CLF-C02 Service Questions Are Selection Questions
The AWS Certified Cloud Practitioner exam feels wide because AWS is wide, but CLF-C02 does not expect you to administer every service. The official CLF-C02 exam guide says the target candidate demonstrates overall AWS Cloud knowledge, identifies core services for common use cases, and is not expected to code, troubleshoot, design architecture, or implement workloads. The same guide weights Cloud Technology and Services at 34% of scored content and Security and Compliance at 30%.
Together, Cloud Technology and Services and Security and Compliance account for 64% of scored content. AWS also publishes an in-scope services list, but the list is non-exhaustive and subject to change. A prep page that only dumps product names is not enough. You need category, use case, and elimination logic.
A Four-Step Method For Any AWS Service Question
Read the scenario before reading the answers. First, identify the job: compute, storage, database, networking, identity, monitoring, migration, analytics, AI, or billing. Second, identify the management level: customer-managed virtual server, managed platform, serverless, fully managed database, or SaaS-like business service. Third, identify the constraint: cost, durability, latency, global delivery, compliance, auditability, high availability, or hybrid connection. Fourth, identify whether the service is operational or financial. CloudWatch observes workloads; Cost Explorer analyzes spend.
This method works because CLF-C02 distractors are usually plausible. A question about audit history may include CloudWatch and CloudTrail. A storage question may include S3, EBS, and EFS. A DNS or delivery question may include Route 53 and CloudFront. You pass by explaining why the wrong service is wrong.
Compute: EC2, Lambda, Beanstalk, Containers, And Hybrid Clues
Amazon EC2 is virtual server compute. Choose it when the scenario needs operating system control, custom software, instance families, or lift-and-shift. Auto Scaling adjusts EC2 capacity. Elastic Load Balancing distributes traffic across targets. EC2 is foundational, but it is not the answer to every compute scenario.
AWS Lambda is event-driven serverless compute. Choose it when code runs in response to events and the customer does not want to manage servers. AWS Elastic Beanstalk is a managed application deployment service: developers upload code and AWS handles environment provisioning around it. Amazon Lightsail is simplified VPS hosting for small applications. AWS Batch is batch processing. AWS Outposts brings AWS infrastructure on premises for hybrid requirements.
Containers appear as separate service roles. Amazon ECS runs containers using AWS-native orchestration. Amazon EKS runs Kubernetes. Amazon ECR stores container images. AWS Fargate is serverless compute capacity for containers. The exam often asks a simple distinction: image registry versus container runtime, Kubernetes versus AWS-native orchestration, or serverless code versus containers.
Storage: Start With The Data Shape
Amazon S3 is object storage for static assets, backups, logs, images, documents, and data lakes. It is durable and managed, and S3 storage classes map cost to access patterns: frequent access, infrequent access, archive, and deep archive. You do not need to calculate a bill, but you should know that retrieval behavior and access frequency matter.
Amazon EBS is block storage for EC2 instances. Amazon EFS is shared file storage for Linux workloads. Amazon FSx is a family of managed file systems. Scope wording matters here: the current in-scope page lists Amazon FSx broadly, while AWS's out-of-scope page explicitly lists Amazon FSx for Lustre. Learn the general managed-file-service role for CLF-C02, but do not spend exam-prep time on Lustre-specific architecture. AWS Storage Gateway connects on-premises environments to AWS storage. AWS Backup centralizes backup management across supported services. Snow Family moves large datasets when network transfer is impractical.
The basic CLF-C02 storage trap is S3 versus EBS versus EFS. Object means S3. Block volume attached to EC2 means EBS. Shared file system means EFS or FSx, depending on the workload. Offline device transfer means Snow Family. Backup policy across services means AWS Backup.
Databases: Pick The Model Before The Brand
Amazon RDS is managed relational database service for engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. Amazon Aurora is AWS's cloud-optimized relational database compatible with MySQL and PostgreSQL. DynamoDB is a managed NoSQL key-value and document database for low-latency scale. ElastiCache is in-memory caching. Redshift is data warehousing and analytics. Neptune is graph database. DocumentDB supports MongoDB-compatible document workloads.
