AWS CCP · Domain 2 of 4

AWS CCP Domain 2: Security and Compliance

Security and Compliance is the highest-weighted CCP domain. It covers the AWS shared responsibility model, cloud security and compliance concepts, access management with IAM, and the AWS services and resources that help secure workloads.

Exam format
30%
Official task statements
4
Assessment estimate
~15
Suggested study time estimate
10–15 hrs

About 11 min read Reviewed October 2026

Overview

Domain 2 covers how security and compliance work in AWS. It has four task statements. The shared responsibility model covers which security tasks AWS owns and which the customer owns. Security, governance and compliance concepts cover compliance programs, AWS Artifact, governance services and data protection ideas. Access management covers IAM users, groups, roles and policies, the root user, multi-factor authentication and the principle of least privilege. Components and resources for security cover services such as IAM Identity Center, security monitoring and protection services, and where to find security information.

At 30%, this is the largest domain and the single most important concept is the shared responsibility model. The exam tests it repeatedly: AWS secures the cloud itself, and the customer secures what they put in it. A clear grasp of that boundary and of basic IAM carries most of this domain.

How it's tested

CLF-C02 questions in this domain describe a security task, access need or compliance situation and ask who is responsible or which service helps. The shared responsibility model and basic IAM underlie most answers, at recognition level rather than configuration. Read the full scenario and all options before choosing.

  • Whose responsibility?

    A security task is described, and you decide whether AWS or the customer owns it under the shared responsibility model.

  • Right access control

    An access need is described, and you choose IAM users, roles, MFA or least privilege.

  • Compliance resource

    A compliance or governance need is described, and you choose the service, such as AWS Artifact or Trusted Advisor.

Reasoning it through

A customer asks who patches the operating system on their EC2 instances. Under the shared responsibility model, AWS secures the underlying hardware and the cloud itself, but the customer is responsible for the guest operating system, including patching, on EC2. Recognizing EC2 as an unmanaged compute service where the customer controls the OS points to the customer as responsible.

Task statements 4

Official task statements from the Amazon Web Services outline, in outline order.

2.1 Understand the AWS shared responsibility modelWhich security tasks AWS owns and which the customer owns.
What it means
This covers the AWS shared responsibility model: AWS is responsible for security of the cloud, such as the physical infrastructure, hardware and managed service internals, while the customer is responsible for security in the cloud, such as data, configuration, access management and, for unmanaged services, the guest operating system.
What to understand
The boundary shifts with the service type. For EC2 the customer manages the operating system and patching, while for managed services such as S3 or Lambda AWS handles more. The customer always owns their data, access control and configuration. This is the single most tested concept in the domain.
How it shows up
A security task is described, and you must decide whether AWS or the customer is responsible.
Common confusion
Assuming AWS secures customer data and configuration; the customer always owns those regardless of service.
2.2 Understand AWS Cloud security, governance, and compliance conceptsCompliance programs, AWS Artifact, governance and data protection.
What it means
This covers AWS compliance programs and certifications, AWS Artifact for accessing compliance reports, governance services such as AWS Organizations and service control policies, data protection concepts including encryption, and logging and monitoring for governance.
What to understand
AWS Artifact provides on-demand access to AWS compliance reports and agreements. AWS Organizations and service control policies enforce governance across accounts. Compliance is shared: AWS certifies its infrastructure, and the customer must configure their workloads to meet their own obligations.
How it shows up
A compliance or governance need is described, and you must choose the service or concept, such as AWS Artifact or Organizations.
Common confusion
Confusing AWS Artifact with a security scanning service; Artifact provides compliance reports, not vulnerability scanning.
2.3 Identify AWS access management capabilitiesIAM users, groups, roles, policies, the root user, MFA and least privilege.
What it means
This covers IAM users, groups, roles and policies, the account root user and why to protect and avoid using it, multi-factor authentication, the principle of least privilege, and federation and IAM Identity Center for access at scale.
What to understand
The root user has full account access and should be secured with MFA and used rarely. IAM users and roles provide day-to-day access, with roles giving temporary credentials. Least privilege means granting only the permissions needed. Groups simplify assigning permissions to many users.
How it shows up
An access need is described, and you must choose IAM users, roles, MFA or least privilege, or recognize why the root user should be protected.
Common confusion
Confusing the root user with an IAM user; the root user has unrestricted account access and should rarely be used.
2.4 Identify components and resources for securitySecurity services, monitoring and where to find security information.
What it means
This covers AWS security services and resources such as security monitoring and threat detection services, protective services, encryption key management, AWS Trusted Advisor security checks, and documentation and resources where security guidance is found.
What to understand
AWS provides managed security services for monitoring, threat detection and protection, and resources such as Trusted Advisor that flag security issues. Knowing that these services exist and what each broadly does is enough at this level, rather than configuring them.
How it shows up
A security monitoring or protection need is described, and you must identify the relevant AWS service or resource.
Common confusion
Expecting to configure security services; at this level the exam tests recognizing what each service does.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Shared responsibility model

