CLF-C02 Security and Compliance Practice Question
A security team wants to automatically identify S3 buckets, IAM roles, and other resources in their AWS account that have policies granting access to external AWS accounts or the public internet — including findings they may not be aware of. Which AWS service performs this analysis?
⚠ Common exam trap
A common mix-up: candidates confuse IAM Access Analyzer with Amazon GuardDuty, assuming GuardDuty's threat detection includes policy analysis, but GuardDuty focuses on operational threats (e.g., compromised credentials) rather than static policy evaluation for external access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS IAM Access Analyzer
AWS IAM Access Analyzer is the correct service because it is specifically designed to analyze resource-based policies (such as S3 bucket policies, IAM role trust policies, and KMS key policies) and identify resources that are shared with external AWS accounts or publicly accessible. It generates findings for any policy that grants access to a principal outside of your AWS account, including the public internet, even for resources you may not be aware of. This directly matches the security team's requirement to automatically identify such exposures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty continuously monitors for malicious activity and unauthorized behavior using threat intelligence feeds and machine learning across VPC Flow Logs, DNS logs, and CloudTrail management events. It is designed to detect active intrusions such as port scanning, crypto mining communication, or compromised credentials, not to inspect resource policies for cross-account access. Because it does not parse IAM or resource-based policies to enumerate external grantees, it cannot generate findings for public or external access the way IAM Access Analyzer does.
- ✗
AWS Config
Why it's wrong here
AWS Config tracks configuration history and configuration item changes of AWS resources and evaluates them against compliance rules, such as checking if security groups have unrestricted open ports or if S3 buckets are publicly readable. While custom Config rules could be written to inspect a limited set of policy statements, Config lacks IAM Access Analyzer's automated reasoning engine that systematically identifies granted access from outside the account or organization. Its primary function is recording and evaluating configurations over time, not discovering external access patterns from policy semantics.
- ✓
AWS IAM Access Analyzer
Why this is correct
IAM Access Analyzer uses automated reasoning to analyse resource-based policies and generate findings when resources are accessible from outside the account or organisation. It covers S3 buckets, IAM roles, KMS keys, SQS queues, Lambda functions, and Secrets Manager secrets.
- ✗
Amazon Macie
Why it's wrong here
Amazon Macie uses machine learning and pattern matching to automatically discover and classify sensitive data, such as personally identifiable information, access keys, or financial records, stored in Amazon S3 buckets. Its findings relate to the presence of exposed data itself, not to whether a bucket or other resource policy grants cross-account permissions. Consequently, Macie will not alert you to a policy that allows an external principal to write to a bucket unless that policy is also associated with known sensitive content, making it unsuitable for the external access review in the question.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.