The CLF-C02 exam has 65 questions, 90 minutes, and a passing score of 700/1000. You don't need to be a cloud engineer to pass — but you do need to understand why AWS exists and how its core services fit together.
This cheat sheet covers everything on the exam, organised by domain.
Domain 1: Cloud Concepts (24%)
The Six Advantages of Cloud Computing
AWS loves these. Know them cold.
- Trade capital expense for variable expense — pay for what you use instead of buying hardware upfront
- Benefit from massive economies of scale — AWS buys hardware at a scale you can't match
- Stop guessing capacity — scale up or down based on actual demand
- Increase speed and agility — provision resources in minutes instead of weeks
- Stop spending money running and maintaining data centers — focus on your business, not infrastructure
- Go global in minutes — deploy to multiple regions with a few clicks
The Three Cloud Deployment Models
| Model | Description | Example |
|---|---|---|
| Public Cloud | All resources on AWS infrastructure | Startups, most companies |
| Private Cloud | Infrastructure in your own data center | Regulated enterprises |
| Hybrid | Mix of on-premises and cloud | Banks with legacy systems |
Cloud Service Models
IaaS (Infrastructure as a Service) — you manage the OS and above. AWS provides the compute, storage, and networking. Example: EC2.
PaaS (Platform as a Service) — you manage the application code. AWS manages the runtime, OS, and infrastructure. Example: Elastic Beanstalk.
SaaS (Software as a Service) — you use the software. AWS manages everything. Example: Amazon WorkMail, Salesforce.
The AWS Well-Architected Framework — Six Pillars
This comes up constantly. Know the pillar name AND what it means:
- Operational Excellence — run and monitor systems, continuously improve. Key concept: "everything as code."
- Security — protect data and systems. Key concepts: IAM least privilege, encryption, audit logging.
- Reliability — recover from failures, scale dynamically. Key concepts: multi-AZ, auto scaling, backups.
- Performance Efficiency — use resources efficiently as demands change. Key concepts: right-sizing, serverless.
- Cost Optimization — deliver value at the lowest price point. Key concepts: Reserved Instances, Spot, rightsizing.
- Sustainability — minimise environmental impact. Key concepts: managed services, efficient resource utilisation.
Key Cloud Concepts
High Availability (HA) — system stays operational even if a component fails. Achieved by deploying across multiple AZs.
Fault Tolerance — system continues operating even if components fail (zero downtime). Requires redundancy.
Scalability — ability to handle increased load. Vertical scaling = bigger instance. Horizontal scaling = more instances.
Elasticity — automatically scale up and down based on demand.
Disaster Recovery — restore operations after a catastrophic event. Key terms: RTO (Recovery Time Objective) and RPO (Recovery Point Objective).
Domain 2: Security and Compliance (30%)
This is the biggest domain. Security questions are scenario-based — pick the service that solves the problem.
The Shared Responsibility Model
The most important concept on the entire exam.
AWS is responsible for security OF the cloud:
- Physical data centres (buildings, power, cooling)
- Hardware (servers, networking equipment)
- Virtualisation layer
- Managed services infrastructure (e.g., the RDS database engine itself)
You are responsible for security IN the cloud:
- Your data and encryption choices
- IAM users, roles, and permissions
- Operating system patches (for EC2)
- Application code and configuration
- Network settings (security groups, NACLs)
- Anything you put IN the service
Exam tip: The line shifts depending on the service. For EC2, you manage the OS. For RDS, AWS manages the OS — you manage what's above it (users, databases, encryption at rest).
IAM — Identity and Access Management
Users — individual people or applications. Each user gets their own credentials.
Groups — collections of users. Attach policies to groups, not individual users.
Roles — temporary permissions for AWS services or federated users. EC2 instances use roles to access S3. Lambda uses roles to access DynamoDB.
Policies — JSON documents that define permissions. Attached to users, groups, or roles.
The principle of least privilege — grant only the permissions needed to do the job. Nothing more.
Root account — the account created when you sign up for AWS. Has unrestricted access. You should:
- Enable MFA on root immediately
- Never use root for day-to-day tasks
- Create an admin IAM user instead
MFA (Multi-Factor Authentication) — adds a second verification step. Always enable on root and admin accounts.
