AWS Certified Cloud Practitioner (CLF-C02)

Foundational AWS certification. No prerequisites. Validates broad cloud knowledge across all four domains: cloud concepts, security, technology/services, and billing.

Official exam guide: https://docs.aws.amazon.com/aws-certification/latest/cloud-practitioner-02/cloud-practitioner-02.html

Exam Format

Unscored questions are not flagged during the exam. Unanswered questions count as wrong — guess rather than skip.

Domain Weightings

Security and Technology together make up 64% of the exam. Prioritise those two domains.

Domain 1: Cloud Concepts (24%)

Task Statement 1.1 — Define the benefits of the AWS Cloud

Knowledge of:

• Value proposition of the AWS Cloud

Skills:

• Understanding the benefits of global infrastructure (speed of deployment, global reach)
• Understanding the advantages of high availability, elasticity, and agility

Key concepts:

The six traditional "advantages of cloud computing" are a common exam topic.

Task Statement 1.2 — Identify design principles of the AWS Cloud

Knowledge of:

• AWS Well-Architected Framework

Skills:

• Understanding the six pillars
• Identifying differences between the pillars

The Six Pillars of the Well-Architected Framework:

The exam asks you to match a scenario to the correct pillar. Sustainability was added in 2021 — know all six.

AWS Well-Architected Tool — free service that reviews your architecture against the framework and produces a report of identified issues.

Task Statement 1.3 — Understand migration strategies and the AWS Cloud Adoption Framework

Knowledge of:

• Cloud adoption strategies
• Resources to support the migration journey

Skills:

• Understanding AWS CAF components
• Identifying appropriate migration strategies (database replication, AWS Snowball)

AWS Cloud Adoption Framework (AWS CAF) — 6 Perspectives:

CAF outcomes: reduced business risk; improved ESG (environmental, social, governance) performance; increased revenue; increased operational efficiency.

The 7 Rs of Migration:

AWS Snow Family (data migration for large volumes or limited bandwidth):

• AWS Snowcone — smallest, 8 TB usable storage, portable
• AWS Snowball Edge — 80 TB usable, compute + storage
• AWS Snowmobile — exabyte-scale, physical truck

Task Statement 1.4 — Understand concepts of cloud economics

Knowledge of:

• Aspects of cloud economics
• Cost savings of moving to the cloud

Skills:

• Fixed costs vs variable costs
• On-premises associated costs
• Licensing strategies (BYOL vs included)
• Rightsizing
• Benefits of automation
• Economies of scale

Key concepts:

• Fixed costs (CapEx): Upfront hardware, data centre space, maintenance contracts — paid regardless of usage.
• Variable costs (OpEx): Cloud spending — scales with actual consumption.
• Rightsizing: Matching instance type and size to actual workload requirements before committing to Reserved Instances.
• BYOL (Bring Your Own Licence): Use existing software licences on AWS (common for Windows Server, SQL Server on Dedicated Hosts).
• Total Cost of Ownership (TCO): Include hardware, software licences, facilities, IT staff, and opportunity cost when comparing on-premises vs cloud.
• Economies of scale: AWS purchases compute and networking at global scale, reducing per-unit cost vs self-managed infrastructure.
• Automation benefit: Automated provisioning and tear-down eliminates idle resource costs.

Domain 2: Security and Compliance (30%)

Task Statement 2.1 — Understand the AWS shared responsibility model

Knowledge of:

• AWS shared responsibility model

Skills:

• Recognising the model's components
• Describing customer responsibilities
• Describing AWS responsibilities
• Describing shared responsibilities
• Understanding how responsibilities shift by service type (EC2, RDS, Lambda)

The model in one sentence: AWS is responsible for security of the cloud (the infrastructure); you are responsible for security in the cloud (what you build and configure).

AWS responsibilities (security OF the cloud):

• Physical data centre security (buildings, power, cooling, hardware)
• Host operating system and virtualisation layer
• Managed service runtime environments (e.g. the RDS database engine)
• Global network infrastructure (Regions, AZs, edge locations)
• Hardware lifecycle and disposal

Customer responsibilities (security IN the cloud):

• Customer data (encryption, access, classification)
• Identity and access management (IAM users, roles, policies)
• Operating system patches on EC2 instances
• Application-layer security
• Network configuration (security groups, NACLs)
• Client-side and server-side encryption choices

How responsibility shifts by service:

The higher up the managed stack, the more AWS takes on. This is a high-frequency exam topic.

