CLF-C02 — AWS Certified Cloud Practitioner Cheat Sheet

Last revised: September 16, 2026

Cheat sheet: AWS Certified Cloud Practitioner CLF-C02 reference for core AWS services, security, architecture, pricing, and support.

Use the tables for a quick pre-exam check. Expand a topic’s notes for explanations, examples, and additional distinctions.

Scope and study context

Item	Reference
Vendor/provider	AWS
Official exam title	AWS Certified Cloud Practitioner (CLF-C02)
Official exam code	CLF-C02
Candidate level	Foundational AWS cloud knowledge
Best use of this page	Fast recall of service purpose, security responsibilities, pricing concepts, and common exam decision points

The AWS Certified Cloud Practitioner (CLF-C02) exam is broad rather than deep. Expect questions that test whether you can identify the right AWS service, explain shared responsibility, recognize basic architecture patterns, and understand cost, support, and governance concepts.

The CLF-C02 exam is broad. It usually rewards recognition, comparison, and decision-making more than deep configuration skill. Focus on:

What a service is mainly used for.
Which service is managed by AWS versus managed by the customer.
Security and compliance responsibility boundaries.
Basic architectural tradeoffs: cost, availability, scalability, performance, and operations.
Pricing, billing, account management, and support concepts.
Common AWS terminology that appears in scenario-based questions.

This page is IT Mastery exam-prep support and is not affiliated with AWS.

High-Yield Mental Model

If the question asks about…	Think first
“Who is responsible?”	AWS Shared Responsibility Model
“Reduce capital expense”	Cloud value proposition: variable expense, pay as you go
“Scale automatically”	Elasticity, Auto Scaling, managed services, serverless
“Global low latency”	Regions, Availability Zones, edge locations, Amazon CloudFront, Route 53
“Secure access”	IAM, MFA, least privilege, roles, policies
“Audit API activity”	AWS CloudTrail
“Monitor metrics and alarms”	Amazon CloudWatch
“Evaluate resource configuration”	AWS Config
“Cost visibility”	AWS Cost Explorer, AWS Budgets, Cost and Usage Report
“Estimate before deploying”	AWS Pricing Calculator
“Object storage”	Amazon S3
“Managed relational database”	Amazon RDS or Amazon Aurora
“NoSQL key-value database”	Amazon DynamoDB
“Run code without servers”	AWS Lambda
“Private network in AWS”	Amazon VPC

Core Cloud Concepts

Cloud Value Propositions

Concept	Exam meaning	Common trap
Pay-as-you-go	Pay for resources consumed instead of large upfront purchases	Not always cheapest if resources are left running
Elasticity	Automatically add/remove capacity based on demand	Elasticity is dynamic; scalability can be planned or manual
Agility	Provision resources quickly and experiment faster	Agility is not the same as weak governance
Global reach	Deploy near users using AWS global infrastructure	Multi-Region designs add complexity and cost
Economies of scale	AWS aggregates demand and can offer broad services/pricing models	Does not remove customer cost management responsibility
High availability	Design to remain available during component failure	Single EC2 instance is not highly available by itself
Fault tolerance	Continue operating through failures	Usually requires redundancy and automated failover

Notes and examples

Cloud Deployment Models

Model	Description	Choose when
Cloud	Resources run in AWS	Need elasticity, managed services, global reach
On premises	Resources run in customer data centers	Existing constraints, legacy systems, or local control
Hybrid	Combines AWS and on premises	Migration, latency, compliance, or gradual modernization
Multi-cloud	Uses multiple cloud providers	Vendor diversification, specialized services, organizational strategy

Cloud Service Models

Model	Customer manages more	AWS/vendor manages more	Examples
IaaS	OS, applications, patches, data	Facilities, hardware, virtualization	Amazon EC2
PaaS	Application code and data	Runtime, scaling, platform operations	AWS Elastic Beanstalk, Amazon RDS
SaaS	Usage and configuration	Application and infrastructure	AWS Marketplace SaaS products, many business apps
Serverless	Code/configuration and data	Servers, scaling, high availability	AWS Lambda, Amazon S3, Amazon DynamoDB

Core cloud advantages

Concept	Exam-ready meaning
Pay-as-you-go	Pay for resources consumed instead of large upfront capital purchases
Variable expense	Costs scale with usage rather than fixed data center commitments
Economies of scale	AWS operates at large scale, which can reduce unit costs
Elasticity	Automatically add or remove capacity as demand changes
Scalability	Increase or decrease capacity to meet workload needs
High availability	Design to remain accessible despite component failures
Agility	Provision resources quickly and experiment faster
Global reach	Deploy closer to users using AWS global infrastructure

Elasticity vs scalability

Term	Quick distinction	Example
Scalability	Ability to handle increased or decreased load	Increase database read capacity
Elasticity	Automatic scaling up and down with demand	Auto Scaling adds instances during peak traffic and removes them later

A common trap is selecting scalability when the scenario emphasizes automatic response to changing demand. That is usually elasticity.

AWS Global Infrastructure

Component	What it is	Exam signal
Region	Geographic area containing multiple Availability Zones	Choose Region for latency, compliance, service availability, cost
Availability Zone	One or more isolated data centers in a Region	Use multiple AZs for high availability
Edge location	Site used by edge services	CloudFront, Route 53, AWS Global Accelerator
Local Zone	Infrastructure closer to large population/industry centers	Ultra-low latency applications near a city
AWS Wavelength	AWS infrastructure embedded in 5G networks	Ultra-low latency mobile/5G applications
AWS Outposts	AWS infrastructure installed on premises	Hybrid workloads needing local processing with AWS services
Regional edge cache	CloudFront caching layer between edge locations and origins	Improves content delivery efficiency

Notes and examples

Region Selection Factors

Factor	Why it matters
Latency	Place workloads near users or systems
Compliance/data residency	Some workloads must remain in specific jurisdictions
Service availability	Not all AWS services/features are available in every Region
Cost	Pricing can vary by Region
Fault isolation	Multi-Region architecture can improve resilience for critical systems

Key infrastructure terms

Term	Meaning	Typical exam angle
Region	A separate geographic area containing multiple Availability Zones	Choose for latency, compliance, data residency, service availability
Availability Zone	One or more discrete data centers within a Region	Design across multiple AZs for high availability
Edge location	Site used by services such as CloudFront to cache content near users	Lower latency for global content delivery
Local Zone	Places selected AWS services closer to large population or industry centers	Low-latency local workloads
AWS Outposts	AWS infrastructure installed on premises	Hybrid workloads that need local processing
AWS Wavelength	AWS services at 5G network edge locations	Ultra-low latency mobile/5G use cases

Region selection decision points

Choose a Region based on:

Compliance or data residency requirements.
Latency to users or systems.
Service availability in that Region.
Cost differences.
Resilience strategy, such as multi-Region disaster recovery.

Do not assume every AWS service is available in every Region.

Shared Responsibility Model

Area	AWS responsibility	Customer responsibility
Physical data centers	Facilities, power, cooling, physical security	None for AWS facilities
Hardware and networking infrastructure	Host hardware, storage hardware, network infrastructure	Use services securely
Virtualization layer	Hypervisor and foundational service infrastructure	Guest OS hardening where applicable
Amazon EC2	Infrastructure under EC2	OS patches, security groups, applications, data
Managed databases	Underlying infrastructure and managed database platform tasks	Data, access control, network access, configuration choices
Amazon S3	Service durability and infrastructure	Bucket policies, encryption settings, object access, data classification
AWS Lambda	Runtime infrastructure and scaling platform	Function code, IAM permissions, event sources, data
IAM	Provides identity service	Users, roles, policies, MFA, least privilege
Data	Secure storage capabilities	Data classification, encryption choices, access permissions, retention

Notes and examples

Shared Responsibility Traps

Statement	Correct exam interpretation
“AWS secures everything in the cloud.”	AWS secures the cloud; customers secure what they put in the cloud.
“AWS patches my EC2 operating system.”	Customer is responsible for guest OS patching on EC2.
“S3 is secure by default, so no customer action is needed.”	Customers still manage bucket access, policies, encryption choices, and data.
“Managed services remove all security work.”	They reduce operational burden but do not remove access, data, and configuration responsibility.
“Compliance is fully outsourced to AWS.”	AWS provides compliant infrastructure and reports; customers must build compliant workloads.

