The AWS Certified Cloud Practitioner (CLF-C02) is a foundational, mostly non-technical exam. It checks that you can hold a sensible conversation about the cloud: what it is and why organisations move to it, the core AWS services and what each one is for, how security responsibility is split between AWS and you, and how AWS charges and supports its customers. You do not need an engineering background, and you will not be asked to configure anything. What you need is a clear mental model of a small number of ideas, applied confidently. This guide is a full self-study course built around the four official domains. It explains each concept in plain English, shows where the easy marks and the common confusions sit, and then turns the content into a short, realistic plan. It is original teaching material only. It contains no real or simulated exam questions, and you should always confirm the current weights and rules against AWS’s own Cloud Practitioner exam guide before you book.
Chapter 1: Exam overview and how to use this guide
What the Cloud Practitioner actually measures
The Cloud Practitioner measures cloud literacy, not engineering skill. AWS describes it as validating a foundational understanding of AWS Cloud concepts, services, security, architecture, pricing, and support, and that framing is exactly right: the exam wants to know that you understand the landscape, not that you can build in it. The single most useful planning fact is the domain split. AWS organises the scored content into four domains with fixed weights: Cloud Concepts at 24%, Security and Compliance at 30%, Cloud Technology and Services at 34%, and Billing, Pricing and Support at 12%. Read those weights as a budget for your time. The middle two domains together are roughly two thirds of the exam, so they deserve most of your attention, while the smallest domain still offers some of the easiest marks on the paper.
The exam is 65 questions in 90 minutes, delivered as multiple-choice (one correct answer) and multiple-response (select two or more) questions. Of those 65, only 50 are scored. The other 15 are unscored questions that AWS is trialling for future use, and they are not identified, so you simply answer every question as if it counts. Results come back as a scaled score from 100 to 1,000, and the pass mark is 700. Because the scoring is scaled across questions of varying difficulty, you should not try to convert 700 into a fixed percentage of right answers. The practical takeaway is simpler: aim to be answering comfortably and consistently across all four domains, not scraping a bare majority.
Why this exam rewards recognition over depth
Most questions ask you to recognise the right service, concept, or responsibility for a situation, rather than to recall a setting or a number. A typical question might describe a need (store files cheaply, run code without managing servers, find out who secures the data) and ask which AWS service or which party fits. That style is forgiving if you have a clear high-level map and punishing if you have memorised disconnected facts without understanding what they are for. Throughout this course, the emphasis is therefore on the purpose of each idea: what problem it solves and when you would reach for it.
How to use this course
Read the chapters in order at least once. Chapter 2 builds the cloud value vocabulary that the rest of the exam assumes, Chapters 3 and 4 cover the two heaviest domains (security and core services), and Chapter 5 finishes the billing and support material. Treat the bold terms as a checklist: by the end you should be able to say, in a sentence, what each one is and when it matters. Chapters 6 to 8 turn the content into a plan, a final review routine, and a description of exam day. Short worked examples appear where an idea is easy to misread, but none of them are exam questions. They are teaching illustrations to make an abstract term concrete.
Chapter 2: Cloud Concepts (24%)
This domain is about the why of the cloud: the benefits that make organisations move off their own hardware, the economics that justify it, and the high-level frameworks AWS uses to talk about good cloud adoption. Get this right and the rest of the exam has a foundation to sit on, because security, services, and pricing all make more sense once you understand what the cloud is for.
What cloud computing is, and what changes
Cloud computing is the on-demand delivery of IT resources (compute, storage, databases, networking, and more) over the internet, paid for as you use them rather than owned outright. The shift that matters for the exam is from capital expenditure to operational expenditure: instead of buying servers up front and hoping you sized them correctly, you rent capacity and pay only for what you consume. That single change drives most of the benefits the exam asks about, so it is worth holding clearly in mind.
