AWS Service for External Auditor Information
Which AWS service can generate information that can be used by external auditors?
Community Votes
100% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of AWS governance services, specifically highlighting the trap of confusing security assessment tools (like Inspector) with configuration auditing tools (Config).
This question identifies AWS Config as the correct service for generating audit information. It establishes that AWS Config's ability to record configuration changes and track resource relationships makes it essential for compliance verification by external auditors.
Candidates often select Amazon Inspector, mistaking vulnerability scanning for comprehensive configuration auditing. While Inspector provides security findings, it does not provide the detailed inventory and history of resource configurations required for general compliance auditing.
Community Discussion (4 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
AWS Config is the correct answer because it continuously monitors and records configuration changes to AWS resources. It provides a detailed inventory of all resources and their relationships, allowing organizations to assess compliance with internal policies and regulatory requirements. This historical data and real-time state are precisely what external auditors need to verify that infrastructure matches approved baselines.Why the Other Options Are Wrong
Amazon Cognito handles user identity and access management, not infrastructure auditing. Amazon FSx is a file storage service and has no inherent auditing capabilities for other resources. Amazon Inspector automates security assessments by finding vulnerabilities in operating systems and applications, but it does not track configuration drift or maintain a comprehensive resource inventory for compliance auditing purposes.Community Comment Notes
Community consensus strongly supports AWS Config. As noted by Yomijohnson, "AWS Config is a service that provides a detailed view of the configuration of AWS resources... allows you to audit and assess resource configurations." Another commenter, alokdixit2006, emphasized that it is used to "track, record, and audit configuration changes," reinforcing its role as the primary tool for this specific audit requirement.Exam Strategy
When asked about auditing resource configurations or compliance history, always choose AWS Config. Distinguish it from Amazon CloudTrail (which audits API activity) and Amazon Inspector (which audits security vulnerabilities). The keyword 'configuration' points directly to Config.
Frequently Asked Questions
Why isn't Amazon Inspector the right choice for auditors?
Inspector focuses on security vulnerabilities in OS and apps, not the configuration state of all AWS resources needed for broad compliance auditing.
Does AWS Config replace CloudTrail for auditing?
No. CloudTrail logs API calls (who did what), while Config tracks resource configurations (what the resources look like). Both are often used together.
Related Analysis
Practice All CLF-C02 Questions
Access 120 questions with complete answers and detailed explanations.
View Full CLF-C02 Practice Test →