Shared Responsibility Model

The Shared Responsibility Model is one of the most important CLF-C02 concepts.

Responsibility split

Area	AWS responsibility	Customer responsibility
Physical facilities	Data centers, power, cooling, physical security	Not responsible
Hardware and global infrastructure	Servers, storage hardware, networking hardware	Not responsible
Managed service infrastructure	Operating and securing the underlying service platform	Configure and use the service securely
Data	Provides secure services and controls	Owns data classification, protection choices, and access
IAM	Provides IAM service	Create users, roles, policies, MFA, least privilege
Network configuration	Provides networking capabilities	Configure VPCs, security groups, NACLs, routing
Guest operating system on EC2	Provides infrastructure	Patch and secure the OS unless using a managed service
Applications	Provides hosting services	Secure application code and dependencies

Service model changes the customer responsibility

Service type	Customer manages more	Customer manages less
Amazon EC2	Operating system, patches, application runtime, installed software	Physical infrastructure
Containers on customer-managed EC2	Container host, cluster configuration, OS, runtime	Physical infrastructure
AWS Fargate	Container image and app configuration	Servers and container host management
AWS Lambda	Function code, permissions, event sources	Servers, OS, runtime operations
Amazon S3	Bucket policies, object permissions, data lifecycle choices	Storage infrastructure
Amazon RDS	Database settings, access, schema, data	Hardware, database engine patching options, backups features

Common shared responsibility traps

“AWS secures the cloud; the customer secures what they put in the cloud.”
AWS does not automatically classify your data for business sensitivity.
AWS does not automatically grant least-privilege IAM permissions.
AWS does not patch your EC2 guest operating system by default.
For managed services, AWS manages more infrastructure, but the customer still controls access, data, and configuration choices.

IAM and Access Control

Identity and Permission Objects

IAM concept	Purpose	Exam cue
Root user	Original account identity with full access	Lock down, enable MFA, avoid routine use
IAM user	Long-term identity for a person or workload	Prefer roles/federation where possible
IAM group	Collection of IAM users	Assign common permissions to users
IAM role	Assumable identity with temporary credentials	Use for AWS services, cross-account access, federation
IAM policy	JSON permissions document	Defines allowed/denied actions and resources
Permissions boundary	Maximum permissions an identity-based policy can grant	Delegate administration safely
Resource-based policy	Policy attached to resource	S3 bucket policies, KMS key policies, SQS policies
Access key	Long-term programmatic credential	Rotate and avoid embedding in code
MFA	Additional authentication factor	Strongly associated with root and privileged access

Notes and examples

IAM Policy Logic

Rule	Exam relevance
Default is implicit deny	No permission means no access
Explicit allow grants access	Unless another policy explicitly denies it
Explicit deny wins	Overrides allows
Least privilege	Grant only required actions/resources
Temporary credentials are preferred	Roles reduce long-term credential risk

AWS Organizations and Account Governance

Service/feature	Use for	Distinction
AWS Organizations	Centrally manage multiple AWS accounts	Consolidated billing and account grouping
Organizational unit	Group accounts	Apply governance by environment, team, or business unit
Service control policy	Set maximum permissions for accounts/OUs	SCPs do not grant permissions by themselves
Consolidated billing	Single bill across accounts	Can help aggregate usage for pricing benefits
AWS Control Tower	Set up and govern multi-account AWS environments	Landing zone and guardrails
IAM Identity Center	Workforce access to multiple AWS accounts/apps	Centralized sign-in and permission sets

IAM essentials

Concept	What it does	Exam tip
IAM user	Long-term identity for a person or application	Prefer roles and federation where possible
IAM group	Collection of IAM users	Policies can be attached to groups
IAM role	Identity with temporary credentials that can be assumed	Common answer for AWS service access
IAM policy	JSON permission document	Grants or denies actions on resources
Root user	Account owner identity with full access	Secure with MFA and avoid routine use
MFA	Additional authentication factor	Strongly recommended for privileged identities
Least privilege	Grant only required permissions	Frequent best-practice answer

IAM role vs IAM user

Scenario	Better answer
EC2 instance needs to access S3	IAM role attached to the instance
Lambda function needs to write logs	IAM execution role
External user needs temporary AWS access	IAM role / federation
Human administrator needs centralized sign-in across accounts	AWS IAM Identity Center
Application uses long-term access keys in code	Usually a bad practice; prefer roles

Policy evaluation basics

For CLF-C02, remember:

Permissions are denied by default.
An explicit allow can grant access.
An explicit deny overrides an allow.
Use least privilege.
Avoid embedding long-term credentials in applications.

AWS Organizations and account governance

Feature	Purpose
AWS Organizations	Centrally manage multiple AWS accounts
Organizational unit, OU	Group accounts for administration
Service control policy, SCP	Set maximum available permissions for accounts or OUs
Consolidated billing	Combine billing across accounts
AWS Control Tower	Helps set up and govern a multi-account AWS environment

Important distinction: SCPs do not grant permissions by themselves. They define permission boundaries at the account or OU level. IAM policies are still needed to allow actions.

Security, Compliance, and Detection Services

Service	Primary purpose	Choose when the question says…
AWS IAM	Identity and access permissions	Users, roles, policies, least privilege
AWS IAM Identity Center	Central workforce access	SSO to AWS accounts and applications
AWS Key Management Service	Create/manage encryption keys	Centralized key management
AWS CloudHSM	Dedicated hardware security modules	Customer-managed HSM requirements
AWS Secrets Manager	Store, retrieve, rotate secrets	Database passwords, API keys, automatic rotation
AWS Systems Manager Parameter Store	Store configuration and secrets	Hierarchical parameters, app config values
AWS Certificate Manager	Provision/manage TLS certificates	HTTPS certificates for AWS-integrated services
AWS WAF	Filter web requests	SQL injection, cross-site scripting, web ACLs
AWS Shield	DDoS protection	Protect against distributed denial-of-service attacks
AWS Firewall Manager	Centrally manage firewall rules	Multi-account WAF/security policy administration
Amazon GuardDuty	Threat detection	Suspicious activity, malicious IPs, anomalous behavior
Amazon Inspector	Vulnerability management	Scan EC2, container images, Lambda functions
Amazon Macie	Discover sensitive data in S3	PII/sensitive data classification
AWS Security Hub	Central security findings	Aggregate and prioritize findings
AWS CloudTrail	Record API activity	Who did what, when, from where
AWS Config	Track resource configuration/compliance	Configuration history and rules
AWS Artifact	Access compliance reports/agreements	Download AWS compliance documentation
AWS Audit Manager	Automate evidence collection	Audit preparation and control mapping
Amazon Detective	Investigate security findings	Analyze relationships and event context

Notes and examples

Encryption Decision Points

Requirement	AWS service/feature
Encrypt S3 objects at rest	S3 server-side encryption options
Manage encryption keys centrally	AWS KMS
Dedicated HSM control	AWS CloudHSM
Encrypt data in transit	TLS, AWS Certificate Manager
Rotate database credentials	AWS Secrets Manager
Protect public web app from common exploits	AWS WAF
Detect suspicious account activity	Amazon GuardDuty
Track configuration drift	AWS Config

Security service recognition table

Service	Primary purpose	Do not confuse with…
AWS IAM	Identity and access management	IAM Identity Center for workforce federation
AWS IAM Identity Center	Centralized workforce access to multiple AWS accounts and apps	IAM users
AWS KMS	Create and control encryption keys	AWS Secrets Manager
AWS Secrets Manager	Store, retrieve, and rotate secrets	Parameter Store for simpler configuration values
AWS Certificate Manager, ACM	Provision and manage SSL/TLS certificates	KMS keys
AWS CloudTrail	Record AWS API calls and account activity	CloudWatch metrics/logs
Amazon CloudWatch	Metrics, logs, alarms, dashboards	CloudTrail audit history
AWS Config	Track resource configuration and compliance over time	CloudTrail API event history
Amazon GuardDuty	Threat detection using logs and intelligence	Inspector vulnerability scanning
Amazon Inspector	Automated vulnerability management for workloads	GuardDuty threat detection
Amazon Macie	Discover and protect sensitive data in S3	KMS encryption
AWS Security Hub	Aggregates security findings	GuardDuty alone
AWS Shield	DDoS protection	AWS WAF web request filtering
AWS WAF	Web application firewall for HTTP/S requests	Security groups
AWS Artifact	Access AWS compliance reports and agreements	Audit logging
Amazon Detective	Investigate security findings	GuardDuty detection
AWS Audit Manager	Continuously audit AWS usage against frameworks	Artifact reports

CloudTrail vs CloudWatch vs Config

Need	Best match
“Who made this API call?”	AWS CloudTrail
“What is CPU utilization?”	Amazon CloudWatch
“Alert me when a metric crosses a threshold.”	Amazon CloudWatch alarm
“Has this resource configuration changed?”	AWS Config
“Is this resource compliant with a rule?”	AWS Config
“Collect application logs.”	Amazon CloudWatch Logs

This is one of the most common question-bank trap areas. Use topic drills until you can choose among these quickly.

