17 Final Review and Exam Strategy · AWS Cloud Practitioner

In this chapter you will learn how to pull the whole book together in the last days before your exam. You will get a one-page recap of each of the four exam domains, a large table of “lookalike” services that the exam loves to put side by side, the numbers worth memorizing, a keyword-to-service cheat sheet, a plan for exam day, and a repeatable technique for eliminating wrong answers. This chapter covers all four CLF-C02 domains: Cloud Concepts (24%), Security and Compliance (30%), Cloud Technology and Services (34%), and Billing, Pricing, and Support (12%).

17.1 How to use this chapter

Read this chapter twice. Read it once about a week before your exam, and mark every row or bullet that makes you hesitate. Go back to the chapter that covers each marked item and reread it. Then read this chapter again the day before the exam, quickly, as a confidence check.

Do not try to learn new material from this chapter. It is written as a compression of everything earlier in the book. If a line here does not make sense, that is a signal to go back, not to memorize the line.

CLF-C02 domain weights (share of scored questions)
Domain 1: Cloud Concepts
24% (about 12 of 50 scored)
Domain 2: Security and Compliance
30% (about 15 of 50 scored)
Domain 3: Cloud Technology and Services
34% (about 17 of 50 scored)
Domain 4: Billing, Pricing, and Support
12% (about 6 of 50 scored)
65 questions total: 50 scored + 15 unscored, 90 minutes, pass mark 700/1000

Figure 17.1: The four CLF-C02 domains and their share of the scored questions. Technology and security together make up almost two thirds of the exam.

The exam has 65 questions: 50 scored and 15 unscored. You cannot tell which are unscored, so treat every question as if it counts. You have 90 minutes, and you need a scaled score of 700 out of 1000 to pass. Questions are either multiple choice (one right answer out of four) or multiple response (two or more right answers out of five or more, and the question tells you how many to pick). There is no penalty for guessing, so never leave a question blank.

17.2 Domain 1 recap: Cloud Concepts (24%)

Value of the cloud. Know the six advantages of cloud computing as AWS describes them: trade fixed expense (capital expense, CapEx) for variable expense (operational expense, OpEx); benefit from massive economies of scale; stop guessing capacity; increase speed and agility; stop spending money running and maintaining data centers; and go global in minutes. When a question asks why a company would move to the cloud, the answer almost always maps to one of these six.

Cloud concepts vocabulary. Elasticity means resources grow and shrink automatically with demand. Scalability means the system can handle growth, either by adding bigger resources (vertical, “scale up”) or more resources (horizontal, “scale out”). High availability means the system keeps working when a component fails, usually by spreading across Availability Zones. Fault tolerance is the stricter idea of no interruption at all. Agility means you can experiment quickly and cheaply. Deployment models. Cloud (all in AWS), hybrid (some on premises, some in AWS, connected), and on premises (sometimes called private cloud). Service models: IaaS (for example Amazon EC2), PaaS (for example AWS Elastic Beanstalk), SaaS (complete applications you just use).

AWS Well-Architected Framework. Six pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Learn one trigger phrase per pillar:

Pillar Trigger phrase in a question
Operational Excellence Run and monitor, automate changes, learn from failure
Security Protect dataand systems, traceability, least privilege
Reliability Recover from failure, scale to meet demand
Performance Efficiency Use the right resource types, go global, experiment
Cost Optimization Avoid unneeded cost, pay only for what you use
Sustainability Reduce environmental impact, maximize utilization

AWS Cloud Adoption Framework (AWS CAF). Six perspectives. Business, People, and Governance are the business-focused ones; Platform, Security, and Operations are the technical ones. The transformation journey has four phases: Envision, Align, Launch, Scale. “People” is the perspective for culture, training, and organizational change. “Governance” is the perspective for managing risk and benefits of the program.

Migration strategies (the 7 Rs). Retire (turn it off), Retain (keep it on premises for now), Rehost (lift and shift, no changes), Relocate (move to AWS at the hypervisor level, for example VMware workloads), Replatform (lift, tinker, and shift, such as moving a database to Amazon RDS), Repurchase (drop and shop, move to a SaaS product), Refactor or re-architect (rewrite to use cloud-native features). Cloud economics. Know the difference between fixed costs (data center, hardware purchases) and variable costs (pay as you go). Know that moving to the cloud changes licensing (bring your own license versus license included), reduces undifferentiated heavy lifting, and lets you right-size instead of buying for peak.

17.3 Domain 2 recap: Security and Compliance (30%)

Shared responsibility model. AWS is responsible for security of the cloud: hardware, the global infrastructure, the physical data centers, and the software that runs managed services. You are responsible for security in the cloud: your data, identity and access, operating system patching on EC2, network and firewall configuration, and encryption choices. The line moves with the service type. With EC2 you patch the guest operating system. With Amazon RDS, AWS patches the database engine and OS, but you still control who can connect. With AWS Lambda or Amazon S3, AWS runs almost everything and you manage code, data, and permissions.

