AWS WAF vs Shield vs GuardDuty vs Inspector: Telling the CLF-C02 Security Services Apart

The CLF-C02 exam guide names its security services as examples inside task statements 2.2 and 2.4: Amazon Inspector, AWS Security Hub, Amazon GuardDuty and AWS Shield for how customers secure resources, and AWS WAF, AWS Firewall Manager, AWS Shield and Amazon GuardDuty for AWS security features. The skill asked is to describe and identify them, not to configure them. The difficulty is that the names give little away, and the exam's wrong options are, in AWS's words, "generally plausible."

What each CLF-C02 security service does, in one line

All of these are on the in-scope services list of exam guide version 1.3. The one-line jobs come from each service's AWS documentation, as read on October 28, 2026:

A useful way to remember the order, which is Passy's grouping rather than AWS's: WAF, Shield and Firewall Manager protect, GuardDuty and Inspector detect, Macie classifies data, Detective investigates, and Security Hub aggregates.

AWS WAF vs AWS Shield on CLF-C02

The pair the exam leans on most.

• AWS WAF inspects web requests against rules you set, based on conditions such as IP addresses or query strings. AWS's documentation lists inspections for likely SQL injection and cross-site scripting. It can block a request, allow it, or return a custom response.
• AWS Shield is about volume attacks that try to knock a service offline. AWS's Shield FAQ says Shield Standard protects all AWS customers against common infrastructure-layer (layer 3 and 4) events, such as SYN and UDP floods and reflection attacks, with "no additional costs." Shield Advanced adds layer 3, 4 and 7 protection, 24/7 access to the Shield Response Team and DDoS cost protection against scaling charges caused by an attack; AWS lists its fee as $3,000 per month per organization, plus data transfer usage fees, on a one-year subscription. The same FAQ says engaging the response team also requires a business-level or enterprise-level AWS Support plan.

One-line test: if the threat is a malicious request, think WAF. If it is a flood of traffic, think Shield. If the question mentions a response team or protection from attack-related charges, it is Shield Advanced, not Standard.

Amazon GuardDuty vs Amazon Inspector

Both "find problems," which is why they get swapped.

• GuardDuty watches behavior. It analyzes logs to spot activity that looks malicious. AWS's examples include compromised AWS credentials, unauthorized cryptomining on EC2 and malware in EC2 workloads or newly uploaded S3 files.
• Inspector checks what is installed and exposed. It automatically discovers EC2 instances, container images in Amazon ECR and Lambda functions, scans them for known software vulnerabilities and unintended network exposure, and rescans when something changes, such as a newly published CVE.

One-line test: "someone is doing something suspicious" points to GuardDuty, while "this server has an unpatched package or an open path to the internet" points to Inspector. The exam guide also lists Inspector under security in a VPC, next to security groups and network ACLs, because of that network-exposure check.

Amazon Macie, Amazon Detective and AWS Security Hub

These three appear less often, but they make convenient distractors.

• Macie answers "where is our sensitive data, and is it exposed?" It uses machine learning and pattern matching to find sensitive data in S3, keeps an inventory of S3 buckets and flags issues such as a bucket that becomes publicly accessible.
• Detective answers "what happened, and how far did it go?" AWS describes it as helping you "analyze, investigate, and quickly identify the root cause of security findings or suspicious activities." It comes after detection, not instead of it.
• Security Hub answers "what should we fix first, across everything?" AWS describes it as a unified cloud security solution that correlates signals from posture management, Inspector, Macie and GuardDuty. Its posture checks against standards such as the AWS Foundational Security Best Practices, CIS and PCI DSS are documented as AWS Security Hub CSPM; the exam guide simply says AWS Security Hub.

Look-alike names are where flashcards earn their keep, and you can review these service names with the 138 Security and Compliance flashcards planned for CLF-C02 once full prep launches.

AWS Firewall Manager vs AWS WAF

Firewall Manager does not inspect traffic itself. It applies protections you choose, including AWS WAF rules, Shield Advanced, security group rules and network ACLs, across all accounts in an AWS Organizations organization, and adds them automatically to new accounts and resources. AWS notes that its charges are for the underlying services.

One-line test: one application needs request filtering, so use WAF. Fifty accounts need the same WAF rules applied and kept in place, so use Firewall Manager.

Firewall Manager can also manage AWS Network Firewall, but Network Firewall itself is on the CLF-C02 out-of-scope list. Don't spend study time on it.

CloudTrail, Config and CloudWatch: the governance trio

Task statement 2.2 pairs these with verbs: monitoring with Amazon CloudWatch, auditing with AWS CloudTrail and AWS Config. AWS's documentation supports a simple split:

Two more security tools CLF-C02 names

• AWS Artifact provides on-demand downloads of AWS's security and compliance documents, such as ISO, PCI and SOC reports. Task 2.2 gives it as the example of where to find AWS compliance information.
• AWS Trusted Advisor inspects your environment and recommends ways to save money, improve availability and performance, and close security gaps. Its documentation says Basic Support includes all Service Limits checks and selected Security and Fault tolerance checks, while the full set needs AWS Business Support+, AWS Enterprise Support or AWS Unified Operations.

Task 2.4 also expects you to know that third-party security products are available in AWS Marketplace, and that AWS publishes security information in the AWS Knowledge Center, the AWS Security Center and the AWS Security Blog.

Two security-service practice examples, written by Passy

These are original examples, not AWS exam items.

Example 1. A security team wants to be alerted when there are signs that an IAM access key has been compromised and is being misused in the company's AWS account. Which service fits?

• A. Amazon Inspector
• B. Amazon GuardDuty
• C. Amazon Macie
• D. AWS Shield Standard

Keyed answer: B. GuardDuty analyzes CloudTrail management events and other logs to detect threats, and AWS lists compromised credentials among them. Inspector looks for software vulnerabilities, Macie looks for sensitive data in S3 and Shield protects against DDoS attacks.

Example 2. A company serves a public website through Amazon CloudFront. It wants to block requests that contain likely SQL injection, and it wants enhanced DDoS protection with access to a 24/7 response team. Which two services meet these needs? (Select two.)

• A. AWS WAF
• B. AWS Shield Advanced
• C. Amazon Inspector
• D. Amazon Macie
• E. AWS Config

Keyed answers: A and B. WAF inspects web requests for patterns such as SQL injection. AWS lists 24/7 access to the Shield Response Team among Shield Advanced features, and its description of Shield Standard includes no such access. Inspector, Macie and Config do not filter traffic.

When you get one of these pairs wrong in practice, the useful step is understanding why your pick fails, and you can have the planned AI Rescue explain why your security-service choice was wrong once full prep opens.

Fitting security services into CLF-C02 study

Learn the shared responsibility model first, since most of these services exist to help with your side of it; the CLF-C02 shared responsibility guide covers that line. Then write one "its job / not to be confused with" sentence per service from the table above, and test yourself on the pairs, not the single names.

For checking yourself, the CLF-C02 practice exams guide explains which official practice sets are free and how to review a miss, and Passy's free CLF-C02 practice questions include security scenarios with explanations. When Security and Compliance trails your other results, you can work through that domain on its own in the planned CLF-C02 per-domain sets.