AWS Cloud Practitioner Cheat Sheet 2026 — All 4 Domains

Exam facts at a glance

• 65 questions, multiple choice + multiple response.
• 90 minutes. Average ~83 seconds per question.
• $100 USD per attempt.
• Passing score: 700/1000 (scaled, not raw percentage).
• Valid 3 years.
• Retake wait: flat 14 days, every attempt.
• Pearson VUE test center or OnVUE online. Closed book.
• Full exam-format details: Cloud Practitioner Exam Guide 2026.

Shared responsibility matrix

The single most-tested concept on Domain 2. AWS is responsible of the cloud; you are responsible in the cloud.

Exam tell: "who patches the OS on a managed service like RDS?" → AWS. "Who patches the OS on a self-managed EC2 instance?" → you. Full breakdown: AWS Shared Responsibility Model Explained.

Compute services — which when

Storage classes at a glance

Database services

• RDS: managed relational — MySQL, PostgreSQL, MariaDB, Oracle, SQL Server. AWS handles patching and backups.
• Aurora: AWS-built MySQL/PostgreSQL-compatible engine, higher performance and availability than standard RDS engines.
• DynamoDB: managed NoSQL, key-value and document data, single-digit millisecond latency at scale.
• Redshift: data warehousing, analytics on large datasets.
• ElastiCache: managed in-memory caching (Redis / Memcached) to speed up application reads.

Networking essentials

• VPC: your isolated virtual network within AWS.
• Route 53: DNS service, also handles domain registration and health checks.
• CloudFront: content delivery network (CDN), caches content at edge locations globally.
• Direct Connect: dedicated private network connection from on-premises to AWS.
• Site-to-Site VPN: encrypted connection over the public internet — cheaper and faster to set up than Direct Connect, but less consistent bandwidth.
• Elastic Load Balancing (ELB): distributes incoming traffic across multiple targets automatically.

IAM basics

• Users: individual identities for people or applications.
• Groups: collections of users sharing the same permissions.
• Roles: temporary permissions assumed by users, applications, or AWS services — no long-term credentials.
• Policies: JSON documents defining permissions, attached to users, groups, or roles.
• MFA: multi-factor authentication — always enable on the root user, strongly recommended for all IAM users.
• Root user: created with the account. Lock it down with MFA and stop using it for daily tasks — create IAM users instead.

Security service names

EC2 pricing models

• On-Demand: pay by the second/hour, no commitment. Highest per-unit cost, maximum flexibility.
• Reserved Instances: 1- or 3-year commitment for steady-state workloads, up to ~72% discount.
• Savings Plans: commit to a $/hour spend for 1-3 years, more flexible than RIs across instance families.
• Spot Instances: bid on spare capacity, up to 90% discount, can be interrupted with short notice — for fault-tolerant, flexible workloads.

AWS support plan tiers

Well-Architected Framework pillars

1. Operational Excellence — run and monitor systems, continuously improve processes.
2. Security — protect data, systems, and assets.
3. Reliability — recover from failures, meet demand dynamically.
4. Performance Efficiency — use resources efficiently as demand and technology change.
5. Cost Optimization — avoid unnecessary costs.
6. Sustainability — minimize environmental impact of running workloads.

Global infrastructure vocabulary

• Region: a geographic area with multiple, isolated data centers.
• Availability Zone (AZ): one or more discrete data centers within a Region, isolated from failures in other AZs.
• Edge Location: CloudFront caching point, closer to end users than a full Region.
• Local Zone: extension of a Region placed closer to large population centers for low-latency needs.

Top 5 trap-question patterns

1. "Who patches X?" — managed service (RDS, Lambda) means AWS patches the underlying OS; self-managed EC2 means you do.
2. Reserved Instances for variable workloads — wrong. RIs are for steady, predictable usage; Spot or On-Demand fit variable workloads.
3. Root user for daily tasks — always wrong. Create IAM users/roles instead.
4. Confusing Cost Explorer with Budgets — Cost Explorer visualizes/forecasts; Budgets sends threshold alerts.
5. Confusing Availability Zones with Regions — Regions are separate geographic areas; AZs are isolated data centers within one Region.

Detailed explanations in How to Pass AWS Cloud Practitioner on the First Try.

Exam-day pocket guide

• 65 questions, 90 minutes, ~83 seconds per question average. Flag long ones, return at the end.
• "Select TWO/THREE" questions: read the stem twice, no partial credit.
• Managed service (RDS, Lambda, Fargate) beats self-managed (EC2) when the scenario says "avoid managing infrastructure."
• Root user answers are almost always wrong.
• Spot Instances beat On-Demand/Reserved when the scenario says "fault-tolerant" or "flexible" or "lowest cost, can be interrupted."
• Passing score is scaled (700/1000), not a raw percentage — do not try to count your correct answers during the exam.
• If frozen on a question past 2 minutes: flag, move on, return at the end.

Frequently asked questions