CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Config

  Why it's wrong here

  AWS Config continuously monitors and records AWS resource configurations, enabling you to evaluate them against your own policies using managed or custom rules. It can assess your internal compliance posture, but it does not publish or provide access to AWS's third-party audit certifications such as SOC 2 or ISO 27001. Since the auditors are requesting official compliance documentation, AWS Config's configuration snapshots and rule evaluations are not the artifacts they require.

  When this WOULD be correct

  A company needs to continuously monitor and evaluate the configurations of their AWS resources against internal policies or regulatory standards, and receive notifications when resources are non-compliant. AWS Config would be the correct service to set up rules and track configuration changes.

• ✓

  AWS Artifact

  Why this is correct

  AWS Artifact is the correct service. It provides a self-service portal for downloading AWS compliance reports and managing agreements. Customers can access SOC, ISO, PCI DSS reports, and accept agreements like the BAA directly from the console.

• ✗

  AWS Security Hub

  Why it's wrong here

  AWS Security Hub aggregates security findings and checks from multiple sources, including AWS Config, Amazon GuardDuty, and AWS Inspector, into a single dashboard that reflects your security posture. It can automate compliance checks against standards like CIS AWS Foundations, but those checks are based on your account's live configuration and do not provide the formal, signed compliance reports or attestations needed for a third-party audit. The auditor's request is best fulfilled by downloading the official documents from AWS Artifact, which Security Hub does not offer.

  When this WOULD be correct

  A company wants to centrally view and manage security findings from multiple AWS services, automate compliance checks against standards like CIS or PCI DSS, and receive aggregated security alerts. In that scenario, AWS Security Hub would be the correct service.

• ✗

  AWS CloudTrail

  Why it's wrong here

  AWS CloudTrail records API activity for governance, compliance, and auditing. It is useful for tracking who did what in the AWS account, but it does not contain the compliance reports or certificates that auditors typically request.

  When this WOULD be correct

  A company needs to audit all API calls made in their AWS account to detect unauthorized access or changes. They require a service that logs management and data plane events for security analysis. AWS CloudTrail would be the correct answer.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”