☁️🎯

AWS Cloud Practitioner
CLF-C02 in bite-size pieces

One idea per slide · memory hooks · exam traps · quizzes

⌨️ →/Space next · ← back · M menu · N next quiz · F full screen · swipe on phone

Know your enemyThe exam at a glance

📝

65 questions

50 count. 15 are unscored tests — you can't tell which.

⏱️

90 minutes

≈ 80 sec per question. Plenty of time — don't rush.

🎯

700 / 1000

Scaled score. You pass on the total, not per domain.

💵

USD 100

Test centre or online proctored. Valid for 3 years.

✅ Two question types

Multiple choice: 1 right of 4.
Multiple response: 2+ right of 5+ (the question tells you how many).

🎲 No penalty for guessing

A blank answer = wrong. Never leave a question empty. Flag it and come back.

Study where the points are4 domains, 4 colours

🛠️ D3 Technology & Services

34%

🔐 D2 Security & Compliance

30%

☁️ D1 Cloud Concepts

24%

💰 D4 Billing, Pricing & Support

12%

D2 + D3 = 64% of your score. Security and "which service fits?" are the big wins.

The colour of the top progress bar tells you which domain you are in.

Your brain, your rulesHow to use this deck

🍅

Sprints

Do one domain block (≈15–20 slides), then take the 🧃 brain break slide seriously.

🧠

Yellow boxes

Memory hooks. Say them out loud. Silly = sticky.

🪤

Red boxes

Exam traps — the wrong answers AWS loves to offer.

❓

Quizzes

Click an answer. You get the reason at once. Score is saved in your browser.

🃏

Flip cards

Recap slides. Guess first, then tap to flip.

🔁

Repeat

Day 1 read. Day 2 quizzes only (press N). Day 3 the final mock + cheat sheet.

Exam techniqueThe 3-step answer method

1

Find the keyword

"least operational overhead", "most cost-effective", "audit", "DDoS", "serverless"…

2

Map keyword → service

Most questions are a lookup: "who made this API call?" → CloudTrail.

3

Kill the distractors

Remove made-up or wrong-category services first. Then pick the managed / simplest option.

When in doubt on CLF-C02, AWS usually wants the managed, serverless, pay-as-you-go answer.

Words like "least", "NOT", "MOST" flip the meaning. Read the last line of the question twice.

D1

Cloud Concepts

24% of your score

Why cloud · Well-Architected · Migration · Cloud economics

DefinitionWhat is cloud computing?

The on-demand delivery of IT resources over the internet with pay-as-you-go pricing.

🔌

Like electricity

You don't build a power plant. You plug in and pay for what you use.

⚡

On demand

Servers in minutes, not weeks of ordering hardware.

🧾

Pay as you go

Turn it off → stop paying. No big upfront purchase.

Classic exam listThe 6 advantages of cloud computing

🔁

1 · Trade fixed expense for variable expense

No upfront data-centre spend. Pay only when you use.

🏭

2 · Benefit from massive economies of scale

AWS buys huge volumes → lower prices for you.

🔮

3 · Stop guessing capacity

Scale up or down with demand. No idle or overloaded servers.

🚀

4 · Increase speed and agility

New resources in minutes → experiment fast, fail cheap.

🧹

5 · Stop spending money running and maintaining data centres

Focus on customers, not racking and cooling servers.

🌍

6 · Go global in minutes

Deploy in many Regions → low latency for users worldwide.

💸 Pay less (1, 2) · 🔮 Guess less (3) · 🚀 Move faster (4) · 🧹 Drop the data centre (5) · 🌍 Go global (6)

Words the exam lovesCloud vocabulary

🪗

Elasticity

Resources grow and shrink automatically to match demand. (Auto Scaling)

📈

Scalability

The system can handle more load by adding resources.

🟢

High availability

Stays up with minimal downtime — e.g. run in multiple AZs.

🛡️

Fault tolerance

Keeps working even when a component fails (no user impact).

🐇

Agility

Speed to try new things: low cost + fast provisioning.

💎

Durability

Data is not lost. S3 = 99.999999999% (11 nines).

Elasticity ≠ scalability. Elasticity = automatic, both directions, follows demand. "Scale in when traffic drops to save money" → elasticity.

Picture itScale up vs scale out

Bigger machine (more CPU/RAM). Has a ceiling. Often needs a restart.

Add more machines behind a load balancer. The cloud-native way.

Scale up = grow taller (one bigger server). Scale out = add more friends (more servers). Shrinking back = scale down / scale in.

Cloud service models🍕 Pizza as a service

Model	Pizza version	You manage	AWS example
🏗️ IaaS Infrastructure	Buy dough + oven time, you cook	OS, patches, apps, data	Amazon EC2, Amazon VPC
🧰 PaaS Platform	Pizza delivered, you set the table	Your code + data	AWS Elastic Beanstalk
📦 SaaS Software	Eat at the restaurant	Just use it (your data/settings)	Webmail, Salesforce, Amazon Connect (contact centre)

The further down the table, the less you manage. IaaS = "I do a lot", SaaS = "So easy".

Where does it run?Cloud deployment models

☁️

Cloud (all-in)

Everything runs in the public cloud. New cloud-native apps or fully migrated.

🌉

Hybrid

Connect on-premises + cloud. Keep some systems on-site (legacy, regulation). E.g. AWS Outposts, VPN, Direct Connect.

🏢

On-premises (private cloud)

Your own data centre with virtualisation / resource-management tools.

"Keep some apps in our data centre and run new ones on AWS, connected together" → Hybrid.

An online shop adds servers automatically during a holiday sale and removes them when traffic drops. Which cloud concept is this?

Automatic growth and shrinking to match demand = elasticity. Fault tolerance is about surviving failures; durability is about not losing data.

Which are advantages of cloud computing listed by AWS?

Correct: Stop guessing capacity and Go global in minutes. Option A is backwards — you trade fixed for variable. Watch for reversed wording!

Cloud economicsOn-premises: you must guess

━ On-prem capacity (big steps you buy upfront) · ━ Real demand · ┅ Cloud capacity (follows demand)

On-prem = CapEx (capital expense, upfront, fixed). Cloud = OpEx (operating expense, variable, pay as you go).

Total Cost of Ownership (TCO)The hidden costs of on-premises

🖥️

Servers, storage, network gear

🏢

Building / rack space (real estate)

⚡

Power + cooling

👷

Staff to install, patch, replace hardware

🔒

Physical security

📜

Software licences

🔄

Hardware refresh every few years

🧯

Disaster recovery site

Cloud removes most of these. Economies of scale: AWS spreads these costs over millions of customers → lower prices.

Business-case tool for migration TCO: Migration Evaluator. Estimating new AWS costs: AWS Pricing Calculator.

Cloud economicsLicensing · Rightsizing · Automation

📜

Licensing

License included: price includes the licence (e.g. Windows on EC2, Oracle SE2 / SQL Server on RDS).

BYOL (Bring Your Own License): reuse licences you already own. Often needs Dedicated Hosts (per-socket / per-core licences).

Track licences: AWS License Manager.

📏

Rightsizing

Match instance type + size to the real workload. Stop paying for idle CPU.

Tools: AWS Compute Optimizer, Cost Explorer rightsizing recommendations, Trusted Advisor.

🤖

Automation

Infrastructure as code (CloudFormation), Auto Scaling, scheduled start/stop.

Benefits: fewer human errors, repeatable, faster, cheaper.

Rightsizing = buying the right shoe size. Too big wastes money, too small hurts.

A company wants to move servers to AWS and reuse its existing Windows Server licences that are tied to physical cores. What should it use?

Socket/core-bound BYOL licences → Dedicated Hosts (you see the physical server's sockets and cores). License-included means paying AWS for a new licence.

Which statement BEST describes the change in cost model when moving to AWS?

Cloud swaps CapEx (upfront, fixed) for OpEx (variable, pay-as-you-go). Option A is the reverse.

AWS Well-Architected FrameworkThe 6 pillars 🏛️

"CROPS + S" → Cost · Reliability · Operational excellence · Performance efficiency · Security · + Sustainability (the newest, added 2021).

