How to use CLF-C02 flashcards effectively
Flashcards work through active recall — the process of retrieving information from memory rather than passively re-reading it. Research consistently shows that active recall produces stronger, longer-lasting memory than re-reading study guides. For CLF-C02 preparation, this means flashcards are one of the highest-return study tools available.
Attempt recall first
Read the CLF-C02 question on each card, pause, and attempt to formulate the answer in your own words before revealing. This retrieval attempt — even if wrong — dramatically strengthens memory compared to immediately reading the answer.
Review wrong cards again
When you get a card wrong, note it and add it back to your review pile. Spaced repetition — seeing difficult cards more frequently — is the mechanism that makes flashcard study far more efficient than linear reading.
Study by domain
Group your CLF-C02 flashcard sessions by domain for the first 3–4 weeks. Master one domain before moving to the next. In the final week, shuffle all cards together to test cross-domain recall — which is what the real CLF-C02 exam requires.
Short sessions beat marathon reviews
20–30 flashcard cards per session, done daily, produces better retention than a single 200-card marathon session. Five short daily sessions per week over 4 weeks gives you over 400 total card reviews — enough to reliably pass CLF-C02.
CLF-C02 flashcard preview
Sample cards from the CLF-C02 flashcard bank. Read the question, think of the answer, then read the explanation below.
A company is migrating its on-premises applications to the AWS Cloud. The Chief Security Officer wants to confirm the division of security responsibilities. According to the AWS Shared Responsibility Model, which of the following tasks is the customer's responsibility?
Managing network access control lists (ACLs) for the customer's VPC
Under the AWS Shared Responsibility Model, AWS manages the security of the cloud (physical data centers, hypervisor, hardware), while the customer manages security in the cloud (network traffic, guest operating systems, applications, and data). Managing network access control lists (ACLs) is a customer responsibility because it involves configuring network traffic within the customer's virtual private cloud (VPC).
A company is preparing for an annual compliance audit. The auditor requests a copy of the AWS SOC 2 Type II report to review AWS's controls. Which AWS service or tool can the company use to obtain this report?
AWS Artifact
AWS Artifact is the central resource for compliance-related information. It provides on-demand access to AWS compliance reports, such as SOC reports, PCI DSS reports, and ISO certifications, as well as agreements like the Business Associate Addendum (BAA). This allows customers to download AWS compliance documentation directly without needing to file a support ticket.
A healthcare company needs to store patient medical records that must be retained for 10 years to comply with regulatory requirements. These records are accessed very rarely, only in the event of an audit or legal request. Which Amazon S3 storage class is the MOST cost-effective choice for this data?
S3 Glacier Deep Archive
Amazon S3 Glacier Deep Archive is designed for long-term retention of data that is accessed extremely rarely, with retrieval times of 12 hours or more. It offers the lowest storage cost among S3 storage classes, making it ideal for compliance archives where data must be kept for years and accessed only a few times per year. S3 Standard is for frequently accessed data and would be too expensive. S3 Intelligent-Tiering automatically moves data between tiers but is not as cost-effective for long-term archival with rare access. S3 One Zone-IA is for infrequently accessed data but does not offer the durability across multiple Availability Zones required for critical compliance data.
A company runs multiple workloads on Amazon EC2 instances. They expect consistent usage for the next three years but want the flexibility to change instance families (for example, from M5 to C5) if performance requirements shift. Which AWS pricing model meets these requirements while providing a significant discount over On-Demand pricing?
Compute Savings Plans
Compute Savings Plans are the most flexible discount model for EC2. They apply to any EC2 instance family across any region, allowing changes to instance types without losing the discount. Reserved Instances lock you into a specific instance family and region, while Spot Instances do not guarantee capacity and are not suitable for consistent workloads.
A developer needs to launch a test server for a new application prototype. The developer logs into the AWS Management Console, selects an Amazon EC2 instance type, configures the security group, and starts the instance. The instance is running within two minutes, and the developer did not need to submit a formal request to the company's IT procurement team or wait for approval from a cloud administrator. Which essential characteristic of cloud computing does this scenario best demonstrate?
On-demand self-service
This scenario illustrates the 'on-demand self-service' characteristic, one of the five essential attributes defined by NIST (National Institute of Standards and Technology) for cloud computing. On-demand self-service allows users to provision and manage computing resources (such as virtual machines, storage, or databases) automatically, without requiring human interaction with the service provider. AWS enables this through the Management Console, CLI, SDKs, and APIs, giving developers immediate access to resources when needed. The absence of manual approval or procurement delays is the key feature. The other options represent other core cloud characteristics: broad network access (access from various client devices), resource pooling (multi-tenancy and location independence), and rapid elasticity (automatic scaling based on demand).
