1. Treating Domain 2 as an afterthought
Security and Compliance is 30% of the exam — nearly a third — and it is the domain candidates most consistently under-study, because service-naming questions in Domain 3 feel more concrete and "studyable." The shared responsibility model in particular gets tested from several angles: who patches what, who configures what, and who is accountable for what in managed vs self-managed services. See AWS Shared Responsibility Model Explained for the concept in full.
Why this happens technically: the shared responsibility line is not fixed — it moves based on how much of the stack AWS manages for a given service. On EC2, you own the guest OS and everything above it. On RDS, AWS absorbs OS patching and the database engine, narrowing your responsibility to configuration and data. On Lambda, there is no server to patch at all. Candidates who study "shared responsibility" as one static fact rather than a sliding scale per service get the EC2 case right and then miss the RDS or Lambda variant of the same question. Fix: drill the model service-by-service (EC2, RDS, Lambda, S3) rather than reading the definition once and moving on.
2. Memorizing service names without use cases
Knowing that DynamoDB is "a database" is not enough — the exam tests when to choose it over RDS, or when Lambda beats EC2 for a given scenario. Candidates who flashcard service names in isolation get tripped up by "which service should this company use" questions, because two or three services technically "could" work, but only one fits the stated constraint (cost, ops overhead, access pattern).
Why this happens technically: Domain 3 questions are built around a specific deciding constraint buried in the scenario text — "avoid managing servers entirely" points to Lambda over EC2 even though both are technically compute options; "accessed once per quarter with retrieval in hours" points to S3 Glacier Flexible Retrieval over Glacier Deep Archive even though both are archival tiers. Candidates who memorize "DynamoDB = NoSQL database" without also learning its access-pattern advantage over RDS miss the constraint-matching skill the question is actually testing. Fix: study services in decision-tree pairs (EC2 vs Lambda, RDS vs DynamoDB, Glacier Flexible vs Deep Archive) rather than isolated definitions, and practice identifying the one constraint word in each scenario that eliminates the wrong options.
3. Never practicing under real time pressure
90 minutes for 65 questions is about 83 seconds each. Candidates who only study with untimed quizzes get a shock on exam day when the scenario-style questions (three or four sentences of setup) eat 2-3 minutes each, leaving no slack for the rest. Do at least two full 65-question mocks under a strict 90-minute clock before you book your real exam date.
Why this happens technically: untimed study rewards careful, deliberate reading of every word, which is the opposite skill the real exam demands. Under time pressure, a candidate needs to identify the deciding constraint in a scenario quickly rather than parsing the full stem word-for-word. Fix: practice a specific reading pattern — read the last sentence of the stem first (it usually contains the actual question and the constraint), then read the setup, then the options. This front-loads the constraint you are solving for before you spend time on setup detail that may not matter to the answer.
4. Skipping multiple-response question drills
"Select TWO" questions have no partial credit — miss one of the two correct answers and you lose the entire point, same as getting it completely wrong. Yet candidates often study these the same way as single-answer questions, reading quickly and picking the first option that sounds right. Slow down specifically on multi-select stems; misreading "select TWO" as "select the best ONE" is a documented, recurring failure pattern.
Why this happens technically: multiple-response questions on CLF-C02 frequently pair one obviously-correct option with one subtly-correct option that requires distinguishing best practice from something that merely sounds plausible — for example, "enable MFA on the root user" (correct) versus "share root credentials with the ops team for convenience" (a direct violation dressed up as a practical answer). Fix: for every multi-select practice question, explicitly justify why each of the five-plus options is in or out before checking the answer, rather than stopping once you feel confident about two of them.
5. Studying only from one source
A single course or single question bank tends to phrase concepts the same way every time, which builds pattern-matching on that source's wording rather than genuine understanding. The real exam phrases questions differently than any one study source. Combine AWS's own Skill Builder material with a large, independently-written question bank — CertSharp's 500-question Cloud Practitioner bank is deliberately calibrated above real exam difficulty so you are not just recognizing familiar phrasing.
6. Booking the exam before hitting 85% on mocks
Because CLF-C02's passing score (700/1000) is scaled rather than a raw percentage, a candidate scoring exactly at the edge on practice mocks has less margin than the number suggests. Do not book your exam date the moment you first cross 70% on a mock — wait until you are consistently landing 85%+ across at least two separate full-length attempts before committing to a date.
Why this happens technically: AWS mixes unscored questions into the 65 without disclosing which ones, and the raw-to-scaled conversion is not published or linear. A candidate scoring 71% on a mock has no way to know whether that maps comfortably above or dangerously close to 700/1000 on the real scaled scale. Fix: treat 85% as your real target, not 70% — the 15-point buffer exists specifically to absorb the uncertainty in the scaling model and the unscored-question noise.
7. Overthinking definitional questions
A meaningful share of CLF-C02 questions are straightforward recall: "which pillar of the Well-Architected Framework focuses on X," "which support plan includes a TAM." Candidates sometimes second-guess these simple questions looking for a trick that is not there, burning time that should go toward the genuinely scenario-based questions. If a question reads as a direct definitional match, trust your first read.
