Amazon · free study guide

AWS Cloud Practitioner study guide

Certified Cloud Practitioner

Free AWS Cloud Practitioner study guide and exam blueprint. 65 questions in 90 minutes, 700% to pass. Written from Amazon's Exam Guide CLF-C02, last checked 22 July 2026. Domain weightings, glossary, and practice questions with worked explanations.

Written from Amazon's Exam Guide CLF-C02. Last checked against that document on 22 July 2026.

65 questions 90 minutes 700% to pass 4 domains

Orientation

The breadth exam.

The Cloud Practitioner is not a hard exam, but it is a wide one. It does not ask you to design anything or write a line of code. It asks whether you know what several dozen AWS services do and when you would reach for each. Almost everyone who struggles with it struggles for the same reason: they studied a few services deeply instead of many services well enough to tell them apart.

What AWS explicitly says is out of scope

Straight from the exam guide, the target candidate is not expected to do coding, cloud architecture design, troubleshooting, implementation, or load and performance testing. If a question seems to demand deep hands-on design, you are overthinking it. This is a literacy exam, not an engineering one.

What you are walking into

The exam (code CLF-C02) has 65 questions in 90 minutes. Only 50 are scored; the other 15 are unscored questions AWS is trialing for future exams, and they are not marked, so answer everything as if it counts. Questions come in two forms: multiple choice (one right answer of four) and multiple response (two or more right answers of five or more, and you must select all of them to get credit). There is no penalty for guessing, so never leave a question blank.

Scoring is scaled from 100 to 1000, and you need 700 to pass. It is compensatory, meaning you pass on your overall score and do not need to pass each domain individually. A weak domain can be offset by strong ones, though the smart move is still to shore up weaknesses rather than rely on that.

The one thing that makes this exam easy or hard

Roughly a third of the exam, the largest domain, is simply identifying AWS services: given a need, which service meets it. Object storage means S3. A relational database means RDS. Serverless functions mean Lambda. A content delivery network means CloudFront. There is no reasoning to do once you know the mapping, and no way to reason your way to it if you do not. This is why service literacy, not cleverness, is what passes this exam.

The trap is the sheer number of similarly named services. AWS has a service for nearly everything, and many sound alike: Inspector, GuardDuty, Macie, and Detective are all security services that do different things. Cost Explorer, Budgets, and the Pricing Calculator all touch money but at different stages. Learning to tell near-neighbors apart is most of the work.

Why this credential is stable, and why that matters here

Unlike some exams in this catalog, CLF-C02 has been in use since September 2023 with no successor announced, and it deliberately avoids the fast-moving configuration detail that dates quickly. It tests durable concepts, shared responsibility, the pricing models, the Well-Architected pillars, and what each core service is for. That stability is exactly why a foundational cloud cert is worth preparing for: the fundamentals you learn here stay true.

The order that works

Cloud Concepts first (24%). The vocabulary, the Well-Architected Framework, and cloud economics frame everything else.
Then Security and Compliance (30%). The shared responsibility model is the single most tested idea on the exam. Learn it cold.
Then Technology and Services (34%), the big one. This is pure breadth: compute, storage, database, networking, and the service categories. Spread your time here.
Then Billing, Pricing, and Support (12%). Smallest domain, but the pricing models and support plans are easy points if you learn the distinctions.

Your study plan

Exam Guide

What the exam is made of.

Four domains under exam guide CLF-C02. The weighting tells you exactly where to spend time: Technology and Services plus Security together are nearly two-thirds of the exam.

24%Cloud Concepts30%Security & Comp.34%Tech & Services12%Billing & Pricing

Four domains 65 questions · 90 minutes

The two large domains, Technology and Services at 34% and Security and Compliance at 30%, make up 64% of the exam between them. Cloud Concepts at 24% is foundational and worth the time because it underpins the rest. Billing at 12% is small but consists of clean, learnable distinctions, so it is efficient points. Nobody should fail this exam on Billing.

The four domains

Domain	Weight	What it covers
1. Cloud Concepts	24%	The value of the AWS Cloud, the Well-Architected Framework and its six pillars, cloud economics (fixed vs variable cost, rightsizing), and migration including the Cloud Adoption Framework.
2. Security and Compliance	30%	The shared responsibility model, IAM and the root user, encryption, the security services (GuardDuty, Inspector, Macie, Shield, WAF), and where to find compliance information (Artifact).
3. Cloud Technology and Services	34%	Ways to access AWS, the global infrastructure (Regions, Availability Zones, edge), and the core services across compute, storage, database, networking, and more.
4. Billing, Pricing, and Support	12%	The pricing models (On-Demand, Reserved, Spot, Savings Plans), cost management tools (Cost Explorer, Budgets, Pricing Calculator), Organizations and consolidated billing, and the support plans.