Shared controls (both AWS and customer):

• Patch management (AWS patches infrastructure; customer patches guest OS and apps)
• Configuration management (AWS configures its infrastructure; customer configures their applications)
• Awareness and training (each party trains their own people)

Task Statement 2.2 — AWS Cloud security, governance, and compliance

Knowledge of:

• AWS compliance and governance concepts
• Benefits of cloud security (encryption)
• Where to capture and locate logs

Skills:

• Finding AWS compliance information (AWS Artifact)
• Securing resources (Inspector, Security Hub, GuardDuty, Shield)
• Encryption options (in transit, at rest)
• Governance services (CloudWatch, CloudTrail, Audit Manager, Config)

Key services:

Encryption:

• Encryption in transit: TLS/SSL protects data moving between services or to clients.
• Encryption at rest: Data encrypted on disk (S3 SSE, EBS encryption, RDS encryption).
• AWS KMS (Key Management Service): Create and control encryption keys. Integrates with most AWS storage services.
• AWS CloudHSM: Dedicated hardware security module — customer controls keys, not AWS.
• AWS Certificate Manager (ACM): Provisions and manages SSL/TLS certificates for use with AWS services.

Task Statement 2.3 — AWS access management capabilities

Knowledge of:

• IAM
• Protecting the root user
• Principle of least privilege
• AWS IAM Identity Center (SSO)

Skills:

• Access keys, password policies, credential storage
• Authentication methods (MFA, IAM Identity Center, cross-account roles)
• Groups, users, custom and managed policies
• Tasks only root can perform
• Root user protection methods
• Types of identity management (federated)

IAM core concepts:

Principle of least privilege: Grant only the minimum permissions required to perform a task.

Root user tasks only (cannot delegate to IAM):

• Change account root email or password
• Close the AWS account
• Activate IAM access to Billing Console
• Restore IAM permissions if locked out
• Change AWS Support plan
• Register as seller in AWS Marketplace

Protect root user: Enable MFA immediately. Never create access keys for root.

Authentication methods:

• MFA (Multi-Factor Authentication): Virtual MFA (Authenticator app), hardware TOTP token, FIDO security key.
• AWS IAM Identity Center (formerly SSO): Centralised access management across multiple AWS accounts and applications; supports SAML 2.0 federation.
• Federated identity: Use existing corporate identities (Active Directory, Okta) to access AWS via SAML 2.0 or OIDC.

Credential storage:

• AWS Secrets Manager: Stores and rotates secrets (DB credentials, API keys) automatically.
• AWS Systems Manager Parameter Store: Stores configuration data and secrets; simpler than Secrets Manager, no auto-rotation built in.

Task Statement 2.4 — Components and resources for security

Knowledge of:

• AWS security capabilities
• Security-related documentation

Skills:

• AWS security features (WAF, Firewall Manager, Shield, GuardDuty)
• Third-party products in AWS Marketplace
• Where to find security information (Knowledge Center, Security Center, Security Blog)
• Using Trusted Advisor for security issues

AWS Firewall Manager: Centrally configure and manage AWS WAF rules, Shield Advanced, security groups, and Network Firewall policies across multiple accounts in AWS Organizations.

AWS Trusted Advisor: Automated recommendations across five categories: Cost Optimization, Performance, Security, Fault Tolerance, and Service Limits. Free tier includes core security checks (MFA on root, unrestricted S3 buckets, open security groups).

Where to find security resources:

• AWS Security Center (https://aws.amazon.com/security/)
• AWS Security Blog
• AWS Knowledge Center (FAQ-style troubleshooting)
• AWS re:Post (community Q&A, replaces AWS Forums)
• AWS Whitepapers (Security Best Practices, etc.)