8. Defaulting to “you patch everything” out of EC2 habit
This is specific enough to call out on its own, separate from the general Domain 2 gap in mistake 1: candidates who learn EC2 first (it is usually the first service anyone touches) internalize "guest OS patching is my job" as a universal rule, then apply it incorrectly to managed and serverless services.
Why this happens technically: the pattern flips completely depending on the service. On EC2, you patch the guest OS. On RDS, AWS patches the OS and the database engine on a schedule you configure but do not perform. On Lambda, there is no OS-level patching exposed to you at all — AWS manages the entire runtime and execution environment. A candidate who answers every "who patches X" question with "you" gets the EC2 variant right and every managed-service variant wrong. Fix: when you see a "who is responsible for patching/maintaining X" question, identify the service model first (self-managed infrastructure-as-a-service vs managed platform vs serverless) before answering — the service model, not a memorized universal rule, determines the answer.
9. Treating pricing models as interchangeable
On-Demand, Reserved Instances, Savings Plans, and Spot Instances are frequently tested against each other in the same question, and candidates who have not internalized the specific trade-off of each one guess based on which name sounds most familiar rather than which fits the stated workload pattern.
Why this happens technically: each pricing model optimizes for a different, specific workload shape — Reserved Instances and Savings Plans reward a 1- or 3-year commitment with a steady, predictable workload; Spot Instances reward tolerance for interruption with the deepest discount; On-Demand carries no commitment and no discount, suited to workloads you cannot yet characterize. A scenario describing "highly variable, fault-tolerant batch processing" is deliberately designed to eliminate Reserved Instances (wrong workload shape) even though RIs offer a real discount — the discount is irrelevant if the commitment does not match the usage pattern. Fix: for every pricing-model question, identify the workload's predictability and interruption-tolerance first, then match that profile to the pricing model built for it, rather than picking whichever model has the highest advertised discount.
Exam-day execution
- Do a light review the morning of, not a new-material cram session — you want confidence, not fatigue.
- Read every question stem twice before looking at the options, especially on "select TWO/THREE" items.
- Flag anything taking more than 2 minutes and move on; return to flagged items with remaining time at the end.
- There is no penalty for wrong answers — never leave a question unanswered.
- Trust your practice-question instincts on definitional recall; save deliberation time for genuine scenario questions.
For the fast pre-exam reference version of all of this, use the Cloud Practitioner cheat sheet in your final 48 hours.
Frequently asked questions
What is the single biggest reason candidates fail CLF-C02?
Underestimating Domain 2 (Security and Compliance, 30% of the exam). Candidates often study services by name recognition — recognizing that GuardDuty is "the threat detection one" — but skip the shared responsibility model in genuine depth, then get caught out by scenario questions that test which party is responsible for a specific security task on a specific service. The failure pattern is consistent: candidates default to "you patch everything" out of EC2 habit, even when the question describes a managed service like RDS or a serverless one like Lambda, where AWS absorbs the patching responsibility. Because this concept is tested from several different angles across the same domain rather than once and moved past, a shaky understanding compounds into multiple missed points instead of just one. The fix is not more service flashcards — it is deliberately drilling the "who is responsible for X on service Y" question format until the pattern becomes automatic rather than something you have to reason through under time pressure.
How much practice is enough before booking the exam?
When you score 85%+ consistently across at least two full-length, timed 65-question mocks, you are ready. Scoring well on untimed, topic-isolated quizzes is not the same signal — the exam tests speed and mixed-domain recall together, and a candidate who scores 90% on untimed Domain 3-only questions can still struggle when that same content is mixed randomly with Domain 1, 2, and 4 questions under a ticking 90-minute clock. The reason two full mocks matter more than one is variance: a single mock can overstate or understate your readiness depending on which specific questions you happened to draw, while a consistent 85%+ across two separate attempts filters out that noise. If your two mocks disagree significantly — for example 90% and then 70% — treat that gap as a signal you have inconsistent recall in at least one domain, and drill that domain specifically before committing to an exam date rather than averaging the two scores and assuming you are ready.
Is it bad to guess on questions I am unsure about?
No — there is no penalty for wrong answers on the AWS exam, so never leave a question blank. Eliminate obviously wrong options first, then guess among what remains if you are truly unsure, and flag it for review if time allows so you can revisit it with fresh eyes after finishing the rest of the exam. This matters more on multiple-response ("select TWO") questions than it might seem: because there is no partial credit, a strategic partial guess (locking in the option you are confident about, then choosing your best guess for the second) is still strictly better than leaving both blank or skipping the question entirely. Keep in mind that AWS mixes unscored questions into the 65 without telling you which ones, so a question you find unusually strange or oddly worded may simply be a calibration item rather than something you are missing — do not let one confusing question shake your confidence on the ones that follow it.
Avoid these mistakes with real practice
30 free Cloud Practitioner questions — no signup, no credit card. Full 500-question bank is $11.99 lifetime, or $9.99/month Pro unlocks every CertSharp certification.