A free, open study guide for the AWS Certified Cloud Practitioner (CLF-C02) exam: revision notes for every domain, side-by-side comparisons of commonly confused services, a glossary, 20 worked sample questions, and the official syllabus as a checklist with a full free lesson for every topic.
Maintained by SaveMyCert, where you can read every lesson free, practice with explained questions and take timed mock exams.
- Exam at a glance
- Exam domains
- What is in this repo
- Syllabus checklist
- How to study for CLF-C02
- Sample questions
- Free resources
| Exam code | CLF-C02 |
| Level | Foundational |
| Questions | 65 |
| Time limit | 90 min |
| Passing score | 700 / 1000 |
| Format | Multiple choice & response |
| Exam fee | $100 |
| Valid for | 3 years |
Exam details change. Always confirm them in the official AWS Certified Cloud Practitioner (CLF-C02) exam guide from Amazon Web Services.
| # | Domain | Weight | Topics |
|---|---|---|---|
| 1 | Cloud Concepts | 24% | 4 |
| 2 | Security and Compliance | 30% | 4 |
| 3 | Cloud Technology and Services | 34% | 8 |
| 4 | Billing, Pricing, and Support | 12% | 3 |
That is 4 domains and 19 topics. Spend your time in proportion to the weights: the heaviest domain decides more of your score than the lightest.
| File | What it gives you |
|---|---|
| Domain 1 notes | Cloud Concepts: condensed revision notes per topic |
| Domain 2 notes | Security and Compliance: condensed revision notes per topic |
| Domain 3 notes | Cloud Technology and Services: condensed revision notes per topic |
| Domain 4 notes | Billing, Pricing, and Support: condensed revision notes per topic |
| Commonly confused services | Side-by-side tables of the services questions set against each other |
| Glossary | Every in-scope term and service in one sentence |
| Sample questions | 20 worked questions with answers and reasoning |
| Exam-day guide | Booking, testing options, scoring, results and retakes |
Tick each topic off once you can explain it without notes. The "Must know" facts are the ones questions turn on. Each lesson link goes to the complete, free lesson.
Weight: 24%. The AWS Cloud value proposition: benefits, Well-Architected design principles, migration strategies, and cloud economics.
📝 Revision notes: Domain 1: Cloud Concepts
- 1.1 Define the benefits of the AWS Cloud
The AWS value proposition: benefits of the global infrastructure (speed of deployment, global reach) and the advantages of high availability, elasticity, and agility.- 📖 Lesson: Benefits of the AWS Cloud: Value Proposition, Elasticity & Global Reach
- Must know: The AWS value proposition: on-demand resources with pay-as-you-go pricing replace owning and operating your own hardware.
- Must know: CapEx to OpEx: large upfront hardware investment becomes a variable expense that tracks actual usage; commitment discounts lower rates but bill the committed amount even when idle.
- 1.2 Identify design principles of the AWS Cloud
The AWS Well-Architected Framework: what each pillar covers — operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability — and how the pillars differ from one another.- 📖 Lesson: AWS Well-Architected Framework: The Six Pillars Explained for CLF-C02
- Must know: The AWS Well-Architected Framework has exactly six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability
- Must know: The AWS Well-Architected Tool is a free console service that reviews workloads against the framework and produces an improvement plan; lenses (from the Lens Catalog, or custom) add domain-specific questions, while milestones only save a snapshot of the review; unlike Trusted Advisor (automated account checks), Compute Optimizer (compute right-sizing) or Config conformance packs (resource settings vs rules), it reviews a workload's design
- 1.3 Understand the benefits of and strategies for migration to the AWS Cloud
Cloud adoption strategies and migration-support resources: the components of the AWS Cloud Adoption Framework (reduced business risk, improved ESG performance, increased revenue, increased operational efficiency) and choosing appropriate migration strategies such as database replication.- 📖 Lesson: AWS Cloud Adoption Framework & Migration Strategies: The 7 Rs, DMS, and Snowball
- Must know: The AWS CAF has six perspectives: Business, People, Governance (business capabilities) and Platform, Security, Operations (technical capabilities). Program, risk, cloud financial and application portfolio management are Governance; strategy and product portfolio are Business.
- Must know: The four CAF benefit categories are reduced business risk, improved ESG performance, increased revenue, and increased operational efficiency (lower cost, higher productivity, better employee and customer experience) — outcomes, not perspectives.
