Security and Compliance is the single largest domain on the AWS Certified Cloud Practitioner (CLF-C02) exam — roughly 30% of your score. More questions come from this domain than any other, and it’s also the area where a little structured study pays off fastest, because most of it is conceptual rather than mathematical. If you can reliably answer “who is responsible?”, “which service does that?”, and “how do you control access?”, you’ve already secured the biggest block of marks on the exam.
This guide is a practitioner’s map of everything the Security and Compliance domain tests: the Shared Responsibility Model, AWS Identity and Access Management (IAM), the portfolio of security services (GuardDuty, Inspector, Macie, WAF, Shield, and more), encryption and key management, and the governance and compliance tooling AWS provides. Along the way, I’ll flag the exact patterns the CLF-C02 uses to phrase these questions so you recognize them under time pressure.
What the Security and Compliance Domain Actually Covers
The official CLF-C02 exam guide breaks Domain 2 into four task statements. Understanding the split tells you where to spend your time:
| Task statement | What it tests | Rough emphasis |
|---|---|---|
| Shared Responsibility Model | Where AWS’s responsibility ends and yours begins | High |
| Security, governance & compliance concepts | Compliance programs, AWS Artifact, encryption concepts, security services | High |
| Access management capabilities | IAM users, groups, roles, policies, MFA, the root user, IAM Identity Center | Very high |
| Components/resources for security | The specific named security services and what each does | Medium |
Two themes dominate: identity and access management (who can do what) and knowing which service solves which security problem. The exam rarely asks you to configure anything — it asks you to identify the right tool or the right responsibility. Keep that framing in mind and you’ll read every question faster.
The Shared Responsibility Model in One Paragraph
Because it underpins the whole domain, start here. AWS is responsible for security of the cloud — the physical data centers, hardware, and virtualization layer. You are responsible for security in the cloud — your data, your IAM configuration, your operating-system patching (where applicable), and your encryption choices. The boundary slides toward AWS as services become more managed: on EC2 you patch the guest OS; on RDS AWS patches the engine; on Lambda there’s no OS you manage at all.
That’s the compressed version. The model deserves its own study session, so work through the dedicated Shared Responsibility Model guide for the CLF-C02 — it’s the highest-yield single concept in this domain.
AWS IAM: The Heart of the Domain
If you master one topic for the exam, make it IAM. It appears constantly, and the exam expects you to distinguish four building blocks precisely.
The root user vs. IAM users
Every AWS account starts with a root user — the identity created when the account is opened, tied to the account’s email address. The root user has unrestricted access to everything, which is exactly why AWS’s guidance (and the exam’s “correct” answer) is:
- Do not use the root user for everyday tasks.
- Enable MFA on the root user immediately.
- Create individual IAM users (or federated identities) for day-to-day work.
- Lock the root credentials away and use them only for the handful of tasks that require root (like closing the account or changing the support plan).
An IAM user is an identity for a person or application that needs long-term access. Best practice — and the exam’s expectation — is one IAM user per person, never a shared login.
Groups, policies, and roles
These four terms are the ones the CLF-C02 loves to test side by side:
| Concept | What it is | Key exam cue |
|---|---|---|
| IAM user | A permanent identity for one person or app | Long-term credentials; one per human |
| IAM group | A collection of users you attach policies to | You cannot nest groups or log in as a group |
| IAM policy | A JSON document that grants or denies permissions | Attach to users, groups, or roles |
| IAM role | A temporary identity that’s assumed, not logged into | For EC2, Lambda, cross-account, and federation — no long-term credentials |
The distinction that trips people up is role vs. user. A role provides temporary credentials and is meant to be assumed by a trusted entity — an EC2 instance that needs to read from S3, a Lambda function, or a user from another account. The classic exam scenario is: “An application on an EC2 instance needs to access an S3 bucket. What is the most secure way to grant access?” The answer is attach an IAM role to the EC2 instance — never hard-code access keys into the application.