Encryption basics

Need	Service or feature
Manage encryption keys	AWS KMS
Hardware security module control	AWS CloudHSM
Encrypt S3 objects	Server-side encryption options for S3, often using S3-managed or KMS-managed keys
Encrypt EBS volumes	EBS encryption
Encrypt RDS databases	RDS encryption options
Manage TLS certificates	AWS Certificate Manager

Know the difference:

Encryption at rest protects stored data.
Encryption in transit protects data moving across networks, usually with TLS.
KMS manages cryptographic keys; it is not a general secret storage service.
Secrets Manager stores secrets such as database credentials and can support rotation.

Networking and Content Delivery

Service/concept	Purpose	Exam cue
Amazon VPC	Isolated virtual network in AWS	Subnets, route tables, security controls
Subnet	Segment of a VPC in one Availability Zone	Public or private placement
Route table	Controls traffic routing	Determines where subnet traffic goes
Internet gateway	Allows VPC resources to access internet directly	Public subnet internet connectivity
NAT gateway	Allows private subnet outbound internet access	Instances download updates without inbound exposure
Security group	Stateful instance-level virtual firewall	Allow rules, attached to ENIs/resources
Network ACL	Stateless subnet-level firewall	Allow and deny rules at subnet boundary
VPC peering	Connect two VPCs privately	Simple VPC-to-VPC connectivity
AWS Transit Gateway	Hub for many VPC/on-prem networks	Scalable network connectivity
AWS Direct Connect	Dedicated private connection to AWS	Consistent private network connectivity
AWS Site-to-Site VPN	Encrypted connection over internet	Quick hybrid connectivity
AWS Client VPN	Remote user VPN access	Users connect securely to AWS/on-prem
Amazon Route 53	DNS and domain routing	Domain names, DNS records, routing policies
Amazon CloudFront	Content delivery network	Cache content at edge locations
AWS Global Accelerator	Improve global app availability/performance	Anycast static IPs, route to healthy endpoints
Elastic Load Balancing	Distribute traffic	ALB, NLB, Gateway Load Balancer

Notes and examples

Security Group vs Network ACL

Feature	Security group	Network ACL
Scope	Resource/network interface level	Subnet level
State	Stateful	Stateless
Rules	Allow rules only	Allow and deny rules
Return traffic	Automatically allowed	Must be explicitly allowed
Common use	Instance/application access control	Broad subnet traffic filtering

Load Balancer Selection

Load balancer	Best fit
Application Load Balancer	HTTP/HTTPS, path/host-based routing, web applications
Network Load Balancer	Very high performance TCP/UDP/TLS traffic
Gateway Load Balancer	Deploy and scale third-party virtual appliances

VPC basics

Component	Purpose
Amazon VPC	Isolated virtual network in AWS
Subnet	Segment of a VPC within an Availability Zone
Public subnet	Has route to internet gateway for internet-facing resources
Private subnet	No direct inbound internet route
Route table	Controls where network traffic is directed
Internet gateway	Allows internet access for public resources
NAT gateway	Allows outbound internet access from private subnets
Security group	Stateful virtual firewall for instances/resources
Network ACL	Stateless subnet-level traffic filter
VPC endpoint	Private access to supported AWS services without using public internet
VPC peering	Private connection between two VPCs
AWS Transit Gateway	Hub for connecting many VPCs and networks

Security group vs network ACL

Feature	Security group	Network ACL
Level	Resource/instance level	Subnet level
State	Stateful	Stateless
Rules	Allow rules only	Allow and deny rules
Return traffic	Automatically allowed if request allowed	Must be explicitly allowed
Common use	Instance-level access control	Broad subnet traffic control

This is a high-frequency CLF-C02 trap. If the scenario says stateless or subnet-level, think network ACL.

Connectivity services

Need	Service
Encrypted connection over the internet from on-premises to AWS	AWS Site-to-Site VPN
Dedicated private network connection to AWS	AWS Direct Connect
Connect many VPCs and on-premises networks centrally	AWS Transit Gateway
DNS and domain registration/routing	Amazon Route 53
Global content caching	Amazon CloudFront
Improve global application availability/performance with static anycast IPs	AWS Global Accelerator

Route 53 routing policy recognition

Routing need	Route 53 concept
Basic single destination	Simple routing
Route based on health checks / failover	Failover routing
Route based on user location	Geolocation routing
Route to lowest-latency Region	Latency-based routing
Split traffic by percentage	Weighted routing

Compute and Containers

Service	What it does	Choose when
Amazon EC2	Virtual servers	Need OS-level control or custom compute environment
Amazon EC2 Auto Scaling	Adjust EC2 capacity	Match demand and improve availability
Elastic Load Balancing	Distribute traffic	Avoid single-server bottlenecks
AWS Lambda	Run code without managing servers	Event-driven, short-running, serverless workloads
AWS Elastic Beanstalk	Deploy apps with managed platform	Want easy deployment but retain underlying resource visibility
Amazon Lightsail	Simplified VPS bundles	Simple websites/apps with predictable setup
Amazon ECS	Run containers	AWS-native container orchestration
Amazon EKS	Managed Kubernetes	Need Kubernetes ecosystem/API compatibility
AWS Fargate	Serverless container compute	Run containers without managing EC2 instances
AWS Batch	Batch computing jobs	Large-scale batch processing
VMware Cloud on AWS	VMware workloads on AWS	Extend/migrate VMware environments

Notes and examples

Compute Selection Traps

Requirement	Better answer	Why
“No server management”	Lambda or Fargate	EC2 still requires instance management
“Full control of operating system”	EC2	Lambda/Fargate abstract infrastructure
“Kubernetes”	EKS	ECS is not Kubernetes
“Simple app deployment without choosing every resource”	Elastic Beanstalk	Higher-level app platform
“Container orchestration with AWS-native service”	ECS	Simpler AWS-native container service
“Run containers without managing instances”	Fargate	Serverless compute for ECS/EKS

Storage

Storage Service Selection

Service	Storage type	Choose when
Amazon S3	Object storage	Durable object storage, static assets, backups, data lakes
Amazon S3 Glacier storage classes	Archive object storage	Long-term, low-cost archival with retrieval tradeoffs
Amazon EBS	Block storage	Persistent volumes for EC2
EC2 instance store	Temporary block storage	Ephemeral high-performance local storage
Amazon EFS	Managed file storage	Shared Linux file system across multiple compute resources
Amazon FSx for Windows File Server	Managed Windows file storage	SMB/Windows-based workloads
Amazon FSx for Lustre	High-performance file system	HPC, ML, high-throughput workloads
AWS Storage Gateway	Hybrid cloud storage	Connect on-prem apps to AWS storage
AWS Backup	Centralized backup management	Backup policies across AWS services
AWS Snow Family	Physical data transfer/edge compute	Large data migration or disconnected edge locations

