CLF-C02 Security and Compliance Practice Question
Which AWS service helps customers understand the compliance programs that AWS has been validated against, such as PCI DSS, HIPAA, and SOC 2?
⚠ Common exam trap
A common mix-up: candidates confuse services that help with internal compliance posture (like AWS Config or Security Hub) with the service that provides AWS’s own third-party compliance certifications, leading them to pick a wrong answer that sounds compliance-related but does not deliver the actual audit reports.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides on-demand access to AWS’s compliance reports, such as PCI DSS, HIPAA, and SOC 2, as well as the AWS Service Organization Controls (SOC) reports. It allows customers to download and review the specific certifications and attestations that AWS has been validated against, directly supporting audit and compliance needs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor runs automated checks that give you recommendations for cost optimization, performance, security, and service quotas, but it does not host or generate AWS's own compliance certifications. Its reports reflect best-practice advisory guidance rather than auditable evidence of AWS's control environment, so it cannot be used to download SOC, PCI, ISO, or HIPAA documents. For compliance audit reports, you need a service that stores and serves AWS's third-party certification artifacts.
- ✗
AWS Config
Why it's wrong here
AWS Config continuously records resource configuration changes and lets you evaluate those configurations against custom or managed rules, producing a compliance history for your own AWS resources. However, it does not contain AWS's own compliance certifications; instead, it assesses whether your specific resources adhere to policies you define. Therefore, AWS Config would not be the source for requesting AWS's SOC, PCI, ISO, or HIPAA compliance audit reports.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the self-service portal where you can download AWS compliance reports and agreements, including SOC, PCI, ISO, and HIPAA certifications, as well as NDAs and BAAs. It directly serves customers' audit and compliance needs by providing access to AWS's audited documentation and contractual terms. For obtaining AWS's compliance audit reports, AWS Artifact is the correct service because it is specifically designed to distribute these artifacts.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub aggregates security findings from services like GuardDuty, Inspector, and Macie, giving you a consolidated view of security alerts and the compliance posture of your own AWS workload. It does not store or provide the underlying certification documents that AWS itself has obtained, such as SOC or ISO reports. Its role is to help you monitor your environment's security, not to serve as a repository for AWS's internal compliance audit evidence.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.