What is the AWS certification?

The AWS certification validates your expertise in AWS cloud services. This study guide covers all exam domains with practice questions and detailed explanations.

How to prepare for the AWS certification exam?

Start with a structured study plan covering all exam domains. Use practice exams to identify weak areas, review detailed explanations, and take timed mock exams before test day.

AWS Cloud Practitioner CLF C02 Salary 2026 : Cert-Pass Blog

Official source note

aws cloud practitioner clf c02 salary 2026 is the main focus of this page, and the safest way to study it is to keep the exam hub open while you work through the official facts and the service selection patterns. AWS describes AWS Cloud Practitioner CLF-C02 as a foundational certification built around practical cloud literacy, service selection, and scenario thinking. The main Cert Pass hub remains /exams/aws-aws-cloud-practitioner-clf-c02.

Exam facts

Exam name: AWS Cloud Practitioner CLF-C02
Exam slug: aws-aws-cloud-practitioner-clf-c02
Vendor: AWS
Cert Pass landing page: /exams/aws-aws-cloud-practitioner-clf-c02
Study hub: /exams/aws-aws-cloud-practitioner-clf-c02
Official vendor page: AWS Certified Cloud Practitioner

Why this article exists

The goal here is not to collect trivia. The goal is to build the habit of reading a scenario, identifying the category, and choosing the simplest service that directly fits the requirement.

Fast study map

Use the exam hub twice during review: /exams/aws-aws-cloud-practitioner-clf-c02 and /exams/aws-aws-cloud-practitioner-clf-c02. Those internal links should act as the stable anchor for practice, revision, and final review.

AWS Cloud Practitioner CLF C02 Salary 2026: Career Value and Compensation Factors

AWS Cloud Practitioner CLF C02 is often discussed as a salary question, but the more accurate framing is career value. The certification is foundational, so it does not create a salary number by itself. What it does create is credibility: a candidate can show that they understand the AWS vocabulary, the common service families, the shared responsibility model, and the basic cost and support conversation that many entry level and adjacent roles need. If a candidate wants the main exam hub while thinking about career direction, the best internal destination is /exams/aws-aws-cloud-practitioner-clf-c02, and the official AWS certification page remains the vendor source for the certification's scope.

Official source note

AWS describes the certification as a foundational, high level understanding of AWS Cloud, services, and terminology. That wording matters because it tells candidates what the exam is not trying to do. It is not a deep design exam. It is a broad literacy exam. The official page is here: AWS Certified Cloud Practitioner.

Exam facts

Exam name: AWS Cloud Practitioner CLF C02
Exam slug: aws-aws-cloud-practitioner-clf-c02
Vendor: AWS
Questions: 65
Time limit: 90 minutes
Passing score: 70 out of 100 on the scaled score model
Prerequisites: None required
Official certification page: AWS Certified Cloud Practitioner
Cert Pass practice landing page: /exams/aws-aws-cloud-practitioner-clf-c02
Cert Pass study hub: /exams/aws-aws-cloud-practitioner-clf-c02

Domain breakdown

Domain 3, Cloud Technology and Services: 34 percent
Domain 2, Security and Compliance: 30 percent
Domain 1, Cloud Concepts: 24 percent
Domain 4, Billing, Pricing, and Support: 12 percent

Study links

The main internal destination for this cluster is /exams/aws-aws-cloud-practitioner-clf-c02. When a question or study section needs a quick reset, use the same landing page again: /exams/aws-aws-cloud-practitioner-clf-c02.

What the certification signals to employers

The certification tells an employer that a candidate can participate in a cloud conversation without starting from zero. That matters in support roles, operations roles, project coordination, customer success, technical sales, junior cloud analyst roles, and career transition roles. It is useful because many teams do not need a beginner who can design a full multi account landing zone on day one. They need someone who can understand what the team is talking about, ask better questions, and learn the AWS environment faster.

That signal is small compared with years of experience, but it is still real. In practical hiring terms, the credential can help a candidate move from "I have heard of AWS" to "I can explain what AWS services do and how they fit together." That shift often improves interview confidence, resume clarity, and role fit.

