CLF-C02 Security and Compliance Practice Question
A company needs to maintain a secure audit trail of all API calls made against its AWS resources. The audit trail must record the identity of the caller, the time of the call, the source IP address, and the request details. The records must be stored securely with integrity guarantees for a minimum of five years to meet compliance requirements. Which AWS service should the company use to capture and store this information?
⚠ Common exam trap
Many candidates confuse AWS Config's configuration tracking with CloudTrail's API activity logging, or assume GuardDuty's threat detection includes a complete audit trail, when in fact only CloudTrail provides the detailed, integrity-protected record of every API call required for compliance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS CloudTrail
AWS CloudTrail is the correct service because it records all API calls made to AWS services, capturing the identity of the caller, timestamp, source IP address, and request details. It stores these logs in Amazon S3 with server-side encryption and integrity validation via digest files, and can be configured to retain logs for more than five years using lifecycle policies or by archiving to Amazon S3 Glacier.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config is a managed service that assesses, audits, and evaluates the configurations of your AWS resources against recorded desired policies over time. It records configuration changes and resource compliance states as configuration items, but it does not capture the API calls that caused those changes, nor does it provide caller identity, request parameters, or temporal sequencing of activity. For satisfying an audit trail requirement, AWS Config's configuration history and rules can help with configuration compliance, but they cannot substitute for a record of who performed what action via AWS APIs.
When this WOULD be correct
A company needs to track changes to AWS resource configurations and evaluate compliance against internal policies over time. AWS Config would be correct to record configuration history and detect non-compliant resources.
- ✗
Amazon GuardDuty
Why it's wrong here
Amazon GuardDuty is an intelligent threat detection service that continuously monitors for malicious or unauthorized behavior by analyzing data sources such as VPC Flow Logs, DNS logs, and AWS CloudTrail event logs. It uses machine learning and threat intelligence to identify anomalies and generate findings, but it is a consumer of audit logs, not a producer of a complete audit trail. GuardDuty does not record every API call or preserve historical caller information; its purpose is to alert on suspicious activity, not to provide a durable, verifiable account of all API operations.
When this WOULD be correct
A company wants to continuously monitor AWS accounts for malicious or unauthorized behavior, such as unusual API calls or compromised credentials, and needs automated threat detection and alerting.
- ✓
AWS CloudTrail
Why this is correct
AWS CloudTrail is the correct service. It records all API calls made to the AWS environment, including details such as the caller's identity, time of the call, source IP address, and request parameters. The logs can be stored durably in Amazon S3 with integrity validation and can be retained for as long as needed.
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is an online tool that inspects your AWS environment and provides real-time recommendations to help you follow AWS Well-Architected best practices, covering areas like cost optimization, performance, security, fault tolerance, and service limits. It performs read-only checks and offers guidance based on resource configuration and usage metrics, but it does not capture or store API call logs, user identities, or request details. Therefore, Trusted Advisor can inform operational decision-making, but it cannot serve as an audit trail of API activity.
When this WOULD be correct
A company wants to check its AWS account against AWS best practices for security (e.g., whether MFA is enabled on root account, whether security groups allow unrestricted access) and receive actionable recommendations. AWS Trusted Advisor would be the correct service to use.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS CloudTrailCorrect answer▾
Why this is correct
AWS CloudTrail is the correct service. It records all API calls made to the AWS environment, including details such as the caller's identity, time of the call, source IP address, and request parameters. The logs can be stored durably in Amazon S3 with integrity validation and can be retained for as long as needed.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config records resource configuration changes and evaluates compliance, not API call audit trails. It lacks details like caller identity, source IP, and request details required for this question.
★ When this WOULD be the correct answer
A company needs to track changes to AWS resource configurations and evaluate compliance against internal policies over time. AWS Config would be correct to record configuration history and detect non-compliant resources.
Why candidates choose this
Candidates may confuse Config's logging of configuration changes with CloudTrail's API activity logging, or think 'audit trail' broadly includes configuration changes.
✗Amazon GuardDutyWrong answer — click to see why▾
Why this is wrong here
Amazon GuardDuty is a threat detection service that monitors for malicious activity, not a service for capturing and storing API call audit trails with integrity guarantees for compliance.
★ When this WOULD be the correct answer
A company wants to continuously monitor AWS accounts for malicious or unauthorized behavior, such as unusual API calls or compromised credentials, and needs automated threat detection and alerting.
Why candidates choose this
Candidates may confuse GuardDuty's monitoring of API calls for security threats with CloudTrail's comprehensive logging of all API calls for auditing and compliance.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides recommendations for optimizing AWS environments (cost, performance, security, fault tolerance, service limits), but it does not capture or store API call audit trails with caller identity, timestamps, source IP, and request details.
★ When this WOULD be the correct answer
A company wants to check its AWS account against AWS best practices for security (e.g., whether MFA is enabled on root account, whether security groups allow unrestricted access) and receive actionable recommendations. AWS Trusted Advisor would be the correct service to use.
Why candidates choose this
Candidates may think Trusted Advisor provides security auditing because it includes security checks, but they confuse security recommendations with the detailed API activity logging that CloudTrail provides.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A security auditor needs to know which IAM user deleted a specific S3 bucket last week, from which IP address the action was taken, and at what exact time. Which AWS service captures this information?
easy- A.Amazon CloudWatch
- B.AWS Config
- ✓ C.AWS CloudTrail
- D.Amazon GuardDuty
Why C: AWS CloudTrail is the correct service because it records all API calls made to the AWS environment, including S3 bucket deletion actions (DeleteBucket). It captures the identity of the IAM user, the source IP address, and the exact timestamp of each API call, which directly meets the auditor's requirements.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.