CLF-C02 flashcards

Cloud Concepts

• The AWS value proposition: on-demand resources with pay-as-you-go pricing replace owning and operating your own hardware.
• CapEx to OpEx: large upfront hardware investment becomes a variable expense that tracks actual usage.
• Economies of scale: aggregated usage from many customers lowers AWS's costs, which are passed on as lower prices.
• Elasticity = automatically acquiring AND releasing resources as demand changes; the release half is what distractors omit.
• Scalability = the ability to grow to meet demand; it does not have to be automatic or bidirectional.
• High availability = surviving component failure with minimal downtime, typically via redundancy across Availability Zones.
• Agility = the business benefit of provisioning in minutes: faster experiments, faster time to market, cheap failure.
• Global infrastructure (Regions, AZs, edge locations) delivers speed of deployment and global reach — 'go global in minutes.'

• The AWS Well-Architected Framework has exactly six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability
• The AWS Well-Architected Tool is a free console service that reviews workloads against the framework and produces an improvement plan
• Reliability = keep working and recover from failure (failover, Multi-AZ, backups); performance efficiency = right resources and low latency when nothing is broken
• Security protects against unauthorized access (least privilege, encryption, audit); reliability protects against component failure
• Cost optimization is measured in money (right-sizing, idle resources, Savings Plans); operational excellence is measured in process quality (deployments, runbooks, learning from incidents)
• Sustainability (added in 2021) targets environmental impact — if the goal is energy or carbon rather than dollars, it is sustainability even when the action is right-sizing
• Answer 'which pillar?' questions by finding the stated goal first; services like Auto Scaling or S3 lifecycle can support more than one pillar

• The AWS CAF has six perspectives: Business, People, Governance (business capabilities) and Platform, Security, Operations (technical capabilities).
• The four CAF benefit categories are reduced business risk, improved ESG performance, increased revenue, and increased operational efficiency — outcomes, not perspectives.
• If an option starts with reduced/improved/increased, it's a CAF benefit; a single functional noun (Security, Operations) is a perspective.
• The 7 Rs: rehost (as-is), replatform (minor optimization), refactor (re-architect), repurchase (SaaS), relocate (VMware as-is), retain (stay put), retire (shut down).
• Migrate live databases with minimal downtime using AWS DMS continuous replication; heterogeneous migrations also need schema conversion.
• Choose AWS Snowball when data volume overwhelms available bandwidth, connectivity is poor, or the transfer is a one-time bulk move.
• Migration Hub tracks migrations centrally; Application Migration Service rehosts servers; Prescriptive Guidance documents strategies; AWS Partners supply expertise.
• Retire and retain are the only two Rs where nothing moves to AWS — a common distractor pair.

• Moving to AWS trades upfront capital expense (CapEx) for pay-as-you-go operational expense (OpEx) — fixed costs become variable costs
• A cost is variable if it rises and falls with usage; hardware purchases, data center rent, and facilities are fixed costs
• On-premises TCO includes hardware, power, cooling, physical space, network, software licenses, AND staff labor — not just servers
• BYOL reuses licenses you already own (you manage compliance); license-included bundles the license into the AWS service price as a variable cost
• Rightsizing means continuously matching instance type and size to actual workload needs — an oversized cloud instance is just overprovisioning at an hourly rate
• Automation with AWS CloudFormation cuts cost by replacing manual provisioning labor with repeatable templates and making idle environments safe to delete
• Managed services (RDS, ECS, EKS, DynamoDB) reduce TCO by shifting patching, backups, scaling, and failure recovery to AWS
• A managed service can cost more per hour than self-managed EC2 yet have lower total cost of ownership once staff time and operations are counted

Security and Compliance

• AWS is responsible for security OF the cloud (facilities, hardware, network, hypervisor); the customer is responsible for security IN the cloud (data, access, configuration).
• Customer data, IAM permissions, and encryption choices are ALWAYS the customer's responsibility, on every service.
• Physical data centers, hardware, the global infrastructure, and the hypervisor are ALWAYS AWS's responsibility.
• The line shifts by service: on EC2 you patch the guest OS; on RDS, AWS patches the OS and database engine; on Lambda, AWS manages everything up through the runtime.
• The three shared controls to memorize: patch management, configuration management, and awareness and training.
• Controls classify as inherited (fully from AWS, e.g. physical security), shared (both act in their own layer), or customer-specific (e.g. data classification).
• Security group and network firewall configuration is the customer's job, even though AWS provides the feature.
• More managed service = more AWS responsibility for operations, but never for your data or your access decisions.

