CLF-C02 Security and Compliance Practice Question
Which AWS service provides managed threat detection that analyzes VPC Flow Logs, AWS CloudTrail events, and DNS logs to identify malicious activity and unauthorized behavior?
⚠ Common exam trap
Many exam-takers confuse AWS Security Hub (a central dashboard for findings) with GuardDuty (the actual threat detection engine), or assume Amazon Inspector performs network traffic analysis when it only scans for software vulnerabilities and network reachability.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing VPC Flow Logs, AWS CloudTrail event logs, and DNS logs. It uses machine learning, anomaly detection, and integrated threat intelligence to identify threats such as credential compromise, cryptocurrency mining, and API abuse without requiring additional security software or infrastructure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub is a central security posture management and aggregation service that collects findings from GuardDuty, Inspector, Macie, and AWS Config rules into a single dashboard. It does not generate the underlying threat-detection findings itself, so enabling Security Hub without GuardDuty leaves no behavioral analysis of VPC Flow Logs or CloudTrail data. The question asks for the service that performs the detection, not one that consolidates detection results.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is an automated vulnerability management service that scans EC2 instances, Amazon ECR container images, and Lambda functions for software vulnerabilities and unintentional network exposure. It is not designed to continually analyze AWS account activity, CloudTrail API calls, or VPC Flow Logs for signs of an active compromise. Inspector's findings focus on known CVEs and configuration weaknesses, whereas the threat described in the scenario is an ongoing behavioral threat.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a continuous, intelligent threat-detection service that uses machine learning, anomaly detection, and integrated threat intelligence to monitor AWS CloudTrail management events, VPC Flow Logs, and DNS query logs. It can alert on compromised EC2 instances, malicious domains, port scanning, and unusual API call patterns that indicate account takeover or insider misuse. Because it directly analyzes these raw data sources for active threats, it is the correct service for this type of detection.
- ✗
AWS Config
Why it's wrong here
AWS Config is a compliance and configuration management service that records resource configuration changes and evaluates them against managed or custom rules, such as required tagging or restricted security groups. It does not inspect network traffic, DNS queries, or CloudTrail events for behavioral anomalies; its scope is resource state and configuration drift. Thus, while AWS Config can detect noncompliant configurations, it cannot identify an active attacker or a compromised instance's communications.
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.