The answer is AWS Firewall Manager, the correct choice because it provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an entire AWS Organization. This service enables you to enforce a consistent security posture by deploying AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules across all accounts and VPCs at once, eliminating the need for manual per-account configuration. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of how Firewall Manager differs from standalone services like AWS WAF or Security Groups—it’s the governance layer for multi-account environments, not just a single resource. A common trap is confusing it with AWS WAF alone, but remember that Firewall Manager is the orchestrator, not the rule engine. Memory tip: think “Firewall Manager = the boss that applies rules everywhere,” or simply recall the acronym “F-M-A” for Firewall Manager, Multi-account, All VPCs.
CLF-C02 Security and Compliance Practice Question
This CLF-C02 practice question tests your understanding of security and compliance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which AWS service provides a centrally managed firewall policy that can be applied to multiple AWS accounts and VPCs across an organization?
Why wrong: AWS WAF is a web application firewall — Firewall Manager is the service that deploys and manages WAF (and other firewall) policies centrally across accounts.
B
Amazon GuardDuty
Why wrong: GuardDuty provides threat detection — it doesn't deploy or manage firewall policies.
C
AWS Firewall Manager
Firewall Manager provides centralized management of WAF rules, Shield Advanced protections, security groups, and Network Firewall policies across all accounts in an AWS Organization.
D
AWS Security Hub
Why wrong: Security Hub aggregates security findings — it doesn't deploy firewall policies to protect VPCs and accounts.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Firewall Manager
AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
AWS WAF
Why it's wrong here
AWS WAF is a web application firewall — Firewall Manager is the service that deploys and manages WAF (and other firewall) policies centrally across accounts.
✗
Amazon GuardDuty
Why it's wrong here
GuardDuty provides threat detection — it doesn't deploy or manage firewall policies.
✓
AWS Firewall Manager
Why this is correct
Firewall Manager provides centralized management of WAF rules, Shield Advanced protections, security groups, and Network Firewall policies across all accounts in an AWS Organization.
Related concept
Read the scenario before looking for a memorised answer.
✗
AWS Security Hub
Why it's wrong here
Security Hub aggregates security findings — it doesn't deploy firewall policies to protect VPCs and accounts.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse AWS WAF (a per-resource firewall) with Firewall Manager (a multi-account policy management service), because both involve firewall rules, but Firewall Manager is specifically designed for centralized governance across an organization.
Detailed technical explanation
How to think about this question
Under the hood, AWS Firewall Manager uses AWS Organizations to centrally define and enforce firewall rules, including AWS WAF rule groups, VPC security group rules, and AWS Network Firewall policies. It automatically applies these policies to new accounts and resources as they are added, ensuring consistent protection. A real-world scenario is a multi-account enterprise that needs to enforce a common set of WAF rules (e.g., blocking SQL injection) across all Application Load Balancers in every account, which Firewall Manager handles automatically.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A healthcare organisation deploys an application with a public-facing web tier and a private database tier. The database subnet has no public IP and only accepts connections from the web tier's security group. Questions like this test whether you can design cloud network isolation using VNets/VPCs, subnets, and security group rules.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CLF-C02 question in full detail.
Security and Compliance — This question tests Security and Compliance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: AWS Firewall Manager — AWS Firewall Manager is the correct service because it provides a centralized firewall policy management across multiple accounts and VPCs within an AWS Organization. It allows you to deploy AWS WAF rules, AWS Shield Advanced protections, and VPC security group rules consistently across your entire organization, ensuring a uniform security posture without manual per-account configuration.
What should I do if I get this CLF-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.