Skip to content

CLF-C02 Study Notes: Task Statement 2.2

Understand AWS Cloud security, governance, and compliance concepts

1. AWS Compliance Concepts

AWS provides security and compliance programs, documentation, reports, and control mappings to help customers assess their AWS environments.

AWS Artifact

AWS Artifact provides on-demand access to AWS security and compliance documents, including:

  • Compliance reports
  • Certifications
  • Agreements
  • Control mappings
  • Documentation related to AWS compliance programs

Exam focus

If asked where to find information about whether an AWS service supports a compliance standard such as GDPR, look for:

AWS Artifact

However, do not assume that every AWS service automatically meets every compliance requirement.

Important compliance principle

Compliance responsibilities can vary:

  • Between AWS services
  • Depending on how the service is configured
  • Depending on the customer’s own processes and controls
  • Depending on the applicable regulation or standard

AWS provides compliant infrastructure and services, but customers are still responsible for configuring and using them appropriately.

Exam tip

The exam is unlikely to require memorizing exactly which AWS services comply with every regulation. Focus on:

  • Knowing where compliance documentation is found
  • Understanding that compliance requirements vary by service
  • Recognizing that compliance is shared between AWS and the customer

Common trap

Incorrect: “If AWS is compliant with GDPR, every resource in every AWS service is automatically GDPR compliant.”

Correct: AWS provides compliance-related infrastructure and documentation, but the customer must configure and operate services in a compliant manner.

2. AWS Security Services

AWS provides several services that address different security needs. Be able to identify the purpose of each service.

Service Primary purpose
AWS WAF Protects web applications from common web exploits
AWS Shield Helps protect against distributed denial-of-service attacks
Amazon GuardDuty Detects threats and suspicious or unauthorized activity
Amazon Inspector Helps identify software vulnerabilities and unintended network exposure
AWS Security Hub Provides a centralized view of security findings
AWS Artifact Provides security and compliance documents and reports

AWS WAF

AWS WAF, or Web Application Firewall, helps protect web applications from common attacks and exploits.

It can help protect against threats that may:

  • Compromise application security
  • Affect application availability
  • Consume excessive resources

Examples of web application attacks include SQL injection and cross-site scripting.

WAF compared with security groups and network ACLs

  • Security groups control traffic to and from AWS resources, such as EC2 instances.
  • Network ACLs control traffic at the subnet level.
  • AWS WAF filters HTTP and HTTPS requests to web applications based on web request rules.

WAF is an application-layer protection service, not a replacement for security groups or network ACLs.

AWS Shield

AWS Shield is a managed DDoS protection service.

  • AWS Shield Standard provides basic protection automatically for AWS customers.
  • AWS Shield Advanced provides additional DDoS protection and features for eligible resources.

AWS WAF compared with AWS Shield

Requirement Appropriate service
Block common web exploits or filter web requests AWS WAF
Protect against DDoS attacks AWS Shield

Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for:

  • Malicious activity
  • Unauthorized behavior
  • Suspicious account or resource activity

GuardDuty analyzes relevant AWS data sources and produces security findings.

Amazon Inspector

Amazon Inspector helps identify security vulnerabilities in supported workloads, such as:

  • Software vulnerabilities
  • Unintended network exposure

AWS Security Hub

AWS Security Hub provides a centralized location to view and manage security findings from AWS security services and supported partner products.

Exam tip

Match the wording in the question to the service:

  • “Detect threats” or “suspicious activity” → GuardDuty
  • “Common web exploits” → WAF
  • “DDoS protection” → Shield
  • “Vulnerabilities” → Inspector
  • “Centralized security findings” → Security Hub

3. Encryption

Encryption protects data by converting it into a form that unauthorized users cannot easily read. A key is used to encrypt and decrypt the data.

Encryption is commonly divided into two categories:

Encryption in transit

Protects data while it is moving between locations, such as:

  • A user and a web application
  • An application and a database
  • AWS services communicating with each other

Common technologies include HTTPS and TLS.

