On this page
Intro
AWS Certified Cloud Practitioner is a foundational exam for people who are new to the AWS Cloud, including those from non-technical roles. This guide turns the CLF-C02 exam guide into manageable study tasks, with CertMonk as one option for reviewing what you learn. The exam scope comes from AWS’s Cloud Practitioner page and its published exam guide; the study plan below is our suggested approach.
Exam at a glance
| Detail | CLF-C02 |
|---|---|
| Exam code | CLF-C02 |
| Questions | 65, including 15 unscored questions |
| Time | 90 minutes |
| Passing score | 700 on a scale of 100–1,000 |
| Question types | Multiple choice and multiple response |
| Price | Check the vendor’s site for current pricing |
| Language note | AWS lists the Italian and German exams as retiring after December 31, 2026 |
Source: AWS’s certification page and the CLF-C02 exam guide, reviewed November 7, 2026. Unscored questions are not identified on the exam, so treat every question seriously.
Exam domains and weights
| Domain | Weight | In plain English |
|---|---|---|
| Cloud concepts | 24% | Understand the value of the cloud, its design principles and how adoption changes the way a business works. |
| Security and compliance | 30% | Know who is responsible for what, and which services and features help protect accounts and data. |
| Cloud technology and services | 34% | Recognize the core service categories and match a need to a suitable service. |
| Billing, pricing and support | 12% | Understand how costs arise, how to estimate and track them, and what support options exist. |
Weights are shown as a share of scored content in the exam guide. Use the full official exam objectives as your coverage checklist; a domain’s weight should help allocate attention without becoming a reason to skip smaller topics.
What each domain really tests
Cloud concepts
Start with the reasons organizations move to the cloud and the trade-offs involved. Explain in your own words ideas such as elasticity, scalability, high availability and agility, and give a short business example for each. Compare moving a workload to the cloud with keeping it in a data center.
Also learn the idea behind a well-designed cloud workload. Read about the design pillars AWS describes, and write one sentence about what each pillar asks a team to consider. Include the basic stages and benefits of a cloud adoption journey.
Security and compliance
The shared responsibility model is the idea to master. Make a two-column list of what AWS manages and what the customer manages, then test it against several service types. Be careful: the split changes depending on the kind of service in use.
Next study identity and access: users, groups, roles, policies, multi-factor authentication and the principle of least privilege. Review the services that help monitor, detect and report on security and compliance, and write what each one is for. Keep the purpose of a service separate from its name so that similar-sounding services stop blurring together.
Cloud technology and services
This domain has the largest weight and the widest reading list. Organize by category rather than by alphabet: compute, storage, databases, networking and content delivery, analytics, application integration, developer tools, and machine learning. For each category, learn the job it does and one or two representative services.
Understand the global infrastructure: Regions, Availability Zones and edge locations, and why a team would choose one design over another. Practice matching a short requirement, such as durable object storage or a managed relational database, to a service category before you reach for a service name.
Billing, pricing and support
This is the smallest domain, but the topics are easy to learn and lose points on if skipped. Compare pricing approaches such as paying as you go, reserving capacity and using spare capacity. Learn what tools exist to estimate, view and organize costs, and what consolidated billing and tagging help with.
Review the support plans at a high level and the resources available for guidance. Write a short note on who you would contact, or what you would open, in a few simple situations.
The coverage above is organized from AWS’s published exam guide; the note-taking exercises are study suggestions.
A realistic 30-day study plan
Treat this as a starting schedule, not a deadline you must meet. Aim for a focused session most days, with time for reading, recall and review. AWS says no prior IT or cloud experience is required, so beginners can use extra time on the basics instead of rushing.
Days 1–7: learn the cloud ideas
Read the exam guide and mark each topic as familiar, uncertain or new. Spend the week on cloud concepts and the shared responsibility model. After each session, close your notes and explain one idea aloud.
Keep a learning log with three columns: topic, misunderstanding and next action. A next action should be specific, such as comparing two storage options. “Study more” is too broad to help tomorrow.
Days 8–14: security and compliance
Work through identity and access, then the services that protect and monitor an account. Draw the shared responsibility split for two or three service types. At the end of the week, revisit week one without looking at your notes first.
If you have a free AWS account, explore the console to see how services are grouped. Follow the account’s cost settings and stay within free offers.
