CLF-C02 Security and Compliance Practice Question
A company is undergoing a compliance audit to demonstrate that its AWS environment adheres to industry standards such as PCI DSS and SOC. The auditor requests the company to provide the latest AWS compliance reports to verify the security controls implemented by AWS. The company needs to obtain these reports directly from AWS in a downloadable format. Which AWS service should the company use to meet this requirement?
⚠ Common exam trap
Test-takers frequently confuse AWS Config (which tracks configuration changes) with AWS Artifact (which provides compliance reports), leading them to select a service that manages compliance rules rather than one that delivers the actual audit documentation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Artifact
AWS Artifact is the correct service because it provides on-demand access to AWS compliance reports, including SOC and PCI DSS reports, in a downloadable format. This allows the company to directly obtain the latest reports from AWS to share with auditors, meeting the compliance audit requirement without needing to configure or manage any other service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Config
Why it's wrong here
AWS Config continuously records and evaluates your AWS resource configurations against desired rules, enabling you to track configuration changes and assess compliance with your own internal policies. It can aggregate compliance history across accounts and regions, but its compliance status reflects how well your resources match those rules—not AWS's own infrastructure certifications. Since third-party audit reports like SOC or ISO concern AWS's controls, they are not generated or delivered by AWS Config; those documents are provided through AWS Artifact.
When this WOULD be correct
AWS Config would be correct if the question asked: 'Which AWS service can be used to evaluate the compliance of AWS resource configurations against internal policies or specific regulatory standards (e.g., PCI DSS) by using managed rules?'
- ✗
AWS Trusted Advisor
Why it's wrong here
AWS Trusted Advisor is a diagnostic tool that inspects your AWS environment and provides real-time recommendations across cost optimization, performance, security, and fault tolerance, often flagging issues like unused resources or misconfigurations. While its security checks can help you harden your own workloads, it does not generate or distribute official compliance certificates or audit reports for AWS's data center and infrastructure. Formal evidence such as SOC 2 or PCI DSS reports are published separately in AWS Artifact and are not available within the Trusted Advisor console.
When this WOULD be correct
A company wants to check its AWS account against AWS best practices for security and receive actionable recommendations to improve security posture. In that case, AWS Trusted Advisor would be the correct service.
- ✓
AWS Artifact
Why this is correct
AWS Artifact is the correct service for downloading AWS compliance reports. It provides on-demand access to AWS security and compliance documents, including SOC reports, PCI DSS reports, and ISO certifications, which are commonly requested by auditors.
- ✗
AWS Security Hub
Why it's wrong here
AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not provide the AWS infrastructure compliance reports (e.g., SOC, PCI DSS) that are typically requested during audits.
When this WOULD be correct
AWS Security Hub would be the correct answer if the question asked for a service that aggregates security findings from multiple AWS services, checks compliance against industry standards (e.g., CIS AWS Foundations Benchmark), and provides a centralized dashboard for security posture monitoring.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS ArtifactCorrect answer▾
Why this is correct
AWS Artifact is the correct service for downloading AWS compliance reports. It provides on-demand access to AWS security and compliance documents, including SOC reports, PCI DSS reports, and ISO certifications, which are commonly requested by auditors.
✗AWS ConfigWrong answer — click to see why▾
Why this is wrong here
AWS Config is used for resource inventory, configuration history, and compliance rules, but it does not provide downloadable compliance reports like PCI DSS or SOC reports. The question specifically asks for AWS compliance reports, which are available through AWS Artifact.
★ When this WOULD be the correct answer
AWS Config would be correct if the question asked: 'Which AWS service can be used to evaluate the compliance of AWS resource configurations against internal policies or specific regulatory standards (e.g., PCI DSS) by using managed rules?'
Why candidates choose this
Candidates may confuse AWS Config's compliance evaluation of resource configurations with the compliance reports provided by AWS Artifact, as both involve 'compliance' terminology.
✗AWS Trusted AdvisorWrong answer — click to see why▾
Why this is wrong here
AWS Trusted Advisor provides recommendations for cost optimization, performance, security, and fault tolerance, but it does not provide downloadable compliance reports for standards like PCI DSS or SOC.
★ When this WOULD be the correct answer
A company wants to check its AWS account against AWS best practices for security and receive actionable recommendations to improve security posture. In that case, AWS Trusted Advisor would be the correct service.
Why candidates choose this
Candidates may confuse Trusted Advisor's security checks with compliance reporting, assuming it can generate official compliance documents.
✗AWS Security HubWrong answer — click to see why▾
Why this is wrong here
AWS Security Hub provides a comprehensive view of security alerts and compliance status across AWS accounts, but it does not offer downloadable compliance reports like those required for PCI DSS or SOC audits. The question specifically asks for obtaining AWS compliance reports directly from AWS, which is the function of AWS Artifact.
★ When this WOULD be the correct answer
AWS Security Hub would be the correct answer if the question asked for a service that aggregates security findings from multiple AWS services, checks compliance against industry standards (e.g., CIS AWS Foundations Benchmark), and provides a centralized dashboard for security posture monitoring.
Why candidates choose this
Candidates may confuse Security Hub's compliance checks and security findings with the ability to download official AWS compliance reports, as both relate to compliance and security auditing.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.