Career Employer

FREE AWS Cloud Practitioner Study Guide 2026

The most important things the AWS Cloud Practitioner (CLF-C02) tests — an interactive study guide with built-in quizzes and flashcards, organized by all 4 official exam domains.

Don't know where to start?

To find us again, just search “Career Employer AWS Cloud Practitioner

By

This free AWS Cloud Practitioner study guide walks through every content domain the AWS Certified Cloud Practitioner (CLF-C02) exam tests, organized to the current official AWS exam guide.[1]

It’s interactive, not a wall of text: every module has built-in checkpoint quizzes, flashcards, and practice questions, so you learn by doing — not just reading.

The CLF-C02 tests four official domains. We teach them in four study modules, leading with the heaviest-weighted content. Read a module, test yourself at each checkpoint, then drill gaps with our free practice test and flashcards. This guide is a high-yield overview that maps the official content — not a full AWS reference manual.

AWS Cloud Practitioner Exam Snapshot

AWS Cloud Practitioner (CLF-C02) exam at a glance
DetailCLF-C02 Exam
Questions65 total (50 scored + 15 unscored pilot)
FormatMultiple choice & multiple response, computer-based
Time90 minutes
Passing score700 (on a scaled 100–1000; compensatory scoring)
Cost$100 USD
DeliveryPearson VUE test center or online proctored
Certifying bodyAmazon Web Services (AWS)
EligibilityNone required (≈6 months of AWS exposure recommended)
Validity3 years
LevelFoundational

The CLF-C02 covers four domains. Two of them — Cloud Technology & Services and Security & Compliance — together make up nearly two-thirds of the exam, so that is where to invest first.[1] Study by weight:

CLF-C02 weighting by content domain (official AWS exam guide)
Cloud Technology & Services34% · Domain 3
Security & Compliance30% · Domain 2
Cloud Concepts24% · Domain 1
Billing, Pricing & Support12% · Domain 4

Module 1 · Cloud Technology & Services

Domain 3, 34% of the exam — the single largest domain. This is the catalog of what AWS actually offers: the global infrastructure your workloads run on, plus the core compute, storage, database, and networking services. Knowing what each core service does is the highest-yield knowledge on the test.

1.1 Global Infrastructure & Deployment

AWS infrastructure is a hierarchy. A is a separate geographic area (such as us-east-1) containing multiple, isolated (AZs) — each one or more discrete data centers with redundant power and networking. A third layer, the , sits outside Regions and is used by and to cache content near users.[5]

The single most-tested idea here: to achieve and , deploy across multiple Availability Zones. You reach AWS three ways — the Management Console (web UI), the CLI (command line), and an SDK (in your code) — and you can deploy with infrastructure as code via CloudFormation.

AWS global infrastructure terms
TermWhat it isUsed for
RegionA geographic area with multiple AZsData residency, latency, and pricing choices
Availability Zone (AZ)One+ isolated data centers in a RegionHigh availability — deploy across several AZs
Edge locationA CDN site outside RegionsCloudFront / Route 53 — low-latency delivery
Local Zone / OutpostsAWS infrastructure closer to users / on-premisesVery low latency or hybrid workloads

1.2 Compute & Storage

Compute is led by (resizable virtual servers — IaaS, you manage the OS) and (serverless — your code runs on events with no servers to manage). Between them sit containers (ECS, EKS, Fargate) and platform services like Elastic Beanstalk. spreads traffic across instances and adds or removes capacity to match demand.