Why compensation depends on the broader profile

Compensation is influenced by many factors that sit outside the certification itself.

Location and market demand
Years of experience
Role family and seniority
Industry and company size
Breadth of technical skill
Hands on AWS experience
Communication ability
Security, networking, and troubleshooting background
Ability to connect cloud concepts to business value

The certification helps most when it is paired with one or more of those factors. A candidate who already works in support, operations, or technical customer facing work may be able to use the certification to strengthen the argument for a cloud oriented role. A candidate who is changing careers may use it to show commitment and baseline knowledge. A candidate already inside an AWS team may use it to formalize knowledge and make later certification steps easier.

Role paths where the certification tends to help

1. Cloud support

Support teams often need people who can recognize AWS service names, understand basic account issues, and speak clearly about what is happening in a customer environment. CLF C02 helps because it teaches the vocabulary of IAM, CloudTrail, CloudWatch, S3, EC2, RDS, and billing tools.

2. Junior cloud operations

Operations work benefits from a candidate who understands monitoring, logs, alarms, and cost awareness. CLF C02 does not make someone an expert operator, but it gives enough foundation to enter conversations about what CloudWatch does, what Config does, and why shared responsibility matters.

3. Technical sales or solution support

Many customer facing roles need a clear explanation of AWS value, not just deep implementation skill. The certification helps a candidate explain elasticity, pay as you go pricing, global reach, and managed services in plain language.

4. Project coordination and delivery support

Project work in cloud environments benefits from a candidate who can understand what services teams are using and why. The certification creates a useful bridge between technical and non technical conversation.

5. Entry cloud analyst or apprentice style roles

For entry roles, the credential can help prove motivation, structure, and baseline literacy. It does not replace hands on work, but it can open the conversation.

What the exam teaches that employers care about

The content of the exam maps to workplace usefulness more directly than it might appear at first glance.

Cloud concepts help a candidate explain why a team should use AWS rather than fixed infrastructure.
Security and compliance help a candidate discuss permissions, audit history, encryption, and governance.
Technology and services help a candidate understand the difference between compute, storage, networking, database, and integration services.
Billing, pricing, and support help a candidate participate in cost and support discussions.

Those topics appear in interview conversations all the time. A hiring manager may not ask about the exam itself, but the same concepts show up as job requirements.

How to talk about the certification without overclaiming

The strongest way to discuss CLF C02 is to be specific and modest. The certification proves foundational AWS knowledge. It does not prove senior architecture skill, deep DevOps capability, or hands on production ownership. Being honest about that boundary makes the credential more credible, not less.

A good way to frame it is:

It demonstrates familiarity with AWS core services and cloud fundamentals.
It shows understanding of the shared responsibility model and basic security concepts.
It shows comfort with cost tools and support plan basics.
It makes the candidate easier to train on more advanced AWS tasks.

That framing helps employers understand where the certification fits in the larger skill stack.

Adjacent skills that increase the value of the certification

The certification is stronger when it sits next to useful practical skills.

Basic troubleshooting
Ticket handling and documentation
Customer communication
Networking fundamentals
Operating system basics
Security awareness
Scripting familiarity
Cost awareness
Familiarity with cloud console navigation
Experience reading logs and alerts

If those skills are present, the certification becomes a better signal because it sits on top of something concrete. If they are not yet present, the certification can still be helpful, but the career impact is usually smaller until the rest of the profile grows.

How employers tend to interpret the credential

Employers usually read CLF C02 in one of three ways.

As evidence that the candidate is new to AWS but serious about learning.
As evidence that the candidate can participate in cloud discussions without constant translation.
As evidence that the candidate is preparing for a more technical AWS track.

That interpretation is useful because it tells a candidate what to do next. The certification is rarely the finish line. It is the start of a more focused path.

Career paths after the certification

A useful way to think about post certification growth is to pair the credential with a role direction.

If the goal is support or operations

Go deeper on CloudWatch, CloudTrail, IAM, S3, EC2, RDS, basic networking, and incident response habits. The value here is practical troubleshooting and service familiarity.