Tell them apartKeyword → pillar

Pillar	Big idea	Exam keywords
⚙️ Operational excellence	Run and improve operations	operations as code (IaC), small reversible changes, learn from failures, observability
🔐 Security	Protect data and systems	least privilege, traceability, encrypt, security at all layers, prepare for incidents
🧱 Reliability	Work correctly + recover	recover from failure automatically, Multi-AZ, test recovery, stop guessing capacity
🏎️ Performance efficiency	Use resources efficiently	right instance type, serverless, go global in minutes, experiment more often
💰 Cost optimization	Avoid unnecessary cost	pay only for what you use, measure efficiency, cloud financial management, rightsizing
🌱 Sustainability	Reduce environmental impact	maximise utilisation, managed services, reduce energy and waste, shared responsibility for sustainability

"Recover from failure" → Reliability (not performance). "Choose the right resource type for the job" → Performance efficiency.

Which Well-Architected pillar focuses on a workload's ability to recover automatically from infrastructure or service failures?

Reliability = work correctly and consistently, and recover from failure.

A team performs operations as code and makes frequent, small, reversible changes. Which pillar does this design principle belong to?

"Perform operations as code" and "make frequent, small, reversible changes" are Operational excellence design principles.

AWS CAFCloud Adoption Framework = the migration "playbook"

👔 Business-side perspectives

Business strategy → business outcomes

People culture, skills, change

Governance programs, benefits, risk

🛠️ Technical-side perspectives

Platform build the cloud platform

Security confidentiality, integrity, availability

Operations run and support services

🎯 Business outcomes

Reduced business risk · Improved ESG performance · Increased revenue · Increased operational efficiency

🔄 Transformation phases

Envision → Align → Launch → Scale

Perspectives: "Big People Govern, Platforms Secure Operations". Phases: "Every Astronaut Lands Safely".

Migration strategiesThe 7 Rs — from lazy to heavy

R	Meaning	Nickname / example
🗑️ Retire	Turn it off — not needed	"Delete it"
⏸️ Retain	Keep on-prem for now	"Not yet" (revisit later)
🚚 Rehost	Move as-is to EC2	Lift and shift · AWS Application Migration Service
📦 Relocate	Move at hypervisor level, no app change	e.g. move VMware VMs to VMware Cloud on AWS / Amazon EVS
🔧 Replatform	Small optimisation, same core	Lift, tinker and shift · self-managed DB → Amazon RDS
🛒 Repurchase	Switch to a different product	Drop and shop · move to SaaS
🏗️ Refactor	Re-architect for cloud-native	e.g. monolith → serverless/microservices

Resources for the migration journeyMigration tools

Discover what servers + dependencies you have on-prem

→

AWS Application Discovery Service

Build a business case / projected AWS cost

→

Migration Evaluator

Track all migrations in one place

→

AWS Migration Hub

Lift-and-shift servers (rehost) to AWS

→

AWS Application Migration Service

Move a database (source stays online, continuous replication)

→

AWS DMS (Database Migration Service)

Convert schema between different DB engines (e.g. Oracle → Aurora PostgreSQL)

→

AWS SCT (Schema Conversion Tool)

Fast recovery of servers into AWS after a disaster

→

AWS Elastic Disaster Recovery

The exam still uses these names. In real life, Migration Hub and Application Discovery Service closed to new customers on 7 Nov 2025 — AWS Transform replaces them.

Older study notes mention the AWS Snow Family (Snowcone, Snowball, Snowmobile). It is not on the current CLF-C02 in-scope list, and Snow devices are no longer offered to new customers. Know only: "Snowball = physical device to ship lots of data offline".

A company moves its self-managed MySQL database from an on-premises server to Amazon RDS for MySQL, without changing the application code. Which migration strategy is this?

Same engine, but now a managed platform → small optimisation = Replatform ("lift, tinker and shift"). Rehost would be copying the server as-is to EC2.

Which AWS CAF perspective focuses on culture, organisational change and building cloud skills (training)?

People = culture, workforce transformation, skills. Governance = programs, risk, benefits.

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL with minimal downtime. Which AWS services should it use?

Different engines (heterogeneous) → SCT converts the schema, DMS moves and continuously replicates the data while the source stays online.

Recap · guess, then tapDomain 1 flash cards

CapEx = upfront, fixed (on-prem). OpEx = variable, pay-as-you-go (cloud).

Cost, Reliability, Operational excellence, Performance efficiency, Security, Sustainability

Automatically add AND remove resources to match demand.

Rehost

Repurchase (move to a SaaS product)

Envision → Align → Launch → Scale

AWS SCT (schema) + AWS DMS (data)

EC2 Dedicated Hosts

🧃🚶

Brain break — 5 minutes

Stand up. Drink water. Say the 6 pillars out loud once: CROPS + S.

Next: Domain 2 — Security (the 30% chunk) 🔐

D2

Security & Compliance

30% of your score

Shared responsibility · IAM · Encryption · Security services · Logging · Compliance

#1 most tested ideaShared responsibility model

🏠 AWS builds and guards the house (OF). You lock your doors and protect your stuff inside (IN).

The more managed, the less you doWho patches what?

Layer	🖥️ EC2 (IaaS)	🗄️ RDS (managed)	λ Lambda (serverless)
Your data + access (IAM)	You	You	You
Application / code	You	You (schemas, queries)	You (function code)
Firewall rules (security groups)	You	You	AWS*
Database engine / runtime patches	You	AWS	AWS
Operating system patches	You (guest OS)	AWS	AWS
Hardware, virtualisation, facilities	AWS	AWS	AWS

* Lambda: no servers for you to firewall. If you attach a function to your VPC, you control its security groups.

🤝 Shared controls (both sides)

Patch management, configuration management, awareness & training — AWS does its part, you do yours.

📥 Inherited controls

Physical and environmental controls — you inherit them fully from AWS.

Under the shared responsibility model, which task is the customer's responsibility when using Amazon EC2?

On EC2 you own the guest OS and everything above it. Hypervisor, disks and facilities = AWS.

A company uses Amazon RDS. Which task does AWS perform for them?

RDS is managed: AWS patches the OS and DB engine (in your maintenance window). Users, security groups and data are still yours.

AWS Identity and Access Management (IAM)IAM in one picture

AWS managed policy

Ready-made by AWS (e.g. ReadOnlyAccess).

Customer managed policy

You write it — reusable, tailored = best for least privilege.

Inline policy

Embedded in one user/group/role only.

Least privilege = give only the permissions needed, nothing more. Attach policies to groups, not individual users. An explicit Deny always wins.

👑 The root userProtect it. Then don't use it.

✅ Protect root

Turn on MFA
Strong, unique password
No root access keys (delete any)
Create an admin in IAM Identity Center for daily work
In AWS Organizations: centrally remove member-account root credentials

👑 Tasks only root can do

Change root email / root password / root access keys
Close the account (standalone account)
Restore IAM permissions when the only admin locked themselves out
Activate IAM access to the Billing console
View certain tax invoices
Register as a seller in the Reserved Instance Marketplace
Enable MFA Delete on an S3 bucket
Fix an S3 bucket / SQS policy that denies everyone
Sign up for AWS GovCloud (US)

Older notes say "change the support plan" is root-only. The current AWS list no longer includes it.

How identities sign inAuthentication options

🔑

MFA

Something you know + something you have. Passkeys / FIDO security keys, authenticator apps, hardware TOTP tokens.

🔐

Password policy

Set length, complexity, rotation and reuse rules for IAM users.

🗝️

Access keys

Access key ID + secret for CLI / SDK / API. Never put them in code. Prefer roles.

🎭

IAM roles

Temporary credentials. For EC2 → S3 access, Lambda permissions, and cross-account access.

🏢

IAM Identity Center

Single sign-on (SSO) for your workforce across many AWS accounts and apps. Connects to your corporate directory.

🤝

Federation

Use an external identity provider (SAML 2.0 / OIDC, e.g. Microsoft Entra ID, Okta) instead of creating IAM users.

Employees sign in once to many AWS accounts

→

IAM Identity Center

Sign-up / sign-in for your app's customers (web/mobile)

→

Amazon Cognito

Managed Microsoft Active Directory in AWS

→

AWS Directory Service

Credential storage & encryption keysWhere do secrets live?

🤫

AWS Secrets Manager

Stores DB passwords, API keys. Automatic rotation built in. Paid per secret.

🗂️

Systems Manager Parameter Store

Config values + secrets (SecureString). Standard tier free. No built-in rotation.

🔑

AWS KMS

Create and manage encryption keys. AWS-managed, multi-tenant HSMs. Integrated with S3, EBS, RDS… Logged in CloudTrail.

🧱

AWS CloudHSM

Dedicated hardware security module (single-tenant). You fully control keys. For strict compliance.

