Browse AWS Certification Guides

AWS CLF-C02 Cheat Sheet: Cloud Services, Security, and Pricing

March 28, 2026

AWS CLF-C02 cheat sheet for AWS cloud concepts, core services, shared responsibility, security, billing, pricing, support plans, and final review traps.

On this page

Keep this cheat sheet open while drilling questions. CLF‑C02 rewards clear definitions, best-fit service choices, and pricing/support reasoning more than deep implementation details.

Cloud decision flow

Use this when an answer choice is really asking you to classify the service, boundary, or pricing pattern first.

    flowchart TD
	  Q["Scenario"] --> C["Cloud concept, security boundary, service category, or pricing/support?"]
	  C --> S["Pick the AWS service or concept that matches the requirement"]
	  S --> E["Reject answers that are correct in general but miss the stated constraint"]

Rule: if the answer is true in AWS generally but not the best fit for the scenario, it is still wrong.

Scenario eliminations

Stem clue Eliminate first Keep in play
object storage, static assets, backups, or data lake EBS or EFS by default Amazon S3 and storage class choices
virtual server or OS control Lambda as the first answer Amazon EC2
event-driven code with no server management EC2 instance management AWS Lambda
managed relational database self-managed database on EC2 Amazon RDS or Aurora
key-value access at scale relational database by habit DynamoDB
private VPC access to S3 or DynamoDB NAT gateway as the default path gateway VPC endpoint
compliance reports and agreements CloudTrail or CloudWatch AWS Artifact
Technical Account Manager Basic, Developer, or Business Support Enterprise Support

CLF-C02 answer choices often include services from the right general area but the wrong category. Classify the workload first: compute, storage, database, network, security, management, billing, or support.

Exam-day classification ladder

Use this ladder before comparing answer choices. CLF-C02 rarely requires deep configuration; it usually asks whether you can place the requirement in the right AWS category.

First question If yes, think… Common wrong turn
Is this about who owns security or operations? shared responsibility model choosing a service when the question asks for a boundary
Is this about where data is stored? object, block, file, database, warehouse, archive treating all storage as S3 or all databases as RDS
Is this about running code or workloads? EC2, Lambda, containers, Beanstalk, Lightsail choosing serverless when OS control is required
Is this about connecting or routing traffic? VPC, Route 53, ELB, CloudFront, VPN, Direct Connect confusing DNS, load balancing, CDN, and private connectivity
Is this about seeing activity or health? CloudTrail, CloudWatch, Config, AWS Health using CloudWatch for audit or CloudTrail for performance
Is this about cost before or after deployment? Pricing Calculator before, Cost Explorer after, Budgets for alerts using the billing invoice as the planning tool
Is this about support or official guidance? support plan, Well-Architected, re:Post, Artifact choosing a paid support plan when the question asks for documents

Shared responsibility traps

Stem wording AWS owns Customer owns
“physical security of facilities” data centers, hardware, power, cooling choosing a Region and using services correctly
“EC2 operating system patching” underlying host and virtualization guest OS, installed packages, application patches
“RDS database engine infrastructure” managed platform and underlying hosts database users, data, network access, parameter choices
“S3 data exposure” durable S3 service infrastructure bucket policy, public access settings, object permissions, encryption choices
“Lambda scaling and servers” server fleet, runtime infrastructure, scaling mechanics function code, dependencies, IAM role, environment variables
“compliance evidence” AWS reports and attestations through Artifact mapping those reports to the customer’s controls and audits

High-yield rule: the more managed the service is, the less infrastructure you patch, but you still own identity, data, configuration, and business compliance.

Similar-service eliminations

If the options include… Choose based on… Quick elimination rule
S3 vs EBS vs EFS object vs block vs shared file EBS attaches to EC2; EFS is shared file; S3 stores objects.
RDS vs DynamoDB vs Redshift transactions vs key-value vs analytics Redshift is not for OLTP; DynamoDB is not for arbitrary joins.
CloudFront vs Route 53 vs ELB cache/edge vs DNS vs load balancing Route 53 routes names; it does not cache content.
CloudTrail vs CloudWatch vs Config API audit vs metrics/logs/alarms vs config history “Who did what?” is CloudTrail. “How is it performing?” is CloudWatch.
Artifact vs Inspector vs GuardDuty compliance documents vs vulnerabilities vs threat findings Artifact is paperwork/evidence, not a scanner.
Budgets vs Cost Explorer vs Pricing Calculator alerts vs historical analysis vs estimates Budgets alerts; Pricing Calculator estimates before use.