Storage comes in three shapes. is object storage (files in buckets, virtually unlimited, 11 nines of durability). is block storage attached to an EC2 instance (like a virtual hard drive). is shared file storage many instances can mount at once. For archives, the classes cost the least.[7]

Compute services — what to use when
ServiceWhat it isBest for
Amazon EC2Virtual servers (IaaS)Full control of the OS; lift-and-shift; steady workloads
AWS LambdaServerless functionsEvent-driven code; no servers to manage; pay per use
ECS / EKS / FargateContainer orchestrationRunning containerized apps (Fargate is serverless containers)
Elastic BeanstalkPlatform as a ServiceDeploying an app without managing the infrastructure
The three types of AWS storage
TypeServiceThink of it as
ObjectAmazon S3 (and S3 Glacier for archive)Files in buckets — backups, data lakes, websites
BlockAmazon EBSA virtual hard drive attached to one EC2 instance
FileAmazon EFS (and FSx)A shared network drive many instances can mount

1.3 Databases & Networking

For databases, prefer managed services. runs managed relational databases (MySQL, PostgreSQL, and more), and is the cloud-native engine within it. is the serverless NoSQL key-value database, and is the data warehouse for analytics.

Networking centers on the — your own isolated virtual network, divided into (public ones reach the internet, private ones stay isolated). You secure traffic with a (stateful, instance-level, allow-only) and a (stateless, subnet-level, allow and deny). gives a private link to AWS that bypasses the public internet.

AWS database services
ServiceTypeUse it for
Amazon RDS / AuroraManaged relational (SQL)Traditional apps needing a relational database
Amazon DynamoDBManaged NoSQL (serverless)High-scale key-value / document data, low latency
Amazon RedshiftData warehouseAnalytics and reporting over large datasets
Amazon ElastiCacheIn-memory cacheSpeeding up reads with Redis or Memcached
Security group vs. network ACL
Security groupNetwork ACL
LevelInstanceSubnet
StateStateful (return traffic auto-allowed)Stateless (must allow return traffic)
RulesAllow rules onlyAllow and deny rules, in number order

Checkpoint · Cloud Technology & Services

Question 1 of 10

A global retailer notices that AWS keeps adding new Regions and Availability Zones around the world over time. From an architecture standpoint, what does this ongoing expansion of the AWS global infrastructure primarily give customers?

Module 2 · Security & Compliance

Domain 2, 30% of the exam — the second-largest domain. Security on AWS starts with one idea you must know cold: the . The rest is access management (IAM) and recognizing which service does which security job.

2.1 The Shared Responsibility Model

AWS is responsible for security of the cloud — the hardware, the global infrastructure, and the software of managed services. The customer is responsible for security in the cloud — their data, identity and access management, and how they configure and encrypt what they put there.[4]

The boundary shifts by service type. With (IaaS), the customer patches the guest operating system. With managed services like , , or , AWS handles more of the stack — but the customer always owns their data, IAM, and configuration.

2.2 IAM & Access Management

(IAM) controls who can do what. Users represent people or apps; groups bundle users with shared permissions; an grants temporary credentials and is the preferred way to give access to applications and services; and an is the JSON document that says what is allowed or denied.[6]

The best practices are heavily tested. Protect the — enable on it and use it only for the rare tasks that require it. Grant . Use roles instead of sharing long-lived keys. Manage many accounts with and consolidated billing.

IAM building blocks
ElementWhat it is
UserAn identity for a person or application
GroupA collection of users that share a set of permissions
RoleAn identity with permissions that can be assumed for temporary credentials
PolicyA JSON document defining allowed or denied actions on resources
Root userThe all-powerful account owner — protect with MFA, use rarely

2.3 Security Services & Compliance

You don’t need deep configuration knowledge — you need to know which service does which job. defends against DDoS; filters malicious web requests; detects threats; finds vulnerabilities; discovers sensitive data in S3; and manages encryption keys.

For governance and audit, records who did what (API calls), while monitors metrics and logs. For compliance, provides on-demand access to AWS’s audit reports and agreements.

AWS security & compliance services — one job each
ServiceIts job
AWS ShieldProtect against DDoS attacks
AWS WAFFilter malicious web traffic (SQL injection, XSS)
Amazon GuardDutyContinuously detect threats and unusual activity
Amazon InspectorScan workloads for software vulnerabilities
Amazon MacieDiscover and protect sensitive data (PII) in S3
AWS KMSCreate and manage encryption keys
AWS CloudTrailRecord account activity and API calls (audit)
AWS ArtifactOn-demand AWS compliance reports and agreements

Checkpoint · Security & Compliance

Question 1 of 10

In the AWS shared responsibility model, the line dividing customer and AWS duties is often summarized as security "of" the cloud versus security "in" the cloud. Which item belongs to security "of" the cloud?

