arrow_back Cert

AWS AWS Cloud Practitioner CLF-C02

Study & Mastery Mode

🔥 0 streak

Score 0% /70%

timer Mock Exam lock Pro menu_book Course description 3-Page download Free

menu_book

AWS Cloud Practitioner CLF-C02

Compressed Course

AWS Certified Cloud Practitioner CLF-C02 — Compressed Exam Preparation Course

Purpose: This course converts the CLF-C02 practice question bank into a clean, non-repetitive study guide. It focuses on service selection, scenario reasoning, exam traps, and fast revision.

Source question bank analyzed: 1005 questions
Detected domain balance: Cloud Concepts 241, Security and Compliance 300, Cloud Technology and Services 343, Billing/Pricing/Support 121

1. Exam Overview

What the exam is testing

The AWS Certified Cloud Practitioner CLF-C02 validates foundational understanding of the AWS Cloud. It is not a deep engineering exam, but it expects you to recognize:

Core AWS Cloud value propositions
The AWS shared responsibility model
Security, governance, and compliance foundations
Major AWS service categories and common use cases
Billing, pricing, support, cost tools, and purchasing options
Basic architecture patterns for reliability, elasticity, scalability, and availability

How to think like the exam

The exam usually asks: “Which AWS service or concept best fits this business need?”

A strong answer normally matches the scenario using the least complicated correct service:

Need object storage → Amazon S3
Need managed relational database → Amazon RDS or Aurora
Need serverless code execution → AWS Lambda
Need identity and access → IAM
Need account governance at scale → AWS Organizations / Control Tower
Need audit history of API calls → AWS CloudTrail
Need metrics and alarms → Amazon CloudWatch
Need cost visibility → AWS Cost Explorer
Need budget thresholds → AWS Budgets
Need compliance reports → AWS Artifact
Need DDoS protection → AWS Shield
Need web application filtering → AWS WAF
Need content delivery → Amazon CloudFront

How to use this course

Read the domain overview first.
Study the service-selection tables.
Review the traps and “if you see X, think Y” patterns.
Practice questions by explaining why wrong answers fail.
Use the final checklist before exam day.

2. Exam Domains

The official CLF-C02 exam domains are:

Domain	Official Weight	What it means for study
Domain 1: Cloud Concepts	24%	Cloud value, cloud economics, Well-Architected principles, migration benefits
Domain 2: Security and Compliance	30%	Shared responsibility, IAM, encryption, compliance, governance, monitoring
Domain 3: Cloud Technology and Services	34%	Core AWS services, compute, storage, databases, networking, analytics, AI/ML
Domain 4: Billing, Pricing, and Support	12%	Pricing models, cost tools, support plans, Marketplace, billing dashboards

Priority notes

The highest-yield areas are:

Cloud Technology and Services — most service-selection questions.
Security and Compliance — many scenario traps around IAM, CloudTrail, Config, KMS, WAF, Shield, and Artifact.
Cloud Concepts — conceptual questions about benefits, elasticity, scalability, and Well-Architected.
Billing/Pricing/Support — fewer questions but easy points if memorized well.

Most repeated themes extracted from the source bank

Theme	Why it matters
IAM and least privilege	Identity/security questions appear constantly.
EC2 vs Lambda vs containers	Common compute service-selection trap.
S3 vs EBS vs EFS vs Glacier	Very frequent storage comparison.
CloudTrail vs CloudWatch vs Config	Classic monitoring/audit/governance confusion.
WAF vs Shield vs GuardDuty vs Inspector vs Macie	Security-service differentiation is heavily tested.
Cost Explorer vs Budgets vs Pricing Calculator	Billing questions often test timing and purpose.
RDS vs DynamoDB vs Redshift vs ElastiCache	Database selection appears in many scenarios.
Route 53, CloudFront, Direct Connect, VPN	Networking and edge services are common.
Organizations, SCPs, Control Tower	Multi-account governance patterns.
AWS Artifact and compliance reports	Easy marks if remembered.

