AWS · CLF-C02
Validates overall knowledge of the AWS Cloud, including cloud concepts, security and compliance, cloud technology and services, and billing and pricing.
Practice Questions
600
≈ 9 practice exams
Duration
90 minutes
Passing Score
700/1000
Difficulty
FoundationalLast Updated
Jan 2026
CLF-C02 is AWS's foundational, role-independent certification, and its weighting reflects that: Cloud Technology and Services carries the largest share at 34 percent of scored content, followed by Security and Compliance at 30 percent, Cloud Concepts at 24 percent, and Billing, Pricing, and Support at 12 percent. With 600 questions in the bank, this practice exam mirrors that split so you spend proportionally more time on AWS services and security fundamentals than on billing trivia.
On test day you get 65 questions in 90 minutes: 50 scored and 15 unscored questions AWS mixes in to evaluate future content, without telling you which is which. Scoring is scaled from 100 to 1,000, and you need 700 to pass. AWS designs CLF-C02 for candidates with up to 6 months of AWS exposure, with no coding, architecture design, or troubleshooting required, so the practice questions focus on recognizing what a service does and when to use it rather than deep hands-on configuration.
There's no formal prerequisite, and CLF-C02 is often the first AWS certification people take before moving to an associate-level exam like Solutions Architect or Developer. The exam costs $100 and the certification is valid for 3 years. Start with the 30 free questions, then work through the full 600-question bank until your accuracy holds steady across all four domains.
The AWS Certified Cloud Practitioner (CLF-C02) is a foundational-level certification from Amazon Web Services that validates a broad, high-level understanding of the AWS Cloud platform, its core services, and its key terminology. The certification demonstrates competency across four core domains: cloud concepts and the AWS value proposition, security and compliance including the shared responsibility model, cloud technology and services spanning compute, networking, database, and storage, and billing, pricing, and support structures. Launched on September 19, 2023 as the successor to CLF-C01, the updated CLF-C02 exam places greater emphasis on governance concepts and the AWS Cloud Adoption Framework (CAF), while increasing the weight of the Security and Compliance domain from 25% to 30%. It is assessed on a compensatory scoring model, meaning candidates must achieve an overall passing score without needing to pass each individual domain section.
The CLF-C02 is designed for individuals who are new to cloud computing or seeking to formalize foundational AWS knowledge, regardless of their technical background. It is particularly well-suited for professionals in non-technical roles — such as sales, marketing, project management, or finance — who work alongside technical teams and need cloud literacy, as well as for IT professionals beginning their AWS journey who plan to advance toward Associate or Specialty certifications. Candidates who have had up to 6 months of exposure to AWS Cloud in any capacity (technical, managerial, sales, or operational) are the primary audience, though no prior cloud experience is strictly required.
There are no formal prerequisites for the CLF-C02 exam. AWS does not require candidates to hold any prior certifications or complete specific training courses before sitting for the exam. AWS recommends that candidates have up to 6 months of exposure to the AWS Cloud in any capacity — technical or non-technical — though even this is not a hard requirement. Candidates benefit from a general familiarity with IT concepts and an understanding of basic cloud terminology. Those with no IT background whatsoever can still successfully prepare through AWS's official training materials available on AWS Skill Builder.
The CLF-C02 exam consists of 65 total questions delivered in 90 minutes, of which 50 questions are scored and 15 are unscored pretest questions that are not identified and do not affect the final score. Questions are presented in two formats: multiple choice (one correct answer from four options) and multiple response (two or more correct answers from five or more options). The exam is available through Pearson VUE either at an authorized testing center or via online proctored delivery in 13 languages, including English, Japanese, Korean, Spanish, Portuguese, French, German, Italian, Arabic, and simplified/traditional Chinese. Scores are reported on a scaled range of 100–1,000, and the minimum passing score is 700. The compensatory scoring model means no individual domain passing threshold exists — only the total score matters. Unanswered questions are counted as incorrect, so guessing carries no additional penalty. The exam fee is $100 USD.
