How to build a cloud home lab for certification practice

Why hands-on practice beats passive study

Watching videos and reading notes builds recognition; building things builds recall — and certification exams test recall under pressure. When you have actually created a virtual machine, misconfigured its firewall and fixed it, the scenario question about why an instance is unreachable stops being abstract: you have lived it. The AWS associate exams and Azure exams like AZ-104 lean heavily on scenario questions that ask what you would do, and those are far easier to answer when “what you would do” is something you have genuinely done.

Hands-on work also compounds beyond the exam. Interviewers probe certificates by asking what you have built, and a candidate who can describe a real project — including what went wrong — is more convincing than one who can only recite service definitions. A home lab gives every certification answer a story behind it, which is exactly what our guide on what to do after your first cloud certification argues employers actually look for.

The free and cheap options on AWS and Azure

On AWS, the Free Tier lets you use a meaningful slice of core services at no cost — the exact allowances change, so check the AWS Free Tier page for what is currently included rather than trusting any blog’s snapshot. AWS Skill Builder also offers free digital courses and some free hands-on labs that run in sandboxed environments, so you can practise certain tasks without touching your own account at all.

On the Microsoft side, a free Azure account comes with starter credit and a set of free services — again, the amounts and terms change, so read Azure’s free account page for current figures. Microsoft Learn goes a step further than most vendors: many of its learning paths include built-in sandbox environments that give you temporary, no-cost access to a real Azure subscription for the duration of an exercise. For AZ-900 or AZ-104 preparation, working through those sandboxes is some of the best free practice available anywhere.

The single most important habit: billing alerts first

Before you create a single resource, set up a billing alert or budget — on AWS through Budgets and billing alarms, on Azure through Cost Management budgets and alerts. Free tiers have limits, and the classic home-lab accident is leaving something running past them: a virtual machine forgotten for a month, a database that was never deleted, a resource created in a size or region the free allowance does not cover. An alert that emails you the moment estimated charges rise above a small threshold turns a potential nasty surprise into a same-day fix.

Pair the alert with a tear-down habit: at the end of every session, delete what you built. This is not just cost hygiene — rebuilding a setup from scratch is genuinely better practice than leaving it running, because repetition is what moves console steps into memory. Some people keep a checklist or script for tear-down; on Azure, deleting the resource group removes everything inside it, which is itself a useful lesson in how Azure organises resources.

Starter projects mapped to certification skills

The best lab projects are small, finishable and mapped to what your target exam actually tests. Each of these can be built on AWS or Azure with free-tier resources, and each corresponds to a domain you will meet in the foundational and associate exams:

• Host a static website — object storage (S3 or Azure Blob Storage), public access settings and optionally a CDN in front. Teaches storage, permissions and content delivery.
• Launch and secure a virtual machine — an EC2 instance or Azure VM, SSH or RDP access, and a security group or network security group locked down to only what is needed.
• Build a network — a VPC on AWS or a virtual network on Azure, with public and private subnets and a clear reason why each resource sits where it does.
• Write a small serverless function — Lambda or Azure Functions triggered by an HTTP request or a storage event. Teaches event-driven design without any servers to manage.
• Practise identity and least privilege — create IAM users, groups and policies on AWS, or users and role assignments in Microsoft Entra ID, granting only the permissions each identity needs.
• Set up monitoring and alerts — CloudWatch or Azure Monitor watching a resource, with an alarm that actually notifies you when a threshold is crossed.
• Try infrastructure as code — recreate one of the above with Terraform, CloudFormation or Bicep, so the whole environment can be built and destroyed with one command.

Local tooling for offline practice

Not everything needs a cloud account. Docker on your own machine teaches the container concepts that both vendors’ exams increasingly assume, and container images you build locally run unchanged on cloud container services. Emulators in the LocalStack style simulate popular AWS APIs locally, which is useful for practising CLI commands and infrastructure-as-code templates without any billing exposure at all — just remember an emulator is an approximation, and behaviour that matters for the exam should be verified against the real service.

Install the vendor CLIs early — the AWS CLI and Azure CLI, plus Azure PowerShell if you are heading towards AZ-104. Doing in the terminal what you first did in the console is the classic second pass of a home lab: it deepens understanding, it is how professionals actually work, and CLI familiarity quietly answers a whole category of exam questions about how tasks are performed.

Document it publicly — and stay safe

Push your lab work to GitHub as you go: the infrastructure code, a README describing what you built and why, a diagram, and notes on what broke and how you fixed it. This costs almost nothing extra and converts private practice into public portfolio evidence — the thing interviewers can actually inspect. A repository per project, written up plainly, does more for a job application than a longer list of certifications with nothing behind them.

The safety rules are few but absolute. Never commit credentials, keys or secrets to a repository — use environment variables or the provider’s secret-management tools, and add credential files to your ignore list before the first commit. Practise least privilege in the lab exactly as you would in production, because the habit is the point. And delete resources when you are done: an abandoned lab with an exposed service is how personal accounts get compromised. A home lab should teach you good security instincts, not train you out of them.