CLF-C02 Security and Compliance Practice Question
A company has enabled Amazon GuardDuty for threat detection, Amazon Inspector for vulnerability scans, and AWS Config for compliance checks. The security team wants a single, centralized dashboard that aggregates all security findings from these services, provides a consolidated security score, and allows them to automate remediation workflows. Which AWS service should the team use?
⚠ Common exam trap
It's easy for candidates to confuse AWS Security Hub with AWS Trusted Advisor, thinking both provide security recommendations, but Trusted Advisor lacks the ability to aggregate findings from multiple security services or provide a consolidated security score and automated remediation workflows.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Hub
AWS Security Hub is designed to aggregate findings from multiple AWS security services, including GuardDuty, Inspector, and Config, into a single dashboard. It provides a consolidated security score (via the security standards framework) and supports automated remediation through integration with AWS Systems Manager and EventBridge. This makes it the correct choice for centralized security visibility and response.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor inspects your AWS environment and provides recommendations on cost optimization, performance, security, and fault tolerance. However, it does not aggregate findings from other security services like GuardDuty, Inspector, or Config into a single dashboard with a security score. It is not designed for central aggregation of third-party findings.
When this WOULD be correct
A company wants a service that provides real-time guidance to help provision resources following AWS best practices, including cost optimization, performance, security, and fault tolerance checks, without needing to aggregate findings from multiple security services.
- ✓
AWS Security Hub
Why this is correct
AWS Security Hub is the correct service. It provides a comprehensive view of security alerts and compliance status across AWS accounts. It integrates with services like GuardDuty, Inspector, and Config, aggregates findings, generates a consolidated security score, and supports automated remediation through AWS Config rules and custom actions.
- ✗
AWS Systems Manager
Why it's wrong here
AWS Systems Manager is an operations management service that helps you view and control your infrastructure on AWS. It provides capabilities for patching, automation, and inventory management, but it does not aggregate security findings from multiple security services or provide a security score. It is not a security dashboard.
When this WOULD be correct
A company needs to automate patching of EC2 instances based on patch compliance reports, centralize operational data across AWS resources, and run automation runbooks for common IT tasks. In that scenario, AWS Systems Manager (with Patch Manager, State Manager, and Automation) would be the correct answer.
- ✗
Amazon Detective
Why it's wrong here
Amazon Detective is an investigation service that analyzes and visualizes security data to quickly identify the root cause of potential security issues. It can ingest findings from GuardDuty and other sources, but its primary purpose is deep investigative analysis, not providing a centralized dashboard with a consolidated security score or aggregated view of all findings across multiple services.
When this WOULD be correct
A security team needs to analyze and visualize the root cause of suspicious activities identified by GuardDuty, Inspector, and other sources, requiring a service that helps conduct forensic investigations and understand the scope of security incidents.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Security HubCorrect answer▾
Why this is correct
AWS Security Hub is the correct service. It provides a comprehensive view of security alerts and compliance status across AWS accounts. It integrates with services like GuardDuty, Inspector, and Config, aggregates findings, generates a consolidated security score, and supports automated remediation through AWS Config rules and custom actions.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides best-practice recommendations for cost optimization, performance, security, and fault tolerance, but it does not aggregate findings from GuardDuty, Inspector, and Config into a single dashboard with a consolidated security score and automated remediation workflows.
★ When this WOULD be the correct answer
A company wants a service that provides real-time guidance to help provision resources following AWS best practices, including cost optimization, performance, security, and fault tolerance checks, without needing to aggregate findings from multiple security services.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with Security Hub's centralized security findings, assuming Trusted Advisor can aggregate and score security data from other services.
✗AWS Systems ManagerWrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager is an operations hub for managing EC2 and on-premises resources, patching, and automation, but it does not aggregate security findings from GuardDuty, Inspector, and Config into a single dashboard with a consolidated security score.
★ When this WOULD be the correct answer
A company needs to automate patching of EC2 instances based on patch compliance reports, centralize operational data across AWS resources, and run automation runbooks for common IT tasks. In that scenario, AWS Systems Manager (with Patch Manager, State Manager, and Automation) would be the correct answer.
Why candidates choose this
Candidates may confuse Systems Manager's automation capabilities (e.g., running scripts or remediation actions) with Security Hub's security-specific automation, or they may think 'centralized dashboard' refers to Systems Manager's Fleet Manager or OpsCenter.
✗Amazon DetectiveWrong answer — click to see why▾
Why this is wrong here
Amazon Detective is designed for in-depth investigation of security findings, not for aggregating findings from multiple services into a single dashboard or providing a consolidated security score.
★ When this WOULD be the correct answer
A security team needs to analyze and visualize the root cause of suspicious activities identified by GuardDuty, Inspector, and other sources, requiring a service that helps conduct forensic investigations and understand the scope of security incidents.
Why candidates choose this
Candidates may confuse Detective's investigative capabilities with Security Hub's aggregation and dashboard features, assuming that 'detective' implies a central view of all security data.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.