📜 AWS Certificate Manager (ACM)

Provision, manage and auto-renew SSL/TLS certificates (HTTPS). Public certificates for use with ACM-integrated services (ELB, CloudFront, API Gateway) are free.

"Rotate secrets automatically" → Secrets Manager. "Dedicated / single-tenant HSM" → CloudHSM. "Manage encryption keys" → KMS.

Benefit of cloud securityEncryption: 2 states of data

At rest

Data stored on disk. S3 encrypts all new objects by default (SSE-S3). EBS, RDS, DynamoDB support KMS encryption.

In transit

Data moving between client and AWS or between services. Use TLS (HTTPS), VPN.

Encryption is the customer's choice and configuration (shared model) — AWS gives the tools (KMS, ACM).

An application running on an Amazon EC2 instance needs to read objects from an S3 bucket. What is the MOST secure way to give it access?

IAM roles give temporary, automatically rotated credentials — no long-term keys in code.

Which are AWS best practices for the AWS account root user?

MFA and no root access keys. You can't attach IAM policies to the root user (in AWS Organizations, an SCP can restrict a member account's root user). Daily work → admin user via IAM Identity Center.

A company needs to store database credentials and rotate them automatically every 30 days. Which service meets this with the LEAST effort?

Secrets Manager = store + automatic rotation. KMS manages encryption keys, not app passwords.

Meet the guard teamSecurity services (memorise these!)

🛡️

AWS Shield

DDoS protection. Standard: free, automatic for all. Advanced: paid, 24/7 Shield Response Team, DDoS cost protection.

🧱

AWS WAF

Web Application Firewall (layer 7). Blocks SQL injection, cross-site scripting, bad IPs, bots. On CloudFront, ALB, API Gateway.

🎛️

AWS Firewall Manager

Manage WAF, Shield Advanced and security group rules centrally across all accounts in AWS Organizations.

🐕

Amazon GuardDuty

Intelligent threat detection. ML analyses CloudTrail, VPC Flow Logs, DNS logs → finds malicious activity.

🔍

Amazon Inspector

Automated vulnerability scanning (CVEs, unintended network exposure) of EC2, container images in ECR, Lambda.

🕵️

Amazon Macie

Finds sensitive data (PII) in S3 using ML. E.g. credit card numbers, passport IDs.

🔎

Amazon Detective

Investigate the root cause of security findings. Builds graphs from logs.

📊

AWS Security Hub

Single dashboard: collects findings from GuardDuty, Inspector, Macie…, checks best practices / standards.

Name note: the best-practice / standards checks are now called "AWS Security Hub CSPM". "Security Hub" is now the unified product that correlates findings from CSPM, GuardDuty, Inspector and Macie. For the exam: Security Hub = the central place for security findings and posture checks.

Make them stick🧠 One-line hooks

🐕 GuardDuty

→

a guard dog that barks at threats it sees in your logs

🔍 Inspector

→

a building inspector checking for weaknesses (vulnerabilities)

🕵️ Macie

→

"Ma-see your secrets" — finds PII in S3

🔎 Detective

→

arrives after the crime — investigates root cause

🛡️ Shield

→

blocks the flood → DDoS

🧱 WAF

→

Web attacks: SQL injection, XSS (layer 7)

📊 Security Hub

→

the hub where all findings meet

AWS Marketplace sells third-party security products (firewalls, antivirus, SIEM) that you can run on AWS.

A company wants to automatically discover and classify personally identifiable information (PII) stored in Amazon S3 buckets. Which service should it use?

PII in S3 → Macie. Inspector = vulnerabilities, GuardDuty = threats, Shield = DDoS.

Which service protects a web application from SQL injection and cross-site scripting attacks?

Application-layer (layer 7) web exploits → AWS WAF. Shield is for DDoS. Security groups filter by IP/port only.

A company needs to scan its EC2 instances and container images for software vulnerabilities continuously. Which service meets this need?

Software vulnerabilities (CVEs) on EC2 / ECR / Lambda → Amazon Inspector.

Where are the logs?The 3 governance twins (that people mix up)

👣

AWS CloudTrail

WHO did WHAT, WHEN — records API calls / account activity.

→ auditing, "who deleted my bucket?"

📈

Amazon CloudWatch

HOW is it doing? — metrics, logs, alarms, dashboards.

→ monitoring, "CPU over 80% → alert"

📸

AWS Config

WHAT changed in resource configuration over time + compliance rules.

→ "is every bucket encrypted? what did this SG look like last week?"

📋 IAM access reports

Credential report (all users + status of passwords, keys, MFA) · Last accessed information (remove unused permissions).

🌊 VPC Flow Logs

Capture IP traffic info going to and from network interfaces in your VPC.

CloudTrail = footprints on a trail (who walked here). CloudWatch = a wristwatch / health tracker. Config = before-and-after photos.

ComplianceProve it & learn it

📁

AWS Artifact

Self-service portal for AWS compliance reports (SOC, PCI, ISO certifications) and agreements (e.g. BAA for HIPAA). "Auditor wants AWS's PCI report" → Artifact.

🌐

Compliance varies

By industry (HIPAA health, PCI DSS payments) and geography (GDPR EU, data residency). Not every service is in scope for every program — check "AWS Services in Scope by Compliance Program". You choose the Region where data lives.

📚 AWS Knowledge Center

Answers to common support questions.

🏛️ AWS Security Center

aws.amazon.com/security — security info, bulletins, best practices.

✍️ AWS Security Blog

Latest security news, how-tos.

✔️ Trusted Advisor

Security checks: open ports, root MFA, public buckets.

Abuse from AWS resources (spam, attacks, malware hosting)? Report it to the AWS Trust & Safety team (abuse report form). Penetration testing on many services is allowed without prior approval — but DoS testing is prohibited (needs a separate approval process).

Govern many accountsOrganizations · Control Tower · more

🌳

AWS Organizations

Group accounts into OUs. Service control policies (SCPs) set max permissions for accounts. Consolidated billing.

🗼

AWS Control Tower

Set up a secure multi-account landing zone fast, with best-practice controls (guardrails).

🛍️

AWS Service Catalog

Catalogue of pre-approved products (e.g. CloudFormation templates) users can launch.

🔗

AWS RAM

Resource Access Manager — share resources (subnets, Transit Gateways) across accounts.

📏

Service Quotas

View and request increases of service limits.

🧾

AWS License Manager

Track and enforce software licence usage.

An SCP never grants permissions — it only sets the maximum (a guardrail). IAM policies still have to allow the action.

A security auditor needs to know which IAM user terminated an EC2 instance yesterday. Which service provides this information?

"Who did what" (API calls) → CloudTrail.

A company's auditor requests AWS's SOC 2 and PCI DSS compliance reports. Where can the company download them?

AWS's own compliance reports and agreements → AWS Artifact.

A company wants to track configuration changes to its AWS resources over time and get alerted when a resource becomes non-compliant with internal rules. Which service should it use?

Configuration history + compliance rules → AWS Config.

A company wants to prevent ALL accounts in a specific organizational unit (OU) from using services outside an approved list. What should it use?

SCPs apply guardrails to all accounts in an OU — even the root user of member accounts.

Recap · guess, then tapDomain 2 flash cards

OF = AWS (hardware, facilities, global infra). IN = you (data, IAM, OS on EC2, config).

AWS Shield (Standard free; Advanced paid + response team)

AWS WAF

Amazon GuardDuty

Amazon Macie

AWS CloudTrail

AWS Artifact

AWS IAM Identity Center

Amazon Cognito

AWS Secrets Manager

🧃🧘

Brain break — 5 minutes

Close your eyes. Picture the guard dog 🐕 (GuardDuty), the inspector 🔍 and Macie 🕵️ searching S3.

Next: Domain 3 — Technology & Services (the biggest, 34%) 🛠️

D3

Cloud Technology & Services

34% of your score — the biggest

Access · Global infra · Compute · Databases · Network · Storage · AI/ML · Analytics · Others

Deploying & operating4 ways to talk to AWS

🖱️

Management Console

Web UI. Great for learning and one-time tasks. Not repeatable.

⌨️

AWS CLI

Commands in a terminal. Scriptable → repeatable.

🧑‍💻

SDKs / APIs

Call AWS from application code (Python, Java, JS…). Everything in AWS is an API call.

📜

Infrastructure as Code

AWS CloudFormation templates (JSON/YAML) → whole environments, repeatable, version-controlled.

🌱 AWS Elastic Beanstalk

Upload your code → AWS handles capacity, load balancing, scaling, health monitoring. PaaS. You keep control of the resources.

