Exam Identity and Study Focus
| Item | Reference |
|---|
| Vendor/provider | AWS |
| Official exam title | AWS Certified Cloud Practitioner (CLF-C02) |
| Official exam code | CLF-C02 |
| Candidate level | Foundational AWS cloud knowledge |
| Best use of this page | Fast recall of service purpose, security responsibilities, pricing concepts, and common exam decision points |
The AWS Certified Cloud Practitioner (CLF-C02) exam is broad rather than deep. Expect questions that test whether you can identify the right AWS service, explain shared responsibility, recognize basic architecture patterns, and understand cost, support, and governance concepts.
High-Yield Mental Model
| If the question asks about… | Think first |
|---|
| “Who is responsible?” | AWS Shared Responsibility Model |
| “Reduce capital expense” | Cloud value proposition: variable expense, pay as you go |
| “Scale automatically” | Elasticity, Auto Scaling, managed services, serverless |
| “Global low latency” | Regions, Availability Zones, edge locations, Amazon CloudFront, Route 53 |
| “Secure access” | IAM, MFA, least privilege, roles, policies |
| “Audit API activity” | AWS CloudTrail |
| “Monitor metrics and alarms” | Amazon CloudWatch |
| “Evaluate resource configuration” | AWS Config |
| “Cost visibility” | AWS Cost Explorer, AWS Budgets, Cost and Usage Report |
| “Estimate before deploying” | AWS Pricing Calculator |
| “Object storage” | Amazon S3 |
| “Managed relational database” | Amazon RDS or Amazon Aurora |
| “NoSQL key-value database” | Amazon DynamoDB |
| “Run code without servers” | AWS Lambda |
| “Private network in AWS” | Amazon VPC |
Core Cloud Concepts
Cloud Value Propositions
| Concept | Exam meaning | Common trap |
|---|
| Pay-as-you-go | Pay for resources consumed instead of large upfront purchases | Not always cheapest if resources are left running |
| Elasticity | Automatically add/remove capacity based on demand | Elasticity is dynamic; scalability can be planned or manual |
| Agility | Provision resources quickly and experiment faster | Agility is not the same as weak governance |
| Global reach | Deploy near users using AWS global infrastructure | Multi-Region designs add complexity and cost |
| Economies of scale | AWS aggregates demand and can offer broad services/pricing models | Does not remove customer cost management responsibility |
| High availability | Design to remain available during component failure | Single EC2 instance is not highly available by itself |
| Fault tolerance | Continue operating through failures | Usually requires redundancy and automated failover |
Cloud Deployment Models
| Model | Description | Choose when |
|---|
| Cloud | Resources run in AWS | Need elasticity, managed services, global reach |
| On premises | Resources run in customer data centers | Existing constraints, legacy systems, or local control |
| Hybrid | Combines AWS and on premises | Migration, latency, compliance, or gradual modernization |
| Multi-cloud | Uses multiple cloud providers | Vendor diversification, specialized services, organizational strategy |
Cloud Service Models
| Model | Customer manages more | AWS/vendor manages more | Examples |
|---|
| IaaS | OS, applications, patches, data | Facilities, hardware, virtualization | Amazon EC2 |
| PaaS | Application code and data | Runtime, scaling, platform operations | AWS Elastic Beanstalk, Amazon RDS |
| SaaS | Usage and configuration | Application and infrastructure | AWS Marketplace SaaS products, many business apps |
| Serverless | Code/configuration and data | Servers, scaling, high availability | AWS Lambda, Amazon S3, Amazon DynamoDB |
AWS Global Infrastructure
| Component | What it is | Exam signal |
|---|
| Region | Geographic area containing multiple Availability Zones | Choose Region for latency, compliance, service availability, cost |
| Availability Zone | One or more isolated data centers in a Region | Use multiple AZs for high availability |
| Edge location | Site used by edge services | CloudFront, Route 53, AWS Global Accelerator |
| Local Zone | Infrastructure closer to large population/industry centers | Ultra-low latency applications near a city |
| AWS Wavelength | AWS infrastructure embedded in 5G networks | Ultra-low latency mobile/5G applications |
| AWS Outposts | AWS infrastructure installed on premises | Hybrid workloads needing local processing with AWS services |
| Regional edge cache | CloudFront caching layer between edge locations and origins | Improves content delivery efficiency |
Region Selection Factors
| Factor | Why it matters |
|---|
| Latency | Place workloads near users or systems |
| Compliance/data residency | Some workloads must remain in specific jurisdictions |