If the goal is architecture

Move toward associate level architecture study, especially networking, compute choice, storage design, resiliency patterns, and cost tradeoffs.

If the goal is security

Focus on IAM, KMS, Secrets Manager, CloudTrail, Config, WAF, Shield, GuardDuty, Inspector, and Macie. The foundational certification becomes the entry point into a stronger security story.

If the goal is technical sales or customer success

Focus on cloud value, pricing, managed services, support plans, and the ability to explain AWS simply to non technical stakeholders.

Why the official AWS description matters for career framing

The official AWS certification page says the credential validates foundational understanding of AWS Cloud, services, and terminology. That wording is important because it keeps the career story honest. It says the credential is valuable, but it also says what level it represents. A candidate who uses that wording correctly can avoid inflated claims and can build a more durable narrative around career growth.

Salary conversations done the right way

The best salary conversation is not "What does the certification pay?" The better conversation is "How does this certification fit the role I want?" That question is much more useful because compensation is tied to capability and demand, not just a logo on a resume.

A candidate can improve the compensation story by combining the certification with:

A clearer job target
Practical AWS lab work
Experience with tickets or projects
Evidence of troubleshooting skill
Communication and documentation ability
Related certifications on the next step of the path

That combination is far more persuasive than the credential alone.

What not to claim

It is tempting to overstate the value of any certification, especially a first one. The safer approach is to avoid claims that are unsupported or too broad.

Do not claim that the certification guarantees a specific salary.
Do not claim it replaces experience.
Do not claim it proves production design expertise.
Do not claim it is enough by itself for a senior role.

Clear boundaries make the credential more believable and make the career story stronger.

A practical 90 day growth plan

A strong way to turn the certification into career movement is to attach a next step plan.

Month 1

Reinforce the exam material and build a small hands on lab routine. Learn the service families well enough to describe them from memory.

Month 2

Pick a role direction and study the adjacent skills that support it. For example, a support focused candidate can study logs and alerts, while a security focused candidate can study IAM and KMS in more depth.

Month 3

Create a simple portfolio of notes, diagrams, or lab exercises that show practical understanding. That evidence is often more useful in a hiring conversation than the certification alone.

How the certification helps in interviews

Interviewers often want proof that a candidate can learn cloud concepts and speak clearly about them. The certification helps because it gives the candidate a stable vocabulary.

A candidate who can explain the difference between CloudTrail, CloudWatch, and Config, or between S3, EBS, and EFS, appears more prepared than a candidate who knows only the exam title. That practical fluency can improve interview quality even before deep hands on experience is available.

Extended official revision notes

AWS Certified Cloud Practitioner CLF-C02 - Compressed Exam Preparation Course

Purpose: This course converts the CLF-C02 practice question bank into a clean, non-repetitive study guide. It focuses on service selection, scenario reasoning, exam traps, and fast revision.

Source question bank analyzed: 1005 questions
Detected domain balance: Cloud Concepts 241, Security and Compliance 300, Cloud Technology and Services 343, Billing/Pricing/Support 121

1. Exam Overview

What the exam is testing

The AWS Certified Cloud Practitioner CLF-C02 validates foundational understanding of the AWS Cloud. It is not a deep engineering exam, but it expects you to recognize:

Core AWS Cloud value propositions
The AWS shared responsibility model
Security, governance, and compliance foundations
Major AWS service categories and common use cases
Billing, pricing, support, cost tools, and purchasing options
Basic architecture patterns for reliability, elasticity, scalability, and availability

How to think like the exam

The exam usually asks: “Which AWS service or concept best fits this business need?”

A strong answer normally matches the scenario using the least complicated correct service:

Need object storage → Amazon S3
Need managed relational database → Amazon RDS or Aurora
Need serverless code execution → AWS Lambda
Need identity and access → IAM
Need account governance at scale → AWS Organizations / Control Tower
Need audit history of API calls → AWS CloudTrail
Need metrics and alarms → Amazon CloudWatch
Need cost visibility → AWS Cost Explorer
Need budget thresholds → AWS Budgets
Need compliance reports → AWS Artifact
Need DDoS protection → AWS Shield
Need web application filtering → AWS WAF
Need content delivery → Amazon CloudFront

How to use this course

Read the domain overview first.
Study the service-selection tables.
Review the traps and “if you see X, think Y” patterns.
Practice questions by explaining why wrong answers fail.
Use the final checklist before exam day.

