CLF-C02 Security and Compliance Practice Question
A company suspects that an IAM role used by an EC2 instance has been granted excessive permissions. Which AWS service can generate a policy that includes only the permissions actually used over the last 90 days?
⚠ Common exam trap
Candidates often confuse AWS IAM Access Analyzer's policy generation feature with its external access analysis feature, or mistakenly think AWS Config or Trusted Advisor can generate usage-based policies when they cannot.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Access Analyzer
AWS IAM Access Analyzer can generate a policy based on the access activity recorded in AWS CloudTrail logs over the trailing 90 days. This generated policy includes only the permissions that were actually used by the IAM role, allowing you to replace an overly permissive policy with a least-privilege version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is an advisory tool that inspects your AWS environment against AWS best practices across categories like cost optimization, performance, security, and fault tolerance. For IAM, it can alert you to issues such as missing root account MFA or unused IAM users, but it does not inspect CloudTrail logs to determine which specific API actions a role or user actually invoked. Therefore, it cannot produce a usage-based least-privilege policy.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a continuous security monitoring service that uses threat intelligence and anomaly detection to identify malicious activity, such as compromised credentials or suspicious API calls. It does not perform permission usage analysis of historical CloudTrail logs to recommend reduced IAM permissions. Its purpose is to detect active threats, not to generate or suggest IAM policies based on least privilege.
- ✓
AWS IAM Access Analyzer
Why this is correct
AWS IAM Access Analyzer generates least-privilege policies by analyzing CloudTrail logs and the IAM Access Analyzer findings to determine which permissions were actually used by a role or user over a specified analysis period. You can configure the analysis window, and then IAM Access Analyzer creates a policy containing only the actions that were invoked, helping you replace overly broad policies with precise ones. This directly matches the scenario of leveraging actual usage history to generate replacement policies.
- ✗
AWS Config
Why it's wrong here
AWS Config is a resource configuration tracking and compliance service. While it can evaluate resource configurations (including IAM policies) against managed or custom rules and flag noncompliant policies, it does not analyze a principal's historical API call activity to derive a least-privilege policy. It audits what exists, not what was actually used, so it cannot generate a permission policy based on observed usage patterns.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.