CLF-C02 exam tips: Security & Compliance (30% of the exam)
Security is the single biggest domain on the CLF-C02 — 30% of your score. Here's what it actually tests.
What the exam focuses on
The exam does not test deep security engineering. It tests whether you know which service to reach for in a given scenario, and the shared responsibility model.
The shared responsibility model — always on the exam
AWS is responsible for: You are responsible for:
┌─────────────────────────┐ ┌─────────────────────────┐
│ Physical data centres │ │ Data encryption │
│ Network infrastructure │ │ IAM users & permissions │
│ Hypervisor / hardware │ │ Security group rules │
│ Managed service patches │ │ Application security │
└─────────────────────────┘ └─────────────────────────┘
"Security OF the cloud" "Security IN the cloud"
Exam pattern: a scenario describes a breach or misconfiguration — whose responsibility was it? Almost always the answer is yours (the customer), not AWS's.
IAM — the most-tested service in this domain
| Concept | What the exam tests |
|---|---|
| Principle of least privilege | Always grant minimum permissions needed |
| IAM roles vs users | Roles for services/apps, users for humans |
| MFA | Should always be enabled, especially on root |
| Root account | Should never be used for daily tasks |
| IAM policies | JSON documents attached to users/roles/groups |
Threat detection — know what each service detects
| Service | What it detects |
|---|---|
| GuardDuty | Malicious activity, anomalous API calls, cryptocurrency mining |
| Inspector | Software vulnerabilities in EC2 and container images |
| Macie | Sensitive data (PII, credentials) in S3 buckets |
| Security Hub | Aggregates findings from all the above |
Memory trick: GuardDuty = threats from outside. Inspector = vulnerabilities inside. Macie = data you shouldn't have left exposed.
Encryption — know the key hierarchy
- KMS — managed key service, integrates with almost every AWS service
- CloudHSM — dedicated hardware for compliance requirements (FIPS 140-2 Level 3)
- Secrets Manager — stores and rotates credentials, API keys, DB passwords
Exam pattern: "needs to store database credentials securely and rotate them automatically" → Secrets Manager (not KMS, not Parameter Store alone).
Key exam tip
If a question asks about compliance reports, attestations, or audit artefacts (SOC 2, ISO 27001, PCI DSS) — the answer is AWS Artifact. It's a self-service portal for downloading AWS's own compliance documents.