2. Exam Domains

The official CLF-C02 exam domains are:

Domain	Official Weight	What it means for study
Domain 1: Cloud Concepts	24%	Cloud value, cloud economics, Well-Architected principles, migration benefits
Domain 2: Security and Compliance	30%	Shared responsibility, IAM, encryption, compliance, governance, monitoring
Domain 3: Cloud Technology and Services	34%	Core AWS services, compute, storage, databases, networking, analytics, AI/ML
Domain 4: Billing, Pricing, and Support	12%	Pricing models, cost tools, support plans, Marketplace, billing dashboards

Priority notes

The highest-yield areas are:

Cloud Technology and Services - most service-selection questions.
Security and Compliance - many scenario traps around IAM, CloudTrail, Config, KMS, WAF, Shield, and Artifact.
Cloud Concepts - conceptual questions about benefits, elasticity, scalability, and Well-Architected.
Billing/Pricing/Support - fewer questions but easy points if memorized well.

Most repeated themes extracted from the source bank

Theme	Why it matters
IAM and least privilege	Identity/security questions appear constantly.
EC2 vs Lambda vs containers	Common compute service-selection trap.
S3 vs EBS vs EFS vs Glacier	Very frequent storage comparison.
CloudTrail vs CloudWatch vs Config	Classic monitoring/audit/governance confusion.
WAF vs Shield vs GuardDuty vs Inspector vs Macie	Security-service differentiation is heavily tested.
Cost Explorer vs Budgets vs Pricing Calculator	Billing questions often test timing and purpose.
RDS vs DynamoDB vs Redshift vs ElastiCache	Database selection appears in many scenarios.
Route 53, CloudFront, Direct Connect, VPN	Networking and edge services are common.
Organizations, SCPs, Control Tower	Multi-account governance patterns.
AWS Artifact and compliance reports	Easy marks if remembered.

3. Start-to-Finish Study Path

Phase 1 - Foundation

Learn these first:

What cloud computing means
AWS global infrastructure: Regions, Availability Zones, edge locations
Public cloud benefits: pay-as-you-go, elasticity, scalability, agility
Shared responsibility model
Basic IAM: users, groups, roles, policies, MFA
Basic storage, compute, networking, and database categories

Phase 2 - Intermediate

Focus on service choice:

EC2, Lambda, ECS, EKS, Fargate, Elastic Beanstalk, Lightsail
S3, EBS, EFS, FSx, S3 Glacier
VPC, Route 53, CloudFront, VPN, Direct Connect
RDS, Aurora, DynamoDB, Redshift, ElastiCache
CloudWatch, CloudTrail, Config, Trusted Advisor
WAF, Shield, GuardDuty, Inspector, Macie, KMS, Secrets Manager

Phase 3 - Advanced exam reasoning

Practice eliminating wrong answers:

Is the question asking for audit, metrics, or configuration compliance?
Is the workload object, block, or file storage?
Is the database relational, key-value, warehouse, or cache?
Is the need forecasting future costs, tracking current spend, or alerting on budget limits?
Is the security need identity, encryption, threat detection, vulnerability scanning, or web filtering?

Phase 4 - Final review

Spend the final day memorizing:

Shared responsibility boundaries
Support plan differences
Cost tool differences
Storage and database selection
Monitoring/security service differences
Well-Architected pillars

4. Core Concepts by Domain

Domain 1: Cloud Concepts

Concepts

Domain 1 tests whether you understand the why behind cloud computing.