• AWS Artifact = self-service download of AWS's compliance reports (SOC, PCI, ISO) and agreements — free, no configuration.
• Compliance requirements vary by geography (data residency, GDPR-style laws), industry (HIPAA, PCI DSS), and even by AWS service (services-in-scope lists).
• Encryption at rest protects stored data (KMS-integrated); encryption in transit protects moving data (TLS certificates via ACM).
• Security logs — CloudTrail events, VPC Flow Logs, S3 access logs — are typically delivered to Amazon S3 and/or CloudWatch Logs.
• GuardDuty detects threats by analyzing logs; Inspector scans workloads for vulnerabilities; Security Hub aggregates findings; Shield stops DDoS (Standard free, Advanced paid).
• CloudTrail answers "who did what, when, from where"; CloudWatch answers "how is it performing"; Config answers "what does/did the resource configuration look like."
• AWS Audit Manager automates collecting YOUR audit evidence against frameworks; Artifact provides AWS'S completed audit reports — never confuse the two.

• IAM is a free, global service: authentication proves who you are; authorization (policies) decides what you can do.
• Users hold long-term credentials, groups organize users for shared permissions, roles are assumed temporarily with no long-term credentials, policies are JSON permission documents.
• Protect the root user: strong password, MFA, no access keys, never use it for daily work.
• Root-only tasks include closing the account, changing account/root settings, and changing the Support plan.
• Least privilege: grant only the permissions required — the narrower answer is usually the correct one.
• An application on EC2 or Lambda that needs AWS access gets an IAM role — never stored access keys.
• Cross-account access uses roles, not duplicated users; federation lets external identities assume roles without becoming IAM users.
• IAM Identity Center = single sign-on for the workforce across multiple accounts; Secrets Manager rotates secrets automatically, Parameter Store stores config and secrets simply.

• Security groups are stateful instance-level firewalls with allow rules only; all rules are evaluated together.
• Network ACLs are stateless subnet-level filters with allow AND deny rules, evaluated in number order, first match wins.
• The default network ACL allows all traffic; a custom network ACL denies all traffic until you add rules.
• Only a network ACL can explicitly DENY traffic — blocking a specific IP range points to the NACL.
• AWS WAF is a layer-7 web application firewall: web ACLs on CloudFront, ALB, or API Gateway block SQL injection and XSS.
• Third-party security products (firewalls, endpoint protection, SIEM) come from AWS Marketplace, billed through your AWS bill.
• AWS Trusted Advisor security checks flag open security groups, public S3 buckets, and missing root MFA; core checks are free, the full set needs Business or Enterprise support.
• Quick answers → AWS Knowledge Center; announcements and deep dives → AWS Security Blog; whitepapers and bulletins → AWS security resource pages.

Cloud Technology and Services

• Every access method — Console, CLI, SDKs, IaC — ultimately makes calls to the same AWS APIs over HTTPS.
• Management Console = human, visual, one-time or infrequent tasks; sign in with password + MFA.
• AWS CLI = terminal commands and scripts for repeatable admin automation; SDKs = AWS calls from application code.
• AWS CloudFormation templates provision entire environments repeatably, consistently, and under version control — the IaC answer on CLF-C02.
• One-time task → console is fine; anything repeated → script it (CLI) or template it (CloudFormation) for consistency and fewer errors.
• Hybrid deployment = cloud connected to on-premises; triggers are legacy systems, data residency/compliance, and gradual migration.
• Site-to-Site VPN = encrypted tunnel over the internet — fast to set up, cheaper, variable performance.
• Direct Connect = dedicated private physical link — consistent bandwidth/latency, avoids the public internet, but costs more and takes weeks to provision.

• A Region is a geographic area containing multiple isolated Availability Zones; an AZ is one or more discrete data centers with independent power, cooling, and networking.
• Availability Zones do not share single points of failure but are linked by low-latency connections — deploy across multiple AZs for high availability within a Region.
• Use multiple Regions for exactly four exam reasons: disaster recovery, business continuity, low latency for distant users, and data sovereignty.
• Data stays in the Region you put it in unless you move it — that is why Region choice answers data-residency questions.
• Edge locations number in the hundreds — far more than Regions — and serve users nearby rather than hosting your core workloads.
• CloudFront caches content at edge locations (CDN); Global Accelerator uses edge locations as static entry points onto the AWS global network for any TCP/UDP application.
• Local Zones extend a Region into a metro area for single-digit-millisecond latency; Wavelength Zones embed AWS inside telecom 5G networks; Outposts puts AWS hardware on your premises.
• Trap check: availability during component failure = multiple AZs; regional disaster, global users, or legal residency = multiple Regions.