A solutions architect is planning a new web application on AWS. The workload will include 3 Amazon EC2 instances (t3.medium) running 24/7, an Application Load Balancer, and an Amazon RDS for MySQL db.t3.small database. The architect needs to estimate the monthly cost for the first year, considering different purchasing options (On-Demand, 1-year All Upfront Reserved Instance, and Compute Savings Plan). Which AWS tool should the architect use to create this estimate?
AWS Pricing Calculator
The AWS Pricing Calculator (formerly the AWS Simple Monthly Calculator) allows you to explore AWS services and create an estimate for the cost of your use cases. You can model your solutions before building them, explore the price points and calculations behind your estimate, and review the estimate summary. It supports different pricing models such as On-Demand, Reserved Instances, and Savings Plans, making it the correct tool for this scenario. The AWS TCO Calculator is used to compare the costs of running an on-premises environment vs. AWS. AWS Cost Explorer provides historical analysis of already incurred costs. AWS Budgets lets you set spending limits and receive alerts, but does not generate initial cost estimates.
A company's development team frequently needs temporary test environments. A developer can log into the AWS Management Console, select an Amazon EC2 instance type, configure storage, and launch the instance within minutes without any interaction with the IT infrastructure team. This capability is an example of which essential characteristic of cloud computing?
On-demand self-service
On-demand self-service is one of the five essential characteristics defined by NIST. It allows users to provision computing resources (like EC2 instances, storage, databases) automatically, without requiring human interaction from the service provider. In this scenario, the developer directly provisions the test environment through the AWS Management Console without needing approval or assistance from the IT team, which directly demonstrates on-demand self-service. Resource pooling refers to multi-tenant sharing of resources. Measured service refers to metering usage for billing and optimization. Rapid elasticity refers to the ability to scale resources up or down quickly. While these are also essential characteristics, the scenario specifically highlights the lack of human interaction required to obtain resources.
A company's finance team needs to analyze AWS spending in detail. They require a report that includes hourly cost data for each AWS service, each individual resource (e.g., a specific EC2 instance), and any cost allocation tags applied. The team plans to export this data to an Amazon S3 bucket and then import it into a custom business intelligence (BI) analytics dashboard. Which AWS tool should the finance team use to generate this level of detailed cost data?
AWS Cost and Usage Report
The AWS Cost and Usage Report (CUR) is the correct tool for generating detailed, granular cost and usage data. It provides hourly or daily cost data at the resource level (e.g., individual EC2 instance IDs) and includes all cost allocation tags. The report is delivered to an S3 bucket in CSV or Parquet format, making it ideal for importing into BI tools for custom analysis. AWS Cost Explorer offers historical cost visualization and can show hourly granularity for supported services, but it does not export raw resource-level data with tags to S3. AWS Budgets is used for setting cost thresholds and sending alerts, not for detailed cost reporting. AWS Trusted Advisor provides cost optimization recommendations but does not generate raw cost reports. Therefore, CUR is the most appropriate choice for the team's requirements.
A company uses AWS for its development environment. The finance team wants to set a monthly budget of $10,000. They want to receive an email notification when the actual costs reach 80% of the budget ($8,000) and again when costs exceed the budget. The team needs a managed AWS service that can automatically send these alerts without requiring custom code or third-party tools. Which AWS service should the team use?
AWS Budgets
AWS Budgets is the service designed for setting cost or usage budgets and configuring automatic alerts when actual or forecasted costs exceed defined thresholds. It can send email notifications directly or integrate with Amazon SNS for additional actions. This enables proactive cost management without custom code.
A company uses AWS Organizations to manage multiple accounts. The security team needs to enforce a policy that restricts SSH access (port 22) from the internet (0.0.0.0/0) in all VPCs across all accounts. The team wants to centrally define the allowed rules and automatically apply them to newly created VPCs and security groups, while also automatically remediating any existing non-compliant security groups. Which AWS service should the team use?
AWS Firewall Manager
AWS Firewall Manager is the correct choice because it provides centralized management of security groups across multiple accounts and resources. It allows administrators to define a common set of security group rules and automatically enforce them, including auto-remediation of non-compliant resources. AWS Config can detect non-compliance but does not offer centralized enforcement across accounts. Amazon GuardDuty is a threat detection service, not a firewall management tool. IAM manages access permissions, not network security group rules.