Shared controls. Patch management, configuration management, and awareness and training are shared: AWS does them for its infrastructure and you do them for your own systems and people.

Identity and access. The root user is created with the account. Protect it with MFA, do not create access keys for it, and use it only for the few tasks that require it (such as closing the account). For everything else, use IAM users, groups, and roles, or better, federated users through AWS IAM Identity Center. Follow least privilege. Roles give temporary credentials and are the right answer whenever an application or AWS service needs permissions.

Governance. AWS Organizations groups accounts, gives consolidated billing, and applies service control policies (SCPs) that set the maximum permissions for accounts. AWS Control Tower sets up a well-architected multi-account landing zone with guardrails. AWS Config records resource configuration and checks it against rules. AWS CloudTrail records API activity. Amazon CloudWatch watches metrics and logs.

Protection services. AWS Shield (Standard is automatic and free; Advanced adds protection and response for larger DDoS attacks), AWS WAF (layer 7 web filtering), AWS Firewall Manager (central management of firewall rules across accounts), Amazon GuardDuty (threat detection), Amazon Inspector (vulnerability scanning), Amazon Macie (sensitive data discovery in S3), Amazon Detective (investigation), AWS Security Hub (central security posture and findings). Data protection. Encryption at rest (AWS KMS, AWS CloudHSM) and in transit (TLS, certificates from AWS Certificate Manager). AWS Secrets Manager stores and rotates secrets.

Compliance. AWS Artifact gives on-demand access to AWS compliance reports and agreements. AWS Audit Manager helps you collect evidence for your own audits. The AWS Customer Compliance Center and the compliance programs pages describe how AWS meets standards. Remember: AWS being compliant does not make your workload compliant automatically.

17.4 Domain 3 recap: Cloud Technology and Services (34%)

Ways to access AWS. AWS Management Console (web), AWS CLI (command line), AWS SDKs (code), and infrastructure as code (AWS CloudFormation, AWS CDK). AWS CloudShell gives a browser-based shell already signed in.

Global infrastructure. A Region is a separate geographic area with multiple Availability Zones (AZs). An AZ is one or more discrete data centers with redundant power and networking. AWS has more than 30 Regions, and each Region has at least three AZs. Edge locations (hundreds of them) serve Amazon CloudFront and Route 53. Local Zones put compute close to large cities, Wavelength Zones put it inside 5G networks, and AWS Outposts puts AWS hardware in your own data center. Choose a Region based on compliance and data residency, latency to users, service availability, and price.

Compute. Amazon EC2 instance families: general purpose, compute optimized, memory optimized, storage optimized, and accelerated computing. Containers run on Amazon ECS or Amazon EKS, with servers you manage (EC2) or serverless (AWS Fargate). AWS Lambda runs code in response to events for up to 15 minutes per invocation. AWS Elastic Beanstalk deploys web apps for you. Amazon Lightsail is simple virtual private servers with predictable pricing. AWS Batch runs batch jobs.

Databases. Relational: Amazon RDS (MySQL, PostgreSQL, MariaDB, Oracle, SQL Server, Db2) and Amazon Aurora (MySQL- and PostgreSQL-compatible). NoSQL: Amazon DynamoDB (key-value, serverless). In-memory: Amazon ElastiCache (Valkey, Redis OSS, Memcached) and Amazon MemoryDB. Others: Amazon DocumentDB (MongoDB-compatible), Amazon Neptune (graph), Amazon Keyspaces (Cassandra-compatible), Amazon Timestream (time series). Migration: AWS DMS and the AWS Schema Conversion Tool.

Networking. Amazon VPC with public and private subnets, internet gateway, NAT gateway, route tables, security groups (stateful, instance level, allow rules only) and network ACLs (stateless, subnet level, allow and deny). Connectivity: AWS Site-to-Site VPN, AWS Direct Connect, AWS Client VPN, AWS Transit Gateway, VPC peering, AWS PrivateLink. Amazon Route 53 for DNS and Amazon CloudFront for content delivery. AWS Global Accelerator for static IPs and faster routing over the AWS network.

Storage. Object (Amazon S3 and its storage classes), block (Amazon EBS, and instance store which is temporary), file (Amazon EFS for Linux, Amazon FSx for Windows File Server, Lustre, NetApp ONTAP, and OpenZFS). Hybrid: AWS Storage Gateway. Backups: AWS Backup. Data movement: AWS DataSync, AWS Transfer Family, and the AWS Snow Family.