3. Start-to-Finish Study Path

Phase 1 — Foundation

Learn these first:

What cloud computing means
AWS global infrastructure: Regions, Availability Zones, edge locations
Public cloud benefits: pay-as-you-go, elasticity, scalability, agility
Shared responsibility model
Basic IAM: users, groups, roles, policies, MFA
Basic storage, compute, networking, and database categories

Phase 2 — Intermediate

Focus on service choice:

EC2, Lambda, ECS, EKS, Fargate, Elastic Beanstalk, Lightsail
S3, EBS, EFS, FSx, S3 Glacier
VPC, Route 53, CloudFront, VPN, Direct Connect
RDS, Aurora, DynamoDB, Redshift, ElastiCache
CloudWatch, CloudTrail, Config, Trusted Advisor
WAF, Shield, GuardDuty, Inspector, Macie, KMS, Secrets Manager

Phase 3 — Advanced exam reasoning

Practice eliminating wrong answers:

Is the question asking for audit, metrics, or configuration compliance?
Is the workload object, block, or file storage?
Is the database relational, key-value, warehouse, or cache?
Is the need forecasting future costs, tracking current spend, or alerting on budget limits?
Is the security need identity, encryption, threat detection, vulnerability scanning, or web filtering?

Phase 4 — Final review

Spend the final day memorizing:

Shared responsibility boundaries
Support plan differences
Cost tool differences
Storage and database selection
Monitoring/security service differences
Well-Architected pillars

4. Core Concepts by Domain

Domain 1: Cloud Concepts

Concepts

Domain 1 tests whether you understand the why behind cloud computing.

Key ideas:

Pay-as-you-go: pay only for what you use.
Economies of scale: AWS can offer lower variable costs due to large-scale operations.
Elasticity: automatically match capacity to demand.
Scalability: ability to grow or shrink resources.
Agility: launch resources quickly.
High availability: reduce downtime by using multiple Availability Zones.
Fault tolerance: system continues operating despite failures.
Global reach: deploy near users around the world.
Operational excellence: improve operations through automation and monitoring.

AWS Cloud value proposition

Concept	Meaning	Exam pattern
Trade fixed expense for variable expense	Avoid large upfront data center costs	“No need to buy servers before knowing demand”
Benefit from massive economies of scale	AWS passes scale efficiencies to customers	“Lower variable cost”
Stop guessing capacity	Scale up/down based on demand	“Avoid overprovisioning”
Increase speed and agility	Provision resources in minutes	“Experiment quickly”
Stop spending money on running data centers	AWS manages physical facilities	“Focus on business value”
Go global in minutes	Deploy in multiple Regions	“Serve users worldwide with low latency”

Well-Architected Framework

Pillar	Main idea	Exam clue
Operational Excellence	Run and monitor systems effectively	Automation, runbooks, observability
Security	Protect data, systems, and assets	IAM, encryption, detection
Reliability	Recover from failures	Multi-AZ, backups, fault tolerance
Performance Efficiency	Use resources efficiently	Right service and instance choice
Cost Optimization	Avoid unnecessary cost	right sizing, Savings Plans, Budgets
Sustainability	Minimize environmental impact	efficient utilization, managed services

Domain 1 patterns

If the question says rapidly respond to demand, think elasticity.
If it says support growth over time, think scalability.
If it says continue during failures, think fault tolerance or high availability.
If it says deploy close to global users, think Regions, Availability Zones, CloudFront, edge locations.
If it says reduce undifferentiated heavy lifting, think AWS managed services.

Domain 1 traps

Elasticity vs scalability: elasticity is dynamic adjustment; scalability is the ability to handle increased load.
Availability vs durability: availability means accessible when needed; durability means data is not lost.
Fault tolerance vs backup: backup helps recovery; fault tolerance keeps service running.
Region vs Availability Zone: Region is a geographic area; AZ is isolated data center grouping inside a Region.
Edge location vs Region: edge locations cache/deliver content; Regions host primary AWS resources.

Domain 2: Security and Compliance

Concepts

Domain 2 is one of the most important sections. You must know who is responsible for what, and which AWS security service solves each problem.

Shared Responsibility Model

Responsibility	AWS	Customer
Physical data centers	Yes	No
Hardware infrastructure	Yes	No
Global infrastructure	Yes	No
Managed service infrastructure	Yes	Depends on service
Data classification	No	Yes
IAM users, roles, and permissions	No	Yes
Application security	No	Yes
Guest OS patching on EC2	No	Yes
Encryption configuration	Shared	Customer configures usage
Network traffic protection	Shared	Customer configures controls

IAM essentials

IAM element	Use
User	Long-term identity for a person or app, but roles are preferred for AWS services
Group	Collection of users with common permissions
Role	Temporary credentials; best for AWS services and cross-account access
Policy	JSON permissions document
MFA	Stronger sign-in protection
Least privilege	Grant only required permissions

