CLF-C02 — AWS Certified Cloud Practitioner Exam Blueprint

How to Use This Exam Blueprint

Use this checklist as a practical study map for the AWS Certified Cloud Practitioner (CLF-C02) exam from AWS. It is designed for final review and gap checking, not as a replacement for hands-on learning or official AWS documentation.

For each topic area, ask:

• Can I explain the concept in plain language?
• Can I choose the right AWS service for a simple business scenario?
• Can I identify what AWS manages versus what the customer manages?
• Can I recognize billing, support, security, and operational tradeoffs?
• Can I eliminate attractive but incorrect service choices?

Readiness for CLF-C02 is mostly about service awareness, cloud concepts, cost/security responsibility, and scenario judgment. You do not need to design complex architectures, but you should be able to recognize suitable AWS services and explain why they fit.

Topic-Area Readiness Table

Cloud Concepts and AWS Value

Core Concepts to Know

Can You Do This?

• Explain the difference between elasticity and scalability.
• Explain why cloud computing can reduce undifferentiated heavy lifting.
• Identify which workloads may benefit from managed services.
• Recognize when global infrastructure improves latency or resilience.
• Explain why overprovisioning and underprovisioning are cost and performance problems.
• Distinguish capital expense-style thinking from variable expense-style cloud consumption.
• Describe why automation is important in cloud operations.

Common Traps

AWS Global Infrastructure

What to Review

Scenario Cues

Shared Responsibility Model

Responsibility Classification

Can You Do This?

• Classify whether AWS or the customer manages physical data center security.
• Classify whether AWS or the customer manages IAM permissions.
• Classify whether AWS or the customer manages guest operating system patches on EC2.
• Explain why a managed database reduces operational responsibility compared with self-managed database software on EC2.
• Identify that customers are responsible for protecting their own data, credentials, and configurations.
• Recognize that responsibility changes depending on whether the service is infrastructure, platform, or software-oriented.

Common Trap

Do not answer “AWS” for every security question. In CLF-C02 scenarios, many correct answers involve the customer configuring IAM, encryption, network rules, logging, and account controls.

Identity, Access, and Account Security

IAM Essentials

Can You Do This?

• Explain why the root user should not be used for everyday work.
• Choose IAM roles for AWS services that need permissions.
• Identify least privilege as the preferred permissions approach.
• Recognize when MFA should be enabled.
• Distinguish authentication from authorization.
• Recognize that IAM policies are used to allow or deny actions.
• Explain why temporary credentials are generally safer than long-term static credentials.
• Identify AWS Organizations as a way to centrally manage multiple AWS accounts.

Service-to-Service Access Decision

Security, Compliance, and Governance Services

Security Service Map

Can You Do This?

• Match CloudTrail to API auditing.
• Match CloudWatch to metrics, alarms, and logs.
• Match AWS Config to resource configuration tracking.
• Match AWS WAF to web request filtering.
• Match AWS Shield to DDoS protection.
• Match KMS to encryption key management.
• Match Secrets Manager to secret storage and rotation.
• Match AWS Artifact to compliance reports and agreements.
• Explain the difference between encryption at rest and encryption in transit.
• Recognize that security groups are stateful traffic controls and network ACLs are subnet-level controls.

Compliance and Governance Decision Points

AWS Well-Architected and Architecture Awareness

Pillars to Review

Can You Do This?

• Explain why multiple Availability Zones can improve reliability.
• Recognize monitoring and automation as operational excellence practices.
• Explain how right-sizing supports cost optimization.
• Identify encryption, IAM, and logging as security practices.
• Recognize that managed services can improve operational efficiency.
• Identify backups and recovery planning as reliability practices.

Compute Services

Compute Service Selection

Can You Do This?

• Choose EC2 when the scenario requires server-level control.
• Choose Lambda for short, event-driven, serverless execution scenarios.
• Choose containers when the scenario emphasizes packaging and portability.
• Distinguish ECS from EKS at a high level.
• Recognize Fargate as a way to run containers without managing servers.
• Identify Auto Scaling as a capacity adjustment feature.
• Identify Elastic Load Balancing as traffic distribution.
• Recognize Elastic Beanstalk as a simplified application deployment service.

Common Compute Traps

Storage Services

Storage Types

Amazon S3 Readiness

Can You Do This?

• Choose Amazon S3 for durable object storage.
• Choose Amazon EBS for block storage attached to EC2.
• Choose Amazon EFS for shared file storage across Linux-based workloads.
• Recognize Amazon FSx for managed file systems with specific file-system compatibility needs.
• Identify archival storage classes for rarely accessed long-term data.
• Explain why lifecycle policies help manage storage cost.
• Recognize that S3 is not a traditional mounted block volume for an EC2 boot disk.
• Identify Snow Family for large data movement or edge use cases when network transfer is impractical.

