CLF-C02 Security and Compliance Practice Question
A company's compliance team needs to know which AWS resources are not compliant with the company's tagging policy (all resources must have a 'CostCenter' tag). Which AWS service can continuously evaluate and report on this compliance?
⚠ Common exam trap
Many candidates confuse AWS Config (configuration compliance) with AWS CloudTrail (API auditing) or Amazon CloudWatch (performance monitoring), assuming any 'monitoring' service can handle tag compliance, but only AWS Config provides continuous, rule-based evaluation of resource configurations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config with the required-tags rule
AWS Config with the managed 'required-tags' rule can continuously evaluate whether resources have the specified tag (e.g., 'CostCenter') and report non-compliant resources. AWS Config records configuration changes, evaluates them against rules, and provides a compliance dashboard and notifications via Amazon SNS, making it the correct service for ongoing compliance monitoring.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is designed for operational monitoring—metrics, logs, alarms, and dashboards—rather than resource configuration assessment. It cannot inspect the tag metadata attached to EC2 instances, S3 buckets, or other resources to determine whether a CostCenter tag exists. CloudWatch might alert on application performance or infrastructure health, but it has no mechanism to report tag absence as a compliance finding.
- ✓
AWS Config with the required-tags rule
Why this is correct
AWS Config with the required-tags rule is the correct choice because this service continuously records resource configuration changes and runs managed rules against them. The required-tags rule specifically checks for the presence of user-specified tag keys (e.g., CostCenter, Environment, Owner) and reports any resource lacking those tags as non-compliant. Unlike other options, AWS Config evaluates the current tag state across supported AWS resources, not just at creation time, and can trigger remediation actions automatically.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is not the right answer because although it provides cost optimization and security recommendations, it does not offer a customizable, continuous compliance evaluation for arbitrary tag key requirements. Its existing checks related to tags are limited in scope and do not flag every resource missing a specific tag across all resource types. Trusted Advisor gives point-in-time recommendations based on best practices, not ongoing configuration compliance.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity such as who created an EC2 instance or whether tags were included in that Create operation, but it does not evaluate the current configuration of resources after they exist. A resource might be created with the correct tags and later have them removed, and CloudTrail alone would not detect that current non-compliance. CloudTrail is an audit trail of actions, not a configuration compliance service.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.