STEP 1 · Study

CLF-C02 StudyCloud Practitioner

Read the key points for each exam domain, then use “Practice this domain” to answer questions from that domain only. Domains with a larger weight appear more often on the exam.

Cloud Concepts

24%

Learning goals

Explain the benefits of the AWS Cloud (agility, elasticity, global reach, economies of scale) in business terms
Explain the differences among the six pillars of the Well-Architected Framework
Distinguish the AWS CAF perspectives and typical migration strategies (rehost, replatform and so on)
Explain cloud economics such as fixed versus variable costs, bring your own license (BYOL) and rightsizing

Key points

Typical cloud benefits: trade capital expense (fixed cost) for pay-as-you-go (variable cost), stop guessing capacity, benefit from lower prices through economies of scale, provision resources in minutes, go global in minutes, and focus on your business instead of running data centers.
Elasticity means scaling up and down automatically with demand; high availability means spreading across multiple AZs so systems rarely stop; agility means trying and abandoning things quickly.
The six pillars of the Well-Architected Framework: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability. Questions ask “which pillar’s idea is this?”
AWS CAF is a framework that organizes the capabilities needed for cloud adoption into six perspectives: business, people, governance, platform, security and operations.
Migration strategies (7 Rs): rehost (move as is), replatform (replace some parts with managed services), refactor (rebuild), repurchase (move to SaaS), retain, retire and relocate.
On-premises costs include “hidden costs” beyond the servers themselves, such as power, cooling, floor space and maintenance staff. Compare including these.
Rightsizing means reviewing instance size and type to match utilization. In the cloud you can change them later.

Workplace uses

AccountingIn a server replacement approval request, compare the total on-premises cost including five years of purchase, maintenance, power and facility costs with an AWS pay-as-you-go estimate.
SalesBuild a campaign site whose traffic spikes only during the campaign so that Auto Scaling adds servers only when needed, avoiding equipment purchases sized for the peak.
General AffairsCompare migration approaches for an aging file server: “move as is (rehost)” or “replace with a managed service (replatform).”

Exam objectives (from the exam guide)

1.1 Define the benefits of the AWS Cloud.
1.2 Identify design principles of the AWS Cloud.
1.3 Understand the benefits of and strategies for migration to the AWS Cloud.
1.4 Understand concepts of cloud economics.

Learning resources

Learn in detail (4 topics with mini quizzes) →Practice this domain (72 questions) →Next domain ↓

Security and Compliance

30%

Learning goals

Explain the responsibilities of AWS and the customer in the shared responsibility model for each service type (EC2, RDS, Lambda)
Explain access management basics such as protecting the root user, least privilege, MFA and IAM Identity Center
Distinguish services used for auditing and compliance such as CloudTrail, Config, CloudWatch and Artifact
Distinguish the roles of threat detection and protection services such as GuardDuty, Inspector, Security Hub, Shield and WAF

Key points

Shared responsibility model: AWS is responsible for “security of the cloud” (physical facilities, hardware, virtualization infrastructure); the customer is responsible for “security in the cloud” (data, access permissions, OS and application settings).
On EC2, OS patching is the customer’s responsibility. On RDS, AWS patches the database engine, and on Lambda, AWS also manages the runtime environment. The more managed the service, the smaller the customer’s responsibility, but data and access permissions are always the customer’s.
Don’t use the root user for daily work; set MFA and don’t create access keys. Use it only for tasks only the root user can do (closing the account, changing the support plan and so on).
Principle of least privilege: grant only the permissions needed for the work. Assign permissions to people via IAM Identity Center or groups, and use IAM roles rather than long-term access keys for applications.
Don’t hard-code secrets such as passwords and API keys; store them in AWS Secrets Manager (automatic rotation available) or Systems Manager Parameter Store.
Audit basics: CloudTrail records API activity; Config records resource configuration history and evaluates rule compliance; CloudWatch provides metrics, logs and alarms. AWS third-party audit reports (SOC, ISO and so on) are obtained from AWS Artifact.
Threat detection is GuardDuty, automated vulnerability scanning is Inspector, a unified view of security posture is Security Hub, DDoS protection is Shield, filtering attacks on web apps (such as SQL injection) is WAF, and sensitive data discovery in S3 is Macie.
Consider encryption both at rest (key management with KMS) and in transit (TLS).

