Security and Compliance
Threat Detection, Protection, and Security Resources
ImportantRecognize which AWS capabilities protect applications, detect threats, assess vulnerabilities, aggregate findings, recommend improvements, or provide security information and third-party products.
Aligned to the current CLF-C02 exam guide, verified August 15, 2026.
Why this matters
Security scenarios often offer several real AWS services as choices. Success depends on matching the required security outcome to the service rather than choosing a generic security-sounding name.
Must Know
- AWS WAF can allow, block, or count web requests based on conditions in web access-control rules.
- AWS Shield provides managed DDoS protection; Shield Standard is included for supported AWS resources, while Shield Advanced adds capabilities and assistance.
- AWS Firewall Manager provides centralized management of supported protection policies for multi-account environments.
- GuardDuty analyzes supported data sources for threats; Inspector assesses supported compute workloads for vulnerabilities; Security Hub centralizes findings and posture information.
- Trusted Advisor checks an AWS environment for best-practice improvement opportunities in several categories, including security.
- AWS Marketplace is the AWS-oriented catalog for purchasing eligible third-party security software and services.
- AWS Security Center pages and the AWS Security Blog provide security guidance and announcements; AWS Official Knowledge Center content on re:Post addresses common questions and troubleshooting.
Compare and Distinguish
- Shield vs WAF: Shield mitigates DDoS attacks; WAF evaluates application-layer web requests.
- WAF vs Firewall Manager: WAF provides web request rules; Firewall Manager centrally deploys and manages supported policies across accounts and resources.
- GuardDuty vs Inspector: GuardDuty detects suspicious activity; Inspector identifies vulnerabilities and unintended exposure in supported workloads.
- Security Hub vs source services: Security Hub aggregates and evaluates posture; services such as GuardDuty and Inspector produce specialized findings.
- Trusted Advisor vs Security Hub: Trusted Advisor supplies broad best-practice recommendations; Security Hub focuses on security posture, controls, and consolidated findings.
- Marketplace vs AWS guidance: Marketplace provides products and services for purchase; AWS security resources provide information.
Scenario examples
- Scenario: A public application must block HTTP requests that match a malicious pattern. Think: Use AWS WAF web request rules.
- Scenario: A company wants managed protection from distributed denial-of-service attacks. Think: Use AWS Shield for supported resources.
- Scenario: A security team wants suspicious account activity identified from supported AWS signals. Think: Amazon GuardDuty provides managed threat detection.
- Scenario: A team wants one place to view findings from GuardDuty and Inspector. Think: AWS Security Hub consolidates supported security findings.
- Scenario: A company wants to buy a third-party security appliance with AWS-oriented deployment and billing. Think: Search AWS Marketplace.
Exam traps
- WAF is not a general DDoS service, and Shield does not replace web request filtering rules.
- Firewall Manager is a central policy-management service, not the source of every threat or vulnerability finding.
- GuardDuty does not scan packages for known vulnerabilities; that requirement points to Inspector.
- Security Hub does not make every security service unnecessary; it relies on findings and posture data from supported sources.
- Trusted Advisor recommendations are not the same as real-time threat detection, and feature availability can vary by Support plan.
Key takeaways
- WAF filters web requests; Shield protects against DDoS; Firewall Manager manages supported policies centrally.
- GuardDuty detects threats; Inspector assesses vulnerabilities; Security Hub consolidates posture and findings.
- Trusted Advisor recommends improvements rather than acting as an all-purpose security control.
- Marketplace is for third-party products; AWS security resources are for guidance and information.
How it works
- WAF evaluates matching web requests, Shield supplies DDoS protections, and Firewall Manager applies supported policy configurations centrally.
- GuardDuty and Inspector generate specialized findings from different signals; Security Hub can consolidate supported findings and evaluate security controls.
- Trusted Advisor checks the environment against supported best practices and presents recommendations.
- AWS information resources publish guidance, while Marketplace supplies a procurement path for eligible third-party offerings.
When to use it
- Use WAF for application-layer request filtering and Shield for DDoS protection.
- Use Firewall Manager when supported security policies must be managed consistently across accounts.
- Use GuardDuty for suspicious activity, Inspector for supported workload vulnerabilities, and Security Hub for consolidated posture and findings.
- Use Trusted Advisor for best-practice recommendations available to the account.
- Use Marketplace to find and procure an eligible third-party security product.
Security and governance implications
- Combine preventive, detective, assessment, and response capabilities according to workload risk rather than expecting one service to perform every role.
- Restrict who can change WAF, Shield, Firewall Manager, and findings-management settings.
- Evaluate third-party products for fit, permissions, data access, and operational ownership before deployment.
Troubleshooting signals
- Start with the required outcome—filter, protect, detect, assess, aggregate, recommend, learn, or procure—then select the service category.
- If findings appear incomplete, verify that the applicable source service and integration are enabled for the intended accounts and Regions.
More detail
- Preventive and protective controls reduce or filter unwanted activity. Detective services identify suspicious behavior or vulnerabilities. Aggregation services organize findings. Recommendations and documentation guide improvements. A scenario usually signals one of these roles.
- Security Hub is named in the exam guide. Current AWS documentation may describe the posture-management capability as AWS Security Hub CSPM; learners should recognize the guide wording without treating product-name evolution as trivia.
- Marketplace listings are offered by AWS Partners and other sellers. Buying through Marketplace does not turn the third-party product into an AWS service or transfer the customer's deployment and governance responsibilities.
- Trusted Advisor spans multiple recommendation categories. Security recommendations are useful, but they are different from GuardDuty threat findings or Inspector vulnerability findings.
Ready for the quiz?
- When is AWS WAF a better answer than AWS Shield?
- How do GuardDuty and Inspector differ?
- Why might a company use Security Hub with other security services?
- What multi-account requirement points to Firewall Manager?
- Where would you look for an eligible third-party security product?
Related objectives
- D2.4