Key Security Services
| Service | What it does | When to use it |
|---|---|---|
| IAM | Controls who can do what in AWS | Always — foundational |
| AWS Shield | DDoS protection. Standard (free), Advanced (paid) | Any public-facing app |
| AWS WAF | Web Application Firewall — blocks SQL injection, XSS | Applications behind ALB, CloudFront |
| GuardDuty | Threat detection using ML — watches CloudTrail, VPC Flow Logs, DNS | Continuous threat monitoring |
| Inspector | Automated security scanning for EC2 and containers | Finding vulnerabilities |
| Macie | Uses ML to discover and protect sensitive data in S3 | PII, financial data in S3 |
| CloudTrail | Logs every API call in your AWS account | Audit logging, compliance |
| Config | Records and evaluates resource configurations over time | Compliance, change tracking |
| KMS | Key Management Service — create and manage encryption keys | Encrypting data in S3, RDS, EBS |
| Secrets Manager | Store and rotate secrets (database passwords, API keys) | Removing hardcoded credentials |
| Security Hub | Centralised security findings from GuardDuty, Inspector, Macie | Single-pane security dashboard |
| Artifact | Access AWS compliance reports and agreements | Audit and compliance documentation |
| Cognito | User authentication for web and mobile apps | Adding login to your app |
Encryption
Encryption at rest — data is encrypted when stored. S3, EBS, RDS all support this. Managed through KMS.
Encryption in transit — data is encrypted while moving over a network. HTTPS/TLS. AWS services use TLS by default.
Server-side encryption (SSE) — AWS encrypts data on your behalf before storing it.
Client-side encryption — you encrypt data before sending it to AWS.
Compliance Programs
AWS has certifications for SOC 1/2/3, ISO 27001, PCI DSS, HIPAA, and more. Use AWS Artifact to access compliance reports and agreements. You don't have to start from scratch — AWS's compliance certifications carry over to your workload.
Domain 3: Cloud Technology and Services (34%)
Global Infrastructure
Region — a geographic area containing 2+ Availability Zones. Currently 30+ regions globally. Choose a region based on: latency, compliance/data residency, service availability, pricing.
Availability Zone (AZ) — one or more data centres with independent power, cooling, and networking. AZs within a region are connected by high-speed low-latency links.
Edge Location — a site used by CloudFront to cache content closer to users. There are 400+ edge locations — far more than regions or AZs.
Local Zone — AWS infrastructure placed closer to specific cities for ultra-low latency.
Wavelength Zone — AWS infrastructure embedded in telecom providers' 5G networks.
Compute Services
EC2 (Elastic Compute Cloud) — virtual machines in the cloud. You pick the instance type, OS, and configuration. You manage the OS and software.
EC2 Instance Types:
- General Purpose (t3, m5) — balanced CPU/memory. Good for web servers, small databases.
- Compute Optimised (c5) — high CPU. Good for batch processing, gaming servers.
- Memory Optimised (r5, x1) — high RAM. Good for large databases, real-time analytics.
- Storage Optimised (i3, d2) — high disk throughput. Good for data warehouses, distributed file systems.
- Accelerated Computing (p3, g4) — GPUs. Good for ML training, video encoding.
EC2 Pricing Models:
- On-Demand — pay by the second. No commitment. Most expensive. Use for unpredictable workloads.
- Reserved Instances — 1 or 3 year commitment. Up to 72% savings. Standard RI (fixed), Convertible RI (flexible).
- Spot Instances — bid for unused EC2 capacity. Up to 90% savings. Can be interrupted with 2-minute notice. Use for fault-tolerant, interruptible workloads.
- Dedicated Hosts — physical server dedicated to you. Most expensive. Use for software licensing or compliance requirements.
- Savings Plans — flexible commitment to a compute spend ($x/hour for 1 or 3 years). Applies across EC2, Lambda, Fargate.
Lambda — serverless compute. Upload your code, AWS runs it when triggered. Pay per invocation and duration. No servers to manage. Maximum 15-minute execution time.
Elastic Beanstalk — PaaS. Upload your application code, AWS handles deployment, scaling, load balancing. You still control the underlying EC2 instances.
ECS (Elastic Container Service) — run Docker containers on AWS. Managed by AWS control plane. Use EC2 or Fargate for compute.