The AWS Certified Cloud Practitioner serves as the entry point into the AWS certification pathway and is widely recognized as a credential that demonstrates cloud literacy across both technical and business roles. Holders of the certification report measurable career impact: according to research by Jefferson Frank, 73% of AWS-certified professionals received a salary raise after certification, averaging 27%. Entry-level roles for CLF-C02 holders in the U.S. average approximately $85,000–$105,000 annually, with the certification functioning primarily as a gateway to higher-paying Associate and Professional-level roles such as Solutions Architect, SysOps Administrator, or Cloud Developer, which command average U.S. salaries of $130,000–$160,000. AWS currently holds approximately 32% of the global public cloud market, sustaining strong employer demand for cloud-credentialed professionals. Passing the CLF-C02 also provides a 50% discount voucher toward the next AWS certification exam, making it a cost-effective first step in building an AWS credential stack.
5 sample questions with answers and explanations. The full bank has 600 questions, enough for 9 full-length practice exams.
Preview — answers shown1. Litware Corp has analyzed 12 months of EC2 usage and confirmed a consistent compute baseline year-round. The engineering team frequently changes instance families and sizes to optimize performance and occasionally shifts workloads between AWS Regions. They want to commit to a 1-year spending commitment in exchange for a lower hourly rate while retaining the maximum flexibility to change instance families, sizes, operating systems, and Regions. Which EC2 cost optimization option best meets these requirements? (Select one!)
Explanation
Compute Savings Plans provide the most flexibility among AWS commitment-based pricing options. They apply automatically to any EC2 instance regardless of instance family, size, operating system, tenancy, or AWS Region, and also extend to AWS Lambda and AWS Fargate usage. In exchange for this broad flexibility, Compute Savings Plans offer savings of up to 66% compared to On-Demand pricing. Standard Reserved Instances lock the commitment to a specific instance type, platform, and AWS Region and cannot be changed after purchase, which conflicts with the team's need to change families and Regions. Convertible Reserved Instances allow exchanges between instance families, sizes, and platforms but are still scoped to a single AWS Region — they do not satisfy the requirement to shift workloads across Regions. EC2 Instance Savings Plans offer deeper discounts of up to 72% but are tied to a specific instance family within a single AWS Region, which is too restrictive for a team that needs cross-Region flexibility.
2. Fabrikam Inc. is migrating a legacy order management system from their on-premises data center to AWS. The operations team has limited cloud expertise and must complete the migration within 60 days. The team decides to move the application onto Amazon EC2 without changing any code or application architecture. Which migration strategy is Fabrikam using? (Select one!)
Explanation
Rehost, also known as lift and shift, involves moving an application to the cloud without making any changes to the code or architecture. This approach is the fastest migration strategy and is well-suited for teams with limited cloud expertise and tight timelines. Replatform involves making minor optimizations during migration, such as switching to a managed database service, without changing the core application logic. Refactor involves redesigning the application to use cloud-native services and patterns. Repurchase means replacing the existing application with a different product, typically a SaaS solution such as moving from a self-managed CRM to Salesforce.
3. Trey Research's compliance team needs to automatically identify and report any Amazon S3 buckets that contain personally identifiable information (PII) such as credit card numbers, passport numbers, or social security numbers so that appropriate data handling controls can be applied. Which AWS service provides this capability? (Select one!)
Explanation
Amazon Macie is a fully managed data security service that uses machine learning to automatically discover, classify, and protect sensitive data stored in Amazon S3. It identifies personally identifiable information including credit card numbers, passport numbers, social security numbers, and other regulated data categories, then generates detailed findings that enable compliance teams to remediate access controls and apply appropriate data governance policies. Amazon GuardDuty is a threat detection service that monitors CloudTrail API activity, VPC Flow Logs, and DNS logs for malicious behavior and anomalies; it does not scan S3 object content to identify or classify PII. Amazon Inspector performs automated security assessments of EC2 instances and container images to find software vulnerabilities and unintended network exposure, not to discover sensitive data stored inside S3 objects. AWS Security Hub aggregates security findings from multiple AWS services and third-party partners into a unified dashboard for centralized security posture management; it does not independently scan for sensitive data in S3.