Module 3 · Cloud Concepts

Domain 1, 24% of the exam. This is the “why the cloud” domain — the benefits of moving to AWS, the economics, the design best practices (the Well-Architected Framework), and how organizations migrate.

3.1 Benefits & Economics of the Cloud

AWS frames six benefits of cloud computing: trade for , benefit from massive , stop guessing capacity, increase speed and , stop spending on data centers, and go global in minutes.[11] These flow from access to resources.

means resources expand and contract automatically with demand; is the broader ability to grow. The economic payoff is captured in (TCO), and cloud economics rewards right-sizing, automation, and using managed services.

The six benefits of cloud computing (AWS)
BenefitWhat it means
Trade CapEx for OpExPay variable costs as you use, instead of buying servers upfront
Massive economies of scaleAWS's scale yields lower pay-as-you-go prices
Stop guessing capacityScale up or down on demand — no over- or under-provisioning
Increase speed and agilityProvision resources in minutes, not weeks
Stop spending on data centersFocus on customers, not running infrastructure
Go global in minutesDeploy to Regions worldwide quickly for lower latency

3.2 Well-Architected & Migration

The is AWS’s set of design best practices, organized into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability (added in 2021). Expect a question on naming the pillars.[3]

For migration, the (CAF) helps an organization plan its move, and each workload is handled with one of the 7 Rs: rehost (“lift and shift”), replatform, repurchase, refactor, retire, retain, or relocate.

The 7 Rs of migration
StrategyWhat it means
RehostLift and shift — move as-is with minimal change
ReplatformLift, tinker, and shift — small optimizations (e.g., move to RDS)
RepurchaseSwitch to a different product, often SaaS
RefactorRe-architect to be cloud-native
RetireDecommission what's no longer needed
RetainKeep on-premises for now
RelocateMove infrastructure (e.g., VMware) without buying new hardware

Checkpoint · Cloud Concepts

Question 1 of 10

How many pillars make up the AWS Well-Architected Framework?

Module 4 · Billing, Pricing & Support

Domain 4, 12% of the exam. The smallest domain, but easy points: know the EC2 pricing models, the tools for tracking and controlling cost, and the five support plans.

4.1 Pricing Models & Cost Tools

EC2 has several pricing models. charge per second/hour with no commitment. and cut the rate in exchange for a 1- or 3-year commitment (steady workloads). give deep discounts on spare capacity AWS can reclaim (fault-tolerant workloads). New accounts also get the .[8]

To track and control cost: analyzes past and current spend, alerts when you cross a threshold, and the estimates cost before you deploy. via AWS Organizations combines accounts and earns volume discounts.

EC2 pricing models
ModelHow it worksBest for
On-DemandPay per second/hour, no commitmentShort-term, spiky, or unpredictable workloads
Reserved Instances1- or 3-year commitment for a big discountSteady-state, predictable workloads
Savings PlansCommit to consistent usage for lower ratesFlexible discount across compute usage
Spot InstancesUp to ~90% off spare capacity, interruptibleFault-tolerant, flexible, batch workloads
AWS cost-management tools — analyze, alert, or estimate
ToolWhat it does
AWS Cost ExplorerVisualizes and analyzes past and current cost and usage
AWS BudgetsSets thresholds and alerts you when spend exceeds them
AWS Pricing CalculatorEstimates the cost of an architecture before you build it
Cost & Usage ReportThe most detailed, line-item billing data
Cost allocation tagsTag resources to break down spend by team or project