A quick IAM policy example, so the JSON structure is familiar:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:GetObject"],
"Resource": "arn:aws:s3:::my-bucket/*"
}
]
}You won’t write policies on the exam, but you should recognize the Effect / Action / Resource shape and know that an explicit Deny always wins over any Allow.
Multi-Factor Authentication (MFA)
MFA adds a second factor — something you have (an authenticator app, hardware key, or device) — on top of the password you know. The exam wants you to know that MFA should be enabled on the root user and on privileged IAM users, and that it dramatically reduces the risk of a compromised password leading to a breach.
IAM Identity Center and federation
For organizations, IAM Identity Center (formerly AWS SSO) provides centralized access to multiple AWS accounts and applications, often connected to an existing corporate directory. The broader concept is identity federation — letting users sign in with credentials they already have (corporate SSO, Google, etc.) instead of creating separate IAM users. At the Cloud Practitioner level you just need to recognize that these enable single sign-on and centralized access management across many accounts.
The golden IAM principle threaded through every question is least privilege: grant only the permissions required to do the job, and nothing more.
The AWS Security Services Portfolio
The second big pillar of Domain 2 is recognizing AWS’s named security services and matching each to the problem it solves. The exam won’t ask you to configure them — it asks “which service would you use to…?” Memorize the one-line purpose of each.
| Service | One-line purpose | Trigger words in a question |
|---|---|---|
| Amazon GuardDuty | Intelligent threat detection monitoring account & network activity | ”detect malicious activity”, “anomalous behavior” |
| Amazon Inspector | Automated vulnerability assessment for EC2, containers & Lambda | ”scan for vulnerabilities”, “software CVEs” |
| Amazon Macie | Discovers & protects sensitive data (PII) in S3 | ”find PII”, “sensitive data in S3” |
| AWS WAF | Web Application Firewall — filters HTTP(S) traffic | ”SQL injection”, “block malicious web requests” |
| AWS Shield | DDoS protection (Standard is free & automatic; Advanced is paid) | “DDoS attack”, “layer 3/4 protection” |
| AWS Security Hub | Central dashboard aggregating security findings | ”single view of security posture” |
| AWS Firewall Manager | Centrally manage WAF/Shield rules across accounts | ”manage firewall rules org-wide” |
| Amazon Detective | Investigate & analyze the root cause of findings | ”investigate”, “root cause analysis” |
| AWS Network Firewall | Managed network firewall for your VPC | ”filter VPC traffic”, “network-level” |
A memory trick for the three “Amazon” detection services that candidates confuse: GuardDuty guards the account (threat detection), Inspector inspects your workloads (vulnerabilities), and Macie minds your data (sensitive data / PII in S3). Lock those three verbs in and you’ll answer most of the security-service questions correctly.
Encryption and Key Management
Encryption is where “security in the cloud” becomes concrete, and the CLF-C02 tests the concepts at a high level.
Encryption at rest vs. in transit
- Encryption at rest protects data stored on disk — in S3, EBS volumes, RDS databases, and so on.
- Encryption in transit protects data moving over the network, typically using TLS/SSL (HTTPS).
You should be able to say that AWS supports both and that most storage and database services can be encrypted at rest with a checkbox — but the decision to encrypt is a customer responsibility.
AWS KMS, CloudHSM, and Certificate Manager
| Service | Purpose | Exam cue |
|---|---|---|
| AWS KMS (Key Management Service) | Create & manage encryption keys; integrated with most AWS services | ”manage encryption keys”, “encrypt at rest” |
| AWS CloudHSM | Dedicated, single-tenant hardware security module for strict compliance | ”dedicated hardware”, “FIPS 140-2 Level 3” |
| AWS Certificate Manager (ACM) | Provision & manage SSL/TLS certificates | ”HTTPS certificates”, “TLS for a website” |
| AWS Secrets Manager | Store & rotate secrets (DB passwords, API keys) | “rotate database credentials”, “store secrets” |
For most scenarios, KMS is the default answer for encryption key management. CloudHSM appears when a question stresses dedicated hardware or strict single-tenant compliance requirements. Secrets Manager is the answer when the question mentions storing and automatically rotating credentials — distinguish it from Systems Manager Parameter Store, which stores configuration and secrets but without built-in automatic rotation.
