Study CLF-C02 Security and Compliance: key concepts, common traps, and exam decision cues.
This is the heaviest CLF-C02 domain. AWS is not expecting architect-level security design, but it does expect you to separate what AWS secures from what the customer still owns, understand basic identity and least-privilege logic, and recognize the governance or compliance service that fits the question.
AWS currently weights Security and Compliance at 30% of scored content.
| Lesson | Focus |
|---|---|
| 2.1 Shared Responsibility & Protection Boundaries | Learn where AWS responsibility stops and where customer responsibility still begins. |
| 2.2 Identity, Access & Root-Account Protection | Learn IAM, MFA, least privilege, root-account safety, and when to use roles or federated access. |
| 2.3 Governance, Compliance, Logging & Security Services | Learn the difference between compliance evidence, logging, monitoring, guardrails, and threat-detection services. |
| If the question is really about… | Go first to… |
|---|---|
| who secures hardware, OS, data, identities, or patching | 2.1 Shared Responsibility & Protection Boundaries |
| users, roles, MFA, least privilege, root user, or access methods | 2.2 Identity, Access & Root-Account Protection |
| audits, encryption, artifact evidence, CloudTrail, Config, GuardDuty, Shield, or Security Hub | 2.3 Governance, Compliance, Logging & Security Services |
If your misses include the phrase most secure, compliance, or shared responsibility, protect this chapter first. It is the biggest domain and it usually produces near-miss questions with plausible distractors.