4. Wingtip Toys' security team discovers that an EC2 security group was modified at 2:47 AM to allow unrestricted inbound access on port 22. The team must identify which IAM principal made the change, the source IP address used, and whether any other security groups were modified during the same session. Which AWS service contains this information? (Select one!)
Explanation
AWS CloudTrail records every API call made in an AWS account, capturing the caller's identity, the timestamp, the source IP address, the specific API action, and the request parameters. Investigating a security group modification requires searching CloudTrail logs for the AuthorizeSecurityGroupIngress event, which reveals exactly who made the change and from which IP. CloudTrail is the authoritative source for the who, what, when, and from-where of any AWS API action. Amazon CloudWatch collects performance metrics and application logs and fires alarms based on thresholds — it does not record API call history or caller identity for configuration changes. Amazon GuardDuty analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to detect threats and surface anomalous behavior, but it does not expose the raw audit trail needed to reconstruct who made a specific configuration change at a specific time. Amazon Inspector performs automated vulnerability assessments against EC2 instances and container images, not configuration change auditing.
5. Contoso Financial's compliance team must provide auditors with evidence that no Amazon S3 bucket in the account has ever had public access enabled. The auditors require both a current snapshot of each bucket's access configuration and a historical record showing all configuration changes over the past 12 months. Which AWS service provides BOTH the current configuration state AND a complete historical configuration timeline for S3 buckets? (Select one!)
Explanation
AWS Config is the purpose-built service for resource configuration history and compliance auditing. It continuously records the full configuration state of AWS resources including S3 bucket public access settings and bucket policies, stores a complete timeline of every configuration change, and can evaluate resources against managed or custom compliance rules to flag violations. The requirement for a current configuration snapshot plus a 12-month historical record of changes is precisely what AWS Config delivers. AWS CloudTrail records API-level events — it captures who called PutBucketPolicy and when — but does not maintain a structured resource configuration timeline or provide a compliance status view across all buckets over time. Amazon CloudWatch monitors operational performance metrics and triggers alarms on threshold breaches; it does not store resource configuration state. Amazon Macie discovers and classifies sensitive data inside S3 objects, which is entirely separate from auditing the access policy configuration of S3 buckets.
65 questions in 90 minutes: 50 scored plus 15 unscored questions AWS uses to evaluate future content. You are not told which is which.
700 on AWS’s scaled score of 100 to 1,000.
$100 USD, though the exact price varies by the country or region where you sit the exam.
Cloud Technology and Services (34%), Security and Compliance (30%), Cloud Concepts (24%), and Billing, Pricing, and Support (12%).
None formal. AWS designs it for candidates with up to 6 months of AWS exposure, including people in non-technical roles.
Yes, after 3 years. You renew by retaking the current exam or passing a higher-level AWS exam.
AWS does not publish a pass rate. It is the easiest AWS certification, testing recognition of AWS services and concepts rather than hands-on configuration, coding, or architecture design.
It is optional, but common as a first step. Many candidates use it to build foundational AWS vocabulary before attempting an associate-level exam like Solutions Architect or Developer Associate.
AWS Certified SysOps Administrator - Associate (SOA-C02)
SOA-C02 · 2141 questions
AWS Certified Advanced Networking - Specialty (ANS-C01)
ANS-C01 · 1453 questions
AWS Certified AI Practitioner (AIF-C01)
AIF-C01 · 426 questions
AWS Certified CloudOps Engineer - Associate (SOA-C03)
SOA-C03 · 2141 questions
AWS Certified Data Engineer - Associate (DEA-C01)
DEA-C01 · 1120 questions
AWS Certified Developer - Associate (DVA-C02)
DVA-C02 · 536 questions
$17.99
One-time access to this exam