Notes and examples

Amazon S3 Essentials

Feature	Exam meaning
Bucket	Top-level container for objects
Object	File plus metadata stored in S3
Key	Object name/path identifier
Versioning	Keep multiple versions of objects
Lifecycle policy	Transition or expire objects automatically
S3 Object Lock	Help prevent object deletion/modification for retention scenarios
Static website hosting	Serve static web content from S3
Event notifications	Trigger workflows from object events
Cross-Region Replication	Replicate objects to another Region
Bucket policy	Resource-based access policy
Block Public Access	Controls public access settings

S3 Storage Class Decision Points

Storage class family	Use when
S3 Standard	Frequently accessed data
S3 Intelligent-Tiering	Unknown or changing access patterns
S3 Standard-IA	Infrequently accessed but rapidly needed data
S3 One Zone-IA	Infrequent access and lower resilience requirement
S3 Glacier Instant Retrieval	Archive data needing immediate retrieval
S3 Glacier Flexible Retrieval	Archive data with flexible retrieval times
S3 Glacier Deep Archive	Lowest-cost long-term archive with slow retrieval tolerance

Block vs File vs Object

Need	Choose
Attach storage volume to EC2 like a disk	Amazon EBS
Share file system across Linux workloads	Amazon EFS
Store objects accessed by key/API	Amazon S3
Temporary local storage tied to instance lifecycle	EC2 instance store
Windows shared file storage	Amazon FSx for Windows File Server

Storage service selection

Service	Storage type	Best for
Amazon S3	Object storage	Objects, backups, static websites, data lakes
Amazon EBS	Block storage	Persistent volumes for EC2
EC2 instance store	Temporary block storage	Ephemeral data tied to instance lifecycle
Amazon EFS	Managed file storage	Shared Linux file system across instances
Amazon FSx	Managed file systems	Windows File Server, Lustre, NetApp ONTAP, OpenZFS use cases
AWS Backup	Centralized backup management	Backup policies across AWS services
AWS Storage Gateway	Hybrid cloud storage	Connect on-premises environments to AWS storage
AWS Snow Family	Physical devices for edge or data transfer	Large-scale offline transfer or rugged edge processing

S3 essentials

Concept	Meaning
Bucket	Container for S3 objects
Object	File plus metadata stored in S3
Key	Object name/path
Versioning	Keep multiple versions of objects
Lifecycle policy	Move or expire objects over time
Replication	Copy objects to another bucket or Region based on rules
S3 Object Lock	Helps prevent object deletion or overwrite for retention use cases
Static website hosting	Host static HTML/CSS/JS content from S3

S3 storage classes

Storage class	Best for
S3 Standard	Frequently accessed data
S3 Intelligent-Tiering	Data with unknown or changing access patterns
S3 Standard-IA	Infrequently accessed data that still needs rapid access
S3 One Zone-IA	Infrequently accessed data stored in one AZ
S3 Glacier Instant Retrieval	Archive data requiring immediate retrieval
S3 Glacier Flexible Retrieval	Archive data with flexible retrieval needs
S3 Glacier Deep Archive	Long-term archive data with lowest-cost archive use cases

Trap: S3 One Zone-IA stores data in one Availability Zone. It is not the default choice for critical multi-AZ resilience.

EBS vs EFS vs S3

Need	Choose
Boot volume or attached disk for EC2	Amazon EBS
Shared file system for multiple Linux instances	Amazon EFS
Object storage accessible via API/HTTP	Amazon S3
Temporary high-speed storage tied to EC2 host	Instance store
Windows shared file system	Amazon FSx for Windows File Server

Databases and Analytics

Database Service Selection

Service	Database type	Choose when
Amazon RDS	Managed relational database	SQL database with managed backups, patching, Multi-AZ options
Amazon Aurora	AWS-optimized relational database	High performance relational workload compatible with MySQL/PostgreSQL
Amazon DynamoDB	Serverless NoSQL key-value/document	Low-latency, scalable, non-relational access patterns
Amazon Redshift	Data warehouse	Analytics across large structured datasets
Amazon ElastiCache	In-memory cache	Speed up reads, session stores, caching
Amazon Neptune	Graph database	Highly connected data, relationships
Amazon DocumentDB	Document database	MongoDB-compatible document workloads
Amazon Keyspaces	Wide-column database	Apache Cassandra-compatible workloads
Amazon Timestream	Time series database	IoT, telemetry, time-stamped metrics
Amazon QLDB	Ledger database	Immutable, cryptographically verifiable transaction log

Notes and examples

Analytics and Data Services

Service	Purpose	Exam cue
Amazon Athena	Query data in S3 using SQL	Serverless ad hoc analysis
AWS Glue	Data catalog and ETL	Prepare, catalog, transform data
Amazon EMR	Big data frameworks	Spark, Hadoop, distributed processing
Amazon Kinesis	Streaming data	Real-time ingestion and processing
Amazon Data Firehose	Load streaming data to destinations	Delivery stream to S3/Redshift/OpenSearch/etc.
Amazon OpenSearch Service	Search and log analytics	Full-text search, observability analytics
Amazon QuickSight	Business intelligence dashboards	Visualize and share BI insights
AWS Lake Formation	Build/manage data lakes	Governed data lake setup

Database Traps

Scenario	Correct service	Avoid confusing with
Need relational SQL database	RDS/Aurora	DynamoDB
Need serverless NoSQL at scale	DynamoDB	RDS
Need data warehouse analytics	Redshift	RDS transactional database
Need cache to reduce database load	ElastiCache	EBS/EFS
Need query files directly in S3	Athena	Redshift
Need graph relationships	Neptune	DynamoDB

Database selection table

Service	Type	Best for
Amazon RDS	Managed relational database	Traditional SQL applications
Amazon Aurora	AWS-optimized relational database	High-performance MySQL/PostgreSQL-compatible workloads
Amazon DynamoDB	Managed NoSQL key-value/document database	Serverless, low-latency, scalable apps
Amazon ElastiCache	In-memory cache	Redis or Memcached caching
Amazon Redshift	Data warehouse	Analytics on large structured datasets
Amazon Neptune	Graph database	Highly connected data relationships
Amazon DocumentDB	Document database	MongoDB-compatible document workloads
Amazon Timestream	Time-series database	IoT, telemetry, time-based data
Amazon QLDB	Ledger database	Immutable, verifiable transaction log use cases
Amazon Keyspaces	Wide-column database	Apache Cassandra-compatible workloads

RDS vs DynamoDB

Question clue	Likely answer
SQL, joins, relational schema, existing commercial/open-source DB engine	Amazon RDS
MySQL/PostgreSQL compatibility with AWS-optimized performance	Amazon Aurora
Key-value access, massive scale, serverless NoSQL	Amazon DynamoDB
Microservice with unpredictable scale and simple access patterns	DynamoDB often fits
Complex relational transactions and SQL reporting	RDS or Aurora usually fits

Cache vs database

If the question asks for faster repeated reads or reduced database load, think Amazon ElastiCache. If it asks for durable primary data storage, choose a database or storage service instead.

Application Integration and Messaging

Service	Purpose	Choose when
Amazon SQS	Message queues	Decouple components with reliable queueing
Amazon SNS	Pub/sub notifications	Fan-out messages to subscribers
Amazon EventBridge	Event bus	Event-driven integration across AWS/SaaS/custom apps
AWS Step Functions	Workflow orchestration	Coordinate multi-step processes
Amazon API Gateway	Create/manage APIs	Front door for APIs, often with Lambda
AWS AppSync	Managed GraphQL APIs	GraphQL and real-time data sync
Amazon MQ	Managed message broker	Migrate apps using brokers like ActiveMQ/RabbitMQ
AWS AppConfig	Manage application configuration	Deploy config changes safely
AWS Simple Email Service	Email sending/receiving	Application email use cases

Notes and examples

Queue vs Pub/Sub vs Workflow

Need	Service
One component sends work to be processed later	Amazon SQS
One message should notify many subscribers	Amazon SNS
Route events from many sources to many targets	Amazon EventBridge
Coordinate steps with retries/branches/state	AWS Step Functions

Serverless pattern recognition

Requirement	Common AWS service
Run event-driven code	AWS Lambda
Expose API endpoints	Amazon API Gateway
Store objects	Amazon S3
NoSQL database	Amazon DynamoDB
Queue messages	Amazon SQS
Fan-out notifications	Amazon SNS
Event bus / event routing	Amazon EventBridge
Workflow orchestration	AWS Step Functions
User sign-up and authentication	Amazon Cognito

Service	Pattern	Example
Amazon SQS	Queue; one consumer processes each message	Decouple web app from order processor
Amazon SNS	Pub/sub notification fan-out	Send one event to email, Lambda, and SQS subscribers
Amazon EventBridge	Event bus and routing	Route SaaS/app/AWS events to targets

Trap: SQS queues work items; SNS broadcasts notifications.

