You're days out from the AWS Certified Cloud Practitioner exam. You do not need another course. You need to stop losing points to a specific, predictable set of confusions.
The CLF-C02 rarely fails people on obscure services. It fails them on near-neighbor pairs: two things that sound alike, where the wrong option in the question is precision-built from the other half of the pair. We maintain a practice bank where every wrong option carries a note explaining why someone would pick it, and writing those notes taught us something: it's the same handful of confusions, over and over, wearing different question stems. This is that list, organized by exam domain, weighted the way the exam actually weights them.
First, the mechanics, so nothing surprises you: 65 questions, 90 minutes, 50 scored and 15 unscored experimental (you can't tell which are which, so treat them all as real). Scored 100 to 1000, pass at 700. That's roughly a 70% target on the questions that count, which means you can miss around 15 scored questions and still pass. Every confusion below defends one or two of those.
Domain 3: Cloud Technology and Services (34%, the biggest slice)
Region vs Availability Zone vs edge location. A Region is a geographic area holding multiple isolated AZs; an AZ is one or more data centers; edge locations are the far larger network of sites where CloudFront caches content close to users. If the question says "low latency to end users worldwide," it wants edge (CloudFront). If it says "survive a data center failure," it wants multiple AZs. If it says "data sovereignty" or "disaster recovery across geographies," it wants multiple Regions.
Route 53 vs CloudFront vs Global Accelerator. All three sound like "make things fast globally." Route 53 is DNS: it answers "which server does this name point to." CloudFront caches content at edge locations. Global Accelerator routes traffic onto the AWS backbone for non-cacheable, dynamic traffic. DNS question, Route 53. Static content or streaming, CloudFront.
EC2 vs Lambda vs Fargate vs Elastic Beanstalk vs Lightsail. The exam tests these as a picking exercise. EC2: you manage servers. Lambda: run code in response to events, no servers, pay per invocation. Fargate: serverless containers (containers without managing EC2). Elastic Beanstalk: upload your app, AWS provisions the stack, you still see and own the underlying resources. Lightsail: the simplified fixed-price bundle for simple workloads. The word "event-driven" points at Lambda; "containers without managing servers" points at Fargate; "simple monthly price" points at Lightsail.
RDS vs DynamoDB vs Redshift. Relational with SQL: RDS (or Aurora, its high-performance AWS-built flavor). Key-value NoSQL at any scale with single-digit-millisecond reads: DynamoDB. Analytics over huge historical datasets, a data warehouse: Redshift. The trap is "database" in the question stem making all four options feel plausible. Match the workload word: "transactions/SQL" vs "key-value/millisecond" vs "analytics/warehouse."
S3 vs EBS vs EFS vs instance store. S3 is object storage reached over the network by URL, not a filesystem you mount. EBS is a block volume attached to one EC2 instance at a time. EFS is a shared file system many instances can mount at once. Instance store is temporary disk physically on the host: blazing fast, and everything on it vanishes when the instance stops. "Shared across instances" means EFS. "Ephemeral/temporary" means instance store.
SQS vs SNS vs EventBridge. SQS is a queue: one consumer pulls each message, use it to decouple components. SNS is pub/sub fan-out: one message pushed to many subscribers. EventBridge is the event bus for reacting to events from AWS services and SaaS apps with routing rules. "Decouple" leans SQS; "notify many" leans SNS.
Domain 2: Security and Compliance (30%)
The shared responsibility model is worth more points than any single service. The clean rule: AWS secures OF the cloud (facilities, hardware, network, hypervisor), you secure IN the cloud (your data, your configurations, your access rules). The exam's favorite trick is that the boundary moves with the service type:
- EC2: you patch the guest operating system. AWS never touches the inside of your instance.
- Lambda and other fully managed services: AWS patches the OS and runtime. Your job shrinks to code, data, and permissions.
- RDS: AWS patches the database engine and OS; you still own the data, the schema, and who can reach it.
- Always yours, no matter the service: your data, IAM configuration, what you encrypt, who you let in.
If a question asks who patches something, first ask "can the customer even reach that layer?" If not, it's AWS.
Security groups vs network ACLs. Both filter traffic; the exam loves the pair. Security groups sit at the instance level and are stateful (return traffic automatically allowed; allow rules only). Network ACLs sit at the subnet level and are stateless (you write both directions; allow and deny rules). "Deny a specific IP" is the NACL tell, because security groups can't write deny rules.