The format

Questions	65 total: 50 scored, 15 unscored (not identified).
Time	90 minutes.
Question types	Multiple choice (one of four) and multiple response (two or more of five or more; select all correct).
Scoring	Scaled 100 to 1000. Pass at 700. Compensatory: you pass on the overall score, not per domain.
Guessing	No penalty. Never leave a question blank.
Where	Pearson VUE test center or online proctored.
Cost	$100 USD. A 50% discount applies to your next exam if you already hold an AWS certification.
Validity	Three years. AWS certifications are recertified rather than renewed by CPE.

A note on multiple-response questions

When a question says "select TWO" or "select THREE," you must select exactly that many and get all of them right for any credit. There is no partial marking. These reward knowing a topic completely rather than recognizing one plausible answer, so treat them as a signal to study each area thoroughly rather than superficially.

Domain 1 24%

Cloud concepts.

The foundation. This domain establishes why organizations move to the cloud, the framework AWS uses to define good design, and the economics that make the business case. Get the vocabulary precise here and the rest of the exam reads more easily.

The value of the AWS Cloud

Trade capital expense for variable expense. Instead of buying servers up front (capex), you pay only for what you consume (opex). This is the core economic shift of cloud.
Benefit from massive economies of scale. Because AWS aggregates usage from millions of customers, it achieves lower costs than any single organization could, and passes some of that on.
Stop guessing capacity. Scale up or down on demand rather than over-provisioning for a peak that may never come or under-provisioning and failing under load.
Increase speed and agility. New resources are minutes away, not weeks, so experimentation is cheap.
Stop spending money running and maintaining data centers. Focus on your customers, not on racking servers.
Go global in minutes. Deploy to Regions around the world to serve users with low latency.

The Well-Architected Framework: six pillars

AWS defines good cloud design through six pillars. Expect questions that give a goal and ask which pillar it belongs to.

Pillar	What it optimizes for
Operational excellence	Running and monitoring systems, and continually improving processes.
Security	Protecting data, systems, and assets.
Reliability	Recovering from failure and meeting demand.
Performance efficiency	Using resources efficiently and adapting as demand changes.
Cost optimization	Avoiding unnecessary cost and getting the most value.
Sustainability	Minimizing the environmental impact of running workloads.

The memory hook for the six: Operational excellence, Security, Reliability, Performance efficiency, Cost optimization, Sustainability. Sustainability was added later, so older material lists only five, one more reason to use current resources.

Cloud economics

Fixed vs variable cost. On-premises is dominated by fixed costs (hardware bought up front regardless of use). Cloud converts these to variable costs that track actual consumption.
Rightsizing means matching instance types and sizes to the actual workload, rather than paying for capacity you do not use. It is one of the biggest cost levers.
Bring Your Own License (BYOL) vs included licenses. You can bring existing software licenses to AWS, or use instances with licensing included in the price. Which is cheaper depends on what you already own.
Total cost of ownership (TCO) comparisons should include the hidden costs of on-premises: power, cooling, space, staff, and hardware refresh, not just the server price.
Automation (for example with CloudFormation) reduces cost and error by provisioning infrastructure as code rather than by hand.

Migration and the Cloud Adoption Framework

The AWS Cloud Adoption Framework (AWS CAF) organizes migration guidance into perspectives (business, people, governance, platform, security, operations) to help plan a move to the cloud.
The Snow Family (Snowball and related devices) physically transfers very large data sets when moving them over the network would take too long.
Database migration uses the Database Migration Service (DMS) to move databases, optionally with the Schema Conversion Tool (SCT) when changing engines.
The common migration strategies (sometimes called the "R"s) range from simply rehosting ("lift and shift") to fully refactoring an application for the cloud.

Domain 2 30%

Security and compliance.

Nearly a third of the exam. One idea dominates it, the shared responsibility model, and the rest is knowing which AWS security service does what. If you learn only one thing perfectly for this exam, make it the shared responsibility model.

The shared responsibility model, the single most tested idea

AWS is responsible for security OF the cloud. You are responsible for security IN the cloud. AWS secures the hardware, the global infrastructure, and the virtualization layer. You secure your data, your access management, your operating system and application configuration, and your network settings. Where the line falls shifts by service: with EC2 you manage the guest OS and patching, but with a managed service like Lambda or RDS, AWS takes on more. Your data and your IAM configuration are always yours to secure, in every service.