CLF-C02 gives you the data model. Relational tables and SQL point to RDS or Aurora. Key-value or document at massive scale points to DynamoDB. Analytics warehouse points to Redshift. Cache points to ElastiCache. Connected relationships point to Neptune. Do not pick a database because it is familiar; pick the database that matches the model and operating need.
Networking And Content Delivery: DNS, CDN, Private Network, Hybrid Link
Amazon VPC is the private network foundation. Subnets divide a VPC. Security groups are stateful virtual firewalls for resources. Network ACLs are stateless subnet-level controls. Route tables control routing. Internet gateways connect a VPC to the internet. NAT gateways let private subnet resources initiate outbound internet traffic.
Route 53 is DNS. CloudFront is a content delivery network. Elastic Load Balancing distributes application traffic. API Gateway creates and manages APIs. Direct Connect provides dedicated private connectivity from on-premises to AWS. Site-to-Site VPN uses encrypted connectivity over the internet. AWS Global Accelerator improves global application availability and performance through AWS edge networking.
The common pair is CloudFront versus Route 53. DNS name resolution or routing policy points to Route 53. Caching and delivering content globally points to CloudFront. Another pair is Direct Connect versus VPN: dedicated private connection versus encrypted internet connection.
Application Integration: Queue, Fan-Out, Event, Or Workflow
Application-integration questions are a major gap in many service summaries. Amazon SQS is a queue: producers place messages and consumers process them later, which decouples components and absorbs traffic spikes. Amazon SNS is push-based publish/subscribe: one publication can fan out to email, HTTP endpoints, Lambda, or SQS subscriptions. Amazon EventBridge matches events against rules and routes them from sources to targets. AWS Step Functions coordinates multi-step workflows with state, sequencing, retries, branching, and service integrations.
Use the noun in the scenario. A backlog that workers should pull from points to SQS. One alert distributed to many subscribers points to SNS. Events from AWS services or SaaS applications routed by rules point to EventBridge. A visual state machine coordinating several tasks points to Step Functions. Do not treat all four as interchangeable messaging products.
All four appear on AWS's current CLF-C02 in-scope services page. The Domain 3.8 task statement explicitly names EventBridge, SNS, and SQS, while Step Functions appears in the broader in-scope list rather than that task statement's examples. That placement does not make Step Functions optional or out of scope.
Security, Identity, And Compliance Are Core Service Questions
IAM controls users, groups, roles, policies, and least privilege. AWS Organizations centrally manages multiple accounts. IAM Identity Center helps manage workforce access across AWS accounts and applications. AWS KMS manages encryption keys. AWS Secrets Manager stores and rotates secrets. AWS Certificate Manager provisions SSL/TLS certificates. AWS Artifact provides compliance reports and agreements.
For detection and visibility, CloudTrail records API activity, CloudWatch collects metrics and logs and supports alarms, and AWS Config records resource configuration and compliance history. GuardDuty detects threats. Inspector scans for vulnerabilities. Macie helps discover and protect sensitive data in S3. WAF filters web requests. Shield helps with DDoS protection.
Tie every security answer to the shared responsibility model. AWS is responsible for security of the cloud: facilities, hardware, networking, and managed infrastructure. Customers are responsible for security in the cloud: data, identity, access, configurations, network rules, and guest operating systems on EC2. Managed services reduce operational work, but they do not remove customer responsibility for data and access choices.
Management, Migration, Analytics, AI, And Billing Services
CloudFormation is infrastructure as code. Systems Manager helps manage fleets and operational tasks. Trusted Advisor gives best-practice recommendations. As checked August 9, 2026, AWS's Trusted Advisor documentation says Basic Support includes selected checks, while Business Support+, Enterprise Support, and Unified Operations provide all checks. Do not memorize a frozen third-party support-plan table: AWS says Developer Support, Business Support, and Enterprise On-Ramp are in a transition that ends January 1, 2027. AWS Health Dashboard reports events that may affect your AWS environment. AWS Config is configuration history and compliance, not the same as CloudWatch metrics.
