Cloud Concepts
24%of exam
Security + Compliance
30%of exam
Technology + Services
34%of exam
Billing + Support
12%of exam
Quick Facts
- Exam
- CLF-C02
- Credential
- Cloud Practitioner
- Questions
- 65 total
- Scored
- 50 questions
- Time
- 90 min
- Pass
- 700/1000
- Level
- Foundational
- Blueprint
- CLF-C02 current
Six Pillars
OPSERS keeps workload reviews complete
Operational excellenceSecurityReliabilityPerformanceCost optimizationSustainability
Cloud Benefits
- Global reach
- Regions worldwide
- Agility
- Provision in minutes
- Elasticity
- Scale with demand
- Scalability
- Add capacity
- HA
- Minimize downtime
- Economies
- Provider scale savings
- OpEx
- Usage-based spend
- CapEx
- Upfront hardware
- Automation
- Repeatable changes
Well-Architected
- Operational excellence
- Run and improve
- Security
- Protect data/systems
- Reliability
- Recover from failure
- Performance
- Efficient resource use
- Cost optimization
- Avoid waste
- Sustainability
- Reduce environmental impact
- WA Tool
- Review workloads
- Pillar tradeoffs
- Balance priorities
Migration + CAF
- CAF
- Transformation guidance
- Business
- Value outcomes
- People
- Culture skills
- Governance
- Priorities controls
- Platform
- Cloud foundation
- Security
- Risk controls
- Operations
- Run workloads
- DMS
- Database migration
- Snow Family
- Offline transfer
IAM User vs Role
IAM user
- Person/service
- Long-term keys
- Avoid sharing
IAM role
- Assumed identity
- Temporary keys
- Preferred access
Permanent vs temporary
Security Picker
- Human permissions→IAM(Least privilege)
- App users→Cognito(Customer identity)
- Encryption keys→KMS(Managed keys)
- Threat detection→GuardDuty(Findings)
- Vulnerability scans→Inspector(Workloads)
- Sensitive S3 data→Macie(Discovery)
- Compliance reports→Artifact(Audits)
- Web filtering→WAF(Layer 7)
Responsibility
- AWS
- Cloud infrastructure
- Customer
- Data and configuration
- IaaS
- More customer duties
- PaaS
- Shared app duties
- SaaS
- Mostly provider managed
- EC2 patching
- Customer OS duty
- Physical DC
- AWS duty
- IAM users
- Customer duty
Identity + Access
- Root user
- Protect strongly
- IAM user
- Long-term identity
- IAM role
- Temporary access
- IAM policy
- JSON permissions
- Groups
- User collections
- MFA
- Extra factor
- KMS
- Key management
- Cognito
- App user identity
- IAM Identity Center
- Workforce SSO
Security Services
- GuardDuty
- Threat detection
- Inspector
- Vulnerability scans
- Macie
- Sensitive data discovery
- Detective
- Security investigations
- Security Hub
- Posture aggregation
- Shield
- DDoS protection
- WAF
- Web request filtering
- Artifact
- Compliance reports
- ACM
- TLS certificates
- Secrets Manager
- Rotate secrets
Core Services
Compute stores, networks connect, IAM permits
EC2S3VPCIAM
EC2 vs Lambda
EC2
- OS control
- Persistent servers
- You patch
Lambda
- Event code
- No servers
- AWS patches
Server vs function
Service Picker
- Need OS control→EC2(IaaS)
- Event code→Lambda(Serverless)
- Managed app deploy→Elastic Beanstalk(PaaS)
- Container orchestration→ECS(AWS native)
- Kubernetes required→EKS(Managed K8s)
- Object files→S3(Durable)
- Relational database→RDS(Managed SQL)
- Key-value scale→DynamoDB(NoSQL)
- Global cache→CloudFront(CDN)
- DNS routing→Route 53
Compute + Containers
- EC2
- Virtual servers
- Lambda
- Event functions
- Elastic Beanstalk
- Managed app deploy
- Lightsail
- Simple VPS
- ECS
- Container service
- EKS
- Managed Kubernetes
- Fargate
- Serverless containers
- Batch
- Batch jobs
- Outposts
- AWS on-premises
S3 vs EBS
S3
- Object storage
- HTTP access
- Regional service
EBS
- Block volumes
- Attach to EC2
- AZ scoped
Objects vs blocks
Storage + Database
- S3
- Object storage
- S3 Glacier
- Archive storage
- EBS
- EC2 block volumes
- EFS
- Linux file shares
- FSx
- Managed file systems
- Backup
