On the source instance, there are 2 Certificates ( 'sys_certificate' table)
On the target instance, there will be 3 Certificates ('sys_certificate' table)
If just Exclude Table is set, the table on the target instance will be empty after clone.
If just just Preserve data is configured, the table on the target instance will have 5 Certificate records in the 'sys_certificate' table after clone.
If both Exclude Table and Preserve Data, the target instance will have 3 Certificates and Source will have 2 Certificates in the 'sys_certificate' table after clone.
The above is true for Identity Provider Records also.