Worth 30% of the AWS Certified Cloud Practitioner (CLF-C02) exam. CertClue has 403 questions on this objective.
Organisations use many accounts because an account is the strongest isolation boundary AWS offers. Guardrails then make that structure safe to work in quickly, rather than turning governance into a queue for approval.
Exam tip. SCPs do not restrict the management account, even when attached at the root. Keep workloads out of it and hold its access tightly.
IAM answers who is asking and what they may do. Access is denied by default, an explicit allow permits, and an explicit deny anywhere wins. Everything else is a variation on those three rules.
Exam tip. Any option that stores a long-lived access key on a resource is the one to reject. Roles for workloads, roles for cross-account, roles for federation.
Encryption at rest and encryption in transit are separate settings and both are usually required. Most AWS services now encrypt at rest by default, so the real question is almost always which key is used and who can audit its use.
Exam tip. Cross-account or cross-Region access to encrypted data always needs two grants: the resource AND the key. Forgetting the key is the usual cause of a puzzling denial.
AWS is responsible for security OF the cloud; the customer is responsible for security IN the cloud. The line moves with the service, but two things never move: AWS always owns the physical layer, and the customer always owns their data, their code and who may reach it.
Exam tip. Almost every publicised cloud data exposure is a customer configuration decision, not a provider breach. If a question describes a misconfiguration, the responsibility is the customer's.
Defence in depth means several controls at different layers. No single one is a substitute for another, and the exam consistently rejects answers claiming one removes the need for the rest.
Exam tip. A WAF is an outer layer that buys time. It cannot know your application's business rules, so it never replaces input validation in the code.
Four questions, four services: what is happening, what could be exploited, what is in the data, and how was it configured. Knowing which service answers which is most of this domain.
Exam tip. A findings queue nobody can act on is the same as no detection. Triage by severity and suppress accepted findings deliberately, as a recorded decision.
Free, with the answer and the reasoning. No account needed.
1. Which TWO tasks remain the customer's responsibility? (Choose two.)
On EC2 the guest operating system and the network configuration around it are the customer's, which is what security IN the cloud means. The hypervisor, the physical hardware and the facility are AWS's responsibility, which is security OF the cloud. The dividing line moves with the service: on a managed service such as RDS, AWS would take the operating system too.
2. Which service reports known vulnerabilities in the dependencies packaged with a Lambda function?
Inspector scans EC2 instances, container images and Lambda functions for known vulnerabilities, including the libraries a function ships with. Serverless does not remove dependency risk; it only removes the operating system beneath it.
3. What should be done with an IAM access key that has not been used for six months?
Deactivating first is reversible and proves nothing depends on the key before it is removed, which is why it is the recommended sequence. Unused keys are pure risk, and access keys have no expiry date to extend.
The full AWS Certified Cloud Practitioner bank, the study notes behind these summaries, and a readiness score that tells you which objective to revise next. Free, no paid tier.
Take the free AWS Certified Cloud Practitioner practice test