Domain 3: Cloud Technology and Services (34%)

Task Statement 3.1 — Methods of deploying and operating in the AWS Cloud

Knowledge of:

• Ways of provisioning and operating in AWS
• Ways to access AWS services
• Types of cloud deployment models

Skills:

• Programmatic access (APIs, SDKs, CLI) vs AWS Management Console vs IaC
• One-time vs repeatable processes
• Deployment models (cloud, hybrid, on-premises)

Access methods:

Deployment models:

Task Statement 3.2 — AWS global infrastructure

Knowledge of:

• Regions, Availability Zones, edge locations

Skills:

• Relationships among Regions, AZs, edge locations
• High availability via multiple AZs
• AZs do not share single points of failure
• When to use multiple Regions

Definitions:

High availability principle: Deploy across at least two AZs. AZs are connected with low-latency, high-bandwidth links but do not share single points of failure (separate power, separate facilities).

When to use multiple Regions:

• Disaster recovery (DR) and business continuity
• Data sovereignty requirements (data must stay in a specific country)
• Reducing latency for geographically distributed users
• Regulatory compliance

Task Statement 3.3 — AWS compute services

Knowledge of:

• AWS compute services

Skills:

• EC2 instance type categories
• Container options (ECS, EKS)
• Serverless options (Fargate, Lambda)
• Auto Scaling for elasticity
• Load balancers

EC2 instance families:

Containers:

Serverless compute:

Elasticity and load balancing:

• AWS Auto Scaling: Automatically adjusts EC2 capacity based on demand or schedule. Responds to CloudWatch alarms.
• Elastic Load Balancing (ELB): Distributes incoming traffic across multiple targets.
  • Application Load Balancer (ALB): Layer 7; HTTP/HTTPS; path-based routing; good for microservices.
  • Network Load Balancer (NLB): Layer 4; TCP/UDP; extreme performance; static IP.
  • Gateway Load Balancer (GWLB): For deploying inline virtual appliances (firewalls, IDS).

Other compute services:

• AWS Elastic Beanstalk: PaaS — upload code, AWS handles provisioning, load balancing, scaling, monitoring. Supports Java, .NET, PHP, Node.js, Python, Ruby, Go, Docker.
• Amazon Lightsail: Simplified VPS with fixed pricing — bundled compute, storage, and transfer. For simple web apps, blogs, small databases.
• AWS Batch: Managed batch processing jobs at any scale; automatically provisions compute.
• AWS Outposts: Run AWS services on-premises on AWS-managed hardware.

Task Statement 3.4 — AWS database services

Knowledge of:

• AWS database services
• Database migration

Skills:

• EC2-hosted vs managed databases
• Relational (RDS, Aurora)
• NoSQL (DynamoDB)
• In-memory (ElastiCache)
• Migration tools (DMS, SCT)

Relational databases:

EC2-hosted DB vs RDS: Use RDS when you want reduced operational overhead. Use EC2-hosted DB when you need an engine RDS does not support, or when you need OS-level access.

NoSQL:

In-memory:

Other databases:

• Amazon DocumentDB: MongoDB-compatible managed document database
• Amazon Neptune: Managed graph database — for social networks, fraud detection, knowledge graphs
• Amazon Redshift: Managed data warehouse — columnar storage, petabyte scale, SQL queries

Migration tools:

Task Statement 3.5 — AWS network services

Knowledge of:

• AWS network services

Skills:

• VPC components (subnets, gateways)
• VPC security (NACLs, security groups, Inspector)
• Amazon Route 53
• Network connectivity (VPN, Direct Connect)

Amazon VPC (Virtual Private Cloud): Logically isolated network within AWS. You control IP ranges, subnets, route tables, and gateways.

VPC components:

VPC security:

Security groups are the primary tool. NACLs are an additional layer.

Connectivity to AWS:

Content delivery and DNS:

Task Statement 3.6 — AWS storage services

Knowledge of:

• AWS storage services

Skills:

• Object storage use cases
• S3 storage classes
• Block storage (EBS, instance store)
• File services (EFS, FSx)
• Cached file systems (Storage Gateway)
• Lifecycle policies
• AWS Backup

Amazon S3 (Simple Storage Service): Object storage for any amount of data. Objects stored in buckets. Not a file system — objects accessed via HTTP/HTTPS. 11 nines of durability (99.999999999%).

S3 storage classes:

S3 lifecycle policies: Automatically transition objects between storage classes or expire/delete them after a set period.

Block storage:

File storage:

Hybrid storage:

• AWS Storage Gateway: Connects on-premises applications to AWS cloud storage. Three modes: S3 File Gateway (NFS/SMB to S3), Volume Gateway (iSCSI block storage cached or stored in AWS), Tape Gateway (virtual tape library to Glacier).

