Amazon CLF-C02: Security, Identity & Compliance — Study Guide
Part of the AWS Cloud Practitioner CLF-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Identity, access control, and the principle of least privilege
Identity and access in AWS is built around IAM constructs: users, groups, roles, policies, and federation. Best practice is to avoid assigning permissions to the root account and to grant privileges through roles and groups so permissions are centrally managed and auditable. Use IAM roles for compute and serverless services (EC2 instance roles, Lambda execution roles) instead of embedding long-lived credentials. For human access, prefer an identity federation solution (IAM Identity Center or a SAML/OIDC provider) to centralize authentication, use MFA, and enforce short-lived credentials via STS to reduce credential exposure. Policy design must consider identity-based policies vs resource-based policies and policy evaluation order: explicit deny wins, and broad “*” permissions are a common trap that breaks least privilege. Service Control Policies in AWS Organizations provide a higher-level guardrail by preventing accounts from performing banned activities regardless of account-level IAM permissions. Decision criteria hinge on scale and trust boundaries: use cross-account roles with least privilege for automation and centralized administration; use IAM roles for services so you avoid credential leakage; use IAM access analyzer for validating cross-account access. Practitioners often forget to rotate keys, to remove unused permissions, or to enable MFA and federation early — these gaps create the largest operational risk.
Data protection, encryption, and key management
Encrypt data in transit and at rest by default. For data in transit, TLS is the baseline; for data at rest, AWS provides multiple options: S3 server-side encryption (SSE-S3, SSE-KMS, SSE-C), EBS and RDS encryption, and client-side encryption when you need customer controls over keys. AWS KMS is the primary managed key service for envelope encryption, enabling customer-managed CMKs, automatic rotation, and fine-grained usage controls via key policies and IAM. KMS integrates with many AWS services to provide auditing of key usage in CloudTrail, but note that KMS operations may incur per-request charges and have regional scope — cross-account or cross-region architectures require explicit key policy configuration or use of multi-Region keys. For FIPS or dedicated HSM needs, AWS CloudHSM offers tenant-dedicated hardware. Use S3 Object Lock and Glacier Vault Lock for immutability and retention compliance when regulatory requirements demand unalterable archives. A common trap is assuming “encrypted” equals “access-controlled”; encryption protects content confidentiality, but access policies and monitoring must still prevent unauthorized use. Choose SSE-KMS when you need key access logs, granular IAM control, or cross-account decryption; use client-side encryption when you must prevent AWS from having plaintext access at any time.
Detection, monitoring, and automated response
Visibility and detection are the lifeblood of cloud security. CloudTrail provides an audit trail for API calls (management events) and can also capture data events for S3 and Lambda; however, many teams overlook enabling data events, creating blind spots. AWS Config records resource configuration changes and enables continuous compliance checks, while Security Hub aggregates findings from GuardDuty (threat detection), Inspector (vulnerability scanning), and Macie (sensitive data discovery). GuardDuty uses multiple telemetry sources (VPC Flow Logs, DNS, CloudTrail) to identify suspicious activity; findings should feed into a central security account and be actionable via EventBridge and automated playbooks (Lambda or SSM Automation) for containment. Logging and retention decisions affect cost: centralized S3 buckets with lifecycle rules and encryption reduce storage expense and simplify audit access. Integrate with SIEMs or use partner integrations for advanced analytics. A recurring practitioner trap is storing logs in the same account or not protecting the trail S3 bucket, which risks tampering; always centralize and enforce immutability and restricted access. Design incident response runbooks that map GuardDuty and CloudTrail findings to concrete containment steps, and test them regularly.
Perimeter protection, DDoS defense, and compliance controls
Layered perimeter controls combine VPC controls, ALB/WAF rules, and DDoS defenses to reduce attack surface. AWS WAF provides application-layer (L7) filtering for web applications, protecting against common exploits and injection attacks. AWS Shield Standard is automatically applied at no extra cost for basic DDoS protections; Shield Advanced offers enhanced mitigation, DDoS cost protections, and an incident response team at a paid tier, which should be considered for high-risk, internet-facing services. AWS Firewall Manager helps manage WAF, Shield Advanced, and AWS Network Firewall policies across multiple accounts. For sensitive data discovery and monitoring within S3, Macie automates PII detection and classification. Compliance artifacts and third-party assessments are available via AWS Artifact for customers to obtain SOC, ISO, and other reports. Common traps include overly permissive WAF rules, exposed S3 buckets due to misconfigured policies, and assuming Shield Advanced removes the need for WAF. Use defense-in-depth: web ACLs at the ALB, secure security groups and NACLs at the subnet level, VPC endpoints to avoid public internet egress for service traffic, and orchestration with Firewall Manager to enforce org-wide standards.
Service comparisons (high-level)
- AWS WAF: Application-layer rule engine for ALB/CloudFront/API Gateway; rule-based protection and rate-limiting.
- AWS Shield Standard: Free DDoS protections for common attacks; applied automatically.
- AWS Shield Advanced: Paid enhanced DDoS mitigation, response team, cost protection, and telemetry.
- AWS Firewall Manager: Centralized policy deployment of WAF, Shield Advanced, and Network Firewall across AWS Organizations.
- Amazon Macie: Sensitive data discovery and classification for S3 with automated alerts.
Practical Problem: Use-Case Scenario
Scenario: AcmeRetail operates a multi-account AWS Organization. Their public storefront runs on a Fleet account behind an ALB, application logs and backups land in S3, and they have a centralized Security account for tooling and auditing.
Challenge: AcmeRetail needs centralized detection and response, strong encryption for customer data across accounts, and consistent web-application protections without adding heavy operational overhead.
Recommended Approach:
- Enable AWS Organizations and create a dedicated Security account; configure an organization-level CloudTrail that logs management and S3 data events to an encrypted S3 bucket in the Security account using a KMS CMK owned by Security.
- Turn on GuardDuty, Security Hub, Macie, and AWS Config in the Security account and enable Organization-wide aggregation so findings from all member accounts flow into Security for triage.
- Deploy AWS WAF on the ALB with OWASP-managed rules and enable AWS Firewall Manager to enforce the same web ACL across member accounts; evaluate Shield Advanced for the storefront if business continuity risk is high.
- Use IAM Identity Center (federated SSO) for centralized human access, enforce MFA and least-privilege roles, and implement automated remediation playbooks (EventBridge -> Lambda) for high-severity GuardDuty findings.
Rationale: Centralizing logs and detection in a security account with CMK-encrypted trails ensures tamper-resistant visibility and simplified audits, while organization-level enforcement (Firewall Manager, SCPs) and federated identity reduce configuration drift and human-related risks — aligning with least-privilege and defense-in-depth best practices.
← Networking · All domains · Billing →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →