Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions in 90 minutes: 50 scored and 15 unscored questions you can’t spot. Scaled score from 100 to 1,000; you need 700.
- About 80 seconds per question. No penalty for wrong answers, so never leave one blank. Flag and move on.
- Multiple choice has one answer out of four. Multiple response has two or more answers out of five or more options.
- Domain weights: cloud concepts 24%, security and compliance 30%, cloud technology and services 34%, billing, pricing and support 12%. You don’t need to pass each domain, only the whole exam.
How to read a CLF question
Read the last sentence first, then find the key word.
| The question says | Think |
|---|---|
| Least operational overhead, managed | A managed or serverless service, not EC2 you run |
| Cost-effective, lowest cost | Right-sized, Spot for tolerant work, reserved for steady work, cold storage for cold data |
| Highly available | Multiple AZs |
| Disaster recovery, latency to global users, data residency | Multiple Regions |
| Elastic | Auto Scaling, automatic scale out and in |
| Who is responsible | Can they physically touch it? Hardware and hypervisor is AWS. Data, IAM, guest OS on EC2 is the customer |
| Audit, who did this | CloudTrail |
| Compliance report | Artifact |
Elimination tricks
- Two answers that are real services doing nearby jobs: find the exact verb (detect, investigate, scan, block, encrypt).
- Answers that say AWS manages your data, IAM, or guest OS on EC2 are wrong.
- “Always”, “never” and “only” are usually a sign of a wrong option.
- Answers needing hardware you buy, or a manual step, are wrong in a cloud question.
Core definitions
| Term | One line |
|---|---|
| Elasticity | Automatic scale out and in with demand |
| High availability | Keeps running when a part fails (two or more AZs) |
| Agility | Fast provisioning and change |
| Economies of scale | Lower unit price because AWS is huge |
| TCO | Total cost of ownership, including hidden on-premises cost |
| CapEx / OpEx | Up-front fixed spend / pay as you go |
Well-Architected pillars (6): operational excellence, security, reliability, performance efficiency, cost optimization, sustainability.
CAF perspectives (6): business, people, governance, platform, security, operations.
Migration strategies: retire, retain, rehost, relocate, repurchase, replatform, refactor.
Shared responsibility
| Service | AWS | You |
|---|---|---|
| EC2 | Hardware, hypervisor | Guest OS, patches, apps, firewall, data, IAM |
| RDS | OS, engine patching, hardware | Data, access, security groups, encryption choice |
| Lambda | Servers, runtime, scaling | Code, IAM role, data |
| S3 | Everything underneath | Data, bucket policy, encryption choice, access |
Shared controls: patching, configuration management, awareness and training.
Security services
| Service | Job |
|---|---|
| IAM | Users, groups, roles, policies. Global. Least privilege |
| Identity Center | Workforce single sign-on across accounts |
| Cognito | Sign-in for your app’s customers |
| KMS / CloudHSM | Managed keys / dedicated hardware module |
| Secrets Manager | Store and rotate credentials |
| ACM | TLS certificates |
| GuardDuty | Threat detection |
| Inspector | Vulnerability scanning |
| Macie | Sensitive data in S3 |
| Detective | Investigate findings |
| Security Hub | Aggregate findings and checks |
| Shield / WAF | DDoS / web exploits |
| Firewall Manager | Central firewall rules across accounts |
| Artifact | Compliance reports and agreements |
| CloudTrail / CloudWatch / Config | API audit / metrics and logs / configuration history |
| Audit Manager | Audit evidence |
| Trusted Advisor | Best-practice checks |
Root user only: close account, change Support plan, change root credentials and settings. Protect it with MFA, no access keys.
Security group stateful, instance level, allow only. Network ACL stateless, subnet level, allow and deny.
Global infrastructure and connectivity
| Item | One line |
|---|---|
| Region | Geographic area with several AZs |
| AZ | One or more data centres, isolated from other AZs |
| Edge location | CloudFront and Route 53 caching and DNS |
| Local Zone / Wavelength | Compute near a city / inside a 5G network |
| Outposts | AWS hardware in your data centre |
| VPN | Encrypted over the internet, quick |
| Direct Connect | Dedicated private link, consistent, slower to set up |
Services by job
| Job | Service |
|---|---|
| VMs | EC2 |
| Containers | ECS, EKS (Kubernetes), Fargate (serverless), ECR (images) |
| Functions | Lambda (15-minute limit) |
| Easy app deploy | Elastic Beanstalk |
| Simple VPS | Lightsail |
| Relational | RDS, Aurora |
| Key-value NoSQL | DynamoDB |
| In-memory | ElastiCache, MemoryDB |
| Graph / warehouse | Neptune / Redshift |
| Object / block / file | S3 / EBS / EFS or FSx |
| Hybrid file cache | Storage Gateway |
| Central backup | AWS Backup |
| DNS / CDN / static IPs | Route 53 / CloudFront / Global Accelerator |
| API front door | API Gateway |
| Queue / fan-out / events / workflow | SQS / SNS / EventBridge / Step Functions |
| SQL on S3 / ETL / streaming / dashboards | Athena / Glue / Kinesis / QuickSight |
| Custom ML / chatbot / search | SageMaker / Lex / Kendra |
| Image / text in documents / sentiment / speech | Rekognition / Textract / Comprehend / Transcribe and Polly |
| Contact centre / email | Connect / SES |
| Desktops / app streaming | WorkSpaces / AppStream 2.0 |
| IoT | IoT Core, Greengrass |
| GraphQL / full-stack apps | AppSync / Amplify |
| Tracing | X-Ray |
| Infrastructure as code | CloudFormation, CDK |
| Move databases / schema | DMS / SCT |
| Offline data transfer | Snow Family |
S3 classes, cheapest storage last: Standard, Intelligent-Tiering, Standard-IA, One Zone-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, Glacier Deep Archive. Lifecycle rules move data between them.
Pricing and billing
| Need | Choose |
|---|---|
| Unpredictable or short | On-Demand |
| Steady 1 or 3 years | Savings Plans or Reserved Instances (up to about 72%) |
| Interruptible work | Spot (up to about 90%) |
| Per-core licence or compliance | Dedicated Host |
| Guaranteed capacity in an AZ | Capacity Reservation (no discount) |
| Most flexible commitment | Compute Savings Plan |
| Change instance attributes later | Convertible RI |
- Inbound data is free. Outbound is charged. Same-AZ private traffic is free.
- Pricing Calculator = estimate before. Budgets = alerts. Cost Explorer = analyse and forecast. CUR = most detail. Billing Conductor = custom billing views.
- Consolidated billing: one bill, volume discounts, shared RIs and Savings Plans.
- Cost allocation tags must be activated in the Billing console.
Support plans
| Plan | Remember |
|---|---|
| Basic | Free. Customer service, docs, Health Dashboard, core Trusted Advisor checks |
| Developer | Non-production. Email in business hours |
| Business | Production. 24x7 phone, chat, email. Full Trusted Advisor |
| Enterprise On-Ramp | Pool of TAMs. 30 minute response for business-critical down |
| Enterprise | Designated TAM, Concierge. 15 minute response for business-critical down |
Resources: Knowledge Center, re:Post, Prescriptive Guidance, whitepapers. Abuse goes to Trust and Safety. Partners: ISVs and system integrators. Professional Services and Solutions Architects give hands-on help. In December 2025 AWS replaced the paid plans with Business Support+, Enterprise Support and Unified Operations (classic plans run until 1 January 2027 for existing customers). The exam guide still uses the classic comparison above.