What the CLF-C02 exam actually looks like
Before the questions, the shape of the test. Knowing that roughly a quarter of your questions are unscored changes how you handle the one that makes no sense: you flag it and move on, because it may not even count.
| Item | Detail |
|---|---|
| Exam code | CLF-C02 |
| Questions | 65 total, of which 50 are scored (15 are unscored trial questions) |
| Time | 90 minutes |
| Format | Multiple choice (one answer) and multiple response (two or more) |
| Scoring | Scaled 100-1000, passing score 700 |
| Cloud Concepts | 24% |
| Security and Compliance | 30% |
| Cloud Technology and Services | 34% |
| Billing, Pricing and Support | 12% |
- ✓700 is a scaled score, not 70% of questions correct - harder questions carry more weight.
- ✓Security and Compliance plus Cloud Technology and Services are almost two thirds of the exam between them.
- ✓Billing is only 12%, which is about six scored questions - small enough to ignore, large enough to cost you the pass if you are borderline.
Practice: cloud concepts and shared responsibility
This is where the exam is most conceptual, and where the wording matters most. Read who the question is asking about - AWS or the customer.
A company wants to stop spending engineering time on operating-system patching for its relational database. Which AWS service best addresses this?
Amazon RDS. This is a shared-responsibility question wearing a service-selection costume. On EC2 you install and patch the database and its operating system yourself. Moving to RDS shifts OS and database-engine patching to AWS, leaving you responsible for schema, queries, access control and the data itself.
Under the shared responsibility model, who is responsible for encrypting data stored in an Amazon S3 bucket?
The customer. AWS is responsible for security of the cloud - the physical facilities, the hardware, the underlying software of managed services. You are responsible for security in the cloud, which includes deciding whether encryption is on, managing keys, and setting bucket policies and access controls. AWS provides the encryption features; it does not decide that you want them.
An application must keep running if a single data centre becomes unavailable. What should the architecture use?
Multiple Availability Zones within a Region. An Availability Zone is one or more discrete data centres with independent power and networking; deploying across two or more of them survives the loss of one. Multiple Regions protect against a wider failure but add latency, cost and often data-residency questions, so they are the answer only when the question says Region-level or geographic resilience.
Which benefit of cloud computing is described by launching resources in minutes instead of procuring servers over weeks?
Agility - sometimes phrased as increased speed and agility. Watch for the neighbouring answer options: elasticity is about scaling capacity up and down with demand, and economies of scale is about lower per-unit prices from aggregate purchasing. All three are real cloud benefits, so the question is testing whether you can tell them apart.
Practice: core services
The service catalogue is enormous and the exam only expects you to know the main ones by purpose. The failure mode is not being unable to name a service - it is naming a service that is adjacent but wrong.
Which service would you use to run code in response to an event without provisioning any servers?
AWS Lambda. The signal words are without provisioning servers and in response to an event. If a question instead emphasises long-running containers you are being pointed at ECS, EKS or Fargate; if it emphasises full control of the operating system, it wants EC2.
A team needs to store large volumes of unstructured files - images, logs, backups - accessible over the internet. Which service?
Amazon S3. Object storage for unstructured data. Contrast with EBS, which is block storage attached to a single EC2 instance, and EFS, which is a shared file system for multiple instances. The word unstructured, plus the absence of any mention of an instance, points at S3.
Which service delivers content to users worldwide with lower latency by caching it at edge locations?
Amazon CloudFront, the content delivery network. If a question is about routing users to the nearest healthy endpoint by DNS, that is Route 53 instead - both improve global performance, but CloudFront caches content and Route 53 resolves names.
Which service provides a logically isolated section of the AWS Cloud where you control your own IP range, subnets and route tables?
Amazon VPC. The phrase logically isolated network is the giveaway. Distinguish it from security groups and network ACLs, which are controls inside a VPC rather than the network boundary itself.
Practice: billing, pricing and support
This is the domain candidates skip, because a personal free-tier account never shows you a support plan or a Savings Plan commitment. It is only around six scored questions, but they are free marks once you have read the pricing page once.
A workload runs continuously and predictably for the next three years. Which purchasing option gives the lowest cost?
A three-year commitment through Savings Plans or Reserved Instances. The keyword pair is steady state and a term. On-Demand suits unpredictable or short-lived workloads; Spot Instances are cheapest of all but can be interrupted, so they are only correct when the question says the workload is fault-tolerant or interruptible.
Which tool lets you estimate the cost of an architecture before you deploy it?
The AWS Pricing Calculator. Keep three cost tools separate in your head: the Pricing Calculator estimates future spend, Cost Explorer analyses past and current spend with visualisations, and AWS Budgets alerts you when spend or usage crosses a threshold you set.
Which AWS service inspects your account and recommends improvements across cost optimisation, performance, security, fault tolerance and service limits?
AWS Trusted Advisor. Do not confuse it with the AWS Well-Architected Framework, which is a set of design pillars and a review process rather than an automated service, or with Amazon Inspector, which is a targeted security vulnerability scanner.
A company requires a designated technical account manager and the fastest response times for business-critical outages. Which support plan?
Enterprise Support. Enterprise On-Ramp sits just below it and provides access to a pool of technical account managers rather than a designated one, while Business and Developer plans provide neither. Support-plan questions are pure recall, so read the comparison table once rather than reasoning about it in the exam.
The trap: knowing the service but not the boundary
The single most useful thing you can internalise for this exam is that the shared responsibility line is not fixed. It moves according to how managed the service is, and a large number of questions are testing exactly that movement without ever using the phrase shared responsibility.
Run any responsibility question through this ladder. On EC2 you are responsible for the guest operating system, its patches, the application and the data. On RDS, AWS takes the operating system and database engine, and you keep the schema, queries, access control and data. On Lambda there is no operating system in your scope at all - you own the function code, its permissions and its data. On S3 you own the objects, the bucket policy and the encryption decision.
Once that ladder is automatic, a whole class of questions collapses into one step. That is a better use of your last study day than memorising another fifty service names.
A realistic study plan
Cloud Practitioner is a week of focused evenings for someone with any technical background, and two to three weeks from a standing start. What follows is an order, not a schedule - do each stage until it stops producing surprises.
- ✓Read the official exam guide first. It lists the in-scope services explicitly, which saves you studying things that will never be asked.
- ✓Learn the six Well-Architected pillars and the shared responsibility ladder before touching the service catalogue - they organise everything else.
- ✓Group services by purpose (compute, storage, database, networking, security, monitoring) rather than learning them alphabetically. The exam asks by purpose.
- ✓Spend one deliberate session on billing: the pricing models, the four support plans, and the difference between the Pricing Calculator, Cost Explorer and Budgets.
- ✓Do timed practice sets. At 65 questions in 90 minutes you have well over a minute each, so time pressure is mild - the value of timing is building the habit of flagging and moving on.
- ✓Open a free-tier account and launch one EC2 instance, one S3 bucket and one RDS database. An hour of clicking fixes more confusion than a chapter of reading.