AWS Certified Cloud Practitioner (CLF-C02) Study Guide

Comprehensive vocabulary flashcards covering AWS Certified Cloud Practitioner (CLF-C02) core concepts across all four exam domains: Cloud Concepts, Security and Compliance, Cloud Technology and Services, and Billing, Pricing, and Support.

Cloud Computing

The on-demand delivery of IT resources over the internet with pay-as-you-go pricing, renting compute, storage, and databases instead of buying and running physical data centers.

Public Cloud

A cloud deployment model where all infrastructure and resources run entirely in the cloud provider's environment (such as AWS).

Hybrid Cloud

A deployment model connecting on-premises infrastructure to cloud resources (for example, using AWS Direct Connect or VPN).

On-Premises (Private Cloud)

A deployment model where all IT infrastructure and computing resources run within an organization's own physical data center.

Infrastructure as a Service (IaaS)

A cloud service model where the customer manages the operating system, applications, and runtime, while the provider manages physical hardware (e.g., Amazon EC2).

Platform as a Service (PaaS)

A cloud service model where AWS manages the underlying platform, hardware, and operating system, leaving the customer to manage only the application and data (e.g., AWS Elastic Beanstalk, Amazon RDS).

Software as a Service (SaaS)

A cloud service model providing a complete, centrally hosted end-user application managed entirely by the vendor (e.g., Amazon Chime, Amazon WorkMail).

Elasticity

The cloud capability to automatically add and remove computing resources to dynamically match fluctuating demand.

Scalability

The ability of a system to handle workload growth, either vertically (upgrading to a bigger machine) or horizontally (adding more machines).

High Availability

A system's ability to remain operational and accessible despite component failures, typically achieved by deploying across multiple Availability Zones.

Fault Tolerance

The property that enables a system to continue operating properly without interruption even when one or more underlying components fail.

Capital Expenditure (CapEx)

Upfront, fixed financial investment in physical assets such as servers and data centers, characteristic of traditional on-premises IT.

Operational Expenditure (OpEx)

Ongoing, pay-as-you-go operational expenses tied directly to usage, characteristic of the cloud computing economic model.

Total Cost of Ownership (TCO)

The comprehensive cost of running an IT environment over time, encompassing physical hardware, power, real estate/space, and administrative staff.

Right-Sizing

The cost-optimization practice of matching resource types and sizes to actual workload performance requirements to avoid overpaying.

AWS Cloud Adoption Framework (AWS CAF)

Guidance structured into six perspectives (Business, People, Governance, Platform, Security, Operations) to help organizations plan and execute a successful cloud migration.

Rehost (Lift and Shift)

A migration strategy that moves an existing application directly to AWS without making any architectural or code changes.

Replatform (Lift, Tinker, and Shift)

A migration strategy involving small optimizations to gain cloud benefits without altering core application architecture (such as moving a self-managed database to Amazon RDS).

Refactor / Re-architect

A migration strategy that completely redesigns an application to run natively on cloud architecture and services.

AWS Well-Architected Framework

A guide based on six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability.

Shared Responsibility Model

A security model establishing that AWS is responsible for security OF the cloud (physical infrastructure, hardware, hypervisors), while the customer is responsible for security IN the cloud (customer data, IAM, guest OS, network firewalls, and application code).

AWS Root User

The identity created with initial account setup having unrestricted administrative access to all AWS services and resources; must be protected with MFA and locked away.

IAM Role

An IAM identity granted temporary security credentials that can be assumed by users, applications, or AWS services (such as an EC2 instance accessing S3).

Security Group

A virtual, stateful firewall that controls inbound and outbound traffic at the individual Amazon EC2 instance level, supporting allow rules only.

Network Access Control List (NACL)

A virtual, stateless firewall operating at the subnet level that evaluates both allow and deny rules explicitly for inbound and outbound traffic.

AWS WAF (Web Application Firewall)

A security service that monitors and filters HTTP/HTTPS web requests forwarded to protected resources to block common web exploits like SQL injection and cross-site scripting.

AWS Shield

A managed Distributed Denial of Service (DDoS) protection service available as Standard (free and automatic) or Advanced (paid with specialized response support).

AWS KMS (Key Management Service)

A managed service that creates and controls cryptographic keys used to encrypt data across AWS services and applications.

AWS CloudHSM

A dedicated, single-tenant hardware security module fully controlled by the customer to meet strict regulatory and compliance requirements.

AWS Secrets Manager

A security service that securely stores, rotates, manages, and retrieves database credentials, API keys, and other secrets throughout their lifecycle.

Amazon GuardDuty

An intelligent threat detection service that continuously monitors and analyzes CloudTrail events, VPC Flow Logs, and DNS logs for malicious activity.

Amazon Inspector

An automated security assessment and vulnerability scanning service for Amazon EC2 instances, container images, and AWS Lambda functions.

Amazon Macie

A fully managed data security and privacy service that uses machine learning to discover, classify, and protect sensitive data (such as PII) stored in Amazon S3.

AWS Security Hub

A central security tool that aggregates, organizes, and prioritizes security alerts and compliance findings from multiple AWS services and third-party tools.

AWS Artifact

An on-demand self-service portal used to retrieve and download AWS compliance reports (e.g., SOC, ISO, PCI DSS) and manage legal agreements.

AWS CloudTrail

A governance and auditing service that logs, monitors, and retains account API activity, tracking who made which request and when.

AWS Config

A service that records resource configuration changes over time and evaluates compliance against desired baseline rules.

Amazon CloudWatch

A monitoring and management service that tracks operational metrics, centralizes log files, and triggers alarms based on resource performance.

AWS Trusted Advisor

An online guidance tool that inspects AWS environments and provides real-time recommendations across five categories: cost optimization, performance, security, fault tolerance, and service limits.