The benefits of the cloud
AWS frames the value of the cloud as a handful of benefits, and the exam returns to them repeatedly. Trade fixed expense for variable expense: you stop paying for idle hardware and pay only for the resources you actually use. Benefit from massive economies of scale: because AWS aggregates demand from huge numbers of customers, it achieves lower costs than any single organisation could, and passes some of that on. Stop guessing capacity: you scale up or down as real demand dictates, rather than provisioning for a peak that may never come. Increase speed and agility: new resources are minutes away rather than weeks, so teams experiment and ship faster. Stop spending money running and maintaining data centres: you focus on your customers and products instead of racking servers. And go global in minutes: you can deploy close to users around the world without building anything physical. As a teaching example of why this matters: a retailer expecting a seasonal spike can scale out for the busy weeks and scale back afterwards, paying for the extra capacity only while it is needed, which is precisely the “stop guessing capacity” benefit in action.
Elasticity, scalability, and agility
A few related words describe how the cloud flexes, and the exam expects you to tell them apart. Scalability is the ability to grow (or shrink) to handle changing load, often by adding more resources. Elasticity is doing that automatically and quickly in response to demand, so capacity tracks need in near real time. Agility is the broader business benefit: because resources are fast and cheap to obtain, organisations can try ideas, fail cheaply, and move quickly. If a question contrasts “provision for the worst case in advance” with “let capacity follow demand automatically”, the elastic, demand-driven option is the one the exam favours.
Cloud economics and total cost of ownership
The exam touches lightly on economics, mainly through the idea of total cost of ownership (TCO): the full cost of running workloads, not just the obvious one. On-premises, TCO includes hardware, data-centre space, power, cooling, and the staff to run it all; in the cloud, much of that disappears into a usage-based bill. The point the exam rewards is that comparing cloud to on-premises means comparing total costs, including the hidden operational ones, rather than just sticker prices.
The frameworks: Well-Architected and the Cloud Adoption Framework
Two AWS frameworks appear at a conceptual level. The AWS Well-Architected Framework is a set of design pillars for building good systems, and at this level you only need to recognise that it exists and roughly what it covers: operational excellence, security, reliability, performance efficiency, cost optimisation, and sustainability. The AWS Cloud Adoption Framework (CAF) is about the organisational journey to the cloud, grouping the work into perspectives spanning both business and technical concerns. You do not need deep knowledge of either; you need to recognise their names and purpose if a question mentions them. Treat them as background vocabulary rather than study-heavy topics.
Chapter 3: Security and Compliance (30%)
This is the second-largest domain and the one where a single idea, the shared responsibility model, earns a disproportionate number of marks. Security on AWS is a partnership: AWS secures some things and you secure others, and most security questions on this exam are really asking which side of that line a given task sits on. Learn the line first, then the supporting concepts.
The shared responsibility model
The shared responsibility model divides security between AWS and the customer. The shorthand is that AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud. AWS secures the underlying infrastructure: the physical data centres, the hardware, the networking, and the software that runs its managed services. You secure what you put on top: your data, who has access to it, how you configure the services you use, and, where relevant, the operating systems and applications you run.
The exact split shifts depending on how managed a service is, and this nuance is worth understanding rather than memorising. With a service like EC2, where you run virtual servers, you are responsible for more, including patching the guest operating system and configuring the firewall rules. With a highly managed service like S3 or a managed database, AWS handles more of the stack, and your job narrows mainly to access control and the data itself. As a teaching example to make the line concrete: if data in your storage is exposed because it was configured to be publicly readable, that is a customer responsibility, because access configuration sits “in the cloud”; if a hard drive in an AWS data centre fails and is securely decommissioned, that is AWS’s responsibility, because the physical infrastructure is “of the cloud”. Almost every security question on this exam can be answered by placing the task on the correct side of that boundary.
Identity and access management
AWS Identity and Access Management (IAM) is how you control who can do what in your account, and at this level you need the building blocks rather than the policy syntax. An IAM user represents a person or application with long-term credentials. An IAM group is a collection of users that share permissions, which makes access easier to manage at scale. An IAM role provides temporary credentials that can be assumed by a user, an application, or an AWS service, and roles are the preferred way to grant access without embedding long-lived keys. IAM policies are the documents that define permissions, attached to users, groups, or roles.
Two principles sit on top and recur in questions. The first is least privilege: grant only the permissions actually needed, and no more, so a mistake or a compromise has limited blast radius. The second is protecting the most powerful identity of all. The root user, created when the account is opened, has unrestricted access, so the exam’s consistent advice is to secure it (enable multi-factor authentication, or MFA), avoid using it for everyday work, and create individual IAM users or roles for routine tasks instead. MFA adds a second factor beyond a password, and recognising it as a basic, strongly recommended protection is enough for this exam.