Migration, Hybrid, and Transfer

Service/framework	Purpose	Exam cue
AWS Cloud Adoption Framework	Guidance for cloud adoption	Business, people, governance, platform, security, operations perspectives
AWS Migration Hub	Track migrations	Central place to monitor migration progress
AWS Application Discovery Service	Discover on-prem workloads	Inventory and dependency mapping
AWS Application Migration Service	Lift-and-shift server migration	Rehost applications to AWS
AWS Database Migration Service	Migrate databases	Homogeneous or heterogeneous database migration
AWS Schema Conversion Tool	Convert database schemas	Heterogeneous database migrations
AWS DataSync	Online data transfer	Move data between on-prem, AWS storage, and other locations
AWS Transfer Family	Managed SFTP/FTPS/FTP	File transfer into/out of AWS storage
AWS Snowcone	Small rugged edge/data transfer device	Edge collection or smaller transfer jobs
AWS Snowball Edge	Physical data transfer and edge compute	Large migrations or remote processing
AWS Snowmobile	Exabyte-scale physical transfer	Extremely large data center migrations
AWS Storage Gateway	Hybrid storage integration	On-prem apps using cloud-backed storage

Notes and examples

Migration Strategy Terms

Strategy	Meaning
Rehost	Lift and shift with minimal change
Replatform	Make some optimizations without major architecture change
Refactor/re-architect	Redesign application to use cloud-native patterns
Repurchase	Move to a different product, often SaaS
Retain	Keep workload as is for now
Retire	Decommission no-longer-needed workload
Relocate	Move infrastructure-level platform with minimal application change

Migration service recognition

Service	Use
AWS Migration Hub	Track migration progress across tools
AWS Application Migration Service	Lift-and-shift application migration
AWS Database Migration Service, AWS DMS	Migrate databases to AWS
AWS Schema Conversion Tool	Help convert database schemas
AWS DataSync	Online data transfer between storage systems and AWS
AWS Transfer Family	Managed file transfer using protocols such as SFTP
AWS Snow Family	Physical devices for large data transfer or edge workloads
AWS Storage Gateway	Hybrid access to cloud-backed storage
AWS Direct Connect	Dedicated network connection to AWS

Snow Family quick distinction

Device family concept	Typical use
Snowcone	Small rugged edge/data transfer device
Snowball Edge	Larger data transfer and edge compute
Snowmobile	Extremely large-scale data migration concept

For CLF-C02, you usually only need to recognize that Snow Family helps when network transfer is impractical or when edge locations need rugged local processing.

Management, Monitoring, and Operations

Service	Primary purpose	Choose when
Amazon CloudWatch	Metrics, logs, alarms, dashboards	Monitor performance and trigger alarms
AWS CloudTrail	API activity logging	Audit actions in AWS accounts
AWS Config	Resource inventory/config history/rules	Track compliance and configuration changes
AWS Systems Manager	Operate/manage resources	Patch, run commands, inventory, automation
AWS Health	AWS service events affecting you	Service health and account-specific events
AWS Trusted Advisor	Best-practice checks	Cost, security, fault tolerance, performance, service limits guidance
AWS Well-Architected Tool	Review workloads	Assess architecture against best practices
AWS Service Catalog	Approved product portfolios	Standardized self-service provisioning
AWS License Manager	Manage software licenses	Track license usage
AWS Managed Services	AWS-operated infrastructure management	Operational management for AWS environments
AWS Proton	Manage infrastructure for containers/serverless	Platform templates for app teams

Notes and examples

CloudWatch vs CloudTrail vs Config

Need	Service
“CPU is high; alert operations”	CloudWatch
“Who deleted this bucket?”	CloudTrail
“Was this security group open to the internet last week?”	AWS Config
“Run a command or patch managed instances”	Systems Manager
“AWS service issue affects my account”	AWS Health

Operational service recognition

Service	Main use
Amazon CloudWatch	Metrics, logs, alarms, dashboards
AWS CloudTrail	Governance, compliance, operational and risk auditing of API activity
AWS Config	Resource inventory, configuration history, compliance rules
AWS Systems Manager	Operational management for AWS resources and hybrid environments
AWS Health Dashboard	Events affecting AWS services and your account
AWS Trusted Advisor	Recommendations for cost optimization, performance, security, fault tolerance, and service limits
AWS Service Catalog	Approved portfolios of products for users to launch
AWS CloudFormation	Infrastructure as code using templates
AWS Cloud Development Kit, AWS CDK	Define cloud infrastructure using programming languages
AWS OpsWorks	Configuration management using Chef/Puppet-style approaches

CloudFormation vs Elastic Beanstalk

Need	Choose
Provision infrastructure from templates	AWS CloudFormation
Deploy an app while AWS handles infrastructure provisioning details	AWS Elastic Beanstalk
Define infrastructure using familiar programming languages	AWS CDK

Architecture and Well-Architected Concepts

AWS Well-Architected Pillars

Pillar	Focus	Exam examples
Operational excellence	Run and improve systems	Automation, monitoring, small reversible changes
Security	Protect data, systems, assets	IAM, encryption, detection, incident response
Reliability	Recover from failures	Multi-AZ, backups, auto recovery, testing
Performance efficiency	Use resources efficiently	Right service, scalable architecture, modern instance types
Cost optimization	Avoid unnecessary cost	Right sizing, pricing models, budgets
Sustainability	Minimize environmental impact	Efficient utilization, managed services, optimized demand

Notes and examples

Availability and Resilience Terms

Term	Meaning
High availability	System remains accessible despite some failures
Fault tolerance	System continues operating with minimal interruption after failures
Disaster recovery	Strategy to restore service after major disruption
Backup	Copy of data for recovery
Recovery Time Objective	Target time to restore service
Recovery Point Objective	Maximum acceptable data loss measured in time
Horizontal scaling	Add more instances/resources
Vertical scaling	Increase size/capacity of a resource
Loose coupling	Components depend on each other minimally
Stateless design	Instances do not store required session state locally

Common Resilient Patterns

Requirement	AWS pattern
Survive instance failure	Auto Scaling group across multiple AZs
Distribute web traffic	Elastic Load Balancing
Store durable static assets	Amazon S3
Decouple app components	SQS, SNS, EventBridge
Recover relational database from AZ failure	RDS Multi-AZ deployment
Improve global content performance	CloudFront
Protect against accidental deletion	Backups, versioning, lifecycle/retention controls
Reduce single points of failure	Multi-AZ architecture and managed services

Six Well-Architected pillars

Pillar	Exam meaning
Operational excellence	Run and improve systems, automate operations, learn from events
Security	Protect data, systems, and assets
Reliability	Recover from failures and meet demand
Performance efficiency	Use resources efficiently as requirements change
Cost optimization	Avoid unnecessary cost and improve value
Sustainability	Minimize environmental impact of workloads

Architecture decision rules

Scenario asks for…	Prefer…
Loosely coupled communication	Amazon SQS, Amazon SNS, Amazon EventBridge
Queue between application tiers	Amazon SQS
Publish messages to multiple subscribers	Amazon SNS
Event routing between services/apps	Amazon EventBridge
Orchestrate multi-step workflows	AWS Step Functions
Scale web tier automatically	EC2 Auto Scaling with Elastic Load Balancing
Reduce latency for static content	Amazon CloudFront
Avoid managing servers	Lambda, Fargate, managed services
Improve fault tolerance	Multi-AZ design, load balancing, backups
Disaster recovery across geographic areas	Multi-Region strategy

High availability vs fault tolerance vs disaster recovery

Term	Meaning
High availability	System remains accessible with minimal interruption
Fault tolerance	System continues operating even when components fail
Disaster recovery	Restore service after a major outage or disaster
Backup	Copy of data used for restore
Multi-AZ	Resilience within a Region
Multi-Region	Resilience across Regions; often more complex and costly

A question asking for resilience against an Availability Zone failure usually points to multi-AZ. A question asking for resilience against a Regional outage points to multi-Region.