🧰 AWS Systems Manager

Operations hub for EC2 / on-prem servers: patching, run commands at scale, Session Manager (no SSH keys), Parameter Store.

One-time click → Console. Same environment many times (dev / test / prod, many Regions) → CloudFormation.

AWS global infrastructureRegion ⊃ Availability Zones ⊃ data centres

Region = geographic area with multiple (usually 3+) isolated AZs. AZ = 1+ data centres with their own power, cooling, networking. AZs don't share single points of failure.

4 factorsHow to choose a Region

⚖️

1 · Compliance

Data must stay in a country (data sovereignty / residency laws). Often the #1 factor.

⚡

2 · Latency

Close to your users = faster.

🧩

3 · Service availability

Not every service / feature is in every Region.

💲

4 · Pricing

Prices differ by Region.

"Can Llamas Ski Properly?" — Compliance, Latency, Services, Pricing.

Data does not leave a Region unless you move or replicate it.

Design for failureMulti-AZ vs multi-Region

🏢🏢

Multiple AZs → High availability

Run instances in 2+ AZs behind a load balancer. If one AZ fails, others keep serving. Standard best practice.

🌍🌏

Multiple Regions → when you need…

Disaster recovery / business continuity (whole Region outage)
Low latency for users around the world
Data sovereignty (keep each country's data local)

Bonus: disaster-recovery strategies, from cheap/slow to expensive/fast.

🚑 AWS Elastic Disaster Recovery

Continuous block-level replication of servers (on-prem or cloud) into a low-cost staging area in AWS. Launch recovered servers in minutes (RPO seconds, RTO minutes).

🗃️ AWS Backup

Scheduled, point-in-time backups of AWS resources from one central place. Restore when needed — slower recovery.

What is the BEST way to make an application highly available within a single AWS Region?

Multi-AZ = high availability. AZs are isolated from each other's failures. Edge locations are for caching/DNS, not running your app servers.

A European company must keep customer data inside the EU by law. Which factor MOST directly drives its Region choice?

Legal data-residency rules = compliance / data sovereignty. It beats price and latency.

A company wants to continuously replicate its on-premises servers to AWS so that it can launch them in AWS within minutes if its data centre fails. Which service meets this need?

Continuous replication + fast recovery of whole servers → Elastic Disaster Recovery. AWS Backup takes scheduled point-in-time backups; it does not keep servers ready to launch in minutes.

Amazon EC2 — virtual serversPick the right instance family

Family	Letters	Use it for	Hook
⚖️ General purpose	M, T	Web servers, small DBs, balanced	M = Main / Medium. T = Tiny, burstable
🧮 Compute optimized	C	Batch processing, gaming servers, HPC, ML inference, high-performance web	C = CPU / Compute
🧠 Memory optimized	R, X	In-memory DBs, big real-time data	R = RAM
🎮 Accelerated computing	P, G, Inf, Trn	ML training, graphics, GPUs	G = Graphics / GPU
💽 Storage optimized	I, D, H	High sequential read/write on local storage, data warehousing, OLTP	I = IOPS

Key pieces of an instance: AMI (Amazon Machine Image = the template: OS + software), instance type (CPU/RAM), storage (EBS / instance store), security group.

Elasticity in actionAuto Scaling + Elastic Load Balancing

Application LB (ALB)

Layer 7 — HTTP/HTTPS, route by URL path / host.

Network LB (NLB)

Layer 4 — TCP/UDP, ultra-high performance, static IPs.

Gateway LB (GWLB)

Deploy third-party virtual appliances (firewalls, inspection).

Auto Scaling = elasticity (add/remove instances). Load balancer = spread traffic + health checks + single entry point.

Containers & serverlessWho runs the servers?

🐳

Amazon ECS

AWS's own container orchestrator. Simple, deeply integrated.

☸️

Amazon EKS

Managed Kubernetes. Pick when you already use Kubernetes / want portability.

📦

Amazon ECR

Container image registry (store Docker images).

🚫🖥️

AWS Fargate

Serverless compute for containers — run ECS/EKS tasks without managing EC2 instances.

λ

AWS Lambda

Run functions on events. No servers. Pay per request + duration (ms). Max 15 min per run.

🧱

Amazon EC2

Full control of the OS. You manage it.

Serverless = no servers to manage, scales automatically, pay for use. CLF-C02 serverless set: Lambda, Fargate (+ DynamoDB, S3, SQS, SNS, Athena, Glue, EventBridge…).

Other computeThe "easy button" services

Simple website / VPS, fixed low monthly price, no AWS expertise

→

Amazon Lightsail

Upload code, AWS handles deployment, scaling, monitoring

→

AWS Elastic Beanstalk

Run thousands of batch jobs, AWS schedules them

→

AWS Batch

Run AWS services on-premises (low latency / local data)

→

AWS Outposts

Run code on events, no servers

→

AWS Lambda

Run containers, no servers

→

AWS Fargate

A company wants to run containers on Amazon ECS without provisioning or managing EC2 instances. Which service should it use?

Fargate = serverless compute engine for containers. ECR only stores images.

A developer needs to resize images each time they are uploaded to S3. Each job takes 5 seconds. Which is the MOST cost-effective option with no servers to manage?

Short, event-driven job → Lambda. You pay only for the milliseconds it runs.

A company runs a large in-memory database that needs a lot of RAM. Which EC2 instance family is MOST suitable?

Big RAM needs → Memory optimized (R / X). Hook: R = RAM.

AWS database servicesWhich database? (keyword → service)

🗄️ Relational, SQL, managed (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2)

→

Amazon RDS

🚀 Relational, cloud-native, MySQL/PostgreSQL-compatible, high performance, 6 copies across 3 AZs

→

Amazon Aurora

🔑 NoSQL key-value, serverless, single-digit-millisecond at any scale

→

Amazon DynamoDB

⚡ In-memory cache (Valkey, Redis OSS, Memcached), microsecond reads

→

Amazon ElastiCache

📄 Document DB, MongoDB-compatible

→

Amazon DocumentDB

🕸️ Graph DB (social networks, fraud rings, recommendations)

→

Amazon Neptune

🏭 Data warehouse, analytics (OLAP) over petabytes

→

Amazon Redshift

🚚 Migrate a database to AWS (convert schema between engines)

→

AWS DMS (+ AWS SCT)

DynamoDB = Don't need Boxes (serverless NoSQL). ElastiCache = cash in your pocket — fast to grab. Neptune = network of relationships.

EC2-hosted vs AWS managedRun it yourself, or let AWS run it?

🔧

Database on EC2

✅ Full control (OS access, any engine/version, special settings)

❌ You patch, back up, replicate, scale.

→ choose when you need OS-level control or an unsupported engine.

🤖

Managed (RDS, Aurora, DynamoDB)

✅ AWS handles patching, backups, failover, scaling.

❌ No OS access.

→ choose for "least operational overhead".

RDS Multi-AZ

Standby copy in another AZ → automatic failover → high availability.

Read replicas

Copies that serve reads → read performance / scaling.

Multi-AZ = availability (disaster). Read replica = performance (scale reads). Don't swap them.

A gaming app needs a serverless NoSQL database with single-digit-millisecond latency at any scale. Which service fits?

Serverless + NoSQL key-value + ms latency → DynamoDB.

An application repeatedly reads the same data from its relational database, which slows it down. Which service can reduce database load by caching data in memory?

In-memory cache → ElastiCache.

A company needs to run complex analytical SQL queries across petabytes of historical sales data. Which service is designed for this?

Data warehouse / OLAP analytics → Redshift.

Amazon VPC — your private networkVPC in one picture

Subnet

A range of IPs in one AZ.

Internet gateway

Lets a VPC talk to the internet.

NAT gateway

Private subnet → internet (outbound only).

Route table

Rules: where traffic goes.

Security in a VPCSecurity group vs network ACL

	🛡️ Security group	🚧 Network ACL
Works at	Instance (network interface) level	Subnet level
State	Stateful — return traffic allowed automatically	Stateless — must allow return traffic explicitly
Rules	Allow rules only	Allow and Deny rules (numbered, in order)
Default	New SG: no inbound rules (all inbound denied), all outbound allowed	Default NACL allows all in/out

🛡️ Security group = Stateful, Sticks to the Server. 🚧 NACL = the subnet's border guard with No memory (stateless) — and it can say Deny.

"Block one specific bad IP address for the whole subnet" → NACL (security groups can't deny). Scanning instances for network exposure → Amazon Inspector.

Network connectivityHow do I connect?

