CLF-C02 Cloud Concepts Practice Question
A solutions architect implements IAM least-privilege policies, enables encryption for all data at rest and in transit, configures VPC security groups and NACLs to limit network access, and sets up automated security incident detection. Which Well-Architected Framework pillar covers these activities?
⚠ Common exam trap
It's easy for candidates to confuse the Security pillar with Operational Excellence because both involve monitoring and automation, but Security specifically addresses data protection, identity, and network controls, not operational runbooks or deployment pipelines.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Security
The Security pillar of the AWS Well-Architected Framework focuses on protecting data, systems, and assets through identity and access management (IAM least-privilege policies), data protection (encryption at rest and in transit), infrastructure protection (VPC security groups and NACLs), and detective controls (automated security incident detection). These activities directly map to the Security pillar's design principles and best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Operational Excellence
Why it's wrong here
Operational Excellence concentrates on running and improving workloads through automation, observability, continuous improvement, and effective response to incidents — for example, AWS CloudFormation, CloudWatch alarms, and documented runbooks. In contrast, IAM user policies, S3 bucket encryption, and VPC security group rules are safeguards that hide or restrict access to resources. Those are protective mechanisms rather than operational management practices, so they belong to the Security pillar even if security tasks are often automated as part of operations.
- ✗
Reliability
Why it's wrong here
Reliability focuses on proactively mitigating and recovering from failures, including multi-AZ architectures, backups, health checks, and auto scaling to maintain availability. IAM, encryption, and network access controls do not help systems restart, fail over, or restore data; they manage who can act on resources and how data is protected. Restricting access might improve stability by limiting bad actors, but availability planning and security assurance are separate design concerns, and these controls fall under Security.
- ✓
Security
Why this is correct
The Security pillar of the AWS Well-Architected Framework is built around identity and access management, detective controls, infrastructure protection, data protection, and incident response. The architect's actions — configuring IAM policies, enabling encryption at rest and in transit, and setting up detection mechanisms — directly satisfy those five design areas. This makes Security the correct classification because every one of the described controls is a security control, not an optimization, operational, or reliability control.
- ✗
Cost Optimisation
Why it's wrong here
The Cost Optimisation pillar is concerned with achieving business outcomes at the lowest possible price, through tools like usage monitoring, rightsizing, and using flexible pricing models such as Spot Instances or Savings Plans. Although IAM policies and KMS encryption may have indirect cost effects, their purpose is to enforce least privilege and protect data, not to reduce or optimize spend. Deploying these controls is a security decision; the fact that they might cost money does not move them into the Cost Optimisation pillar.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.