CLF-C02 Amazon GuardDuty Practice Question
Which AWS service provides a finding-based security recommendations service that uses AI to identify security threats and anomalies, going beyond simple rule-based Config checks?
⚠ Common exam trap
Candidates may confuse Amazon DevOps Guru's operational anomaly detection with security anomaly detection, but DevOps Guru is not a security service. GuardDuty is the correct security service using AI for threat detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a security monitoring service that uses machine learning to analyze AWS logs (CloudTrail, VPC Flow Logs, DNS) and identifies threats, anomalies, and suspicious behavior. It provides findings and security recommendations, going beyond simple rule-based checks like AWS Config by using AI to detect patterns indicative of security issues. Amazon DevOps Guru focuses on operational health, not security, so it does not match the 'security recommendations' description.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a compliance and resource configuration tracking service, not a security anomaly detector. It continuously records resource configuration changes and evaluates them against AWS-managed or custom rules, flagging noncompliant resources. Its findings are rule-based and deterministic, so it can trigger alarms or remediations, but it never uses ML to identify suspicious behavior or produce security recommendations.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a threat detection service that continuously analyzes AWS CloudTrail management and data events, VPC Flow Logs, and DNS logs using machine learning, anomaly detection, and integrated threat intelligence. It identifies suspicious behavior such as unusual API calls, compromised credentials, cryptocurrency mining, or reconnaissance from known malicious IPs. Findings include a severity level and recommended remediation actions, which makes GuardDuty the service that uses ML for security recommendations.
- ✗
Amazon DevOps Guru
Why it's wrong here
Amazon DevOps Guru is an ML-powered operational service that detects anomalous application behavior, such as high latency, error rates, insufficient capacity, or other performance issues, and then provides recommendations for fixing them. It watches metrics such as CPU utilization and request failures, and while it does use machine learning, its insights are scoped to operational health and availability rather than security threats or attacker activity.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans Amazon EC2 instances, container images, and Lambda functions for software vulnerabilities (CVEs) and unintended network exposure. It compares package versions and network configuration against known signatures and best-practice rules, so its findings are based on vulnerability databases, not ML-based anomaly detection. It does not continuously learn a baseline of normal behavior in an account the way an intelligent threat detection service would.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.