Encryption at rest

Protects stored data, such as:

  • Objects in Amazon S3
  • Data in Amazon EBS volumes
  • Database contents
  • Backups
  • Files stored in other AWS services

Comparison

Type Protects data when...
In transit It is moving across a network
At rest It is stored on disk or other persistent storage

Shared responsibility and encryption

Responsibility for enabling and managing encryption depends on the AWS service.

AWS may provide:

  • Encryption capabilities
  • Default encryption options
  • Key management infrastructure
  • Secure underlying facilities

The customer may need to:

  • Enable encryption
  • Select encryption settings
  • Manage access to encryption keys
  • Configure encryption for the specific service

Always consider the service-specific documentation and the AWS shared responsibility model.

Exam traps

  • Encryption at rest does not mean that data is protected while it travels over a network.
  • Encryption in transit does not automatically encrypt stored data.
  • Encryption is not always enabled or configured in the same way for every AWS service.
  • Do not assume AWS manages every part of encryption for the customer.

4. Logging, Monitoring, Auditing, and Configuration Management

AWS provides different services for observing account activity, monitoring workloads, and assessing resource configurations.

Amazon CloudWatch

Amazon CloudWatch is used for:

  • Monitoring AWS resources and applications
  • Collecting metrics
  • Collecting logs
  • Creating alarms
  • Observing operational health and performance

Typical use case:

Notify an administrator when an EC2 instance’s CPU utilization is too high.

CloudWatch focuses primarily on operational monitoring.

AWS CloudTrail

AWS CloudTrail records API activity and account activity related to actions taken in AWS.

It can help answer questions such as:

  • Who created a resource?
  • Who deleted an EC2 instance?
  • Which IAM user or role changed a security group?
  • When was an AWS resource modified?
  • From where was an API request made?

Typical use case:

Identify the IAM user who deleted an Amazon EC2 instance.

The correct service is:

AWS CloudTrail

CloudTrail supports governance, compliance, operational auditing, and risk auditing.

AWS Config

AWS Config is used to:

  • Record and evaluate resource configurations
  • Maintain an inventory of AWS resources
  • Track configuration changes
  • Determine whether resources comply with configuration rules

Typical use case:

Check whether all S3 buckets comply with a required configuration rule.

AWS Config focuses on the configuration state of resources, rather than primarily recording who performed an API action.

AWS Audit Manager

AWS Audit Manager helps collect and organize evidence to support audits and compliance assessments.

It can help with:

  • Assessing compliance against frameworks
  • Collecting relevant evidence
  • Preparing for audits
  • Generating audit-related reports

Service comparison

Service Main question it answers
CloudWatch What is happening operationally?
CloudTrail Who performed an API action, and when?
AWS Config What is the current or historical configuration of a resource?
Audit Manager How can evidence be collected and organized for an audit?

CloudWatch vs. CloudTrail

Requirement Service
Monitor CPU, memory, application logs, or alarms CloudWatch
Determine who deleted an EC2 instance CloudTrail
Record API calls and resource management activity CloudTrail
Monitor operational performance CloudWatch

CloudTrail trails

A CloudTrail trail can be configured to record events across multiple AWS Regions.

For broad account activity coverage, a common best practice is to create a:

Multi-Region CloudTrail trail

Exam traps

  • CloudWatch is not the primary service for identifying who deleted an AWS resource.
  • CloudTrail is not primarily a performance-monitoring service.
  • AWS Config is not the same as CloudTrail:
  • CloudTrail records actions and API activity.
  • Config evaluates resource configurations.
  • Audit Manager helps with audit evidence; it is not the same as CloudTrail event logging.

5. Least-Privilege Access

The principle of least privilege means granting users, groups, and applications only the permissions they need to perform their tasks—and no more.

For example:

  • A developer may need to read objects from a specific S3 bucket.
  • The developer may not need permission to delete the bucket.
  • An application may need access to one DynamoDB table but not all AWS resources.