- 1.4 Understand concepts of cloud economics
Cloud economics: fixed vs variable costs, costs of on-premises environments, licensing strategies (BYOL vs included licenses), rightsizing, the benefits of automation, and economies of scale (cost savings).- 📖 Lesson: AWS Cloud Economics: CapEx vs OpEx, TCO, and Managed Services (CLF-C02)
- Must know: Moving to AWS trades upfront capital expense (CapEx) for pay-as-you-go operational expense (OpEx) — fixed costs become variable costs
- Must know: A cost is variable if it rises and falls with usage; hardware purchases, data center rent, and facilities are fixed costs
Weight: 30%. The shared responsibility model, AWS security and governance concepts, identity and access management, and security resources.
📝 Revision notes: Domain 2: Security and Compliance
- 2.1 Understand the AWS shared responsibility model
Recognizing the components of the shared responsibility model: what the customer is responsible for, what AWS is responsible for, what is shared, and how responsibilities shift depending on the service used (e.g. EC2 vs RDS vs Lambda).- 📖 Lesson: AWS Shared Responsibility Model: Security OF the Cloud vs IN the Cloud
- Must know: AWS is responsible for security OF the cloud (facilities, hardware, network, hypervisor); the customer is responsible for security IN the cloud (data, access, configuration).
- Must know: Customer data, IAM permissions (including execution roles), database user accounts, and encryption choices are ALWAYS the customer's responsibility, on every service.
- 2.2 Understand AWS Cloud security, governance, and compliance concepts
Where to find compliance information (AWS Artifact) and how compliance needs vary by geography/industry; security logs and encryption in transit vs at rest; services customers use to secure resources (Amazon Inspector, Security Hub, GuardDuty, Shield); governance services — monitoring with CloudWatch, auditing with CloudTrail and Config, and reporting with access reports; compliance requirements that vary among AWS services.- 📖 Lesson: AWS Security, Governance, and Compliance Concepts for CLF-C02
- Must know: AWS Artifact = AWS's own compliance reports (SOC, PCI, ISO) and agreements such as the BAA; an organization agreement is accepted once from the management account and covers every account.
- Must know: Compliance varies by geography (you choose the Region and AWS keeps content there unless you agree; GovCloud (US) for ITAR/FedRAMP High), industry (HIPAA, PCI DSS), and service (services-in-scope lists).
- 2.3 Identify AWS access management capabilities
IAM fundamentals: protecting the root user, the principle of least privilege, IAM Identity Center; access keys and password policies; credential storage (Secrets Manager, Systems Manager); MFA, cross-account IAM roles, federated identity; groups and users, custom vs managed policies, and root-user-only tasks.- 📖 Lesson: AWS IAM Explained: Users, Groups, Roles, Policies & Root User Best Practices
- Must know: IAM is a free, global service: authentication proves who you are; policies authorize what you can do — explicit deny beats allow, and anything not allowed is implicitly denied.
- Must know: Users hold long-term credentials, groups organize IAM users (never instances or other accounts' users), roles are assumed temporarily, policies are JSON permission documents.
- 2.4 Identify components and resources for security
AWS security features and services (AWS WAF, Firewall Manager, Shield, GuardDuty); third-party security products from AWS Marketplace; where to find security guidance (AWS Knowledge Center, Security Center, Security Blog); recognizing security issues with Trusted Advisor.- 📖 Lesson: AWS Security Components: Security Groups vs Network ACLs, WAF, Trusted Advisor
- Must know: Security groups are stateful instance-level firewalls with allow rules only; all rules are evaluated together.
- Must know: Network ACLs are stateless subnet-level filters with allow AND deny rules, evaluated in number order, first match wins.
Weight: 34%. How to deploy and operate in AWS, the global infrastructure, and the core service portfolio: compute, database, network, storage, AI/ML, and analytics.
📝 Revision notes: Domain 3: Cloud Technology and Services
- 3.1 Define methods of deploying and operating in the AWS Cloud
Access and provisioning methods: programmatic access (APIs, SDKs, CLI) vs the Management Console vs infrastructure as code; one-time vs repeatable processes; cloud, hybrid, and on-premises deployment models.- 📖 Lesson: Deploying and Operating in AWS: Console, CLI, SDKs, IaC, and Connectivity
- Must know: Every access method — Console, CLI, SDKs, IaC — ultimately makes calls to the same AWS APIs over HTTPS.
- Must know: Management Console = human, visual, one-time or infrequent tasks; sign in with password + MFA.