Days 15–23: services by category
Take two or three categories per session. Build a one-page table of categories, jobs and example services. Use untimed practice to expose confusion between similar services, then return to the notes before trying again.
End this stretch with mixed review from every domain so far. Record correct guesses as uncertain knowledge. They need follow-up even though a practice score may count them as correct.
Days 24–28: billing, support and pacing
Cover pricing models, cost tools and support plans. Then add timed practice once you can explain the material without help. Review the session afterward and separate knowledge gaps from rushed reading.
Days 29–30: make a readiness decision
Review concise notes and remaining uncertainties. Check your exam version, language and booking details with the vendor. If important topics still feel unfamiliar, plan another week; finishing a calendar is not evidence that learning is complete.
Common mistakes and how to avoid them
- Memorizing service names without jobs. For every service, write the problem it solves in plain words.
- Misreading the shared responsibility model. Test your split against different kinds of service rather than reciting one diagram.
- Skipping billing and support. The domain is small, but its topics are learnable and worth the time.
- Ignoring multiple-response questions. Read how many answers are required and check every option against the scenario.
- Counting lucky guesses as mastery. Flag them for review alongside incorrect responses.
- Repeating a familiar set until the score rises. Return to the underlying concept and explain it without answer choices.
How to use practice questions well
Begin untimed. Read the explanation for your selected answer and for each alternative, then identify the distinction you missed. Wrong-answer explanations matter because they can reveal why a familiar term does not fit the situation being described.
CertMonk offers explanations for every answer choice, randomized practice tests, timed practice and an untimed learning mode, plus flip-card flashcards, study games and progress by exam domain. Use those tools for different jobs: explanations for reasoning, flashcards and games for recall, and domain progress to choose what to review next.
After a practice session, choose a small number of gaps to repair. Read the relevant material, write a short explanation and revisit it later. Add timed practice when the concepts feel more stable. Treat practice results as feedback about your preparation, not a prediction of your exam result.
Free practice questions
Use the free samples below to explore the format and review the explanations without a purchase.
A new engineer asks how the AWS Management Console, the AWS CLI, and the AWS SDKs relate to each other. Which statement is correct?
- AEach tool manages a separate copy of the account’s resources
- BAll three are ways of calling the same underlying AWS service APIs
- COnly the console creates resources; the CLI and SDKs are read-only
- DThe SDKs are only for billing tasks, and the CLI is only for EC2
Show the answer and explanation
Answer: B. All three are ways of calling the same underlying AWS service APIs
Correct. The console, CLI, and SDKs are different interfaces to the same underlying AWS APIs, so they act on the same resources.
Why not the others
- A. All tools act on the same resources in the account.
- C. The CLI and SDKs can create, change, and delete resources just as the console can.
- D. SDKs and the CLI cover a wide range of AWS services.
Takeaway: Console, CLI, SDKs, and infrastructure-as-code tools all call the same AWS APIs; choose the interface that fits the task.
Source: AWS Command Line Interface User Guide: What is the AWS CLI?
When an application assumes an IAM role, it receives credentials that expire after a limited time. Which AWS service issues these temporary security credentials?
- AAWS Secrets Manager
- BAWS Security Token Service (AWS STS)
- CAmazon Cognito user pools for app sign-in
- DAWS Key Management Service (AWS KMS)
Show the answer and explanation
Answer: B. AWS Security Token Service (AWS STS)
Correct. AWS STS issues temporary, limited-privilege security credentials, for example when a role is assumed.
Why not the others
- A. Secrets Manager stores and rotates secrets. It does not issue credentials for assumed roles.
- C. User pools handle sign-up and sign-in for app users. Role credentials come from another service.
- D. KMS manages encryption keys. It does not issue temporary credentials for assumed roles.
Takeaway: AWS STS issues temporary credentials when roles are assumed, which is why roles avoid long-term secrets.
Source: AWS IAM User Guide: Temporary security credentials in IAM
A company owns a fixed number of Oracle processor licenses and runs the software both on servers in its own data center and on EC2 instances. Auditors want one view of license consumption across both environments, and the company wants new EC2 launches blocked when they would exceed its entitlement. Which service fits?
