Exam facts at a glance
- 65 questions, multiple choice + multiple response.
- 90 minutes. Average ~83 seconds per question.
- $100 USD per attempt.
- Passing score: 700/1000 (scaled, not raw percentage).
- Valid 3 years.
- Retake wait: flat 14 days, every attempt.
- Pearson VUE test center or OnVUE online. Closed book.
- Full exam-format details: Cloud Practitioner Exam Guide 2026.
Domain weights at a glance
Know these percentages cold — they tell you exactly where to spend limited review time.
| Domain | Weight | What it tests |
|---|---|---|
| 1. Cloud Concepts | 24% | Cloud value proposition, Well-Architected pillars, migration strategies |
| 2. Security and Compliance | 30% | Shared responsibility model, IAM, compliance tooling |
| 3. Cloud Technology and Services | 34% | Compute, storage, database, networking service selection |
| 4. Billing, Pricing, and Support | 12% | Pricing models, support tiers, cost-management tools |
Domains 2 and 3 combined are 64% of the exam — if review time is short, prioritize the shared responsibility matrix and the compute/storage/database/networking tables below over the smaller domains.
Shared responsibility matrix
The single most-tested concept on Domain 2. AWS is responsible of the cloud; you are responsible in the cloud.
| AWS handles (of the cloud) | You handle (in the cloud) |
|---|---|
| Physical data centers | Data encryption and integrity |
| Hardware and global network | Guest OS patching (on EC2) |
| Hypervisor / virtualization layer | Security group and firewall configuration |
| Managed-service infrastructure (RDS, Lambda internals) | IAM users, roles, and permissions |
| Availability of the managed service SLA | Client-side data encryption before upload |
Exam tell: "who patches the OS on a managed service like RDS?" → AWS. "Who patches the OS on a self-managed EC2 instance?" → you. Full breakdown: AWS Shared Responsibility Model Explained.
Compute services — which when
| Service | Best for |
|---|---|
| EC2 | Full OS control, long-running, custom software stacks |
| Lambda | Event-driven, short-running, zero server management |
| ECS / EKS | Container orchestration |
| Fargate | Serverless containers — no EC2 to manage |
| Elastic Beanstalk | Deploy web apps without managing infrastructure details |
| Lightsail | Simple VPS-style hosting, predictable low pricing |
Storage classes at a glance
| Class | Access pattern | Best for |
|---|---|---|
| S3 Standard | Frequent | Active data, websites |
| S3 Standard-IA | Infrequent | Backups, DR |
| S3 Glacier Flexible | ~Quarterly | Archives, retrieval in minutes-hours |
| S3 Glacier Deep Archive | ~Annual | Compliance archives, retrieval up to 12 hrs |
| EBS | N/A (block storage) | EC2 instance persistent disks |
| EFS | N/A (file storage) | Shared file access across multiple EC2 instances |
Database services
- RDS: managed relational — MySQL, PostgreSQL, MariaDB, Oracle, SQL Server. AWS handles patching and backups.
- Aurora: AWS-built MySQL/PostgreSQL-compatible engine, higher performance and availability than standard RDS engines.
- DynamoDB: managed NoSQL, key-value and document data, single-digit millisecond latency at scale.
- Redshift: data warehousing, analytics on large datasets.
- ElastiCache: managed in-memory caching (Redis / Memcached) to speed up application reads.
Networking essentials
- VPC: your isolated virtual network within AWS.
- Route 53: DNS service, also handles domain registration and health checks.
- CloudFront: content delivery network (CDN), caches content at edge locations globally.
- Direct Connect: dedicated private network connection from on-premises to AWS.
- Site-to-Site VPN: encrypted connection over the public internet — cheaper and faster to set up than Direct Connect, but less consistent bandwidth.
- Elastic Load Balancing (ELB): distributes incoming traffic across multiple targets automatically.
IAM basics
- Users: individual identities for people or applications.
- Groups: collections of users sharing the same permissions.
- Roles: temporary permissions assumed by users, applications, or AWS services — no long-term credentials.
- Policies: JSON documents defining permissions, attached to users, groups, or roles.