Migration services include Application Migration Service for lift-and-shift server migration, Database Migration Service for database migration, Snow Family for offline data transfer, and Migration Hub for tracking migration work. Analytics services include Athena for querying S3 data with SQL, Glue for data integration, Kinesis for streaming, QuickSight for business intelligence, and OpenSearch Service for search and log analytics.
AI and machine learning service names appear at a foundational level. Rekognition analyzes images and video. Textract extracts text and data from documents. Transcribe converts speech to text. Translate translates language. Polly converts text to speech. Lex builds conversational interfaces. Comprehend performs natural language processing. Kendra is enterprise search. SageMaker AI is for building, training, and deploying ML models. The scope page uses the umbrella label Amazon Q; at foundational depth, recognize Amazon Q Developer as a generative AI assistant that helps users understand, build, extend, and operate AWS applications.
Billing services have their own clues. Cost Explorer analyzes and visualizes spend. AWS Budgets alerts when cost or usage crosses thresholds. Cost and Usage Reports provide detailed billing data for analysis. Marketplace is for buying third-party software. Support plans change support access and Trusted Advisor coverage.
High-Yield Service Pairs For Final Review
Build your last review table as service, job, and not this. These pairs are worth more than another product-name list.
| Pair | Choose the first when... | Choose the second when... |
|---|---|---|
| CloudWatch vs CloudTrail | You need metrics, logs, alarms, or app/resource telemetry. | You need API activity history for audit and governance. |
| AWS Config vs CloudTrail | You need configuration state and compliance history. | You need who called which API and when. |
| S3 vs EBS | You need object storage. | You need a block volume for EC2. |
| EFS vs EBS | You need shared file storage. | You need a single-instance block volume. |
| Route 53 vs CloudFront | You need DNS. | You need content caching and global delivery. |
| RDS vs DynamoDB | You need managed relational database. | You need NoSQL key-value/document scale. |
| Cost Explorer vs Budgets | You need spend analysis and forecasting. | You need threshold alerts. |
| Direct Connect vs VPN | You need dedicated private connectivity. | You need encrypted internet-based connectivity. |
Many competitor pages name the same services but stop before this elimination step. CLF-C02 is scored through plausible distractors, so your practice should sound like: CloudWatch is wrong because the question asks for API audit history; CloudTrail is right. Or: S3 is wrong because the workload needs a block device attached to EC2; EBS is right.
Exam boundary and current format
The live AWS certification page currently lists 65 multiple-choice or multiple-response questions, 90 minutes, and a USD 100 list price; AWS points candidates to its exam-pricing page for foreign-exchange details. The official exam guide clarifies that 50 questions affect the score and 15 are unscored; the unscored items are not identified. Unanswered questions are incorrect, there is no penalty for guessing, scores use a 100-1,000 scale, and 700 is the minimum passing score. CLF-C02 uses a compensatory model, so you pass the exam overall rather than passing each domain separately.
The four scored domains are Cloud Concepts 24%, Security and Compliance 30%, Cloud Technology and Services 34%, and Billing, Pricing, and Support 12%. Use those weights to control study time; they describe shares of scored content, not a promise of an exact visible question count by domain.
As checked August 9, 2026, AWS's current in-scope services page includes Amazon Q, SQS, SNS, EventBridge, and Step Functions. Amazon Bedrock appears on neither that page nor AWS's explicit out-of-scope page. Because both lists are non-exhaustive and subject to change, do not label Bedrock formally out of scope; prioritize the services AWS currently names and recheck the official pages during your final week.
Compared with broad competitor guides, the useful advantage here is elimination: service pairs, application-integration distinctions, and explicit scope boundaries. A 200-name glossary looks comprehensive but is less useful than being able to explain the clue that separates two plausible answers.
Practice Path For The Services Layer
Spend one block on service categories, one on security services, one on billing/management, and one on service-pair elimination. Do not wait until you can recite the entire in-scope list. Start taking questions as soon as the major categories make sense.
Buy on Amazon
Take courses on Udemy
Learning path on Pluralsight