| Service availability | Not all AWS services/features are available in every Region |
| Cost | Pricing can vary by Region |
| Fault isolation | Multi-Region architecture can improve resilience for critical systems |
Shared Responsibility Model
| Area | AWS responsibility | Customer responsibility |
|---|
| Physical data centers | Facilities, power, cooling, physical security | None for AWS facilities |
| Hardware and networking infrastructure | Host hardware, storage hardware, network infrastructure | Use services securely |
| Virtualization layer | Hypervisor and foundational service infrastructure | Guest OS hardening where applicable |
| Amazon EC2 | Infrastructure under EC2 | OS patches, security groups, applications, data |
| Managed databases | Underlying infrastructure and managed database platform tasks | Data, access control, network access, configuration choices |
| Amazon S3 | Service durability and infrastructure | Bucket policies, encryption settings, object access, data classification |
| AWS Lambda | Runtime infrastructure and scaling platform | Function code, IAM permissions, event sources, data |
| IAM | Provides identity service | Users, roles, policies, MFA, least privilege |
| Data | Secure storage capabilities | Data classification, encryption choices, access permissions, retention |
Shared Responsibility Traps
| Statement | Correct exam interpretation |
|---|
| “AWS secures everything in the cloud.” | AWS secures the cloud; customers secure what they put in the cloud. |
| “AWS patches my EC2 operating system.” | Customer is responsible for guest OS patching on EC2. |
| “S3 is secure by default, so no customer action is needed.” | Customers still manage bucket access, policies, encryption choices, and data. |
| “Managed services remove all security work.” | They reduce operational burden but do not remove access, data, and configuration responsibility. |
| “Compliance is fully outsourced to AWS.” | AWS provides compliant infrastructure and reports; customers must build compliant workloads. |
IAM and Access Control
Identity and Permission Objects
| IAM concept | Purpose | Exam cue |
|---|
| Root user | Original account identity with full access | Lock down, enable MFA, avoid routine use |
| IAM user | Long-term identity for a person or workload | Prefer roles/federation where possible |
| IAM group | Collection of IAM users | Assign common permissions to users |
| IAM role | Assumable identity with temporary credentials | Use for AWS services, cross-account access, federation |
| IAM policy | JSON permissions document | Defines allowed/denied actions and resources |
| Permissions boundary | Maximum permissions an identity-based policy can grant | Delegate administration safely |
| Resource-based policy | Policy attached to resource | S3 bucket policies, KMS key policies, SQS policies |
| Access key | Long-term programmatic credential | Rotate and avoid embedding in code |
| MFA | Additional authentication factor | Strongly associated with root and privileged access |
IAM Policy Logic
| Rule | Exam relevance |
|---|
| Default is implicit deny | No permission means no access |
| Explicit allow grants access | Unless another policy explicitly denies it |
| Explicit deny wins | Overrides allows |
| Least privilege | Grant only required actions/resources |
| Temporary credentials are preferred | Roles reduce long-term credential risk |
AWS Organizations and Account Governance
| Service/feature | Use for | Distinction |
|---|
| AWS Organizations | Centrally manage multiple AWS accounts | Consolidated billing and account grouping |
| Organizational unit | Group accounts | Apply governance by environment, team, or business unit |
| Service control policy | Set maximum permissions for accounts/OUs | SCPs do not grant permissions by themselves |
| Consolidated billing | Single bill across accounts | Can help aggregate usage for pricing benefits |
| AWS Control Tower | Set up and govern multi-account AWS environments | Landing zone and guardrails |
| IAM Identity Center | Workforce access to multiple AWS accounts/apps | Centralized sign-in and permission sets |
Security, Compliance, and Detection Services
| Service | Primary purpose | Choose when the question says… |
|---|
| AWS IAM | Identity and access permissions | Users, roles, policies, least privilege |
| AWS IAM Identity Center | Central workforce access | SSO to AWS accounts and applications |
| AWS Key Management Service | Create/manage encryption keys | Centralized key management |
| AWS CloudHSM | Dedicated hardware security modules | Customer-managed HSM requirements |