    AWS secures the cloud; the customer secures what they put in it.

    Remember
    The customer always owns data, access and configuration.
    Tested as
    The most tested concept in the domain.
    Trap
    Assuming AWS secures customer data.

  • Security of vs. in the cloud

    AWS handles security of the cloud (infrastructure); the customer handles security in the cloud (their workloads).

    Remember
    The boundary shifts with service type.
    Tested as
    Responsibility questions.
    Trap
    Applying one boundary to every service.

  • Root user

    The account owner with full, unrestricted access.

    Remember
    Protect it with MFA and use it rarely.
    Tested as
    Access management questions.
    Trap
    Using the root user for daily tasks.

  • IAM users, groups and roles

    Identities and permission containers; roles give temporary credentials.

    Remember
    Use roles for services and groups to manage permissions at scale.
    Tested as
    Access questions.
    Trap
    Confusing the root user with an IAM user.

  • Least privilege

    Granting only the permissions needed.

    Remember
    It is a core AWS security best practice.
    Tested as
    Access questions.
    Trap
    Granting broad permissions.

  • Multi-factor authentication (MFA)

    A second authentication factor beyond a password.

    Remember
    Enable it on the root user and privileged accounts.
    Tested as
    Access questions.
    Trap
    Relying on passwords alone.

  • AWS Artifact

    On-demand access to AWS compliance reports and agreements.

    Remember
    It provides compliance evidence, not scanning.
    Tested as
    Compliance questions.
    Trap
    Confusing it with a security scanner.

  • AWS Organizations

    Central management and governance across multiple accounts.

    Remember
    Service control policies enforce guardrails.
    Tested as
    Governance questions.
    Trap
    Confusing it with IAM for a single account.

  • AWS Trusted Advisor

    Checks that flag security, cost and other best-practice issues.

    Remember
    It recommends improvements, including security.
    Tested as
    Security resource questions.
    Trap
    Expecting it to remediate automatically.

  • Compliance is shared

    AWS certifies its infrastructure; the customer configures workloads to meet obligations.

    Remember
    Certification of AWS does not make a workload compliant.
    Tested as
    Compliance questions.
    Trap
    Assuming AWS compliance covers the customer's workload.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

AWS vs. customer responsibility

ConceptMeaningKey differenceCommon trap
AWS (of the cloud) Physical infrastructure, hardware, managed service internals Security of the cloud Expecting AWS to secure customer data
Customer (in the cloud) Data, configuration, access, guest OS on EC2 Security in the cloud Assuming AWS patches the EC2 OS

Root user vs. IAM user vs. IAM role

ConceptMeaningKey differenceCommon trap
Root user Full account owner access Unrestricted, use rarely Using it for daily work
IAM user An identity with assigned permissions Scoped day-to-day access Confusing it with the root user
IAM role Temporary credentials assumed by services or users No long-lived keys Using a user where a role fits

AWS Artifact vs. Trusted Advisor vs. Organizations

ConceptMeaningKey differenceCommon trap
AWS Artifact Compliance reports and agreements Evidence of compliance Expecting it to scan or enforce
Trusted Advisor Best-practice checks and recommendations Flags issues to fix Expecting automatic remediation
AWS Organizations Multi-account governance Guardrails across accounts Confusing it with single-account IAM

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. AWS patches the EC2 OS

    What candidates pick
    Say AWS is responsible for patching the operating system on EC2 instances.
    Why it looks right
    AWS manages a lot.
    Why it's wrong
    For EC2, the customer manages the guest operating system and patching. AWS secures the underlying infrastructure.

    Clue to watch for The task is OS patching or configuration on EC2.