Backup:

• AWS Backup: Centralised backup service across EBS, RDS, EFS, DynamoDB, EC2, and other services. Audit compliance with backup policies.
• AWS Elastic Disaster Recovery: Replicates on-premises or cloud workloads to AWS for fast recovery.

Task Statement 3.7 — AI/ML and analytics services

Skills:

• AI/ML services and their tasks
• Data analytics services

AI/ML services:

Analytics services:

Task Statement 3.8 — Other in-scope service categories

Application integration:

Business applications:

• Amazon Connect: Cloud-based contact centre (call centre as a service)
• Amazon SES (Simple Email Service): Transactional and marketing email sending at scale

Developer tools:

• AWS CodeBuild: Managed build service — compiles code, runs tests, produces deployable artefacts
• AWS CodePipeline: Continuous delivery pipeline — automates build, test, and deploy stages
• AWS X-Ray: Distributed tracing — analyse and debug production applications; service maps

End-user computing:

• Amazon AppStream 2.0: Streams desktop applications to browsers — no local install required
• Amazon WorkSpaces: Managed cloud desktop (Windows or Linux DaaS)
• Amazon WorkSpaces Secure Browser: Managed browser for accessing internal web apps without full desktop

Frontend web and mobile:

• AWS Amplify: Full-stack platform for web and mobile apps — hosting, authentication, APIs, storage
• AWS AppSync: Managed GraphQL API service; real-time and offline support

IoT:

• AWS IoT Core: Connect, manage, and secure IoT devices; message routing between devices and AWS services

Management and governance (key services):

Domain 4: Billing, Pricing, and Support (12%)

Task Statement 4.1 — Compare AWS pricing models

Knowledge of:

• Compute purchasing options
• Storage options and tiers

Skills:

• When to use each purchasing option
• Reserved Instance flexibility
• RI behaviour in AWS Organizations
• Data transfer costs
• Storage pricing options

EC2 purchasing options:

Reserved Instance flexibility:

• Standard RIs: fixed instance family, OS, tenancy; can be sold on RI Marketplace.
• Convertible RIs: can exchange for RIs of equal or greater value; cannot be sold on RI Marketplace.
• RIs can be shared across accounts in an AWS Organization via consolidated billing.

Data transfer costs:

• Inbound (ingress) to AWS from internet: free
• Outbound (egress) from AWS to internet: charged per GB (after free tier)
• Transfer between services in the same Region but different AZs: charged
• Transfer between services in the same AZ: free (generally)
• Transfer between Regions: charged

AWS Free Tier:

• Always free: Lambda (1M requests/month), DynamoDB (25 GB), CloudWatch (10 metrics), etc.
• 12-month free: EC2 (750 hours/month t2.micro or t3.micro), S3 (5 GB), RDS (750 hours), etc.
• Trials: short-term free trials for specific services

Task Statement 4.2 — Billing, budget, and cost management resources

Knowledge of:

• Billing support and information
• AWS service pricing information
• AWS Organizations
• Cost allocation tags

Skills:

• AWS Budgets and AWS Cost Explorer capabilities
• AWS Pricing Calculator
• AWS Organizations consolidated billing
• Cost allocation tags and billing reports

Key tools:

Cost allocation tags:

• Tag AWS resources (key-value pairs) to track costs by project, team, environment, etc.
• AWS-generated tags: auto-applied by some services.
• User-defined tags: you create them.
• Tags appear in the Cost and Usage Report after activation in the Billing console.

AWS Organizations consolidated billing:

• One payer account receives a combined bill for all member accounts.
• Aggregated usage across accounts can qualify for volume pricing tiers.
• RIs and Savings Plans purchased in one account can be shared across the organisation (unless sharing is disabled).

Task Statement 4.3 — Technical resources and AWS Support options

Knowledge of:

• Resources and documentation on official AWS websites
• AWS Support plans
• AWS Partner Network role
• AWS Support Center

Skills:

• Locating whitepapers, blogs, documentation
• Identifying technical resources (Prescriptive Guidance, Knowledge Center, re:Post)
• AWS Support plan options
• Trusted Advisor, Health Dashboard, Health API
• Trust and Safety team
• AWS Partner roles (Marketplace, ISVs, SIs)
• Benefits of being an AWS Partner

AWS Support Plans:

Note: AWS is discontinuing Enterprise On-Ramp on January 1, 2027. Enterprise On-Ramp customers are being migrated to Enterprise Support during 2026. The exam still tests on all five plans as of May 2026.