| AWS Secrets Manager | Store, retrieve, rotate secrets | Database passwords, API keys, automatic rotation |
| AWS Systems Manager Parameter Store | Store configuration and secrets | Hierarchical parameters, app config values |
| AWS Certificate Manager | Provision/manage TLS certificates | HTTPS certificates for AWS-integrated services |
| AWS WAF | Filter web requests | SQL injection, cross-site scripting, web ACLs |
| AWS Shield | DDoS protection | Protect against distributed denial-of-service attacks |
| AWS Firewall Manager | Centrally manage firewall rules | Multi-account WAF/security policy administration |
| Amazon GuardDuty | Threat detection | Suspicious activity, malicious IPs, anomalous behavior |
| Amazon Inspector | Vulnerability management | Scan EC2, container images, Lambda functions |
| Amazon Macie | Discover sensitive data in S3 | PII/sensitive data classification |
| AWS Security Hub | Central security findings | Aggregate and prioritize findings |
| AWS CloudTrail | Record API activity | Who did what, when, from where |
| AWS Config | Track resource configuration/compliance | Configuration history and rules |
| AWS Artifact | Access compliance reports/agreements | Download AWS compliance documentation |
| AWS Audit Manager | Automate evidence collection | Audit preparation and control mapping |
| Amazon Detective | Investigate security findings | Analyze relationships and event context |
Encryption Decision Points
| Requirement | AWS service/feature |
|---|
| Encrypt S3 objects at rest | S3 server-side encryption options |
| Manage encryption keys centrally | AWS KMS |
| Dedicated HSM control | AWS CloudHSM |
| Encrypt data in transit | TLS, AWS Certificate Manager |
| Rotate database credentials | AWS Secrets Manager |
| Protect public web app from common exploits | AWS WAF |
| Detect suspicious account activity | Amazon GuardDuty |
| Track configuration drift | AWS Config |
Networking and Content Delivery
| Service/concept | Purpose | Exam cue |
|---|
| Amazon VPC | Isolated virtual network in AWS | Subnets, route tables, security controls |
| Subnet | Segment of a VPC in one Availability Zone | Public or private placement |
| Route table | Controls traffic routing | Determines where subnet traffic goes |
| Internet gateway | Allows VPC resources to access internet directly | Public subnet internet connectivity |
| NAT gateway | Allows private subnet outbound internet access | Instances download updates without inbound exposure |
| Security group | Stateful instance-level virtual firewall | Allow rules, attached to ENIs/resources |
| Network ACL | Stateless subnet-level firewall | Allow and deny rules at subnet boundary |
| VPC peering | Connect two VPCs privately | Simple VPC-to-VPC connectivity |
| AWS Transit Gateway | Hub for many VPC/on-prem networks | Scalable network connectivity |
| AWS Direct Connect | Dedicated private connection to AWS | Consistent private network connectivity |
| AWS Site-to-Site VPN | Encrypted connection over internet | Quick hybrid connectivity |
| AWS Client VPN | Remote user VPN access | Users connect securely to AWS/on-prem |
| Amazon Route 53 | DNS and domain routing | Domain names, DNS records, routing policies |
| Amazon CloudFront | Content delivery network | Cache content at edge locations |
| AWS Global Accelerator | Improve global app availability/performance | Anycast static IPs, route to healthy endpoints |
| Elastic Load Balancing | Distribute traffic | ALB, NLB, Gateway Load Balancer |
Security Group vs Network ACL
| Feature | Security group | Network ACL |
|---|
| Scope | Resource/network interface level | Subnet level |
| State | Stateful | Stateless |
| Rules | Allow rules only | Allow and deny rules |
| Return traffic | Automatically allowed | Must be explicitly allowed |
| Common use | Instance/application access control | Broad subnet traffic filtering |
Load Balancer Selection
| Load balancer | Best fit |
|---|
| Application Load Balancer | HTTP/HTTPS, path/host-based routing, web applications |
| Network Load Balancer | Very high performance TCP/UDP/TLS traffic |
| Gateway Load Balancer | Deploy and scale third-party virtual appliances |
Compute and Containers
| Service | What it does | Choose when |
|---|
| Amazon EC2 | Virtual servers | Need OS-level control or custom compute environment |
| Amazon EC2 Auto Scaling | Adjust EC2 capacity | Match demand and improve availability |
| Elastic Load Balancing | Distribute traffic | Avoid single-server bottlenecks |
| AWS Lambda | Run code without managing servers | Event-driven, short-running, serverless workloads |
| AWS Elastic Beanstalk | Deploy apps with managed platform | Want easy deployment but retain underlying resource visibility |
