Security and Compliance (30% of Exam)
This domain tests your ability to identify which AWS security service solves a given problem, understand the boundary between AWS and customer responsibility, and distinguish between similar-sounding services. Expect scenario-based questions where two answers look plausible—knowing the precise job of each service is the differentiator.
Shared Responsibility Model
AWS owns security of the cloud (physical infrastructure, hypervisor, managed service internals). You own security in the cloud (data, IAM configuration, OS patching on EC2, network controls).
Key distinctions:
- EC2: You patch the OS and manage firewall rules. AWS secures the underlying host.
- RDS: AWS patches the database engine. You control network access and encryption settings.
- Lambda/S3: AWS manages more of the stack; your responsibility shrinks to IAM policies and data classification.
- Managed services shift OS/patching responsibility to AWS—a common exam lever.
AWS IAM
Core concepts to know cold:
- Users: long-term credentials, used for humans or legacy app integrations
- Groups: apply policies to collections of users; groups cannot be nested
- Roles: temporary credentials via STS; used by services, cross-account access, federated users
- Policies: JSON documents; identity-based (attached to principal) vs resource-based (attached to resource, e.g., S3 bucket policy)
- Least privilege: grant only what is needed; deny is implicit by default—explicit deny always wins
MFA: Can be enforced via IAM policy condition (aws:MultiFactorAuthPresent). Root account should always have MFA enabled.
Trap: Inline policies vs managed policies—AWS managed policies are reusable and AWS-maintained; customer managed policies are reusable and self-maintained; inline policies are embedded in a single entity and deleted with it.
AWS Organizations
- Management account controls the organization; member accounts cannot leave without approval
- Service Control Policies (SCPs): guardrails that restrict maximum available permissions across accounts; they do not grant permissions—IAM still must allow the action
- SCP + IAM: effective permissions = intersection of what SCP allows AND what IAM allows
- SCPs do not apply to the management account itself
- Consolidated billing: single payment method, volume discounts aggregated across accounts, Reserved Instance and Savings Plan sharing enabled by default
AWS Artifact
Self-service portal for compliance documentation. Two things it provides:
- Reports: AWS audit reports (SOC 1/2/3, ISO certifications, PCI DSS Attestation of Compliance)
- Agreements: sign BAAs (Business Associate Agreements for HIPAA) and NDAs directly in the console
Artifact does not assess your workload—it covers AWS's own compliance posture.
Threat Detection and Monitoring Services
| Service | What it does | Input sources |
|---|---|---|
| GuardDuty | ML-based threat detection (active threats) | CloudTrail, VPC Flow Logs, DNS logs |
| Inspector | Automated vulnerability assessment of workloads | EC2 (agent-based), ECR images, Lambda |
| Macie | Discovers and classifies sensitive data (PII) | S3 only |
| Security Hub | Aggregates findings from GuardDuty, Inspector, Macie, etc. | Multiple services |
Unlock with a paid plan
1 more section (about 535 words) continue below. Every paid plan unlocks all CLF-C02 study guides, the full question bank and mock exams, from $4.97/month.