EKS (Elastic Kubernetes Service) — managed Kubernetes. Run Kubernetes without managing the control plane.
Fargate — serverless compute for containers. Run ECS or EKS tasks without managing EC2 instances.
Lightsail — simplified VMs, databases, and networking for simple workloads. Think: WordPress hosting with a fixed monthly price.
Batch — managed service for running batch computing jobs at any scale.
Storage Services
S3 (Simple Storage Service) — object storage. Unlimited storage, objects up to 5TB. Durability: 99.999999999% (11 nines). Globally unique bucket names.
S3 Storage Classes:
| Class | Use Case | Retrieval | Cost |
|---|---|---|---|
| Standard | Frequently accessed data | Milliseconds | Highest |
| Intelligent-Tiering | Unknown access patterns | Milliseconds | Varies |
| Standard-IA | Infrequently accessed, needs fast retrieval | Milliseconds | Lower |
| One Zone-IA | Infrequent access, can recreate if lost | Milliseconds | Lower |
| Glacier Instant Retrieval | Archives needing ms retrieval | Milliseconds | Low |
| Glacier Flexible Retrieval | Long-term archives | Minutes to hours | Very low |
| Glacier Deep Archive | 7-10 year retention | 12-48 hours | Lowest |
S3 Key Concepts:
- Versioning — keep multiple versions of an object. Protects against accidental deletion.
- Lifecycle policies — automatically move objects between storage classes or delete them.
- Replication — copy objects to another bucket (same or different region).
- Pre-signed URLs — temporary access URLs for private objects.
- Static website hosting — host a static HTML/JS/CSS site directly from S3.
EBS (Elastic Block Store) — persistent block storage for EC2. Like a virtual hard drive. Stays attached to one EC2 instance at a time (usually). Survives instance stops and terminations.
EFS (Elastic File System) — managed NFS file system. Multiple EC2 instances can mount the same EFS simultaneously. Scales automatically.
S3 Glacier — archival storage for long-term retention. Very cheap, but retrieval takes time.
Storage Gateway — connects on-premises systems to AWS cloud storage.
Snow Family — physical devices to move data to/from AWS when internet transfer isn't practical.
- Snowcone — smallest (8TB). Edge computing and data transfer.
- Snowball Edge — 80TB. Data migration plus local compute.
- Snowmobile — 100PB. A literal truck for exabyte-scale migrations.
Database Services
| Service | Type | Managed? | Use When |
|---|---|---|---|
| RDS | Relational (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB) | Yes | Traditional relational database |
| Aurora | Relational (MySQL/PostgreSQL compatible) | Yes | High performance relational — 5x faster than MySQL |
| DynamoDB | NoSQL key-value/document | Yes (serverless) | Single-digit ms latency at any scale |
| ElastiCache | In-memory caching (Redis, Memcached) | Yes | Speed up reads, session storage |
| Redshift | Data warehouse (columnar) | Yes | Analytics on petabytes of data |
| DocumentDB | MongoDB-compatible document DB | Yes | Migrating MongoDB workloads |
| Neptune | Graph database | Yes | Social networks, fraud detection |
| QLDB | Ledger database (immutable) | Yes | Audit trail, financial transactions |
RDS Multi-AZ — synchronous standby replica in a different AZ for high availability. Automatic failover. NOT for read scaling.
RDS Read Replicas — asynchronous copies for read scaling. Can be in different region. NOT for automatic failover.
Networking
VPC (Virtual Private Cloud) — your private network in AWS. Logically isolated from other customers. You define the IP address range, subnets, routing, and security.
Subnet — a range of IP addresses within your VPC.
- Public subnet — has a route to the internet gateway. Resources here can receive inbound internet traffic.
- Private subnet — no direct route to internet. Resources here can't receive inbound internet traffic.
Internet Gateway (IGW) — connects your VPC to the internet. Required for public subnets.
NAT Gateway — allows resources in private subnets to initiate outbound internet connections (e.g., download updates) without being reachable from the internet.
Security Group — stateful firewall at the instance level. Rules apply to inbound AND outbound. If you allow inbound, the response is automatically allowed out.
Network ACL (NACL) — stateless firewall at the subnet level. Must explicitly allow inbound AND outbound. Rules are numbered and evaluated in order.