| Amazon Lightsail | Simplified VPS bundles | Simple websites/apps with predictable setup |
| Amazon ECS | Run containers | AWS-native container orchestration |
| Amazon EKS | Managed Kubernetes | Need Kubernetes ecosystem/API compatibility |
| AWS Fargate | Serverless container compute | Run containers without managing EC2 instances |
| AWS Batch | Batch computing jobs | Large-scale batch processing |
| VMware Cloud on AWS | VMware workloads on AWS | Extend/migrate VMware environments |
Compute Selection Traps
| Requirement | Better answer | Why |
|---|
| “No server management” | Lambda or Fargate | EC2 still requires instance management |
| “Full control of operating system” | EC2 | Lambda/Fargate abstract infrastructure |
| “Kubernetes” | EKS | ECS is not Kubernetes |
| “Simple app deployment without choosing every resource” | Elastic Beanstalk | Higher-level app platform |
| “Container orchestration with AWS-native service” | ECS | Simpler AWS-native container service |
| “Run containers without managing instances” | Fargate | Serverless compute for ECS/EKS |
Storage
Storage Service Selection
| Service | Storage type | Choose when |
|---|
| Amazon S3 | Object storage | Durable object storage, static assets, backups, data lakes |
| Amazon S3 Glacier storage classes | Archive object storage | Long-term, low-cost archival with retrieval tradeoffs |
| Amazon EBS | Block storage | Persistent volumes for EC2 |
| EC2 instance store | Temporary block storage | Ephemeral high-performance local storage |
| Amazon EFS | Managed file storage | Shared Linux file system across multiple compute resources |
| Amazon FSx for Windows File Server | Managed Windows file storage | SMB/Windows-based workloads |
| Amazon FSx for Lustre | High-performance file system | HPC, ML, high-throughput workloads |
| AWS Storage Gateway | Hybrid cloud storage | Connect on-prem apps to AWS storage |
| AWS Backup | Centralized backup management | Backup policies across AWS services |
| AWS Snow Family | Physical data transfer/edge compute | Large data migration or disconnected edge locations |
Amazon S3 Essentials
| Feature | Exam meaning |
|---|
| Bucket | Top-level container for objects |
| Object | File plus metadata stored in S3 |
| Key | Object name/path identifier |
| Versioning | Keep multiple versions of objects |
| Lifecycle policy | Transition or expire objects automatically |
| S3 Object Lock | Help prevent object deletion/modification for retention scenarios |
| Static website hosting | Serve static web content from S3 |
| Event notifications | Trigger workflows from object events |
| Cross-Region Replication | Replicate objects to another Region |
| Bucket policy | Resource-based access policy |
| Block Public Access | Controls public access settings |
S3 Storage Class Decision Points
| Storage class family | Use when |
|---|
| S3 Standard | Frequently accessed data |
| S3 Intelligent-Tiering | Unknown or changing access patterns |
| S3 Standard-IA | Infrequently accessed but rapidly needed data |
| S3 One Zone-IA | Infrequent access and lower resilience requirement |
| S3 Glacier Instant Retrieval | Archive data needing immediate retrieval |
| S3 Glacier Flexible Retrieval | Archive data with flexible retrieval times |
| S3 Glacier Deep Archive | Lowest-cost long-term archive with slow retrieval tolerance |
Block vs File vs Object
| Need | Choose |
|---|
| Attach storage volume to EC2 like a disk | Amazon EBS |
| Share file system across Linux workloads | Amazon EFS |
| Store objects accessed by key/API | Amazon S3 |
| Temporary local storage tied to instance lifecycle | EC2 instance store |
| Windows shared file storage | Amazon FSx for Windows File Server |
Databases and Analytics
Database Service Selection
| Service | Database type | Choose when |
|---|
| Amazon RDS | Managed relational database | SQL database with managed backups, patching, Multi-AZ options |
| Amazon Aurora | AWS-optimized relational database | High performance relational workload compatible with MySQL/PostgreSQL |
| Amazon DynamoDB | Serverless NoSQL key-value/document | Low-latency, scalable, non-relational access patterns |
| Amazon Redshift | Data warehouse | Analytics across large structured datasets |
| Amazon ElastiCache | In-memory cache | Speed up reads, session stores, caching |
| Amazon Neptune | Graph database | Highly connected data, relationships |
| Amazon DocumentDB | Document database | MongoDB-compatible document workloads |
| Amazon Keyspaces | Wide-column database | Apache Cassandra-compatible workloads |
| Amazon Timestream | Time series database | IoT, telemetry, time-stamped metrics |
| Amazon QLDB | Ledger database | Immutable, cryptographically verifiable transaction log |