Storage Scenario Cues

Database and Data Services

Database Service Map

Can You Do This?

• Choose RDS for managed relational databases.
• Choose Aurora when the question emphasizes an AWS-managed relational database option with cloud optimization.
• Choose DynamoDB for serverless NoSQL key-value/document access patterns.
• Choose Redshift for data warehousing and analytics.
• Choose ElastiCache for caching to reduce latency or database load.
• Recognize DMS for database migration.
• Distinguish transactional databases from analytical data warehouses.
• Recognize that managed database services reduce administrative work compared with self-managed databases on EC2.

Common Database Traps

Networking and Content Delivery

Core Networking Checklist

Can You Do This?

• Explain why private subnets are used for resources that should not be directly reachable from the internet.
• Match CloudFront to content delivery and caching at the edge.
• Match Route 53 to DNS.
• Match Direct Connect to dedicated connectivity.
• Match VPN to encrypted connectivity over the internet.
• Distinguish security groups from network ACLs at a basic level.
• Identify when a load balancer improves availability and traffic distribution.
• Recognize that VPC design affects security, routing, and connectivity.

Networking Decision Points

Monitoring, Logging, and Operations

Operations Service Map

Can You Do This?

• Choose CloudWatch for metrics, logs, dashboards, and alarms.
• Choose CloudTrail for auditing API calls.
• Choose AWS Config for configuration tracking and compliance evaluation.
• Choose AWS Health Dashboard for AWS service events affecting an account.
• Choose Trusted Advisor for best-practice recommendations.
• Recognize CloudFormation as infrastructure as code.
• Recognize Systems Manager as an operations management service.
• Explain why logs, metrics, and alarms are not the same thing.

CloudWatch vs CloudTrail vs Config

Billing, Pricing, and Cost Management

Pricing Concepts to Review

Cost Tool Map

Can You Do This?

• Explain the difference between on-demand and commitment-based pricing concepts.
• Identify AWS Budgets for cost alerts.
• Identify Cost Explorer for spend analysis.
• Identify Pricing Calculator for pre-deployment estimates.
• Explain why tagging helps cost allocation.
• Recognize that unused, oversized, or idle resources can waste money.
• Match storage classes to access frequency and cost optimization.
• Recognize that architecture choices can affect data transfer and cost.

Common Billing Traps

AWS Support, Documentation, and Account Help

Support and Guidance Sources

Can You Do This?

• Identify when a scenario needs AWS Support rather than community help.
• Recognize that support options vary by plan without memorizing exact fees.
• Match architectural review needs to AWS Well-Architected resources.
• Identify documentation as the source for service-specific implementation details.
• Recognize partner and professional services channels for migration or transformation help.

Migration, Hybrid, and Data Transfer

Migration Service Map

Can You Do This?

• Match DMS to database migration.
• Match Application Migration Service to server/application migration.
• Match Snow Family to large-scale physical transfer or edge scenarios.
• Match DataSync to online data movement.
• Match Storage Gateway to hybrid cloud storage integration.
• Recognize basic migration strategy terms such as rehost, replatform, and refactor at a high level.
• Explain why discovery and assessment matter before migration.

Analytics, AI, and Application Integration Awareness

Analytics and Data Processing

AI and Machine Learning Awareness

Application Integration

Can You Do This?

• Choose SQS when decoupling components with a queue.
• Choose SNS for publish/subscribe notifications.
• Choose EventBridge for event-driven routing.
• Choose Step Functions for orchestrating workflow steps.
• Choose API Gateway for managed API front doors.
• Choose Athena for querying data in S3.
• Choose QuickSight for dashboards.
• Choose SageMaker for ML model lifecycle tasks.
• Choose Bedrock for generative AI foundation model access scenarios.

Key Service Differentiation Checks

Frequently Confused Services

Scenario and Decision-Point Practice

Service Selection Prompts

Use these prompts to test whether you can identify the best-fit AWS service quickly.

