Complete Guide
CLF-C02 AWS Cloud Practitioner
Tap any service to see more details and official docs.
Exam breakdown
40–60
Questions
~45
Min read
700
Passing score
Cloud Concepts
24% of the examThe 6 advantages of the AWS cloud
CapEx → OpEx
Stop investing in hardware. Pay only for what you use.
Economies of scale
AWS aggregates millions of customers → lower prices.
Stop guessing capacity
Scale exactly to actual demand.
Agility
New resources in minutes, not weeks.
No datacenter to run
No more rack, electricity, and staffing costs.
Global reach
Deploy across multiple regions in minutes.
Deployment models
| Model | Description | When |
|---|---|---|
| ☁️ Public cloud | Everything on AWS, no own infrastructure | Startups, new apps, variable workloads |
| 🏢 On-premises | Own infrastructure managed with AWS software (Outposts) | Strict compliance, ultra-low latency |
| 🔀 Hybrid | Mix of public cloud + on-premises connected | Gradual migration, sensitive data on-premises |
AWS global infrastructure
| Component | Description |
|---|---|
| Regions | Geographic areas with multiple AZs (e.g. us-east-1). 33+ global regions. |
| Availability Zones | One or more physically separated datacenters within a region. Minimum 3 per region. |
| Edge Locations | Points of presence for CloudFront CDN and Route 53. 400+ worldwide. |
| Local Zones | Region extensions for ultra-low latency in specific cities. |
| Wavelength Zones | AWS infrastructure on 5G networks for ultra-low latency applications. |
Regions vs AZs vs Edge Locations shows up in nearly every CLF-C02 exam. A region has a minimum of 3 AZs. Edge Locations are only for CDN (CloudFront) — not for deploying EC2.
Security and Compliance
30% of the examShared Responsibility Model
AWS and the customer share responsibility for security. The split varies by service.
🏢 AWS — Security OF the cloud
- • Hardware and physical infrastructure
- • Global networks and datacenters
- • Hypervisors and virtualization
- • Managed services software
👤 Customer — Security IN the cloud
- • Customer data
- • EC2 OS, patches, antivirus
- • IAM, users, roles, policies
- • Network configuration (SG, NACL)
IAM — Identity and access
Click any service to see more details
👤 Users
A person or service with its own credentials
👥 Groups
A collection of users with common permissions
🎭 Roles
An identity that services or users can assume
📋 Policies
JSON documents that define Allow/Deny
AWS security services
| Service | Function |
|---|---|
| AWS Shield | DDoS protection. Standard is free for everyone. Advanced for critical apps. |
| AWS WAF | Web application firewall. Filters malicious HTTP/S traffic. |
| Amazon Inspector | Automated vulnerability scanning for EC2, containers, and Lambda. |
| Amazon GuardDuty | ML-powered threat detection analyzing VPC, CloudTrail, and DNS logs. |
| AWS KMS | Key Management Service — manages encryption keys for all services. |
| AWS Secrets Manager | Stores and automatically rotates secrets (DB passwords, API keys). |
| Amazon Macie | Discovers and protects sensitive data (PII) in S3 using ML. |
AWS Shield Standard (free) protects against layer 3/4 DDoS attacks. AWS Shield Advanced (paid) protects layer 7, and includes support from AWS's DDoS Response Team.
AWS Technology and Services
34% of the examCompute
Click any service to see more details
| Service | Type | Use case |
|---|---|---|
| Amazon ECS | Containers | Docker container orchestration on AWS |
| Amazon EKS | Kubernetes | Managed Kubernetes on AWS |
| AWS Fargate | Serverless containers | Run containers without managing servers |
| AWS Elastic Beanstalk | PaaS | Deploy web apps without managing infrastructure |
| Amazon Lightsail | Simple VPS | Simple servers with predictable fixed pricing |
Storage
Click any service to see more details
Networking and content delivery
Click any service to see more details
Monitoring and management
Application integration
| Service | Pattern | When |
|---|---|---|
| Amazon SNS | Pub/Sub (fan-out) | Push notifications to multiple subscribers simultaneously |
| Amazon SQS | Message queue | Decouple producer and consumer; buffer against load spikes |
| Amazon EventBridge | Event Bus | Route events between AWS services and third-party apps |
| AWS Step Functions | Orchestration | Coordinate multiple Lambdas or services in workflows |
Artificial Intelligence and Machine Learning
| Service | Function |
|---|---|
| Amazon Rekognition | Image and video analysis: objects, faces, text, moderation |
| Amazon Lex | Conversational chatbots — Alexa's technology, understands intent |
| Amazon Polly | Text-to-speech (TTS) with natural voices in 30+ languages |
| Amazon Transcribe | Speech-to-text (STT), transcription with speaker diarization |
| Amazon Comprehend | NLP: sentiment analysis, entity extraction, classification |
| Amazon Textract | Extracts structured text and tables from scanned documents |
| Amazon Kendra | Intelligent enterprise search — answers questions in natural language |
| Amazon SageMaker | A complete platform for building and training your own ML models |
D3 carries the most weight (34%). The exam will give a scenario and ask for the right service. Memorize: EC2 vs Lambda, S3 vs EBS vs EFS, RDS vs DynamoDB, CloudWatch vs CloudTrail vs Trusted Advisor, SNS vs SQS, Rekognition vs Textract.
