CLF-C02
Deep Dive
Monitoring and management services are essential to operating on AWS. The CLF-C02 especially tests the difference between CloudWatch (monitoring), CloudTrail (auditing), and Config (compliance), which are frequently confused.
Contents
Monitoring and observability for AWS resources and applications
Amazon CloudWatch collects and tracks metrics, collects and monitors log files, sets alarms, and automatically reacts to changes in your AWS resources and applications.
CloudWatch components
Metrics
Numeric data published by AWS services. E.g. EC2 CPUUtilization, S3 NumberOfObjects, RDS ReadLatency. Free by default every 5 minutes.
Detailed Monitoring
EC2 sends metrics every 1 minute (instead of 5) at an extra cost. Useful for more reactive Auto Scaling.
Alarms
Trigger actions when a metric crosses a threshold. Actions: notify via SNS, run Auto Scaling, stop/start EC2 instances.
Logs
Centralizes logs from Lambda, EC2, RDS, ECS, etc. CloudWatch Logs Insights lets you query logs.
Dashboards
Visual panels with metric graphs. Shareable across teams.
Events / EventBridge
Reacts to state changes in AWS services (e.g. EC2 starts → triggers Lambda).
Key metrics by service
| Service | Key metrics |
|---|---|
| EC2 | CPUUtilization, NetworkIn/Out, DiskRead/WriteOps |
| RDS | DatabaseConnections, ReadLatency, FreeStorageSpace |
| Lambda | Invocations, Duration, Errors, Throttles |
| S3 | BucketSizeBytes, NumberOfObjects (not real-time) |
| ELB | RequestCount, Latency, HTTP4XXCount, HTTP5XXCount |
| DynamoDB | ConsumedReadCapacityUnits, ThrottledRequests |
Exam trap
CloudWatch does NOT monitor EC2 RAM usage by default. For memory, you must install the CloudWatch Agent on the instance. Same for detailed disk metrics.
Audit trail for API calls in your AWS account
AWS CloudTrail records actions taken by users, roles, or AWS services. Every API call is logged as an event in CloudTrail. Enabled by default for the last 90 days (Management Events).
What each CloudTrail event captures
Types of events in CloudTrail
Management Events (control plane)
Resource management operations: CreateEc2Instance, CreateS3Bucket, DeleteIAMUser. Enabled by default.
Data Events (data plane)
Operations on data: S3 GetObject/PutObject, Lambda InvokeFunction. Not enabled by default (high volume).
Insights Events
Detects unusual API activity (spikes in calls, anomalous behavior).
Provisions AWS infrastructure through declarative templates
AWS CloudFormation lets you model and provision all your AWS infrastructure resources using code (JSON or YAML templates). All infrastructure is treated as versioned, repeatable code.
Templates
JSON or YAML files that describe the resources you need. Define once, deploy to any region.
Stacks
CloudFormation's unit of deployment. A stack = a set of related resources created from a template.
Change Sets
Preview what changes will be made to a stack before applying them. Avoids surprises in production.
CloudFormation benefits for the exam
Assesses and records AWS resource configurations for compliance
AWS Config provides a detailed inventory of your AWS resources and their historical configuration. It lets you evaluate configurations against compliance rules and alert you when there's drift.
AWS Config rules (examples)
Use cases
Unified management for EC2 instances and on-premises resources
Session Manager
SSH/RDP access to EC2 instances without opening ports (no inbound Security Groups). No bastion host needed.
Parameter Store
Secure storage for configuration and secrets (strings, numbers, encrypted SecureString). Free.
Patch Manager
Automates patching of operating systems and applications on EC2 and on-premises instances.
Run Command
Runs scripts or commands across multiple instances simultaneously without direct SSH access.
Create an encrypted, hierarchical parameter to centralize configuration without touching code.
+1 more...
Centralized management for multiple AWS accounts
AWS Organizations lets you consolidate multiple AWS accounts into an organization that you create and centrally manage. It enables consolidated billing, centralized security policies, and workload isolation.
Consolidated Billing
A single bill for all accounts. Volume discounts consolidated across every account in the organization.
Service Control Policies (SCPs)
Policies that set the MAXIMUM permissions available to accounts or Organizational Units. Not even the account root can bypass an SCP.
Organizational Units (OUs)
Groupings of accounts (e.g. Production-OU, Development-OU). Apply SCPs at the OU level to control multiple accounts at once.
Create an organization and add a member account to an organizational unit (OU) for centralized management.
+1 more...
Automated advisor to optimize your AWS account
Trusted Advisor analyzes your AWS account and gives recommendations across 5 categories. Available checks depend on your support plan.
Cost Optimization
Underutilized resources (low-CPU EC2 instances, unused Reserved Instances, unattached EBS volumes)
Performance
Recommendations to improve performance (high-utilization instances, CloudFront distributions with a high error rate)
Security
Insecure configurations: MFA not enabled on root, open Security Groups (0.0.0.0/0), publicly accessible S3
Fault Tolerance
Improve resilience: RDS without Multi-AZ, EC2 not spread across multiple AZs, outdated EBS backups
Service Limits
Warns when you approach AWS service limits (quotas): number of VPCs, EC2 instances per region
Checks by support plan
Basic/Developer: ~7 checks (mainly security and service limits). Business/Enterprise: the full set of checks.
| Dimension | CloudWatch | CloudTrail | AWS Config |
|---|---|---|---|
| Purpose | Performance monitoring | API call auditing | Configuration compliance |
| Question it answers | "How is my infrastructure performing right now?" | "Who did what, and when?" | "Is my infrastructure configured correctly?" |
| Data type | Numeric metrics (CPU, requests) | API call events | Resource configuration state |
| Time | Real time and trends | Historical event log | History of configuration changes |
| Alerts | Yes — Alarms when a metric crosses a threshold | Via CloudWatch Events or EventBridge | Yes — when a resource drifts out of compliance |
| Typical use case | CPU at 95%, alarm notifies the ops team | "Who deleted the S3 bucket?" | "Which EC2 instances aren't encrypted?" |
Set up monitoring and automatic alerts with Amazon CloudWatch.
+1 more...
Did you get this topic?
Test what you just learned
A security team needs to know the current encryption status of every RDS instance in the AWS account, and be notified when an RDS instance is created without encryption enabled. Which AWS service satisfies this requirement?
Put what you learned to the test with original CLF-C02 exam questions.
Start CLF-C02 mock examUnlimited mock exams with the Pro plan
Log in to track your progress.