CLF-C02 answer sequence

Use this when the stem is mostly a service or pricing classification problem.

    flowchart TD
	  S["Scenario"] --> C["Classify the requirement"]
	  C --> M["Match the AWS service or concept"]
	  M --> O["Check who manages what"]
	  O --> P["Check pricing, support, or availability"]
	  P --> E["Reject answers that miss the constraint"]

Quick facts (CLF-C02)

I verified these current AWS exam facts on May 17, 2026.

Item Value
Questions 65 total
Scoring 50 scored + 15 unscored (unscored items are not identified)
Question types Multiple choice and multiple response
Time 90 minutes
Passing score 700 (scaled 100–1000)
Cost 100 USD

Domain weights and review priority

Domain Weight What to compress for final review
Cloud Concepts 24% cloud value, elasticity, global infrastructure, migration, Well-Architected ideas
Security and Compliance 30% shared responsibility, IAM, encryption, logging, compliance reports, core security services
Cloud Technology and Services 34% compute, storage, database, networking, analytics, AI/ML, integration, management services
Billing, Pricing, and Support 12% pricing models, budgets, Cost Explorer, support plans, Trusted Advisor, AWS Health

The biggest domain is Cloud Technology and Services, but Security and Compliance is close behind. The exam is not asking you to design advanced systems; it is asking you to classify AWS services and explain who manages what.

Official task compression

Domain Official task pattern What to remember under time pressure
Cloud Concepts value of cloud, global infrastructure, cloud economics, CAF, Well-Architected Explain why cloud helps: agility, elasticity, global reach, reliability, security, and pay-as-you-go cost model.
Security and Compliance shared responsibility, IAM, security services, compliance resources Always separate what AWS secures from what the customer configures, owns, or audits.
Cloud Technology and Services compute, storage, networking, databases, analytics, AI/ML, management Classify the service category first, then choose the simplest AWS service that matches the use case.
Billing, Pricing, and Support pricing models, cost tools, consolidated billing, support plans, Trusted Advisor Match the question to the right financial tool or support tier; do not overthink architecture.

How CLF-C02 questions work (fast strategy)

  • Many options are “true” statements—pick the one that best matches the requirement (for example: lowest cost, least operational effort, highest availability).
  • If two services look similar, the exam often tests the category (“object vs block vs file”) or the managed level (“AWS runs it vs you run it”).
  • Read the last sentence first to capture the constraint, then eliminate choices that violate it.

Question-type traps

Question type Exam-day habit
Multiple choice Pick the service or concept that directly matches the requirement, not the most advanced option.
Multiple response Each selected option must satisfy the question; one extra plausible-but-wrong option makes the response wrong.

Unanswered questions are incorrect and there is no penalty for guessing. Answer every item, mark uncertain ones, and return after the easier service-fit questions are done.

Final 20-minute recall (exam day)

Cue -> best answer (pattern map)

If the question says… Usually best answer
Managed virtual servers Amazon EC2
Event-driven code without server management AWS Lambda
Object storage, durable and scalable Amazon S3
Managed relational database Amazon RDS
Key-value/document database at scale Amazon DynamoDB
Private access to S3/DynamoDB from VPC Gateway VPC endpoint
DDoS baseline protection AWS Shield Standard
Compliance reports and attestations AWS Artifact
Budget alerts or spend thresholds AWS Budgets
Need TAM / highest support level Enterprise Support