Key ideas:

Pay-as-you-go: pay only for what you use.
Economies of scale: AWS can offer lower variable costs due to large-scale operations.
Elasticity: automatically match capacity to demand.
Scalability: ability to grow or shrink resources.
Agility: launch resources quickly.
High availability: reduce downtime by using multiple Availability Zones.
Fault tolerance: system continues operating despite failures.
Global reach: deploy near users around the world.
Operational excellence: improve operations through automation and monitoring.

AWS Cloud value proposition

Concept	Meaning	Exam pattern
Trade fixed expense for variable expense	Avoid large upfront data center costs	“No need to buy servers before knowing demand”
Benefit from massive economies of scale	AWS passes scale efficiencies to customers	“Lower variable cost”
Stop guessing capacity	Scale up/down based on demand	“Avoid overprovisioning”
Increase speed and agility	Provision resources in minutes	“Experiment quickly”
Stop spending money on running data centers	AWS manages physical facilities	“Focus on business value”
Go global in minutes	Deploy in multiple Regions	“Serve users worldwide with low latency”

Well-Architected Framework

Pillar	Main idea	Exam clue
Operational Excellence	Run and monitor systems effectively	Automation, runbooks, observability
Security	Protect data, systems, and assets	IAM, encryption, detection
Reliability	Recover from failures	Multi-AZ, backups, fault tolerance
Performance Efficiency	Use resources efficiently	Right service and instance choice
Cost Optimization	Avoid unnecessary cost	right sizing, Savings Plans, Budgets
Sustainability	Minimize environmental impact	efficient utilization, managed services

Domain 1 patterns

If the question says rapidly respond to demand, think elasticity.
If it says support growth over time, think scalability.
If it says continue during failures, think fault tolerance or high availability.
If it says deploy close to global users, think Regions, Availability Zones, CloudFront, edge locations.
If it says reduce undifferentiated heavy lifting, think AWS managed services.

Domain 1 traps

Elasticity vs scalability: elasticity is dynamic adjustment; scalability is the ability to handle increased load.
Availability vs durability: availability means accessible when needed; durability means data is not lost.
Fault tolerance vs backup: backup helps recovery; fault tolerance keeps service running.
Region vs Availability Zone: Region is a geographic area; AZ is isolated data center grouping inside a Region.
Edge location vs Region: edge locations cache/deliver content; Regions host primary AWS resources.

Domain 2: Security and Compliance

Concepts

Domain 2 is one of the most important sections. You must know who is responsible for what, and which AWS security service solves each problem.

Shared Responsibility Model

Responsibility	AWS	Customer
Physical data centers	Yes	No
Hardware infrastructure	Yes	No
Global infrastructure	Yes	No
Managed service infrastructure	Yes	Depends on service
Data classification	No	Yes
IAM users, roles, and permissions	No	Yes
Application security	No	Yes
Guest OS patching on EC2	No	Yes
Encryption configuration	Shared	Customer configures usage
Network traffic protection	Shared	Customer configures controls

IAM essentials

IAM element	Use
User	Long-term identity for a person or app, but roles are preferred for AWS services
Group	Collection of users with common permissions
Role	Temporary credentials; best for AWS services and cross-account access
Policy	JSON permissions document
MFA	Stronger sign-in protection
Least privilege	Grant only required permissions

Security and compliance service map

Need	Service
Manage identities and permissions	IAM
Centralize multi-account management	AWS Organizations
Restrict accounts at organization level	Service Control Policies
Set up governed multi-account landing zone	AWS Control Tower
Audit API calls	AWS CloudTrail
Monitor metrics/logs/alarms	Amazon CloudWatch
Track resource configuration and compliance	AWS Config
Get compliance reports	AWS Artifact
Encrypt and manage keys	AWS KMS
Store and rotate secrets	AWS Secrets Manager
SSL/TLS certificates	AWS Certificate Manager
Detect threats	Amazon GuardDuty
Scan vulnerabilities	Amazon Inspector
Discover sensitive data in S3	Amazon Macie
Web application firewall	AWS WAF
DDoS protection	AWS Shield
Best-practice recommendations	AWS Trusted Advisor

Domain 2 patterns

If the question asks who manages the physical security of AWS data centers, answer AWS.
If it asks who configures IAM permissions, answer customer.
If it asks for API activity history, choose CloudTrail.
If it asks for CPU metrics and alarms, choose CloudWatch.
If it asks for resource compliance drift, choose AWS Config.
If it asks for downloadable compliance reports, choose AWS Artifact.
If it asks for DDoS protection, choose AWS Shield.
If it asks for SQL injection or cross-site scripting filtering, choose AWS WAF.
If it asks for sensitive data discovery in S3, choose Macie.
If it asks for vulnerability scanning of EC2/container workloads, choose Inspector.

