Domain Overview

🔒

Security & Compliance

Domain 6 of DOP-C02 (~17%). Detect threats, protect data, respond automatically, and govern many accounts — the largest security-weighted slice of the exam.

~61 min total8 modules8 quiz questionsDOP-C02 Domain 6 · 17%

The Security and Compliance domain is about automating security — not configuring one service, but wiring detection, protection, response, and governance into a pipeline that runs across every account. The exam rewards knowing which service owns which job and how findings turn into automatic action.

💡This page focuses on the security service landscape and multi-account governance. The mechanics of policies, roles, and cross-account trust live in the IAM Deep Dive — treat the two together.

The Four Jobs — Click Each

Shared Responsibility

AWS — security OF the cloud

• Physical data centers, hardware, hypervisor
• Managed-service infrastructure (S3, DynamoDB, Lambda runtime)
• Global network and AZ isolation

You — security IN the cloud

• IAM, SCPs, resource policies, MFA
• Encryption choices (KMS keys, TLS), key policies
• Patching your OS/app (EC2), security groups, data classification

🎯The line shifts with the service model. On EC2 you patch the OS; on Fargate/Lambda AWS patches the runtime and you own only the code and its IAM role. “Who patches the guest OS?” is a common shared-responsibility cue.