AWS Certified Cloud Practitioner (CLF-C02) — the complete study guide

Cloud Practitioner is the shortest path to a credential that actually opens doors, and it is genuinely achievable in three focused weeks. It is also the exam where people over-prepare on services and under-prepare on billing — which is 12% of the exam and the easiest 12% to secure.

The exam at a glance#

No penalty for wrong answers — answer every question. Flag and return rather than stalling.

Domain weightings#

Note that Security and Compliance is nearly a third of the exam. For a "foundational" certification that surprises people. If you are coming from a security background, this is where your existing knowledge pays.

Domain 1 — Cloud Concepts (24%)#

The value proposition#

The six advantages of cloud, in AWS's own framing:

1. Trade capital expense for variable expense
2. Benefit from massive economies of scale
3. Stop guessing capacity
4. Increase speed and agility
5. Stop spending money running and maintaining data centres
6. Go global in minutes

Expect at least one question that is simply asking you to recognise one of these restated.

Design principles#

• The AWS Well-Architected Framework and its pillars: operational excellence, security, reliability, performance efficiency, cost optimisation, and sustainability. Be able to place a scenario in the right pillar.
• Elasticity vs scalability — elasticity is automatic adjustment to demand; scalability is the ability to grow. Related, not identical.
• High availability vs fault tolerance vs disaster recovery.
• Loose coupling, designing for failure, horizontal vs vertical scaling.

Migration and the cloud economics#

• Migration strategies (the "7 Rs"): rehost, replatform, repurchase, refactor, retire, retain, relocate.
• Total cost of ownership, the AWS Pricing Calculator, and the Migration Evaluator.
• Cloud deployment models: cloud, hybrid, on-premises.
• Service models: infrastructure, platform and software as a service, and which AWS services sit where.

Domain 2 — Security and Compliance (30%)#

The shared responsibility model#

This is the single most-tested concept in the exam.

AWS is responsible for      SECURITY OF THE CLOUD
  Hardware, global infrastructure, regions, availability zones,
  edge locations, the managed service software itself.
 
You are responsible for     SECURITY IN THE CLOUD
  Customer data, platform and application management, identity and
  access, operating system and network configuration, client- and
  server-side encryption, network traffic protection.

The line moves depending on the service. With EC2 you patch the operating system; with RDS AWS does; with Lambda there is no operating system to patch and your responsibility is the code and its permissions. Expect a question in exactly this shape.

Identity and access#

• Root user — used only for the handful of tasks that require it; enable MFA on it immediately and then stop using it. This is a guaranteed question.
• IAM users, groups, roles and policies; least privilege; using roles rather than long-lived access keys.
• IAM Identity Center for workforce single sign-on.
• Multi-factor authentication.

Security services worth knowing by name#

Compliance#

AWS Artifact for compliance documents, AWS Compliance Programs, data residency and the fact that you choose your Region and AWS does not move your data out of it.

Domain 3 — Cloud Technology and Services (34%)#

You do not need depth here — you need to know what each service is for so you can match a requirement to a service.

Compute#

• EC2 — virtual machines. Instance families, AMIs.
• Lambda — serverless functions, event-driven, no servers to manage, execution time limits.
• ECS / EKS / Fargate — containers; Fargate is the serverless container option.
• Elastic Beanstalk — deploy an application, AWS handles the infrastructure.
• Auto Scaling and Elastic Load Balancing.

Storage#

• S3 — object storage. Storage classes: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive. Lifecycle policies.
• EBS — block storage attached to one EC2 instance in one availability zone.
• EFS — shared file storage across many instances, multi-AZ.
• FSx — managed Windows / Lustre file systems.
• Storage Gateway and Snowball for hybrid and bulk transfer.

Networking#

• VPC, subnets, route tables, internet gateway, NAT gateway.
• Security groups vs network ACLs — instance-level and stateful vs subnet-level and stateless.
• Route 53 — DNS. CloudFront — content delivery network.
• Direct Connect (dedicated private connection) vs Site-to-Site VPN (encrypted over the internet).
• Regions, Availability Zones, Edge Locations, Local Zones, Outposts.

Databases#

• RDS (managed relational), Aurora (AWS's high-performance relational), DynamoDB (managed NoSQL, single-digit millisecond), ElastiCache (in-memory), Redshift (data warehouse), DocumentDB, Neptune.
• Database Migration Service for moving databases in.

Management and developer tools#

CloudFormation (infrastructure as code), Systems Manager, CloudWatch, CodeCommit/CodeBuild/CodeDeploy/CodePipeline, the AWS CLI, SDKs and the Management Console.

Integration and analytics#

SNS (publish/subscribe notifications), SQS (message queues), EventBridge, Step Functions, Athena, Glue, Kinesis, QuickSight.

Domain 4 — Billing, Pricing and Support (12%)#

Small, easy, and routinely neglected. Do not neglect it.

EC2 purchasing options#

Cost management tools#

• AWS Budgets — alerts when spend or usage crosses a threshold.
• Cost Explorer — visualise and forecast spend.
• Cost and Usage Report — the detailed line-item export.
• Consolidated billing through AWS Organizations — one bill, and volume discounts pooled across accounts.
• Cost Allocation Tags for attributing spend.
• AWS Pricing Calculator for estimating before you build.

Support plans#

Know which plan first gives you a Technical Account Manager, and which gives full Trusted Advisor. Both appear regularly.

A three-week study plan#

Week 1 — Concepts and security. Domains 1 and 2. Draw the shared responsibility model yourself for three different services (EC2, RDS, Lambda). Create a free-tier account, enable MFA on the root user, and make an IAM user.

Week 2 — Services. Domain 3. Do not memorise limits — build a one-line description of each service in your own words. Launch an EC2 instance, put an object in S3, and create a Lambda function that does something trivial.

Week 3 — Billing and practice. Domain 4 in two days, then practice exams for the rest of the week. Set a budget alert on your own account; it makes Domain 4 concrete in ten minutes.

Where marks get lost#

• Guessing at the shared responsibility line for managed services.
• Confusing S3 storage classes with retrieval characteristics.
• Mixing up Availability Zones and Regions — an AZ is one or more discrete data centres within a Region.
• Skipping the support plans table because it feels like trivia. It is trivia, and it is free marks.
• Confusing CloudTrail with CloudWatch. CloudTrail records who did what; CloudWatch records how things are performing.

Resources#

• The official AWS Exam Guide for CLF-C02.
• AWS Skill Builder's free Cloud Practitioner Essentials course.
• A free-tier account with a billing alarm set to a low number.
• One practice exam bank for timing.

Three weeks, done properly, is enough. Book the exam before you start — the date is what makes the plan real.