Study CLF-C02 Governance, Compliance, Logging and Security Services: key concepts, common traps, and exam decision cues.
This is the part of CLF-C02 where similar-sounding AWS services start to blur together. The exam expects broad recognition, not specialist incident-response skill. You need to know which service provides compliance reports, which one records API actions, which one monitors metrics, and which ones help detect, summarize, or protect against security issues.
Compliance: Meeting external or internal rules, standards, or control requirements.
Audit trail: Record of what actions happened, by whom, and when.
AWS wants you to separate:
| Service | Strongest CLF-C02 mental label |
|---|---|
| AWS Artifact | compliance reports and agreements |
| AWS CloudTrail | records API activity and account actions |
| Amazon CloudWatch | monitoring, metrics, logs, and alarms |
| AWS Config | configuration tracking and rule evaluation |
| AWS Security Hub | aggregated security findings view |
| Amazon GuardDuty | threat detection |
| AWS Shield | DDoS protection |
| AWS WAF | web request filtering |
| Amazon Inspector | vulnerability and exposure assessment |
CLF-C02 mixes service questions with broad security concepts. Keep these separate:
If a question says “show me AWS-generated compliance reports,” that is an Artifact question, not a GuardDuty question. If it says “show me who made the API call,” that is a CloudTrail question, not a CloudWatch one.
| If the requirement is mainly about… | Think first about… |
|---|---|
| AWS-generated compliance documents and agreements | Artifact |
| API actions and account activity history | CloudTrail |
| metrics, logs, alarms, and operational monitoring | CloudWatch |
| configuration state and rule-based compliance evaluation | Config |
| suspicious behavior and threat findings | GuardDuty |
| one place to see findings from multiple security services | Security Hub |
| DDoS protection | Shield |
| filtering malicious web requests | WAF |
| Trap | Better thinking |
|---|---|
| “CloudWatch and CloudTrail are basically the same.” | CloudWatch monitors metrics and logs; CloudTrail records API activity. |
| “Security Hub is threat detection.” | Security Hub aggregates findings; GuardDuty is a threat-detection lane. |
| “Artifact is a monitoring service.” | Artifact is for AWS compliance reports and agreements. |
| “Shield, WAF, and Config all just mean security.” | They solve different security jobs at different layers. |
An auditor asks a company to provide AWS-generated compliance reports and agreements relevant to a regulatory review. Which AWS service is the strongest first fit?
Correct answer: 1
Why: Artifact is the AWS service specifically used to access compliance reports and agreements. The other answers are security or networking services, not compliance-document sources.