AWS Certified Cloud Practitioner (CLF-C02) Study Guide

A comprehensive vocabulary list for the AWS Certified Cloud Practitioner (CLF-C02) exam covering Cloud Concepts, Security, Technology, and Billing.

Cloud computing

On-demand delivery of IT resources (compute, storage, databases, networking) over the internet with pay-as-you-go pricing.

Capital expense (CapEx)

Upfront investment in physical infrastructure and assets.

Variable expense (OpEx)

Ongoing costs for running a product, business, or system on a pay-as-you-go basis.

Cloud deployment model

Fully in the cloud delivery with no on-premises infrastructure.

On-premises (private cloud) deployment

Resources deployed on-premises using virtualization and resource management tools.

Hybrid deployment model

Connects cloud resources to on-premises infrastructure.

Infrastructure as a Service (IaaS)

Provides building blocks like compute, storage, and networking; offers the most flexibility and requires the most management (e.g., EC2).

Platform as a Service (PaaS)

Removes the need to manage underlying infrastructure to focus on deployment and management of applications (e.g., Elastic Beanstalk, RDS).

Software as a Service (SaaS)

A complete product run and managed by the provider (e.g., Gmail, Salesforce).

Region

A physical location in the world with a cluster of Availability Zones (e.g., us-east-1).

Availability Zone (AZ)

One or more discrete data centers with redundant power, networking, and connectivity, isolated from failures in other AZs; each Region has at least 3.

Edge Location

Site used by CloudFront to cache content closer to users for low-latency delivery.

Operational Excellence Pillar

The Well-Architected Framework pillar focused on running and monitoring systems and continuous improvement of processes.

Security Pillar

The Well-Architected Framework pillar focused on protecting information, systems, and assets.

Reliability Pillar

The Well-Architected Framework pillar focused on the ability to recover from failures and dynamically acquire resources.

Performance Efficiency Pillar

The Well-Architected Framework pillar focused on using IT/computing resources efficiently as demand changes.

Cost Optimization Pillar

The Well-Architected Framework pillar focused on avoiding unnecessary costs.

Sustainability Pillar

The Well-Architected Framework pillar focused on minimizing environmental impact of running cloud workloads.

Rehost (‐lift and shift‐)

Migration strategy moving applications to the cloud without changes.

Replatform (‐lift, tinker, and shift‐)

Migration strategy involving minor optimizations without changing core architecture.

Repurchase (‐drop and shop‐)

Migration strategy involving moving to a different product, often SaaS.

Refactor / re-architect

Migration strategy involving reimagining how the application is architected using cloud-native features.

Retire

Migration strategy involving decommissioning or removing no-longer-needed resources.

Retain

Migration strategy involving keeping applications running as-is to be revisited later.

AWS Cloud Adoption Framework (AWS CAF)

Framework grouping guidance into six perspectives: Business, People, Governance, Platform, Security, and Operations.

Snowcone

The smallest member of the AWS Snow Family for offline data transfer and edge computing.

Snowball Edge

A physical device for storage and compute-intensive workloads in the AWS Snow Family.

Snowmobile

An exabyte-scale, truck-based physical device for massive data transfer.

AWS responsibility (‐security OF the cloud‐)

Responsibility for protecting the infrastructure that runs all services, including hardware, software, networking, and facilities.

Customer responsibility (‐security IN the cloud‐)

Responsibility for customer data, IAM, OS configuration, network/firewall configuration, and encryption.

IAM (Identity and Access Management)

Globally free service to manage access to AWS services and resources securely.

Root user

The identity created when an AWS account is first set up; has complete access and should be secured with MFA.

IAM User

An identity for a person or service with long-term credentials used to interact with AWS.

IAM Group

A collection of IAM users; policies attached apply to all members.

IAM Role

An identity with temporary permissions assumed by users, applications, or services.

IAM Policy

A JSON document defining permissions (Allow/Deny) attached to users, groups, or roles.

Principle of Least Privilege

Granting only the minimum permissions needed to perform a task.

MFA (Multi-Factor Authentication)

Security layer requiring a second verification factor beyond a password.

AWS Organizations

Service used to centrally manage and govern multiple AWS accounts.

Organizational Unit (OU)

Groups of accounts organized hierarchically for applying policies within AWS Organizations.

Service Control Policy (SCP)

Sets maximum available permissions for accounts in an OU; does not grant permissions, only restricts.

Consolidated billing

Feature that combines usage across all accounts in an organization for volume discounts and a single payment method.

AWS Artifact

Self-service portal for on-demand access to compliance reports (e.g., ISO, PCI-DSS) and to accept agreements like the BAA.

AWS Config

Service that tracks resource configurations and changes over time to evaluate compliance against rules.

AWS KMS (Key Management Service)

Service used to create and control encryption keys for data encryption.

AWS Secrets Manager

Service to securely store, rotate, and manage secrets like database credentials and API keys.

Security Group

Virtual firewall at the instance level; stateful and only supports ‐allow‐ rules.

