CLF-C02
Deep Dive
AWS offers a full ecosystem of security services. The CLF-C02 tests your ability to identify the right service for each security scenario. Know the purpose of each one and their key differences.
Contents
| Service | Main function | What it detects / protects |
|---|---|---|
| AWS Shield Standard | Automatic DDoS protection | Layer 3/4 attacks (volumetric, protocol). Included free for everyone. |
| AWS Shield Advanced | Advanced DDoS protection | Layer 7 attacks + 24/7 DRT support + cost protection for DDoS-related spikes. |
| AWS WAF | Web application firewall | SQL injection, XSS, custom rules. Deployed on CloudFront/ALB/API Gateway. |
| Amazon GuardDuty | ML-based threat detection | Anomalous behavior in VPC Flow Logs, CloudTrail, DNS. Intrusion detection. |
| Amazon Inspector | Vulnerability scanning | CVEs in EC2, containers (ECR), and Lambda functions. Automated continuous scanning. |
| Amazon Macie | Sensitive data protection in S3 | PII data (names, credit cards, SSNs) in S3. Uses ML to classify and alert. |
| AWS KMS | Encryption key management | Encryption keys for S3, EBS, RDS, Lambda, etc. FIPS 140-2 Level 2. |
| AWS Secrets Manager | Secret storage and rotation | DB passwords, API keys. Automatic rotation integrated with RDS. |
| AWS CloudTrail | API call auditing | Every API event: who did what, when, from where. |
| AWS Config | Compliance and configuration | History of resource configuration. Is the resource in the correct state? |
| AWS Security Hub | Unified security view | Aggregates findings from GuardDuty, Inspector, Macie, Config into one dashboard. |
| AWS Artifact | Compliance and audit reports | Access to AWS audit reports (SOC, PCI, ISO). For compliance teams. |
Managed protection against Distributed Denial of Service (DDoS) attacks
Shield Standard — free for everyone
Shield Advanced — paid ($3,000/month)
Protects web applications from common attacks like SQL injection and cross-site scripting (XSS)
What AWS WAF can filter
Where WAF is deployed
Create a Web ACL with AWS managed rules to block SQL injection and XSS before they reach your application.
+1 more...
This is the most common D2 question on the CLF-C02
The exam will give a scenario and ask you to choose between GuardDuty, Inspector, and Macie. Memorize the core difference between each one.
Amazon GuardDuty — ML-based threat detection
GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior to protect your AWS accounts, workloads, and data.
Data sources analyzed
What it detects
Exam trap
GuardDuty = anomalous behavior and active threats in your environment. It does NOT scan code for vulnerabilities or look for sensitive data.
Amazon Inspector — vulnerability scanning
Inspector runs automated security assessments to help improve the security and compliance of applications deployed on AWS.
What it scans
What it finds
Exam trap
Inspector = vulnerabilities in the SOFTWARE of your workloads (CVEs, outdated packages). It does NOT detect anomalous behavior or sensitive data in S3.
Amazon Macie — sensitive data protection
Macie is a data security and privacy service that uses machine learning to automatically discover and protect sensitive data in Amazon S3.
Where it works
What it detects (PII)
Exam trap
Macie = sensitive data (PII) IN S3. When the scenario mentions "personal data," "GDPR," "PCI DSS" + S3, the answer is Macie.
AWS Key Management Service (KMS)
Creates and controls the encryption keys used to encrypt data across AWS services. Integrated with S3, EBS, RDS, DynamoDB, Lambda, and more.
AWS Secrets Manager
Stores, rotates, and manages secrets such as database credentials, API keys, and passwords. Removes hardcoded credentials from your code.
Store database credentials in Secrets Manager and configure automatic rotation.
+1 more...
Turn on AWS's managed threat detection and understand which data sources it continuously analyzes.
+1 more...
Records every API activity in your AWS account
CloudTrail records every call to the AWS API: who made it, from which IP, at what time, with what parameters, and what the result was. It's AWS's auditing service.
What it records
Use cases
CloudTrail ≠ CloudWatch
CloudTrail = auditing of API CALLS (who did what). Answers "who?" and "when?" questions.CloudWatch = METRICS monitoring (CPU, memory, latency). Answers "how is it performing?" questions.
Evaluates, audits, and verifies the configuration of AWS resources
AWS Config records how the configuration of AWS resources changes over time and evaluates whether those configurations comply with your organization's compliance rules.
Questions Config answers
Config vs CloudTrail
AWS Security Hub
A centralized, unified view of security alerts and findings from multiple AWS services (GuardDuty, Inspector, Macie, Config, IAM Access Analyzer).
AWS Artifact
An on-demand access portal for AWS compliance reports and agreements. For audit teams that need AWS compliance documentation.
AWS supports encryption in two fundamental states that must both be present for a complete security posture.
Encryption at rest
Stored data is encrypted. If someone gains physical access to the disks, they can't read the data without the keys.
Encryption in transit
Data moving between systems is encrypted. Protects against interception attacks (man-in-the-middle).
AWS KMS — Key Management Service
Generates and manages symmetric and asymmetric encryption keys. Integrated with nearly every AWS service that supports encryption.
AWS CloudHSM — Hardware Security Module
A dedicated hardware security module. Unlike KMS (multi-tenant), CloudHSM gives you exclusive physical control of the hardware where keys are stored.
KMS = for most cases. CloudHSM = when regulation requires physical control of keys (e.g., strict PCI DSS level 1).
AWS Artifact
A portal for downloading AWS audit reports and compliance agreements. Free, on demand.
AWS Audit Manager
Automates evidence collection for audits. Maps controls to compliance frameworks (GDPR, HIPAA, PCI DSS, SOC 2) and generates audit-ready reports.
Compliance standards on AWS
| Standard | Scope | AWS support |
|---|---|---|
| SOC 1/2/3 | Internal controls, operational security | Yes — reports available in AWS Artifact |
| ISO 27001 | Information security management | Yes — certification for AWS infrastructure |
| PCI DSS | Payment card data | Yes — AWS infrastructure is PCI DSS level 1 |
| HIPAA | Health information (US) | Yes — with a signed BAA, eligible services |
| GDPR | Personal data protection (EU) | Yes — tools and a DPA available |
Amazon Detective
Investigates security incidents and analyzes logs (GuardDuty, CloudTrail, VPC Flow) to find the root cause using graph-based analysis.
AWS Certificate Manager (ACM)
Provisions, manages, and renews SSL/TLS certificates for free. Integrates with CloudFront, ALB, API Gateway.
AWS Firewall Manager
Centralized management of AWS WAF, Shield Advanced, and Security Groups across every account in AWS Organizations.
Amazon Cognito
User authentication for web and mobile applications. User Pools (user management) + Identity Pools (AWS access). Also a security service.
Learn to control network traffic with EC2 Security Groups.
+1 more...
Turn on activity auditing in your AWS account with CloudTrail for compliance.
+1 more...
Did you get this topic?
Test what you just learned
A security team discovered that some Amazon S3 buckets contain files with credit card numbers and customers' personal data. Which AWS service should be implemented to automatically detect and alert on this kind of sensitive data in S3?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.