Identity and access management (IAM)

IAM controls who can do what in your AWS account, through users, groups, roles, and policies.
Users are individual identities; groups collect users so policies can be applied together; roles grant temporary permissions to whoever or whatever assumes them (services, applications, or cross-account access) without long-lived credentials.
Policies are JSON documents that define permissions. Follow the principle of least privilege: grant only what is needed.
The root user is created with the account and can do everything, including things nothing else can (like closing the account or changing support plans). Protect it fiercely: enable MFA on it, do not use it for daily work, and do not create access keys for it.
MFA adds a second factor beyond the password and should be enabled everywhere, especially on the root user.
IAM Identity Center (formerly AWS Single Sign-On) centrally manages access across multiple accounts and supports federated identity from an external identity provider.

The security services: telling near-neighbors apart

This is where the exam catches people. These services all sound similar and do genuinely different things.

Service	What it does
Amazon GuardDuty	Threat detection: continuously monitors for malicious or unauthorized activity.
Amazon Inspector	Automated vulnerability scanning of workloads (EC2, containers) for software flaws and exposure.
Amazon Macie	Discovers and protects sensitive data in S3, using machine learning to find things like personal information.
Amazon Detective	Investigates and analyzes the root cause of security findings.
AWS Shield	DDoS protection.
AWS WAF	Web application firewall: filters malicious web traffic (SQL injection, cross-site scripting).
AWS KMS	Key Management Service: creates and controls encryption keys.
AWS Secrets Manager	Stores, rotates, and retrieves secrets like database credentials and API keys.

Encryption, compliance, and network security

Encryption in transit protects data moving over the network (TLS); encryption at rest protects stored data. AWS offers both, and KMS manages the keys.
AWS Artifact is where you find AWS compliance reports and agreements (SOC, ISO, PCI, and so on) on demand. When a question asks where to get compliance documentation, the answer is Artifact.
Security groups act as a virtual firewall at the instance level, and are stateful (return traffic is automatically allowed). Network ACLs operate at the subnet level and are stateless. Both control traffic, at different layers.
AWS CloudTrail records who did what in your account (API calls) for auditing. Amazon CloudWatch monitors performance and operational metrics. CloudTrail is the audit log; CloudWatch is the monitoring dashboard.
AWS Trusted Advisor inspects your account and recommends improvements across cost, performance, security, fault tolerance, and service limits.

Domain 3 34% · largest

Cloud technology and services.

The biggest domain, and pure breadth. There is little to reason about here: you either know what a service does or you do not. The good news is that the core services follow clean categories, so learn them by category and the mapping becomes manageable.

The global infrastructure

Regions are geographic areas (like us-east-1) containing multiple isolated data centers. You choose Regions for latency, cost, compliance, and data sovereignty.
Availability Zones (AZs) are one or more discrete data centers within a Region, isolated from each other so a failure in one does not affect another. Deploying across multiple AZs is how you achieve high availability.
Edge locations sit closer to users and cache content for low-latency delivery, used by CloudFront and Global Accelerator.
Use multiple Regions for disaster recovery, lower latency to distant users, and data residency requirements.

Compute

Service	What it is
Amazon EC2	Virtual servers. Full control of the OS, and you choose instance types tuned for compute, memory, or storage.
AWS Lambda	Serverless functions: run code without managing servers, paying only for execution time. The go-to answer for "run code without provisioning servers."
Amazon ECS / EKS	Container orchestration (ECS is AWS's own; EKS is managed Kubernetes).
AWS Fargate	Serverless compute for containers: run containers without managing the underlying servers.
Elastic Load Balancing	Distributes incoming traffic across multiple targets for availability and scale.
EC2 Auto Scaling	Automatically adds or removes instances to match demand, providing elasticity.

Storage

Service	Type and use
Amazon S3	Object storage. Virtually unlimited, durable, for files, backups, static content. Storage classes trade cost against access frequency; Glacier is for cheap archival.
Amazon EBS	Block storage. Persistent volumes attached to a single EC2 instance, like a hard drive.
Amazon EFS	File storage. A shared file system many instances can mount at once (Linux).
Amazon FSx	Managed file systems for Windows and other high-performance workloads.
AWS Backup	Centralized backup across AWS services.

The exam loves the object / block / file distinction: S3 is object, EBS is block, EFS is file.