Compliance and where to find it
The exam expects awareness, not expertise, on compliance. AWS maintains a long list of compliance programmes and certifications, and the key resource to recognise is AWS Artifact, the self-service portal where you can download AWS’s compliance reports and agreements. The mental model to carry is that compliance, like everything else, is shared: AWS certifies its infrastructure against many standards, but using a compliant platform does not automatically make your workload compliant, because how you configure and use the services is your responsibility.
Core security services to recognise
You should recognise a handful of security services by purpose, without needing to operate them. AWS Shield protects against distributed denial-of-service (DDoS) attacks. AWS WAF is a web application firewall that filters malicious web traffic. Amazon GuardDuty is a threat-detection service that watches for suspicious activity. AWS KMS (Key Management Service) manages the encryption keys used to protect data. Amazon Inspector assesses workloads for vulnerabilities, and AWS Security Hub gives a consolidated view of security findings. The exam may also reference encryption at rest (protecting stored data) and encryption in transit (protecting data as it moves), and the takeaway is simply that AWS provides the tools to do both. You are being tested on matching a service to a need (“which service protects against DDoS?”), not on configuring any of them.
Chapter 4: Cloud Technology and Services (34%)
This is the largest domain, and it is a breadth test: you need to recognise the core services across compute, storage, databases, and networking, know at a high level what each is for, and understand the global infrastructure they run on. Depth is not the goal. A clear map is. The most efficient way to study this domain is to group services by category and learn the one-line purpose of each, so that when a scenario describes a need, the right category and service come to mind.
The AWS global infrastructure
AWS runs in Regions, which are separate geographic areas around the world. Each Region contains multiple Availability Zones (AZs), which are one or more discrete data centres with independent power and networking, located close enough for low-latency links but far enough apart to fail independently. Deploying across multiple AZs is the foundation of high availability, because the loss of one zone need not take your application down. Separately, edge locations are sites used by content-delivery and related services to cache content close to end users, reducing latency. The exam likes the distinction between a Region (a geographic area), an Availability Zone (isolated data centres within a Region), and an edge location (a caching site near users), so hold those three apart clearly.
Compute
Compute is where your code and applications run, and a few services cover most questions. Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers, giving you the most control and the most responsibility. AWS Lambda is serverless compute: you upload code and it runs in response to events, with no servers for you to manage and billing only for the time it runs, which suits short, event-driven tasks. Containers are served by Amazon ECS and Amazon EKS for orchestration, with AWS Fargate offering a serverless way to run containers without managing the underlying instances. AWS Elastic Beanstalk is a higher-level service that deploys and manages an application for you, handling the capacity and scaling behind the scenes. The mental model that earns marks is a spectrum of control versus convenience: EC2 gives maximum control, Lambda and Fargate remove server management, and Beanstalk automates deployment of a whole app.
Storage
AWS storage comes in three broad shapes, and choosing between them is a recurring theme. Amazon S3 (Simple Storage Service) is object storage: highly durable, effectively unlimited, and ideal for files, backups, data lakes, and static website assets. Amazon EBS (Elastic Block Store) is block storage attached to a single EC2 instance, behaving like a virtual hard disk for that server. Amazon EFS (Elastic File System) is file storage that many instances can share at once. For low-cost archival, S3 offers Glacier storage classes, trading retrieval speed for a much lower price. The clean way to remember the split: object storage (S3) for files and backups, block storage (EBS) for a single server’s disk, file storage (EFS) for a shared file system, and Glacier for cheap archives you rarely touch.
Databases
On the database side, the first distinction is relational versus non-relational. Amazon RDS (Relational Database Service) is managed SQL, handling engines like MySQL, PostgreSQL, and others, and taking care of patching, backups, and failover. Amazon Aurora is AWS’s own high-performance database compatible with MySQL and PostgreSQL. Amazon DynamoDB is a managed NoSQL key-value and document database built for massive scale and low latency. Amazon ElastiCache provides an in-memory cache to speed up reads. Amazon Redshift is a data-warehouse service for analytics over large datasets. For this exam, you match the need to the category: structured, relational data with complex queries points to RDS or Aurora, while high-scale key-value access points to DynamoDB.
