AWS CLF-C02
AWS Cloud Practitioner CLF-C02: Complete Study Notes
This handbook is written as a self-contained CLF-C02 preparation resource. It teaches foundational AWS concepts from scratch, explains why services exist, shows how they are used in production, highlights common exam traps, and trains you to pick the best answer in scenario-based questions without depending on outside material.
CLF-C02
Foundational AWS
Exam Handbook
Scenarios
Revision Notes
Exam Orientation and Winning Mindset
The AWS Certified Cloud Practitioner exam validates broad understanding of the AWS Cloud rather than deep implementation skill in one specific service. The exam rewards candidates who can recognize business requirements, map them to the correct AWS concept or service family, and reject tempting but unnecessarily complex answers.
- What the exam is really testing: cloud value, basic architecture thinking, security responsibility, service purpose, pricing awareness, and support/governance knowledge.
- What it is not testing: detailed command syntax, complex coding, or advanced design trade-offs expected from architect-level exams.
- Best preparation mindset: learn each service as an answer to a business problem. When you know the problem a service solves, exam questions become easier.
Current exam format
| Item | CLF-C02 detail |
|---|---|
| Duration and format | 90 minutes; 65 multiple-choice or multiple-response questions. |
| Scoring | 50 questions are scored and 15 are unscored. Results use a 100–1,000 scale; the minimum passing score is 700. |
| Guessing | Unanswered questions are incorrect and there is no penalty for guessing, so answer every question. |
Official content domains
| Domain | Weight | What you must know |
|---|---|---|
| 1. Cloud Concepts | 24% | Cloud value, elasticity, global infrastructure, deployment models, and migration value. |
| 2. Security and Compliance | 30% | Shared responsibility, IAM, governance, encryption, auditing, and compliance services. |
| 3. Cloud Technology and Services | 34% | Core compute, storage, networking, databases, monitoring, analytics, and migration services. |
| 4. Billing, Pricing, and Support | 12% | Pricing models, billing tools, support plans, cost controls, and Organizations. |
Use the official CLF-C02 exam guide for the current scope and the official certification page for scheduling details. AWS can revise an exam guide, so check both again before booking.
Exam-first rule: if two answers seem technically possible, the correct one is usually the one that is simpler, more managed, more cost-aware, and more directly aligned to the requirement wording.
Cloud Foundations: What Cloud Computing Actually Means
Cloud computing means consuming IT resources as on-demand services instead of building everything as fixed on-premises infrastructure. In practice, this means servers, storage, networking, databases, analytics tools, and security controls can be provisioned when needed and released when no longer required.
Why cloud exists
- Speed: businesses launch resources in minutes instead of waiting for hardware procurement cycles.
- Elasticity: capacity can expand during peak demand and shrink afterward.
- Global reach: applications can be deployed near users in multiple geographic locations.
- Consumption pricing: many services follow pay-for-what-you-use billing instead of large upfront ownership costs.
- Managed operations: AWS operates much of the underlying infrastructure, reducing operational burden.
Important terms that appear on the exam
| Term | Meaning | Exam distinction |
|---|---|---|
| Scalability | Ability to increase capacity as workload grows. | Can be manual or automatic. |
| Elasticity | Automatic adjustment of resources to match demand. | Focuses on dynamic expansion and contraction. |
| High availability | System remains available despite failures. | Often achieved with multiple Availability Zones. |
| Fault tolerance | Workload continues even when a component fails. | Usually stronger than simple high availability. |
| Agility | Ability to experiment and deliver faster. | Business outcome, not just a technical property. |
| Economies of scale | AWS can provide lower variable cost by operating at enormous scale. | Classic cloud-benefit exam phrase. |
Service models you must understand
- IaaS: infrastructure as a service. You manage more of the stack. EC2 is a common example.
- PaaS tendencies: managed platforms reduce administrative work. Elastic Beanstalk is closer to this style.
- Serverless: you focus on code or configuration, while AWS handles most infrastructure operations. Lambda is the classic example.
- SaaS: finished software consumed by end users. This is a cloud model, though many CLF-C02 questions stay focused on AWS infrastructure services.
Common misconception: cloud does not automatically mean cheaper. It means more flexible economics. Poor design, overprovisioning, idle resources, and bad data transfer choices can still create high bills.