- 3.2 Define the AWS global infrastructure
Relationships among Regions, Availability Zones, and edge locations; high availability through multiple AZs (which share no single point of failure); when to use multiple Regions (disaster recovery, business continuity, low latency for end users, data sovereignty); the benefits of edge locations.- 📖 Lesson: AWS Global Infrastructure Explained: Regions, Availability Zones, and Edge
- Must know: A Region is a geographic area containing multiple isolated Availability Zones; an AZ is one or more discrete data centers with independent power, cooling, and networking.
- Must know: Availability Zones do not share single points of failure but are linked by low-latency connections — deploy across multiple AZs for high availability within a Region.
- 3.3 Identify AWS compute services
EC2 instance families (e.g. compute optimized, storage optimized); container options (ECS, EKS); serverless compute (Lambda, Fargate); elasticity through auto scaling; the purposes of load balancers.- 📖 Lesson: AWS Compute Services Explained: EC2, Lambda, ECS, EKS, and Fargate (CLF-C02)
- Must know: EC2 = virtual servers with full OS control; you patch, size, and scale them, and they suit long-running workloads.
- Must know: Instance families by trigger: compute optimized = CPU-heavy (batch, gaming); memory optimized = in-memory datasets; storage optimized = high local disk I/O; accelerated = GPUs/ML; HPC optimized = tightly coupled CPU simulations (no GPUs); general purpose = balanced.
- 3.4 Identify AWS database services
EC2-hosted vs AWS managed databases; relational databases (RDS, Aurora); NoSQL (DynamoDB); memory-based databases (ElastiCache); database migration tools (AWS DMS, AWS SCT).- 📖 Lesson: AWS Database Services for CLF-C02: RDS, Aurora, DynamoDB, ElastiCache, DMS
- Must know: Database on EC2 = full control (any engine/version, OS access) but the customer patches, backs up and fails it over; managed services shift that work to AWS — but never the schema, queries or data decisions.
- Must know: Amazon RDS = managed relational service for MySQL, PostgreSQL, MariaDB, SQL Server, Oracle and IBM Db2 — relational engines only.
- 3.5 Identify AWS network services
VPC components (subnets, gateways); VPC security (network ACLs, security groups, Amazon Inspector); the purpose of Route 53; network connectivity options to AWS (AWS VPN, Direct Connect).- 📖 Lesson: AWS Network Services Explained: VPC, Route 53, CloudFront and More
- Must know: Amazon VPC is your logically isolated virtual network in one Region; you define the IP range and split it into subnets, each in exactly one Availability Zone.
- Must know: Public subnet = route to an internet gateway; private subnet = no direct internet route. Every route table keeps a local route, so all subnets can still reach each other.
- 3.6 Identify AWS storage services
Object storage use cases; differences between S3 storage classes; block storage (EBS, instance store); file services (EFS, FSx); cached file systems (Storage Gateway); lifecycle policies; AWS Backup use cases.- 📖 Lesson: AWS Storage Services Explained: S3, EBS, EFS, FSx, and Storage Gateway
- Must know: Match the storage shape first: S3 = objects via API, EBS = block disk for one EC2 instance, EFS/FSx = shared file systems.
- Must know: S3 is designed for 11 nines (99.999999999%) durability, virtually unlimited capacity, and shines for backups, static websites, data lakes, and media.
- 3.7 Identify AWS artificial intelligence and machine learning (AI/ML) services and analytics services
AI/ML services and the tasks they perform (SageMaker AI, Lex) and the data analytics portfolio (Athena, Kinesis, AWS Glue, Amazon Quick Sight).- 📖 Lesson: AWS AI/ML and Analytics Services: SageMaker, Athena, Kinesis and More
- Must know: SageMaker (now SageMaker AI) is the platform to build, train, and deploy YOUR OWN ML models; every other AI service is a pre-trained API you can call out of the box, with no ML expertise needed.
- Must know: Transcribe = speech to text; Polly = text to speech; Translate = between languages; Comprehend = sentiment and meaning from text.
- 3.8 Identify services from other in-scope AWS service categories
The rest of the in-scope catalog: application integration (EventBridge, SNS, SQS); business applications (Connect, SES); customer enablement (AWS Support) and choosing business support assistance; developer tools to build, deploy, and troubleshoot (CodeBuild, CodePipeline, X-Ray); end-user computing (AppStream 2.0, WorkSpaces, WorkSpaces Secure Browser); frontend web/mobile (Amplify); IoT (IoT Core).- 📖 Lesson: AWS Application Integration, Developer Tools & Other Service Categories
- Must know: SQS is a pull-based message queue (one consumer per message, buffers and decouples); SNS is push-based pub/sub (one message fanned out to many subscribers).