Network ACL (NACL)

Firewall at the subnet level; stateless and supports both ‐allow‐ and ‐deny‐ rules.

AWS Shield

Managed DDoS protection service; Standard is free; Advanced is paid.

AWS WAF (Web Application Firewall)

Protects web applications from common exploits (SQL injection, XSS) by filtering traffic.

Amazon GuardDuty

Intelligent threat detection service using machine learning to monitor for malicious activity.

Amazon Inspector

Automated security assessment service checking EC2, container, and Lambda workloads for vulnerabilities.

Amazon Macie

ML-based service to discover, classify, and protect sensitive data (like PII) in S3.

AWS Trusted Advisor

Provides real-time guidance across cost optimization, performance, security, fault tolerance, and service limits.

AWS Abuse

Team used for reporting suspected abuse of AWS resources such as spam or malware.

Amazon EC2 (Elastic Compute Cloud)

Resizable virtual servers (‐instances‐) in the cloud.

EC2 On-Demand

EC2 pricing where you pay by the hour/second with no commitment; most flexible and expensive.

Reserved Instances

EC2 pricing with 1 or 3-year commitments for discounts up to 72%.

Savings Plans

Commitment to consistent usage (measured in $/hour) for discounts; flexible across instance families.

Spot Instances

Bid on unused EC2 capacity for up to 90% discount; can be interrupted.

Dedicated Hosts

Physical server dedicated to a customer's use; used for licensing or compliance.

Auto Scaling

Automatically adjusts the number of EC2 instances based on demand.

Elastic Load Balancing (ELB)

Automatically distributes incoming traffic across multiple targets like EC2, containers, or IPs.

AWS Lambda

Serverless compute service where you run code without provisioning servers and pay only for time used.

Amazon ECS / EKS

Container orchestration services; ECS is AWS-native and EKS is managed Kubernetes.

AWS Fargate

Serverless compute engine for containers used with ECS or EKS.

AWS Elastic Beanstalk

PaaS service that handles deployment, capacity, load balancing, and scaling for web apps.

AWS Outposts

Service that extends AWS infrastructure and services to on-premises locations.

Amazon S3 (Simple Storage Service)

Object storage service with 11 nines durability ($99.999999999\%$).

S3 Standard

S3 storage class for frequently accessed data.

S3 Intelligent-Tiering

Automatically moves S3 data between tiers based on access patterns.

S3 Standard-IA (Infrequent Access)

Lower cost S3 storage for less frequent access with retrieval fees.

S3 One Zone-IA

S3 storage class for less frequent access stored in a single AZ; cheaper but less resilient.

S3 Glacier

Long-term archival storage; cheapest S3 options with slower retrieval.

S3 Lifecycle Policies

Automation tool for moving objects between storage classes or expiring them.

Amazon EBS (Elastic Block Store)

Persistent block storage volumes for use with EC2 instances.

Amazon EFS (Elastic File System)

Scalable, fully managed shared file storage (NFS) for multiple EC2 instances.

AWS Storage Gateway

Hybrid cloud storage connecting on-premises environments to AWS storage.

Amazon RDS (Relational Database Service)

Managed service for relational databases like MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, and Aurora.

Amazon Aurora

AWS’s proprietary relational database compatible with MySQL/PostgreSQL; up to 5x faster than standard MySQL.

Amazon DynamoDB

Fully managed, serverless NoSQL key-value/document database with single-digit millisecond performance.

Amazon Redshift

Fully managed data warehouse service for analytics and big data.

Amazon ElastiCache

Managed in-memory caching service (Redis/Memcached) for application performance.

Database Migration Service (DMS)

Service to migrate databases to AWS with minimal downtime.

Amazon VPC (Virtual Private Cloud)

Logically isolated virtual network within AWS for launching resources.

Subnet

A range of IP addresses within a VPC; can be public or private.

Internet Gateway

Allows communication between a VPC and the internet.

NAT Gateway

Allows instances in a private subnet to access the internet while remaining unreachable from the outside.

Amazon Route 53

Scalable DNS (Domain Name System) and domain registration service.

Amazon CloudFront

Content Delivery Network (CDN) service using edge locations for low latency.

AWS Direct Connect

Dedicated private network connection from on-premises to AWS that bypasses the public internet.

AWS Step Functions

Service to coordinate multiple AWS services into serverless workflows (state machines).

AWS CloudFormation

Infrastructure as Code (IaC) service used to provision resources using templates.

AWS CloudTrail

Service that logs and monitors account activity and API calls for governance and auditing.

Amazon CloudWatch

Monitoring and observability service that collects metrics, logs, and sets alarms.

Amazon SageMaker

Fully managed service to build, train, and deploy machine learning models.

AWS Pricing Calculator

Tool to estimate the cost of AWS services before use.

AWS Cost Explorer

Tool to visualize, understand, and manage AWS costs and usage over time.

AWS Budgets

Service to set custom cost and usage budgets with alerts for threshold breaches.

AWS Cost and Usage Report (CUR)

The most comprehensive cost/usage dataset available, including service/pricing metadata.