Chapter 2 of 4 · AWS CLF-C02
Security and Compliance
Shared responsibility, governance, IAM, network protection and threat detection services.
- 5topics
- 20 minfast track
- 3diagrams and exhibits
- 30%of the exam
Topics in this chapter
Take them in order, or jump to the one you need.
- 1The Shared Responsibility ModelLearn who secures what in AWS: security of the cloud versus security in the cloud, how duties change by service, and shared and…Diagram4 min
- 2Governance, Compliance and AuditingLearn AWS governance and compliance concepts for CLF-C02, including AWS Artifact, CloudTrail, Config, Audit Manager…4 min
- 3IAM and Access ManagementLearn AWS Identity and Access Management for CLF-C02: users, groups, roles, policies, root user, MFA, least privilege and IAM…Diagram4 min
- 4Network Security and ProtectionCompare security groups, network ACLs, AWS WAF, AWS Shield and Firewall Manager for CLF-C02 and learn which layer of defence each…Diagram4 min
- 5Detection and Data ProtectionLearn AWS threat detection and data protection for CLF-C02: GuardDuty, Inspector, Macie, Security Hub, KMS, Secrets Manager…4 min
About this chapter
What this chapter covers
Security and Compliance asks who is responsible for what, how access is controlled, and which AWS services protect and monitor your resources.
It starts with the shared responsibility model, because every other security question depends on it. It then covers governance and compliance, access management with AWS Identity and Access Management (IAM), and the services that protect networks, detect threats and protect data.
The questions are mostly about choosing the right service for a described need.
How the topics fit together
The pages move from the rules, to the people, to the tools.
- Shared responsibility sets the boundary between AWS and the customer.
- Governance and compliance cover reports, activity records and rules across accounts.
- IAM controls identities and permissions.
- Network protection covers firewalls, web protection and defence against distributed denial of service (DDoS) attacks.
- Detection and data protection cover threat findings, vulnerability scans, encryption and secrets.
Start every security question by asking whether the item is AWS's part or the customer's part. That one step removes many wrong answers.
How to use these pages
Each topic page has the same shape, so you can skim for what you need.
- What it is: the idea in plain words.
- How it works: the mechanism, with diagrams and tables.
- What to remember for the exam: the facts to memorise.
- Common mistakes: the classic traps.
- Check yourself: three questions to test your understanding.
There are many similar service names in this chapter. Make your own one line summary of each service and test yourself until you can match name to job quickly.
Ready for more practice?
The full AWS CLF-C02 question bank has 832 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by AWS. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.