AI, Machine Learning, and End-User Services

Service	Purpose	Exam cue
Amazon SageMaker	Build, train, deploy ML models	Custom ML lifecycle
Amazon Bedrock	Build generative AI applications with foundation models	GenAI without managing foundation model infrastructure
Amazon Comprehend	Natural language processing	Sentiment, entities, key phrases
Amazon Lex	Conversational chatbots	Voice/text bots
Amazon Polly	Text to speech	Convert text into lifelike speech
Amazon Rekognition	Image/video analysis	Detect labels, faces, moderation
Amazon Textract	Extract text/data from documents	Forms, tables, scanned documents
Amazon Transcribe	Speech to text	Audio transcription
Amazon Translate	Language translation	Translate text
Amazon Kendra	Enterprise search	Intelligent search over business content
Amazon Personalize	Recommendations	Personalization and recommendations
Amazon Connect	Cloud contact center	Customer service/contact center
Amazon WorkSpaces	Virtual desktops	Desktop-as-a-service
Amazon AppStream 2.0	Application streaming	Stream desktop applications to users

Pricing, Billing, and Cost Management

Pricing Fundamentals

Concept	Meaning
Pay for what you use	Usage-based pricing for many services
No long-term commitment required	On-Demand options are available for many services
Pay less with commitment	Savings Plans and Reserved Instances can reduce cost for steady usage
Pay less with spare capacity	Spot can reduce cost for interruptible workloads
Data transfer matters	Data movement can affect cost depending on direction and service
Managed services may reduce operational cost	Higher service price can be offset by lower administration effort

Notes and examples

Compute Pricing Options

Option	Best fit	Trap
On-Demand	Flexible, unpredictable, short-term workloads	Usually not the lowest cost for steady long-running usage
Savings Plans	Commitment to usage for reduced compute cost	Applies based on eligible usage and plan type
Reserved Instances	Predictable EC2/RDS-style capacity needs	Less flexible than pure On-Demand
Spot Instances	Fault-tolerant, interruptible workloads	Can be interrupted; not ideal for critical persistent workloads
Dedicated Hosts	Physical server dedicated to your use	Often chosen for licensing/compliance needs
Dedicated Instances	Instances run on hardware dedicated to one customer	Less license-control detail than Dedicated Hosts

Cost Tools

Tool	Use for
AWS Pricing Calculator	Estimate cost before deployment
AWS Cost Explorer	Visualize and analyze historical spend/usage
AWS Budgets	Set budget thresholds and alerts
AWS Cost and Usage Report	Detailed billing data for analysis
AWS Cost Anomaly Detection	Detect unusual spend patterns
AWS Billing dashboard	View bills and account charges
AWS Marketplace	Find third-party software/services
AWS Compute Optimizer	Rightsizing recommendations for supported resources
AWS Trusted Advisor	Cost optimization and best-practice checks

Cost Optimization Decision Points

Requirement	Likely answer
Alert when monthly cost exceeds threshold	AWS Budgets
Estimate cost of planned architecture	AWS Pricing Calculator
Analyze past spending trends	AWS Cost Explorer
Get detailed raw billing data	Cost and Usage Report
Detect unexpected spend spike	Cost Anomaly Detection
Reduce cost of steady compute usage	Savings Plans or Reserved Instances
Use spare capacity for batch jobs	Spot Instances
Reduce storage cost over time	S3 lifecycle policies and storage classes
Identify idle/underused resources	Trusted Advisor, Compute Optimizer, Cost Explorer

Pricing fundamentals

AWS pricing commonly varies by:

Compute usage and purchase model.
Storage amount, class, and retrieval.
Data transfer.
Requests and API calls.
Managed service features.
Region.
Support plan and optional services.

Do not assume the cheapest option is always correct. The exam often balances cost with availability, performance, or operational effort.

Cost tool selection

Need	Best match
Estimate cost before building	AWS Pricing Calculator
View and analyze historical cost and usage	AWS Cost Explorer
Set alerts for cost or usage thresholds	AWS Budgets
Detailed billing data for analysis	AWS Cost and Usage Report
Receive optimization recommendations	AWS Trusted Advisor
Allocate costs by project/team	Cost allocation tags
Central billing across accounts	AWS Organizations consolidated billing

Common billing traps

Pricing Calculator estimates before deployment; it does not analyze your real past usage.
Cost Explorer analyzes actual cost and usage trends; it is not primarily an alerting tool.
AWS Budgets is for thresholds and notifications.
Trusted Advisor gives recommendations across categories, including cost optimization.
Consolidated billing helps manage multiple accounts centrally.
Tags help organize and allocate costs, but only if used consistently.

Support concepts

Know that AWS offers multiple support options with different levels of technical support, response expectations, and advisory features. For exam purposes, focus on the general idea:

Need	Think about
Basic documentation and whitepapers	AWS documentation and self-service resources
Account and billing support	Available separately from deep technical support
Technical guidance and production workload support	Paid AWS Support plans
Architectural guidance and best practices	AWS Support resources, Trusted Advisor, Well-Architected guidance
Help from third-party software listings	AWS Marketplace seller or support path, depending on product

Avoid memorizing unofficial support-plan details from outdated sources. Use the current AWS exam guide and AWS support documentation for plan-specific features.

AWS Support and Documentation Resources

Resource	Purpose	Exam cue
AWS Support plans	Technical support options by plan level	Need access to AWS support engineers or advanced support features
Basic support	Account and billing support plus core resources	Included support baseline
Developer support	Early development/test support	Individual developer guidance
Business support	Production workload support	Production systems and broader technical support
Enterprise On-Ramp support	Production/business-critical support with enhanced guidance	Organizations needing stronger support than Business
Enterprise support	Mission-critical support relationship	Highest-touch support and account guidance
AWS re:Post	Community and expert Q&A	Public AWS technical knowledge
AWS Documentation	Official service instructions	Service behavior and configuration guidance
AWS Whitepapers	Architecture and best-practice guidance	Conceptual guidance and frameworks
AWS Skill Builder	AWS training resource	Learning paths and courses
AWS Professional Services	Advisory/implementation help	Paid expert assistance
AWS Partner Network	AWS partners	Find consulting/technology partners
Technical Account Manager	Enterprise-level guidance role	Ongoing technical guidance for eligible support plans

Notes and examples

For the exam, avoid memorizing exact support response times unless your official study materials explicitly require them. Focus on which support level is appropriate for developer, production, business-critical, and enterprise needs.

Compliance and Governance

Concept/service	Exam relevance
AWS Artifact	Retrieve AWS compliance reports and agreements
AWS Config	Evaluate resources against rules
AWS CloudTrail	Audit account activity
AWS Organizations	Multi-account governance
Service control policies	Permission guardrails across accounts/OUs
AWS Control Tower	Governed multi-account landing zone
AWS Security Hub	Consolidated security posture
AWS Audit Manager	Evidence collection for audits
Data residency	Customer chooses Regions and architecture to meet requirements
Compliance inheritance	Customers can inherit controls from AWS infrastructure, but remain responsible for their workloads

Common Exam Traps

Trap	Correct thinking
Confusing CloudWatch and CloudTrail	CloudWatch monitors metrics/logs; CloudTrail records API activity
Confusing AWS Config and CloudTrail	Config tracks resource configuration; CloudTrail tracks actions
Assuming an IAM role is the same as a user	Roles are assumed and use temporary credentials
Thinking SCPs grant permissions	SCPs set maximum permissions; IAM still grants access
Choosing EC2 for every compute question	Managed/serverless services may be better if server management is not needed
Choosing EBS for shared file storage	EFS/FSx are file services; EBS is block storage for instances
Choosing RDS for any database	DynamoDB, Redshift, Neptune, and others fit different patterns
Using NAT gateway for inbound internet access	NAT gateway is for outbound access from private subnets
Treating security groups as stateless	Security groups are stateful
Treating NACLs as stateful	NACLs are stateless
Assuming Multi-AZ means Multi-Region	Multi-AZ is within one Region
Assuming S3 is a file system	S3 is object storage
Confusing elasticity and high availability	Elasticity adjusts capacity; HA maintains availability
Confusing AWS Marketplace and Service Catalog	Marketplace sells software/services; Service Catalog provides approved internal portfolios
Assuming Free Tier means no cost risk	Usage beyond free allowances or non-free services can incur charges

