CLF-C02 Security and Compliance Practice Question
A company uses multiple AWS security services — GuardDuty, Inspector, Macie, and IAM Access Analyzer — across multiple accounts. The security team needs a single console to view, prioritise, and manage all security findings from these services and third-party tools. Which AWS service provides this aggregated view?
⚠ Common exam trap
Watch out — candidates often confuse AWS Security Hub with Amazon GuardDuty or AWS Config, mistakenly thinking that GuardDuty's threat detection or Config's compliance checks already provide a consolidated view, when in fact Security Hub is the dedicated aggregation service that ingests findings from multiple sources.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
AWS Security Hub is the correct service because it provides a single, consolidated view of security alerts and compliance status across multiple AWS accounts and services, including GuardDuty, Inspector, Macie, and IAM Access Analyzer. It aggregates findings from these native services and third-party tools into a standardized format using the AWS Security Finding Format (ASFF), enabling centralized prioritization and management. This directly addresses the requirement for a unified console to view, prioritize, and manage all security findings.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that continuously analyzes VPC Flow Logs, AWS CloudTrail management events, and DNS logs using machine learning to identify malicious behavior. It generates its own findings for threats such as cryptojacking, unauthorized access, or reconnaissance, but it does not ingest or normalize findings from other services. GuardDuty acts as a finding source that Security Hub can aggregate, rather than a central aggregator.
- ✗
Amazon CloudWatch
Why it's wrong here
Amazon CloudWatch is a monitoring and observability service for collecting metrics, logs, and events from infrastructure and applications, enabling operational dashboards and alarms. It does not provide a centralized security finding aggregation layer or support the AWS Security Finding Format (ASFF) to normalize detections from multiple security services. CloudWatch focuses on resource utilization and operational health, not on consolidating threat detections from GuardDuty, Inspector, or Macie.
- ✓
AWS Security Hub
Why this is correct
Security Hub aggregates findings from GuardDuty, Inspector, Macie, IAM Access Analyzer, Firewall Manager, and third-party tools into a unified dashboard. It uses the AWS Security Finding Format (ASFF) to normalise findings and allows centralised management across accounts.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that records resource configuration changes and evaluates them against managed or custom rules to determine compliance with your internal policies. While Security Hub can ingest compliance findings from AWS Config, Config itself does not aggregate or correlate security detections from services like GuardDuty and Inspector. Its purpose is configuration history and compliance auditing, not unified security finding management.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 985-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.