CLF-C02 Security and Compliance Practice Question
A company has internal security policies that require all Amazon S3 buckets to be private (not publicly accessible) and all Amazon EC2 security groups to restrict inbound SSH traffic to a specific IP range. The security team needs to continuously monitor all AWS resources across their account to detect any resource that violates these policies. They also need a historical record of configuration changes and a compliance dashboard that shows overall pass/fail status. Which AWS service should the security team use to meet these requirements?
⚠ Common exam trap
A common mix-up: candidates confuse AWS CloudTrail (which logs API calls) with AWS Config (which tracks resource configuration state and compliance), leading them to choose CloudTrail because they think 'historical record of changes' refers to API logs rather than configuration item snapshots.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Config
AWS Config is the correct service because it provides continuous monitoring, compliance auditing, and historical recording of configuration changes for AWS resources. It allows you to define rules (e.g., 's3-bucket-public-read-prohibited' and 'restricted-ssh') that automatically evaluate your S3 bucket policies and EC2 security group rules against your security policies, and it offers a compliance dashboard showing pass/fail status for each resource. AWS Config also maintains a configuration history that can be used for auditing and troubleshooting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Config
Why this is correct
AWS Config is the only service that continuously records and evaluates S3 bucket configurations against managed or custom compliance rules, such as enforced bucket policies, encryption settings, or lifecycle rules. It provides a compliance dashboard that shows whether each bucket is compliant or noncompliant with your internal policy, and it maintains a full configuration history for auditing. This makes it the correct choice for an internal policy requiring all S3 buckets to meet specific configuration standards.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail records API activity (who made what call, when, from where) but does not evaluate the actual configuration of resources against policies. It is not designed for compliance rule evaluation or a compliance dashboard.
When this WOULD be correct
A company needs to audit all API calls made in their AWS account to detect unauthorized access or changes, and they require a record of who made what change and when. AWS CloudTrail would be the correct service to meet these requirements.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is a threat detection service that uses machine learning to identify malicious or unauthorized behavior, such as unusual API calls or compromised instances. It does not evaluate resource configurations for compliance with internal policies.
When this WOULD be correct
A company needs to continuously monitor AWS accounts for malicious or unauthorized behavior, such as unusual API calls, compromised instances, or crypto mining activity. They require automated threat detection and findings that can be integrated with incident response workflows.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure. It does not evaluate resource configurations against custom compliance rules or provide a compliance dashboard for resources like S3 bucket policies or security group rules.
When this WOULD be correct
A company needs to automatically assess EC2 instances for known software vulnerabilities and unintended network access, and requires a report of findings with severity levels. Amazon Inspector would be the correct service to perform these vulnerability scans.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ConfigCorrect answer▾
Why this is correct
AWS Config is the only service that continuously records and evaluates S3 bucket configurations against managed or custom compliance rules, such as enforced bucket policies, encryption settings, or lifecycle rules. It provides a compliance dashboard that shows whether each bucket is compliant or noncompliant with your internal policy, and it maintains a full configuration history for auditing. This makes it the correct choice for an internal policy requiring all S3 buckets to meet specific configuration standards.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail records API activity and provides audit logs, but it does not continuously evaluate resource configurations against policies, nor does it provide a compliance dashboard or historical configuration tracking for S3 bucket policies or EC2 security group rules.
★ When this WOULD be the correct answer
A company needs to audit all API calls made in their AWS account to detect unauthorized access or changes, and they require a record of who made what change and when. AWS CloudTrail would be the correct service to meet these requirements.
Why candidates choose this
Candidates may confuse CloudTrail's logging of API calls with the configuration compliance and monitoring capabilities of AWS Config, assuming that tracking changes via API logs is sufficient for policy enforcement.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity, not for compliance with internal policies like S3 bucket public access or EC2 security group rules. It does not provide a compliance dashboard or historical configuration change tracking.
★ When this WOULD be the correct answer
A company needs to continuously monitor AWS accounts for malicious or unauthorized behavior, such as unusual API calls, compromised instances, or crypto mining activity. They require automated threat detection and findings that can be integrated with incident response workflows.
Why candidates choose this
Candidates may confuse GuardDuty's monitoring capabilities with compliance monitoring, or assume that any security-related service can enforce policies and track configuration changes.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, but it does not provide continuous compliance monitoring, a historical record of configuration changes, or a compliance dashboard for pass/fail status against custom policies.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for known software vulnerabilities and unintended network access, and requires a report of findings with severity levels. Amazon Inspector would be the correct service to perform these vulnerability scans.
Why candidates choose this
Candidates may confuse Inspector's security assessment capabilities with compliance monitoring, or assume it can enforce policies like restricting SSH access, when it actually focuses on vulnerability scanning rather than configuration compliance tracking.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?
medium- A.AWS Trusted Advisor
- B.Amazon GuardDuty
- ✓ C.AWS Config
- D.Amazon Inspector
Why C: AWS Config is the correct service because it provides continuous monitoring and evaluation of AWS resource configurations against desired rules. You can create a custom AWS Config rule to check that all EC2 instances have the tag 'Environment=Production' and are associated with the security group 'Prod-SG'. When a resource becomes non-compliant, AWS Config can trigger an Amazon SNS notification to alert the IT team.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.