4.2 Support Plans & Trusted Advisor

AWS has five : Basic (free), Developer, Business, Enterprise On-Ramp, and Enterprise. Higher tiers add faster response times, more channels, and — at the Enterprise tiers — a designated (TAM) and concierge support.[9]

inspects your account across five categories — cost optimization, performance, security, fault tolerance, and service limits — with full checks at Business and above. The shows service health and personalized event alerts.[10]

AWS Support plans (lowest → highest)
PlanKey feature
BasicFree — documentation, forums, and Trusted Advisor core checks
DeveloperBusiness-hours email support; for testing/development
Business24/7 support, full Trusted Advisor checks, faster response times
Enterprise On-RampAdds a pool of Technical Account Managers and faster critical response
EnterpriseDesignated TAM, concierge support, fastest response (15 min for critical)

Checkpoint · Billing, Pricing & Support

Question 1 of 10

A growing company manages dozens of separate AWS accounts for different teams and wants a single service to centrally govern them, apply policies across all of them, and combine their invoices into one payment. Which AWS service provides this capability?

How to Use This AWS Cloud Practitioner Study Guide

This guide is built to be worked, not just read. The most efficient path to a pass:

  • Study by weight. Cloud Technology & Services (34%) and Security & Compliance (30%) are nearly two-thirds of the exam — start there, then Cloud Concepts and Billing.
  • Check off as you go. Use the Study Guide Contents to mark each section done; it raises your exam-readiness score.
  • Take every checkpoint. The end-of-module quizzes show you exactly which domains need another pass.
  • Drill the weak domain. Send your weak area into the flashcards and a practice test until the score climbs.
  • Learn what each service does. This is a breadth exam — recognizing the job of each core service beats memorizing configuration detail.

AWS Cloud Practitioner Concept Questions

Common AWS concepts candidates search while studying for the CLF-C02 — each answered briefly and backed by an official AWS source. Test yourself, then drill them as flashcards.

AWS Cloud Practitioner Glossary

The high-yield AWS terms in one place — hover any dotted term in the guide, or flip the whole deck here as a self-grading flashcard set.

