The answer is AWS Trusted Advisor, as it is the service that automatically generates password policy recommendations, reviews IAM users for unused keys and MFA status, and provides a security score to help assess the overall security posture of an AWS account. This works because Trusted Advisor runs a series of best-practice checks across five categories, including security, where it evaluates your password policy against AWS-recommended settings and flags IAM user risks, then aggregates these findings into a single security score that gives you a quick health overview. On the AWS Certified Cloud Practitioner CLF-C02 exam, this question tests your understanding of which service handles automated security assessments rather than manual configuration tools like IAM itself or monitoring services like AWS Config. A common trap is confusing Trusted Advisor with AWS Security Hub, but remember that Security Hub aggregates findings from multiple services, while Trusted Advisor directly generates the password policy checks, IAM user reviews, and the security score. Memory tip: think of Trusted Advisor as your “security scorekeeper” that checks your password and IAM users for you.
CLF-C02 Security and Compliance Practice Question
This CLF-C02 practice question tests your understanding of security and compliance. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
Which AWS service automatically generates password policies, reviews IAM users, and provides a security score to help assess the security posture of an AWS account?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Trusted Advisor
AWS Trusted Advisor is the correct service because it provides automated checks that include password policy recommendations (e.g., minimum length, expiration), IAM user reviews (e.g., unused keys, MFA status), and a security score that aggregates findings to assess overall account security posture. This directly matches the question's description of generating password policies, reviewing IAM users, and providing a security score.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Amazon GuardDuty
Why it's wrong here
GuardDuty detects active threats — it doesn't generate security scores or review IAM credential configuration.
✓
AWS Trusted Advisor
Why this is correct
Trusted Advisor's security checks evaluate MFA on root, IAM password policies, access key rotation, and other security configurations, providing color-coded security recommendations.
Related concept
Read the scenario before looking for a memorised answer.
✗
Amazon Inspector
Why it's wrong here
Inspector scans for software vulnerabilities in EC2 and containers — it doesn't provide account-level security scoring.
✗
Amazon Macie
Why it's wrong here
Macie discovers sensitive data in S3 — it doesn't provide IAM credential reviews or security scores.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse AWS Trusted Advisor's security checks with Amazon Inspector's vulnerability scanning, because both have 'security' in their descriptions, but Inspector focuses on EC2/container vulnerabilities while Trusted Advisor handles account-level IAM and password policy reviews.
Detailed technical explanation
How to think about this question
Trusted Advisor runs over 100 checks across categories like cost optimization, performance, security, and fault tolerance. For security, it specifically checks IAM password policies against AWS-recommended settings (e.g., requiring at least one uppercase letter, one number, and a minimum length of 14 characters) and flags IAM users with unused access keys older than 90 days. The security score is calculated as a percentage of passed checks out of total applicable checks, updated in near real-time via the AWS Support API.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
Related glossary terms
Concepts from this question explained
These glossary pages explain the core terms tested in this CLF-C02 question in full detail.
Security and Compliance — This question tests Security and Compliance — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: AWS Trusted Advisor — AWS Trusted Advisor is the correct service because it provides automated checks that include password policy recommendations (e.g., minimum length, expiration), IAM user reviews (e.g., unused keys, MFA status), and a security score that aggregates findings to assess overall account security posture. This directly matches the question's description of generating password policies, reviewing IAM users, and providing a security score.
What should I do if I get this CLF-C02 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.