Decision Flow: Monitoring, Audit, or Configuration?

    flowchart TD
	    A[Question asks about visibility] --> B{What kind of visibility?}
	    B --> C[Metrics, logs, alarms, dashboards]
	    B --> D[API calls and account activity]
	    B --> E[Resource configuration and compliance]
	    C --> F[Amazon CloudWatch]
	    D --> G[AWS CloudTrail]
	    E --> H[AWS Config]

Decision Flow: Compute Choice

    flowchart TD
	    A[Need to run workload] --> B{Need server OS control?}
	    B -->|Yes| C[Amazon EC2]
	    B -->|No| D{Event-driven function?}
	    D -->|Yes| E[AWS Lambda]
	    D -->|No| F{Container workload?}
	    F -->|Yes| G[ECS, EKS, or Fargate concept]
	    F -->|No| H{Simple app deployment?}
	    H -->|Yes| I[AWS Elastic Beanstalk]
	    H -->|No| J[Consider managed service fit]

Artifact and Console-Concept Checks

You do not need deep administrator-level implementation for CLF-C02, but you should recognize common AWS artifacts and console concepts.

IAM Policy Recognition

If you see a simple IAM policy, be able to identify:

• Whether it allows or denies actions.
• Which service actions are referenced.
• Which resources are affected.
• Whether permissions appear broad or least-privilege.
• That explicit deny takes precedence conceptually.

High-Value “Can You Do This?” Checklist

Use this as a final readiness checkpoint.

Cloud and Architecture

• Explain AWS Regions, Availability Zones, and edge locations.
• Match high availability to multi-AZ concepts.
• Match global content delivery to CloudFront.
• Explain the purpose of the AWS Well-Architected pillars.
• Identify basic benefits of managed services.
• Recognize when serverless reduces infrastructure management.
• Distinguish elasticity, scalability, and fault tolerance.

Security

• Explain the shared responsibility model.
• Protect the root user with MFA and avoid daily use.
• Apply least privilege to IAM permissions.
• Choose IAM roles for AWS service access.
• Match CloudTrail, Config, GuardDuty, Security Hub, WAF, Shield, KMS, and Secrets Manager to their use cases.
• Identify encryption at rest and in transit scenarios.
• Recognize compliance evidence use cases for AWS Artifact.
• Understand centralized multi-account governance with AWS Organizations.

Technology and Services

• Choose EC2, Lambda, containers, or Elastic Beanstalk for basic compute scenarios.
• Choose S3, EBS, EFS, FSx, or archival storage for storage scenarios.
• Choose RDS, Aurora, DynamoDB, Redshift, or ElastiCache for database scenarios.
• Choose VPC, Route 53, CloudFront, VPN, or Direct Connect for networking scenarios.
• Choose SQS, SNS, EventBridge, Step Functions, and API Gateway for integration scenarios.
• Choose Athena, Glue, Kinesis, QuickSight, and Redshift for analytics scenarios.
• Recognize SageMaker and Bedrock use cases at a high level.
• Identify CloudFormation as infrastructure as code.

Billing and Support

• Explain pay-as-you-go pricing.
• Distinguish On-Demand, Reserved Instance concepts, Savings Plans, and Spot Instance concepts.
• Use Budgets for alerts and Cost Explorer for analysis.
• Use Pricing Calculator for estimates.
• Explain how tags help cost allocation.
• Recognize consolidated billing through AWS Organizations.
• Identify AWS Support, documentation, re:Post, and Well-Architected guidance sources.
• Recognize Trusted Advisor recommendation categories at a high level.

Common Weak Areas and Traps

Final-Week Review Checklist

Seven to Five Days Before

• Review this checklist once without notes and mark weak areas.
• Build a one-page service map for compute, storage, database, networking, security, monitoring, and cost tools.
• Revisit shared responsibility examples for EC2, S3, RDS, and managed services.
• Drill CloudWatch vs CloudTrail vs Config until the difference is automatic.
• Practice service-selection questions under time pressure.
• Review AWS pricing and billing tools.
• Review IAM root user, users, groups, roles, policies, and MFA.

Four to Two Days Before

• Take a mixed practice set covering all major topic areas.
• For every missed question, write the missed service and the correct scenario cue.
• Recheck frequently confused pairs.
• Review Well-Architected pillar names and practical meanings.
• Review AWS Support, AWS Artifact, Organizations, Trusted Advisor, and migration tools.
• Practice eliminating distractors based on keywords such as “serverless,” “relational,” “audit,” “DNS,” “estimate,” and “alert.”

Day Before

• Do a light pass through service maps and weak-area notes.
• Avoid cramming obscure limits or pricing numbers.
• Rehearse the main decision points: compute, storage, database, monitoring, security, and cost.
• Confirm you can explain shared responsibility in your own words.
• Rest and keep review focused on recognition and scenario judgment.

Final Readiness Self-Assessment

Practical Next Step

After reviewing the checklist, take a mixed set of original CLF-C02-style practice questions and tag every miss by topic area: cloud concepts, security, technology, billing, or support. Then return to the specific rows above until you can explain both the correct answer and why the distractors are wrong.