ExamFinch.com My Study

Cheat sheet

AWS Cloud Practitioner Cheat Sheet

Practice this exam

Cloud Concepts

  • 24% of exam
  • Cloud Benefits Well-Architected Migration + CAF Cloud Economics CapEx vs OpEx

Security + Compliance

  • 30% of exam
  • Responsibility Identity + Access Security Services Compliance IAM Role vs User

Technology + Services

  • 34% of exam
  • Compute + Containers Storage + Database Network + Delivery Management + Integration Service Picker

Billing + Support

  • 12% of exam
  • Cost + Support Pricing Cost Tools Support Plans Cost Picker

Quick Facts

  • Exam CLF-C02
  • Credential Cloud Practitioner
  • Questions 65 total
  • Scored 50 questions
  • Time 90 min
  • Pass 700/1000
  • Level Foundational
  • Blueprint CLF-C02 current

Six Pillars CL

  • OPSERS keeps workload reviews complete
  • Operational excellence Security Reliability Performance Cost optimization Sustainability

Cloud Benefits CL

  • Global reach Regions worldwide
  • Agility Provision in minutes
  • Elasticity Scale with demand
  • Scalability Add capacity
  • HA Minimize downtime
  • Economies Provider scale savings
  • OpEx Usage-based spend
  • CapEx Upfront hardware
  • Automation Repeatable changes

Well-Architected CL

  • Operational excellence Run and improve
  • Security Protect data/systems
  • Reliability Recover from failure
  • Performance Efficient resource use
  • Cost optimization Avoid waste
  • Sustainability Reduce environmental impact
  • WA Tool Review workloads
  • Pillar tradeoffs Balance priorities

Migration + CAF CL

  • CAF Transformation guidance
  • Business Value outcomes
  • People Culture skills
  • Governance Priorities controls
  • Platform Cloud foundation
  • Security Risk controls
  • Operations Run workloads
  • DMS Database migration
  • Snow Family Offline transfer, existing customers only

Shared Model SE

  • AWS owns cloud; you own choices
  • Facilities Hardware Data IAM Patching Config

IAM User vs Role SE

IAM user

  • Person/service
  • Long-term keys
  • Avoid sharing

IAM role

  • Assumed identity
  • Temporary keys
  • Preferred access
  • Permanent vs temporary

Security Picker SE

  • Human permissions → IAM ( Least privilege )
  • App users → Cognito ( Customer identity )
  • Encryption keys → KMS ( Managed keys )
  • Threat detection → GuardDuty ( Findings )
  • Vulnerability scans → Inspector ( Workloads )
  • Sensitive S3 data → Macie ( Discovery )
  • Compliance reports → Artifact ( Audits )
  • Web filtering → WAF ( Layer 7 )

Responsibility SE

  • AWS Cloud infrastructure
  • Customer Data and configuration
  • IaaS More customer duties
  • PaaS Shared app duties
  • SaaS Mostly provider managed
  • EC2 patching Customer OS duty
  • Physical DC AWS duty
  • IAM users Customer duty

Identity + Access SE

  • Root user Protect strongly
  • IAM user Long-term identity
  • IAM role Temporary access
  • IAM policy JSON permissions
  • Groups User collections
  • MFA Extra factor
  • KMS Key management
  • Cognito App user identity
  • IAM Identity Center Workforce SSO

Security Services SE

  • GuardDuty Threat detection
  • Inspector Vulnerability scans
  • Macie Sensitive data discovery
  • Detective Security investigations
  • Security Hub Posture aggregation
  • Shield DDoS protection
  • WAF Web request filtering
  • Artifact Compliance reports
  • ACM TLS certificates
  • Secrets Manager Rotate secrets

Core Services SE

  • Compute stores, networks connect, IAM permits
  • EC2 S3 VPC IAM

EC2 vs Lambda SE

EC2

  • OS control
  • Persistent servers
  • You patch

Lambda

  • Event code
  • No servers
  • AWS patches
  • Server vs function

Service Picker SE

  • Need OS control → EC2 ( IaaS )
  • Event code → Lambda ( Serverless )
  • Managed app deploy → Elastic Beanstalk ( PaaS )
  • Container orchestration → ECS ( AWS native )
  • Kubernetes required → EKS ( Managed K8s )
  • Object files → S3 ( Durable )
  • Relational database → RDS ( Managed SQL )
  • Key-value scale → DynamoDB ( NoSQL )
  • Global cache → CloudFront ( CDN )
  • DNS routing → Route 53