Office ↔ VPC, encrypted over the public internet, quick to set up

→

AWS Site-to-Site VPN

The two ends of a Site-to-Site VPN

→

Virtual private gateway (or Transit Gateway) on the AWS side + customer gateway on your side

Individual remote users / laptops → VPC

→

AWS Client VPN

Dedicated private line, consistent performance, doesn't use the internet

→

AWS Direct Connect

Hub to connect many VPCs + on-prem networks

→

AWS Transit Gateway

Private access to a service/endpoint without the internet

→

AWS PrivateLink

Create, publish and secure APIs (front door for Lambda)

→

Amazon API Gateway

Direct Connect = private, but not encrypted by default and takes weeks to provision. Need encryption quickly → VPN (you can also run VPN over Direct Connect).

Edge servicesGet users to your app — fast

🧭

Amazon Route 53

DNS (name → IP), domain registration, health checks, routing policies: simple, weighted, latency, failover, geolocation…

🚚

Amazon CloudFront

CDN: caches content (images, video, websites, APIs) at edge locations close to users. Works with WAF and Shield.

🏎️

AWS Global Accelerator

Sends traffic over the AWS global network with static anycast IPs. Good for TCP/UDP (non-HTTP) apps and fast regional failover. No caching.

Route 53 = the phone book / GPS. CloudFront = local copies in shops near you. Global Accelerator = an express lane on the AWS highway.

"Cache static content close to users" → CloudFront (not Global Accelerator). Route 53's name comes from DNS port 53.

Which statement about security groups is correct?

Security groups: stateful, instance level, allow-only. NACLs are stateless, subnet level, allow+deny. Configuring them is the customer's job.

A company needs a dedicated, private network connection from its data centre to AWS with consistent bandwidth that does not travel over the public internet. Which service should it use?

Dedicated + private + consistent, not the internet → Direct Connect. VPNs run over the internet.

A media company wants to reduce latency for users worldwide who download videos stored in an S3 bucket in one Region. Which service should it use?

Cache content at edge locations near users → CloudFront.

AWS storage servicesObject · Block · File

🪣

Object — Amazon S3

Files as objects in buckets, accessed by URL/API. Unlimited total storage; one object up to 50 TB (raised from 5 TB in Dec 2025 — older notes say 5 TB). Backups, data lakes, static websites, media.

💽

Block — EBS / instance store

A hard drive for EC2. OS boot volumes, databases.

🗂️

File — EFS / FSx

Shared folder that many servers mount at once.

🌉 AWS Storage Gateway

Hybrid: on-prem apps use cloud storage with a local cache. Types: S3 File Gateway, Volume Gateway, Tape Gateway (replace physical backup tapes).

🗃️ AWS Backup

Central backup plans + policies for EBS, EC2, RDS, DynamoDB, EFS, FSx, S3… across accounts and Regions. Compliance-friendly.

Block vs fileEBS vs instance store vs EFS vs FSx

	💽 EBS	⚡ Instance store	🗂️ EFS	🪟 FSx
Type	Block (network drive)	Block (physically attached)	File (NFS)	File (managed third-party file systems)
Survives stop?	Yes (persistent)	No — data lost on stop/terminate	Yes	Yes
Scope	One AZ; usually one instance	That one instance	Many instances, many AZs	Many instances
Best for	Boot volumes, databases	Temporary data, caches, buffers	Linux shared files, auto-grows	Windows File Server (SMB), NetApp ONTAP, OpenZFS

EBS = USB drive plugged by network (keep it). Instance store = scratch paper (gone when you stop). EFS = shared Folder for Linux. FSx for Windows = "File Server x (any flavour)".

EBS snapshots are incremental, Region-level backups (stored in S3). Restore a volume in any AZ of the Region, or copy the snapshot to another Region.

Amazon S3 storage classes🔥 Hot → 🧊 cold

Class	Use when	Retrieval	Min. days	AZs
🔥 S3 Standard	Frequent access	ms	—	3+
🤖 S3 Intelligent-Tiering	Unknown / changing access — auto moves data, no retrieval fees	ms (archive tiers optional)	—	3+
🌤️ S3 Standard-IA	Infrequent, needs fast access	ms + retrieval fee	30	3+
🌥️ S3 One Zone-IA	Infrequent, re-creatable data (lost if the AZ is destroyed)	ms + fee	30	1
❄️ Glacier Instant Retrieval	Archive read ~once a quarter, needs ms access	ms	90	3+
🧊 Glacier Flexible Retrieval	Archive, wait minutes–hours is OK	1–5 min to 12 h	90	3+
🏔️ Glacier Deep Archive	Cheapest. Keep 7–10 years for compliance	≤ 12 h (bulk ≤ 48 h)	180	3+

Also: S3 Express One Zone — single-AZ class for the fastest, single-digit-ms performance. All classes: 11 nines durability.

The colder the class → the cheaper to store, the slower and pricier to retrieve, the longer the minimum stay.

Automate the coolingS3 Lifecycle policies

➡️ Transition actions

Move objects to a cheaper class after N days.

🗑️ Expiration actions

Delete objects (or old versions) after N days.

Access pattern known → Lifecycle policy. Access pattern unknown → Intelligent-Tiering.

Other S3 features: versioning (recover deleted/overwritten objects), replication to another Region, static website hosting, Transfer Acceleration, Block Public Access (on by default).

A company must keep financial records for 10 years for compliance. The data is almost never read, and a 12-hour retrieval time is acceptable. Which storage class is the MOST cost-effective?

Long-term, rarely accessed, hours OK → Glacier Deep Archive (lowest storage cost).

A company stores data in S3 but cannot predict how often each object will be accessed. Which storage class optimises cost automatically?

Unknown / changing access → Intelligent-Tiering moves objects between tiers automatically.

Several Linux EC2 instances in different Availability Zones need to read and write the same files at the same time. Which service should be used?

Shared Linux file system across many instances and AZs → EFS. EBS is tied to one AZ.

A company wants on-premises applications to use Amazon S3 storage through a local file share with low-latency cached access, and to replace its physical backup tapes. Which service should it use?

Hybrid, cached access to cloud storage (File / Volume / Tape gateway) → Storage Gateway.

🧃🎵

Brain break — 5 minutes

Put on one song. Then come back for AI/ML — it's the fun part 🤖

AI & machine learningAI services = superpowers via API

🧑‍🔬

Amazon SageMaker AI

Build, train and deploy your own ML models (for data scientists).

💬

Amazon Q

Generative AI assistant for business users (Q Business) and developers (Q Developer).

👁️

Amazon Rekognition

Image + video analysis: faces, objects, text, unsafe content.

📄

Amazon Textract

Extract text, handwriting, forms and tables from scanned documents.

🧠

Amazon Comprehend

NLP: sentiment, key phrases, entities, language of text.

🌐

Amazon Translate

Translate text between languages.

📝

Amazon Transcribe

Speech → text (call recordings, subtitles).

🦜

Amazon Polly

Text → speech (lifelike voices).

🤖

Amazon Lex

Chatbots / voice bots (same tech as Alexa).

Make them stick🧠 AI hooks

🦜 Polly the parrot

→

talks: text → speech

📝 Transcribe

→

a transcript: speech → text

🤖 Lex

→

Lexicon of a chatbot — talks back to you

👁️ Rekognition

→

recognises faces and objects in pictures

📄 Textract

→

extracts text from documents (more than OCR: forms + tables)

🧠 Comprehend

→

comprehends the meaning / feeling of text

🧑‍🔬 SageMaker AI

→

the maker of your own custom models

Bonus (not on the in-scope list): Amazon Bedrock = API access to foundation models (generative AI) from Amazon and others.

Analytics servicesThe data pipeline, left to right

SQL queries directly on files in S3, serverless, pay per query

→

Amazon Athena

Real-time streaming data (clickstreams, IoT, logs)

→

Amazon Kinesis

Serverless ETL + Data Catalog (crawlers find schemas)

→

AWS Glue

Big-data frameworks: Apache Spark, Hadoop

→

Amazon EMR

Search + log analytics (Elasticsearch-compatible)

→

Amazon OpenSearch Service

BI dashboards and reports

→

Amazon Quick Sight

Name note: Amazon QuickSight is now written "Amazon Quick Sight" (part of Amazon Quick Suite). Same service.

A company wants to convert recorded customer-support calls into text and then detect whether each customer was happy or angry. Which combination of services should it use?

Speech → text = Transcribe. Sentiment of text = Comprehend.