The detection alphabet: GuardDuty vs Inspector vs Trusted Advisor vs Artifact. GuardDuty is threat detection: it watches accounts and workloads for malicious activity. Inspector scans workloads for software vulnerabilities and unintended exposure. Trusted Advisor is the best-practice checker across cost, performance, security, and fault tolerance. Artifact is none of these: it's the self-service download desk for AWS compliance reports (SOC, PCI, ISO) that auditors ask for. "Continuous threat monitoring" is GuardDuty; "vulnerability assessment" is Inspector; "download the SOC 2 report" is Artifact.
CloudTrail vs CloudWatch vs Config. Who did what: CloudTrail (an API call log for auditing). How the system is performing: CloudWatch (metrics, alarms, logs). What does my resource configuration look like and has it drifted: Config. Memorize it as audit / monitor / configuration history.
IAM in three lines. Users are identities for people, roles are temporary credentials for services and cross-account access, policies are JSON documents that grant permissions and attach to either. Root user: lock it down with MFA and never use it for daily work. IAM is global, not per-Region.
Domain 1: Cloud Concepts (24%)
The six Well-Architected pillars, by name: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability. The exam asks you to match a scenario to a pillar; sustainability is the newest and the one people forget.
Elasticity vs high availability vs agility. Elasticity: capacity grows and shrinks automatically with demand. High availability: the system keeps running when components fail. Agility: you can provision resources and experiment in minutes instead of procurement cycles. Questions test whether you'll grab the wrong buzzword for the scenario, so anchor each to its trigger phrase: "matches demand" / "survives failure" / "moves fast."
Cloud economics. The core swap: trade capital expense (buying data centers up front, fixed cost) for variable operational expense (pay for what you use). Economies of scale are why AWS's variable price undercuts your fixed one. Rightsizing means matching the instance to the workload rather than paying for headroom you never use.
Migration vocabulary. Know that the AWS Cloud Adoption Framework (CAF) organizes a migration's people-and-process side, that the "7 Rs" (rehost, replatform, refactor, and friends) are the strategy menu, and that the Snow family exists for moving data too big or too disconnected for the wire.
Domain 4: Billing, Pricing, and Support (12%, small but the most gameable)
This domain is nearly pure memorization, which makes it the cheapest 12% on the exam.
The EC2 pricing ladder. On-Demand: by the second, no commitment, most flexible, most expensive. Reserved Instances: 1 or 3 year commitment, up to about 72% off; the 3-year all-upfront is the deepest discount. Standard RIs discount more but lock the instance family; Convertible RIs discount less but let you change family, OS, or tenancy. Savings Plans: commit to a dollar-per-hour spend instead of an instance type. Spot: up to 90% off for capacity AWS can reclaim with a two-minute warning, so only for interruption-tolerant work.
Dedicated Hosts vs Dedicated Instances. The most reliable point-loser in this domain. Both give you hardware no other customer shares. Only a Dedicated Host gives you visibility and control of the physical server (sockets, cores), which is what per-socket or bring-your-own-license software requires. Dedicated Instances isolate you at the instance level but never show you the box. License compliance question: Host, not Instance.
Budgets vs Cost Explorer vs Pricing Calculator. Future estimate before you build: Pricing Calculator. Alert me when spend crosses a line: Budgets. Analyze and visualize what I've already spent: Cost Explorer. Past/present/future is the sort key.
Support plans, low to high: Basic (free, no tech support), Developer (business-hours email), Business (24/7 phone and chat, full Trusted Advisor checks), Enterprise On-Ramp, Enterprise (Technical Account Manager). The exam tell: "TAM" always means Enterprise; "24/7 phone" starts at Business.
The last 48 hours
Stop taking full mock exams the day before; a final score won't change what you know, and a bad one will wreck your sleep. Spend the time instead on your personal wrong-answer list: every practice question you missed or guessed on, and specifically why the option you picked was wrong. If you can explain the trap, you own the concept. Then sleep. Fatigue converts "I know this" into "wait, was it Inspector or GuardDuty" faster than any knowledge gap.
Where this list came from
Disclosure: we build Certification Studio, a free exam-prep tool, and this post is drawn from its CLF-C02 question bank: 370 questions, each with a rationale for the right answer and a separate note for every wrong option explaining the specific mix-up that makes people choose it. The pairs above are the confusions those notes exist to untangle. If you want to drill them with your confidence tracked per domain (there's a 6-question diagnostic that maps your weak domains in about five minutes), it's free while we're in beta. Either way: the list above is yours, exam's on you. Go pass it.