Study Hub / AWS Certified Cloud Practitioner (CLF-C02) / Domain 2.0
AWS Certified Cloud Practitioner (CLF-C02) Domain 2.0: Security and Compliance — Explained
Domain 2.0 is the biggest conceptual domain on the CLF-C02: who secures what, how identity works on AWS, and how AWS proves its own compliance so customers can inherit it. Get the responsibility line right and half this domain answers itself.
Shared responsibility, applied
Domain 1 introduced the line; Domain 2 makes you walk it:
- AWS ("of" the cloud) — physical facilities, hardware, network infrastructure, virtualization software. Plus, for managed services, the OS and platform patching.
- Customer ("in" the cloud) — your data (classification, encryption, lifecycle), your IAM users/roles/policies, your network controls (security groups, NACLs), your application security.
- The line moves by service — EC2: you patch the guest OS. RDS: AWS patches the database engine; you still own the data and access. The more managed the service, the more AWS owns.
- What never moves — data classification, IAM configuration, and client-side encryption choices are always yours.
IAM concepts: identity on AWS
- Users, groups, roles — users are people (or apps) with long-term credentials; groups collect users for easier policy assignment; roles grant temporary credentials meant to be assumed (EC2 instances, cross-account access, federation).
- Policies — JSON documents stating what an identity may do. Identity-based policies attach to users/groups/roles; resource-based policies attach to resources (like S3 bucket policies).
- Least privilege — grant only the permissions needed, nothing more. The exam treats it as a principle, not a feature.
- MFA — multi-factor authentication for the root user and privileged IAM users. The root user gets MFA first, before anything else is configured.
- Root user — the account's all-powerful identity. Use it once to set up, lock it down with MFA, then never touch it for daily work.
Compliance on AWS: inherit, don't rebuild
- AWS compliance programs — SOC, PCI DSS, HIPAA-eligible services, ISO 27001, FedRAMP. AWS is audited once; customers inherit those controls for the "of the cloud" portion.
- AWS Artifact — the self-service portal for downloading compliance reports. An auditor asks for AWS's SOC 2? You pull it from Artifact.
- Customer compliance — you still own compliance in the cloud: your data handling, your access reviews, your logging. Inheritance covers the data center, not your bucket policies.
- Encryption concepts — at rest (EBS/S3 encryption, KMS-managed keys) and in transit (TLS). KMS is the key-management service; focus on the concept (centralized key control, audit trail) more than the API.
The must-memorize table: IAM identities
Pick the right identity for the scenario.
| Identity | What it is | Use it when |
|---|---|---|
| Root user | The account itself, unlimited power | Initial setup only — then MFA + lock away |
| IAM user | A person or app with long-term credentials | Humans who need console/CLI access |
| IAM group | A collection of users | Assigning the same policies to many people |
| IAM role | Temporary credentials to be assumed | EC2 apps, cross-account, federation |
| Policy | JSON allow/deny document | Defining exactly what an identity may do |
Try it: 4 sample questions
Sample questions to check your understanding of this domain. Answers and full reasoning are tucked under each one.
1. An application running on EC2 needs to read from an S3 bucket. What is the best-practice way to grant access?
- A. A. Create an IAM user and embed its access keys in the application code
- B. B. Attach an IAM role to the EC2 instance with S3 read permissions
- C. C. Make the S3 bucket publicly readable
- D. D. Share the root user credentials with the application
Show answer & reasoning
B. Roles provide temporary credentials automatically — no long-term keys to leak, rotate, or embed. Embedded keys (A) are the classic breach pattern; public buckets (C) expose data to the internet; root credentials (D) should never leave the safe. "Application needs AWS access" → role, every time.
2. A new AWS account is created. What is the first security action to take?
- A. A. Launch EC2 instances for the workload
- B. B. Enable MFA on the root user and avoid using it for daily tasks
- C. C. Create a VPC with public subnets
- D. D. Enable CloudTrail in all regions
Show answer & reasoning
B. The root user can do anything, including deleting the account — so it gets MFA immediately and is then set aside in favor of IAM users/roles. Everything else (C, D) is important but secondary to locking the front door. The exam asks this constantly because real breaches start here.
3. An auditor asks for evidence of AWS's PCI DSS compliance. Where does the customer get it?
- A. A. By running their own penetration test against AWS data centers
- B. B. From AWS Artifact — the compliance report portal
- C. C. From CloudTrail logs
- D. D. By opening a support case asking for an attestation letter
Show answer & reasoning
B. AWS Artifact is the self-service portal for compliance reports and certifications — SOC, PCI, ISO, and more. Customers inherit AWS's audited controls and prove it with Artifact documents. You cannot pentest AWS facilities yourself (A); CloudTrail (C) logs your API activity, not AWS's compliance.
4. A company uses RDS for its database. Who patches the database engine, and who is responsible for the data in it?
- A. A. AWS patches the engine; the customer owns the data
- B. B. The customer patches everything
- C. C. AWS owns both the engine and the data
- D. D. Neither — RDS is fully autonomous
Show answer & reasoning
A. RDS is a managed service: AWS takes the OS and engine patching ("of the cloud" grows), but the customer's data — its classification, access, backups, encryption — stays firmly "in the cloud," i.e., yours. The line moved, but data ownership never crosses it.
This was one domain. The simulator drills all 4.
This free preview covered Security and Compliance (Domain 2.0, 30%). Not covered here: Cloud Technology and Services (Domain 3.0, 34%). The entire largest domain — every core AWS service deep-dive — plus advanced shared-responsibility scenarios and compliance-program detail stay in the paid guide and practice bank. The ByteBar Practice Exam Simulator drills every domain with 1,000 exam-style questions — $9.99 one-time unlocks all 28 exams. Prefer to read? The full AWS Cloud Practitioner Study Guide is in the ByteBar shop on Etsy.
Practice Exam Simulator — $9.99 one-time, all 28 exams Full Study Guides on Etsy