An insurance company receives thousands of scanned claim forms. It needs to extract the fields and tables automatically. Which service should it use?

Text, forms, tables from documents → Textract.

A data analyst wants to run standard SQL queries on log files stored in Amazon S3 without loading them into a database or managing servers. Which service fits BEST?

SQL on S3, serverless → Athena.

Application integrationMessages, events, workflows

📬

Amazon SQS

Queue. Producers drop messages, consumers pull them later. Decouples components, buffers spikes.

📣

Amazon SNS

Pub/sub. One message pushed to many subscribers: email, SMS, Lambda, SQS (fan-out). Alerts & notifications.

🚌

Amazon EventBridge

Serverless event bus. Route events from AWS services, SaaS apps, your apps to targets by rules. Also schedules (cron).

🪜

AWS Step Functions

Visual workflows that orchestrate many steps / services (with retries, branches).

SQS = a Queue at the post office (wait your turn, pull). SNS = a Notification megaphone (push to everyone). EventBridge = a bridge that routes events.

Other in-scope categoriesKeyword → service

☎️ Cloud contact centre / call centre

→

Amazon Connect

✉️ Send marketing / transactional email at scale

→

Amazon SES

🖥️ Full virtual desktops (Windows / Linux) for employees

→

Amazon WorkSpaces

🪟 Stream a single desktop application to a browser

→

Amazon AppStream 2.0

🌐 Secure browser access to internal websites / SaaS

→

Amazon WorkSpaces Secure Browser

📱 Build + host front-end web and mobile apps fast

→

AWS Amplify

📡 Connect and manage IoT devices

→

AWS IoT Core

🏗️ Compile + test code (build server)

→

AWS CodeBuild

🔁 Automate the CI/CD release pipeline

→

AWS CodePipeline

🐞 Trace requests, debug distributed apps / microservices

→

AWS X-Ray

Name note: AppStream 2.0 is now also called "Amazon WorkSpaces Applications". Same service.

Management & governanceKeyword → service

Metrics, logs, alarms

→

CloudWatch

API call history / audit

→

CloudTrail

Config history + rules

→

AWS Config

Best-practice checks (cost, security, limits…)

→

Trusted Advisor

AWS service events affecting you

→

AWS Health Dashboard

Infra as code templates

→

CloudFormation

Patch / manage fleets of servers

→

Systems Manager

Right-size EC2, Lambda, EBS (ML recommendations)

→

Compute Optimizer

Review against the 6 pillars

→

Well-Architected Tool

Multi-account, central billing, SCPs

→

Organizations

Multi-account landing zone + guardrails

→

Control Tower

Approved IT product catalogue

→

Service Catalog

See / raise service limits

→

Service Quotas

Scale EC2, DynamoDB, ECS… automatically

→

AWS Auto Scaling

A company needs to send an email and an SMS alert to the operations team whenever a CloudWatch alarm fires. Which service should deliver the notifications?

Push notifications to people (email + SMS) from alarms → SNS. SES is for bulk/marketing emails from apps.

An order system's front end sometimes sends orders faster than the back end can process them. Which service lets the components work independently and buffer the orders?

Buffer + decouple → message queue = SQS.

A company wants to give remote employees secure, persistent Windows desktops that run in AWS, accessible from their own laptops. Which service should it use?

Virtual desktops (DaaS) → WorkSpaces.

Developers want to find which microservice is causing slow response times in their distributed application. Which service helps?

Trace requests across services and find bottlenecks → X-Ray.

Recap · guess, then tapDomain 3 flash cards

Region = geographic area. AZ = isolated data centre group(s) inside it.

AWS Fargate

Amazon EKS

Amazon DynamoDB

Security group

AWS Direct Connect

Amazon CloudFront

S3 Glacier Deep Archive

Amazon EFS

Amazon Polly

Amazon Athena

Amazon SNS

🧃🏃

Brain break — 5 minutes

You finished the biggest domain! 🎉 Walk around. Last stop: money 💰

D4

Billing, Pricing & Support

12% of your score

Pricing models · Data transfer · Cost tools · Organizations · Support plans · Help resources

How AWS charges3 pricing principles

🧾

Pay as you go

Pay for what you use. No long-term contract needed.

🤝

Save when you commit

1- or 3-year commitments (Savings Plans, Reserved Instances) = big discounts.

📦

Pay less by using more

Volume tiers (e.g. S3 per-GB price drops as you store more).

🎁 AWS Free Tier (accounts created since 15 July 2025)

Free plan: up to USD 200 in credits (100 at sign-up + up to 100 for trying services), valid 6 months. No charges unless you upgrade to the Paid plan.

Always Free offers (e.g. Lambda requests, DynamoDB storage) stay free within monthly limits. Some services also have short trials.

Older accounts / older study notes: "12 months free" tier. You may still see that wording.

Compute purchasing optionsHow much can I save? (vs On-Demand)

🎰 Spot Instances

up to 90%

📅 EC2 Instance Savings Plan

up to 72%

📅 Standard Reserved Instance

up to 72%

🔄 Compute Savings Plan

up to 66%

🔄 Convertible RI

up to 66%

🧾 On-Demand

More commitment + less flexibility = bigger discount. Spot = biggest discount but AWS can take it back with a 2-minute warning.

Decision guideWhich purchase option?

Short-term, unpredictable, can't be interrupted, new app testing

→

🧾 On-Demand

Steady, predictable use for 1 or 3 years

→

📅 Reserved Instances or Savings Plans

Commit to $/hour, flexible across instance family, Region, OS, and Lambda + Fargate

→

🔄 Compute Savings Plan

Fault-tolerant, flexible, can be interrupted (batch, CI, big data, image rendering)

→

🎰 Spot Instances

BYOL (per-socket/core), compliance needs a physical server you control

→

🏠 Dedicated Hosts

Hardware not shared with other customers, but no host control

→

🚪 Dedicated Instances

Guarantee capacity in a specific AZ, any duration, no term commitment

→

🎟️ On-Demand Capacity Reservations

Spot = "spot sale at the market — cheap, but the seller can take it back". Dedicated Host = you rent the whole house. Dedicated Instance = your own room, landlord controls the house.

Reserved InstancesRI flexibility & behaviour in Organizations

⏳ Terms & payment

1 or 3 years.

All Upfront (biggest discount) · Partial Upfront · No Upfront.

🧱 Standard vs Convertible

Standard: bigger discount; can change AZ / size; can be sold on the RI Marketplace.

Convertible: exchange for another family, OS, tenancy; smaller discount; can't be sold.

🌍 Regional vs Zonal

Regional: discount applies in any AZ + instance size flexibility (same family, Linux, default tenancy). No capacity reservation.

Zonal: reserves capacity in one AZ.

🌳 RIs in AWS Organizations

With consolidated billing, RI and Savings Plans discounts are shared across all accounts in the organization by default. The management account can turn sharing off for specific accounts.

AWS now recommends Savings Plans for most compute commitments — simpler and more flexible than RIs. RIs still exist (also for RDS, Redshift, ElastiCache, OpenSearch).

A company runs nightly video-rendering jobs that can be stopped and restarted at any time without problems. Which EC2 option is MOST cost-effective?

Interruptible + flexible → Spot (up to 90% off).

A company has steady compute use across EC2, AWS Lambda and AWS Fargate and changes instance families often. Which option gives a discount with the MOST flexibility?

Compute Savings Plans cover EC2 (any family, Region, OS), Lambda and Fargate. EC2 Instance SP is locked to one family in one Region.

A company uses AWS Organizations with consolidated billing. Account A bought Reserved Instances it does not fully use. What happens by default?

Consolidated billing shares RI and Savings Plans discounts across accounts by default (sharing can be turned off).

Data transferData in is free. Data out costs.

Inbound from the internet = free. Outbound to the internet = charged. Between Regions = charged. Between AZs = charged (small). Same AZ over private IP = free. AWS origin → CloudFront = free.

Storage options and tiersWhat do you pay for in storage?

🪣

Amazon S3

GB stored per month (by storage class)
Requests (PUT, GET…)
Retrieval fees (IA, Glacier classes)
Data transfer out
Management features (e.g. Intelligent-Tiering monitoring fee, replication)

💽

Amazon EBS

GB provisioned per month — even if empty!
Provisioned IOPS / throughput (some volume types)
Snapshots (GB stored in S3)

🗂️

Amazon EFS

GB used per month (grows and shrinks). Infrequent Access / Archive classes are cheaper.

🧊

Archive classes

Cheapest per GB, but minimum storage duration charges + retrieval fees.