Service category chooser

Requirement wording Category first Likely service family
“Run virtual machines” or “full OS control” Compute EC2
“Run code on events without servers” Serverless compute Lambda
“Run containers without managing servers” Containers ECS/Fargate
“Store objects, backups, static assets” Object storage S3
“Attach storage to one EC2 instance” Block storage EBS
“Shared file system” File storage EFS or FSx
“Managed relational database” Database RDS or Aurora
“Key-value at scale” NoSQL database DynamoDB
“DNS and domain routing” Networking Route 53
“Cache content globally” Edge/CDN CloudFront
“Audit API activity” Governance/security CloudTrail
“Metrics, logs, alarms” Operations CloudWatch

Must-memorize CLF distinctions

Topic Fast recall
Shared responsibility AWS secures cloud infrastructure; customer secures workloads, data, IAM, config
Support plans Basic < Developer < Business < Enterprise
Pricing models On-Demand, Savings Plans/Reserved, Spot
Core reliability pattern Multi-AZ for high availability
Storage categories Object (S3), block (EBS), file (EFS/FSx)
RTO vs RPO RTO = restore time, RPO = acceptable data loss

Last-minute traps

  • Confusing AWS Health Dashboard (account-specific) with public Service Health Dashboard.
  • Choosing self-managed options when question says least operational effort.
  • Picking NAT instead of VPC endpoint for private S3/DynamoDB access.
  • Mixing up support plan features (TAM is Enterprise only).

1) Cloud concepts (Domain 1 — 24%)

1.1 Benefits of the AWS Cloud

  • Agility: provision resources in minutes, not weeks.
  • Elasticity: scale out/in as demand changes.
  • Global reach: deploy to Regions worldwide; use edge services for global performance.
  • Reliability: build across multiple AZs; design for failure.
  • Security: AWS runs secure data centers; you apply identity, encryption, and configuration controls.
  • Cost: trade CAPEX for OPEX; pay for what you use; access economies of scale.

1.2 AWS Cloud design principles (high yield)

Core principles you’ll see phrased in different ways:

  • Design for failure: assume components fail; build redundancy (multi-AZ).
  • Loose coupling: decouple with queues/events; reduce “blast radius”.
  • Elastic architecture: scale automatically; avoid fixed capacity assumptions.
  • Automate everything: infrastructure as code, scripted operations, repeatability.
  • Use managed services: reduce undifferentiated heavy lifting (patching, HA, backups).
  • Optimize for cost: right-size and align usage to pricing models.

Key definitions (frequently tested):

Term Meaning (exam-friendly)
High availability (HA) System stays available during failures (often multi-AZ).
Fault tolerant (FT) Continues operating with minimal/no interruption when components fail.
Scalability Ability to grow capacity to meet demand (vertical or horizontal).
Elasticity Automatically match capacity to demand (scale out/in).
RTO Recovery Time Objective (how long downtime is acceptable).
RPO Recovery Point Objective (how much data loss is acceptable).

Simple HA mental model:

    flowchart LR
	  U[Users] --> LB[Load Balancer]
	  LB --> AZ1[App in AZ1]
	  LB --> AZ2[App in AZ2]
	  AZ1 --> DB[(Managed DB Multi-AZ)]
	  AZ2 --> DB

Well-Architected pillars (recognize the keywords)

Pillar What it’s about (CLF level)
Operational Excellence Operate and improve: automation, runbooks, incident response, postmortems
Security Protect: IAM, least privilege, encryption, logging/monitoring
Reliability Recover and scale: multi-AZ, backups, DR, change management
Performance Efficiency Use resources efficiently: right services, caching, scaling, measurement
Cost Optimization Avoid waste: right sizing, purchase options, managed services, tagging
Sustainability Reduce environmental impact: efficient architectures and resource usage

1.3 Migration to AWS (strategy + common tools)

The “6 Rs” show up a lot in wording:

Strategy Meaning Typical goal
Rehost Lift-and-shift Fastest migration
Replatform Minor optimization Quick wins with limited change
Refactor / re-architect Redesign for cloud-native Best long-term benefits
Repurchase Move to SaaS Replace app with managed SaaS
Retire Decommission Reduce scope and cost
Retain Keep as-is Delay due to constraints

AWS Cloud Adoption Framework (CAF) (high level):

Perspective Focus
Business Value realization and outcomes
People Skills, roles, organizational change
Governance Decision-making, risk, compliance, controls
Platform Architecture, infrastructure, and foundational services
Security Security strategy and controls
Operations Operating model, incident/change management

Common migration services (high level):

  • AWS Migration Hub: track migrations and progress.
  • AWS Application Migration Service (MGN): move servers (lift-and-shift).
  • AWS Database Migration Service (DMS): migrate databases (often with minimal downtime).
  • AWS Snow Family: offline data transfer when bandwidth is limited.
  • AWS Storage Gateway: hybrid storage integration (on-prem ↔ AWS storage).

