DJames617 CLF-C02 / Domain 2 / 30%
Security and Compliance
Shared responsibility, security, governance, compliance, access management, and security resources.
Official Task Statements
| Task | What to prove |
|---|---|
| CLF-2.1 | Understand the AWS shared responsibility model. |
| CLF-2.2 | Understand AWS Cloud security, governance, and compliance concepts. |
| CLF-2.3 | Identify AWS access management capabilities. |
| CLF-2.4 | Identify components and resources for security. |
Concepts You Need to Understand
- Shared responsibility, IAM fundamentals, root user protection, governance, compliance, encryption, security services, and audit evidence.
AWS services involved
- IAM
- IAM Identity Center
- AWS Organizations
- AWS KMS
- CloudTrail
- AWS Config
- GuardDuty
- Security Hub
Important configurations
- MFA on privileged users.
- Least-privilege policies.
- Organization-level trails and guardrails.
Exam Decision Patterns
Least operational overhead
Prefer managed and serverless services when they satisfy the requirement. Exceptions appear when the scenario needs host control, unsupported runtimes, specialized network behavior, or exact migration compatibility.
Highly available
Identify the failure boundary. One instance is not HA. Multiple instances in one AZ help capacity but not AZ failure. Multi-AZ handles regional AZ faults. Multi-Region handles regional events but adds complexity and cost.
Durable
Durability is about preserving data. Use replication, versioning, backups, point-in-time recovery, and tested restore plans. A durable backup does not guarantee a low RTO.
Decouple the application
Use SQS for buffering work, SNS for fanout, EventBridge for event routing, and Step Functions for visible workflow state. Add retries, DLQs, and idempotent consumers.
Least privilege
Prefer roles and temporary credentials, scope actions/resources/conditions, watch explicit denies, and remember that resource policies may also be required.
Common Mistakes
- Assuming AWS secures customer data automatically.
- Using root credentials for normal administration.
Example Architecture
Hands-On Activity
Open IAM Access Analyzer policy validation and inspect findings for a sample policy.
For an AWS-account lab, use one of the linked mini labs and keep cleanup steps visible before you start.
Task-by-Task Study Notes
CLF-2.1 - Understand the AWS shared responsibility model.
Read this task as a decision problem: identify the workload requirement, the control or service family involved, and the tradeoff AWS is testing. The validated local corpus connects this objective to 5 official AWS sources and identifies these study anchors:
- Understand the AWS shared responsibility model.
- Security and Compliance
- IAM
- IAM Identity Center
- AWS Organizations
- AWS KMS
- CloudTrail
- AWS Config
How to apply the material
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
Explain before memorizing
Know this distinction: explain why the selected approach fits the requirement, what it does not provide, and which customer-managed control remains. Then test the explanation against a changed constraint: a different failure boundary, traffic pattern, data sensitivity, latency target, or operating-cost limit.
Exam habit: when two answers seem technically possible, prefer the one that matches the stated outcome and shared-responsibility boundary. Do not assume that a managed service removes identity, data-protection, configuration, monitoring, recovery, or cost responsibilities.
Mastery check before Arcade practice
- I can define the central terms and explain what problem the objective is solving.
- I can select the best answer from a realistic scenario without relying on a product name alone.
- I can explain why the closest distractor is wrong when one requirement changes.
- I can identify the AWS-managed boundary and the customer-managed control that remains.
- I can predict the main availability, security, scaling, operations, or cost consequence of the choice.
Use the Arcade after you can explain all five checks aloud or in writing. If an answer is correct only because it looks familiar, return to the source anchors and compare the service purpose, constraints, and tradeoffs again.
Practice CLF-2.1 style questions in this domain
Official AWS references for this objective
- AWS docs / aws-certification/latest/cloud-practitioner-02/cloud-practitioner-02.html
- AWS docs / wellarchitected/latest/framework/welcome.html
- AWS docs / IAM/latest/UserGuide/introduction.html
- AWS docs / organizations/latest/userguide/orgs_introduction.html
- AWS docs / cost-management/latest/userguide/budgets-managing-costs.html
Sources are from the validated local corpus; retrieved 2026-08-14. Retrieval metadata and hashes are retained in the corpus manifest.
CLF-2.2 - Understand AWS Cloud security, governance, and compliance concepts.
Read this task as a decision problem: identify the workload requirement, the control or service family involved, and the tradeoff AWS is testing. The validated local corpus connects this objective to 5 official AWS sources and identifies these study anchors:
- Understand AWS Cloud security, governance, and compliance concepts.
- Security and Compliance
- IAM
- IAM Identity Center
- AWS Organizations
- AWS KMS
- CloudTrail
- AWS Config
How to apply the material
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
Explain before memorizing
Know this distinction: explain why the selected approach fits the requirement, what it does not provide, and which customer-managed control remains. Then test the explanation against a changed constraint: a different failure boundary, traffic pattern, data sensitivity, latency target, or operating-cost limit.
Exam habit: when two answers seem technically possible, prefer the one that matches the stated outcome and shared-responsibility boundary. Do not assume that a managed service removes identity, data-protection, configuration, monitoring, recovery, or cost responsibilities.
Mastery check before Arcade practice
- I can define the central terms and explain what problem the objective is solving.
- I can select the best answer from a realistic scenario without relying on a product name alone.