Governance, Compliance, and Auditing
The final slice of the domain covers how AWS helps you prove and maintain a secure, compliant environment.
AWS Artifact — your compliance evidence locker
AWS Artifact is a self-service portal for on-demand access to AWS compliance reports and agreements — SOC reports, PCI DSS, ISO certifications, and more. The exam cue is unmistakable: if a question asks “where do you download AWS’s compliance reports?” or “how does a customer obtain AWS’s SOC 2 report?”, the answer is AWS Artifact.
Compliance programs and AWS’s global reach
AWS participates in a long list of compliance programs — PCI DSS, HIPAA, SOC 1/2/3, ISO 27001, FedRAMP, GDPR, and others. You don’t need to memorize the full catalog; you need to know that AWS maintains these certifications for the infrastructure (security of the cloud), while achieving compliance for your workload remains a shared effort.
Auditing and configuration tracking
| Service | Purpose | Exam cue |
|---|---|---|
| AWS CloudTrail | Records API calls — who did what, when | ”audit trail”, “who deleted the bucket”, “API history” |
| AWS Config | Records & evaluates resource configuration over time | ”configuration compliance”, “track config changes” |
| Amazon CloudWatch | Monitoring — metrics, logs, alarms | ”performance metrics”, “operational monitoring” |
| AWS Trusted Advisor | Best-practice recommendations across security, cost, performance | ”recommendations to improve security” |
The most-confused pair here is CloudTrail vs. Config. Remember it this way: CloudTrail answers “who did it?” (a log of API actions and identities), while Config answers “what does it look like now, and how did it change?” (a record of resource state and configuration history). If a question mentions auditing user actions, it’s CloudTrail; if it mentions tracking configuration or compliance rules, it’s Config.
AWS Trusted Advisor rounds out governance by scanning your account and recommending improvements across five categories — cost optimization, performance, security, fault tolerance, and service limits. The security checks (like exposed access keys or open ports) map directly to this domain.
How the CLF-C02 Frames Security Questions
The exam’s phrasing is remarkably consistent once you’ve seen enough questions. Here are the recurring patterns and how to answer them:
- “Most secure way for an EC2 app to access S3?” → IAM role, never hard-coded keys.
- “Detect malicious or unauthorized activity in your account?” → GuardDuty.
- “Discover sensitive data (PII) stored in S3?” → Macie.
- “Scan EC2 instances for software vulnerabilities?” → Inspector.
- “Protect a web application from SQL injection?” → AWS WAF.
- “Protect against DDoS attacks at no additional cost?” → AWS Shield Standard.
- “Download AWS’s compliance/SOC reports?” → AWS Artifact.
- “Audit which API calls were made and by whom?” → CloudTrail.
- “Manage encryption keys across AWS services?” → AWS KMS.
- “Add a second layer of sign-in security?” → MFA.
Notice that almost every answer is a single service name or a single responsibility. Train your recall of the one-line purpose for each service and the pattern-match becomes automatic.
A High-Yield Study Sequence
To cover this domain efficiently:
- Nail the Shared Responsibility Model first — it’s foundational and appears everywhere.
- Drill IAM until user vs. group vs. role vs. policy is instant, and you know when a role is the right answer.
- Memorize the security-service one-liners using the GuardDuty/Inspector/Macie verbs and the WAF/Shield distinction.
- Learn the encryption trio — KMS (default), CloudHSM (dedicated hardware), Secrets Manager (rotation).
- Separate the auditing pair — CloudTrail (who) vs. Config (what/state), plus Artifact for compliance reports.