Security and compliance service map

Need	Service
Manage identities and permissions	IAM
Centralize multi-account management	AWS Organizations
Restrict accounts at organization level	Service Control Policies
Set up governed multi-account landing zone	AWS Control Tower
Audit API calls	AWS CloudTrail
Monitor metrics/logs/alarms	Amazon CloudWatch
Track resource configuration and compliance	AWS Config
Get compliance reports	AWS Artifact
Encrypt and manage keys	AWS KMS
Store and rotate secrets	AWS Secrets Manager
SSL/TLS certificates	AWS Certificate Manager
Detect threats	Amazon GuardDuty
Scan vulnerabilities	Amazon Inspector
Discover sensitive data in S3	Amazon Macie
Web application firewall	AWS WAF
DDoS protection	AWS Shield
Best-practice recommendations	AWS Trusted Advisor

Domain 2 patterns

If the question asks who manages the physical security of AWS data centers, answer AWS.
If it asks who configures IAM permissions, answer customer.
If it asks for API activity history, choose CloudTrail.
If it asks for CPU metrics and alarms, choose CloudWatch.
If it asks for resource compliance drift, choose AWS Config.
If it asks for downloadable compliance reports, choose AWS Artifact.
If it asks for DDoS protection, choose AWS Shield.
If it asks for SQL injection or cross-site scripting filtering, choose AWS WAF.
If it asks for sensitive data discovery in S3, choose Macie.
If it asks for vulnerability scanning of EC2/container workloads, choose Inspector.

Domain 2 traps

Trap	Correct reasoning
CloudTrail vs CloudWatch	CloudTrail records API calls; CloudWatch monitors metrics/logs/alarms.
CloudWatch vs Config	CloudWatch tells what is happening operationally; Config tracks configuration history and compliance.
WAF vs Shield	WAF filters web requests; Shield protects against DDoS.
GuardDuty vs Inspector	GuardDuty detects threats; Inspector scans vulnerabilities.
KMS vs Secrets Manager	KMS manages encryption keys; Secrets Manager stores/rotates secrets.
IAM role vs IAM user	Roles provide temporary credentials and are preferred for AWS services.
SCP vs IAM policy	SCP sets account permission boundaries; IAM policy grants permissions within those boundaries.
Artifact vs Audit Manager	Artifact provides reports/agreements; Audit Manager helps collect evidence for audits.

Domain 3: Cloud Technology and Services

Concepts

This is the largest domain. It tests whether you can identify major AWS services and choose the correct one for a scenario.

AWS global infrastructure

Component	Meaning
Region	Separate geographic area containing multiple Availability Zones
Availability Zone	Isolated location within a Region
Edge location	Site used by CloudFront and edge services to reduce latency
Local Zone	Places selected AWS resources close to large population centers
Wavelength Zone	AWS infrastructure at 5G telecom edge
Outposts	AWS infrastructure deployed on premises

Compute services

Service	Best use	Avoid when
Amazon EC2	Full control over virtual servers	You want fully serverless execution
AWS Lambda	Event-driven, short-running serverless code	You need long-running full OS control
Amazon ECS	Container orchestration on AWS	You specifically need Kubernetes APIs
Amazon EKS	Managed Kubernetes	You do not need Kubernetes complexity
AWS Fargate	Serverless containers	You need direct server/host control
Elastic Beanstalk	Easy app deployment with managed platform	You need deep infrastructure customization
Amazon Lightsail	Simple VPS for small workloads	You need enterprise-scale architecture

Storage services

Service	Type	Best use
Amazon S3	Object storage	Static websites, backups, data lakes, objects
Amazon EBS	Block storage	Persistent volumes for EC2
Amazon EFS	File storage	Shared Linux file system across EC2
Amazon FSx	Managed file systems	Windows File Server, Lustre, NetApp ONTAP, OpenZFS
S3 Glacier	Archive storage	Low-cost long-term archives
Storage Gateway	Hybrid storage	Connect on-premises environments to AWS storage
AWS Backup	Centralized backup	Backup automation across AWS services
AWS DataSync	Data movement	Move large datasets to/from AWS

Database services

Service	Best use
Amazon RDS	Managed relational databases
Amazon Aurora	High-performance AWS-compatible relational database
Amazon DynamoDB	Serverless key-value/document database with low latency
Amazon Redshift	Data warehouse and analytics
Amazon ElastiCache	In-memory cache
Amazon Neptune	Graph database
Amazon DocumentDB	MongoDB-compatible document database
Amazon QLDB	Ledger database