Domain 2 traps

Trap	Correct reasoning
CloudTrail vs CloudWatch	CloudTrail records API calls; CloudWatch monitors metrics/logs/alarms.
CloudWatch vs Config	CloudWatch tells what is happening operationally; Config tracks configuration history and compliance.
WAF vs Shield	WAF filters web requests; Shield protects against DDoS.
GuardDuty vs Inspector	GuardDuty detects threats; Inspector scans vulnerabilities.
KMS vs Secrets Manager	KMS manages encryption keys; Secrets Manager stores/rotates secrets.
IAM role vs IAM user	Roles provide temporary credentials and are preferred for AWS services.
SCP vs IAM policy	SCP sets account permission boundaries; IAM policy grants permissions within those boundaries.
Artifact vs Audit Manager	Artifact provides reports/agreements; Audit Manager helps collect evidence for audits.

Domain 3: Cloud Technology and Services

Concepts

This is the largest domain. It tests whether you can identify major AWS services and choose the correct one for a scenario.

AWS global infrastructure

Component	Meaning
Region	Separate geographic area containing multiple Availability Zones
Availability Zone	Isolated location within a Region
Edge location	Site used by CloudFront and edge services to reduce latency
Local Zone	Places selected AWS resources close to large population centers
Wavelength Zone	AWS infrastructure at 5G telecom edge
Outposts	AWS infrastructure deployed on premises

Compute services

Service	Best use	Avoid when
Amazon EC2	Full control over virtual servers	You want fully serverless execution
AWS Lambda	Event-driven, short-running serverless code	You need long-running full OS control
Amazon ECS	Container orchestration on AWS	You specifically need Kubernetes APIs
Amazon EKS	Managed Kubernetes	You do not need Kubernetes complexity
AWS Fargate	Serverless containers	You need direct server/host control
Elastic Beanstalk	Easy app deployment with managed platform	You need deep infrastructure customization
Amazon Lightsail	Simple VPS for small workloads	You need enterprise-scale architecture

Storage services

Service	Type	Best use
Amazon S3	Object storage	Static websites, backups, data lakes, objects
Amazon EBS	Block storage	Persistent volumes for EC2
Amazon EFS	File storage	Shared Linux file system across EC2
Amazon FSx	Managed file systems	Windows File Server, Lustre, NetApp ONTAP, OpenZFS
S3 Glacier	Archive storage	Low-cost long-term archives
Storage Gateway	Hybrid storage	Connect on-premises environments to AWS storage
AWS Backup	Centralized backup	Backup automation across AWS services
AWS DataSync	Data movement	Move large datasets to/from AWS

Database services

Service	Best use
Amazon RDS	Managed relational databases
Amazon Aurora	High-performance AWS-compatible relational database
Amazon DynamoDB	Serverless key-value/document database with low latency
Amazon Redshift	Data warehouse and analytics
Amazon ElastiCache	In-memory cache
Amazon Neptune	Graph database
Amazon DocumentDB	MongoDB-compatible document database
Amazon QLDB	Ledger database

Networking and content delivery

Service	Best use
Amazon VPC	Isolated virtual network
Subnets	Segment VPC resources
Security Groups	Instance-level virtual firewall
Network ACLs	Subnet-level stateless firewall
Route 53	DNS and domain routing
CloudFront	CDN and edge caching
Elastic Load Balancing	Distribute traffic across targets
Direct Connect	Dedicated private connection to AWS
Site-to-Site VPN	Encrypted connection over internet
Transit Gateway	Central hub for VPC/on-premises connectivity
API Gateway	Managed APIs, often with Lambda