Analytics and Data Services
| Service | Purpose | Exam cue |
|---|
| Amazon Athena | Query data in S3 using SQL | Serverless ad hoc analysis |
| AWS Glue | Data catalog and ETL | Prepare, catalog, transform data |
| Amazon EMR | Big data frameworks | Spark, Hadoop, distributed processing |
| Amazon Kinesis | Streaming data | Real-time ingestion and processing |
| Amazon Data Firehose | Load streaming data to destinations | Delivery stream to S3/Redshift/OpenSearch/etc. |
| Amazon OpenSearch Service | Search and log analytics | Full-text search, observability analytics |
| Amazon QuickSight | Business intelligence dashboards | Visualize and share BI insights |
| AWS Lake Formation | Build/manage data lakes | Governed data lake setup |
Database Traps
| Scenario | Correct service | Avoid confusing with |
|---|
| Need relational SQL database | RDS/Aurora | DynamoDB |
| Need serverless NoSQL at scale | DynamoDB | RDS |
| Need data warehouse analytics | Redshift | RDS transactional database |
| Need cache to reduce database load | ElastiCache | EBS/EFS |
| Need query files directly in S3 | Athena | Redshift |
| Need graph relationships | Neptune | DynamoDB |
Application Integration and Messaging
| Service | Purpose | Choose when |
|---|
| Amazon SQS | Message queues | Decouple components with reliable queueing |
| Amazon SNS | Pub/sub notifications | Fan-out messages to subscribers |
| Amazon EventBridge | Event bus | Event-driven integration across AWS/SaaS/custom apps |
| AWS Step Functions | Workflow orchestration | Coordinate multi-step processes |
| Amazon API Gateway | Create/manage APIs | Front door for APIs, often with Lambda |
| AWS AppSync | Managed GraphQL APIs | GraphQL and real-time data sync |
| Amazon MQ | Managed message broker | Migrate apps using brokers like ActiveMQ/RabbitMQ |
| AWS AppConfig | Manage application configuration | Deploy config changes safely |
| AWS Simple Email Service | Email sending/receiving | Application email use cases |
Queue vs Pub/Sub vs Workflow
| Need | Service |
|---|
| One component sends work to be processed later | Amazon SQS |
| One message should notify many subscribers | Amazon SNS |
| Route events from many sources to many targets | Amazon EventBridge |
| Coordinate steps with retries/branches/state | AWS Step Functions |
Migration, Hybrid, and Transfer
| Service/framework | Purpose | Exam cue |
|---|
| AWS Cloud Adoption Framework | Guidance for cloud adoption | Business, people, governance, platform, security, operations perspectives |
| AWS Migration Hub | Track migrations | Central place to monitor migration progress |
| AWS Application Discovery Service | Discover on-prem workloads | Inventory and dependency mapping |
| AWS Application Migration Service | Lift-and-shift server migration | Rehost applications to AWS |
| AWS Database Migration Service | Migrate databases | Homogeneous or heterogeneous database migration |
| AWS Schema Conversion Tool | Convert database schemas | Heterogeneous database migrations |
| AWS DataSync | Online data transfer | Move data between on-prem, AWS storage, and other locations |
| AWS Transfer Family | Managed SFTP/FTPS/FTP | File transfer into/out of AWS storage |
| AWS Snowcone | Small rugged edge/data transfer device | Edge collection or smaller transfer jobs |
| AWS Snowball Edge | Physical data transfer and edge compute | Large migrations or remote processing |
| AWS Snowmobile | Exabyte-scale physical transfer | Extremely large data center migrations |
| AWS Storage Gateway | Hybrid storage integration | On-prem apps using cloud-backed storage |
Migration Strategy Terms
| Strategy | Meaning |
|---|
| Rehost | Lift and shift with minimal change |
| Replatform | Make some optimizations without major architecture change |
| Refactor/re-architect | Redesign application to use cloud-native patterns |
| Repurchase | Move to a different product, often SaaS |
| Retain | Keep workload as is for now |
| Retire | Decommission no-longer-needed workload |
| Relocate | Move infrastructure-level platform with minimal application change |
Management, Monitoring, and Operations
| Service | Primary purpose | Choose when |
|---|
| Amazon CloudWatch | Metrics, logs, alarms, dashboards | Monitor performance and trigger alarms |
| AWS CloudTrail | API activity logging | Audit actions in AWS accounts |
| AWS Config | Resource inventory/config history/rules | Track compliance and configuration changes |
| AWS Systems Manager | Operate/manage resources | Patch, run commands, inventory, automation |
| AWS Health | AWS service events affecting you | Service health and account-specific events |