Billing, Pricing, and Support
12% of the examPricing models
| Model | Description | Savings |
|---|---|---|
| On-Demand | Pay by the hour/second, no commitment. Maximum flexibility. | Base price |
| Reserved Instances | 1 or 3 year commitment. Full/partial/monthly payment. | Up to 72% |
| Savings Plans | Usage commitment ($/hour) for 1-3 years. More flexible than Reserved. | Up to 66% |
| Spot Instances | Spare AWS capacity. Can be interrupted with 2 minutes' notice. | Up to 90% |
| Dedicated Hosts | Dedicated physical server. For BYOL licensing or compliance. | Variable |
Cost management tools
AWS Cost Explorer
Visualize and analyze historical and projected spend. Identify trends and patterns.
AWS Pricing Calculator
Estimate costs BEFORE creating resources. Configure services, regions, and expected usage.
AWS Budgets
Create budgets with automatic email alerts when spending crosses thresholds.
Cost and Usage Report
Detailed cost report at the resource level. For deep analysis with Athena/Quick Sight. Today it is set up as CUR 2.0 in AWS Data Exports.
AWS support plans
| Plan | Access | Response time |
|---|---|---|
| Basic | Documentation, forums, Trusted Advisor (7 checks) | No SLA |
| Developer | Email to AWS Support during business hours | 12-24h |
| Business | 24/7 phone, full Trusted Advisor, AWS Health API | 1h for production |
| Enterprise On-Ramp | Pool of TAMs, Well-Architected reviews | 30 min for critical |
| Enterprise | Dedicated TAM, access to Infrastructure Event Management | 15 min for critical |
Full Trusted Advisor (all checks) requires Business Support or higher. Basic and Developer only have 7 security and service-limit checks.
Tips for exam day
AWS has 6 advantages of the cloud: trade CapEx for OpEx, economies of scale, stop guessing capacity, agility, no datacenter costs, global reach.
EC2 pricing models: On-Demand (flexible), Reserved (up to 72% discount), Spot (up to 90% discount, interruptible), Dedicated (physical compliance).
Shared Responsibility: AWS manages "security OF the cloud". You manage "security IN the cloud" (data, OS on EC2, applications, IAM).
IAM: never use root for daily operations. Use MFA. Principle of least privilege. Roles for services, not Access Keys.
S3 storage classes: Standard → Standard-IA → One Zone-IA → Glacier Instant → Glacier Flexible → Glacier Deep Archive (price drops, latency rises).
Security Groups = stateful (instance). NACLs = stateless (subnet). Security Groups only have Allow rules. NACLs have Allow and Deny.
CloudWatch = monitoring and metrics. CloudTrail = API call auditing. Trusted Advisor = recommendations. They are distinct services.
The AWS Well-Architected Framework has 6 pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.
Regions → Availability Zones (min 3 per region) → Data Centers. AZs are physically separated within the same region.
Support plans: Basic (free), Developer, Business, Enterprise On-Ramp, Enterprise. Business or higher for full access to Trusted Advisor. From 1/1/2027, Developer and Business move to Business Support+ and Enterprise On-Ramp to Enterprise.
Pre-trained AI: Rekognition=images, Lex=chatbot, Polly=text-to-speech, Transcribe=speech-to-text, Comprehend=NLP, Textract=documents, Kendra=search. SageMaker=custom ML.
SNS=fan-out pub/sub (one message to many). SQS=point-to-point queue (one message to one consumer). EventBridge=event bus for integration between services.
AWS Cloud Quest: Recertify Cloud Practitioner — an official game-based recertification option. Available on AWS Skill Builder as an alternative to the traditional exam for renewing your certification.
Want to go deeper?
This guide is a quick summary. Visit the Deep Dive section for an exhaustive walkthrough with real cases, cost analysis and architecture decisions.
Practice CLF-C02 with interactive simulations
Click-through labs: navigate a step-by-step portal simulation, with clear objectives and verification on every action — no real costs.
Ready to practice?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Was this guide helpful?
Not ready to start yet?
Leave your email and create your free account whenever you're ready — start with 15 CLF-C02 questions, no credit card required.
Already have an account? Go straight to the mock exam →