Integration and application services

Service	Best use
Amazon SQS	Message queue and decoupling
Amazon SNS	Pub/sub notifications
Amazon EventBridge	Event bus and event-driven integration
AWS Step Functions	Workflow orchestration
Amazon MQ	Managed message broker for existing broker-based apps
AWS AppSync	Managed GraphQL APIs

Analytics, ML, and business applications

Service	Best use
Amazon Athena	Query S3 data with SQL
AWS Glue	Serverless data integration/ETL and catalog
Amazon Kinesis	Streaming data ingestion and processing
Amazon EMR	Big data frameworks such as Spark/Hadoop
Amazon QuickSight	Business intelligence dashboards
Amazon SageMaker	Build/train/deploy ML models
Amazon Bedrock	Generative AI foundation models
Amazon Lex	Chatbots
Amazon Polly	Text-to-speech
Amazon Transcribe	Speech-to-text
Amazon Translate	Translation
Amazon Comprehend	NLP and text insights
Amazon Connect	Cloud contact center
Amazon WorkSpaces	Virtual desktops
Amazon AppStream 2.0	Stream desktop applications

Domain 3 patterns

Need simple object storage → S3.
Need EC2 boot volume or database volume → EBS.
Need shared Linux file system → EFS.
Need archive rarely accessed data → S3 Glacier.
Need managed relational database → RDS/Aurora.
Need NoSQL key-value with single-digit millisecond latency → DynamoDB.
Need data warehouse analytics → Redshift.
Need in-memory caching → ElastiCache.
Need DNS → Route 53.
Need CDN → CloudFront.
Need dedicated private network connection → Direct Connect.
Need encrypted tunnel over internet → VPN.
Need decoupled queue → SQS.
Need fanout notifications → SNS.
Need event routing → EventBridge.
Need workflow state machine → Step Functions.

Domain 3 traps

Trap	Correct reasoning
S3 vs EBS	S3 is object storage; EBS is block storage for EC2.
EBS vs EFS	EBS attaches to EC2 as a volume; EFS is shared file storage.
RDS vs DynamoDB	RDS is relational SQL; DynamoDB is NoSQL key-value/document.
Redshift vs RDS	Redshift is analytics warehouse; RDS is transactional database.
CloudFront vs Route 53	CloudFront caches/delivers content; Route 53 resolves DNS.
Direct Connect vs VPN	Direct Connect is dedicated private connectivity; VPN uses encrypted internet tunnel.
SQS vs SNS	SQS queues messages; SNS publishes notifications to subscribers.
Lambda vs EC2	Lambda is serverless event execution; EC2 gives server control.
ECS vs EKS	ECS is AWS-native containers; EKS is Kubernetes.
Glue vs Athena	Glue catalogs/transforms data; Athena queries S3 with SQL.

Domain 4: Billing, Pricing, and Support

Concepts

This domain tests whether you can identify the right cost, billing, and support tool.

Pricing models

Model	Best for
On-Demand	Flexible workloads with no long-term commitment
Reserved Instances	Steady-state EC2/RDS usage with commitment
Savings Plans	Flexible compute savings with usage commitment
Spot Instances	Fault-tolerant workloads that can be interrupted
Dedicated Hosts	Compliance/licensing requiring physical server visibility
Free Tier	Initial exploration within usage limits

Cost and billing tools

Need	Tool
Estimate before deployment	AWS Pricing Calculator
Analyze historical and current cost	AWS Cost Explorer
Set cost/usage alerts	AWS Budgets
View bills and invoices	AWS Billing Dashboard
Allocate costs by team/project	Cost allocation tags
Programmatic cost data	Cost and Usage Report
Find optimization recommendations	Trusted Advisor / Compute Optimizer
Buy third-party software/services	AWS Marketplace

Support plans

Plan	Typical use
Basic	Account/billing support, docs, whitepapers
Developer	Business-hours technical support for testing/development
Business	24/7 technical support and production workloads
Enterprise On-Ramp	Production/business-critical support with faster access than Business
Enterprise	Mission-critical workloads, TAM, fastest response levels

Domain 4 patterns

Need future cost estimate → Pricing Calculator.
Need visualize past/current spend → Cost Explorer.
Need alert when spend exceeds threshold → Budgets.
Need architecture best-practice checks → Trusted Advisor.
Need third-party AMIs/software → Marketplace.
Need production technical support 24/7 → Business or higher.
Need TAM → Enterprise support.