A company archives historical transaction records in Amazon S3. The records are accessed frequently for the first 30 days after creation. After 30 days, access drops sharply to only a few times per year, but the company must be able to retrieve any record within 5 minutes if needed. The company wants to minimize storage costs while meeting the retrieval time requirement. Which combination of S3 storage classes should the company use?
Use S3 Standard for the first 30 days, then transition to S3 Glacier Flexible Retrieval.
The question asks for a cost-optimized storage solution that balances frequent initial access with infrequent long-term retention, while maintaining a 5-minute retrieval time. S3 Standard is suitable for frequent access but is too expensive for long-term storage of rarely accessed data. S3 Glacier Flexible Retrieval offers configurable retrieval options—including expedited retrieval (1–5 minutes at extra cost) and standard retrieval (3–5 hours)—allowing the company to meet the 5-minute retrieval requirement when needed by paying for expedited retrieval. Transitioning from S3 Standard to S3 Glacier Flexible Retrieval after 30 days provides significant storage cost savings while retaining the ability to retrieve data within the required time. S3 Standard-IA and S3 One Zone-IA are lower-cost options for infrequently accessed data but are not archival classes and may not minimize long-term storage costs as effectively. S3 Glacier Deep Archive has a retrieval time of 12 hours or more, which does not meet the 5-minute requirement.
A company handles credit card transactions and must comply with the Payment Card Industry Data Security Standard (PCI DSS). The company's compliance officer needs to review AWS's PCI DSS compliance reports and also download and sign the AWS Business Associate Addendum (BAA) for HIPAA eligibility. The company wants a single, managed AWS service that provides on-demand access to these compliance documents and agreements. Which AWS service should the compliance officer use?
AWS Artifact
AWS Artifact is the central repository for AWS compliance reports and agreements. It provides on-demand access to documents such as SOC reports, PCI DSS reports, ISO certifications, and the Business Associate Addendum (BAA). The compliance officer can use AWS Artifact to download and review the required reports and sign the BAA directly within the service. This makes it the correct choice for this scenario.
A company currently uses the AWS Basic Support plan. The CTO wants to access the complete set of AWS Trusted Advisor checks, including those related to cost optimization and performance. Additionally, the CTO requires a guaranteed response time of less than 15 minutes for critical business-impairing issues. Which AWS Support plan should the company choose to meet all of these requirements?
AWS Enterprise Support
The AWS Enterprise Support plan provides the fastest response time for critical cases (under 15 minutes) and includes access to the full set of Trusted Advisor checks, including cost optimization and performance. The Business Support plan also includes full Trusted Advisor checks but offers a response time of under 1 hour for production system down (not under 15 minutes). The Developer and Basic plans do not include full Trusted Advisor checks or the required fast response times. Therefore, only Enterprise Support meets both requirements.
A company currently runs its infrastructure in a colocation data center. The CIO wants to estimate the total cost of ownership (TCO) of migrating the existing workload to AWS, compared to continuing with the on-premises solution. The company has detailed data on current server specifications, power, cooling, and labor costs. Which AWS tool should the company use to perform this analysis?
AWS Total Cost of Ownership (TCO) Calculator
The AWS Total Cost of Ownership (TCO) Calculator is designed to help customers compare the cost of running their infrastructure on-premises versus on AWS. It takes inputs like server specifications, power, cooling, and labor costs to provide a detailed cost comparison. The AWS Pricing Calculator (option A) is used to estimate the cost of AWS services after migration, not to compare on-premises vs cloud. AWS Cost Explorer (option C) analyzes historical AWS usage costs. AWS Budgets (option D) sets spending limits and alerts. Therefore, the correct tool is the AWS TCO Calculator.
A company has a compliance policy requiring that all data at rest in Amazon S3 be encrypted with a key that is automatically rotated every year. The company wants to manage the encryption keys themselves, maintain control over access policies, and have AWS handle the key rotation automatically. Which AWS service should the company use?
AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) allows you to create customer managed keys (CMKs) and enables automatic annual rotation for these keys. This meets the compliance requirement for key rotation while retaining customer control over key policies. AWS CloudHSM provides hardware security modules but does not offer automatic key rotation; it is used for scenarios requiring dedicated, FIPS 140-2 Level 3 validated hardware. AWS Secrets Manager manages secrets (such as database passwords) and can rotate them, but it does not manage encryption keys for data at rest. AWS Certificate Manager handles SSL/TLS certificates, not data encryption keys.
