Security and Compliance is 30% of the CLF-C02, which makes it the largest domain in the exam — around 19 or 20 of your 65 questions. If you are going to be strong somewhere, be strong here. The good news is that a big share of this domain rests on one idea, and once that idea clicks, the questions stop feeling like trivia.
The line that decides most of these questions
The shared responsibility model splits security into two halves. AWS is responsible for security of the cloud: the data centres, the hardware, the hypervisor, the host operating system, the global network. You are responsible for security in the cloud: your data, who may access it, your IAM configuration, the guest OS on your instances, your firewall rules, your encryption settings, your application code.
The half-sentence that separates them is worth learning as a reflex: if you can configure it, you own it. You can configure a security group, so security groups are yours. You cannot touch the hypervisor, so the hypervisor is AWS’s. This one test resolves the large majority of shared-responsibility questions on sight.
The subtlety the exam likes — and the one that separates a confident answer from a lucky one — is that the line moves depending on the service. On EC2, you own the guest OS and its patches. On Amazon RDS, AWS patches the database engine for you, so that piece of the line has moved upwards and off your plate; you still own the data inside and who may query it. On S3, you own almost nothing operationally except the two things that matter most: what you put in the bucket and who may read it. The more managed the service, the less of the stack is yours — but your data and your access control never leave your side of the line. Not once, for any service.
Identity: the four rules that keep recurring
IAM questions at this level are not deep. They test whether you have internalised a handful of principles that AWS repeats everywhere:
- Least privilege. Start from the minimum a task needs; widen only when a need is shown. Any option that grants
AdministratorAccess for convenience is wrong.
- The root user is not for working. It has unrestricted access, it cannot be restricted by an IAM policy, and it exists for the life of the account. Secure it with MFA, and use it only where it is genuinely required.
- Identities are not shared. A shared IAM user destroys the audit trail — you can no longer tell who did what. Rotating its password does not repair that.
- Roles over long-lived keys. When an EC2 instance or a Lambda function needs to call an AWS service, it gets a role with temporary credentials, not an access key baked into the code.
Read the option text for these words rather than the scenario. If an option contains “root user for daily”, “one shared account” or “full administrator to be safe”, the exam has put it there to be rejected.
The services: know the boundaries, not the manuals
Most security-service questions are a fork between two or three plausible names. You do not need depth here; you need one crisp sentence per service, and you especially need the pairs the exam habitually confuses:
- WAF against Shield. WAF inspects the content of HTTP requests — SQL injection, cross-site scripting. Shield defends against the volume of traffic — DDoS. Content, or volume.
- GuardDuty against Inspector against Macie. GuardDuty watches logs for suspicious behaviour. Inspector scans your workloads for known vulnerabilities. Macie finds sensitive data such as personal information sitting in S3. Behaviour, weakness, data.
- KMS against Secrets Manager against Certificate Manager. KMS manages encryption keys. Secrets Manager stores and rotates credentials. Certificate Manager handles TLS certificates. Keys, passwords, certificates.
- Artifact against Config. Artifact hands you AWS’s compliance reports. Config records how your resources are configured over time. Their evidence, or your evidence.
- Security Hub aggregates findings that other services produce. If a question describes centralising alerts rather than generating them, that is Security Hub.
Why this domain is where exams are lost
Candidates rarely fail the CLF-C02 because security is conceptually hard — it is not, at this level. They fail because the distractors are all real AWS services doing real security work, and recognising a name feels like knowing an answer. Four options, all genuine, all in the right neighbourhood: that is the whole difficulty, and it is entirely defeated by being able to say what each service is for in one sentence.
That is what the questions below are built to train. Answer each one first, then read the explanation past the correct letter — the part that matters is why the other three fail. On the real exam nobody tells you which three those were.
Updated for CLF-C02 (July 2026). The sample questions above are our own work
in the style of the exam — not real exam items. The exam itself is set and marked
by the certification body.