Networking and content delivery

Service	Best use
Amazon VPC	Isolated virtual network
Subnets	Segment VPC resources
Security Groups	Instance-level virtual firewall
Network ACLs	Subnet-level stateless firewall
Route 53	DNS and domain routing
CloudFront	CDN and edge caching
Elastic Load Balancing	Distribute traffic across targets
Direct Connect	Dedicated private connection to AWS
Site-to-Site VPN	Encrypted connection over internet
Transit Gateway	Central hub for VPC/on-premises connectivity
API Gateway	Managed APIs, often with Lambda

Integration and application services

Service	Best use
Amazon SQS	Message queue and decoupling
Amazon SNS	Pub/sub notifications
Amazon EventBridge	Event bus and event-driven integration
AWS Step Functions	Workflow orchestration
Amazon MQ	Managed message broker for existing broker-based apps
AWS AppSync	Managed GraphQL APIs

Analytics, ML, and business applications

Service	Best use
Amazon Athena	Query S3 data with SQL
AWS Glue	Serverless data integration/ETL and catalog
Amazon Kinesis	Streaming data ingestion and processing
Amazon EMR	Big data frameworks such as Spark/Hadoop
Amazon QuickSight	Business intelligence dashboards
Amazon SageMaker	Build/train/deploy ML models
Amazon Bedrock	Generative AI foundation models
Amazon Lex	Chatbots
Amazon Polly	Text-to-speech
Amazon Transcribe	Speech-to-text
Amazon Translate	Translation
Amazon Comprehend	NLP and text insights
Amazon Connect	Cloud contact center
Amazon WorkSpaces	Virtual desktops
Amazon AppStream 2.0	Stream desktop applications

Domain 3 patterns

Need simple object storage → S3.
Need EC2 boot volume or database volume → EBS.
Need shared Linux file system → EFS.
Need archive rarely accessed data → S3 Glacier.
Need managed relational database → RDS/Aurora.
Need NoSQL key-value with single-digit millisecond latency → DynamoDB.
Need data warehouse analytics → Redshift.
Need in-memory caching → ElastiCache.
Need DNS → Route 53.
Need CDN → CloudFront.
Need dedicated private network connection → Direct Connect.
Need encrypted tunnel over internet → VPN.
Need decoupled queue → SQS.
Need fanout notifications → SNS.
Need event routing → EventBridge.
Need workflow state machine → Step Functions.

Domain 3 traps

Trap	Correct reasoning
S3 vs EBS	S3 is object storage; EBS is block storage for EC2.
EBS vs EFS	EBS attaches to EC2 as a volume; EFS is shared file storage.
RDS vs DynamoDB	RDS is relational SQL; DynamoDB is NoSQL key-value/document.
Redshift vs RDS	Redshift is analytics warehouse; RDS is transactional database.
CloudFront vs Route 53	CloudFront caches/delivers content; Route 53 resolves DNS.
Direct Connect vs VPN	Direct Connect is dedicated private connectivity; VPN uses encrypted internet tunnel.
SQS vs SNS	SQS queues messages; SNS publishes notifications to subscribers.
Lambda vs EC2	Lambda is serverless event execution; EC2 gives server control.
ECS vs EKS	ECS is AWS-native containers; EKS is Kubernetes.
Glue vs Athena	Glue catalogs/transforms data; Athena queries S3 with SQL.

Domain 4: Billing, Pricing, and Support

Concepts

This domain tests whether you can identify the right cost, billing, and support tool.

Pricing models

Model	Best for
On-Demand	Flexible workloads with no long-term commitment
Reserved Instances	Steady-state EC2/RDS usage with commitment
Savings Plans	Flexible compute savings with usage commitment
Spot Instances	Fault-tolerant workloads that can be interrupted
Dedicated Hosts	Compliance/licensing requiring physical server visibility
Free Tier	Initial exploration within usage limits

Cost and billing tools

Need	Tool
Estimate before deployment	AWS Pricing Calculator
Analyze historical and current cost	AWS Cost Explorer
Set cost/usage alerts	AWS Budgets
View bills and invoices	AWS Billing Dashboard
Allocate costs by team/project	Cost allocation tags
Programmatic cost data	Cost and Usage Report
Find optimization recommendations	Trusted Advisor / Compute Optimizer
Buy third-party software/services	AWS Marketplace