Agility
The ability to innovate and respond quickly because resources can be provisioned in minutes rather than weeks.
Amazon Aurora
A high-performance, MySQL- and PostgreSQL-compatible relational database built for the cloud and available through Amazon RDS.
Amazon CloudFront
A content delivery network (CDN) that caches content at edge locations to reduce latency.
Amazon CloudWatch
A monitoring service that collects metrics, logs, and alarms for AWS resources and applications.
Amazon DynamoDB
A fully managed, serverless NoSQL key-value and document database with single-digit-millisecond performance.
Amazon EBS
Elastic Block Store — persistent block storage volumes attached to EC2 instances.
Amazon EC2
Elastic Compute Cloud — resizable virtual servers (instances) in the AWS Cloud (Infrastructure as a Service).
Amazon EFS
Elastic File System — scalable, shared file storage that multiple EC2 instances can mount at once.
Amazon GuardDuty
A threat-detection service that continuously monitors for malicious activity and unauthorized behavior.
Amazon Inspector
An automated vulnerability-management service that scans workloads for software vulnerabilities and unintended network exposure.
Amazon Macie
A service that uses machine learning to discover and protect sensitive data (such as PII) in Amazon S3.
Amazon RDS
Relational Database Service — a managed relational database (MySQL, PostgreSQL, Aurora, and others) where AWS handles patching, backups, and failover.
Amazon Redshift
A fully managed cloud data warehouse for analytics on large datasets.
Amazon Route 53
A scalable Domain Name System (DNS) web service for routing users to applications.
Amazon S3
Simple Storage Service — highly durable object storage that stores files as objects in buckets.
Amazon VPC
Virtual Private Cloud — a logically isolated virtual network in AWS where you control IP ranges, subnets, and gateways.
Auto Scaling
A service that automatically adds or removes compute capacity to match demand.
Availability Zone
One or more discrete data centers within a Region, each with redundant power, networking, and connectivity (an AZ).
AWS Artifact
A self-service portal for on-demand access to AWS compliance reports and agreements.
AWS Budgets
A tool to set custom cost or usage thresholds and receive alerts when spending exceeds them.
AWS Cloud
Amazon's on-demand cloud computing platform, providing compute, storage, database, networking, and other services on a pay-as-you-go basis.
AWS CloudTrail
A service that records account activity and API calls for governance, compliance, and auditing.
AWS Cost Explorer
A tool to visualize, understand, and analyze AWS costs and usage over time.
AWS Direct Connect
A dedicated private network connection from your premises to AWS, bypassing the public internet.
AWS Free Tier
Free usage of certain AWS services for new customers, in three forms: always free, 12-months free, and short-term trials.
AWS Health Dashboard
A dashboard showing the health of AWS services and personalized alerts about events affecting your resources.
AWS Identity and Access Management
IAM — the service that controls who is authenticated and authorized to use AWS resources via users, groups, roles, and policies.
AWS KMS
Key Management Service — create and control the encryption keys used to encrypt your data.
AWS Lambda
A serverless compute service that runs your code in response to events and scales automatically; you pay only for compute time used.
AWS Organizations
A service to centrally manage and govern multiple AWS accounts, with consolidated billing and service control policies.
AWS Pricing Calculator
A web tool to estimate the cost of an AWS architecture before you deploy it.
AWS Shield
A managed service that protects applications against Distributed Denial of Service (DDoS) attacks.
AWS Support plans
The five support tiers — Basic, Developer, Business, Enterprise On-Ramp, and Enterprise — with increasing response speed and features.
AWS Trusted Advisor
A tool that inspects your environment and recommends improvements across cost, performance, security, fault tolerance, and service limits.
AWS WAF
Web Application Firewall — protects web applications from common exploits such as SQL injection and cross-site scripting.
CapEx
Capital expenditure — large upfront spending to buy assets such as servers and data centers.
Cloud Adoption Framework
AWS CAF — guidance organized into perspectives (business, people, governance, platform, security, operations) that helps organizations plan a cloud migration.
Cloud computing
The on-demand delivery of IT resources over the internet with pay-as-you-go pricing, instead of buying and maintaining physical data centers.
Consolidated billing
Combining the bills of multiple accounts under AWS Organizations into one payment, with volume discounts across accounts.
Economies of scale
Lower per-unit costs that AWS achieves by aggregating the usage of many customers and passing savings on as lower prices.
Edge location
A site outside Regions used by Amazon CloudFront and Route 53 to cache content close to users for low latency.
Elastic Load Balancing
A service that automatically distributes incoming traffic across multiple targets to improve availability and fault tolerance.
Elasticity
The ability to automatically acquire resources when you need them and release them when you don't, matching capacity to demand.
Fault tolerance
The ability of a system to continue operating without interruption when one or more of its components fail.
High availability
Designing a system so it remains operational despite component failure, commonly by deploying across multiple Availability Zones.
IAM policy
A document that defines permissions — what actions are allowed or denied on which resources.
IAM role
An IAM identity with permissions that can be assumed to obtain temporary credentials, often used by applications and services.
Least privilege
Granting only the minimum permissions needed to perform a task.
Multi-factor authentication
MFA — an extra sign-in step (a code from a device) added on top of a password for stronger security.
Network ACL
A stateless firewall at the subnet level that supports both allow and deny rules evaluated in numbered order.
On-Demand Instances
EC2 pricing where you pay per second or hour with no upfront commitment — ideal for short-term or unpredictable workloads.
OpEx
Operating expenditure — variable, pay-as-you-go spending on services as they are used.
Pay-as-you-go
A pricing model where you pay only for the individual services and capacity you actually consume, with no long-term contracts required.
Region
A separate geographic area that contains multiple, isolated Availability Zones.
Reserved Instances
A 1- or 3-year commitment that provides a significant discount over On-Demand pricing for steady-state workloads.
Root user
The account created when you first set up an AWS account; it has full access and should be protected with MFA and used rarely.
S3 Glacier
Low-cost Amazon S3 storage classes designed for data archiving and long-term backup.
Savings Plans
A flexible pricing model offering lower prices in exchange for a 1- or 3-year commitment to a consistent amount of usage.
Scalability
The ability to increase or decrease resources to handle growth in workload; on AWS this can be done on demand.
Security group
A stateful virtual firewall at the instance level that controls inbound and outbound traffic with allow rules only.
Shared Responsibility Model
The division of security duties: AWS secures the cloud (infrastructure), the customer secures what they put in the cloud (data, IAM, configuration).
Spot Instances
EC2 capacity offered at deep discounts that AWS can reclaim with short notice — best for fault-tolerant, flexible workloads.
Subnet
A range of IP addresses within a VPC; a public subnet can reach the internet, a private subnet stays isolated.
Technical Account Manager
TAM — a designated AWS advocate included with Enterprise-level support who provides proactive guidance.
Total cost of ownership
TCO — the full cost of running a workload, including direct and indirect costs, used to compare on-premises and cloud.
Well-Architected Framework
AWS best practices for designing workloads, organized into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability.