- MFA: multi-factor authentication — always enable on the root user, strongly recommended for all IAM users.
- Root user: created with the account. Lock it down with MFA and stop using it for daily tasks — create IAM users instead.
Security service names
| Service | What it does |
|---|---|
| GuardDuty | Continuous threat detection |
| Inspector | Vulnerability scanning on EC2/containers |
| Macie | Sensitive-data discovery in S3 |
| Shield | DDoS protection |
| WAF | Web application firewall, filters malicious HTTP traffic |
| KMS | Encryption key management |
| Artifact | On-demand compliance report downloads |
EC2 pricing models compared
Domain 4 tests this table directly — memorize the commitment/discount/risk trade-off for each model, not just the name.
| Model | Commitment | Discount | Best for |
|---|---|---|---|
| On-Demand | None | None (baseline rate) | Unpredictable, short-term, or first-time workloads |
| Reserved Instances | 1 or 3 years | Up to ~72% off On-Demand | Steady-state, predictable, always-on workloads |
| Savings Plans | 1 or 3 years ($/hour spend) | Comparable to RIs | Steady spend, more flexible across instance families than RIs |
| Spot Instances | None (reclaimable with short notice) | Up to 90% off On-Demand | Fault-tolerant, interruption-tolerant batch or flexible workloads |
Exam tell: "steady-state" or "predictable, always-on" points to Reserved Instances or Savings Plans. "Fault-tolerant" or "can be interrupted" points to Spot. "Unpredictable" or "just starting out" points to On-Demand.
Billing and cost-management tools
Domain 4 candidates commonly confuse these four tools — they sound similar but do different jobs.
| Tool | What it does |
|---|---|
| AWS Cost Explorer | Visualizes and forecasts historical and projected spending — analysis, not alerting |
| AWS Budgets | Sets custom cost/usage thresholds and sends alerts when spending crosses them |
| AWS Organizations (consolidated billing) | Combines usage across multiple accounts under one payer account for volume discounts and a single bill |
| AWS Free Tier | Limited no-cost usage of many services for new accounts, useful for light hands-on practice |
Exam tell: "wants an alert when spending exceeds a threshold" → Budgets. "Wants to analyze and forecast spending trends" → Cost Explorer. "Wants one bill across dozens of accounts" → Organizations consolidated billing.
AWS support plan tiers
| Plan | Key feature |
|---|---|
| Basic | Free. Self-service documentation and forums only. |
| Developer | Business-hours email access to Cloud Support Associates. |
| Business | 24/7 phone/chat/email support, production workload target response times. |
| Enterprise | Dedicated Technical Account Manager (TAM), fastest response times. |
Well-Architected Framework pillars
| Pillar | One-line meaning | Exam angle |
|---|---|---|
| Operational Excellence | Run and monitor systems, continuously improve processes | Automation, runbooks, learning from failures |
| Security | Protect data, systems, and assets | Overlaps with shared responsibility — do not confuse the two concepts |
| Reliability | Recover from failures, meet demand dynamically | Auto Scaling, multi-AZ deployment scenarios |
| Performance Efficiency | Use resources efficiently as demand and technology change | Commonly confused with Reliability — this is about efficient use, not recovery |
| Cost Optimization | Avoid unnecessary costs | Right-sizing, pricing model selection |
| Sustainability | Minimize environmental impact of running workloads | The newest pillar — candidates sometimes forget it exists as a 6th option |
Global infrastructure vocabulary
- Region: a geographic area with multiple, isolated data centers.
- Availability Zone (AZ): one or more discrete data centers within a Region, isolated from failures in other AZs.
- Edge Location: CloudFront caching point, closer to end users than a full Region.
- Local Zone: extension of a Region placed closer to large population centers for low-latency needs.
Top 5 trap-question patterns
- "Who patches X?" — managed service (RDS, Lambda) means AWS patches the underlying OS; self-managed EC2 means you do.
- Reserved Instances for variable workloads — wrong. RIs are for steady, predictable usage; Spot or On-Demand fit variable workloads.
- Root user for daily tasks — always wrong. Create IAM users/roles instead.
- Confusing Cost Explorer with Budgets — Cost Explorer visualizes/forecasts; Budgets sends threshold alerts.