Networking and content delivery
A few networking services round out the map. Amazon VPC (Virtual Private Cloud) is your own logically isolated network within AWS, where your resources live. Amazon Route 53 is the managed DNS service that translates domain names into addresses and routes users to your application. Amazon CloudFront is the content-delivery network (CDN) that caches content at edge locations to serve users quickly. You may also see Elastic Load Balancing, which spreads incoming traffic across multiple targets for availability and performance. Recognising what each does at a high level is enough.
Ways to interact, deploy, and operate
Finally, the exam expects you to know the ways you can work with AWS. You can use the AWS Management Console (a web interface), the AWS Command Line Interface (CLI), or the SDKs that let applications call AWS programmatically. For deployment models, recognise the difference between cloud (everything in AWS), hybrid (a mix of cloud and on-premises, often connected over a private link), and on-premises (your own data centre). A couple of operational services are worth recognising too: Amazon CloudWatch for monitoring metrics, logs, and alarms, and AWS CloudTrail for recording account activity and API calls for audit. These appear lightly, but they are easy marks if you know what each is for.
Chapter 5: Billing, Pricing and Support (12%)
This is the smallest domain, but it is dense with quick marks because the concepts are concrete and finite. It covers how AWS prices its services, the tools for managing and forecasting cost, and the support plans on offer. A focused pass here is one of the best returns on study time in the whole exam.
How AWS pricing works
AWS pricing rests on a few fundamentals. The first is pay-as-you-go: you pay only for what you use, with no large up-front commitment required. The second is that committing to usage earns discounts, which is where the EC2 purchasing options come in. On-Demand pricing is the flexible default, billed by the second or hour with no commitment, and it suits unpredictable or short-term workloads. Reserved Instances and Savings Plans offer significant discounts in exchange for committing to a level of usage over one or three years, which suits steady, predictable workloads. Spot Instances offer the deepest discounts by using AWS’s spare capacity, but they can be reclaimed at short notice, so they suit fault-tolerant or flexible work. The exam’s instinct is to match the pricing model to the workload: steady and predictable favours Reserved or Savings Plans, unpredictable favours On-Demand, and interruptible favours Spot.
The third fundamental is the AWS Free Tier, which lets new accounts use certain services free within limits, so you can learn and experiment at no cost. Recognise its existence and purpose; you do not need the specific limits.
Cost-management and billing tools
AWS provides tools to see, control, and predict spending, and the exam expects you to match each tool to its job. AWS Cost Explorer visualises and analyses your spending over time. AWS Budgets lets you set custom cost or usage budgets and alerts you when you approach or exceed them. The AWS Pricing Calculator estimates the cost of a planned architecture before you build it. The AWS Billing Dashboard shows your current charges. For organisations with many accounts, consolidated billing through AWS Organizations combines billing into one payer account and can unlock volume discounts across the group. A useful way to keep these straight: Cost Explorer looks at what you have spent, Budgets warns you about what you are about to spend, and the Pricing Calculator estimates what you would spend.
AWS support plans
AWS offers tiered support plans, and the exam wants you to match a plan to a need rather than memorise every feature. Basic support is free and included with every account, covering account and billing questions and access to documentation and forums. Developer support suits experimentation and non-production work, adding business-hours technical guidance. Business support suits production workloads, adding faster response times and around-the-clock access to support. Enterprise On-Ramp and Enterprise support are for business-critical and large-scale workloads, with the fastest response times and, at the Enterprise level, a designated Technical Account Manager (TAM) who provides proactive guidance. The pattern to remember runs from free and self-service (Basic) up to business-critical with a dedicated contact (Enterprise), with the right answer driven by how critical the workload is. Two more resources are worth recognising: AWS Trusted Advisor, which inspects your account and recommends improvements across cost, security, performance, and more, and AWS Support itself as the channel for raising cases.
Chapter 6: Study plan and timeline
With the four domains understood, the remaining task is to pace them sensibly. This is a foundational exam, so the danger is not under-studying so much as letting a quick certification drift over months until the early material fades. The plan below is deliberately short and weighted toward the two heaviest domains.