AWS Cloud Practitioner Study Guide FAQ

The CLF-C02 exam has 65 questions — 50 scored and 15 unscored pilot items that don't affect your score. You get 90 minutes. Questions are multiple choice (one correct answer) or multiple response (two or more correct answers).

References

  1. 1.Amazon Web Services. “AWS Certified Cloud Practitioner (CLF-C02) Exam Guide.” docs.aws.amazon.com.
  2. 2.Amazon Web Services. “AWS Certified Cloud Practitioner — Certification Page.” aws.amazon.com.
  3. 3.Amazon Web Services. “AWS Well-Architected Framework.” docs.aws.amazon.com.
  4. 4.Amazon Web Services. “AWS Shared Responsibility Model.” aws.amazon.com.
  5. 5.Amazon Web Services. “Global Infrastructure.” aws.amazon.com.
  6. 6.Amazon Web Services. “What is IAM?.” docs.aws.amazon.com.
  7. 7.Amazon Web Services. “Amazon S3 Storage Classes.” aws.amazon.com.
  8. 8.Amazon Web Services. “Amazon EC2 Pricing.” aws.amazon.com.
  9. 9.Amazon Web Services. “AWS Support Plans.” aws.amazon.com.
  10. 10.Amazon Web Services. “AWS Trusted Advisor.” docs.aws.amazon.com.
  11. 11.Amazon Web Services. “Six Advantages of Cloud Computing.” docs.aws.amazon.com.
  12. 101.Amazon Web Services. “Security Groups for Your VPC.” docs.aws.amazon.com, accessed 19 June 2026.
  13. 102.Amazon Web Services. “What is Amazon EC2?.” docs.aws.amazon.com, accessed 19 June 2026.
  14. 103.Amazon Web Services. “What is Amazon S3?.” docs.aws.amazon.com, accessed 19 June 2026.
  15. 104.Amazon Web Services. “What is AWS Lambda?.” docs.aws.amazon.com, accessed 19 June 2026.
  16. 105.Amazon Web Services. “What is Amazon VPC?.” docs.aws.amazon.com, accessed 19 June 2026.
  17. 106.Amazon Web Services. “What is Amazon RDS?.” docs.aws.amazon.com, accessed 19 June 2026.
  18. 107.Amazon Web Services. “AWS Cost Explorer.” aws.amazon.com, accessed 19 June 2026.
Career Employer

Career Employer is the ultimate resource to help you get started working the job of your dreams. We cover topics from general career information, career searching, exam preparation with free study materials, career interviewing, and becoming successful in your career of choice.

Follow Us:

All Posts

Career Employer’s Editorial Process

Here at Career Employer, we focus a lot on providing factually accurate information that is always up to date. We strive to provide correct information using strict editorial processes, article editing, and fact-checking for all of the information found on our website. We only utilize trustworthy and relevant resources. To find out more, make sure to read our full editorial process page here.