AWS Global Infrastructure and Why It Matters
AWS operates a global infrastructure that lets customers place resources close to users, isolate failures, and meet regulatory or latency requirements. You must understand the hierarchy because many exam questions depend on it.
| Component | What it is | Why it matters |
|---|---|---|
| Region | A geographic area containing multiple Availability Zones. | Supports latency, data residency, and disaster recovery decisions. |
| Availability Zone (AZ) | One or more discrete data centers with independent power and networking. | Used for high availability inside a Region. |
| Edge Location | Location used by services such as CloudFront for content delivery. | Brings cached content closer to end users. |
| Regional service | Service scoped to a Region. | You choose the Region deliberately. |
| Global service | Service not tied in the same way to one Region. | IAM is the classic example students must remember. |
How exam questions use this topic
- If the question mentions high availability, think multiple AZs first.
- If the question mentions users around the world, think CloudFront or global DNS-related decisions.
- If the question mentions compliance or data residency, think Region selection.
- If the question mentions disaster recovery, ask whether another Region is needed rather than only another AZ.
Real-world example
An e-commerce company runs its application in one Region with web servers in two AZs. That design helps survive a data-center-level failure. If the company also needs protection from a full regional outage, it needs a multi-Region disaster recovery strategy, which is a different objective.
Exam alert: multi-AZ is not the same as multi-Region. Students often choose a larger design than the question requires.
Identity, Access, and Security Fundamentals
AWS Identity and Access Management (IAM) controls who can do what in an AWS environment. For CLF-C02, you must know users, groups, roles, policies, MFA, least privilege, root-user handling, and how IAM differs from service-level access controls.
Core building blocks
- IAM user: an identity for one person or application needing long-term credentials.
- IAM group: a collection of users used to simplify permission management.
- IAM role: an identity intended to be assumed temporarily by users, applications, or AWS services.
- Policy: a JSON document that allows or denies actions on resources under defined conditions.
- MFA: multi-factor authentication adds a second verification factor beyond password-only access.
IAM User vs IAM Role
| Feature | IAM User | IAM Role |
|---|---|---|
| Credential style | Usually long-term credentials. | Usually temporary credentials. |
| Best use | Named human identity when necessary. | AWS services, federated identities, cross-account access, applications. |
| Security preference | Less preferred for workloads. | Preferred for workloads because temporary credentials are safer. |
Best practices
- Protect the root user with MFA and avoid routine root usage.
- Grant least privilege rather than broad administrator rights.
- Prefer roles for EC2, Lambda, and other workloads instead of storing access keys.
- Rotate credentials and monitor account activity.
- Use IAM Identity Center for workforce access where appropriate.
Related security services you should recognize
- KMS: manages encryption keys.
- Secrets Manager: stores and rotates secrets such as database passwords.
- CloudTrail: records API activity for auditing.
- Config: tracks resource configuration and compliance posture over time.
- GuardDuty: detects suspicious or malicious activity patterns.
Common Exam Traps
- Confusing authentication with authorization. Authentication proves identity; authorization defines allowed actions.
- Choosing an IAM user for an EC2 instance when an IAM role is the more secure answer.
- Assuming CloudTrail is for metrics. It is for API and account activity history, while CloudWatch is for metrics, alarms, and logs.
Quick Revision
- Root user: protect, minimize, do not use daily.
- Users: named identities.
- Groups: permission management convenience.
- Roles: temporary access and preferred for workloads.
- MFA and least privilege: always exam favorites.
Core AWS Services You Must Be Able to Choose
Most CLF-C02 service questions are not asking for implementation details. They ask whether you know the purpose of major AWS services and can match them to a requirement.
Compute
- Amazon EC2: virtual servers in the cloud. Use when you need operating-system control, custom software, or traditional server patterns.
- AWS Lambda: serverless compute that runs code in response to events. Use when you want no server management and event-driven execution.
- Elastic Beanstalk: application deployment service that simplifies provisioning and scaling of web applications.
Storage
- Amazon S3: durable object storage for files, backups, static websites, logs, and data lakes.
- Amazon EBS: block storage for EC2 instances. Think virtual hard drive for one instance or tightly coupled compute use.
- Amazon EFS: scalable shared file storage for Linux workloads across multiple instances.
- S3 Glacier storage classes: lower-cost archival storage with slower retrieval characteristics.
Databases
- Amazon RDS: managed relational databases such as MySQL, PostgreSQL, and others.
- Amazon DynamoDB: fully managed NoSQL key-value and document database for high-scale low-latency workloads.
- Amazon Redshift: data warehouse for analytics rather than transactional application storage.
Networking and delivery
- Amazon VPC: logically isolated virtual network.
- Elastic Load Balancing: distributes traffic across targets.
- Amazon Route 53: DNS service with routing policies and health-check uses.
- Amazon CloudFront: content delivery network that caches content closer to users.
