CLF-C02 Deep Dive: Security, Compliance and Cloud Technology (Domains 2 & 3)

Domains 2 and 3 of the AWS Certified Cloud Practitioner (CLF-C02) make up 64% of your scored questions. If you master these two domains, you can afford a few mistakes elsewhere and still pass comfortably. This deep-dive guide covers every service, concept, and comparison table you need for Security and Compliance (Domain 2, 30%) and Cloud Technology and Services (Domain 3, 34%).

This is not a surface-level overview. We break down each service with enough detail to answer exam questions confidently, including the 2026 updates to AI/ML services that now appear regularly on the CLF-C02.

Domain 2: Security and Compliance (30%)

The Shared Responsibility Model

This is the single most important concept on the entire CLF-C02 exam. AWS uses a "shared responsibility" model that divides security duties between AWS and the customer:

• AWS is responsible for security OF the cloud: physical data centers, hardware, networking infrastructure, hypervisor, managed service infrastructure (the parts you cannot touch).
• The customer is responsible for security IN the cloud: data encryption, IAM configuration, security group rules, OS patching (on EC2), application code, and network configuration.

IAM (Identity and Access Management)

IAM is the foundation of AWS security. You must understand these components:

• IAM Users: Individual identities with long-term credentials (username/password or access keys). Best practice: create individual users, never share credentials.
• IAM Groups: Collections of users. Attach policies to groups, not individual users. A user can belong to multiple groups.
• IAM Roles: Temporary credentials assumed by users, applications, or AWS services. No long-term credentials. Use roles for EC2 instances, Lambda functions, and cross-account access.
• IAM Policies: JSON documents that define permissions (Allow or Deny actions on resources). Follow the principle of least privilege — grant only the permissions needed.
• Root Account: The account created when you sign up for AWS. Has unrestricted access. Best practice: enable MFA, do not use for daily tasks, lock away access keys.

AWS Organizations and Control Tower

AWS Organizations lets you manage multiple AWS accounts from a central management account. Key features: consolidated billing, Service Control Policies (SCPs) to restrict what member accounts can do, and Organizational Units (OUs) for grouping accounts.

AWS Control Tower automates the setup of a multi-account environment following AWS best practices. It creates a landing zone with guardrails (preventive and detective) that enforce compliance across all accounts.

Security Services Comparison

The CLF-C02 tests your ability to pick the right security service for a given scenario. Here is the definitive comparison:

Domain 3: Cloud Technology and Services (34%)

This is the heaviest domain and covers the broadest range of services. The key is knowing what each service does and when to choose it — you do not need to know how to configure them in the console.

Compute Services

Storage Services

Other Storage Services: Amazon EBS (block storage for EC2 — like a virtual hard drive, single-AZ), Amazon EFS (managed NFS file system, multi-AZ, scales automatically), and Amazon FSx (managed Windows File Server or Lustre for HPC workloads).

Database Services

Networking Essentials

You need to know these networking concepts at a high level:

• Amazon VPC: Your isolated virtual network in AWS. You control IP ranges, subnets, route tables, and gateways.
• Security Groups: Virtual firewalls at the instance level. Stateful (return traffic automatically allowed). Default: deny all inbound, allow all outbound.
• Network ACLs: Firewalls at the subnet level. Stateless (must explicitly allow return traffic). Default: allow all.
• Amazon Route 53: DNS service. Routes users to your application. Supports health checks and routing policies (simple, weighted, latency, failover, geolocation).
• Amazon CloudFront: CDN (Content Delivery Network). Caches content at Edge Locations globally. Reduces latency for end users.
• AWS Global Accelerator: Routes traffic through AWS backbone to the nearest healthy endpoint. Improves availability and performance for global applications.

AI/ML Services (2026 Update)

The CLF-C02 now includes questions about AI and ML services. You need to know what each service does — not how to build models.

Serverless Services Summary

The CLF-C02 increasingly emphasizes serverless services. A serverless service means you do not manage any servers — AWS handles provisioning, scaling, and patching. The key serverless services to know:

• AWS Lambda — Serverless compute (run code without servers)
• AWS Fargate — Serverless containers
• Amazon DynamoDB — Serverless NoSQL database
• Amazon S3 — Serverless object storage
• Amazon Aurora Serverless — Serverless relational database
• Amazon API Gateway — Serverless API management
• AWS Step Functions — Serverless workflow orchestration
• Amazon SQS/SNS — Serverless messaging and notifications
• Amazon EventBridge — Serverless event bus

When a CLF-C02 question asks for the option with "least operational overhead" or "no infrastructure management," the answer is almost always the serverless option. Master these two domains and you will have a strong foundation for 64% of the exam.