TL;DR
Certification earned
I organized these notes around the official CLF-C02 domains, with core cloud concepts, AWS services, exam triggers, and practice questions to help others prepare. The questions are study material, not a complete exam simulation.
Exam Overview and Domain Breakdown
The AWS Certified Cloud Practitioner exam covers four domains:
| Domain | Description | Exam Weighting |
|---|---|---|
| Domain 1 | Cloud Concepts | 24% |
| Domain 2 | Security and Compliance | 30% |
| Domain 3 | Cloud Technology and Services | 34% |
| Domain 4 | Billing, Pricing, and Support | 12% |
The exam format is approximately 65 questions, including 50 scored questions and 15 unscored questions. The time limit is 90 minutes, and the passing score is 700 out of 1000 on a scaled score.
This is the order I used while studying:
Domain 1: Cloud Concepts
This domain covers the value of cloud computing, migration approaches, and the AWS Well-Architected Framework.
1. Cloud Value Proposition and Economics
- Agility: Rapidly provision IT infrastructure within minutes instead of waiting for hardware procurement.
- Elasticity: Automatically scale computing capacity up or down based on real-time demand.
- Global reach: Deploy applications across multiple AWS Regions and serve users from locations close to them.
- Variable expenses: Move from Capital Expenses (CapEx), such as upfront data center hardware, to operational expenses (OpEx) based on actual consumption.
- Economies of scale: AWS’s large operating scale helps provide lower pay-as-you-go pricing.
2. AWS Cloud Adoption Framework and Migration Strategies
The AWS Cloud Adoption Framework (AWS CAF) organizes cloud adoption guidance into six perspectives:
- Business
- People
- Governance
- Platform
- Security
- Operations
The 7 Rs of cloud migration describe common migration strategies:
| Strategy | Description |
|---|---|
| Rehost | Move an application without changing its core architecture, often called lift and shift. |
| Replatform | Make minor cloud optimizations without changing the application’s core code, often called lift, tinker, and shift. |
| Repurchase | Replace the existing solution with a different product or SaaS offering, often called drop and shop. |
| Refactor / Re-architect | Redesign an application to use cloud-native patterns such as serverless services or microservices. |
| Relocate | Move workloads to another platform, such as moving hypervisor instances to VMware Cloud on AWS. |
| Retire | Decommission applications that are no longer needed. |
| Retain | Keep an application in its current environment when migration is not appropriate yet. |
3. AWS Well-Architected Framework
The six pillars of the AWS Well-Architected Framework are:
- Operational Excellence: Run and monitor systems to deliver business value and continuously improve processes.
- Security: Protect information, assets, and systems through risk assessment and mitigation.
- Reliability: Ensure a workload performs its intended function correctly and consistently.
- Performance Efficiency: Use computing resources efficiently to meet system requirements.
- Cost Optimization: Run systems at the lowest price point without sacrificing performance.
- Sustainability: Minimize the environmental and carbon impact of cloud workloads.
Domain 1 Practice Questions
Question 1
An organization wants to eliminate upfront hardware investments and pay only for computing resources as they are consumed. Which economic benefit of the AWS Cloud does this represent?
- A. Bring Your Own License (BYOL)
- B. Trading capital expense (CapEx) for variable expense
- C. Economies of scale
- D. Rightsizing
Show answer and reason
Answer: B. Trading capital expense (CapEx) for variable expense.
Reason: The cloud replaces upfront capital expenses for physical infrastructure with variable expenses based on actual usage.
Question 2
Which pillar of the AWS Well-Architected Framework focuses on minimizing energy consumption and environmental impact?
- A. Reliability
- B. Operational Excellence
- C. Cost Optimization
- D. Sustainability
Show answer and reason
Answer: D. Sustainability.
Reason: The Sustainability pillar addresses the environmental, economic, and societal impacts of cloud workloads.
Question 3
An application needs to scale up automatically during peak morning traffic and scale down during the night to minimize costs. Which AWS Cloud capability supports this requirement?
- A. Elasticity
- B. High Availability
- C. Data Sovereignty
- D. Global Reach
Show answer and reason
Answer: A. Elasticity.
Reason: Elasticity automatically provisions or removes resources to match changing workload demand.
Domain 2: Security and Compliance
This domain focuses on the AWS shared responsibility model and the services used to secure, monitor, and govern cloud environments.
1. AWS Shared Responsibility Model
- Security of the Cloud: AWS protects the underlying infrastructure, physical facilities, data center hardware, networking, and hypervisors.
- Security in the Cloud: Customers configure IAM permissions, encrypt data, patch guest operating systems on services such as EC2, manage security groups, and secure their applications.
The customer responsibilities vary by service. For example, AWS manages the underlying operating system and hardware for Amazon RDS, while the customer manages database users, schemas, and network access controls.