- Central backups
- Storage Gateway
- Hybrid storage
- RDS
- Relational databases
- Aurora
- AWS relational engine
- DynamoDB
- Key-value NoSQL
- Redshift
- Data warehouse
- ElastiCache
- In-memory cache
Security Group vs NACL
Security group
- Instance level
- Stateful
- Allow rules
NACL
- Subnet level
- Stateless
- Allow/deny rules
Instance vs subnet
Network + Delivery
- VPC
- Isolated network
- Subnet
- VPC segment
- Security group
- Instance firewall
- NACL
- Subnet firewall
- Route 53
- DNS service
- CloudFront
- CDN edge cache
- Direct Connect
- Private circuit
- Site-to-Site VPN
- Encrypted tunnel
- Transit Gateway
- Network hub
- PrivateLink
- Private service access
- API Gateway
- Managed API front
- Global Accelerator
- Global traffic routing
CloudWatch vs CloudTrail
CloudWatch
- Metrics/logs
- Alarms
- Resource health
CloudTrail
- API calls
- Audit trail
- Who did what
Observe vs audit
Management + Integration
- CloudWatch
- Metrics and alarms
- CloudTrail
- API activity logs
- Config
- Resource compliance
- Systems Manager
- Ops management
- Auto Scaling
- Capacity adjustment
- CloudFormation
- IaC templates
- Trusted Advisor
- Best-practice checks
- Organizations
- Account grouping
- EventBridge
- Event bus
- SNS
- Pub/sub notifications
- SQS
- Message queues
- Step Functions
- Workflow orchestration
Cost Flow
Estimate, track, alert, optimize
CalculatorExplorerBudgetsAdvisor
Cost Explorer vs Budgets
Cost Explorer
- Analyze spend
- Historical trends
- Forecast view
Budgets
- Set thresholds
- Send alerts
- Track limits
Analyze vs alert
Cost Picker
- Estimate architecture→Pricing Calculator
- Inspect spend→Cost Explorer
- Alert threshold→Budgets
- Detailed charges→CUR
- Commit usage→Savings Plans
- Unused capacity→Spot
- Optimization advice→Trusted Advisor
- Multi-account billing→Organizations
Cost + Support
- Pricing Calculator
- Future cost estimate
- Cost Explorer
- Spend analysis
- Budgets
- Spend alerts
- CUR
- Detailed spend data
- Savings Plans
- Flexible commitment
- Reserved Instances
- Instance commitment
- Spot
- Spare capacity
- On-Demand
- No commitment
- Free Tier
- Limited free use
- Marketplace
- Third-party software
- Basic Support
- Account support
- Developer Support
- Business-hours support
- Business Support
- Production support
- Enterprise Support
- Mission-critical support
Common Traps
Shared Responsibility
AWS secures facilities ≠ Customer secures data
Region vs AZ
Region = geography ≠ AZ = datacenter set
SG vs NACL
SG is stateful ≠ NACL is stateless
Role vs User
Role has temporary keys ≠ User has long-term keys
Calculator vs Explorer
Calculator estimates future ≠ Explorer reads actuals
CloudWatch vs CloudTrail
CloudWatch observes metrics ≠ CloudTrail records API
S3 vs EBS
S3 stores objects ≠ EBS attaches volumes
Last Minute
- 1.Know 24/30/34/12 weights
- 2.700 pass; 50 scored
- 3.AWS owns physical infrastructure
- 4.IAM role beats shared keys
- 5.SG stateful; NACL stateless
- 6.S3 objects; EBS blocks
- 7.Calculator estimates; Explorer tracks
- 8.GuardDuty detects suspicious activity
- 9.Artifact provides compliance reports
- 10.CloudTrail records API activity
- 11.Trusted Advisor recommends optimizations
Buy on Amazon
Take courses on Udemy
Learning path on PluralsightSame family resources
Explore More AWS Certifications
Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.
More From This Family
Videos and articles for deeper review.
VideoPass AWS Cloud Practitioner CLF-C02 First Try (2026)This examArticleAzure vs AWS Certification 2026: Which Cloud Cert Should You Get First?19 min readArticleFREE AWS Developer DVA-C02 Exam Guide 2026: Pass on Attempt 128 min readArticlePass AWS Cloud Practitioner CLF-C02 First Try (2026)14 min readArticleAWS Certified AI Practitioner (AIF-C01) Exam Guide 2026: FREE Study Plan, Bedrock Deep Dive, Pass Rate32 min read