ExamFinch.com My Study

Study guide

5.3 Security Services Deep Dive

Practice this exam

AWS Certified Cloud Practitioner CLF-C02

Track your progress as you read

Finished sections get a check mark.

1 Introduction

About the AWS Cloud Practitioner (CLF-C02) Exam Study Strategies and Exam Tips

2 Domain 1: Cloud Concepts (24%)

1.1 What Is Cloud Computing? 1.2 Cloud Deployment Models 1.3 AWS Well-Architected Framework 1.4 Cloud Migration Strategies 1.5 Cloud Economics

3 Domain 2: Security and Compliance (30%)

2.1 The AWS Shared Responsibility Model 2.2 AWS Identity and Access Management (IAM) 2.3 AWS Security Services 2.4 Compliance and Governance 2.5 Network Security

4 Domain 3: Cloud Technology and Services (34%)

3.1 AWS Compute Services 3.2 AWS Storage Services 3.3 AWS Database Services 3.4 AWS Networking and Content Delivery 3.5 Management and Governance Services 3.6 AI/ML and Analytics Services 3.7 Application Integration and Other Services

5 Domain 4: Billing, Pricing, and Support (12%)

4.1 AWS Pricing Models 4.2 Billing and Cost Management Tools 4.3 AWS Support Plans 4.4 Additional Billing Concepts and Services

6 AWS Services Deep Dive

5.1 Compute Services Deep Dive 5.2 Storage and Database Deep Dive 5.3 Security Services Deep Dive 5.4 Architecture Best Practices and Design Principles 5.5 Practice Exam — Mixed Domain Questions

5.3 Security Services Deep Dive

Key Takeaways Explain This Topic AI

AWS IAM Identity Center (formerly AWS SSO) provides single sign-on access to multiple AWS accounts and business applications.

AWS Cognito provides authentication and authorization for web and mobile applications — supports user sign-up/sign-in and federation.

AWS Directory Service provides managed Microsoft Active Directory for Windows workloads on AWS.

Amazon GuardDuty analyzes CloudTrail, VPC Flow Logs, DNS logs, and EKS audit logs to detect threats using ML.

AWS Security Token Service (STS) provides temporary security credentials for IAM roles and federated users.

Last updated: October 2026

Quick Answer: This deep dive separates the identity services the exam confuses — IAM (AWS account access), IAM Identity Center (SSO across many accounts), and Cognito (your application's end users) — then covers encryption at rest and in transit , KMS key types , and the detective/compliance services (GuardDuty, Inspector, Macie, Config, CloudTrail, Security Hub).

  • Identity Services
  • AWS IAM Identity Center (formerly AWS SSO)

IAM Identity Center provides centralized single sign-on to multiple AWS accounts and business applications.

  • Feature Detail
  • Single Sign-On One login across all accounts in your Organization
  • Directory Built-in, or integrate Active Directory, Okta, Microsoft Entra ID
  • Permission Sets Define permissions once, assign to many accounts
  • Business Apps SSO to Salesforce, Slack, Microsoft 365, and more
  • Amazon Cognito

Amazon Cognito adds authentication and authorization to your web and mobile apps.

  • Feature Detail
  • User Pools Sign-up/sign-in directory (username/password, social)
  • Identity Pools Issue temporary AWS credentials to app users
  • Federation Sign in with Google, Facebook, Apple, SAML, OIDC
  • MFA Built-in multi-factor support
  • Scaling Millions of users

On the Exam: Cognito = authentication for your APPLICATION'S users. IAM = access control for your AWS ACCOUNT. This exact distinction is tested repeatedly.

AWS Directory Service

  • Service Description
  • AWS Managed Microsoft AD Full Microsoft Active Directory in the cloud
  • AD Connector Proxy redirecting requests to your on-premises AD
  • Simple AD Basic AD features powered by Samba
  • Encryption Deep Dive
  • Encryption at Rest
  • Service Method
  • S3 SSE-S3 (default), SSE-KMS, SSE-C; or client-side
  • EBS AES-256 via KMS; encrypt on creation
  • RDS KMS for storage, backups, snapshots, replicas
  • DynamoDB KMS (AWS-owned, AWS-managed, or customer-managed)
  • EFS KMS at file-system creation
  • Encryption in Transit
  • Method Description
  • TLS/SSL HTTPS to AWS service endpoints and APIs
  • VPN Encrypted tunnel between on-premises and AWS
  • AWS Certificate Manager (ACM) Free public SSL/TLS certificates for AWS services
  • AWS KMS Key Types
  • Key Type Description Control
  • AWS Owned AWS owns and manages; shared None
  • AWS Managed Per-service keys (aws/s3, aws/rds) View only; auto rotation
  • Customer Managed You create and manage in KMS Full control; policy + rotation

On the Exam: "Most control over keys" = Customer Managed Keys . For automatically rotating secrets like database passwords, the answer is AWS Secrets Manager (not KMS, which manages the encryption keys themselves).

  • Advanced Security Services
  • AWS WAF

A web application firewall with managed rules (OWASP Top 10, bot control), custom rules (IP, geo, string/regex match), and rate-based rules that auto-block IPs exceeding a request rate. WAF protects Layer-7 web traffic on CloudFront, ALB, and API Gateway.

Amazon GuardDuty

Intelligent threat detection that analyzes CloudTrail events, VPC Flow Logs , DNS logs , EKS audit logs , and more using ML to surface findings such as cryptomining, communication with command-and-control servers, and unusual API calls — with no agents to deploy.

AWS Network Firewall

A managed, stateful network firewall for VPCs with intrusion prevention, web filtering, and Suricata-compatible custom rules.

AWS Shield

Managed DDoS protection . Shield Standard is automatic and free; Shield Advanced adds enhanced protections, cost-protection guarantees, and DDoS response support.

Compliance and Detective Services

  • Service Purpose
  • AWS Artifact Self-service compliance reports (SOC, PCI, ISO)
  • AWS Audit Manager Automate audit evidence collection (no longer open to new customers)
  • AWS Config Evaluate resource configurations against rules
  • AWS CloudTrail Log all API activity for auditing
  • Amazon Inspector Scan workloads for software vulnerabilities
  • Amazon Macie Discover and protect sensitive data (PII) in S3
  • AWS Security Hub Aggregate and prioritize security findings

On the Exam: Match the verb: detect threats = GuardDuty; scan for vulnerabilities = Inspector; find PII in S3 = Macie; log API calls = CloudTrail; download audit reports = Artifact; central security dashboard = Security Hub. These one-line mappings answer most Security-domain questions.

The Shared Responsibility Model in Practice

Every security question ultimately sits on the Shared Responsibility Model : AWS secures the cloud (hardware, the global infrastructure, the managed-service software), while the customer secures what is in the cloud (data, identity, configuration, and access). The line moves with the service. For EC2 (IaaS), the customer patches the guest OS, configures security groups, and manages encryption. For a managed service like RDS, AWS patches the OS and engine, but the customer still controls data, IAM access, and whether encryption is enabled.

For fully managed and serverless services like S3, DynamoDB, or Lambda, the customer's job narrows mostly to data, access policies, and configuration.

Three responsibilities are always the customer's , regardless of service: protecting the root user (enable MFA, avoid daily use), enforcing least-privilege IAM , and classifying and encrypting their own data . Many exam questions phrase this as "who is responsible for X?" — and the answer follows from whether X concerns the underlying infrastructure (AWS) or the data, identities, and configuration on top of it (customer). Reading each scenario through that lens turns a large share of Security-domain questions into quick, confident answers.