CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Amazon CloudWatch Logs with metric filters

  Why it's wrong here

  Amazon CloudWatch Logs with metric filters lets you monitor log data for specific patterns and create alarms based on those metrics, but it does not capture IAM-level API calls or provide a verifiable, tamper-proof audit trail. The logs themselves are not protected by CloudTrail's signed digest-chain mechanism, so you cannot cryptographically prove they were not modified after ingestion. This approach is for operational observability, not for demonstrating API accountability to an auditor.

• ✓

  AWS CloudTrail with Log File Integrity Validation enabled

  Why this is correct

  AWS CloudTrail with Log File Integrity Validation enabled records all management API calls into log files and additionally creates a chain of cryptographically signed digest files—each containing the SHA-256 hash of the previous digest and the log file's hash—making it possible to detect any alteration, deletion, or forgery of logs. The digest chain is signed with CloudTrail's private key, and the corresponding public key is available from AWS, allowing anyone to verify the integrity of the entire log trail. This is the only option that both captures API activity and provides cryptographic proof of log integrity.

• ✗

  AWS Config with conformance packs

  Why it's wrong here

  AWS Config conformance packs group multiple Config rules and remediation actions designed to assess how well your resources comply with internal or external security standards, such as requiring tags or restricting public S3 access. Config does not record who performed an API action or when, and it offers no cryptographic integrity validation on an audit log—so it cannot prove that a historical set of API records was not tampered with. Its purpose is compliance state management and drift detection, not API-level audit evidence.

• ✗

  VPC Flow Logs stored in S3

  Why it's wrong here

  VPC Flow Logs capture network traffic metadata like source and destination IP addresses, ports, and packet counts—not the identity of the user or service making API calls, nor the API operation itself. While you can store these logs in S3, they lack any cryptographic digest chain or signed hash, so auditors cannot verify they have not been altered or deleted. This option records network activity, not management API activity, so it does not meet the requirement.

Go deeper

Related to this question