Key resources:

AWS Marketplace:

• Catalogue of thousands of third-party software products that can be purchased and deployed on AWS.
• Products billed through your AWS account (single invoice).
• Categories: security, ML, business applications, DevOps, SaaS.
• Key capabilities for enterprises: governance, entitlement management, procurement integration.

AWS Partner Network (APN):

• Technology Partners (ISVs): Build software products on or integrating with AWS.
• System Integrators (SIs) / Consulting Partners: Design, build, and manage AWS solutions for customers.
• AWS Professional Services: AWS's own professional services team.
• AWS Solutions Architects: Pre-sales technical resources; do not charge separately.
• Partner benefits: training and certification, go-to-market support, partner events, volume discounts.

Trust and Safety team: Report abuse of AWS resources (spam, malware, DDoS originating from AWS IPs) via abuse@amazonaws.com or the AWS abuse report form.

Key Concept: Shared Responsibility Model (Deep Dive)

The exam returns to this repeatedly across multiple domains. Internalise it as a decision framework, not just a definition.

Decision rule: If AWS built and operates it (physical hardware, hypervisor, managed service runtime), that's AWS's responsibility. If you configured it or put data in it, that's yours.

Shifting responsibility examples:

EC2 (IaaS)
  AWS owns: hypervisor, physical hardware, networking hardware, AZ infrastructure
  Customer owns: OS patches, application, security group config, data encryption, IAM

RDS (Managed PaaS)
  AWS owns: OS patches, database engine patches, hardware, Multi-AZ replication
  Customer owns: database schema, data, IAM access, security group, encryption at rest/transit

Lambda (Serverless/FaaS)
  AWS owns: runtime environment, OS, infrastructure, scaling
  Customer owns: function code, IAM execution role, data passed to function, dependencies

Key Concept: Well-Architected Framework (Exam Approach)

Exam questions present a scenario and ask which pillar it relates to, or ask what design principle addresses a described problem.

Quick mapping:

• "Recover from failure automatically" → Reliability
• "Use the right resource type for the job" → Performance Efficiency
• "Eliminate unused resources" → Cost Optimization
• "Detect security events" → Security
• "Automate operational tasks" → Operational Excellence
• "Reduce carbon footprint" → Sustainability
• "Use multi-AZ deployment" → Reliability (not Availability — Availability is not a pillar)

Key Concept: Pricing Models (Decision Framework)

In-Scope AWS Services (Complete Official List)

These are the services AWS explicitly names as in-scope for CLF-C02.

Analytics: Athena, EMR, Glue, Kinesis, OpenSearch Service, QuickSight, Redshift

Application Integration: EventBridge, SNS, SQS, Step Functions

Business Applications: Connect, SES

Cloud Financial Management: Budgets, Cost and Usage Reports, Cost Explorer, Marketplace

Compute: Batch, EC2, Elastic Beanstalk, Lightsail, Outposts

Containers: ECR, ECS, EKS

Customer Enablement: AWS Support

Database: Aurora, DocumentDB, DynamoDB, ElastiCache, Neptune, RDS

Developer Tools: CLI, CodeBuild, CodePipeline, X-Ray

End User Computing: AppStream 2.0, WorkSpaces, WorkSpaces Secure Browser

Frontend Web and Mobile: Amplify, AppSync

IoT: IoT Core

Machine Learning: Comprehend, Kendra, Lex, Polly, Amazon Q, Rekognition, SageMaker AI, Textract, Transcribe, Translate

Management and Governance: Auto Scaling, CloudFormation, CloudTrail, CloudWatch, Compute Optimizer, Config, Control Tower, Health Dashboard, License Manager, Management Console, Organizations, Service Catalog, Service Quotas, Systems Manager, Trusted Advisor, Well-Architected Tool

Migration and Transfer: Application Discovery Service, Application Migration Service, DMS, Migration Evaluator, Migration Hub, SCT, Snow Family

Networking and Content Delivery: API Gateway, CloudFront, Direct Connect, Global Accelerator, PrivateLink, Route 53, Transit Gateway, VPC, VPN, Site-to-Site VPN, Client VPN