2. AWS Security, Governance, and Compliance Services
| Service | Function and exam trigger |
|---|---|
| AWS IAM | Manages identities and access. Apply least-privilege permissions. |
| AWS WAF | Filters HTTP and HTTPS traffic to protect web applications from attacks such as SQL injection and cross-site scripting. |
| AWS Shield | Provides Standard and Advanced protection against distributed denial-of-service (DDoS) attacks. |
| Amazon GuardDuty | Detects threats using signals such as CloudTrail events, VPC Flow Logs, and DNS logs. |
| Amazon Inspector | Scans EC2 instances and container images for software vulnerabilities. |
| Amazon Macie | Discovers, classifies, and helps protect sensitive data stored in Amazon S3. |
| AWS Artifact | Provides official AWS compliance reports and security attestations. |
Domain 2 Practice Questions
Question 1
Under the AWS Shared Responsibility Model, which security task is the exclusive responsibility of the customer?
- A. Securing physical access to server racks
- B. Updating firmware on SAN storage units
- C. Managing Identity and Access Management (IAM) user permissions
- D. Patching hypervisor software on host servers
Show answer and reason
Answer: C. Managing Identity and Access Management (IAM) user permissions.
Reason: Customers manage security in the cloud, including access permissions, user credentials, and data protection. AWS manages the underlying host infrastructure.
Question 2
A regulated healthcare business needs official SOC 2 compliance documentation to present to an auditor. Where can the administrator obtain these documents?
- A. AWS Trusted Advisor
- B. AWS Artifact
- C. Amazon GuardDuty
- D. AWS Systems Manager
Show answer and reason
Answer: B. AWS Artifact.
Reason: AWS Artifact is the central portal for AWS audit, security, and compliance reports.
Question 3
Which best practice should be implemented immediately after creating an AWS account to secure the root user?
- A. Share the root account credentials with all system administrators
- B. Enable Multi-Factor Authentication (MFA) on the root user
- C. Use the root user for everyday command-line tasks
- D. Generate static access keys for daily application access
Show answer and reason
Answer: B. Enable Multi-Factor Authentication (MFA) on the root user.
Reason: The root user has unrestricted permissions. AWS recommends enabling MFA on the root user and using individual identities or roles for daily tasks.
Domain 3: Cloud Technology and Services
This was the largest exam domain. I focused on recognizing the purpose of each core service and matching it to the requirement in a scenario.
1. AWS Global Infrastructure
- AWS Regions: Geographic areas that contain multiple physically isolated Availability Zones.
- Availability Zones (AZs): One or more discrete data centers with redundant power, networking, and connectivity. AZs are designed to avoid shared single points of failure.
- Edge locations: Points of Presence used by Amazon CloudFront to cache content close to end users and reduce latency.
2. Core AWS Service Matrix
| Category | Services |
|---|---|
| Compute | Amazon EC2 for virtual machines, AWS Lambda for serverless execution, Amazon ECS and Amazon EKS for container orchestration, and AWS Fargate for serverless container compute. |
| Storage | Amazon S3 for object storage, Amazon EBS for persistent block storage attached to EC2, Amazon EFS for shared file storage, and Amazon S3 Glacier for low-cost archival. |
| Database | Amazon RDS for managed relational databases, Amazon Aurora for high-performance managed SQL, Amazon DynamoDB for managed NoSQL key-value workloads, and Amazon Redshift for data warehousing. |
| Networking | Amazon VPC for an isolated private network, Amazon Route 53 for DNS, and AWS Direct Connect for a dedicated connection to AWS. |
Domain 3 Practice Questions
Question 1
A developer wants to run event-driven code without provisioning, managing, or patching virtual servers. Which service should be used?
- A. Amazon EC2
- B. AWS Lambda
- C. Amazon RDS
- D. AWS Lightsail
Show answer and reason
Answer: B. AWS Lambda.
Reason: Lambda runs code in response to events while AWS manages the underlying compute resources.
Question 2
To establish a fault-tolerant architecture, an engineer deploys resources across isolated data centers within a single geographic region. Which component represents these isolated data centers?
- A. Edge Locations
- B. Local Zones
- C. Availability Zones (AZs)
- D. Transit Gateways
Show answer and reason
Answer: C. Availability Zones (AZs).
Reason: Availability Zones are physically separated data centers within an AWS Region and help prevent single points of failure.
Question 3
An organization requires a managed, petabyte-scale data warehouse service to run complex analytical SQL queries. Which service meets this need?
- A. Amazon DynamoDB
- B. Amazon Redshift
- C. Amazon ElastiCache
- D. Amazon Aurora
Show answer and reason
Answer: B. Amazon Redshift.
Reason: Redshift is a managed data warehouse optimized for high-performance analytics on large datasets.
Domain 4: Billing, Pricing, and Support
This domain connects workload requirements to purchasing options, cost-management tools, and AWS Support plans.
