CLF-C02 Cloud Concepts Practice Question
A company wants to migrate their on-premises applications to AWS but is concerned about losing visibility into their infrastructure. Which AWS service provides a centralized inventory of all AWS resources and tracks configuration changes over time?
⚠ Common exam trap
Candidates often confuse AWS Config with AWS CloudTrail, mistakenly thinking CloudTrail's API logging provides configuration tracking, but CloudTrail only records who made the call, not the resulting configuration state or history.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides a centralized inventory of all AWS resources and continuously tracks configuration changes over time. It enables you to assess, audit, and evaluate the configurations of your AWS resources against desired policies, giving you full visibility into infrastructure state and history.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
CloudTrail records API calls — who did what and when. Config records what the resource configuration state is over time. Both are complementary: CloudTrail answers 'who changed it?' while Config answers 'what was changed to?'
- ✓
AWS Config
Why this is correct
AWS Config is the correct service because it continuously records the configuration state of supported AWS resources, maintaining a complete inventory with historical snapshots and configuration items that document every change. It enables compliance evaluation against desired policies, tracks configuration drift, and maps relationships between resources—such as which security group is attached to which EC2 instance. Unlike operational monitoring tools, Config is purpose-built for configuration governance and change management across nearly all AWS services.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is incorrect because it focuses on operational telemetry—collecting and visualizing metrics, logs, and events from AWS resources and applications—rather than tracking the configuration state or history of the resources themselves. CloudWatch alarms and dashboards help you monitor performance indicators like CPU utilization or error rates, but they do not provide a resource inventory, configuration history, or compliance evaluation. While CloudWatch can detect a change in a metric, it cannot tell you what a resource's configuration was at a specific point in time.
- ✗
AWS Systems Manager Inventory
Why it's wrong here
AWS Systems Manager Inventory is not the right choice because its scope is limited to managed instances—specifically EC2 instances and on-premises servers that have the Systems Manager agent installed. It collects metadata such as installed applications, OS versions, network configurations, and patch status, but it does not track configuration details for broad AWS services like S3 buckets, IAM policies, or VPC resources. This agent-based tool answers 'what software and settings are on my servers?' but not 'what is the configuration state of my entire AWS infrastructure?'
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.