- Must know: Fan-out pattern: publish once to an SNS topic, deliver copies to multiple SQS queues for independent processing.
Weight: 12%. AWS pricing models, cost-management tooling, and the support and technical-resource landscape.
📝 Revision notes: Domain 4: Billing, Pricing, and Support
- 4.1 Compare AWS pricing models
Compute purchasing options (On-Demand, Reserved Instances, Spot, Savings Plans, Dedicated Hosts, Dedicated Instances, Capacity Reservations); Reserved Instance flexibility and behavior in AWS Organizations; data transfer charges (incoming/outgoing, same-Region vs cross-Region); storage pricing tiers.- 📖 Lesson: AWS Pricing Models Explained: On-Demand, Reserved, Spot & Savings Plans
- Must know: Steady, predictable workloads running a year or more → Reserved Instances or Savings Plans, up to 72% off On-Demand.
- Must know: Fault-tolerant, interruptible workloads (batch, CI, analytics) → Spot Instances, up to 90% off, reclaimable with a two-minute warning.
- 4.2 Understand resources for billing, budget, and cost management
AWS Budgets and Cost Explorer; the AWS Pricing Calculator; consolidated billing and cost allocation with AWS Organizations; cost allocation tags and the AWS Cost and Usage Report.- 📖 Lesson: AWS Billing and Cost Management Tools: Budgets, Cost Explorer, CUR and More
- Must know: Match by tense: estimate BEFORE = Pricing Calculator; alert DURING = AWS Budgets; analyze AFTER = Cost Explorer; deepest data = CUR.
- Must know: AWS Pricing Calculator is a free public web tool — no AWS account needed — for estimating a planned architecture's cost.
- 4.3 Identify AWS technical resources and AWS Support options
Where to find whitepapers, blogs, and documentation (Prescriptive Guidance, Knowledge Center, re:Post); AWS Support options (Basic Support, AWS Business Support+, AWS Enterprise Support, AWS Unified Operations) and customer service/communities; Trusted Advisor, AWS Health Dashboard, and AWS Health API; abuse reports via Trust and Safety; AWS Partners and Marketplace; Professional Services and Solutions Architects.- 📖 Lesson: AWS Support Plans and Technical Resources: The Complete CLF-C02 Guide
- Must know: Current AWS Support plans: Basic (free), Business Support+, Enterprise Support and Unified Operations; Developer and Business Support end on 1 January 2027 and Enterprise On-Ramp customers move to Enterprise Support.
- Must know: Business Support+ is the lowest-cost plan with technical support and AWS's minimum recommendation for production; it unlocks the full Trusted Advisor checks and the AWS Health API.
- Read the lesson for each topic in the checklist above, starting with the heaviest domain. Every lesson is free on the CLF-C02 revision notes.
- Practice straight after reading. Answer CLF-C02 practice questions on the topic you just read. Each option comes with an explanation of why it is right or wrong.
- Review what you got wrong, re-read that lesson section, and tick the topic off only when you get its questions right.
- Take a full-length CLF-C02 mock exam under the real time limit. Aim to pass mocks comfortably before you book.
- On the last day, skim the CLF-C02 cheat sheet instead of starting anything new.
sample-questions.md has 20 worked CLF-C02 questions with the answer, why each option is right or wrong, and the reasoning steps.
- AWS Certified Cloud Practitioner (CLF-C02) exam guide: the official source (Amazon Web Services)
- CLF-C02 certification overview
- CLF-C02 revision notes: every lesson, free to read
- CLF-C02 practice questions: with an explanation on every option
- CLF-C02 mock exams: full-length and timed
- CLF-C02 cheat sheet: the key facts on one page
- All certification study guides
Spotted an error or an out-of-date fact? Open an issue with the topic and a link to the official source. See CONTRIBUTING.md.
This guide is licensed under CC BY 4.0. You can reuse and adapt it, including commercially, as long as you credit SaveMyCert with a link to https://www.savemycert.com/.
This is an independent study resource. It is not affiliated with or endorsed by Amazon Web Services. AWS Certified Cloud Practitioner and CLF-C02 are trademarks of their respective owner. Exam domains and weights are taken from the official exam guide linked above.