- Confusing Availability Zones with Regions — Regions are separate geographic areas; AZs are isolated data centers within one Region.
Detailed explanations in How to Pass AWS Cloud Practitioner on the First Try.
Exam-day pocket guide
- 65 questions, 90 minutes, ~83 seconds per question average. Flag long ones, return at the end.
- "Select TWO/THREE" questions: read the stem twice, no partial credit.
- Managed service (RDS, Lambda, Fargate) beats self-managed (EC2) when the scenario says "avoid managing infrastructure."
- Root user answers are almost always wrong.
- Spot Instances beat On-Demand/Reserved when the scenario says "fault-tolerant" or "flexible" or "lowest cost, can be interrupted."
- Passing score is scaled (700/1000), not a raw percentage — do not try to count your correct answers during the exam.
- If frozen on a question past 2 minutes: flag, move on, return at the end.
Frequently asked questions
Can I use this cheat sheet during the AWS Cloud Practitioner exam?
No. CLF-C02 is entirely closed book under proctored conditions, whether you test at a Pearson VUE center or online via OnVUE — there is no delivery method that permits notes, a second monitor, or any reference material during the 90-minute session. Use this cheat sheet for review before the exam instead, especially in the final 48-72 hours, when you want a fast pass over every domain rather than re-reading full study material. A good routine is to read it once at the start of your prep to preview scope, reference specific sections as you study each domain in depth, and then read the whole thing again the night before or morning of your exam. Treat it as a compression of what you should already know from practice questions and study material, not as a first introduction to any of these concepts — if a section here is unfamiliar, that is a signal to go back and study it properly rather than memorize the summary.
Is there a printable PDF of the AWS Cloud Practitioner cheat sheet?
A printable PDF version is coming soon. For now, use your browser's print function (Ctrl/Cmd+P) and select "save as PDF" for a clean printable copy of this page, which preserves the tables and formatting reasonably well in most browsers. Printing it out can help during the final review period if you prefer studying away from a screen, or if you want to annotate sections by hand with your own notes and mnemonics as you work through practice questions. Some candidates find it useful to print just the shared responsibility matrix and trap-patterns sections separately and keep them visible during study sessions, since those two areas account for a disproportionate share of missed points among first-time candidates. Whichever format you use, remember this page updates periodically as the exam evolves, so a saved PDF can go stale — check back here before your exam date rather than relying solely on an old printout.
What is the single most important section to memorize?
The shared responsibility matrix and the compute/storage decision tables carry outsized weight relative to their length. Together, misjudging shared responsibility and mixing up service categories account for the largest share of missed points among first-time candidates, more than any single service-naming gap. The shared responsibility model alone touches roughly 30% of the exam (Domain 2, Security and Compliance) and shows up reframed in several different question styles rather than tested once and moved past. The compute and storage decision tables matter because Domain 3 (34% of the exam, the largest single domain) is built almost entirely around "which service fits this scenario" questions, and those questions reward recognizing the deciding constraint — cost, access pattern, or operational overhead — rather than simply recalling a service exists. If your review time is limited, prioritize these two areas over the smaller reference tables further down this page.
Does this cheat sheet cover everything on the exam?
It covers the high-yield reference material — service categorization, pricing models, support tiers, and the concepts most often tested from multiple angles — but it is a compression for review, not a substitute for working through the full CertSharp question bank or AWS Skill Builder courses. A cheat sheet by design favors breadth and quick recall over the deeper "why" behind each concept, and CLF-C02 does test some of that reasoning, particularly in scenario-style and multiple-response questions where two options both sound plausible. Use this page to confirm you remember the vocabulary and the trap patterns, then use timed practice questions to confirm you can actually apply that vocabulary under exam conditions and time pressure. If you find yourself getting practice questions wrong even after reviewing the relevant section here, that is usually a sign you need to revisit the underlying concept in a full study resource rather than re-reading this summary again.
Pair the cheat sheet with practice
The cheat sheet is for review. The CertSharp question bank is for testing whether you have actually internalized it. 30 free questions, no signup. $11.99 lifetime for the full 500.