| AWS Trusted Advisor | Best-practice checks | Cost, security, fault tolerance, performance, service limits guidance |
| AWS Well-Architected Tool | Review workloads | Assess architecture against best practices |
| AWS Service Catalog | Approved product portfolios | Standardized self-service provisioning |
| AWS License Manager | Manage software licenses | Track license usage |
| AWS Managed Services | AWS-operated infrastructure management | Operational management for AWS environments |
| AWS Proton | Manage infrastructure for containers/serverless | Platform templates for app teams |
CloudWatch vs CloudTrail vs Config
| Need | Service |
|---|
| “CPU is high; alert operations” | CloudWatch |
| “Who deleted this bucket?” | CloudTrail |
| “Was this security group open to the internet last week?” | AWS Config |
| “Run a command or patch managed instances” | Systems Manager |
| “AWS service issue affects my account” | AWS Health |
Architecture and Well-Architected Concepts
AWS Well-Architected Pillars
| Pillar | Focus | Exam examples |
|---|
| Operational excellence | Run and improve systems | Automation, monitoring, small reversible changes |
| Security | Protect data, systems, assets | IAM, encryption, detection, incident response |
| Reliability | Recover from failures | Multi-AZ, backups, auto recovery, testing |
| Performance efficiency | Use resources efficiently | Right service, scalable architecture, modern instance types |
| Cost optimization | Avoid unnecessary cost | Right sizing, pricing models, budgets |
| Sustainability | Minimize environmental impact | Efficient utilization, managed services, optimized demand |
Availability and Resilience Terms
| Term | Meaning |
|---|
| High availability | System remains accessible despite some failures |
| Fault tolerance | System continues operating with minimal interruption after failures |
| Disaster recovery | Strategy to restore service after major disruption |
| Backup | Copy of data for recovery |
| Recovery Time Objective | Target time to restore service |
| Recovery Point Objective | Maximum acceptable data loss measured in time |
| Horizontal scaling | Add more instances/resources |
| Vertical scaling | Increase size/capacity of a resource |
| Loose coupling | Components depend on each other minimally |
| Stateless design | Instances do not store required session state locally |
Common Resilient Patterns
| Requirement | AWS pattern |
|---|
| Survive instance failure | Auto Scaling group across multiple AZs |
| Distribute web traffic | Elastic Load Balancing |
| Store durable static assets | Amazon S3 |
| Decouple app components | SQS, SNS, EventBridge |
| Recover relational database from AZ failure | RDS Multi-AZ deployment |
| Improve global content performance | CloudFront |
| Protect against accidental deletion | Backups, versioning, lifecycle/retention controls |
| Reduce single points of failure | Multi-AZ architecture and managed services |
AI, Machine Learning, and End-User Services
| Service | Purpose | Exam cue |
|---|
| Amazon SageMaker | Build, train, deploy ML models | Custom ML lifecycle |
| Amazon Bedrock | Build generative AI applications with foundation models | GenAI without managing foundation model infrastructure |
| Amazon Comprehend | Natural language processing | Sentiment, entities, key phrases |
| Amazon Lex | Conversational chatbots | Voice/text bots |
| Amazon Polly | Text to speech | Convert text into lifelike speech |
| Amazon Rekognition | Image/video analysis | Detect labels, faces, moderation |
| Amazon Textract | Extract text/data from documents | Forms, tables, scanned documents |
| Amazon Transcribe | Speech to text | Audio transcription |
| Amazon Translate | Language translation | Translate text |
| Amazon Kendra | Enterprise search | Intelligent search over business content |
| Amazon Personalize | Recommendations | Personalization and recommendations |
| Amazon Connect | Cloud contact center | Customer service/contact center |
| Amazon WorkSpaces | Virtual desktops | Desktop-as-a-service |
| Amazon AppStream 2.0 | Application streaming | Stream desktop applications to users |
Pricing, Billing, and Cost Management
Pricing Fundamentals
| Concept | Meaning |
|---|
| Pay for what you use | Usage-based pricing for many services |
| No long-term commitment required | On-Demand options are available for many services |
| Pay less with commitment | Savings Plans and Reserved Instances can reduce cost for steady usage |
| Pay less with spare capacity | Spot can reduce cost for interruptible workloads |
| Data transfer matters | Data movement can affect cost depending on direction and service |