Databases

Service	What it is
Amazon RDS	Managed relational databases (MySQL, PostgreSQL, SQL Server, and others). AWS handles patching, backups, and failover.
Amazon Aurora	AWS's high-performance relational database, MySQL- and PostgreSQL-compatible.
Amazon DynamoDB	Managed NoSQL database. Serverless, fast, for key-value and document data at any scale.
Amazon Redshift	Data warehouse for analytics on large data sets.

Shorthand: relational means RDS or Aurora; NoSQL means DynamoDB; analytics warehouse means Redshift.

Networking and content delivery

Amazon VPC is your isolated private network in AWS, containing subnets, route tables, and gateways.
Amazon Route 53 is the DNS service (and domain registration). The name is a nod to DNS port 53.
Amazon CloudFront is the content delivery network, caching content at edge locations for low latency.
AWS Direct Connect provides a dedicated private network link from your premises to AWS; AWS VPN provides an encrypted tunnel over the public internet. Direct Connect is private and consistent; VPN is quick and cheaper.
AWS Global Accelerator improves availability and performance using the AWS global network and edge locations.

Ways to access AWS, and other categories

Three ways to interact: the Management Console (web UI), the CLI (command line), and SDKs (programmatic access from code). Infrastructure as code via CloudFormation makes provisioning repeatable.
Messaging and integration: SNS (notifications, pub/sub), SQS (message queues), EventBridge (event routing).
AI/ML: SageMaker (build and train models), plus task-specific services like Rekognition (images), Comprehend (text), Lex (chatbots), Polly (text to speech), Transcribe (speech to text).
Analytics: Athena (query S3 with SQL), Kinesis (streaming data), Glue (data integration), QuickSight (dashboards).

Domain 4 12% · smallest

Billing, pricing, and support.

The smallest domain, and the most learnable. It is almost entirely clean distinctions: the pricing models for compute, the cost management tools, and the support plans. Learn these tables and you bank easy points that offset harder questions elsewhere.

EC2 pricing models

Model	When to use it
On-Demand	Pay by the second with no commitment. For short-term, spiky, or unpredictable workloads, and for testing.
Reserved Instances	Commit to 1 or 3 years for a large discount. For steady, predictable, always-on workloads.
Savings Plans	Commit to a consistent amount of compute usage (per hour) for 1 or 3 years for a discount, with more flexibility than Reserved Instances.
Spot Instances	Deep discounts on spare capacity that AWS can reclaim with little notice. For fault-tolerant, interruptible work (batch jobs, rendering).
Dedicated Hosts	A physical server dedicated to you, for licensing or compliance requirements.

The exam pattern is a scenario ("a workload that can tolerate interruption" or "a steady 24/7 database") asking for the cheapest fitting model. Interruptible means Spot; steady and predictable means Reserved or Savings Plans; short and unpredictable means On-Demand.

Cost management tools

Tool	What it does
AWS Pricing Calculator	Estimates costs before you deploy, for planning and budgeting.
AWS Cost Explorer	Visualizes and analyzes your past and current spending and usage trends.
AWS Budgets	Sets custom budgets and alerts you when spending exceeds or is forecast to exceed them.
Cost and Usage Report	The most detailed billing data available, for deep analysis.
AWS Billing Conductor	Customizes billing for showback and chargeback within organizations.

The tell: Pricing Calculator estimates the future, Cost Explorer analyzes the past, Budgets alerts on thresholds.

Organizations and consolidated billing

AWS Organizations centrally manages multiple AWS accounts under one umbrella.
Consolidated billing combines the bills of all accounts, which can lower cost through combined volume discounts and shared Reserved Instance and Savings Plan benefits.
Service Control Policies (SCPs) set guardrails on what member accounts are permitted to do.
Cost allocation tags label resources so spending can be tracked by project, team, or environment in billing reports.

AWS Support plans

Plan	Key characteristic
Basic	Free for all accounts. Documentation, whitepapers, and support forums, plus core Trusted Advisor checks.
Developer	Business-hours email access to support. For experimentation and early development.
Business	24/7 phone, email, and chat, full Trusted Advisor, and faster response times. For production workloads.
Enterprise	All of Business plus a Technical Account Manager (TAM), concierge support, and the fastest response for business-critical systems.

The distinguishing details the exam tests: only Business and Enterprise get 24/7 phone and full Trusted Advisor, and only Enterprise includes a dedicated Technical Account Manager.

Trusted Advisor across plans

Trusted Advisor inspects your account and makes recommendations across cost optimization, performance, security, fault tolerance, and service limits. Basic and Developer plans get only a limited set of checks; Business and Enterprise get the full set. When a question pairs Trusted Advisor with "all checks," the answer involves Business or Enterprise support.

