Content domains
The 4 domains of CLF-C02, with every task statement and its objectives from the official guide. Study a whole domain, or drill a single task.
1Cloud Concepts
24% of examStudy domain
1.1Define the benefits of the AWS Cloud23 q>
Knowledge of
- What the AWS Cloud offers customers and why organizations choose it over self-managed infrastructure
Skills in
- Explaining what a worldwide footprint buys you (fast deployments, serving users close to where they are)
- Describing why high availability, elasticity, and agility matter to a business
1.2Identify design principles of the AWS Cloud23 q>
Knowledge of
- The AWS Well-Architected Framework and what it is used for
Skills in
- Naming the six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability) and what each one is concerned with
- Telling the pillars apart when a scenario points at one of them
1.3Understand the benefits of and strategies for migration to the AWS Cloud3 q>
Knowledge of
- Strategies organizations use to adopt the cloud
- The AWS resources and programs that support a migration journey
Skills in
- Describing the AWS Cloud Adoption Framework (AWS CAF) and the outcomes it targets (lower business risk, better ESG performance, more revenue, better operational efficiency)
- Picking a migration approach that fits the situation (for example, replicating a database, shipping bulk data with AWS Snowball)
1.4Understand concepts of cloud economics23 q>
Knowledge of
- How cloud spending works compared with buying and running your own hardware
- Where the savings come from when a workload moves to the cloud
Skills in
- Separating fixed costs from variable costs
- Accounting for the full cost of an on-premises environment, including the parts that are easy to forget (power, cooling, floor space, staff)
- Comparing licensing approaches (bring your own license versus a license included in the hourly rate)
- Explaining rightsizing: matching resource size to actual demand
- Explaining what automation saves in both money and manual effort
- Explaining economies of scale and why aggregated demand lowers unit price
2Security and Compliance
30% of examStudy domain
2.1Understand the AWS shared responsibility model23 q>
Knowledge of
- The AWS shared responsibility model and how the split is drawn
Skills in
- Naming the pieces of the model (security of the cloud versus security in the cloud)
- Listing what the customer is on the hook for
- Listing what AWS is on the hook for
- Identifying the areas both parties share
- Explaining how the line moves depending on the service in use (Amazon EC2 leaves more to the customer than Amazon RDS or AWS Lambda do)
2.2Understand AWS Cloud security, governance, and compliance concepts23 q>
Knowledge of
- AWS compliance and governance concepts
- What cloud security gives you, encryption included
- Where security-relevant logs are produced and where to find them
Skills in
- Knowing where AWS publishes its compliance reports and agreements (AWS Artifact)
- Recognizing that compliance obligations differ by region and by industry
- Describing the services customers use to protect their own resources (Amazon Inspector, AWS Security Hub, Amazon GuardDuty, AWS Shield)
- Distinguishing encryption in transit from encryption at rest
- Matching governance needs to services: Amazon CloudWatch for monitoring; AWS CloudTrail, AWS Audit Manager, and AWS Config for auditing; access reports for reporting
- Recognizing that compliance coverage is not uniform across every AWS service
2.3Identify AWS access management capabilities23 q>
Knowledge of
- Identity and access management with AWS Identity and Access Management (IAM)
- Why the account root user needs special protection
- The principle of least privilege
- AWS IAM Identity Center for centralized workforce access
Skills in
- Handling access keys, password policies, and credential storage (AWS Secrets Manager, AWS Systems Manager)
- Recognizing the ways to authenticate (multi-factor authentication, IAM Identity Center, cross-account IAM roles)
- Building users, groups, and policies (custom and AWS managed) that grant only what is needed
- Naming the handful of tasks reserved for the account root user
- Choosing the right protections for the root user
- Describing identity management types, federation included
2.4Identify components and resources for security23 q>
Knowledge of
- The security capabilities AWS makes available
- The security documentation AWS publishes
Skills in
- Describing what the security services do (AWS WAF, AWS Firewall Manager, AWS Shield, Amazon GuardDuty)
- Knowing that third-party security products can be sourced through AWS Marketplace
- Knowing where security guidance lives (AWS Knowledge Center, AWS Security Center, AWS Security Blog)
- Using AWS services such as AWS Trusted Advisor to surface security problems
3Cloud Technology and Services
34% of examStudy domain
3.1Define methods of deploying and operating in the AWS Cloud13 q>
Knowledge of
- The different ways to provision and run resources on AWS
- The different ways to reach AWS services
- Cloud deployment models
Skills in
- Choosing among programmatic access (APIs, SDKs, the AWS CLI), the AWS Management Console, and infrastructure as code
- Judging whether a job is a one-time operation or something that should be made repeatable
- Telling cloud, hybrid, and on-premises deployment models apart
3.2Define the AWS global infrastructure13 q>
Knowledge of
- AWS Regions, Availability Zones, and edge locations
- High availability
- Reasons to run in more than one Region
- What edge locations are good for
Skills in
- Explaining how Regions, Availability Zones, and edge locations nest together
- Explaining how spreading across Availability Zones produces high availability
- Knowing that Availability Zones are isolated so they do not fail together