1.4 Cloud economics (CAPEX vs OPEX + TCO)

Concept What to remember
CAPEX Up-front spend (data centers, servers).
OPEX Ongoing spend (pay-as-you-go cloud bills).
TCO Total cost of ownership (hardware + people + operations + downtime risk).
Economies of scale AWS can buy/run infrastructure cheaper at scale.
Right sizing Match capacity to actual usage to reduce waste.

Cost optimization habits (often the “best answer”):

  • Turn off resources you don’t use (dev/test schedules).
  • Use managed services to reduce ops cost.
  • Choose the right pricing model (Savings Plans/RIs for steady usage, Spot for interruptible workloads).
  • Use storage lifecycle policies (move cold data to cheaper tiers).

2) Security and compliance (Domain 2 — 30%)

2.1 Shared responsibility model (the CLF must-know)

AWS is responsible for security of the cloud (facilities, hardware, managed service infrastructure).
You are responsible for security in the cloud (data, identity, configs, and anything you deploy).

How responsibility shifts with service model:

Model Example services You manage AWS manages
IaaS EC2, EBS, VPC Guest OS, patching, configs, apps, data Data centers, hardware, virtualization
PaaS/Managed RDS, ECS/Fargate, DynamoDB Data, identities, access controls, configs OS/platform (varies), HA primitives
Serverless Lambda, SQS, SNS Code + data + permissions Servers, OS, scaling, infra

High-yield rule: you’re always responsible for data classification, IAM, and configuration.

Shared responsibility quick chooser

Question asks who is responsible for… CLF-C02 answer
Physical data center, power, hardware, and global infrastructure AWS
EC2 guest OS patching and installed application security Customer
IAM users, roles, permissions, and MFA decisions Customer
Data classification, encryption choices, and access configuration Customer
Managed service infrastructure and underlying host patching AWS
Database data, users, and access policies in RDS/DynamoDB Customer
S3 bucket public access, bucket policies, and lifecycle rules Customer
Compliance reports and AWS audit documents AWS provides them through AWS Artifact; customer uses them for their compliance work

2.2 Security, governance, and compliance concepts

Security basics that show up in CLF language:

  • Least privilege: grant only what’s needed.
  • Defense in depth: multiple layers (identity + network + encryption + monitoring).
  • CIA triad: confidentiality, integrity, availability.
  • Compliance and audits: AWS provides reports/artifacts; you must configure and operate securely.

Where to get compliance reports:

  • AWS Artifact: on-demand access to compliance reports and agreements.

Control types (useful for matching to services):

Control type Goal Examples
Preventive Stop bad things IAM/SCPs, security groups, encryption, WAF
Detective Detect and alert CloudTrail, Config, GuardDuty, Security Hub
Corrective Fix automatically Automation runbooks, backups/restore, remediation workflows

2.3 AWS access management capabilities (IAM at a glance)

IAM concept What it is What it’s for
Root user Highest-privilege account identity Protect with MFA; don’t use day-to-day
User Human identity Prefer federation/Identity Center where possible
Group Collection of users Attach policies to groups to simplify access
Role Temporary identity assumed by people/services Preferred for apps and cross-account access
Policy Permission document Defines what actions on what resources
MFA Extra login factor Common “best practice” answer

High-yield best practices:

  • Enable MFA on root; lock away root credentials.
  • Prefer roles and temporary credentials over long-lived access keys.
  • Use AWS IAM Identity Center (formerly AWS SSO) for centralized workforce access.

