Security and Compliance
Threat Detection, Protection, and Security Resources
ImportantRecognize which AWS capabilities protect applications, detect threats, assess vulnerabilities, aggregate findings, recommend improvements, or provide security information and third-party products.
Aligned to the current CLF-C02 exam guide, verified August 15, 2026.
Why this matters
Security scenarios often offer several real AWS services as choices. Success depends on matching the required security outcome to the service rather than choosing a generic security-sounding name.
Must Know
- AWS WAF can allow, block, or count web requests based on conditions in web access-control rules.
- AWS Shield provides managed DDoS protection; Shield Standard is included for supported AWS resources, while Shield Advanced adds capabilities and assistance.
- AWS Firewall Manager provides centralized management of supported protection policies for multi-account environments.
- GuardDuty analyzes supported data sources for threats; Inspector assesses supported compute workloads for vulnerabilities; Security Hub centralizes findings and posture information; Amazon Detective helps investigate findings and analyze their root cause.
- Amazon Macie discovers sensitive data in Amazon S3; it is distinct from GuardDuty threat detection and Inspector vulnerability management.
- Trusted Advisor checks an AWS environment for best-practice improvement opportunities in several categories, including security.
- AWS Marketplace is the AWS-oriented catalog for purchasing eligible third-party security software and services.
- AWS Security Center pages and the AWS Security Blog provide security guidance and announcements; AWS Official Knowledge Center content on re:Post addresses common questions and troubleshooting.
Compare and Distinguish
- Shield vs WAF: Shield mitigates DDoS attacks; WAF evaluates application-layer web requests.
- WAF vs Firewall Manager: WAF provides web request rules; Firewall Manager centrally deploys and manages supported policies across accounts and resources.
- GuardDuty vs Inspector vs Security Hub vs Detective: GuardDuty detects threats; Inspector finds vulnerabilities; Security Hub aggregates posture and findings; Detective investigates findings and their root cause.
- Macie vs GuardDuty and Inspector: Macie discovers sensitive data in S3; GuardDuty detects suspicious activity; Inspector assesses supported workloads for vulnerabilities.
- Security Hub vs source services: Security Hub aggregates and evaluates posture; services such as GuardDuty and Inspector produce specialized findings.
- Trusted Advisor vs Security Hub: Trusted Advisor supplies broad best-practice recommendations; Security Hub focuses on security posture, controls, and consolidated findings.
- Marketplace vs AWS guidance: Marketplace provides products and services for purchase; AWS security resources provide information.
Scenario examples
- Scenario: A public application must block HTTP requests that match a malicious pattern. Think: Use AWS WAF web request rules.
- Scenario: A company wants managed protection from distributed denial-of-service attacks. Think: Use AWS Shield for supported resources.
- Scenario: A security team wants suspicious account activity identified from supported AWS signals. Think: Amazon GuardDuty provides managed threat detection.
- Scenario: A team wants one place to view findings from GuardDuty and Inspector. Think: AWS Security Hub consolidates supported security findings.
- Scenario: A company wants to buy a third-party security appliance with AWS-oriented deployment and billing. Think: Search AWS Marketplace.
Exam traps
- WAF is not a general DDoS service, and Shield does not replace web request filtering rules.
- Firewall Manager is a central policy-management service, not the source of every threat or vulnerability finding.
- GuardDuty does not scan packages for known vulnerabilities; that requirement points to Inspector.
- Security Hub does not make every security service unnecessary; it relies on findings and posture data from supported sources.
- Trusted Advisor recommendations are not the same as real-time threat detection, and feature availability can vary by Support plan.
Key takeaways
- WAF filters web requests; Shield protects against DDoS; Firewall Manager manages supported policies centrally.
- GuardDuty detects threats; Inspector assesses vulnerabilities; Security Hub consolidates posture and findings.
- Trusted Advisor recommends improvements rather than acting as an all-purpose security control.
- Marketplace is for third-party products; AWS security resources are for guidance and information.
How it works
- WAF evaluates matching web requests, Shield supplies DDoS protections, and Firewall Manager applies supported policy configurations centrally.
- GuardDuty and Inspector generate specialized findings from different signals; Security Hub can consolidate supported findings and evaluate security controls.
- Trusted Advisor checks the environment against supported best practices and presents recommendations.
- AWS information resources publish guidance, while Marketplace supplies a procurement path for eligible third-party offerings.
When to use it
- Use WAF for application-layer request filtering and Shield for DDoS protection.
- Use Firewall Manager when supported security policies must be managed consistently across accounts.
- Use GuardDuty for suspicious activity, Inspector for supported workload vulnerabilities, and Security Hub for consolidated posture and findings.
- Use Trusted Advisor for best-practice recommendations available to the account.
- Use Marketplace to find and procure an eligible third-party security product.
Security and governance implications
- Combine preventive, detective, assessment, and response capabilities according to workload risk rather than expecting one service to perform every role.
- Restrict who can change WAF, Shield, Firewall Manager, and findings-management settings.
- Evaluate third-party products for fit, permissions, data access, and operational ownership before deployment.
Operational context
- Start with the required outcome—filter, protect, detect, assess, aggregate, recommend, learn, or procure—then select the service category.
- Incomplete consolidated findings can reflect a missing source-service or Region integration; Security Hub does not create every specialized finding itself.
Current AWS note
- The live guide names AWS Security Hub. Current AWS documentation brands the cloud-security-posture capability as AWS Security Hub CSPM; treat this as product-name reconciliation, not a separate service or a memorization target.
More detail
- Preventive and protective controls reduce or filter unwanted activity. Detective services identify suspicious behavior or vulnerabilities. Aggregation services organize findings. Recommendations and documentation guide improvements. A scenario usually signals one of these roles.
- Marketplace listings are offered by AWS Partners and other sellers. Buying through Marketplace does not turn the third-party product into an AWS service or transfer the customer's deployment and governance responsibilities.
- Trusted Advisor spans multiple recommendation categories. Security recommendations are useful, but they are different from GuardDuty threat findings or Inspector vulnerability findings.
Ready for the quiz?
- When is AWS WAF a better answer than AWS Shield?
- How do GuardDuty and Inspector differ?
- Why might a company use Security Hub with other security services?
- What multi-account requirement points to Firewall Manager?
- Where would you look for an eligible third-party security product?
Related objectives
- D2.4 — Identify components and resources for security.