AWS Region

A distinct physical geographic area consisting of multiple isolated, physically separated, and interconnected Availability Zones.

Availability Zone (AZ)

One or more discrete data centers located within a Region, engineered with redundant power, networking, and connectivity.

Edge Location

A globally distributed site used by services like Amazon CloudFront and Amazon Route 53 to cache content and reduce latency for end users.

Amazon EC2

Elastic Compute Cloud; a web service providing resizable, secure virtual servers (instances) in the cloud with full operating system control.

On-Demand Instances

An EC2 purchasing option where compute capacity is billed per second or hour with no upfront cost or long-term commitment, best for short-term or unpredictable workloads.

Reserved Instances (RIs)

An EC2 purchasing option requiring a $1$- or $3$-year commitment that offers up to approximately $72\%$ savings compared to On-Demand rates for steady-state workloads.

Spot Instances

An EC2 purchasing option that lets you take advantage of spare compute capacity at discounts up to $90\%$, subject to interruption with short notice.

Dedicated Hosts

A physical EC2 server dedicated exclusively to one customer's use, frequently utilized to satisfy strict regulatory compliance or server-bound software licenses.

AWS Lambda

A serverless compute service that runs code automatically in response to events for a maximum runtime of $15\text{ minutes}$, charging solely for execution time.

AWS Elastic Beanstalk

A Platform as a Service (PaaS) solution that handles deployment, capacity provisioning, load balancing, auto-scaling, and health monitoring once application code is uploaded.

Amazon S3

Simple Storage Service; an object storage service designed for $99.999999999\%$ ($11\text{ nines}$) durability, storing data as objects within buckets.

S3 Intelligent-Tiering

An S3 storage class that automatically optimizes storage costs by moving data between access tiers based on changing or unknown access patterns.

Amazon EBS (Elastic Block Store)

High-performance block storage volumes attached to a single EC2 instance within the same Availability Zone, acting like a virtual hard drive.

EC2 Instance Store

Temporary, ephemeral block-level storage physically attached to the host hardware of an EC2 instance that is deleted when the instance stops or terminates.

Amazon EFS (Elastic File System)

A serverless, fully managed Network File System (NFS) that scales automatically and can be mounted concurrently across multiple EC2 instances and Availability Zones.

AWS Snow Family

A collection of physical hardware appliances (Snowcone, Snowball, and Snowmobile) designed to transfer petabytes to exabytes of data offline into AWS.

Amazon RDS

Relational Database Service; a managed service that automates provisioning, patching, backups, and recovery for engines like MySQL, PostgreSQL, Oracle, and SQL Server.

Amazon Aurora

An AWS-engineered cloud-native relational database engine compatible with MySQL and PostgreSQL, delivering up to $5\times$ and $3\times$ speed improvements respectively.

Amazon DynamoDB

A fully managed, serverless NoSQL key-value and document database that provides predictable, single-digit millisecond latency at any scale.

Amazon Redshift

A fully managed, petabyte-scale cloud data warehouse designed for high-performance online analytical processing (OLAP) and business intelligence queries.

Amazon ElastiCache

A managed in-memory data store supporting Redis and Memcached, used to accelerate read-heavy database performance by caching frequently accessed data.

Amazon VPC (Virtual Private Cloud)

A logically isolated virtual network dedicated to an AWS account where AWS compute and networking resources are securely deployed.

NAT Gateway

A managed networking service that allows private subnet resources to initiate outbound connections to the internet while blocking unsolicited inbound connections.

Amazon Route 53

A highly available and scalable cloud Domain Name System (DNS) web service that translates human-readable domain names into numerical IP addresses.

Amazon CloudFront

A Content Delivery Network (CDN) service that caches data, videos, applications, and APIs at edge locations worldwide to minimize delivery latency.

AWS Direct Connect

A dedicated physical network connection linking on-premises corporate data centers directly to AWS, bypassing the public internet for consistent throughput.

Amazon Athena

An interactive, serverless analytics service that allows users to analyze data directly inside Amazon S3 using standard SQL queries.

Amazon SageMaker

A comprehensive cloud machine learning service that enables developers and data scientists to build, train, tune, and deploy custom ML models.

Amazon Bedrock

A fully managed service offering API access to industry-leading foundation models (FMs) for building and scaling generative AI applications.

Amazon SQS (Simple Queue Service)

A fully managed, pull-based message queuing service that decouples and coordinates asynchronous software components and microservices.

Amazon SNS (Simple Notification Service)

A fully managed publish/subscribe (pub/sub) messaging service that pushes notifications out to multiple subscriber endpoints, such as email, SMS, SQS, or Lambda.

Amazon EventBridge

A serverless event bus service that ingests and routes real-time application data and events from AWS services, SaaS apps, and custom systems.

AWS CloudFormation

An infrastructure-as-code (IaC) service that provisions and models AWS and third-party application resources using formatted JSON or YAML templates.

AWS Pricing Calculator

A web-based planning tool used to estimate anticipated monthly AWS costs before deploying architecture or launching services.

AWS Cost Explorer

A reporting interface that enables users to visualize, understand, and analyze historical AWS costs, spending patterns, and future forecasts.

AWS Budgets

A cost tracking tool that allows organizations to define custom spending and usage limits, automatically generating alerts when limits are breached or forecasted to be exceeded.

Consolidated Billing

A feature of AWS Organizations that aggregates usage across multiple member accounts into a single bill, maximizing volume pricing discounts and benefit sharing.

AWS Enterprise Support

The top-tier support plan providing $24/7$ technical assistance, a designated Technical Account Manager (TAM), a Concierge support team, and a $15\text{-minute}$ response time target for business-critical system down events.