2.4 Security services (what each one is “for”)

Service Best one-liner for CLF-C02
AWS KMS Create/manage encryption keys (customer-managed keys).
AWS CloudHSM Dedicated HSM hardware for stricter key control.
AWS Secrets Manager Store and rotate secrets (DB creds, API keys).
AWS Certificate Manager (ACM) Provision/manage TLS certificates.
AWS WAF Web application firewall (L7 filtering).
AWS Shield DDoS protection (Standard by default; Advanced adds more).
Amazon GuardDuty Threat detection using logs (findings).
AWS Security Hub Aggregate security findings and posture checks.
Amazon Inspector Vulnerability scanning (instances/containers).
Amazon Macie Discover/protect sensitive data in S3.
AWS CloudTrail Records API calls and account activity (audit).
Amazon CloudWatch Metrics, logs, alarms (operational visibility).
AWS Config Resource configuration history and compliance rules.

CloudTrail vs CloudWatch vs Config (very common):

Service Think “this answers…”
CloudTrail “Who did what?” (API activity and audit trail)
CloudWatch “How is it performing?” (metrics, logs, alarms)
Config “What changed?” (resource configuration history + compliance)

Security service evidence map

Stem clue Best first match Why
“API calls”, “account activity”, “audit trail” CloudTrail Records AWS API activity and account events.
“metrics”, “alarms”, “logs”, “performance” CloudWatch Operational visibility and alerting.
“configuration changed”, “compliance rule” AWS Config Tracks resource configuration history and compliance.
“sensitive data in S3” Macie Discovers sensitive data such as PII in S3.
“web application attacks” WAF Filters HTTP(S) web requests.
“DDoS protection” Shield Baseline DDoS protection is Shield Standard.
“vulnerability findings” Inspector Assesses vulnerabilities for supported workloads.
“threat detection findings” GuardDuty Detects suspicious activity using logs and threat intelligence.
“aggregate security posture” Security Hub Centralizes and normalizes security findings.
“store and rotate database passwords” Secrets Manager Manages secrets and rotation workflows.

Network security basics:

  • Security groups: stateful, resource-level firewall rules (most common).
  • NACLs: stateless, subnet-level rules (more coarse-grained).

3) Cloud technology and services (Domain 3 — 34%)

3.1 Deploying and operating in AWS (high level)

Cloud computing models (high-yield framing):

Model You manage AWS manages Examples
IaaS OS, apps, runtime, data Hardware + virtualization EC2
PaaS/Managed App + data (varies) More of the platform RDS, Fargate
SaaS Mostly data and users Application + platform (Many third-party SaaS; some AWS managed apps)

Cloud deployment models (conceptual):

Model Meaning
All-in cloud Workloads run in the public cloud (AWS).
Hybrid Mix of on-prem and cloud (for example, AWS + data center).
On-premises Workloads run in your own data center.
Multi-cloud Workloads span multiple cloud providers.

How you run and operate workloads:

  • AWS Management Console / CLI / SDKs: ways to interact with AWS.
  • Infrastructure as Code (IaC): repeatable provisioning (CloudFormation, CDK).
  • Monitoring: CloudWatch metrics/logs/alarms.
  • Centralized management: Systems Manager for fleet operations and automation.

3.2 AWS global infrastructure (Regions, AZs, edge)

Term Meaning
Region Geographic area with multiple AZs
Availability Zone (AZ) Isolated data centers within a Region
Edge location Content delivery/edge services (for example: CloudFront)

Related concepts you might see:

  • AWS Outposts: AWS hardware in your data center (hybrid).
  • Local Zones: bring compute/storage closer to users in a metro area.
  • Wavelength: low-latency for 5G/telecom edge.
    flowchart TB
	  Users --> Edge[Edge Location]
	  Edge --> Region[Region]
	  Region --> AZ1[AZ 1]
	  Region --> AZ2[AZ 2]

3.3 Compute services (service picker)

Service Best for “Exam phrasing” cue
EC2 Virtual servers (IaaS) “Need OS control” / “run a server”
Lambda Event-driven code “No servers to manage” / “run code on events”
ECS / EKS Containers “Run containers”
Fargate Serverless containers “Containers without managing servers”
Elastic Beanstalk App platform (PaaS-like) “Deploy app quickly”
Lightsail Simple VPS bundles “Simple workloads / beginner-friendly”