EBS = pay for what you provision. S3 / EFS = pay for what you store.

Billing, budget & cost managementBefore · during · after

1

🧮 Before: AWS Pricing Calculator

Estimate the cost of an architecture before you build it. Free web tool.

2

🚨 During: AWS Budgets

Set a cost / usage / RI / Savings Plans budget → alert (email, SNS) when actual or forecasted spend crosses it. Budget actions can apply policies or stop resources.

3

📊 After: AWS Cost Explorer

Visualise and analyse past costs and usage, filter by service / tag / account, forecast, get RI / Savings Plans recommendations.

4

📑 Deepest: Cost and Usage Report

The most detailed line-item billing data (by hour, resource, tag) delivered to S3. Analyse with Athena / Quick Sight.

🏷️ Cost allocation tags

Key-value labels (e.g. Project=Alpha) to split costs. Two types: AWS-generated and user-defined. You must activate them in the Billing console before they appear in Cost Explorer / CUR.

🔔 Bonus: Cost Anomaly Detection

Uses ML to spot unusual spend and alert you.

Current prices: each service's public pricing page; programmatic access → AWS Price List API.

Calculator = future 🔮 · Budgets = alarm clock ⏰ · Cost Explorer = rear-view mirror 🪞 (+ forecast) · CUR = the full receipt 🧾

AWS OrganizationsOne family, one bill

🧾 One bill

Consolidated billing — free feature.

📦 Volume discounts

Usage from all accounts is combined for tiered pricing.

🤝 Shared discounts

RI + Savings Plans discounts shared across accounts.

🛂 SCPs

Central guardrails on what accounts can do.

A company wants to receive an email alert when its forecasted monthly AWS spend will exceed USD 5,000. Which service should it use?

Alerts on actual or forecasted spend → AWS Budgets.

Before migrating, a company wants to estimate the monthly cost of a new architecture on AWS. Which tool should it use?

Estimate before you build → Pricing Calculator. Cost Explorer analyses costs you already have.

A company wants to see AWS costs per project and per department. Which actions should it take?

Tag resources, then activate the tags as cost allocation tags. Then filter by tag in Cost Explorer / CUR.

AWS Support plans (current line-up)Pick your helper 🆘

	🆓 Basic	💼 Business Support+	🏢 Enterprise Support	👑 Unified Operations
Price	Free, every account	From USD 29/month (or % of usage)	From USD 5,000/month	From USD 50,000/month
Technical support	No tech cases — account & billing help, docs, re:Post	24/7 phone, chat, email with AWS engineers + AI-powered help	24/7 + AI	24/7 + AI
Critical-case response	—	< 30 min	< 15 min	< 5 min
Trusted Advisor	Core checks (service limits + some security)	Full set + Trusted Advisor Priority	Full set + Trusted Advisor Priority	Full set + Trusted Advisor Priority
Technical Account Manager	—	—	Designated TAM	Designated TAM + specialist & incident engineers
Extras	AWS Health Dashboard	AWS Health, Well-Architected reviews, cost-optimisation guidance	TAM-led Well-Architected reviews, event planning (AWS Countdown), Security Incident Response, billing concierge	Everything in Enterprise + designated domain-specialist and incident-management engineers, < 5 min response

Climb the stairs: Basic (free, no engineers) → Business+ (cheapest 24/7 engineers) → Enterprise (your own TAM) → Unified Ops (a whole team, 5 min).

⚠️ Don't get confusedOld plan names you may still see

🗓️ Retiring 1 January 2027

Developer (business-hours email only)
Business (24/7 phone/chat, < 1 h production down)
Enterprise On-Ramp (pool of TAMs, < 30 min)

Still offered only in AWS GovCloud (US).

✅ The current exam guide lists

Basic Support
AWS Business Support+
AWS Enterprise Support
AWS Unified Operations

Cheapest plan with 24/7 access to engineers by phone

→

Business Support+ (old notes: "Business")

Designated Technical Account Manager (TAM)

→

Enterprise Support (or Unified Operations)

Fastest critical response (5 min), dedicated team

→

Unified Operations

Free billing / account questions

→

Basic Support

Monitor & optimiseTrusted Advisor & AWS Health

✔️

AWS Trusted Advisor

Checks your account against best practices. 6 categories:

💰 Cost optimization🏎️ Performance🔐 Security🛡️ Fault tolerance📏 Service limits⚙️ Operational excellence

Examples: idle EC2 / unattached EBS (cost), open port 22 to world (security), no Multi-AZ (fault tolerance), close to a quota (limits).

🩺

AWS Health Dashboard

Service health: public status of all AWS services.

Your account health: personalised alerts — events and scheduled maintenance that affect your resources.

AWS Health API: programmatic access (with a paid support plan) → automate responses.

Trusted Advisor categories: "Cats Prefer Safe, Friendly, Stable Owners" — Cost, Performance, Security, Fault tolerance, Service limits, Operational excellence.

Technical resourcesWhere to get help

Community Q&A with AWS experts (replaced the old forums)

→

AWS re:Post

Articles answering the most common support questions

→

AWS Knowledge Center

Proven strategies, guides, patterns from AWS experts

→

AWS Prescriptive Guidance

Deep technical papers / user guides

→

AWS Whitepapers · AWS Documentation · AWS Blogs

Open and manage support cases (account & billing cases are free on every plan)

→

AWS Support Center

Official price of each service

→

Service pricing pages (aws.amazon.com/pricing)

View bills, invoices, payments, credits

→

Billing and Cost Management console

AWS's own experts to help deliver a project (paid)

→

AWS Professional Services

Help designing an architecture (via your account team)

→

AWS Solutions Architects

Report abuse (spam, attacks) coming from AWS resources

→

AWS Trust & Safety team

AWS Partner Network (APN)Partners & AWS Marketplace

💿

ISVs

Independent software vendors — build and sell software that runs on / integrates with AWS (often via Marketplace).

🧑‍🔧

System integrators (SIs)

Consulting / services partners that design, build, migrate and manage workloads for customers.

🎁

Partner benefits

Partner training & certification, partner events, partner volume discounts, funding and marketing support.

🛒

AWS Marketplace

A curated digital catalogue to find, buy and deploy third-party software, data and services. Charges appear on your AWS bill. Flexible pricing (hourly, annual, BYOL, private offers). Helps with cost management and governance & entitlement (control who can buy what, track licences).

A start-up wants the LOWEST-cost AWS Support plan that gives 24/7 phone access to AWS engineers for production issues. Which plan should it choose?

Business Support+ is the lowest-cost plan with 24/7 engineer access (from USD 29/month). Basic has no technical support cases.

A company needs a designated Technical Account Manager for proactive guidance, at the LOWEST cost. Which support plan should it choose?

Designated TAM starts at Enterprise Support. Unified Operations also has one, but costs much more.

Which service gives recommendations on idle resources, security-group ports open to the world, and service quotas that are close to their limits?

Best-practice checks across cost, security, limits, etc. → Trusted Advisor.

A company wants to buy a third-party firewall product that runs on AWS and pay for it through its AWS bill. Where should it look?

Third-party software, billed on your AWS bill → AWS Marketplace. Service Catalog is for your own approved products.

Recap · guess, then tapDomain 4 flash cards

Spot Instances (up to 90%)

Compute Savings Plan

AWS Pricing Calculator

AWS Budgets

AWS Cost Explorer

AWS Cost and Usage Report

Business Support+

Enterprise Support (and Unified Operations)

Inbound from internet; same-AZ private IP; AWS origin → CloudFront

Cost, Performance, Security, Fault tolerance, Service limits, Operational excellence

🏁

Final mock — 20 mixed questions

Aim for 16+ correct

Mixed domains, like the real exam. Use the 3-step method: keyword → service → kill distractors.

1. Which AWS service lets a company define its infrastructure in a template and deploy the same environment repeatedly in several Regions?

Infrastructure as code templates → CloudFormation.

2. Which task is AWS responsible for under the shared responsibility model when a customer uses AWS Lambda?

Serverless: AWS handles OS + managed runtime. Code, IAM and data stay with the customer.

3. Which are benefits of AWS global infrastructure?

Low latency + data residency. Data never leaves a Region unless you move it; inter-Region transfer is charged; AZs are isolated.

4. Which service can a company use to centrally manage single sign-on access for its employees to multiple AWS accounts?

Workforce SSO across accounts → IAM Identity Center. Cognito is for your app's customers.