• EC2 = virtual servers with full OS control; you patch, size, and scale them, and they suit long-running workloads.
• Instance families by trigger: compute optimized = CPU-heavy (batch, gaming, HPC); memory optimized = in-memory datasets; storage optimized = high local disk I/O (data warehousing); accelerated = GPUs/ML; general purpose = balanced.
• Lambda runs short, event-driven functions with zero server management and pay-per-use billing; choose EC2 instead for long-running or full-control workloads.
• Fargate is serverless compute for containers under ECS or EKS — Lambda runs functions, Fargate runs containers.
• ECS is AWS-native container orchestration; EKS is managed Kubernetes — pick EKS whenever the question says Kubernetes or portability.
• Auto scaling adjusts capacity to demand — that is elasticity; a load balancer distributes traffic across existing targets for availability and fault tolerance.
• ELB types at a glance: ALB = HTTP/HTTPS (layer 7), NLB = TCP/UDP (layer 4), Gateway LB = third-party network appliances.
• One-liners: Elastic Beanstalk = upload code, AWS provisions everything; Lightsail = simple VPS at a fixed monthly price; AWS Batch = managed batch job execution.

• Database on EC2 = full control (any engine/version, OS access) but you patch, back up, and scale it; managed services shift that work to AWS.
• Amazon RDS = managed relational service for MySQL, PostgreSQL, MariaDB, SQL Server, and Oracle; Multi-AZ is for availability, read replicas are for read scaling.
• Amazon Aurora = MySQL/PostgreSQL-compatible RDS engine with higher performance and storage replicated across three AZs; Aurora Serverless auto-scales capacity.
• Amazon DynamoDB = serverless NoSQL key-value/document database with single-digit millisecond latency at any scale — no instances to manage.
• "SQL, joins, transactions" = RDS/Aurora; "key-value, flexible schema, any scale" = DynamoDB.
• Amazon ElastiCache = managed Redis/Memcached for caching and session stores; MemoryDB = Redis-compatible durable primary database.
• AWS DMS moves the data with the source still live; AWS SCT converts schema and code between different engines.
• Same-engine migration = DMS alone; cross-engine (heterogeneous) migration = SCT first, then DMS.

• Amazon VPC is your logically isolated virtual network in AWS; you define the IP range and split it into subnets, each in exactly one Availability Zone.
• Public subnet = route to an internet gateway; private subnet = no direct internet route.
• Internet gateway enables two-way VPC-to-internet traffic; NAT gateway gives private subnets outbound-only internet access.
• Security groups filter traffic at the instance level; network ACLs filter at the subnet level — two VPC security layers.
• Route 53 is DNS: it translates domain names to IP addresses, registers domains, and routes traffic using health checks and routing policies.
• CloudFront is a CDN that caches content at edge locations; Global Accelerator speeds up TCP/UDP connections over AWS's global network with static anycast IPs.
• Site-to-Site VPN = encrypted tunnels over the internet; Direct Connect = dedicated private physical link to AWS.
• Client VPN connects individual remote users; Site-to-Site VPN connects entire networks.

• Match the storage shape first: S3 = objects via API, EBS = block disk for one EC2 instance, EFS/FSx = shared file systems.
• S3 is designed for 11 nines (99.999999999%) durability, virtually unlimited capacity, and shines for backups, static websites, data lakes, and media.
• Pick S3 classes by access pattern: Standard (frequent), Standard-IA (infrequent + instant), One Zone-IA (re-creatable), Intelligent-Tiering (unknown pattern).
• Pick Glacier tiers by retrieval time: Instant Retrieval (milliseconds), Flexible Retrieval (minutes–hours), Deep Archive (hours, cheapest, compliance retention).
• Lifecycle policies automatically transition aging objects to cheaper classes and expire them — the default answer for S3 cost optimization over time.
• EBS persists through stop/start and snapshots to S3; instance store is ephemeral and lost on stop or termination — 'temporary/scratch data' means instance store.
• EFS is elastic shared NFS for thousands of Linux instances; FSx for Windows File Server = SMB/Active Directory; FSx for Lustre = HPC.
• Storage Gateway = on-premises access to cloud storage with local caching (hybrid); AWS Backup = centralized policy-based backup across EBS, RDS, DynamoDB, EFS, and more.

• SageMaker is the platform to build, train, and deploy YOUR OWN ML models; every other AI service is a pre-trained API you just call.
• Transcribe = speech to text; Polly = text to speech; Translate = between languages; Comprehend = sentiment and meaning from text.
• Rekognition analyzes photos and videos; Textract extracts text and form data from scanned documents; Lex builds chatbots; Kendra is natural-language enterprise search.
• Athena runs serverless SQL directly on data in S3, pay per query; Redshift is the data warehouse you load data into for petabyte-scale analytics.
• "Real time" or "streaming" in an analytics question means Kinesis; "Apache Kafka" means MSK; "Spark or Hadoop" means EMR.
• AWS Glue is serverless ETL plus the data catalog; QuickSight is the BI dashboard and visualization service.
• OpenSearch Service is full-text search and log analytics for applications; Kendra is ML-powered question-answering search over company documents.
• AWS Data Exchange is where you find and subscribe to third-party data sets.