Domain 4 traps

Trap	Correct reasoning
Pricing Calculator vs Cost Explorer	Calculator estimates future workloads; Cost Explorer analyzes actual spend.
Budgets vs Cost Explorer	Budgets alerts on thresholds; Cost Explorer visualizes and analyzes costs.
Trusted Advisor vs Compute Optimizer	Trusted Advisor covers broad best practices; Compute Optimizer focuses compute recommendations.
Reserved Instances vs Savings Plans	RIs are more specific; Savings Plans are more flexible for compute usage.
Spot vs Reserved	Spot is interruptible and cheap; Reserved is committed and predictable.
Basic support vs Developer	Basic does not include general technical support cases.

5. Service Selection Guide

Security and Governance

Scenario	Choose	Why
User needs temporary access to AWS resources	IAM role	Uses temporary credentials
Enforce permission limits across accounts	SCP	Applies at organization/account boundary
Govern many accounts quickly	AWS Control Tower	Landing zone and guardrails
Find API caller history	CloudTrail	Records API calls
Detect non-compliant resource config	Config	Tracks configuration and rules
Download AWS compliance reports	Artifact	Compliance reports and agreements
Encrypt data with managed keys	KMS	Key management service
Rotate database credentials	Secrets Manager	Secret storage and rotation
Detect compromised credentials or unusual activity	GuardDuty	Threat detection
Scan workloads for vulnerabilities	Inspector	Vulnerability management
Find PII in S3	Macie	Sensitive data discovery
Protect web app from SQL injection/XSS	WAF	Layer 7 web request filtering
Protect against DDoS attacks	Shield	DDoS protection

Compute

Scenario	Choose	Why
Need virtual machine with OS control	EC2	Full compute control
Need event-driven serverless execution	Lambda	No server management
Need simple app deployment	Elastic Beanstalk	Platform handles deployment
Need simple VPS	Lightsail	Simplified compute bundle
Need containers without managing servers	Fargate	Serverless container runtime
Need Kubernetes	EKS	Managed Kubernetes
Need AWS-native container orchestration	ECS	Integrated AWS container service

Storage

Scenario	Choose	Why
Store files, images, backups, logs	S3	Durable object storage
Persistent disk for EC2	EBS	Block storage
Shared Linux file system	EFS	Multi-instance file access
Windows file shares	FSx for Windows File Server	Managed SMB file system
Long-term archive	S3 Glacier	Low-cost archival
Hybrid on-premises storage	Storage Gateway	Connects on-premises apps to AWS storage
Move large data sets	DataSync / Snowball	Online/offline migration options

Databases

Scenario	Choose	Why
Managed MySQL/PostgreSQL/SQL Server	RDS	Managed relational database
High-performance cloud-native relational	Aurora	AWS-optimized relational database
Serverless NoSQL key-value	DynamoDB	Low-latency NoSQL
Analytics warehouse	Redshift	Columnar analytics
Cache frequent reads	ElastiCache	In-memory performance
Graph relationships	Neptune	Graph database
MongoDB-compatible document workload	DocumentDB	Managed document database

Networking

Scenario	Choose	Why
Isolate cloud network	VPC	Private network boundary
Control instance inbound/outbound traffic	Security Group	Stateful instance firewall
Control subnet traffic	Network ACL	Stateless subnet firewall
DNS and domain routing	Route 53	Managed DNS
CDN and edge caching	CloudFront	Low-latency content delivery
Dedicated private connection	Direct Connect	Private network link
Encrypted connection over internet	VPN	Encrypted tunnel
Hub for multiple VPCs	Transit Gateway	Central connectivity

6. Architecture Patterns