- I can explain why the closest distractor is wrong when one requirement changes.
- I can identify the AWS-managed boundary and the customer-managed control that remains.
- I can predict the main availability, security, scaling, operations, or cost consequence of the choice.
Use the Arcade after you can explain all five checks aloud or in writing. If an answer is correct only because it looks familiar, return to the source anchors and compare the service purpose, constraints, and tradeoffs again.
Practice CLF-2.2 style questions in this domain
Official AWS references for this objective
- AWS docs / aws-certification/latest/cloud-practitioner-02/cloud-practitioner-02.html
- AWS docs / wellarchitected/latest/framework/welcome.html
- AWS docs / IAM/latest/UserGuide/introduction.html
- AWS docs / organizations/latest/userguide/orgs_introduction.html
- AWS docs / cost-management/latest/userguide/budgets-managing-costs.html
Sources are from the validated local corpus; retrieved 2026-08-14. Retrieval metadata and hashes are retained in the corpus manifest.
CLF-2.3 - Identify AWS access management capabilities.
Read this task as a decision problem: identify the workload requirement, the control or service family involved, and the tradeoff AWS is testing. The validated local corpus connects this objective to 5 official AWS sources and identifies these study anchors:
- Identify AWS access management capabilities.
- Security and Compliance
- IAM
- IAM Identity Center
- AWS Organizations
- AWS KMS
- CloudTrail
- AWS Config
How to apply the material
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
Explain before memorizing
Know this distinction: explain why the selected approach fits the requirement, what it does not provide, and which customer-managed control remains. Then test the explanation against a changed constraint: a different failure boundary, traffic pattern, data sensitivity, latency target, or operating-cost limit.
Exam habit: when two answers seem technically possible, prefer the one that matches the stated outcome and shared-responsibility boundary. Do not assume that a managed service removes identity, data-protection, configuration, monitoring, recovery, or cost responsibilities.
Mastery check before Arcade practice
- I can define the central terms and explain what problem the objective is solving.
- I can select the best answer from a realistic scenario without relying on a product name alone.
- I can explain why the closest distractor is wrong when one requirement changes.
- I can identify the AWS-managed boundary and the customer-managed control that remains.
- I can predict the main availability, security, scaling, operations, or cost consequence of the choice.
Use the Arcade after you can explain all five checks aloud or in writing. If an answer is correct only because it looks familiar, return to the source anchors and compare the service purpose, constraints, and tradeoffs again.
Practice CLF-2.3 style questions in this domain
Official AWS references for this objective
- AWS docs / aws-certification/latest/cloud-practitioner-02/cloud-practitioner-02.html
- AWS docs / wellarchitected/latest/framework/welcome.html
- AWS docs / IAM/latest/UserGuide/introduction.html
- AWS docs / organizations/latest/userguide/orgs_introduction.html
- AWS docs / cost-management/latest/userguide/budgets-managing-costs.html
Sources are from the validated local corpus; retrieved 2026-08-14. Retrieval metadata and hashes are retained in the corpus manifest.
CLF-2.4 - Identify components and resources for security.
Read this task as a decision problem: identify the workload requirement, the control or service family involved, and the tradeoff AWS is testing. The validated local corpus connects this objective to 5 official AWS sources and identifies these study anchors:
- Identify components and resources for security.
- Security and Compliance
- IAM
- IAM Identity Center
- AWS Organizations
- AWS KMS
- CloudTrail
- AWS Config
How to apply the material
- Translate the wording into requirements: security, operations, cost, availability, latency, governance, or data behavior.
- Choose the service or configuration that directly satisfies those requirements with the least unnecessary complexity.
- Reject options that are technically possible but miss the domain goal or increase risk without a requirement.
Explain before memorizing
Know this distinction: explain why the selected approach fits the requirement, what it does not provide, and which customer-managed control remains. Then test the explanation against a changed constraint: a different failure boundary, traffic pattern, data sensitivity, latency target, or operating-cost limit.
Exam habit: when two answers seem technically possible, prefer the one that matches the stated outcome and shared-responsibility boundary. Do not assume that a managed service removes identity, data-protection, configuration, monitoring, recovery, or cost responsibilities.
Mastery check before Arcade practice
- I can define the central terms and explain what problem the objective is solving.
- I can select the best answer from a realistic scenario without relying on a product name alone.
- I can explain why the closest distractor is wrong when one requirement changes.
- I can identify the AWS-managed boundary and the customer-managed control that remains.
- I can predict the main availability, security, scaling, operations, or cost consequence of the choice.
Use the Arcade after you can explain all five checks aloud or in writing. If an answer is correct only because it looks familiar, return to the source anchors and compare the service purpose, constraints, and tradeoffs again.
Practice CLF-2.4 style questions in this domain
Official AWS references for this objective
- AWS docs / aws-certification/latest/cloud-practitioner-02/cloud-practitioner-02.html
- AWS docs / wellarchitected/latest/framework/welcome.html
- AWS docs / IAM/latest/UserGuide/introduction.html
- AWS docs / organizations/latest/userguide/orgs_introduction.html
- AWS docs / cost-management/latest/userguide/budgets-managing-costs.html
Sources are from the validated local corpus; retrieved 2026-08-14. Retrieval metadata and hashes are retained in the corpus manifest.