AWS Certified Cloud Practitioner (CLF-C02)

CLF-C02 Exam Prep Notes

Based on the official exam guide scope as of October 2026About 30 min read

A complete summary of the CLF-C02 exam scope, short enough to reread in the last 30 minutes before the exam. Use it as a final check after working through all four domains in the learning course and finding your weak spots with the practice questions. Read the table that maps question cues to the right answer, and the wrong-answer patterns and traps, first.

Exam facts and approach

The exam has 65 questions in 90 minutes, of which 50 are scored, and you cannot tell which 15 questions are unscored.
Results are reported as a scaled score from 100 to 1,000, and the passing score is 700.
Scoring is compensatory, so there is no per-domain passing line and you only need 700 overall.
There are two question types: multiple choice with one answer out of four options, and multiple response with two or more answers out of five or more options.
Unanswered questions are scored as incorrect and there is no penalty for guessing, so answer every question.
The domain weights are Cloud Technology and Services 34%, Security and Compliance 30%, Cloud Concepts 24%, and Billing, Pricing, and Support 12%.
The target candidate has up to about six months of exposure to AWS, and coding, architecture design, and troubleshooting are out of scope.
The core skills tested are matching services to use cases and judging whether a responsibility belongs to AWS or to the customer.
Superlatives such as most cost-effective or least operational overhead decide between the last two options.

Question cues and the right answer

Cue in the question	Direction of the answer
Automatically add or remove instances to match demand	Amazon EC2 Auto Scaling (elasticity)
Distribute traffic across multiple instances	Elastic Load Balancing
Run code briefly on events without managing servers	AWS Lambda
Run containers without managing servers	AWS Fargate
Run interruptible workloads at the lowest cost	Spot Instances
Steady workload for one or three years	Reserved Instances or Savings Plans
Keep the discount even if instance type or Region changes	Compute Savings Plans
Bring per-socket licenses and dedicate a physical server	Dedicated Hosts
Find out who called which API and when	AWS CloudTrail
Record resource configuration changes and check rule compliance	AWS Config
Watch metrics such as CPU utilization and raise alarms	Amazon CloudWatch
Obtain audit reports such as SOC or PCI DSS	AWS Artifact
Protect against DDoS attacks	AWS Shield
Block web attacks such as SQL injection	AWS WAF
Detect suspicious traffic or unusual account activity	Amazon GuardDuty
Scan EC2 or container images for vulnerabilities	Amazon Inspector
Find personal data in data stored in S3	Amazon Macie
Store database passwords and rotate them automatically	AWS Secrets Manager
Combine bills for multiple accounts and share discounts	Consolidated billing in AWS Organizations
Get notified when spending is about to exceed a budget	AWS Budgets
Analyze past spending trends by service	AWS Cost Explorer
Estimate the monthly cost before you start	AWS Pricing Calculator
Check cost and security best practices	AWS Trusted Advisor
Connect on-premises over a dedicated line with steady bandwidth	AWS Direct Connect
Quickly set up an encrypted connection over the internet	AWS Site-to-Site VPN
Deliver content to users worldwide with low latency	Amazon CloudFront
Resolve domain names and fail over with health checks	Amazon Route 53
Store data with unknown or changing access patterns	S3 Intelligent-Tiering
Data kept for years and almost never retrieved	S3 Glacier Deep Archive
Shared files mounted by multiple EC2 instances at once	Amazon EFS
Migrate a database to AWS without downtime	AWS DMS (plus AWS SCT if the engine changes)
Build the same infrastructure repeatedly from code	AWS CloudFormation
Decouple processing and queue messages for later	Amazon SQS
Deliver one notification to many recipients at once	Amazon SNS
Keep the service running through a single point of failure	Spread across multiple Availability Zones

Wrong-answer patterns

Rule out any option that makes data center security or physical hardware maintenance the customer's responsibility.
Rule out any option that makes patching the EC2 guest OS the responsibility of AWS.
Rule out mix-ups such as checking CPU utilization in CloudTrail or finding who made a change in CloudWatch.
Rule out any option that uses the root user for everyday tasks.
Rule out granting broad permissions first and narrowing them later, because it violates the principle of least privilege.
Rule out any option that writes access keys directly into code or configuration files.
Rule out choosing Spot Instances for workloads that cannot be interrupted.
Rule out choosing Reserved Instances for short, unpredictable workloads.
Rule out any option that claims high availability with resources in a single Availability Zone.
Rule out any option that names forecasting and reserving capacity in advance as a cloud benefit.
When asked for the least operational overhead, rule out installing and running software yourself on EC2.
Rule out any option that says Basic Support includes technical support cases.
Rule out the reversed pairing of Budgets for past analysis and Cost Explorer for budget alerts.
Rule out choosing Shield against SQL injection or Inspector as the main DDoS defense.
Rule out any option that writes deny rules in a security group.
Rule out any option that treats edge locations as the same thing as Availability Zones.
When the goal is the fastest migration, rule out refactoring, which rebuilds the application.