| Managed services may reduce operational cost | Higher service price can be offset by lower administration effort |
Compute Pricing Options
| Option | Best fit | Trap |
|---|
| On-Demand | Flexible, unpredictable, short-term workloads | Usually not the lowest cost for steady long-running usage |
| Savings Plans | Commitment to usage for reduced compute cost | Applies based on eligible usage and plan type |
| Reserved Instances | Predictable EC2/RDS-style capacity needs | Less flexible than pure On-Demand |
| Spot Instances | Fault-tolerant, interruptible workloads | Can be interrupted; not ideal for critical persistent workloads |
| Dedicated Hosts | Physical server dedicated to your use | Often chosen for licensing/compliance needs |
| Dedicated Instances | Instances run on hardware dedicated to one customer | Less license-control detail than Dedicated Hosts |
| Tool | Use for |
|---|
| AWS Pricing Calculator | Estimate cost before deployment |
| AWS Cost Explorer | Visualize and analyze historical spend/usage |
| AWS Budgets | Set budget thresholds and alerts |
| AWS Cost and Usage Report | Detailed billing data for analysis |
| AWS Cost Anomaly Detection | Detect unusual spend patterns |
| AWS Billing dashboard | View bills and account charges |
| AWS Marketplace | Find third-party software/services |
| AWS Compute Optimizer | Rightsizing recommendations for supported resources |
| AWS Trusted Advisor | Cost optimization and best-practice checks |
Cost Optimization Decision Points
| Requirement | Likely answer |
|---|
| Alert when monthly cost exceeds threshold | AWS Budgets |
| Estimate cost of planned architecture | AWS Pricing Calculator |
| Analyze past spending trends | AWS Cost Explorer |
| Get detailed raw billing data | Cost and Usage Report |
| Detect unexpected spend spike | Cost Anomaly Detection |
| Reduce cost of steady compute usage | Savings Plans or Reserved Instances |
| Use spare capacity for batch jobs | Spot Instances |
| Reduce storage cost over time | S3 lifecycle policies and storage classes |
| Identify idle/underused resources | Trusted Advisor, Compute Optimizer, Cost Explorer |
AWS Support and Documentation Resources
| Resource | Purpose | Exam cue |
|---|
| AWS Support plans | Technical support options by plan level | Need access to AWS support engineers or advanced support features |
| Basic support | Account and billing support plus core resources | Included support baseline |
| Developer support | Early development/test support | Individual developer guidance |
| Business support | Production workload support | Production systems and broader technical support |
| Enterprise On-Ramp support | Production/business-critical support with enhanced guidance | Organizations needing stronger support than Business |
| Enterprise support | Mission-critical support relationship | Highest-touch support and account guidance |
| AWS re:Post | Community and expert Q&A | Public AWS technical knowledge |
| AWS Documentation | Official service instructions | Service behavior and configuration guidance |
| AWS Whitepapers | Architecture and best-practice guidance | Conceptual guidance and frameworks |
| AWS Skill Builder | AWS training resource | Learning paths and courses |
| AWS Professional Services | Advisory/implementation help | Paid expert assistance |
| AWS Partner Network | AWS partners | Find consulting/technology partners |
| Technical Account Manager | Enterprise-level guidance role | Ongoing technical guidance for eligible support plans |
For the exam, avoid memorizing exact support response times unless your official study materials explicitly require them. Focus on which support level is appropriate for developer, production, business-critical, and enterprise needs.
Compliance and Governance
| Concept/service | Exam relevance |
|---|
| AWS Artifact | Retrieve AWS compliance reports and agreements |
| AWS Config | Evaluate resources against rules |
| AWS CloudTrail | Audit account activity |
| AWS Organizations | Multi-account governance |
| Service control policies | Permission guardrails across accounts/OUs |
| AWS Control Tower | Governed multi-account landing zone |
| AWS Security Hub | Consolidated security posture |
| AWS Audit Manager | Evidence collection for audits |
| Data residency | Customer chooses Regions and architecture to meet requirements |
| Compliance inheritance | Customers can inherit controls from AWS infrastructure, but remain responsible for their workloads |
Common Exam Traps
| Trap | Correct thinking |
|---|
| Confusing CloudWatch and CloudTrail | CloudWatch monitors metrics/logs; CloudTrail records API activity |
| Confusing AWS Config and CloudTrail | Config tracks resource configuration; CloudTrail tracks actions |