Security, Identity, and Compliance: Artifact, Audit Manager, ACM, CloudHSM, Cognito, Detective, Directory Service, Firewall Manager, GuardDuty, IAM, IAM Identity Center, Inspector, KMS, Macie, RAM, Secrets Manager, Security Hub, Shield, WAF

Serverless: Fargate, Lambda

Storage: Backup, EBS, EFS, Elastic Disaster Recovery, FSx, S3, S3 Glacier, Storage Gateway

Exam Strategy

What the exam tests: Recognition and selection — matching a described scenario to the correct service, model, or concept. It does not test implementation, architecture design, or coding.

Question approach:

1. Identify the scenario type first (migration, security, cost, compute, etc.).
2. Look for eliminating keywords — "no servers to manage" = serverless (Lambda/Fargate), "compliance reports" = Artifact, "who made an API call" = CloudTrail.
3. For multiple-response questions, identify the number of correct answers required before reading options.
4. Eliminate obviously wrong answers before evaluating remaining options.
5. No penalty for guessing — if uncertain, select the most specific match.

Common traps:

• CloudWatch vs CloudTrail: CloudWatch = metrics and logs (operational); CloudTrail = API audit log (governance/security).
• Security Groups vs NACLs: Security groups are stateful and apply to instances; NACLs are stateless and apply to subnets.
• RDS vs DynamoDB: RDS = relational (SQL); DynamoDB = NoSQL (key-value/document). Exam often asks which to use for a described data model.
• S3 Glacier vs S3 Glacier Instant Retrieval: Instant Retrieval = millisecond access, Flexible Retrieval = minutes to hours.
• Basic Support vs Developer: Basic = free, no tech support; Developer = email support, one contact, business hours only.
• Trusted Advisor full checks require Business Support or higher (not Developer or Basic).
• The root user account has tasks only it can perform — those cannot be delegated to any IAM user or role.
• AWS Artifact provides compliance documentation (SOC reports, PCI attestations); it is not a security scanning tool.
• Shared responsibility: "security groups" are the customer's responsibility even though they are an AWS feature.

High-frequency topics by domain:

• Domain 1: 6 cloud advantages, Well-Architected 6 pillars, 7 Rs, CAF perspectives
• Domain 2: Shared responsibility shifts per service, IAM (users/groups/roles/policies), root user restrictions, GuardDuty vs Inspector vs Security Hub vs Shield
• Domain 3: EC2 instance families, S3 storage classes, when to use Lambda vs EC2 vs Fargate, EBS vs EFS vs S3 differences
• Domain 4: Pricing model comparison, Support plan tier differences, what Trusted Advisor covers at each tier

Time management: 90 minutes for 65 questions = ~83 seconds per question. Flag uncertain questions and return; most questions are answerable in under 60 seconds.

Related Pages

• landscape/aws-solutions-architect-associate (next certification up)
• landscape/aws-ai-practitioner — AIF-C01; the AI-specialist companion certification to CLF-C02
• protocols/mcp (cloud protocol context)
• infra/vector-stores (AWS services in AI infra context)
• security/owasp-llm-top10 (cloud security context)

Connections

• landscape/aws-ai-practitioner — companion AIF-C01 exam that extends CLF-C02 with AI/ML depth
• cloud/aws-analytics-services — Domain 3 (34%): Athena, EMR, Glue, Kinesis, OpenSearch, QuickSight, Redshift
• cloud/aws-ai-recognition-services — Domain 3 (34%): pre-built AI APIs; scenario-to-service matching
• cloud/aws-amazon-q — Domain 3 (34%): Amazon Q as part of the AI services catalogue
• cloud/cloud-hub — cloud engineering hub that operationalises the AWS services surveyed here
• cloud/aws-core — deep-dive AWS core services page for practitioners moving beyond foundational level
• cs-fundamentals/se-hub — software engineering fundamentals needed alongside AWS knowledge

Open Questions

• CLF-C02 retirement dates are unconfirmed — when is the next scheduled exam version update?
• Which CLF-C02 domain has changed most significantly between CLF-C01 and CLF-C02, and are further changes anticipated?
• At what point does CLF-C02 preparation overlap enough with SAA-C03 that it is more efficient to target SAA-C03 directly?