CLF-C02 Security and Compliance Practice Question
A company is preparing for a PCI DSS compliance audit. The security team needs to ensure that all AWS API calls are logged and that the logs are continuously analyzed for suspicious or unauthorized activity. The team wants a managed security service that uses machine learning to identify threats, generates findings for review, and can trigger automated remediation through AWS Lambda. Which AWS service should the team use?
⚠ Common exam trap
Candidates often confuse AWS CloudTrail's logging capability with GuardDuty's threat detection, overlooking that CloudTrail alone does not analyze logs or trigger automated responses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Amazon GuardDuty
Amazon GuardDuty is a managed threat detection service that uses machine learning and integrated threat intelligence to continuously monitor AWS API calls (via CloudTrail), VPC Flow Logs, and DNS logs for suspicious activity. It generates actionable security findings and can trigger automated remediation through AWS Lambda, making it the correct choice for the described requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudTrail
Why it's wrong here
AWS CloudTrail logs all API calls made to the AWS environment, which is necessary for audit trails, but it does not analyze logs for threats or use machine learning to detect suspicious activity. It is a logging service, not a threat detection service.
When this WOULD be correct
A question that asks for a service to record API activity for auditing, compliance, and governance, without requiring threat detection or automated response, would make CloudTrail the correct answer.
- ✓
Amazon GuardDuty
Why this is correct
Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning and integrated threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs, generates findings, and can trigger automated responses through AWS Lambda, meeting all the requirements.
- ✗
AWS Config
Why it's wrong here
AWS Config is a service that evaluates your resource configurations against desired policies and tracks changes over time. It does not analyze API call logs for suspicious activity and does not use machine learning for threat detection.
When this WOULD be correct
A company needs to continuously monitor and record changes to AWS resource configurations, ensuring compliance with internal policies and auditing standards. They want automated checks for configuration drift and the ability to trigger remediation via AWS Lambda when non-compliant changes occur.
- ✗
Amazon Inspector
Why it's wrong here
Amazon Inspector is a vulnerability assessment service that scans EC2 instances and container images for software vulnerabilities and network exposure. It does not analyze AWS API calls or monitor for unauthorized activity in CloudTrail logs.
When this WOULD be correct
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and deviations from security best practices, with findings reported for remediation. Amazon Inspector would be the correct choice.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Amazon GuardDutyCorrect answer▾
Why this is correct
Amazon GuardDuty is a managed threat detection service that continuously monitors for malicious or unauthorized behavior using machine learning and integrated threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs, generates findings, and can trigger automated responses through AWS Lambda, meeting all the requirements.
✗AWS CloudTrailWrong answer — click to see why▾
Why this is wrong here
AWS CloudTrail logs API calls but does not provide continuous analysis with machine learning to identify threats or generate findings for automated remediation.
★ When this WOULD be the correct answer
A question that asks for a service to record API activity for auditing, compliance, and governance, without requiring threat detection or automated response, would make CloudTrail the correct answer.
Why candidates choose this
Candidates may confuse CloudTrail's logging capability with the threat detection and automated response features that GuardDuty provides, assuming that logging alone satisfies the security monitoring requirement.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is a service for evaluating resource configurations against desired policies, not for continuous threat detection or analyzing API call logs for suspicious activity. It does not use machine learning to identify threats or generate findings for security incidents.
★ When this WOULD be the correct answer
A company needs to continuously monitor and record changes to AWS resource configurations, ensuring compliance with internal policies and auditing standards. They want automated checks for configuration drift and the ability to trigger remediation via AWS Lambda when non-compliant changes occur.
Why candidates choose this
Candidates may confuse AWS Config's compliance monitoring and rule evaluation with security threat detection, especially since it can trigger Lambda for remediation, but it lacks the ML-based threat detection and API call log analysis required in this question.
✗Amazon InspectorWrong answer — click to see why▾
Why this is wrong here
Amazon Inspector is a vulnerability management service that scans for software vulnerabilities and unintended network exposure, not a threat detection service that analyzes API call logs for suspicious activity using machine learning.
★ When this WOULD be the correct answer
A company needs to automatically assess EC2 instances for common vulnerabilities and exposures (CVEs) and deviations from security best practices, with findings reported for remediation. Amazon Inspector would be the correct choice.
Why candidates choose this
Candidates may confuse Inspector's security assessment capabilities with threat detection, or assume it can analyze API logs because it is a security service, but it focuses on host-level vulnerabilities, not API call analysis.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.