← CLF-C02 Study Guide
Chapter 2 · 30% of the exam
Security & Identity
Shared responsibility, IAM, least privilege, MFA, security services, and CloudTrail vs CloudWatch.
Topics
- 2.1
Shared Responsibility Model
AWS secures the cloud; customers secure what they put in the cloud — responsibilities shift by service model.
- 2.2
IAM (users, groups, roles, policies)
Control who can access AWS resources using identities, collective permissions, assumable roles, and JSON policies.
- 2.3
Least Privilege & MFA
Grant only required permissions; require MFA especially for privileged access.
- 2.4
Security services table
Map IAM, KMS, CloudTrail, GuardDuty, WAF, Shield, Artifact, and Macie to their primary purposes.
- 2.5
CloudTrail vs CloudWatch
CloudTrail records API activity; CloudWatch monitors metrics, logs, alarms, and dashboards.