AWS Cloud Practitioner Study Guide: CLF-C02 Essentials

CLF-C02 has four content domains: Cloud Concepts, Security and Compliance, Cloud Technology and Services, and Billing, Pricing and Support. Their published weightings are 24%, 30%, 34% and 12%, respectively; confirm these against the current official exam guide when planning revision. Cloud fluency starts with on-demand resources, measured usage and the ability to provision capacity without purchasing physical infrastructure. Scalability means adjusting capacity to meet demand, while elasticity emphasises expanding and contracting resources as demand changes. Neither means that costs automatically fall: architecture, purchasing choices and resource management still determine the financial outcome of a cloud deployment.

Understand how AWS global infrastructure supports availability and performance. A Region is a separate geographical area containing multiple Availability Zones. Each Availability Zone comprises one or more discrete data centres with redundant infrastructure. Deploying across Availability Zones can help an application tolerate a zone failure; using multiple Regions can address requirements such as disaster recovery or geographical reach. Edge locations bring selected services closer to users, but they are not substitutes for Regions. Connect these concepts to the AWS Well-Architected Framework, whose six pillars help teams assess operational excellence, security, reliability, performance efficiency, cost optimisation and sustainability.

Amazon EC2 provides virtual servers when workloads need control over operating systems and software configuration. EC2 Auto Scaling can adjust instance capacity, while Elastic Load Balancing distributes traffic across healthy targets. AWS Lambda runs code in response to events without requiring customers to provision or manage servers, although customers still manage their code, permissions and configuration. For containers, Amazon ECS provides container orchestration and Amazon EKS provides managed Kubernetes. AWS Fargate supplies serverless compute for supported ECS and EKS workloads. At this level, focus on these roles rather than detailed deployment commands or container cluster administration.

Amazon VPC provides a logically isolated network in AWS, with subnets, routing and connectivity controls. A public subnet has a route to an internet gateway, but that alone does not make every resource publicly reachable: addressing and security settings also matter. Security groups control traffic for associated resources, while network ACLs operate at the subnet level. Amazon Route 53 supplies DNS and related routing capabilities; Amazon CloudFront is a content delivery network that caches and delivers content through edge locations. AWS Direct Connect offers dedicated connectivity to AWS, whereas AWS Site-to-Site VPN provides an encrypted connection over the internet.

Amazon S3 is object storage for data such as documents, media, backups and data lakes. It is not a block device attached to a server. Amazon EBS provides block storage for EC2 workloads, with volumes scoped to an Availability Zone. Amazon EFS provides managed NFS file storage that multiple clients can access. Within S3, storage classes suit different access patterns, retrieval requirements and resilience needs; some archival classes involve retrieval delays and additional charges. Lifecycle rules can transition or expire objects according to policy. Distinguish durability, which concerns preserving data, from availability, which concerns being able to access it when required.

Amazon RDS manages common relational database engines, helping with tasks such as provisioning, patching and backups. Amazon Aurora is a relational database compatible with MySQL and PostgreSQL, available through Amazon RDS. Amazon DynamoDB is a managed NoSQL database supporting key-value and document data models. Amazon Redshift supports data warehousing and analytics, while Amazon ElastiCache provides managed in-memory caching. Choose based on the access pattern: transactions with relational structures point towards a relational database, whereas predictable key-based access may suit DynamoDB. Managed services reduce operational work, but customers still decide access permissions, data structures, retention requirements and appropriate configuration.

The shared responsibility model separates security of the cloud from security in the cloud. AWS protects the underlying facilities, hardware, networking and virtualisation infrastructure. Customers remain responsible for their data, access decisions and configuration, with specific duties changing by service. On EC2, customers generally patch the guest operating system and their applications. With Lambda, AWS manages the underlying servers and operating systems, while customers secure their application code, dependencies and permissions. Avoid absolute claims such as 'AWS handles all security for managed services'. Compliance is also shared: using an eligible AWS service does not automatically make a customer's workload compliant.

AWS Identity and Access Management controls access through identities and policies. Apply least privilege, prefer temporary credentials where appropriate, protect the account root user with multi-factor authentication and avoid using it for routine work. AWS IAM Identity Center supports workforce access across accounts and applications. For monitoring, distinguish Amazon CloudWatch metrics, logs and alarms from AWS CloudTrail records of account activity and API calls. AWS Config records resource configurations and can evaluate them against rules. Amazon GuardDuty detects potential threats, Amazon Inspector identifies supported workload vulnerabilities, and AWS Artifact provides access to compliance reports and selected agreements.

AWS pricing depends on the service, Region, usage and purchasing model. Common cost drivers include compute duration, storage capacity, requests and data transfer. On-Demand pricing avoids a long-term usage commitment, while Savings Plans offer lower eligible rates in exchange for a consistent hourly spending commitment over a defined term. Reserved Instances provide billing discounts for matching usage; capacity reservation behaviour depends on their scope and offering. EC2 Spot Instances use spare capacity at discounted rates but can be interrupted, so they suit fault-tolerant workloads. Do not assume that every discount applies across all services or that a commitment is always cheaper for unpredictable usage.

Use AWS Pricing Calculator to estimate proposed workloads, AWS Cost Explorer to analyse spending and usage, and AWS Budgets to track thresholds and send alerts. A budget alert is not a universal spending cap, although budget actions can automate selected responses when configured. AWS Organisations supports consolidated billing across accounts, and cost allocation tags help attribute supported costs when configured and activated. Free Tier offers have eligibility conditions, time limits or usage limits that should be checked against current terms. For support questions, revise the current AWS Support plans and AWS Trusted Advisor capabilities using official documentation rather than memorising potentially outdated pricing tables.