• SQS is a pull-based message queue (one consumer per message, buffers and decouples); SNS is push-based pub/sub (one message fanned out to many subscribers).
• Fan-out pattern: publish once to an SNS topic, deliver copies to multiple SQS queues for independent processing.
• EventBridge routes events between AWS services, SaaS apps, and custom apps using rules; Step Functions orchestrates multi-step workflows visually.
• Contact center = Amazon Connect; bulk or transactional email = Amazon SES.
• Startup credits = Activate; hire third-party certified freelancers = IQ; AWS operates your infrastructure = AMS; help from AWS engineers = AWS Support.
• CI/CD by stage: CodeCommit (Git) → CodeBuild (build/test) → CodeDeploy (deploy) → CodePipeline (orchestrate); CodeArtifact stores packages; X-Ray traces requests; AppConfig manages feature flags.
• Full virtual desktop = WorkSpaces; stream a single application = AppStream 2.0; secure browser to internal sites = WorkSpaces Web.
• GraphQL = AppSync; build/host full-stack apps fast = Amplify; connect devices to the cloud = IoT Core; compute on devices, even offline = IoT Greengrass.

Billing, Pricing, and Support

• Steady, predictable workloads running a year or more → Reserved Instances or Savings Plans, up to 72% off On-Demand.
• Fault-tolerant, interruptible workloads (batch, CI, analytics) → Spot Instances, up to 90% off, reclaimable with a two-minute warning.
• Unpredictable, short-term, or first-time workloads → On-Demand: no commitment, most flexible, most expensive long-run.
• Standard RI = bigger discount, less flexible; Convertible RI = exchangeable (family/OS/tenancy) for a smaller discount; more money upfront = bigger discount.
• Compute Savings Plans are the most flexible commitment — any EC2 family, size, or Region, plus Fargate and Lambda; EC2 Instance Savings Plans trade flexibility for a deeper discount.
• Dedicated Host = whole physical server with socket/core visibility for BYOL licensing; Dedicated Instance = isolated hardware without host visibility; Capacity Reservation = guaranteed AZ capacity with no discount.
• Under AWS Organizations consolidated billing, unused RI and Savings Plans discounts are shared across all accounts by default, and aggregated usage reaches volume-discount tiers sooner.
• Data transfer: inbound from the internet is free; outbound to the internet, cross-Region, and cross-AZ transfers are charged; same-AZ private-IP traffic is typically free.

• Match by tense: estimate BEFORE = Pricing Calculator; alert DURING = AWS Budgets; analyze AFTER = Cost Explorer; deepest data = CUR.
• AWS Pricing Calculator is a free public web tool — no AWS account needed — for estimating a planned architecture's cost.
• AWS Budgets alerts via email or SNS on actual OR forecasted cost, usage, and RI/Savings Plans utilization or coverage thresholds.
• AWS Cost Explorer visualizes historical spend, filters/groups by service, account, and tag, and forecasts future costs from history.
• The Cost and Usage Report is the most detailed billing data AWS provides — per-resource, per-hour line items delivered to an S3 bucket.
• Consolidated billing gives one bill for all Organizations accounts, combines usage toward volume discounts, and shares RI/SP discounts — at no extra charge.
• AWS Billing Conductor produces pro-forma billing data at custom rates for resellers and chargeback; it never changes the real AWS bill.
• Cost allocation tags (AWS-generated and user-defined) must be ACTIVATED in the Billing console before they appear in Cost Explorer and the CUR.

• Cheapest plan with 24/7 phone/chat access to support engineers: Business; cheapest with any technical support at all: Developer (business-hours email).
• Any TAM access (pool) starts at Enterprise On-Ramp; a designated TAM and the Concierge Support Team require Enterprise.
• Response-time ladder: production down under 1 hour (Business), business-critical down under 30 minutes (On-Ramp), under 15 minutes (Enterprise).
• Full Trusted Advisor checks and the AWS Health API require Business Support or higher; core checks and the Health Dashboard are free for all.
• AWS Health Dashboard shows events and maintenance affecting your account; re:Post is the community Q&A that replaced AWS Forums.
• Prescriptive Guidance = proven strategies and patterns from AWS experts and Partners; Knowledge Center = answers to the most frequent support questions.
• Report spam, attacks, or malware from AWS resources to the AWS Trust & Safety team — not through a support case.
• APN: ISVs build software (sold via AWS Marketplace); system integrators design, migrate, and manage workloads; Professional Services delivers enterprise engagements.

Yes — the whole CLF-C02 deck is free and needs no account. Create a free account only if you want to save progress and drill full practice questions and mock exams.