Key points by domain

Domain 1 Cloud Concepts (24%)

The six advantages of cloud computing are no upfront investment, economies of scale, no need to guess capacity, agility, no data center operations, and global deployment in minutes.
Elasticity is the ability to follow demand automatically, and scalability is the ability to increase or decrease capacity.
High availability means the system rarely goes down, and fault tolerance means it keeps working even when a failure occurs.
The six pillars of the Well-Architected Framework are operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.
Recovering from failures is reliability, choosing the right resources is performance efficiency, eliminating waste is cost optimization, and reducing environmental impact is sustainability.
The six perspectives of the AWS CAF are business, people, governance, platform, security, and operations.
The benefits named by the AWS CAF are reduced business risk, improved ESG performance, increased revenue, and increased operational efficiency.
The 7 Rs of migration are rehost, replatform, refactor, repurchase, retire, retain, and relocate.
Cloud economics turn fixed costs into variable costs, allow rightsizing to actual usage, and cut manual work through automation.
For licensing, you can bring your own licenses (BYOL) or use license-included pricing.

Domain 2 Security and Compliance (30%)

AWS is responsible for security of the cloud (physical facilities, hardware, and the virtualization layer), and the customer is responsible for security in the cloud (data, IAM, OS, and network settings).
The boundary shifts by service: on EC2 the customer owns everything from the OS up, on RDS AWS patches the OS and database, and on Lambda AWS manages the runtime environment.
The shared controls between AWS and the customer are patch management, configuration management, and awareness and training.
In IAM, a user is a person or app, a group gives the same permissions to many users, a role is a set of temporary permissions you assume, and a policy is a JSON document that defines permissions.
Protect the root user with MFA, create no access keys for it, and use it only for root-only tasks such as closing the account, changing the account name or email address, and activating IAM access to billing information.
IAM Identity Center provides single sign-on to multiple accounts and federation with external identities, and Amazon Cognito handles sign-up and sign-in for app users.
The customer enables encryption at rest (AWS KMS keys) and in transit (TLS), and stores credentials in Secrets Manager or Systems Manager Parameter Store.
Logging and auditing use CloudTrail (API records), Config (configuration records and compliance), CloudWatch (monitoring), and IAM access reports.
GuardDuty covers threats, Inspector vulnerabilities, Security Hub aggregated findings, Shield DDoS, WAF web attacks, and Firewall Manager central rule deployment.
Get compliance reports from AWS Artifact and find third-party security products in AWS Marketplace.

Domain 3 Cloud Technology and Services (34%)

You use AWS through the Management Console, CLI, SDKs, APIs, and infrastructure as code, and the three deployment models are cloud, hybrid, and on-premises.
Each Region has multiple AZs that share no single point of failure, and edge locations deliver content close to users.
The reasons to use multiple Regions are disaster recovery, business continuity, low latency for users, and data sovereignty.
For compute, choose among EC2 (instance types by use case), Lambda, ECS and EKS (containers), and Fargate (containers without managing servers).
Databases are RDS and Aurora (relational), DynamoDB (NoSQL), and ElastiCache (in-memory), and you self-install on EC2 only when you must manage the OS or engine yourself.
A VPC is built from subnets and gateways, security groups are stateful at the instance level, and network ACLs are stateless at the subnet level.
Storage is S3 (object), EBS (block in one AZ), instance store (temporary), EFS and FSx (file), and Storage Gateway (connection to on-premises).
S3 Standard, Standard-IA, Glacier Flexible Retrieval, and Glacier Deep Archive get cheaper and slower to retrieve in that order, and lifecycle policies move data between them automatically.
For AI and analytics, choose among SageMaker AI, Lex, Textract (extracting text from documents), Translate (translation), Athena, Kinesis, Glue, and Amazon Quick Sight by use case.
For integration, use SQS (queue messages), SNS (notify many recipients), and EventBridge (route events by rules), and AWS Backup manages backups centrally.