3.4 Database services (service picker)

Service Type Best for
RDS Relational Managed MySQL/PostgreSQL/etc
Aurora Relational (AWS-optimized) High performance relational on AWS
DynamoDB NoSQL Key-value/document at massive scale
Redshift Data warehouse Analytics/BI on large datasets
ElastiCache In-memory cache Speed up reads, reduce DB load

Rule of thumb:

  • Transactions and joins → relational (RDS/Aurora).
  • Massive key-value scale → DynamoDB.
  • Analytics → Redshift/Athena/QuickSight (see analytics below).

3.5 Network services (service picker)

Service Best for (CLF level)
VPC Your isolated virtual network
Route 53 DNS and domain routing
Elastic Load Balancing (ELB) Distribute traffic across targets
CloudFront CDN for caching and global delivery
Direct Connect Dedicated private connection from on-prem to AWS
Site-to-Site VPN Encrypted tunnel over the internet

3.6 Storage services (service picker)

Service Storage type Best for
S3 Object Buckets, backups, data lakes, static assets
EBS Block Storage for EC2 instances
EFS File Shared file system for Linux workloads
FSx File Managed Windows/Lustre/etc file systems
Glacier Archive Long-term, low-cost archival

S3 storage class intuition (high-level):

Class Best for
S3 Standard Frequent access
S3 Intelligent-Tiering Unknown/changing access patterns
S3 Standard-IA / One Zone-IA Infrequent access (One Zone is cheaper but less resilient)
S3 Glacier Archival/long retention

Hybrid + migration storage helpers:

  • Storage Gateway: integrate on-prem apps with S3/EBS.
  • Snowball: move large datasets offline.

3.7 AI/ML and analytics services (recognize the names)

Category Services Best one-liner
AI/ML platform SageMaker Build/train/deploy ML models
AI services Rekognition, Comprehend, Lex, Polly, Transcribe, Translate Prebuilt AI capabilities
Analytics Athena, Glue, EMR, QuickSight Query/ETL/big data/BI
Streaming Kinesis Real-time streaming ingest/processing

AI/ML and GenAI at CLF depth

Requirement wording Best fit
Use foundation models or build GenAI applications Amazon Bedrock
Build, train, and deploy custom ML models Amazon SageMaker AI
Search enterprise content with ML-powered relevance Amazon Kendra
Analyze images or video Amazon Rekognition
Extract text and forms from documents Amazon Textract
Analyze sentiment, entities, or language Amazon Comprehend
Speech-to-text Amazon Transcribe
Text-to-speech Amazon Polly
Translate text Amazon Translate

CLF-C02 usually asks you to identify the right managed capability, not to implement ML pipelines or tune models.

3.8 Other common service categories (high yield)

Application integration

  • SQS: message queue (decouple systems).
  • SNS: pub/sub notifications (fanout).
  • EventBridge: event bus/routing across services.
  • Step Functions: workflow orchestration.

Management & governance

  • CloudFormation / CDK: infrastructure as code.
  • Organizations / Control Tower: multi-account governance.
  • Trusted Advisor: best-practice checks (cost, security, performance, etc.).
  • Systems Manager: operational tooling for fleets (patching, automation, run commands).

Developer tools

  • CodeCommit / CodeBuild / CodeDeploy / CodePipeline: source, build, deploy, CI/CD pipelines.

Migration & transfer

  • Migration Hub / MGN / DMS: migration tracking, server moves, database migration.
  • Snow Family / DataSync / Storage Gateway: move data when bandwidth or hybrid constraints exist.

Customer engagement

  • SES: email sending service (transactional and marketing emails).