Monitoring and management
- Amazon CloudWatch: metrics, logs, dashboards, and alarms.
- AWS CloudTrail: account API audit history.
- AWS Trusted Advisor: recommendations for cost, security, performance, fault tolerance, and service limits.
High-Value Service Comparisons
EC2 vs Lambda
- EC2: more control, more administration, better for long-running or customized server workloads.
- Lambda: less administration, event-driven, ideal for variable demand and short execution tasks.
- Exam decision point: choose Lambda when the question highlights no server management, event triggers, or sporadic workloads.
S3 vs EBS vs EFS
- S3: object storage accessed via APIs.
- EBS: block storage attached to EC2, typically one instance at a time.
- EFS: shared file storage for multiple Linux instances.
- Exam decision point: if the question says shared file system, choose EFS; if it says durable object store, choose S3; if it says boot volume or database disk for EC2, choose EBS.
RDS vs DynamoDB
- RDS: relational, structured, SQL-oriented workloads.
- DynamoDB: NoSQL, key-value/document, extreme scale and low latency.
- Exam decision point: schema relationships and SQL usually indicate RDS; massive low-latency key access suggests DynamoDB.
CloudWatch vs CloudTrail
- CloudWatch: monitors performance and operational telemetry.
- CloudTrail: records who did what through AWS APIs.
- Exam decision point: monitoring versus auditing is a classic trap.
SNS vs SQS
- SNS: pub/sub messaging and fan-out notifications.
- SQS: message queue for decoupling and buffering work.
- Exam decision point: if consumers need to process asynchronously from a queue, think SQS; if multiple subscribers need notification from one event, think SNS.
Pricing, Billing, Cost Control, and Support
CLF-C02 expects you to understand not just technology choices but also how AWS charges, how organizations govern spending, and how support options differ.
Pricing concepts
- Pay-as-you-go: pay only for consumed resources rather than large upfront ownership.
- Save when usage grows: commitments such as Savings Plans can reduce compute cost for predictable use.
- Stop guessing capacity: elasticity helps reduce the waste of permanent overprovisioning.
Common pricing models you must recognize
| Model | Use case | Exam caution |
|---|---|---|
| On-Demand | Flexible, no commitment. | Convenient but often not cheapest for steady workloads. |
| Savings Plans | Predictable compute usage. | Commitment-based discount, broader and more modern exam answer than old RI-heavy wording in many cases. |
| Reserved Instances | Reserved EC2 or database capacity discount model. | Still relevant, but understand AWS also emphasizes Savings Plans. |
| Spot Instances | Interruptible workloads that can tolerate interruption. | Wrong for critical uninterrupted processing. |
Cost management tools
- AWS Budgets: alerts when usage or cost thresholds are reached.
- AWS Cost Explorer: analyzes spending patterns and trends.
- Cost and Usage Report: detailed billing data for analysis.
- Organizations: central governance and consolidated billing across multiple accounts.
- Trusted Advisor: highlights some optimization opportunities.
Support plans
- Basic Support: included for all customers; covers account and billing help, service quota increases, and self-service resources, but not full technical case support.
- AWS Business Support+: the entry paid operational tier, with 24/7 technical support and faster help for production-impacting issues.
- AWS Enterprise Support: builds on Business Support+ with designated Technical Account Managers and deeper strategic operational guidance.
- AWS Unified Operations: the highest current tier for mission-critical operations, with a designated global expert team and the most proactive support model.
2026 transition note: AWS documentation now lists Basic, Business Support+, Enterprise Support, and Unified Operations. Some customers may still see legacy Developer, Business, or Enterprise On-Ramp plans during the transition. Developer Support is scheduled to be discontinued on January 1, 2027, and affected Developer and Business customers must review AWS communications and make the applicable plan choice before that date. Verify names and benefits on the official AWS Support Plans page.
Compliance, Governance, and Protection Services
Cloud security is broader than login credentials. The exam expects recognition of governance, detection, encryption, compliance evidence, and protective controls.
- AWS Artifact: provides access to compliance reports and agreements. Use when customers need compliance documentation.
- AWS Config: records and evaluates resource configurations for compliance visibility.
- Amazon Inspector: vulnerability-management oriented service awareness may appear at a foundational level.
- AWS Shield: DDoS protection.
- AWS WAF: web application firewall for filtering HTTP/S requests.
- Amazon Macie: helps identify and protect sensitive data in S3.
Common Exam Traps
- Choosing CloudWatch when the question asks for an audit trail. That is CloudTrail.
- Choosing IAM when the question asks for compliance reports. That is Artifact.