Let the weights set your priorities
Spend your time roughly in proportion to the domain weights, which means the most on Cloud Technology and Services (34%) and Security and Compliance (30%), a solid pass on Cloud Concepts (24%), and a focused, efficient session on Billing, Pricing and Support (12%). Within security, the shared responsibility model is the single highest-value topic, so give it more time than its share of pages might suggest. Within technology, build the category map (compute, storage, databases, networking) before worrying about any individual service’s details.
Choose a timeline
A comfortable default is two to three weeks at three to four hours a week for someone new to the cloud. A sensible sequence is: week one on cloud concepts and the global infrastructure, building the value vocabulary and the Region/AZ/edge distinction; week two on the two big domains, security (centred on the responsibility model and IAM) and the core services by category; and a short third week on billing, pricing, and support, followed by practice questions and a final review. If you already have an IT background, you can compress this to roughly a week of light study (around ten hours), skimming the domains and spending most of the time on practice questions to calibrate the level of detail. A gentler pace of four weeks at around two hours a week works for total beginners who prefer to absorb the vocabulary slowly. To turn whichever timeline you pick into dated weeks for your own start date, use the free study-plan generator.
Lean on practice questions
Because this exam rewards recognition rather than configuration, practice questions are the most efficient study tool, and you should start them as soon as you have covered a domain rather than saving them for the end. They reveal the level of detail you actually need, which is lower than most beginners assume, and they quickly surface the few areas (usually the shared responsibility model and the pricing models) where people slip. Treat every wrong answer as a prompt to reread that concept until you can explain it in a sentence. If you are weighing this against jumping straight to an associate exam, the Cloud Practitioner vs Solutions Architect Associate comparison covers the trade-off.
Chapter 7: A little hands-on, and final review
Why a small amount of hands-on still helps
You will not be asked to configure anything, and hands-on practice is not required to pass. But an hour or two in a free-tier account turns abstract terms into things you have actually seen, which makes the recognition questions easier. A worthwhile starter session is to create an S3 bucket and upload a file, launch a small EC2 instance and connect to it, open the IAM console to see users and roles, and look at the billing dashboard and the Pricing Calculator. The aim is familiarity, not skill: once you have seen what an EC2 instance or an S3 bucket actually is, the services stop being just names on a list.
The final review
When your practice scores sit comfortably above the pass mark across all four domains on fresh questions, switch from learning to consolidating. Do a focused final pass over the highest-value material: the shared responsibility model and where the line falls, the core services grouped by category, the IAM building blocks and root-user protection, the pricing models matched to workloads, and the support plans matched to criticality. This is not an exam that rewards over-preparation, so resist the urge to keep adding new detail once you are scoring well. A short, confident review beats another week of cramming.
Keep the momentum
A two-to-four-week plan only delivers its value if it stays that length. Short, focused sessions beat letting the certification slide over months, where early material fades and the easy win slips away. Set a target exam date early and book it, so the plan stays tight and the studying stays purposeful.
Chapter 8: Exam day and format
On the day, the exam is 65 questions in 90 minutes, taken either at a Pearson VUE test centre or through online proctoring, and you will need valid government-issued identification. The questions are multiple-choice (one correct answer) and multiple-response (select two or more, with the question telling you how many), and there are no hands-on labs at this level. Remember that 15 of the 65 questions are unscored trial questions that are not marked as such, so answer every question normally and do not waste energy guessing which ones count.
Pacing is not a serious problem at this level, since 90 minutes is generous for 65 recognition-style questions, but a steady rhythm still helps. Read each question for what it is really asking, eliminate the options that are clearly wrong, and for multiple-response questions make sure you select exactly the number requested. You can flag questions and return to them, so do not stall on a hard one; mark it, move on, and come back with fresh eyes. Apply the simple instincts you built over the weeks of study: place security tasks on the correct side of the responsibility line, match a need to the right service category, match a workload to the right pricing model, and match a support requirement to the right plan. Having practised at the right level of detail, the format will feel familiar rather than intimidating, which is exactly the advantage a short, focused preparation is meant to give you.