A company has 50 TB of historical data stored on on-premises network-attached storage (NAS). The company wants to transfer this data to Amazon S3. The internet connection provides only 10 Mbps upload speed, and the company wants to complete the transfer within 2 weeks. The data is not sensitive and does not require encryption during transfer. Which AWS service should the company use to meet these requirements?
AWS Snowball Edge
This scenario tests knowledge of AWS data transfer options for large volumes over low-bandwidth connections. AWS Snowball Edge is a physical data transport solution designed for moving terabytes to petabytes of data. It avoids network bottlenecks by shipping a device that is loaded with data on-premises and then sent to an AWS facility for ingestion into S3. Other options like AWS DataSync or Storage Gateway operate over the network and would take far longer given the bandwidth constraint, while Direct Connect requires dedicated network setup and is typically used for ongoing connectivity rather than one-time transfers.
A company has 50 TB of on-premises file server data that must be transferred to Amazon S3. The company's internet connection is limited to 100 Mbps, and the data transfer must not impact daily business operations. The company needs a physical device to securely copy the data and then ship it to AWS for ingestion. Which AWS service should the company use?
AWS Snowball
AWS Snowball (specifically Snowball Edge or Snowcone for smaller volumes) is a petabyte-scale data transport solution that uses secure physical devices to transfer large amounts of data into and out of the AWS cloud. When network transfer is too slow, costly, or disruptive, Snowball provides a faster and more reliable alternative by shipping the device over a courier. AWS DataSync and Amazon S3 Transfer Acceleration are network-based solutions that would still depend on the limited internet bandwidth and could affect operations. AWS Direct Connect provides a dedicated network connection but also requires significant bandwidth and is not a physical device for offline transfer.
A company based in Germany needs to store and process customer data that, by law, must remain within the European Union (EU). The company plans to use AWS services. Which AWS Global Infrastructure element is the MOST important for the company to evaluate when choosing where to deploy its resources?
AWS Regions
AWS Regions are geographically isolated areas that consist of multiple Availability Zones. Data residency regulations require that data remain within a specific geographic boundary. By selecting an AWS Region located within the EU (e.g., Frankfurt or Ireland), the company can meet its compliance requirement. Availability Zones, Edge Locations, and Local Zones are all components of the global infrastructure, but the primary decision for data residency starts with choosing an appropriate Region. Availability Zones exist within a Region and are in the same geographic area, but they do not allow cross-country placement. Edge Locations are used for content caching and do not host primary compute or storage. Local Zones extend a Region but are still part of the parent Region's country.
A company has 200 IAM users. The security team needs to automatically verify that every IAM user has enabled multi-factor authentication (MFA) for console access. They also need to receive a notification whenever a new user is created without MFA so they can enforce the policy. Which AWS service should the security team use to meet these requirements?
AWS Config
AWS Config is a service that enables you to assess, audit, and evaluate the configurations of your AWS resources. It provides managed rules that can automatically check resource configurations against desired policies. The 'iam-user-mfa-enabled' managed rule checks whether IAM users have MFA enabled. AWS Config can also trigger Amazon Simple Notification Service (SNS) notifications when resources become non-compliant. This makes AWS Config the correct choice for continuously monitoring and alerting on MFA compliance. AWS CloudTrail records API activity but does not evaluate compliance against rules. Amazon GuardDuty is a threat detection service that monitors for malicious behavior, not configuration compliance. AWS Trusted Advisor provides best practice checks and recommendations, including MFA for the root account, but it does not provide automated continuous evaluation of all IAM users or event-driven notifications for new non-compliant users.
A company has a compliance policy requiring that all Amazon EC2 instances in its production environment must have the tag "Environment=Production" and must be associated with a security group named "Prod-SG". The company wants to continuously monitor its AWS account and automatically detect any EC2 instances that do not meet these requirements. The IT team needs a service that can evaluate the configuration of resources against these rules and send notifications when a non-compliant resource is detected. Which AWS service should the company use?
AWS Config
AWS Config is the correct service because it provides managed and custom rules that evaluate the configuration of AWS resources against desired policies. It continuously monitors resources, detects configuration changes, and can trigger notifications (via Amazon SNS) when resources become non-compliant. In this scenario, AWS Config can be configured with a rule to check that EC2 instances have the required tag and are associated with a specific security group. AWS Trusted Advisor is an advisory service that offers best practice checks across cost, performance, security, and fault tolerance, but it does not support custom compliance rules or resource-level configuration evaluation. Amazon GuardDuty is a threat detection service that analyzes network and account activity for malicious behavior, not resource configuration compliance. Amazon Inspector is a vulnerability management service that assesses applications for software vulnerabilities and network exposure, not for tagging or security group compliance.
