CLF-C02 Security and Compliance Practice Question
Which AWS service provides a central place to manage security alerts and automate compliance checks across an AWS Organization?
⚠ Common exam trap
Many exam-takers confuse AWS Security Hub with Amazon GuardDuty, thinking that GuardDuty's threat detection and alerting also covers compliance checks and centralized management of all security alerts, but GuardDuty only handles threat detection findings and lacks the multi-service aggregation and compliance automation that Security Hub provides.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
AWS Security Hub is the correct answer because it provides a single, central location for aggregating, organizing, and prioritizing security alerts (findings) from multiple AWS services (like Amazon GuardDuty, Amazon Inspector, and AWS Macie) and third-party tools. It also enables automated compliance checks against standards such as CIS AWS Foundations, PCI DSS, and AWS Foundational Security Best Practices across all accounts in an AWS Organization, using built-in or custom controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously analyzes VPC Flow Logs, DNS query logs, and AWS CloudTrail management events to identify malicious and unauthorized behavior. However, it acts as a single source of findings—it does not ingest or aggregate alerts from other security services such as Amazon Inspector, Macie, or third-party tools. Consequently, GuardDuty alone cannot provide the consolidated multi-service view and automated compliance framework checks described in the scenario.
- ✓
AWS Security Hub
Why this is correct
AWS Security Hub is a cloud security posture management (CSPM) service that aggregates high-priority security findings from multiple AWS services, including GuardDuty, Inspector, Macie, Firewall Manager, and from partner products, into a single standardized format. It also runs continuous automated compliance checks against industry standards and best practices like CIS AWS Foundations, NIST SP 800-53, and PCI DSS, producing a cross-account, cross-service scorecard. This dual capability—findings aggregation plus compliance standard checks—makes Security Hub exactly the right tool for the organization's requirements.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects accounts and gives real-time recommendations in broad categories such as cost optimization, performance, security, fault tolerance, and service limits. Although it includes some security checks (for example, open security groups or missing MFA on the root account), it does not aggregate threat findings from security services nor evaluate compliance against frameworks like CIS or NIST. It is an advisory best-practice tool, not a centralized security findings aggregator, so it does not fulfill the stated need.
- ✗
AWS Config
Why it's wrong here
AWS Config records the configuration state of AWS resources over time and evaluates those configurations against desired rules that you define, enabling change tracking, resource inventory, and configuration-based compliance. While it can flag non-compliant resource configurations and trigger remediation, it does not gather threat intelligence, correlate suspicious activity, or aggregate findings from detection services like GuardDuty or Inspector. Its focus is configuration history and drift, not consolidated threat detection or security-standard compliance checks across multiple services.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?
medium- A.AWS Trusted Advisor
- ✓ B.AWS Security Hub
- C.AWS Systems Manager
- D.Amazon Detective
Why B: AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.
Variation 2. A company uses Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scanning, and Amazon Macie for sensitive data discovery. The security team needs a centralized dashboard that aggregates findings from all these services, provides a security score, and tracks compliance against industry standards such as CIS AWS Foundations. Which AWS service should the security team use?
medium- A.AWS Config
- ✓ B.AWS Security Hub
- C.Amazon Detective
- D.AWS Trusted Advisor
Why B: AWS Security Hub is the correct service because it provides a centralized dashboard that aggregates findings from multiple AWS security services, including GuardDuty, Inspector, and Macie. It also offers a consolidated security score and supports automated compliance checks against standards like CIS AWS Foundations, making it the ideal choice for this use case.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.