  2. Root for everything

    What candidates pick
    Use the root user for everyday administration.
    Why it looks right
    It has full access.
    Why it's wrong
    The root user should be protected with MFA and used rarely; daily work uses IAM users and roles.

    Clue to watch for The scenario involves routine access or best practice.

  3. Artifact scans

    What candidates pick
    Use AWS Artifact to scan workloads for vulnerabilities.
    Why it looks right
    It sounds security-related.
    Why it's wrong
    Artifact provides compliance reports and agreements, not vulnerability scanning.

    Clue to watch for The need is compliance evidence versus scanning.

  4. AWS compliance covers me

    What candidates pick
    Assume an AWS compliance certification makes the customer's application compliant.
    Why it looks right
    AWS is certified.
    Why it's wrong
    AWS certifies its infrastructure; the customer must configure workloads to meet their own obligations.

    Clue to watch for The question is about the customer's workload compliance.

  5. Data is AWS's job

    What candidates pick
    Say AWS is responsible for protecting the customer's data.
    Why it looks right
    AWS stores the data.
    Why it's wrong
    The customer always owns data protection, access and configuration, regardless of service.

    Clue to watch for The task concerns customer data or access.

  6. Trusted Advisor fixes it

    What candidates pick
    Expect Trusted Advisor to automatically remediate flagged issues.
    Why it looks right
    It identifies problems.
    Why it's wrong
    Trusted Advisor recommends improvements; acting on them is the customer's job.

    Clue to watch for The scenario involves identifying versus fixing issues.

Answer framework

For any Domain 2 security scenario, use these steps to find the answer CLF-C02 expects.

  1. Apply the shared responsibility model first, deciding whether AWS or the customer owns the task, and remember the boundary shifts by service type.
  2. Recall that the customer always owns data, access control and configuration, and the guest operating system on unmanaged services such as EC2.
  3. For access, prefer IAM users and roles with least privilege and MFA, and protect the root user rather than using it.
  4. For compliance, use AWS Artifact for reports and AWS Organizations for multi-account governance, and remember compliance is shared.
  5. For security resources, identify the right service by what it does, such as Trusted Advisor for recommendations, without expecting to configure it.

Practice question

Under the AWS shared responsibility model, which one of the following tasks is the CUSTOMER responsible for when running an application on Amazon EC2 instances?

Want more like this? The AWS CCP practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Because this is the heaviest domain and the shared responsibility model is the most tested and most failed concept, start there and master it. Practice sorting specific tasks, OS patching, data encryption, hardware, access control, into AWS's or the customer's column, and learn how the line shifts between EC2 and managed services such as S3 and Lambda.

Next, learn basic IAM at recognition level: the root user and why to protect it, users versus roles, groups, least privilege and MFA. Then learn the compliance and governance resources, keeping AWS Artifact (reports), Organizations (multi-account governance) and Trusted Advisor (recommendations) distinct.

This is an awareness exam, so focused reading and practice questions beat hands-on labs. Drill shared-responsibility scenarios until they are automatic. Afterwards, move to Domain 3, cloud technology and services, the largest domain by weight. This is an awareness exam, so flashcards and timed practice questions are more valuable than hands-on labs, and reviewing missed questions by domain shows where to focus next.

FAQ

How much of CLF-C02 is Domain 2?

Security and Compliance is 30% of the scored content, the highest-weighted domain.

What is the shared responsibility model?

AWS is responsible for security of the cloud, such as infrastructure and hardware, while the customer is responsible for security in the cloud, such as data, configuration, access and the guest OS on EC2.

Who patches the operating system on EC2?

The customer. For EC2, AWS secures the underlying infrastructure, but the customer manages the guest operating system and its patching.

Should I use the root user?

Rarely. The root user has full account access and should be protected with MFA and reserved for a few specific tasks, with daily work done through IAM users and roles.

What does AWS Artifact provide?

On-demand access to AWS compliance reports and agreements. It is not a vulnerability scanner.

Does AWS being compliant make my application compliant?

No. AWS certifies its infrastructure, but the customer must configure their workloads to meet their own compliance obligations.

How does Domain 2 connect to the rest of the exam?

Security underpins the services and billing domains, and the shared responsibility model and IAM recur throughout the exam.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 2 knowledge

You have covered the shared responsibility model, IAM, security services and compliance resources. Test whether you can assign responsibilities correctly under exam conditions.

Take the AWS CCP practice test Check your AWS CCP readiness

Keep going