Notes and examples

Trap list

CloudTrail vs CloudWatch
- CloudTrail: API activity and audit.
- CloudWatch: metrics, logs, alarms.
Security group vs network ACL
- Security group: stateful, resource level.
- Network ACL: stateless, subnet level.
IAM role vs access key
- Roles with temporary credentials are usually preferred for AWS service access.
S3 vs EBS vs EFS
- S3: object storage.
- EBS: block volume for EC2.
- EFS: shared file storage.
RDS vs DynamoDB
- RDS/Aurora: relational SQL.
- DynamoDB: managed NoSQL key-value/document.
Pricing Calculator vs Cost Explorer vs Budgets
- Calculator: estimate.
- Cost Explorer: analyze actual costs.
- Budgets: alert on thresholds.
Multi-AZ vs multi-Region
- Multi-AZ: resilience inside a Region.
- Multi-Region: geographic disaster recovery or global strategy.
AWS responsibility vs customer responsibility
- AWS manages infrastructure.
- Customer manages data, identity, access, and configuration choices.
SNS vs SQS
- SNS broadcasts.
- SQS queues.
Managed service does not mean no customer responsibility

You still configure access, encryption choices, networking, and data handling.

Rapid Service Selection Matrix

Scenario	Best AWS answer
Host a static website	Amazon S3, often with CloudFront
Cache content near users globally	Amazon CloudFront
Register/manage DNS	Amazon Route 53
Run virtual machines	Amazon EC2
Automatically scale EC2 fleet	Amazon EC2 Auto Scaling
Distribute HTTP/HTTPS traffic	Application Load Balancer
Run event-driven code	AWS Lambda
Run containers without servers	AWS Fargate
Managed Kubernetes	Amazon EKS
Managed relational database	Amazon RDS
AWS-optimized relational database	Amazon Aurora
Serverless NoSQL database	Amazon DynamoDB
Data warehouse	Amazon Redshift
Query S3 data with SQL	Amazon Athena
ETL and data catalog	AWS Glue
Store objects	Amazon S3
Persistent EC2 block volume	Amazon EBS
Shared Linux file system	Amazon EFS
Hybrid storage bridge	AWS Storage Gateway
Physical data migration	AWS Snow Family
Online data transfer	AWS DataSync
Migrate databases	AWS Database Migration Service
Decouple with queue	Amazon SQS
Fan-out notifications	Amazon SNS
Event bus/routing	Amazon EventBridge
Multi-step workflow	AWS Step Functions
API front door	Amazon API Gateway
Manage identities and permissions	AWS IAM
Central SSO	IAM Identity Center
Encrypt/manage keys	AWS KMS
Store and rotate secrets	AWS Secrets Manager
Web application firewall	AWS WAF
Threat detection	Amazon GuardDuty
Vulnerability scanning	Amazon Inspector
Sensitive data discovery in S3	Amazon Macie
API audit trail	AWS CloudTrail
Metrics and alarms	Amazon CloudWatch
Configuration compliance	AWS Config
Cost forecast/estimate	AWS Pricing Calculator
Cost trends	AWS Cost Explorer
Cost alerts	AWS Budgets

Last-Minute Checklist

Know Cold

AWS Shared Responsibility Model.
Difference between Region, Availability Zone, and edge location.
IAM user vs group vs role vs policy.
Explicit deny overrides allow.
Security group vs network ACL.
CloudWatch vs CloudTrail vs AWS Config.
S3 vs EBS vs EFS vs FSx.
EC2 vs Lambda vs ECS/EKS/Fargate.
RDS/Aurora vs DynamoDB vs Redshift.
SQS vs SNS vs EventBridge vs Step Functions.
Pricing Calculator vs Cost Explorer vs Budgets.
Organizations, SCPs, Control Tower, and consolidated billing.
Well-Architected pillars.

Notes and examples

Use This Exam Strategy

Identify the requirement: security, cost, reliability, performance, operations, migration, or support.
Eliminate services that solve a different layer of the problem.
Prefer managed/serverless services when the question emphasizes reduced operations.
Prefer multi-AZ designs when the question emphasizes high availability within a Region.
Prefer IAM roles and temporary credentials over long-term access keys.
For audit questions, separate monitoring, logging, and configuration tracking:
- Metrics/alarms: CloudWatch.
- API calls: CloudTrail.
- Resource configuration: AWS Config.
For cost questions, separate estimating, analyzing, and alerting:
- Estimate: Pricing Calculator.
- Analyze: Cost Explorer.
- Alert: Budgets.

High-yield exam mindset

What CLF-C02 tends to test

Area	What to know quickly	Common candidate mistake
Cloud concepts	Elasticity, scalability, high availability, pay-as-you-go, global reach	Treating elasticity and scalability as identical
Security	Shared Responsibility Model, IAM, encryption, logging, monitoring	Assuming AWS handles all security tasks
Core AWS services	Compute, storage, databases, networking, analytics, migration, AI/ML at a recognition level	Over-studying console steps while missing service purpose
Pricing and billing	Pricing models, cost tools, account structures, support options	Confusing Budgets, Cost Explorer, Pricing Calculator, and Trusted Advisor
Architecture	Well-Architected thinking, managed services, fault tolerance, decoupling	Choosing a complex service when a managed service is the exam-friendly answer

Notes and examples

Practical review rule

If a question asks “Which AWS service should…”, first identify the workload category:

If the scenario says…	Think first of…
Run virtual servers	Amazon EC2
Run code without managing servers	AWS Lambda
Store objects, backups, static assets	Amazon S3
Managed relational database	Amazon RDS or Amazon Aurora
NoSQL key-value / document database	Amazon DynamoDB
Content delivery / caching at edge	Amazon CloudFront
DNS / domain routing	Amazon Route 53
Monitor metrics and alarms	Amazon CloudWatch
Audit API activity	AWS CloudTrail
Evaluate resource configuration over time	AWS Config
Identity and access permissions	AWS IAM
Central multi-account governance	AWS Organizations
Encrypt and manage keys	AWS Key Management Service, AWS KMS
Estimate future AWS costs	AWS Pricing Calculator
Analyze past/current cost and usage	AWS Cost Explorer
Set cost alerts and thresholds	AWS Budgets

Compute services

Compute comparison

Service	Use when…	Key exam clue
Amazon EC2	You need virtual servers and control over OS/runtime	“Virtual machine,” “install software,” “full control”
EC2 Auto Scaling	Add/remove EC2 instances based on demand	“Adjust capacity automatically”
Elastic Load Balancing	Distribute traffic across targets	“Balance traffic,” “fault tolerance”
AWS Lambda	Run code in response to events without managing servers	“Serverless,” “event-driven,” “short-running function”
Amazon ECS	Run containers using AWS container orchestration	“Docker containers,” “managed orchestration”
Amazon EKS	Run Kubernetes on AWS	“Kubernetes”
AWS Fargate	Run containers without managing servers	“Serverless containers”
AWS Elastic Beanstalk	Deploy applications without manually managing infrastructure	“Developer uploads code; AWS handles capacity/provisioning”
Amazon Lightsail	Simple VPS-style cloud hosting	“Simple website or small app with predictable bundle”
AWS Batch	Batch computing jobs	“Batch processing”

Notes and examples

EC2 purchasing options

Option	Best for	Common clue
On-Demand Instances	Flexible, short-term, unpredictable workloads	No long-term commitment
Reserved Instances	Steady-state usage with commitment	Predictable EC2 needs
Savings Plans	Flexible commitment-based savings	Commit to usage amount
Spot Instances	Fault-tolerant workloads that can be interrupted	Lowest-cost spare capacity use cases
Dedicated Hosts	Physical server dedicated to you	Licensing or compliance tied to physical host
Dedicated Instances	Instances on hardware dedicated to one customer	Isolation at hardware level, less license control than hosts

Trap: Spot Instances are attractive for cost, but not for workloads that cannot tolerate interruption.