- Choosing Shield when the question asks for filtering malicious web requests by rule. That is WAF.
Exam Alert
When the question is about proving compliance to auditors, downloading reports, or reviewing certifications, think AWS Artifact before operational monitoring tools.
Exam Scenarios
Scenario 1: Startup with unpredictable traffic
A startup launches a new application and expects occasional traffic spikes but does not want to manage servers. Best fit: AWS Lambda with other managed services where applicable. Why: serverless aligns with variable demand and low operational burden. Why not EC2: EC2 is valid compute, but it increases administration and may leave idle capacity.
Scenario 2: Company needs file backup archive at low cost
Best fit: Amazon S3 with lifecycle transition to archival storage classes if access is rare. Why: S3 is durable object storage with lifecycle flexibility. Why not EBS: EBS is block storage for instances and is not the economical archive choice.
Scenario 3: Security team needs to know who deleted a resource
Best fit: AWS CloudTrail. Why: it records API actions and identity context. Why not CloudWatch: CloudWatch is for metrics, alarms, and logs, but CloudTrail answers who performed AWS API activity.
Scenario 4: Business wants to reduce monthly cost for a fault-tolerant batch job
Best fit: Spot Instances if interruption is acceptable. Why: the workload is flexible. Why not On-Demand: simpler, but more expensive for interruption-tolerant processing.
Scenario 5: Enterprise wants central billing across many AWS accounts
Best fit: AWS Organizations with consolidated billing. Why: it centralizes governance and billing structure. Why not IAM alone: IAM handles permissions, not organization-wide billing consolidation.
Scenario 6: Production team needs 24/7 technical support
Best fit: AWS Business Support+ as the starting paid tier. Why: Basic does not provide the same technical case support for production workloads. Exam technique: if the scenario also requires designated strategic advisors or the most proactive mission-critical operating model, compare Enterprise Support and Unified Operations instead of selecting a legacy plan name.
Scenario 7: Finance wants an alert before monthly spend exceeds a target
Best fit: AWS Budgets. Why: budgets can track thresholds and send alerts. Why not Cost Explorer alone: Cost Explorer is primarily for analyzing costs and usage trends; it does not replace a configured budget alert.
Common Exam Traps and Misconceptions
- Global vs Regional confusion: students forget IAM is globally oriented while many other services are Regional.
- Monitoring vs auditing: CloudWatch monitors behavior; CloudTrail records API actions.
- Availability vs disaster recovery: multi-AZ does not automatically mean protection from full regional loss.
- Simple vs overengineered answers: foundational exams often prefer the most direct managed service, not a complex custom design.
- Storage confusion: object, block, and file storage are different categories with different use cases.
- Cost confusion: lowest price is not always best; the answer must still satisfy security, performance, and availability requirements.
Quick Revision, Remember This, and Final Exam Alert
Quick Revision
- A Region contains multiple AZs.
- Shared responsibility splits duties between AWS and the customer.
- IAM controls identities and permissions; roles are preferred for workloads.
- S3 is object storage, EBS is block storage, EFS is shared file storage.
- RDS is relational, DynamoDB is NoSQL.
- CloudWatch monitors; CloudTrail audits.
- CloudFront accelerates content delivery globally.
- Budgets alert on thresholds; Cost Explorer analyzes spend.
- Organizations helps govern multiple AWS accounts.
- Spot Instances are cheap but interruptible.
Remember This
- Use the most managed service that meets the requirement.
- Read whether the question asks for cost optimization, auditing, scalability, or least operational effort.
- Many wrong answers are not impossible; they are simply not the best answer.
Exam Alert
High-probability CLF-C02 concepts include the shared responsibility model, IAM basics, S3/EBS/EFS differences, RDS versus DynamoDB, CloudWatch versus CloudTrail, pricing models, support plans, Organizations, Artifact, and service selection based on business needs.
Continue learning
AWS SAA-C03
AWS Solutions Architect SAA-C03: Complete Study Notes
Prepare for SAA-C03 with current domain weights, secure and resilient architecture, performance, cost optimization, service comparisons, and scenario drills.
Hosting
How to Host a Website: From DNS to Production Deployment
Learn website hosting from domains and DNS through HTTPS, shared hosting, VPS, cloud platforms, GitHub Actions, rollback, monitoring, backups, and security.
Git
Git for Developers: Commands, Workflows and Recovery
Learn Git with practical setup, commits, remotes, branching, merge versus rebase, conflict recovery, worktrees, bisect, signing, and safe collaboration workflows.
Browse Free Tutorials
Explore 500+ free tutorials across 20+ languages and frameworks.