Route 53 — AWS managed DNS service. Routes traffic to your AWS resources (or external). Supports routing policies: Simple, Weighted, Latency, Failover, Geolocation.
CloudFront — Content Delivery Network (CDN). Caches content at edge locations globally. Reduces latency for users. Works with S3, ALB, EC2.
Elastic Load Balancer (ELB):
- ALB (Application Load Balancer) — layer 7. Routes HTTP/HTTPS. Can route based on URL path or host header.
- NLB (Network Load Balancer) — layer 4. Ultra-high performance, millions of requests per second. For TCP/UDP.
- GLB (Gateway Load Balancer) — layer 3. Deploy and scale third-party virtual appliances (firewalls).
Direct Connect — dedicated private network connection from your data centre to AWS. More reliable and consistent than VPN over internet.
VPN — encrypted tunnel over the public internet from your data centre to AWS VPC.
Transit Gateway — connect multiple VPCs and on-premises networks through a central hub.
VPC Peering — private connection between two VPCs. No transit — traffic doesn't go over the internet.
Management & Monitoring
CloudWatch — monitoring and observability. Collects metrics, logs, and events. Set alarms. Trigger auto-scaling.
CloudTrail — records every API call made in your AWS account. Who did what, when, from where. Enabled by default, keeps 90 days. Send to S3 for longer retention.
AWS Config — records resource configurations and changes over time. Evaluate against compliance rules.
Systems Manager (SSM) — manage EC2 instances at scale. Patch manager, session manager (SSH without opening port 22), parameter store.
Trusted Advisor — automated best practice checks across cost, performance, security, fault tolerance, and service limits.
Well-Architected Tool — review your workloads against the six Well-Architected pillars.
Control Tower — set up and govern a multi-account AWS environment following best practices.
Organizations — manage multiple AWS accounts centrally. Consolidated billing. Service Control Policies (SCPs) to restrict what member accounts can do.
AWS Health Dashboard — service status and alerts specific to your AWS account.
Application Integration
SQS (Simple Queue Service) — message queue. Decouples components. Messages wait in queue until consumer processes them. Pull-based.
SNS (Simple Notification Service) — pub/sub messaging. Push notifications to multiple subscribers simultaneously (email, SMS, Lambda, SQS).
EventBridge — serverless event bus. Connect AWS services and SaaS applications through events.
Step Functions — serverless workflow orchestration. Chain Lambda functions and AWS services into visual workflows.
Developer Tools
CodeCommit — managed Git repositories (like GitHub on AWS). Being deprecated — migrate to GitHub.
CodeBuild — managed build service. Compiles code, runs tests, produces artifacts.
CodeDeploy — automated deployments to EC2, Lambda, ECS, or on-premises.
CodePipeline — CI/CD pipeline orchestration. Chains CodeCommit, CodeBuild, CodeDeploy together.
CloudFormation — Infrastructure as Code. Define AWS resources in YAML or JSON templates. Provision and update resources consistently.
CDK (Cloud Development Kit) — define cloud infrastructure using programming languages (Python, TypeScript, Java).
Domain 4: Billing, Pricing, and Support (12%)
AWS Pricing Principles
Three fundamentals:
- Pay for what you use — no upfront costs, no termination fees (for most services)
- Pay less when you reserve — commit upfront for significant discounts
- Pay less with more usage — tiered pricing, more you use the cheaper it gets (S3, data transfer)
Free Tier
Three types of free tier offers:
- Always free — never expires (Lambda 1M requests/month, DynamoDB 25GB)
- 12 months free — free for one year from account creation (EC2 t2.micro 750 hours/month, S3 5GB)
- Trials — short-term free trials for specific services
Pricing Tools
AWS Pricing Calculator — estimate costs for a new architecture before building it.
AWS Cost Explorer — visualise and analyse your historical and current spending. Identify trends.
AWS Budgets — set cost and usage budgets. Get alerts when approaching or exceeding limits.
Cost and Usage Report (CUR) — most detailed billing data. Export to S3 for analysis.
Savings Plans — flexible pricing model offering up to 72% savings vs On-Demand in exchange for a 1 or 3-year spend commitment.