Compute + Containers SE

  • EC2 Virtual servers
  • Lambda Event functions
  • Elastic Beanstalk Managed app deploy
  • Lightsail Simple VPS
  • ECS Container service
  • EKS Managed Kubernetes
  • Fargate Serverless containers
  • Batch Batch jobs
  • Outposts AWS on-premises

S3 vs EBS SE

S3

  • Object storage
  • HTTP access
  • Regional service

EBS

  • Block volumes
  • Attach to EC2
  • AZ scoped
  • Objects vs blocks

Storage + Database SE

  • S3 Object storage
  • S3 Glacier Archive storage
  • EBS EC2 block volumes
  • EFS Linux file shares
  • FSx Managed file systems
  • Backup Central backups
  • Storage Gateway Hybrid storage
  • RDS Relational databases
  • Aurora AWS relational engine
  • DynamoDB Key-value NoSQL
  • Redshift Data warehouse
  • ElastiCache In-memory cache

Security Group vs NACL SE

Security group

  • Instance level
  • Stateful
  • Allow rules

NACL

  • Subnet level
  • Stateless
  • Allow/deny rules
  • Instance vs subnet

Network + Delivery SE

  • VPC Isolated network
  • Subnet VPC segment
  • Security group Instance firewall
  • NACL Subnet firewall
  • Route 53 DNS service
  • CloudFront CDN edge cache
  • Direct Connect Private circuit
  • Site-to-Site VPN Encrypted tunnel
  • Transit Gateway Network hub
  • PrivateLink Private service access
  • API Gateway Managed API front
  • Global Accelerator Global traffic routing

CloudWatch vs CloudTrail SE

CloudWatch

  • Metrics/logs
  • Alarms
  • Resource health

CloudTrail

  • API calls
  • Audit trail
  • Who did what
  • Observe vs audit

Management + Integration SE

  • CloudWatch Metrics and alarms
  • CloudTrail API activity logs
  • Config Resource compliance
  • Systems Manager Ops management
  • Auto Scaling Capacity adjustment
  • CloudFormation IaC templates
  • Trusted Advisor Best-practice checks
  • Organizations Account grouping
  • EventBridge Event bus
  • SNS Pub/sub notifications
  • SQS Message queues
  • Step Functions Workflow orchestration

Cost Flow BI

  • Estimate, track, alert, optimize
  • Calculator Explorer Budgets Advisor

Cost Explorer vs Budgets BI

Cost Explorer

  • Analyze spend
  • Historical trends
  • Forecast view

Budgets

  • Set thresholds
  • Send alerts
  • Track limits
  • Analyze vs alert

Cost Picker BI

  • Estimate architecture → Pricing Calculator
  • Inspect spend → Cost Explorer
  • Alert threshold → Budgets
  • Detailed charges → CUR
  • Commit usage → Savings Plans
  • Unused capacity → Spot
  • Optimization advice → Trusted Advisor
  • Multi-account billing → Organizations

Cost + Support BI

  • Pricing Calculator Future cost estimate
  • Cost Explorer Spend analysis
  • Budgets Spend alerts
  • CUR Detailed spend data
  • Savings Plans Flexible commitment
  • Reserved Instances Instance commitment
  • Spot Spare capacity
  • On-Demand No commitment
  • Free Tier Limited free use
  • Marketplace Third-party software
  • Basic Support Account support
  • Business Support+ 24/7 production support
  • Enterprise Support Designated TAM, 15-minute response
  • Unified Operations Mission-critical support

Common Traps

Shared Responsibility

  • AWS secures facilities ≠ Customer secures data

Region vs AZ

  • Region = geography ≠ AZ = datacenter set

SG vs NACL

  • SG is stateful ≠ NACL is stateless

Role vs User

  • Role has temporary keys ≠ User has long-term keys

Calculator vs Explorer

  • Calculator estimates future ≠ Explorer reads actuals

CloudWatch vs CloudTrail

  • CloudWatch observes metrics ≠ CloudTrail records API

S3 vs EBS

  • S3 stores objects ≠ EBS attaches volumes

Last Minute

  • 1. Know 24/30/34/12 weights
  • 2. 700 pass; 50 scored
  • 3. AWS owns physical infrastructure
  • 4. IAM role beats shared keys
  • 5. SG stateful; NACL stateless
  • 6. S3 objects; EBS blocks
  • 7. Calculator estimates; Explorer tracks
  • 8. GuardDuty detects suspicious activity
  • 9. Artifact provides compliance reports
  • 10. CloudTrail records API activity
  • 11. Trusted Advisor recommends optimizations