5. A company's website is hit by a large DDoS attack. It wants 24/7 access to AWS DDoS experts and protection against the extra scaling charges caused by the attack. What should it use?

Response team + DDoS cost protection = Shield Advanced. Standard is free and automatic but has neither.

6. Which pillar of the Well-Architected Framework includes the principle "maximise utilisation" to reduce the energy needed by a workload?

Environmental impact / energy → Sustainability.

7. A company wants an AWS-managed relational database that is MySQL-compatible, keeps six copies of data across three AZs, and offers higher performance than standard MySQL. Which service fits?

Aurora: MySQL/PostgreSQL-compatible, 6 copies across 3 AZs, faster than standard engines.

8. Which AWS service analyses CloudTrail events, VPC Flow Logs and DNS logs to detect compromised instances and malicious activity?

Threat detection from logs = GuardDuty 🐕.

9. A company wants to move an application to AWS quickly without making any changes, then optimise later. Which migration strategy is this?

As-is, fast = Rehost (lift and shift).

10. Which storage is lost when an EC2 instance is stopped?

Instance store is ephemeral — data is gone on stop, hibernate or terminate.

11. Which AWS service routes users to the application endpoint with the lowest latency and can fail over to a healthy endpoint using DNS health checks?

DNS with latency and failover routing policies + health checks → Route 53.

12. Which are benefits of AWS Organizations consolidated billing?

One bill + aggregated usage for volume tiers (plus shared RI / Savings Plans discounts).

13. A company needs to give a third-party auditor temporary access to resources in its AWS account without sharing long-term credentials. What is the BEST approach?

Cross-account IAM roles give temporary credentials with least privilege.

14. A company wants to analyse streaming clickstream data from its website in real time. Which service should collect the stream?

Real-time streaming ingestion → Kinesis.

15. Which benefit of cloud computing means a company no longer needs to buy servers for its expected peak load in advance?

Buying for peak in advance = guessing → Stop guessing capacity.

16. Where can a customer view AWS events and scheduled maintenance that may affect its own resources?

Personalised events affecting your resources → AWS Health Dashboard.

17. Which service gives a company a managed way to build, train and deploy its own custom machine learning models?

Custom models end to end → SageMaker AI. The others are pre-trained AI services.

18. Which service uses machine learning to recommend optimal EC2 instance types and sizes based on historical utilisation?

ML rightsizing for EC2, EBS, Lambda, ECS on Fargate → Compute Optimizer. (Trusted Advisor also flags idle resources.)

19. Which network control can explicitly DENY traffic from a specific IP address range to all instances in a subnet?

Deny rules at subnet level → Network ACL. Security groups have allow rules only.

20. A company wants to discover its on-premises servers, their utilisation and dependencies to plan a migration. Which service should it use?

Discovery = find servers and dependencies. Application Migration Service does the actual lift-and-shift.

Cheat sheet · read the night beforeKeyword → answer (1/2)

Who did it? (API calls)

→

CloudTrail

Metrics / alarms

→

CloudWatch

Config history / rules

→

Config

AWS compliance reports

→

Artifact

DDoS

→

Shield

SQLi / XSS

→

WAF

Threats in logs

→

GuardDuty

Vulnerabilities (CVE)

→

Inspector

PII in S3

→

Macie

Root-cause investigation

→

Detective

All findings in one place

→

Security Hub

Encryption keys

→

KMS

Dedicated HSM

→

CloudHSM

Rotate secrets

→

Secrets Manager

SSL/TLS certs

→

ACM

Workforce SSO

→

IAM Identity Center

App user sign-in

→

Cognito

Account guardrails

→

SCPs (Organizations)

Landing zone

→

Control Tower

Best-practice checks

→

Trusted Advisor

Events affecting you

→

Health Dashboard

Report abuse

→

Trust & Safety

Cheat sheet · read the night beforeKeyword → answer (2/2)

Serverless functions

→

Lambda

Serverless containers

→

Fargate

Kubernetes

→

EKS

Simple VPS, fixed price

→

Lightsail

Upload code, AWS runs it

→

Elastic Beanstalk

NoSQL ms latency

→

DynamoDB

In-memory cache

→

ElastiCache

Data warehouse

→

Redshift

Graph

→

Neptune

SQL on S3

→

Athena

Streaming

→

Kinesis

ETL

→

Glue

CDN

→

CloudFront

DNS

→

Route 53

Private line

→

Direct Connect

Queue / decouple

→

SQS

Push notifications

→

SNS

Shared Linux files

→

EFS

Cheapest archive

→

Glacier Deep Archive

Hybrid storage cache

→

Storage Gateway

Estimate cost

→

Pricing Calculator

Spend alerts

→

Budgets

Analyse spend

→

Cost Explorer

3rd-party software

→

Marketplace

NumbersThe few numbers worth memorising

11 nines

S3 durability (99.999999999%)

15 min

Max Lambda run time

2 min

Spot interruption warning

90% / 72% / 66%

Spot / EC2 Instance SP & Standard RI / Compute SP & Convertible RI

1 or 3 years

RI and Savings Plans terms

6

Well-Architected pillars · CAF perspectives · Trusted Advisor categories

7

Migration Rs

30 / 15 / 5 min

Critical response: Business+ / Enterprise / Unified Ops

30 / 90 / 180 days

Min. storage: IA / Glacier IR & Flexible / Deep Archive

50 TB

Max single S3 object (was 5 TB before Dec 2025)

53

DNS port → Route 53

700

Pass mark out of 1000

Exam dayYour game plan 🎮

1

Before

Sleep. Eat. Online exam: clear desk, ID ready, run the system check early.

2

Pass 1

Answer what you know fast. Flag anything > 1 minute. Always pick something.

3

Pass 2

Come back to flagged ones. Eliminate. Prefer managed / serverless / least effort.

4

Final check

No blanks. Multiple response: did you pick the exact number asked?

Some questions are unscored experiments. A strange question? Don't panic — it might not even count.

Don't change an answer unless you find a clear reason. First instinct is often right.

🏆☁️

You've got this!

Re-run the quizzes with N until you score 90%+. Then book the exam.

Score so far is shown at the bottom bar · ↺ resets it

AWS Cloud PractitionerCLF-C02 in bite-size pieces

Know your enemyThe exam at a glance

65 questions

90 minutes

700 / 1000

USD 100

✅ Two question types

🎲 No penalty for guessing

Study where the points are4 domains, 4 colours

Your brain, your rulesHow to use this deck

Sprints

Yellow boxes

Red boxes

Quizzes

Flip cards

Repeat

Exam techniqueThe 3-step answer method

Find the keyword

Map keyword → service

Kill the distractors

Cloud Concepts

DefinitionWhat is cloud computing?

Like electricity

On demand

Pay as you go

Classic exam listThe 6 advantages of cloud computing

1 · Trade fixed expense for variable expense

2 · Benefit from massive economies of scale

3 · Stop guessing capacity

4 · Increase speed and agility

5 · Stop spending money running and maintaining data centres

6 · Go global in minutes

Words the exam lovesCloud vocabulary

Elasticity

Scalability

High availability

Fault tolerance

Agility

Durability

Picture itScale up vs scale out

Cloud service models🍕 Pizza as a service

Where does it run?Cloud deployment models

Cloud (all-in)

Hybrid

On-premises (private cloud)

Cloud economicsOn-premises: you must guess

Total Cost of Ownership (TCO)The hidden costs of on-premises

Cloud economicsLicensing · Rightsizing · Automation

Licensing

Rightsizing

Automation

AWS Well-Architected FrameworkThe 6 pillars 🏛️

Tell them apartKeyword → pillar

AWS CAFCloud Adoption Framework = the migration "playbook"

👔 Business-side perspectives

🛠️ Technical-side perspectives

🎯 Business outcomes

🔄 Transformation phases

Migration strategiesThe 7 Rs — from lazy to heavy

Resources for the migration journeyMigration tools

Recap · guess, then tapDomain 1 flash cards

Brain break — 5 minutes

Security & Compliance

#1 most tested ideaShared responsibility model

The more managed, the less you doWho patches what?

🤝 Shared controls (both sides)

📥 Inherited controls

AWS Identity and Access Management (IAM)IAM in one picture

AWS managed policy

Customer managed policy

Inline policy

👑 The root userProtect it. Then don't use it.

✅ Protect root

👑 Tasks only root can do

How identities sign inAuthentication options

MFA

Password policy

Access keys

IAM roles

IAM Identity Center

AWS Cloud Practitioner
CLF-C02 in bite-size pieces