AWS Support Plans
| Plan | Price | Response Time (Critical) | Use Case |
|---|---|---|---|
| Basic | Free | None (docs only) | Exploring AWS |
| Developer | $29/mo (or 3% of usage) | 12 hours (business hours) | Dev/test environments |
| Business | $100/mo (or 10% of usage) | 1 hour | Production workloads |
| Enterprise On-Ramp | $5,500/mo | 30 minutes | Business-critical workloads |
| Enterprise | $15,000/mo | 15 minutes | Mission-critical workloads |
Technical Account Manager (TAM) — available with Enterprise On-Ramp and Enterprise plans. Your dedicated AWS expert.
Concierge Support — Enterprise only. Billing and account management specialists.
Trusted Advisor — full checks available with Business and above. Basic and Developer get limited checks.
AWS Organizations and Consolidated Billing
Consolidated billing — combine usage across multiple accounts for volume discounts. Reserved Instance and Savings Plan benefits can be shared across accounts. One invoice for all accounts.
Service Control Policies (SCPs) — restrict what AWS services and actions member accounts can use. Applied at the OU (Organizational Unit) or account level.
Management account — the root account that created the organization. Cannot be restricted by SCPs.
Cost Management Best Practices
Rightsizing — match instance type and size to actual workload. Don't pay for capacity you don't use.
Reserved Instances and Savings Plans — for predictable, steady-state workloads.
Spot Instances — for fault-tolerant, interruptible workloads.
Auto Scaling — automatically adjust capacity, avoid over-provisioning.
S3 Lifecycle policies — move data to cheaper storage tiers automatically.
Delete unused resources — idle EC2, unattached EBS volumes, old snapshots. Use Cost Explorer to find them.
Quick Reference: Key Acronyms and Terms
| Term | What it means |
|---|---|
| AZ | Availability Zone — one or more data centres in a region |
| AMI | Amazon Machine Image — template for launching EC2 instances |
| EBS | Elastic Block Store — persistent disk storage for EC2 |
| EFS | Elastic File System — shared file storage (NFS) |
| ELB | Elastic Load Balancer — distributes traffic across instances |
| IAM | Identity and Access Management — controls who can do what |
| IGW | Internet Gateway — connects VPC to internet |
| KMS | Key Management Service — manages encryption keys |
| MFA | Multi-Factor Authentication — second verification step |
| NACL | Network Access Control List — stateless subnet-level firewall |
| RDS | Relational Database Service — managed SQL databases |
| RPO | Recovery Point Objective — max acceptable data loss |
| RTO | Recovery Time Objective — max acceptable downtime |
| S3 | Simple Storage Service — object storage |
| SCPs | Service Control Policies — guardrails for AWS Organizations |
| SNS | Simple Notification Service — pub/sub messaging |
| SQS | Simple Queue Service — message queuing |
| VPC | Virtual Private Cloud — your isolated network in AWS |
Exam Strategy
The exam is scenario-based. You won't be asked "what does EC2 stand for?" You'll be asked "a company needs highly available web servers across two locations — what should they do?" The answer: deploy EC2 instances across two AZs with a load balancer.
Work from what the question is actually asking:
- Identify the problem (availability? cost? security? compliance?)
- Eliminate answers that are clearly wrong
- Between the remaining options, pick the one that best solves the stated problem with the least complexity
Common exam traps:
- "Most cost-effective" = Reserved Instances or Spot (not On-Demand)
- "Highly available" = multiple AZs (not multiple regions)
- "Audit logging / who did what" = CloudTrail (not CloudWatch)
- "Performance monitoring / metrics" = CloudWatch (not CloudTrail)
- "Managed database" = RDS/Aurora (not EC2 with MySQL installed)
- "Serverless" = Lambda, DynamoDB, Aurora Serverless, Fargate
- "Multi-AZ vs Read Replica" = Multi-AZ for HA/failover, Read Replica for read scaling
Time management: 65 questions in 90 minutes = 83 seconds per question. Flag hard ones and come back. Don't overthink — the right answer is usually the simplest one that solves the stated problem.
The Real Problem With Studying for This Exam
Most people spend weeks going through video courses, taking notes on everything, and then sitting down for a practice exam and scoring 60% — not knowing which topics to focus on next.
The fastest path to passing isn't studying more. It's knowing exactly which domains you're weak in and only focusing there.
That's what StudyTech was built for.