Least privilege reduces the impact of:

  • Accidental changes
  • Compromised credentials
  • Unauthorized access
  • Misconfigured applications

Exam tip

When a question asks how to improve security by limiting permissions, the answer is usually:

Apply the principle of least privilege.

Detailed identity and access management concepts are covered more fully in the access management task statement.

Exam Tips and Traps

  1. AWS Artifact is the source for compliance documents and reports.
  2. Do not assume all AWS services automatically satisfy every compliance requirement.
  3. AWS WAF protects web applications from common web exploits.
  4. AWS Shield protects against DDoS attacks.
  5. GuardDuty detects threats and suspicious activity.
  6. CloudTrail records API and account activity.
  7. CloudWatch monitors operational performance and collects metrics and logs.
  8. AWS Config tracks and evaluates resource configurations.
  9. Audit Manager helps collect and organize evidence for audits.
  10. Know the difference between:
    • Encryption at rest
    • Encryption in transit
  11. Encryption settings and responsibilities can vary by AWS service.
  12. Use least privilege by granting only the permissions required.

Practice Questions

Question 1

A company needs to determine which IAM user deleted an Amazon EC2 instance. Which AWS service should it use?

A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. Amazon GuardDuty

Answer: B. AWS CloudTrail

Explanation: CloudTrail records AWS API activity, including actions such as creating, modifying, and deleting resources. It can identify the user or role that performed the action.

Question 2

A company wants to protect its web application from SQL injection attacks. Which AWS service should it use?

A. AWS Shield
B. AWS WAF
C. Amazon GuardDuty
D. AWS Config

Answer: B. AWS WAF

Explanation: AWS WAF helps protect web applications against common web exploits, including SQL injection and cross-site scripting.

Question 3

Which AWS service provides managed protection against distributed denial-of-service attacks?

A. AWS Shield
B. AWS WAF
C. Amazon Inspector
D. Amazon CloudWatch

Answer: A. AWS Shield

Explanation: AWS Shield is designed to help protect AWS applications and resources from DDoS attacks.

Question 4

An organization wants to find AWS compliance reports and security documentation on demand. Which service should it use?

A. AWS Config
B. AWS Artifact
C. AWS Audit Manager
D. AWS Security Hub

Answer: B. AWS Artifact

Explanation: AWS Artifact provides on-demand access to AWS security and compliance reports, certifications, and related documents.

Question 5

Which service continuously monitors for malicious activity and unauthorized behavior in an AWS account?

A. Amazon GuardDuty
B. Amazon Inspector
C. AWS CloudTrail
D. Amazon CloudWatch

Answer: A. Amazon GuardDuty

Explanation: GuardDuty is a threat detection service that identifies suspicious and potentially malicious activity.

Question 6

A company wants to verify that all resources maintain the required configuration settings. Which AWS service should it use?

A. AWS Config
B. AWS CloudTrail
C. Amazon CloudWatch
D. AWS Shield

Answer: A. AWS Config

Explanation: AWS Config records resource configurations, tracks configuration changes, and evaluates resources against configuration rules.

Question 7

Which statement correctly describes encryption in transit?

A. It protects data stored on an EBS volume.
B. It protects data while it moves between systems.
C. It automatically protects all data in an AWS account.
D. It replaces the need for access control.

Answer: B. It protects data while it moves between systems.

Explanation: Encryption in transit protects data as it travels across a network. Encryption at rest protects stored data.

Question 8

A company wants to provide an auditor with organized evidence for a compliance assessment. Which AWS service can help?

A. AWS Audit Manager
B. Amazon GuardDuty
C. AWS Shield
D. Amazon Inspector

Answer: A. AWS Audit Manager

Explanation: AWS Audit Manager helps collect and organize evidence for audits and compliance assessments.

Question 9

Which principle requires that users receive only the permissions necessary to perform their assigned tasks?

A. Defense in depth
B. Least privilege
C. Fault tolerance
D. High availability

Answer: B. Least privilege

Explanation: Least privilege limits permissions to only what is required, reducing the risk of unauthorized or accidental actions.