CLF-C02 · Last-Minute Review
AWS Cloud Practitioner (CLF-C02) Cheat Sheet
Everything the AWS Certified Cloud Practitioner exam tests, compressed into one page. Review this the night before your exam, then verify your recall with free practice questions.
Core concepts
- Shared responsibility model: AWS = security of the cloud (physical data centers, hardware, hypervisor, network). Customer = security in the cloud (data, IAM, guest OS patching, security groups).
- Region = geographically isolated area with 3+ Availability Zones.
- Availability Zone = one or more isolated data centers with independent power, cooling and networking.
- Edge location = CloudFront cache site close to users for low-latency content delivery.
- Pay-as-you-go converts large capital expense (CAPEX) into variable operating expense (OPEX).
- Well-Architected pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.
Every core service in one table
| Service | One-line job | Pick it when… |
|---|---|---|
| EC2 | Resizable virtual servers | You need full control of a server |
| Lambda | Serverless, event-driven code | You don't want to manage servers |
| Auto Scaling | Adjusts EC2 count to demand | Load varies and cost must follow demand |
| ELB | Distributes traffic across instances | High availability across multiple targets |
| S3 | Object storage, 11 nines durability | Storing files, images, backups, static content |
| EBS | Block storage for EC2 | A single EC2 instance needs persistent disk |
| EFS | Shared NFS file system | Multiple EC2 instances need shared files |
| Glacier / Glacier Deep Archive | Cheap archival storage | Rarely accessed data, long-term retention |
| RDS | Managed relational database | SQL workloads (MySQL, PostgreSQL, etc.) |
| Aurora | AWS-native MySQL/PostgreSQL | High-performance relational DB |
| DynamoDB | NoSQL key-value DB | Single-digit ms latency, serverless apps |
| ElastiCache | In-memory cache (Redis/Memcached) | Read-heavy workloads need low latency |
| Route 53 | DNS (domain → IP) | DNS routing and domain registration |
| CloudFront | CDN via edge locations | Deliver content fast worldwide |
| VPC | Isolated virtual network | You launch resources in your own network |
| IAM | Users, groups, roles, policies | Controlling access and permissions |
| WAF | Web application firewall | Blocking SQL injection, XSS |
| Shield | DDoS protection | Protecting against DDoS attacks |
| GuardDuty | Threat detection | Monitoring for malicious behavior |
| KMS | Encryption key management | Encrypting data at rest |
| CloudTrail | Records API activity | Auditing who did what, when |
| CloudWatch | Metrics, logs, alarms | Operational monitoring |
| Config | Configuration compliance auditing | Auditing resource config over time |
| Artifact | Compliance reports (SOC, PCI) | Downloading security reports |
| SQS | Message queue | Decoupling application components |
| SNS | Pub/sub notifications | Sending alerts to email/SMS/Lambda |
| API Gateway | Create/manage APIs | Building and securing APIs |
| ECS / EKS / Fargate | Run containers | Containerized applications |
EC2 purchasing options
| Option | Cost | Notes |
|---|---|---|
| On-Demand | Highest per unit | No commitment, pay per second/hour |
| Reserved / Savings Plans | Up to ~72% off | 1- or 3-year commitment, steady workloads |
| Spot | Up to 90% off | Unused capacity; can be interrupted with 2-minute notice |
Billing & pricing tools
- Cost Explorer — visualize and forecast spending over time.
- Pricing Calculator — estimate cost before you build.
- Budgets — alerts when spending passes a threshold.
- Consolidated billing — one bill across accounts; volume discounts.
- Free Tier — 12-month free usage for new accounts.
- Trusted Advisor — recommendations on cost, security, fault tolerance, performance.
- Support plans: Basic (free) → Developer → Business → Enterprise (TAM, 15-min response).
Security quick facts
- Security group = stateful, allow-only virtual firewall at instance level.
- IAM role = temporary credentials for EC2/services (no long-lived keys in code).
- Least privilege = grant only the permissions needed.
- MFA = second factor beyond password; enable on the root account.
- Data at rest → encryption keys via KMS; data in transit → TLS/SSL.
The exam in 3 numbers
- 65 questions, 90 minutes, pass at 700/1000.
- Domains: Concepts 24%, Security 30%, Tech 34%, Billing 12%.
Test yourself on every fact above
Start free in seconds — no signup, no credit card. Practice questions, timed mock exams with the official 70% pass threshold, and flashcards.