Workplace uses

General AffairsTo answer a business partner’s security checklist, obtain AWS third-party audit reports from AWS Artifact and attach them as AWS-side controls.
AccountingAssign permission sets per accounting system user with IAM Identity Center, separating read-only auditors from staff who can make changes.
SalesStore the password for a SaaS integration handling customer information in Secrets Manager, and have the application retrieve it with an IAM role.

Exam objectives (from the exam guide)

2.1 Understand the AWS shared responsibility model.
2.2 Understand AWS Cloud security, governance, and compliance concepts.
2.3 Identify AWS access management capabilities.
2.4 Identify components and resources for security.

Learning resources

Learn in detail (4 topics with mini quizzes) →Practice this domain (90 questions) →Next domain ↓

Cloud Technology and Services

34%

Learning goals

Choose among the Management Console, CLI/SDK and IaC (CloudFormation) by purpose
Explain the relationship among Regions, Availability Zones and edge locations, and why to use multiple AZs and Regions
Choose key compute, database, network and storage services by use
Distinguish representative AI/ML, analytics, application integration, business application and end-user computing services

Key points

Ways to operate: the Management Console for one-off tasks, the CLI and SDKs for automation and scripts, and IaC (AWS CloudFormation) to build the same environment repeatedly and accurately.
Regions are geographically separate locations; each Region consists of multiple Availability Zones (AZs) that share no single point of failure. Edge locations are sites from which services such as CloudFront deliver content close to users.
For high availability, “spread across multiple AZs”; for disaster recovery, data residency requirements and low latency for distant users, consider “multiple Regions.”
Compute: EC2 for virtual servers (instance types by use), Lambda for event-driven work without server management, ECS and EKS for containers, and Fargate to remove server management for containers. Auto Scaling adjusts the number of instances and ELB balances load.
Databases: RDS and Aurora for relational, DynamoDB for key-value NoSQL, ElastiCache for in-memory caching. DMS for migration and SCT for schema conversion between different engines.
Networking: create subnets inside a VPC and control traffic with an internet gateway and so on. Security groups are per instance (stateful); network ACLs are per subnet (stateless). Route 53 for DNS; connect to on-premises with Site-to-Site VPN (over the internet, encrypted) or Direct Connect (dedicated line).
Storage: S3 for objects (optimize cost with storage classes and lifecycle), EBS for EC2 block storage (instance store is temporary), EFS (Linux) and FSx (Windows and others) for shared files, Storage Gateway for cached connections from on-premises, and AWS Backup for centralized backup.
AI/ML and analytics: SageMaker AI for building machine learning, Lex for chatbots, Textract for extracting text and tables from documents, Athena for SQL on data in S3, Kinesis for streaming, Glue for ETL and QuickSight for BI dashboards.
Others: SNS for notifications, SQS for queues, EventBridge for event integration, Amazon Connect for contact centers, SES for sending email, WorkSpaces for virtual desktops, AppStream 2.0 for app streaming, Amplify for web and mobile front ends, and IoT Core for connecting IoT devices.

Workplace uses

SalesLaunch a customer inquiry line with Amazon Connect and handle first-line responses outside business hours with an Amazon Lex chatbot.
General AffairsProvide remote workers with Amazon WorkSpaces virtual desktops containing internal apps, so no data stays on their devices.
AccountingScan paper invoices into S3, read amounts and dates with Amazon Textract and aggregate monthly with Athena.

