AWS Shared Responsibility, Security and Compliance for CLF-C02

CLF-C02 tests the AWS shared responsibility model, customer responsibilities, AWS responsibilities, IAM basics, root user protection, encryption concepts, monitoring, audit logging, governance and compliance resources.

Security and Compliance is a heavily weighted domain, so candidates should treat it as core preparation rather than a short side topic.

AWS is responsible for security of the cloud, including the global infrastructure that runs AWS services. Customers are responsible for security in the cloud, including data, access, configuration and workload choices.

The exact boundary changes by service. With Amazon EC2, customers manage more of the operating system and application layer. With managed services, AWS takes on more operational responsibility, but customers still configure access and data protection.

AWS Identity and Access Management helps control who can access what. Know users, groups, roles, policies, least privilege and multi-factor authentication at a foundational level.

The root user should be protected carefully and not used for everyday tasks. Exam questions may ask about MFA, least privilege, access keys or tasks that require root-level action.

CLF-C02 may ask about encryption at rest, encryption in transit, audit activity, monitoring and compliance information. CloudTrail, CloudWatch, AWS Config, AWS Artifact, AWS Security Hub, Amazon GuardDuty and AWS Trusted Advisor can appear in security contexts.

Do not simply memorise names. Learn the job: CloudTrail records API activity, CloudWatch monitors metrics and logs, Artifact provides access to compliance reports, and GuardDuty helps detect threats.

The biggest mistake is saying AWS handles everything because it is cloud. The second biggest mistake is confusing identity control with network control. IAM permissions and security group traffic rules solve different problems.

A third mistake is ignoring service context. Responsibility for patching differs between unmanaged, managed and serverless service models.

How to Practise Shared Responsibility

Security Services as Jobs, Not Names

Quality Study Notes for AWS shared responsibility model

For this topic, the safest preparation habit is to connect every fact to a decision. Do not only write that a service exists; write what problem it solves, what it is commonly confused with, and what wording would point toward it in an exam scenario. This turns passive reading into usable exam knowledge.

Use a three-column review note: clue, answer, reason. The clue is the wording in the question, the answer is the service or concept, and the reason is the rule that makes it correct. If you cannot write the reason in one sentence, the topic is not yet stable enough for timed practice.

Also keep a short list of near-miss concepts. For AWS Cloud Practitioner, near misses often include CloudWatch versus CloudTrail, S3 versus EBS versus EFS, IAM versus security groups, Pricing Calculator versus Budgets versus Cost Explorer, and AWS responsibility versus customer responsibility. Reviewing near misses gives you more improvement than rereading topics you already know.

Finally, practise explaining answers out loud or in short written notes. CLF-C02 is not a writing exam, but the ability to explain a choice reveals whether you truly understand the concept. If your explanation sounds vague, return to the domain map and rebuild the distinction.

When you review this page, choose one concrete output before moving on: a comparison table, a set of flash rules, a repaired weak topic, or a short mixed practice set. Study becomes much more effective when every reading session produces something you can test later.

Keep your language simple. The exam is not asking for marketing descriptions or architecture essays. It is asking whether you can recognise the right service family, responsibility boundary, cost tool or cloud concept from a realistic prompt. Simple language often reveals the right answer faster than memorised product copy.

Before you leave the topic, ask one final question: what would make me choose the wrong answer here? That question points directly to the distractor you need to study. For many candidates, improvement comes from understanding why a similar AWS service is not the answer.

This is especially important for shorter study sessions. A 20-minute session can still be valuable when it produces one clear distinction and one corrected mistake. Small, precise repairs compound faster than vague rereading.

Keep the final output visible: one clearer rule, one fewer recurring mistake, and one more confident answer choice.

That steady improvement is the point of preparation: fewer surprises, cleaner reasoning, and a calmer exam-day process.

Small corrections matter here because the exam rewards precise distinctions.

Keep practising until those distinctions feel automatic.

Exam Tip

Read the task verb before choosing a service. Estimate, monitor, audit, secure, store and analyse point to different AWS service families.

Common Mistake

Do not treat every workload as an EC2 question. Many CLF-C02 items reward recognising managed, serverless or specialised services.