CLF-C02 Security and Compliance Practice Question
A company wants to automatically evaluate its AWS resource configurations against internal security policies. The company has defined rules such as 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'. They need a service that continuously monitors resource configurations, identifies noncompliant resources, and provides a dashboard of compliance status over time. Which AWS service should the company use?
⚠ Common exam trap
Watch out — candidates often confuse AWS Config's configuration compliance monitoring with Amazon Inspector's vulnerability scanning or Trusted Advisor's best-practice checks, leading candidates to choose a service that does not support custom rule definitions or continuous compliance dashboards.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it continuously monitors and records AWS resource configurations, evaluates them against custom rules (like 'EBS volumes must be encrypted' and 'S3 buckets must not be publicly accessible'), and provides a compliance dashboard that shows historical compliance status over time. It directly addresses the need for automated, ongoing evaluation of resource configurations against internal security policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config is a managed service that continuously records resource configurations as configuration items and evaluates them against rules you define, such as requiring EBS volumes to be encrypted or S3 buckets to be private. It provides a compliance dashboard, historical configuration timelines, and can trigger automatic remediation and SNS notifications when a resource becomes noncompliant. This makes it the correct answer because it is purpose-built for evaluating AWS resource configurations against specific compliance and security policies over time.
- ✗
Amazon Inspector
Why it's wrong here
Incorrect. Amazon Inspector is an automated vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not evaluate resource configurations against custom security policies like 'EBS volumes must be encrypted'.
When this WOULD be correct
A company wants to automatically assess EC2 instances for common software vulnerabilities and network exposures, and receive a detailed report of findings with remediation guidance.
- ✗
AWS Trusted Advisor
Why it's wrong here
Incorrect. AWS Trusted Advisor provides best practice checks and recommendations across five categories, including security. However, it does not continuously monitor resource configurations against custom rules defined by the customer, nor does it maintain a compliance status dashboard over time.
When this WOULD be correct
A company wants a service that automatically checks their AWS account against AWS best practices (e.g., cost optimization, performance, security) and provides recommendations to improve their environment. They need a high-level overview of potential issues without defining custom rules.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail is an auditing service that records every API call made in your AWS account, capturing details such as the identity of the caller, the source IP address, and the request parameters. However, it does not assess whether the resulting resource configuration meets any defined security or encryption policy, and it has no rules engine to determine if an S3 bucket is public or if an EBS volume is encrypted. Thus, CloudTrail is incorrect for this scenario because it provides an operational audit trail of actions taken, not continuous configuration compliance monitoring.
When this WOULD be correct
A company needs to audit all API calls made to the AWS environment, track changes to resources, and detect unauthorized access or anomalous activity for security investigation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config is a managed service that continuously records resource configurations as configuration items and evaluates them against rules you define, such as requiring EBS volumes to be encrypted or S3 buckets to be private. It provides a compliance dashboard, historical configuration timelines, and can trigger automatic remediation and SNS notifications when a resource becomes noncompliant. This makes it the correct answer because it is purpose-built for evaluating AWS resource configurations against specific compliance and security policies over time.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not for evaluating resource configurations against internal security policies like encryption or public access settings.
★ When this WOULD be the correct answer
A company wants to automatically assess EC2 instances for common software vulnerabilities and network exposures, and receive a detailed report of findings with remediation guidance.
Why candidates choose this
Candidates may confuse 'security assessment' with 'configuration compliance', assuming Inspector covers all security checks, including resource configuration rules.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice checks and recommendations, but it does not continuously monitor resource configurations against custom internal policies or provide a compliance dashboard over time; it focuses on AWS-recommended best practices, not user-defined rules.
★ When this WOULD be the correct answer
A company wants a service that automatically checks their AWS account against AWS best practices (e.g., cost optimization, performance, security) and provides recommendations to improve their environment. They need a high-level overview of potential issues without defining custom rules.
Why candidates choose this
Candidates may confuse Trusted Advisor's best-practice checks with compliance monitoring, assuming it can evaluate custom policies, or they may think its dashboard provides the required compliance status tracking.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail records API activity for auditing, but it does not evaluate resource configurations against rules or provide a compliance dashboard for resource settings like encryption or public access.
★ When this WOULD be the correct answer
A company needs to audit all API calls made to the AWS environment, track changes to resources, and detect unauthorized access or anomalous activity for security investigation.
Why candidates choose this
Candidates may confuse CloudTrail's logging of API calls with the configuration monitoring and compliance evaluation provided by AWS Config, as both are related to governance and security.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.