Exam objectives (from the exam guide)

3.1 Define methods of deploying and operating in the AWS Cloud.
3.2 Define the AWS global infrastructure.
3.3 Identify AWS compute services.
3.4 Identify AWS database services.
3.5 Identify AWS network services.
3.6 Identify AWS storage services.
3.7 Identify AWS artificial intelligence and machine learning (AI/ML) services and analytics services.
3.8 Identify services from other in-scope AWS service categories.

Learning resources

Learn in detail (8 topics with mini quizzes) →Practice this domain (103 questions) →Next domain ↓

Billing, Pricing, and Support

12%

Learning goals

Explain when to use On-Demand, Reserved Instances, Savings Plans, Spot Instances and Dedicated Hosts
Distinguish the uses of Budgets, Cost Explorer, Pricing Calculator, consolidated billing and cost allocation tags
Explain the roles of support plans, re:Post, Knowledge Center, Trusted Advisor, AWS Health, Marketplace and partners

Key points

On-Demand is pay-as-you-go with no long-term commitment; Reserved Instances (RIs) and Savings Plans give discounts for committing to 1 or 3 years of use; Spot Instances offer large discounts in exchange for possible interruption. Dedicated Hosts give you a dedicated physical server and are used to bring socket- or core-based licenses.
Data transfer pricing: inbound from the internet to AWS is generally free; outbound from AWS to the internet and transfer between Regions are charged.
AWS Pricing Calculator estimates before use, Cost Explorer analyzes past usage and forecasts, AWS Budgets sets budgets and alerts on expected overruns, and the Cost and Usage Report is the most detailed usage data.
Consolidated billing in AWS Organizations combines multiple accounts’ bills into one and aggregates usage for volume discounts. Cost allocation tags split costs by department or project.
Support plans (official page as of 2026-10): Basic (included for all customers: customer service, documentation, re:Post, Trusted Advisor core checks, AWS Health), Business Support+ (the minimum recommended plan for production workloads), Enterprise Support (for business-critical workloads) and Unified Operations (for mission-critical workloads). All Trusted Advisor checks are available with paid plans.
Sources of technical information: AWS re:Post (community Q&A), Knowledge Center (common questions and procedures), Prescriptive Guidance, whitepapers and blogs. Report abuse of AWS resources to the AWS Trust & Safety team.
AWS Marketplace is a catalog for buying and using third-party software, with charges consolidated into the AWS bill. AWS Partners (ISVs, SIs) support adoption and development.

Workplace uses

AccountingTag resources with cost-center per department, check monthly costs by department in Cost Explorer, and have AWS Budgets email department heads when 80% of the budget is reached.
General AffairsCombine the headquarters’ and subsidiaries’ AWS accounts with consolidated billing in Organizations, making one bill and reducing payment processing.
SalesBefore a customer proposal, create a rough monthly estimate with AWS Pricing Calculator and attach it to the quote.

Exam objectives (from the exam guide)

4.1 Compare AWS pricing models.
4.2 Understand resources for billing, budget, and cost management.
4.3 Identify AWS technical resources and AWS Support options.

Learning resources

Learn in detail (3 topics with mini quizzes) →Practice this domain (36 questions) →Try the mock exam →

When you finish reading

Practice all domains (301 questions)Mock exam (65 questions · 90 min)CLF-C02 home

Notes (unofficial, original questions, no pass guarantee)

The questions on this site are original practice questions written by this site based on publicly available skills outlines and exam guides. They are not actual exam questions.
Amazon Web Services, AWS and related marks are trademarks of Amazon.com, Inc. or its affiliates. This site is not affiliated with or endorsed by AWS.
This content is a study aid and does not guarantee a pass. Exam content, format and prerequisites may change without notice; always check the latest information on the official page before taking the exam.
Your accuracy on the mock exam cannot be converted to the official (scaled) score and does not predict a pass or fail.
Progress is saved only in this browser (localStorage) unless you sign in with Google to sync it. You can delete it from the Cookie & storage settings page (Japanese).