| Assuming an IAM role is the same as a user | Roles are assumed and use temporary credentials |
| Thinking SCPs grant permissions | SCPs set maximum permissions; IAM still grants access |
| Choosing EC2 for every compute question | Managed/serverless services may be better if server management is not needed |
| Choosing EBS for shared file storage | EFS/FSx are file services; EBS is block storage for instances |
| Choosing RDS for any database | DynamoDB, Redshift, Neptune, and others fit different patterns |
| Using NAT gateway for inbound internet access | NAT gateway is for outbound access from private subnets |
| Treating security groups as stateless | Security groups are stateful |
| Treating NACLs as stateful | NACLs are stateless |
| Assuming Multi-AZ means Multi-Region | Multi-AZ is within one Region |
| Assuming S3 is a file system | S3 is object storage |
| Confusing elasticity and high availability | Elasticity adjusts capacity; HA maintains availability |
| Confusing AWS Marketplace and Service Catalog | Marketplace sells software/services; Service Catalog provides approved internal portfolios |
| Assuming Free Tier means no cost risk | Usage beyond free allowances or non-free services can incur charges |
Rapid Service Selection Matrix
| Scenario | Best AWS answer |
|---|
| Host a static website | Amazon S3, often with CloudFront |
| Cache content near users globally | Amazon CloudFront |
| Register/manage DNS | Amazon Route 53 |
| Run virtual machines | Amazon EC2 |
| Automatically scale EC2 fleet | Amazon EC2 Auto Scaling |
| Distribute HTTP/HTTPS traffic | Application Load Balancer |
| Run event-driven code | AWS Lambda |
| Run containers without servers | AWS Fargate |
| Managed Kubernetes | Amazon EKS |
| Managed relational database | Amazon RDS |
| AWS-optimized relational database | Amazon Aurora |
| Serverless NoSQL database | Amazon DynamoDB |
| Data warehouse | Amazon Redshift |
| Query S3 data with SQL | Amazon Athena |
| ETL and data catalog | AWS Glue |
| Store objects | Amazon S3 |
| Persistent EC2 block volume | Amazon EBS |
| Shared Linux file system | Amazon EFS |
| Hybrid storage bridge | AWS Storage Gateway |
| Physical data migration | AWS Snow Family |
| Online data transfer | AWS DataSync |
| Migrate databases | AWS Database Migration Service |
| Decouple with queue | Amazon SQS |
| Fan-out notifications | Amazon SNS |
| Event bus/routing | Amazon EventBridge |
| Multi-step workflow | AWS Step Functions |
| API front door | Amazon API Gateway |
| Manage identities and permissions | AWS IAM |
| Central SSO | IAM Identity Center |
| Encrypt/manage keys | AWS KMS |
| Store and rotate secrets | AWS Secrets Manager |
| Web application firewall | AWS WAF |
| Threat detection | Amazon GuardDuty |
| Vulnerability scanning | Amazon Inspector |
| Sensitive data discovery in S3 | Amazon Macie |
| API audit trail | AWS CloudTrail |
| Metrics and alarms | Amazon CloudWatch |
| Configuration compliance | AWS Config |
| Cost forecast/estimate | AWS Pricing Calculator |
| Cost trends | AWS Cost Explorer |
| Cost alerts | AWS Budgets |
Last-Minute Checklist
Know Cold
- AWS Shared Responsibility Model.
- Difference between Region, Availability Zone, and edge location.
- IAM user vs group vs role vs policy.
- Explicit deny overrides allow.
- Security group vs network ACL.
- CloudWatch vs CloudTrail vs AWS Config.
- S3 vs EBS vs EFS vs FSx.
- EC2 vs Lambda vs ECS/EKS/Fargate.
- RDS/Aurora vs DynamoDB vs Redshift.
- SQS vs SNS vs EventBridge vs Step Functions.
- Pricing Calculator vs Cost Explorer vs Budgets.
- Organizations, SCPs, Control Tower, and consolidated billing.
- Well-Architected pillars.
Use This Exam Strategy
- Identify the requirement: security, cost, reliability, performance, operations, migration, or support.
- Eliminate services that solve a different layer of the problem.
- Prefer managed/serverless services when the question emphasizes reduced operations.
- Prefer multi-AZ designs when the question emphasizes high availability within a Region.
- Prefer IAM roles and temporary credentials over long-term access keys.
- For audit questions, separate monitoring, logging, and configuration tracking:
- Metrics/alarms: CloudWatch.
- API calls: CloudTrail.
- Resource configuration: AWS Config.
- For cost questions, separate estimating, analyzing, and alerting:
- Estimate: Pricing Calculator.
- Analyze: Cost Explorer.
- Alert: Budgets.
Practical Next Step
Use this Quick Reference to drill service selection, shared responsibility, and cost-management scenarios, then move into timed CLF-C02 practice questions that force you to choose the best AWS service or concept from similar-looking options.