- Naming the reasons to go multi-Region (disaster recovery, business continuity, latency for distant users, data sovereignty)
3.3Identify AWS compute services3 q>
Knowledge of
- The AWS compute services and what separates them
Skills in
- Matching an Amazon EC2 instance type to a workload (compute optimized, storage optimized, and the rest)
- Choosing between container options (Amazon ECS, Amazon EKS)
- Choosing between serverless compute options (AWS Fargate, AWS Lambda)
- Recognizing auto scaling as the mechanism that delivers elasticity
- Explaining what a load balancer is for
3.4Identify AWS database services3 q>
Knowledge of
- The AWS database services
- Moving databases to AWS
Skills in
- Deciding between running a database yourself on EC2 and letting AWS manage it
- Spotting the relational options (Amazon RDS, Amazon Aurora)
- Spotting the NoSQL option (Amazon DynamoDB)
- Spotting the in-memory option (Amazon ElastiCache)
- Naming the migration tooling (AWS Database Migration Service, AWS Schema Conversion Tool)
3.5Identify AWS network services13 q>
Knowledge of
- The AWS networking services
Skills in
- Naming the parts of a VPC (subnets, gateways, and so on)
- Describing VPC security controls (network ACLs, security groups, Amazon Inspector)
- Explaining what Amazon Route 53 does
- Naming the ways to connect an outside network to AWS (AWS VPN, AWS Direct Connect)
3.6Identify AWS storage services13 q>
Knowledge of
- The AWS storage services and the storage types they represent
Skills in
- Describing what object storage is for
- Telling the Amazon S3 storage classes apart
- Spotting block storage (Amazon EBS, instance store)
- Spotting file storage (Amazon EFS, Amazon FSx)
- Recognizing cached file systems (AWS Storage Gateway)
- Explaining when a lifecycle policy is the right tool
- Explaining when AWS Backup is the right tool
3.7Identify AWS artificial intelligence and machine learning (AI/ML) services and analytics services3 q>
Knowledge of
- The AWS AI/ML services
- The AWS analytics services
Skills in
- Matching an AI/ML service to the job it does (Amazon SageMaker AI, Amazon Lex, Amazon Kendra)
- Matching an analytics service to the job it does (Amazon Athena, Amazon Kinesis, AWS Glue, Amazon QuickSight)
3.8Identify services from other in-scope AWS service categories4 q>
Knowledge of
- Application integration: Amazon EventBridge, Amazon SNS, Amazon SQS
- Business applications: Amazon Connect, Amazon SES
- Customer enablement, including AWS Support
- Developer tools: AWS CodeBuild, AWS CodePipeline, AWS X-Ray
- End-user computing: Amazon AppStream 2.0, Amazon WorkSpaces, Amazon WorkSpaces Secure Browser
- Frontend web and mobile: AWS Amplify, AWS AppSync
- IoT, including AWS IoT Core
Skills in
- Picking the right service for delivering messages, alerts, and notifications
- Picking the right service for a business application need
- Picking the right business support option
- Naming the tools for developing, deploying, and troubleshooting applications
- Naming the services that stream a virtual machine's output to an end user's device
- Naming the services for building and shipping frontend and mobile apps
- Naming the services that manage IoT devices
4Billing, Pricing, and Support
12% of examStudy domain
4.1Compare AWS pricing models4 q>
Knowledge of
- Compute purchasing options (On-Demand Instances, Reserved Instances, Spot Instances, Savings Plans, Dedicated Hosts, Dedicated Instances, Capacity Reservations)
- Storage options and their tiers
Skills in
- Knowing which compute purchasing option suits which usage pattern
- Describing how Reserved Instances can flex (instance size, Availability Zone, and so on)
- Describing how Reserved Instances behave across accounts in AWS Organizations
- Knowing which data transfer directions cost money and which do not (into AWS, out to the internet, Region to Region, inside one Region)
- Comparing prices across storage options and tiers
4.2Understand resources for billing, budget, and cost management4 q>
Knowledge of
- Where to get billing help and billing information
- Where to find pricing for AWS services
- AWS Organizations
- AWS cost allocation tags
Skills in
- Knowing what AWS Budgets and AWS Cost Explorer are each good for
- Knowing what AWS Pricing Calculator is good for
- Explaining consolidated billing in AWS Organizations and how costs are allocated across member accounts
- Distinguishing AWS generated from user defined cost allocation tags and seeing how they show up in billing reports such as AWS Cost and Usage Report
4.3Identify AWS technical resources and AWS Support options3 q>
Knowledge of
- The resources and documentation published on official AWS websites
- The AWS Support plans
- What the AWS Partner Network does, including independent software vendors and systems integrators
- AWS Support Center
Skills in
- Finding AWS whitepapers, blogs, and documentation on official AWS sites
- Finding technical resources (AWS Prescriptive Guidance, AWS Knowledge Center, AWS re:Post)
- Telling the support plans apart (customer service and communities, Developer, Business, Enterprise On-Ramp, Enterprise)
- Explaining how AWS Trusted Advisor, the AWS Health Dashboard, and the AWS Health API help manage and monitor an environment, cost optimization included
- Knowing that the AWS Trust and Safety team is where abuse of AWS resources gets reported
- Explaining what AWS Partners bring (AWS Marketplace, independent software vendors, systems integrators)
- Naming the benefits of being an AWS Partner (training and certification, partner events, volume discounts)
- Naming what AWS Marketplace offers beyond the catalog (cost management, governance and entitlement)
- Naming the paid technical assistance options (AWS Professional Services, AWS Solutions Architects)