Load balancers

Load balancer	Best fit
Application Load Balancer, ALB	HTTP/HTTPS, path-based or host-based routing
Network Load Balancer, NLB	Very high performance TCP/UDP/TLS traffic
Gateway Load Balancer, GWLB	Deploy and scale third-party virtual appliances

At CLF-C02 level, the most common distinction is ALB for web application routing and NLB for high-performance network traffic.

Analytics, AI/ML, and developer services

Analytics services

Service	Main purpose
Amazon Athena	Query data in S3 using SQL
AWS Glue	Data integration, ETL, data catalog
Amazon EMR	Big data processing frameworks
Amazon Kinesis	Real-time streaming data
Amazon OpenSearch Service	Search, log analytics, observability use cases
Amazon QuickSight	Business intelligence dashboards
Amazon Redshift	Data warehousing

Notes and examples

AI/ML service recognition

Service	Main purpose
Amazon SageMaker	Build, train, and deploy machine learning models
Amazon Bedrock	Build generative AI applications using foundation models
Amazon Comprehend	Natural language processing
Amazon Rekognition	Image and video analysis
Amazon Polly	Text to speech
Amazon Transcribe	Speech to text
Amazon Translate	Language translation
Amazon Lex	Conversational interfaces / chatbots
Amazon Textract	Extract text and data from documents
Amazon Kendra	Intelligent enterprise search

For CLF-C02, these are usually recognition questions. Do not over-study model training unless your practice results show a weakness.

Developer and deployment services

Service	Purpose
AWS CodeCommit	Source control repository service
AWS CodeBuild	Build and test code
AWS CodeDeploy	Automate code deployments
AWS CodePipeline	Continuous delivery pipeline
AWS Cloud9	Cloud-based IDE
Amazon ECR	Container image registry

Fast service-selection workflow

Use this quick mental workflow when a scenario lists several AWS services:

    flowchart TD
	    A[Read the scenario outcome] --> B{What category is needed?}
	    B -->|Compute| C{Server control needed?}
	    C -->|Yes| C1[Amazon EC2]
	    C -->|No, code only| C2[AWS Lambda]
	    C -->|Containers| C3[ECS/EKS or Fargate]
	    B -->|Storage| D{Object, block, or file?}
	    D -->|Object| D1[Amazon S3]
	    D -->|Block for EC2| D2[Amazon EBS]
	    D -->|Shared file| D3[Amazon EFS or FSx]
	    B -->|Database| E{Relational?}
	    E -->|Yes| E1[RDS or Aurora]
	    E -->|NoSQL key-value| E2[DynamoDB]
	    E -->|Warehouse| E3[Redshift]
	    B -->|Security or audit| F{Need logs, config, or identity?}
	    F -->|API activity| F1[CloudTrail]
	    F -->|Metrics and alarms| F2[CloudWatch]
	    F -->|Resource compliance| F3[Config]
	    F -->|Permissions| F4[IAM]

Quick review checklist

Before starting mock exams, make sure you can answer these without notes:

Cloud and architecture

Explain elasticity, scalability, high availability, and fault tolerance.
Identify why a company might choose cloud over on-premises infrastructure.
Choose between Region, Availability Zone, edge location, Local Zone, Wavelength, and Outposts.
Recognize the six AWS Well-Architected pillars.
Distinguish multi-AZ from multi-Region.

Notes and examples

Security

Apply the Shared Responsibility Model to EC2, RDS, S3, and Lambda.
Choose IAM roles instead of long-term credentials for AWS service access.
Explain least privilege, MFA, root user protection, and policy basics.
Choose between CloudTrail, CloudWatch, and Config.
Recognize GuardDuty, Inspector, Macie, Shield, WAF, KMS, Secrets Manager, ACM, and Artifact.

Technology and services

Choose EC2, Lambda, ECS/EKS, Fargate, Elastic Beanstalk, or Lightsail from scenario clues.
Choose S3, EBS, EFS, FSx, Storage Gateway, Backup, or Snow Family.
Choose RDS, Aurora, DynamoDB, Redshift, ElastiCache, Neptune, or DocumentDB.
Identify VPC components and security group vs network ACL differences.
Recognize Route 53, CloudFront, Direct Connect, VPN, Transit Gateway, and Global Accelerator.
Recognize SQS, SNS, EventBridge, Step Functions, and API Gateway.

Billing and support

Choose Pricing Calculator, Cost Explorer, Budgets, Cost and Usage Report, or Trusted Advisor.
Explain consolidated billing and AWS Organizations at a high level.
Understand cost allocation tags.
Recognize common pricing factors: compute, storage, requests, data transfer, Region, and support.
Know that support options vary and should be checked against current AWS documentation.

Final rapid reminders

Prefer managed services when the scenario values reduced operational burden.
Prefer IAM roles over embedded long-term credentials.
Prefer Multi-AZ for Availability Zone resilience.
Prefer CloudFront for global content delivery.
Prefer S3 for object storage and static assets.
Prefer RDS/Aurora for relational databases.
Prefer DynamoDB for serverless NoSQL key-value/document workloads.
Prefer CloudTrail for audit trails.
Prefer CloudWatch for metrics, logs, alarms, and dashboards.
Prefer AWS Budgets for alerts and Cost Explorer for cost analysis.
Always check whether the question asks for security, cost, availability, performance, or operational simplicity.

Your next practical step: use this Cheat Sheet as a checklist, then work through CLF-C02 topic drills and original practice questions with detailed explanations until the service-selection traps feel automatic.

Put the review into practice

Study Plan

CLF-C02 — AWS Certified Cloud Practitioner Cheat Sheet

High-Yield Mental Model

Core Cloud Concepts

Cloud Value Propositions

Cloud Deployment Models

Cloud Service Models

Core cloud advantages

Elasticity vs scalability

AWS Global Infrastructure

Region Selection Factors

Key infrastructure terms

Region selection decision points

Shared Responsibility Model

Shared Responsibility Traps

Shared Responsibility Model

Responsibility split

Service model changes the customer responsibility

Common shared responsibility traps

IAM and Access Control

Identity and Permission Objects

IAM Policy Logic

AWS Organizations and Account Governance

IAM essentials

IAM role vs IAM user

Policy evaluation basics

AWS Organizations and account governance

Security, Compliance, and Detection Services

Encryption Decision Points

Security service recognition table

CloudTrail vs CloudWatch vs Config

Encryption basics

Networking and Content Delivery

Security Group vs Network ACL

Load Balancer Selection

VPC basics

Security group vs network ACL

Connectivity services

Route 53 routing policy recognition

Compute and Containers

Compute Selection Traps

Storage

Storage Service Selection

Amazon S3 Essentials

S3 Storage Class Decision Points

Block vs File vs Object

Storage service selection

S3 essentials

S3 storage classes

EBS vs EFS vs S3

Databases and Analytics

Database Service Selection

Analytics and Data Services

Database Traps

Database selection table

RDS vs DynamoDB

Cache vs database

Application Integration and Messaging

Queue vs Pub/Sub vs Workflow

Serverless pattern recognition

SQS vs SNS vs EventBridge

Migration, Hybrid, and Transfer

Migration Strategy Terms

Migration service recognition

Snow Family quick distinction

Management, Monitoring, and Operations

CloudWatch vs CloudTrail vs Config

Operational service recognition

CloudFormation vs Elastic Beanstalk

Architecture and Well-Architected Concepts

AWS Well-Architected Pillars

Availability and Resilience Terms

Common Resilient Patterns

Six Well-Architected pillars

Architecture decision rules

High availability vs fault tolerance vs disaster recovery

AI, Machine Learning, and End-User Services

Pricing, Billing, and Cost Management

Pricing Fundamentals

Compute Pricing Options

Cost Tools