CLF-C02 Security and Compliance Practice Question
A company is using AWS Organizations to manage multiple AWS accounts. The security team wants to ensure that users in the development accounts cannot disable AWS CloudTrail logging or delete CloudTrail trails, even if those users have full administrator permissions within their own accounts. The team needs a central mechanism that is enforced across all development accounts regardless of individual IAM policies. Which AWS feature should the security team use to meet this requirement?
⚠ Common exam trap
Candidates often confuse SCPs with IAM policies, thinking IAM policies can centrally restrict actions across accounts, but SCPs are the only mechanism that can enforce a deny across all accounts in an AWS Organization regardless of local administrator privileges.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Service control policies (SCPs)
Service control policies (SCPs) are a feature of AWS Organizations that allow you to centrally control the maximum available permissions for all accounts in an organization. SCPs act as a guardrail, restricting what actions users and roles in member accounts can perform, even if they have full administrator permissions via IAM policies. By applying an SCP that denies the `cloudtrail:DeleteTrail` and `cloudtrail:StopLogging` actions, the security team can enforce that CloudTrail cannot be disabled or deleted across all development accounts, regardless of individual IAM configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Service control policies (SCPs)
Why this is correct
Correct. SCPs are used within AWS Organizations to set permission guardrails for member accounts. They are evaluated before IAM policies, so they can block actions even for users with full administrative IAM permissions, making them ideal for centrally enforcing restrictions like preventing CloudTrail from being disabled.
- ✗
IAM policies
Why it's wrong here
IAM policies define permissions for users and roles within a single account. However, an account administrator with full permissions can modify or bypass IAM policies. Since the requirement is for central enforcement across accounts regardless of individual permissions, IAM policies alone are insufficient.
When this WOULD be correct
A company wants to restrict a specific user in a single AWS account from deleting CloudTrail trails, while allowing other users in the same account to do so. In that case, an IAM policy attached to that user would be the correct solution.
- ✗
AWS Config rules
Why it's wrong here
AWS Config rules are detective controls that evaluate the recorded configuration of AWS resources against desired policies and can trigger remediation actions like SSM automation or Lambda functions. However, they operate asynchronously after a resource change or at a set frequency, so they cannot block the initial API call that disables CloudTrail. The rule can flag the non-compliant state and even attempt to re-enable the trail, but the disabling action itself has already occurred, making this an after-the-fact response rather than a preventive guardrail. In contrast, SCPs are evaluated before any action is allowed, providing a hard boundary that AWS Config rules inherently lack.
- ✗
Amazon CloudWatch Events
Why it's wrong here
Amazon CloudWatch Events (now part of Amazon EventBridge) can react to API calls (e.g., disabling CloudTrail) by invoking a Lambda function or sending a notification, but it does not prevent the action from happening. It is a reactive tool, not a preventive guardrail.
When this WOULD be correct
A company needs to automatically notify the security team whenever a CloudTrail trail is deleted or disabled across multiple accounts. CloudWatch Events can capture the API calls and trigger an SNS notification or Lambda function for real-time alerting.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓Service control policies (SCPs)Correct answer▾
Why this is correct
Correct. SCPs are used within AWS Organizations to set permission guardrails for member accounts. They are evaluated before IAM policies, so they can block actions even for users with full administrative IAM permissions, making them ideal for centrally enforcing restrictions like preventing CloudTrail from being disabled.
✗IAM policiesWrong answer — click to see why▾
Why this is wrong here
IAM policies are account-specific and cannot be centrally enforced across multiple accounts in AWS Organizations. Even with full administrator permissions, users could modify or remove IAM policies within their own accounts, so IAM policies cannot prevent them from disabling CloudTrail.
★ When this WOULD be the correct answer
A company wants to restrict a specific user in a single AWS account from deleting CloudTrail trails, while allowing other users in the same account to do so. In that case, an IAM policy attached to that user would be the correct solution.
Why candidates choose this
Candidates may think IAM policies are the standard way to control permissions, overlooking that SCPs provide a higher-level guardrail across accounts in an organization, which is specifically needed here.
✗Amazon CloudWatch EventsWrong answer — click to see why▾
Why this is wrong here
Amazon CloudWatch Events can trigger actions based on CloudTrail API calls, but it cannot prevent users from disabling CloudTrail or deleting trails. It is a reactive monitoring service, not a preventive control.
★ When this WOULD be the correct answer
A company needs to automatically notify the security team whenever a CloudTrail trail is deleted or disabled across multiple accounts. CloudWatch Events can capture the API calls and trigger an SNS notification or Lambda function for real-time alerting.
Why candidates choose this
Candidates may think CloudWatch Events can enforce policies by triggering remediation actions, but it lacks the ability to deny API calls before they happen, which is required for this preventive requirement.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.