Quick architecture patterns (CLF level)

Static website (common pick):

    flowchart LR
	  U[Users] --> R53[Route 53]
	  R53 --> CF[CloudFront]
	  CF --> S3[(S3 Static Site)]

Typical web app (conceptual):

    flowchart LR
	  U[Users] --> R53[Route 53]
	  R53 --> CF[CloudFront]
	  CF --> LB[Load Balancer]
	  LB --> App[EC2 / Containers]
	  App --> DB[(RDS/Aurora)]

4) Billing, pricing, and support (Domain 4 — 12%)

4.1 AWS pricing models (what each is “for”)

Model Best for Key idea
On-Demand Unpredictable usage Pay by the second/hour with no commitment
Savings Plans Predictable compute spend Commit to usage for discount
Reserved Instances (RIs) Predictable, specific resources Commit to a specific resource for discount
Spot Interruptible workloads Use spare capacity at deep discount

Also know:

  • Free Tier exists (some offers are time-limited; some are “always free”).
  • Free Tier types: 12 months free, always free, and short-term trials.
  • Pricing Calculator helps estimate costs before deployment.

4.2 Billing, budget, and cost management tools

Tool Best for
Billing console Invoices, payments, account billing settings
Cost Explorer Visualize and analyze spend trends
AWS Budgets Alerts and guardrails for spend/usage
Cost and Usage Report (CUR) Most detailed cost data export
Cost allocation tags Attribute costs to teams/projects
Cost Categories Group costs logically for showback/chargeback
Organizations (consolidated billing) Central billing for multiple accounts
Trusted Advisor Best-practice recommendations (cost/security/etc.)

Cost language that appears in questions:

  • Data transfer costs can be significant (especially cross-AZ or internet egress).
  • Right size and turn off unused resources before buying commitments.

Pricing and cost-tool chooser

Stem asks for Choose Do not confuse with
Estimate cost before deployment AWS Pricing Calculator Cost Explorer, which analyzes existing spend
Analyze historical spend trends Cost Explorer Budgets, which alerts on thresholds
Alert when spend or usage crosses a threshold AWS Budgets Pricing Calculator
Most detailed billing data export Cost and Usage Report (CUR) Monthly invoice summary
Attribute cost to teams/projects Cost allocation tags IAM tags as a security boundary
Central billing for multiple accounts AWS Organizations consolidated billing Control Tower landing-zone setup
Best-practice recommendations including cost checks Trusted Advisor CloudWatch metrics
Unexpected spend spike detection Cost Anomaly Detection Manual invoice review

Purchase option chooser

Workload pattern Best pricing idea
Unknown, short-term, or unpredictable On-Demand
Predictable compute spend Savings Plans
Predictable specific resource Reserved Instances
Fault-tolerant or interruptible Spot
Idle dev/test resources Stop, schedule, or right-size before buying commitments

4.3 AWS technical resources and Support options

High-yield resources:

  • AWS Documentation, Whitepapers, Architecture Center
  • AWS Well-Architected Framework
  • AWS re:Post (community Q&A)

Public vs account-specific health views (common terminology):

View What it is
Service Health Dashboard Public status of AWS services (global view)
AWS Health / Personal Health Dashboard Account-specific events that may impact your resources

Support plan distinctions (CLF level):

Plan What to remember
Basic Included; docs/whitepapers/re:Post; Trusted Advisor core checks; AWS Health
Developer Guidance + business-hours support (good for dev/test)
Business 24/7 support; broader guidance; full Trusted Advisor
Enterprise Proactive guidance; Technical Account Manager (TAM); best for mission-critical workloads

Exam cue: TAM → Enterprise. 24/7 technical support → Business/Enterprise.

Support and learning-resource chooser

Stem clue Best answer
“official technical documentation” AWS Documentation
“best-practice architecture guidance” AWS Well-Architected Framework or Architecture Center
“community Q&A” AWS re:Post
“account-specific event affecting my resources” AWS Health
“public AWS service status” Service Health Dashboard
“compliance reports and agreements” AWS Artifact
“proactive guidance and TAM” Enterprise Support
“24/7 technical support for production workloads” Business or Enterprise Support

Next: drill by objective

  • Use Resources to keep the official exam guide and pricing/security docs nearby.
  • Use the FAQ when you need a fast reset on format, weights, and study sequence.
  • Keep this cheat sheet open while you drill so you reinforce service-fit and pricing logic instead of memorizing isolated facts.

Quiz

Loading quiz…
Revised on Monday, June 15, 2026
Study Plan
Sample Questions