1. Compute Purchasing Options
- On-Demand: Pay by the second or hour without a long-term commitment. Best for short-term or unpredictable workloads.
- Reserved Instances and Savings Plans: Commit for one or three years in exchange for discounted rates. Best for steady-state workloads.
- Spot Instances: Use unused EC2 capacity at discounts of up to 90%. AWS can reclaim the capacity with a two-minute interruption notice. Best for stateless and fault-tolerant workloads.
- Dedicated Hosts: Physical servers dedicated to one customer, often used for strict compliance or Bring Your Own License (BYOL) requirements.
2. Cost Management and Technical Support Tools
- AWS Organizations: Manages multiple accounts and provides consolidated billing, which can help aggregate usage and qualify for volume pricing.
- AWS Cost Explorer: Visualizes, analyzes, and forecasts historical and future cloud usage costs.
- AWS Pricing Calculator: Estimates projected costs before building or deploying workloads.
- AWS Support plans: Basic provides documentation and core support resources; Developer provides business-hours email support; Business provides 24/7 phone and chat support; Enterprise includes proactive guidance and an assigned Technical Account Manager (TAM).
Domain 4 Practice Questions
Question 1
A team runs batch image processing jobs that can be interrupted and resumed without impacting operations. Which EC2 purchasing model minimizes costs?
- A. On-Demand Instances
- B. Spot Instances
- C. Reserved Instances
- D. Dedicated Hosts
Show answer and reason
Answer: B. Spot Instances.
Reason: Spot Instances offer substantial discounts for workloads that can tolerate interruptions and resume processing.
Question 2
A business manages 10 separate AWS accounts and wants to consolidate billing to qualify for volume tiering discounts. Which service enables this?
- A. AWS Cost Explorer
- B. AWS Organizations
- C. AWS Trusted Advisor
- D. AWS Config
Show answer and reason
Answer: B. AWS Organizations.
Reason: AWS Organizations provides consolidated billing across linked accounts and can aggregate usage for volume pricing.
Question 3
An enterprise requires proactive architectural guidance and a designated technical point of contact within AWS. Which support plan includes this benefit?
- A. Basic Support
- B. Developer Support
- C. Business Support
- D. Enterprise Support
Show answer and reason
Answer: D. Enterprise Support.
Reason: Enterprise Support includes an assigned Technical Account Manager who provides proactive operational guidance.
Five Scenario Questions for Final Review
Scenario 1: Managed Database Responsibility
What is the customer’s responsibility when using Amazon RDS according to the Shared Responsibility Model?
- A. Replacing broken physical hard drives
- B. Patching the host server operating system
- C. Configuring database network security rules and user permissions
- D. Managing physical facility power redundancy
Show answer and reason
Answer: C. Configuring database network security rules and user permissions.
Explanation: AWS handles the RDS operating system, hardware, and physical maintenance. The customer manages network security rules, database schemas, and user permissions.
Scenario 2: Private Cloud Network
Which service provides an isolated private virtual network environment for launching AWS resources?
- A. Amazon VPC
- B. AWS Direct Connect
- C. Amazon Route 53
- D. Amazon CloudFront
Show answer and reason
Answer: A. Amazon VPC.
Explanation: Amazon VPC provides an isolated virtual network in the AWS Cloud for running resources securely.
Scenario 3: Cloud Agility
Which term describes the ability to provision IT resources in minutes rather than waiting weeks for hardware delivery?
- A. Elasticity
- B. Agility
- C. Reliability
- D. Sustainability
Show answer and reason
Answer: B. Agility.
Explanation: Agility refers to the speed at which cloud resources can be provisioned, enabling rapid experimentation and innovation.
Scenario 4: Estimating AWS Costs
Which tool should a Cloud Solutions Architect use to estimate monthly cloud charges before provisioning any resources?
- A. AWS Cost Explorer
- B. AWS Pricing Calculator
- C. AWS Budgets
- D. AWS Cost and Usage Report
Show answer and reason
Answer: B. AWS Pricing Calculator.
Explanation: The AWS Pricing Calculator models estimated costs for planned architectures before resources are provisioned.
Scenario 5: Managed DNS
Which AWS service provides an automated, highly available Domain Name System (DNS)?
- A. Amazon Route 53
- B. Amazon API Gateway
- C. AWS Transit Gateway
- D. AWS Global Accelerator
Show answer and reason
Answer: A. Amazon Route 53.
Explanation: Route 53 is a scalable DNS service that routes end-user requests to infrastructure running on AWS or elsewhere.
Final Thoughts
The biggest lesson for me was that CLF-C02 is not just about memorizing AWS service names. The exam becomes much easier when each service is connected to a business requirement: elasticity for changing demand, IAM for least-privilege access, Availability Zones for resilience, and the right pricing model for the workload.
My advice