- Practice with scenario questions until you recognize the phrasing patterns above without hesitation.
For the bigger picture of how this domain fits alongside the others, the CLF-C02 domains breakdown shows how Security and Compliance’s 30% weighs against Cloud Concepts, Technology, and Billing. Pair that with the Core AWS Services guide so you can connect each security service to the resource it protects.
Practice Until the Service Names Are Reflexive
Security and Compliance is a recognition domain: the exam gives you a scenario, and you match it to the right service or responsibility. That skill is built through repetition, not re-reading. The fastest way to expose the gaps — the CloudTrail-vs-Config confusion, the KMS-vs-CloudHSM edge case, the role-vs-user scenario — is full-length, timed practice that mirrors how the CLF-C02 phrases these questions.
That’s exactly what the AWS Cloud Practitioner (CLF-C02) Mock Exam Bundle is built for. Its questions follow the real exam’s domain weightings — so Security and Compliance gets the ~30% share it deserves — with detailed explanations that turn every wrong answer into a lesson. Warm up with the free CLF-C02 practice questions, then use the bundle to confirm you can place responsibilities and pick the right security service under real time pressure.
To structure the rest of your preparation, follow the CLF-C02 study plan and the complete AWS Cloud Practitioner exam guide for 2026.
Conclusion
The Security and Compliance domain is the largest on the CLF-C02, but it’s also one of the most learnable — because nearly every answer reduces to a clear responsibility or a single service name. Anchor everything to the Shared Responsibility Model, make IAM (users, groups, roles, policies, MFA, least privilege) second nature, and memorize the one-line purpose of each security, encryption, and governance service. Learn to spot the exam’s phrasing patterns — “detect,” “scan,” “PII,” “audit,” “compliance report,” “encrypt” — and you’ll convert the biggest domain into your highest-scoring one.
Master this domain and you don’t just pass a bigger share of the exam; you build the security instinct that keeps real AWS accounts out of the breach headlines — which is precisely why the CLF-C02 weights it so heavily.
FAQ
How much of the AWS Cloud Practitioner exam is about security and compliance?
Security and Compliance is the largest domain on the CLF-C02 at roughly 30% of scored content — more than any other domain. It covers the Shared Responsibility Model, IAM, security services, encryption, and compliance/governance tooling.
What is the difference between an IAM user and an IAM role?
An IAM user is a permanent identity with long-term credentials, meant for one person or application. An IAM role provides temporary credentials and is assumed by a trusted entity (like an EC2 instance, a Lambda function, or a user from another account) rather than logged into. For granting AWS services access to other resources, a role is the secure choice — never hard-coded access keys.
What’s the difference between GuardDuty, Inspector, and Macie?
GuardDuty is threat detection (monitors account and network activity for malicious behavior), Inspector is vulnerability scanning (finds software CVEs in EC2, containers, and Lambda), and Macie discovers and protects sensitive data like PII in Amazon S3. Remember: GuardDuty guards, Inspector inspects, Macie minds your data.
Where do I get AWS compliance reports like SOC 2 or PCI DSS?
Through AWS Artifact, a self-service portal that provides on-demand access to AWS’s compliance reports and agreements (SOC, PCI DSS, ISO, and more). If an exam question asks where to download AWS’s compliance documentation, the answer is AWS Artifact.
What is the difference between AWS CloudTrail and AWS Config?
CloudTrail records API calls — it answers “who did what, and when.” AWS Config records and evaluates resource configuration over time — it answers “what does this resource look like now, and how has it changed.” Use CloudTrail for auditing actions and Config for tracking configuration and compliance.
Do I need to configure these services for the CLF-C02 exam?
No. The Cloud Practitioner exam is conceptual — it asks you to identify the right service, responsibility, or best practice, not to configure anything. Focus on knowing the one-line purpose of each service and the Shared Responsibility Model. Practicing with the CLF-C02 Mock Exam Bundle is an effective way to drill the recognition patterns the exam rewards.