A company collects sensor data from IoT devices and stores the data in Amazon S3. For the first 90 days, the data is accessed frequently for real-time analysis. After 90 days, the data is rarely accessed but must be retrievable within 24 hours for compliance audits. After 365 days, the data must be retained for legal purposes but can be deleted after 7 years. Which S3 storage class should the company use for the data from day 91 to day 365 to minimize storage costs while meeting the retrieval time requirement?
Amazon S3 Standard-Infrequent Access (S3 Standard-IA)
Amazon S3 Standard-Infrequent Access (S3 Standard-IA) is designed for data that is accessed less frequently but requires rapid access when needed. It offers the same low latency and high throughput as S3 Standard but at a lower storage cost. The retrieval time is within milliseconds, which easily meets the 'within 24 hours' requirement. S3 Glacier Flexible Retrieval has retrieval times ranging from minutes to hours and is more cost-effective for archival data, but it is intended for data that is accessed very rarely and where retrieval time flexibility is acceptable. S3 Standard is more expensive and optimized for frequent access. S3 One Zone-IA is less durable (stores data in a single Availability Zone) and is not recommended for data that must be retained for compliance without resilience.
A company develops a mobile application that allows employees to upload sales reports to an Amazon S3 bucket. The application must work reliably from any location, including from corporate offices, remote home offices, and international travel locations. The solution uses standard HTTPS requests over the internet. Which essential characteristic of cloud computing does this scenario best illustrate?
Broad network access
This scenario describes the ability to access cloud resources using standard network protocols from a variety of devices and locations, which is the defining feature of broad network access.
CLF-C02 flashcards by domain
The CLF-C02 flashcard bank covers all 4 official blueprint domains published by Amazon Web Services. Cards are distributed proportionally, so domains with higher exam weight have more cards.
Domain Coverage
Cloud Concepts
Security and Compliance
Cloud Technology and Services
Billing, Pricing, and Support
Flashcards vs practice tests: which is better for CLF-C02?
Both flashcards and practice questions are evidence-based study tools. The difference is in what they train:
Flashcards — concept retention
Best for memorising definitions, acronyms, protocol behaviours, command syntax, and conceptual distinctions. Use flashcards to build the foundational vocabulary that CLF-C02 questions assume you know.
Best in: weeks 1–3
Practice tests — application
Best for applying concepts to realistic scenarios, eliminating distractors, and building exam stamina.CLF-C02 questions test scenario reasoning — not just recall — so practice tests are essential.
Best in: weeks 3–6
The most effective CLF-C02 study plan combines both: use flashcards for the first 2–3 weeks to build conceptual foundations, then shift to practice tests and mock exams in the final 2–3 weeks to apply and benchmark that knowledge. Most candidates who pass on their first attempt use both tools.
CLF-C02 flashcards — frequently asked questions
Are the CLF-C02 flashcards free?
Yes — all CLF-C02 flashcards on Courseiva are completely free, no account required. Every card includes the question, correct answer, and a full explanation. Create a free account to track which cards you have studied and get spaced repetition recommendations.
How many CLF-C02 flashcards are on Courseiva?
Courseiva has 1004+ original CLF-C02 flashcards across all 4 exam blueprint domains. New cards are added regularly as the question bank grows. All cards are written by certified engineers against the official Amazon Web Services exam objectives.
How are Courseiva flashcards different from Anki or Quizlet?
Courseiva flashcards are purpose-built for IT certification exams. Unlike generic flashcard platforms where content quality varies, every Courseiva card is mapped to the official CLF-C02 exam blueprint, written by engineers who hold the certification, and includes a full explanation of the correct answer and why the distractors are wrong. This explanation quality is what separates genuine learning from rote memorisation.
Can I use CLF-C02 flashcards offline?
Courseiva is a web platform — an internet connection is required. For offline study, we recommend creating free Courseiva account, using the platform in your browser, and using your device's offline capabilities if your browser supports offline web apps.
Track your CLF-C02 flashcard progress
Save your results, see which domains need more work, and get spaced repetition recommendations — all free.
Sign Up FreeFree forever · Every certification included