- AAWS License Manager
- BAWS Marketplace license subscriptions
- CAWS Config with a custom rule per license
- DAWS Organizations service control policies
Show the answer and explanation
Answer: A. AWS License Manager
Correct. License Manager tracks license use against rules you define, can include servers outside AWS through Systems Manager, and can set hard limits that stop non-compliant launches.
Why not the others
- B. Marketplace sells software, including license-included products. The company already owns its Oracle licenses and needs to track them.
- C. Config records resource settings. It has no built-in license counting across on-premises servers and EC2, and it cannot stop a launch before it happens.
- D. SCPs limit which API actions accounts may perform. They do not count license consumption against an entitlement.
Takeaway: AWS License Manager tracks BYOL license use in AWS and on premises against rules you define, and hard limits can prevent overuse before it happens.
Source: What is AWS License Manager?
A startup moves an image-thumbnail job from an always-on EC2 instance to AWS Lambda. The finance lead asks what the Lambda part of the bill will depend on. Which answer is accurate?
- AThe number of requests and how long each run lasts
- BThe number of hours the function is deployed, whether or not it is invoked
- CA flat monthly fee per function, regardless of how often it runs
- DThe number of vCPUs and the instance type chosen for the function
Show the answer and explanation
Answer: A. The number of requests and how long each run lasts
Correct. Lambda is priced on the number of requests and the duration the code runs, measured in GB-seconds (memory allocated multiplied by execution time). There is no charge while the function is idle.
Why not the others
- B. Lambda does not bill for idle, deployed functions; this describes an always-on instance.
- C. There is no flat per-function fee; cost scales with use.
- D. Lambda has no instance types to choose; compute is allocated in proportion to the memory setting.
Takeaway: Lambda charges per request plus duration in GB-seconds (memory × run time). Idle time is free, which suits spiky or occasional workloads.
Source: AWS Lambda Pricing
Each time a user uploads an image to an Amazon S3 bucket, a short routine must run to generate a thumbnail. Uploads are unpredictable: often none for hours, sometimes hundreds within a minute. The team does not want to manage or patch any servers and wants to pay nothing when no uploads occur. Which compute option BEST fits?
- AA nightly batch job on a dedicated server that processes the images uploaded that day.
- BAWS Lambda, triggered by the S3 upload event.
- CA small Amazon EC2 instance, running around the clock, that polls the bucket for new objects.
- DAn Auto Scaling group of EC2 instances that scales on a CPU metric.
Show the answer and explanation
Answer: B. AWS Lambda, triggered by the S3 upload event.
Correct. Lambda runs code in response to events without provisioning or managing servers, scales horizontally with demand, and is billed per request and per GB-second of execution, so an idle period costs nothing.
Why not the others
- A. Batching delays every thumbnail by up to a day, and the dedicated server is still managed and paid for continuously.
- C. This works but contradicts both requirements: the team patches and manages the instance, and it is billed while idle even when no uploads arrive.
- D. Auto Scaling handles the burst, but instances must still be managed and patched, scaling takes time relative to a sudden burst, and the group’s minimum capacity keeps costing money while idle.
Takeaway: Event-driven work that is short, bursty, and idle much of the time is the classic case for serverless compute: no capacity to size, no servers to patch, and no charge when nothing is happening.
FAQ
Do I need AWS experience for Cloud Practitioner?
AWS says no prior IT or cloud experience is required. Its target candidate has up to six months of exposure to AWS Cloud design, implementation or operations, according to the exam guide.
What types of questions are on the exam?
AWS lists multiple choice, with one correct response, and multiple response, with two or more correct responses. Read each question for how many answers it requires.
Do all 65 questions count toward my score?
No. AWS states that 15 of the questions are unscored and are used to evaluate future questions. They are not identified, so answer every question carefully.
Is 30 days enough to prepare?
It can be a useful planning window, but your starting knowledge and available time decide whether it is realistic. Extend it if you cannot yet explain the topics or match a need to a service category.
Which domain should I focus on?
Cloud technology and services has the largest weight and the most material, but security and compliance is close behind. Keep every domain on your checklist and use the weights to balance your time.
How should I decide what to revise next?
Start with concepts you cannot explain and mistakes that recur across practice sessions. Use domain weights to balance the remaining schedule, while keeping every domain on your checklist.
Next step
Try free practice questions → https://app.certmonk.app/samples