Domain 4 Billing, Pricing, and Support (12%)

The seven purchase options are On-Demand, Reserved Instances, Savings Plans, Spot Instances, Dedicated Hosts, Dedicated Instances, and Capacity Reservations.
Savings Plans commit to an hourly spend for one or three years and are more flexible than Reserved Instances, and both discounts are shared within the organization through consolidated billing.
Data transfer from the internet into AWS is free, while transfer out of AWS, between Regions, and across AZs within the same Region is charged.
Use Budgets for budget alerts, Cost Explorer for past analysis, and Pricing Calculator for estimates before you start.
Cost allocation tags include AWS-generated tags and user-defined tags, and once activated they let you break down costs in reports such as the AWS Cost and Usage Report.
The support plans are the free Basic Support and the paid Business Support+, Enterprise Support, and Unified Operations (as of October 2026).
Trusted Advisor checks cost optimization, performance, security, fault tolerance, service quotas, and operational excellence.
Find technical information in whitepapers, blogs, documentation, AWS Prescriptive Guidance, AWS Knowledge Center, and AWS re:Post.
AWS Health Dashboard and the AWS Health API tell you how AWS outages and scheduled maintenance affect your environment.
Report abuse of AWS resources to the Trust and Safety team, and get adoption help from the AWS Partner Network, Marketplace, and Professional Services.

Services in one line

Name	In one line
Amazon Q	Generative AI assistant that answers business and development questions
AWS Config	Resource configuration history and compliance evaluation
AWS CloudTrail	Record of API activity (who, when, what)
Amazon CloudWatch	Monitoring with metrics, logs, and alarms
AWS Trusted Advisor	Best-practice checks and improvement recommendations
AWS Security Hub	Security findings aggregated in one place
Amazon Inspector	Automated vulnerability scanning of EC2 and container images
AWS Firewall Manager	Apply WAF and other rules across multiple accounts at once
AWS Control Tower	Automatically set up a governed multi-account environment
AWS Global Accelerator	Optimize traffic paths over the AWS network (no caching)
AWS Application Migration Service	Move servers to AWS as they are (rehost)
AWS Outposts	AWS infrastructure in your own data center
AWS Elastic Beanstalk	Upload code and get a runtime environment
AWS IAM Identity Center	Single sign-on to multiple accounts
Amazon Rekognition	Image and video analysis
Amazon Comprehend	Extract sentiment and entities from text
Amazon Polly	Text to speech
Amazon Transcribe	Speech to text

Top 15 traps

An Availability Zone is not a single data center but a group of one or more data centers.
Activating IAM access to billing information cannot be done by an IAM user with administrator permissions, only by the root user.
Config records resource configuration changes and compliance status, not who made the change.
Security groups are stateful with allow rules only, while network ACLs are stateless and support both allow and deny rules.
Patching the RDS operating system is the responsibility of AWS, not the customer.
Whether an S3 bucket is public is the customer's responsibility, not AWS.
Savings Plans commit to an hourly spend, not to a number of instances.
Transfer out of AWS is what gets charged, and an option that says transfer from the internet into AWS is paid is a distractor.
Basic Support is free but does not include technical support cases.
AWS Artifact is where you get reports, not where audit logs are stored (that is CloudTrail).
EBS is block storage in one AZ, and shared files for multiple instances call for EFS.
Instance store data is lost when the instance stops or terminates, so choosing it for persistent storage is a distractor.
CloudFront caches and delivers content, while Global Accelerator optimizes traffic paths without caching.
Choose a Region not by price alone but by regulatory compliance, proximity to users, and service availability.
Consolidated billing combines bills, while service control policies (SCPs) restrict what accounts can do.

Last-minute checklist

I can state the number of questions, the exam time, the number of scored questions, and the passing score.
I can name the four domains and their weights.
I can name the six advantages of cloud computing.
I can name the six pillars of the Well-Architected Framework.
I can name the six perspectives of the AWS CAF.
I can name the 7 Rs of migration.
I can explain the difference between elasticity and scalability in one sentence.
I can explain the difference between high availability and fault tolerance in one sentence.
I can name three AWS responsibilities and three customer responsibilities in the shared responsibility model.
I can explain how the customer's responsibility changes across EC2, RDS, and Lambda.
I can name two tasks that only the root user can perform.
I can name three ways to protect the root user.
I can explain the differences among IAM users, groups, roles, and policies.
I can explain CloudWatch, CloudTrail, and Config in one sentence each.
I can state the role of GuardDuty, Inspector, Macie, Shield, and WAF in one word each.
I can name two differences between security groups and network ACLs.
I can explain how Regions, Availability Zones, and edge locations relate.
I can name three reasons to use multiple Regions.
I can explain the differences among S3, EBS, EFS, and instance store.
I can name four S3 storage classes from most to least frequently retrieved.
I can explain when to use RDS, Aurora, DynamoDB, and ElastiCache.
I can explain the differences among SQS, SNS, and EventBridge.
I can name the seven EC2 purchase options and when the main ones fit.
I can explain when to use Budgets, Cost Explorer, and Pricing Calculator.
I can name the four support plans.
I can name three categories that Trusted Advisor checks.
I can explain the difference between Direct Connect and Site-to-Site VPN.
I can say where to report abuse of AWS resources.