CLF-C02 Security and Compliance Practice Question
Which AWS service is used to centrally manage and enforce policies across multiple AWS accounts in an organization, such as restricting which AWS services member accounts can use?
⚠ Common exam trap
Test-takers frequently confuse IAM policies with SCPs, not realizing that IAM policies are account-specific and cannot enforce restrictions across multiple accounts, while SCPs provide centralized, organization-wide guardrails without granting permissions themselves.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Organizations with Service Control Policies
AWS Organizations with Service Control Policies (SCPs) is the correct service because SCPs enable central governance of the maximum available permissions for all accounts within an organization. SCPs act as a permission guardrail, allowing administrators to restrict which AWS services, actions, and resources member accounts can use, regardless of the IAM policies attached to those accounts. This makes SCPs the appropriate tool for enforcing organization-wide restrictions across multiple accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM policies
Why it's wrong here
AWS IAM policies control permissions for principals (users, roles, and groups) within a single AWS account. Even though IAM policies can be very granular, they cannot be applied across an entire AWS Organizations structure to set a uniform guardrail for every member account. Moreover, IAM policies do not create an organization-wide boundary that overrides the permissions of all accounts; they are scoped to a specific account's identities and resources.
- ✓
AWS Organizations with Service Control Policies
Why this is correct
AWS Organizations with Service Control Policies (SCPs) provide centralized governance by allowing you to define the maximum available permissions for every account in the organization. SCPs act as guardrails that restrict which AWS services, actions, and resources member accounts can use, even if an account's IAM policies allow more. This proactive, organization-wide control is exactly what an administrator needs to enforce consistent security and compliance requirements across all member accounts, making it the correct answer.
- ✗
AWS Config rules
Why it's wrong here
AWS Config rules are designed for continuous compliance auditing, not for proactive prevention. They evaluate resource configurations against desired policies and can trigger remediation actions, but they operate after the fact and do not block an API call or resource change from occurring in the first place. While they can flag non-compliant resources, they lack the enforcement authority to deny or restrict actions across an organization.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning, anomaly detection, and integrated threat intelligence to identify suspicious activity such as crypto mining, credential exfiltration, or compromised EC2 instances. It generates findings and can send alerts, but it has no ability to enforce governance or restrict what actions are permitted in member accounts. GuardDuty observes and detects threats after the fact; it cannot proactively define permission boundaries or prevent account-level actions.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. Which AWS service provides centralized governance and compliance across multiple AWS accounts in an organization?
medium- A.AWS IAM
- B.AWS Config
- ✓ C.AWS Organizations
- D.Amazon Macie
Why C: AWS Organizations is the correct service because it provides centralized governance and compliance across multiple AWS accounts by enabling you to create a hierarchy of accounts with Service Control Policies (SCPs) that centrally control permissions. SCPs allow you to enforce compliance rules, such as restricting the use of specific AWS services or regions, across all accounts in the organization without requiring individual account-level configuration.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.