Support plans

Plan	Typical use
Basic	Account/billing support, docs, whitepapers
Developer	Business-hours technical support for testing/development
Business	24/7 technical support and production workloads
Enterprise On-Ramp	Production/business-critical support with faster access than Business
Enterprise	Mission-critical workloads, TAM, fastest response levels

Domain 4 patterns

Need future cost estimate → Pricing Calculator.
Need visualize past/current spend → Cost Explorer.
Need alert when spend exceeds threshold → Budgets.
Need architecture best-practice checks → Trusted Advisor.
Need third-party AMIs/software → Marketplace.
Need production technical support 24/7 → Business or higher.
Need TAM → Enterprise support.

Domain 4 traps

Trap	Correct reasoning
Pricing Calculator vs Cost Explorer	Calculator estimates future workloads; Cost Explorer analyzes actual spend.
Budgets vs Cost Explorer	Budgets alerts on thresholds; Cost Explorer visualizes and analyzes costs.
Trusted Advisor vs Compute Optimizer	Trusted Advisor covers broad best practices; Compute Optimizer focuses compute recommendations.
Reserved Instances vs Savings Plans	RIs are more specific; Savings Plans are more flexible for compute usage.
Spot vs Reserved	Spot is interruptible and cheap; Reserved is committed and predictable.
Basic support vs Developer	Basic does not include general technical support cases.

5. Service Selection Guide

Security and Governance

Scenario	Choose	Why
User needs temporary access to AWS resources	IAM role	Uses temporary credentials
Enforce permission limits across accounts	SCP	Applies at organization/account boundary
Govern many accounts quickly	AWS Control Tower	Landing zone and guardrails
Find API caller history	CloudTrail	Records API calls
Detect non-compliant resource config	Config	Tracks configuration and rules
Download AWS compliance reports	Artifact	Compliance reports and agreements
Encrypt data with managed keys	KMS	Key management service
Rotate database credentials	Secrets Manager	Secret storage and rotation
Detect compromised credentials or unusual activity	GuardDuty	Threat detection
Scan workloads for vulnerabilities	Inspector	Vulnerability management
Find PII in S3	Macie	Sensitive data discovery
Protect web app from SQL injection/XSS	WAF	Layer 7 web request filtering
Protect against DDoS attacks	Shield	DDoS protection

Compute

Scenario	Choose	Why
Need virtual machine with OS control	EC2	Full compute control
Need event-driven serverless execution	Lambda	No server management
Need simple app deployment	Elastic Beanstalk	Platform handles deployment
Need simple VPS	Lightsail	Simplified compute bundle
Need containers without managing servers	Fargate	Serverless container runtime
Need Kubernetes	EKS	Managed Kubernetes
Need AWS-native container orchestration	ECS	Integrated AWS container service

Storage

Scenario	Choose	Why
Store files, images, backups, logs	S3	Durable object storage
Persistent disk for EC2	EBS	Block storage
Shared Linux file system	EFS	Multi-instance file access
Windows file shares	FSx for Windows File Server	Managed SMB file system
Long-term archive	S3 Glacier	Low-cost archival
Hybrid on-premises storage	Storage Gateway	Connects on-premises apps to AWS storage
Move large data sets	DataSync / Snowball	Online/offline migration options

Databases

Scenario	Choose	Why
Managed MySQL/PostgreSQL/SQL Server	RDS	Managed relational database
High-performance cloud-native relational	Aurora	AWS-optimized relational database
Serverless NoSQL key-value	DynamoDB	Low-latency NoSQL
Analytics warehouse	Redshift	Columnar analytics
Cache frequent reads	ElastiCache	In-memory performance
Graph relationships	Neptune	Graph database
MongoDB-compatible document workload	DocumentDB	Managed document database

Networking

Scenario	Choose	Why
Isolate cloud network	VPC	Private network boundary
Control instance inbound/outbound traffic	Security Group	Stateful instance firewall
Control subnet traffic	Network ACL	Stateless subnet firewall
DNS and domain routing	Route 53	Managed DNS
CDN and edge caching	CloudFront	Low-latency content delivery
Dedicated private connection	Direct Connect	Private network link
Encrypted connection over internet	VPN	Encrypted tunnel
Hub for multiple VPCs	Transit Gateway	Central connectivity

6. Architecture Patterns