CLF-C02 Security and Compliance Practice Question
A company has a strict security policy requiring that no Amazon S3 bucket or IAM role should be accessible to external AWS accounts unless explicitly approved. The security team needs a service that continuously analyzes resource-based policies and can generate findings when an S3 bucket policy allows access to a principal from outside the company's AWS Organization. Which AWS service should the team use?
⚠ Common exam trap
Many candidates confuse AWS Config (which audits resource configurations) with IAM Access Analyzer (which specifically analyzes resource-based policies for cross-account access), leading them to choose AWS Config for a use case that requires policy-level access analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IAM Access Analyzer
IAM Access Analyzer is designed to continuously analyze resource-based policies (such as S3 bucket policies and IAM role trust policies) and generate findings when access is granted to principals outside of the trusted AWS Organization. It uses zone of trust logic to identify policies that allow access to external AWS accounts, making it the correct service for this security requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config evaluates resource configurations against rules and can detect changes, but it does not specifically analyze resource-based policies to identify if they grant access to external principals. It is not the primary tool for this requirement.
When this WOULD be correct
A company needs to automatically remediate S3 buckets that are publicly accessible. AWS Config with a managed rule like 's3-bucket-public-read-prohibited' can detect noncompliant buckets and trigger remediation actions.
- ✓
IAM Access Analyzer
Why this is correct
IAM Access Analyzer continuously analyzes resource-based policies and generates findings when a resource is accessible from outside the AWS Organization. This matches the requirement of detecting unintended external access to S3 buckets and IAM roles.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor provides recommendations across cost, performance, security, and fault tolerance, including some checks for security group rules and IAM use. However, it does not continuously monitor resource-level policies for external access and does not generate findings for unintended sharing.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning and anomaly detection to monitor for malicious activity, such as compromised EC2 instances, suspicious API calls, or crypto-mining behavior. It does not inspect resource-based policies (like S3 bucket policies or IAM role trust policies) to determine whether they grant access to external principals. GuardDuty focuses on operational threat signals—DNS queries, VPC flow logs, and CloudTrail management events—not on static permission definitions. Therefore, it cannot detect the unintended external access pattern described in the policy requirement.
When this WOULD be correct
An exam scenario where GuardDuty would be correct: A company needs to detect suspicious API calls or potential compromise of AWS credentials within their account, such as unusual S3 bucket access patterns or unauthorized IAM role usage from external IPs.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓IAM Access AnalyzerCorrect answer▾
Why this is correct
IAM Access Analyzer continuously analyzes resource-based policies and generates findings when a resource is accessible from outside the AWS Organization. This matches the requirement of detecting unintended external access to S3 buckets and IAM roles.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config evaluates resource compliance against rules but does not analyze resource-based policies for cross-account access. It cannot detect S3 bucket policies granting access to principals outside the AWS Organization.
★ When this WOULD be the correct answer
A company needs to automatically remediate S3 buckets that are publicly accessible. AWS Config with a managed rule like 's3-bucket-public-read-prohibited' can detect noncompliant buckets and trigger remediation actions.
Why candidates choose this
Candidates may confuse AWS Config's compliance monitoring with IAM Access Analyzer's policy analysis, assuming Config can also check for cross-account access in resource policies.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity and unauthorized behavior, not for analyzing resource-based policies for cross-account access. It does not generate findings based on S3 bucket policies allowing external principals.
★ When this WOULD be the correct answer
An exam scenario where GuardDuty would be correct: A company needs to detect suspicious API calls or potential compromise of AWS credentials within their account, such as unusual S3 bucket access patterns or unauthorized IAM role usage from external IPs.
Why candidates choose this
Candidates may confuse GuardDuty's security monitoring capabilities with policy analysis, assuming it can detect any security misconfiguration including overly permissive S3 bucket policies.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.