Reference

Service glossary.

The core CLF-C02 services and concepts, grouped so near-neighbors sit together. This is the map the largest domain tests: know what each does and when to reach for it.

Shared responsibility model: AWS secures OF the cloud (hardware, infrastructure); you secure IN the cloud (data, IAM, OS config). The line shifts by service; your data and IAM are always yours.
Well-Architected pillars: Operational excellence, Security, Reliability, Performance efficiency, Cost optimization, Sustainability.
Region / AZ / edge: Region = geographic area of data centers. Availability Zone = isolated data center(s) within a Region; use multiple AZs for high availability. Edge location = caching point near users.
EC2: Virtual servers with full OS control.
Lambda: Serverless functions; run code without managing servers, pay per execution.
Fargate: Serverless compute for containers.
ECS / EKS: Container orchestration (ECS native, EKS managed Kubernetes).
Auto Scaling / ELB: Auto Scaling adds/removes instances for elasticity; Elastic Load Balancing spreads traffic across targets.
S3 / EBS / EFS: Object storage / block storage (one instance) / shared file storage (many instances). Glacier = cheap S3 archival.
RDS / Aurora / DynamoDB / Redshift: Managed relational / AWS high-performance relational / NoSQL / analytics data warehouse.
VPC / Route 53 / CloudFront: Your private network / DNS / content delivery network (edge caching).
Direct Connect vs VPN: Direct Connect = dedicated private link. VPN = encrypted tunnel over the internet.
IAM: Users, groups, roles, and policies controlling who can do what. Roles give temporary credentials.
Root user: All-powerful account owner. Enable MFA, do not use daily, no access keys.
GuardDuty / Inspector / Macie / Detective: Threat detection / vulnerability scanning / sensitive-data discovery in S3 / finding investigation.
Shield / WAF: DDoS protection / web application firewall.
KMS / Secrets Manager: Encryption key management / storing and rotating secrets like credentials.
CloudTrail vs CloudWatch: CloudTrail logs who did what (audit). CloudWatch monitors performance and metrics.
AWS Artifact: Where to download AWS compliance reports (SOC, ISO, PCI).
Trusted Advisor: Recommendations across cost, performance, security, fault tolerance, and service limits.
Security group vs network ACL: Security group = instance-level, stateful. Network ACL = subnet-level, stateless.
Pricing models: On-Demand (no commitment) / Reserved (1-3yr, steady) / Savings Plans (flexible commitment) / Spot (cheap, interruptible) / Dedicated Host (physical, licensing).
Pricing Calculator vs Cost Explorer vs Budgets: Estimate future cost / analyze past cost / alert on thresholds.
Organizations / consolidated billing: Manage many accounts centrally; combine bills for volume discounts and shared commitments.
Support plans: Basic (free) / Developer (business-hours email) / Business (24/7, full Trusted Advisor) / Enterprise (adds a Technical Account Manager).
CAF vs Snow Family: Cloud Adoption Framework = migration planning guidance. Snow Family = physical devices to move large data.

Common questions

AWS Cloud Practitioner exam questions, answered

How many questions are on the AWS Cloud Practitioner exam?

The AWS Cloud Practitioner exam has 65 questions and lasts 90 minutes. You need 700% to pass.

What is on the AWS Cloud Practitioner exam?

The exam covers 4 domains: Cloud Concepts (24%), Security & Comp. (30%), Tech & Services (34%), Billing & Pricing (12%). These weightings come from Amazon's Exam Guide CLF-C02.

Is this AWS Cloud Practitioner material current?

Yes. This guide was written from Amazon's own published outline, Exam Guide CLF-C02, and last checked against that document on 22 July 2026. That date is shown on every page so you can judge for yourself rather than take our word for it.

Are there free AWS Cloud Practitioner practice questions?

Yes. Sample questions with full worked explanations are free and need no account. The complete question bank and the full-length 65-question timed mock are paid.

Practise it

The guide above is free. The question bank and the full-length timed mock are the paid part.

Open AWS CCP →

Other exams:
PMP · CAPM · PMI-ACP · PSM I · PRINCE2 · ITIL · ISTQB CTFL · CC · Network+ · Security+ · CISSP

Cutscores is independent and is not affiliated with, authorised by, endorsed by or sponsored by Amazon or any certification body. AWS CCP and all certification names and marks are the property of their respective owners, and are used here only to describe which exam this material prepares you for. We do not reproduce live exam content.