AI and ML. Amazon Bedrock (foundation models through an API), Amazon SageMaker AI (build, train, and deploy your own models), Amazon Q (Q Business for company knowledge, Q Developer for software development), and the task-specific AI services: Rekognition, Textract, Comprehend, Translate, Transcribe, Polly, Lex, Kendra, and Personalize. Analytics. Amazon Athena, Amazon Redshift, AWS Glue, Amazon EMR, Amazon Kinesis Data Streams, Amazon Data Firehose, Amazon OpenSearch Service, Amazon QuickSight, AWS Lake Formation.

Application integration and others. Amazon SQS, Amazon SNS, Amazon EventBridge, AWS Step Functions, Amazon MQ. Amazon SES for email, Amazon Connect for contact centers, Amazon WorkSpaces for virtual desktops, AWS Amplify for web and mobile front ends, AWS IoT Core for devices.

17.5 Domain 4 recap: Billing, Pricing, and Support (12%)

Pricing models. On-Demand (no commitment, pay per second or hour), Savings Plans (commit to a dollar amount of usage per hour for one or three years, up to 72% off), Reserved Instances (commit to an instance configuration for one or three years, up to 72% off), Spot Instances (spare capacity, up to 90% off, can be interrupted with a two-minute warning), Dedicated Hosts (a physical server for you, helps with server-bound licenses), and Dedicated Instances (hardware not shared with other customers, but you do not control placement on the host). Capacity Reservations reserve capacity in a specific AZ without a discount by themselves.

Data transfer. Data coming into AWS from the internet is generally free. Data going out to the internet is charged. Transfer between AZs and between Regions usually costs money; transfer within the same AZ using private IPs is usually free.

Cost tools. AWS Pricing Calculator (estimate before you build), AWS Budgets (set thresholds and get alerts, or trigger actions), AWS Cost Explorer (visualize and forecast past and current spend, with Savings Plans and RI recommendations), AWS Cost and Usage Report delivered through AWS Data Exports (the most detailed line-item data), cost allocation tags (break costs down by project or team), AWS Cost Anomaly Detection (ML alerts on unusual spend), AWS Compute Optimizer (rightsizing), AWS Billing Conductor (custom billing views for resellers or chargeback). AWS Organizations consolidated billing gives one bill and combines usage for volume discounts. Support. Five plans tested on the exam:

Plan Fastest response Key extras
Basic None (no tech cases) Docs, forums, core Trusted Advisor
checks, Health Dashboard
Developer 12 business hours (impaired) Business-hours email from cloud support
associates
Business 1 hour (production down) 24/7 phone, chat, email; full Trusted
Advisor

Enterprise On-Ramp 30 minutes (business-critical down) Pool of Technical Account Managers Enterprise 15 minutes (business-critical down) Designated TAM, concierge billing support

AWS has been revising its support offerings, so check the current AWS Support plans page before you rely on these details in real life. For the exam, these tiers and response times are the ones to know.

Other help. AWS re:Post (community questions and answers), AWS Knowledge Center, AWS Prescriptive Guidance, AWS Professional Services, the AWS Partner Network (consulting and technology partners), AWS Marketplace (buy third-party software, often billed through your AWS bill), and the AWS Trust and Safety team (report abuse of AWS resources).

17.6 The service map

The service map below groups the services you are most likely to meet on the exam. Use it as a self-test: cover the right side of the page and try to name two services in each box before you look.

Efs

Dms + sct

Emr

Sqs

Sns

Dms

Self-test: cover the page and name two services per box, with one sentence each.

Figure 17.2: One-page service map. Each box is a category, and each line inside it names a service you should be able to describe in one sentence.

17.7 Lookalike services: pick Y, not Z

The single biggest source of lost points on the Cloud Practitioner exam is confusing two services that sound alike or do overlapping jobs. The question writers know this, so they put the lookalike in the answer list on purpose. The table below lists the pairs that show up most often. Read the left column as “if the question says this”, then pick the middle column and avoid the right column.

If the question says… Pick Not
Who madean API call, and when CloudTrail CloudWatch
CPU metrics, alarms, application logs CloudWatch CloudTrail
Configuration history, rule compliance AWS Config CloudTrail
Threat detection from logsand DNS GuardDuty Inspector
Scan EC2, containers, Lambdafor CVEs Inspector GuardDuty
Find PII or credit cards in S3 Macie GuardDuty
Investigate the root cause ofa finding Detective Security Hub
One dashboard of security findings Security Hub Detective
Protectagainst DDoS attacks Shield WAF
Block SQL injection or XSS WAF Shield
Manage WAF rulesacross many accounts Firewall Manager WAF alone
Download AWS SOC or PCI reports Artifact Audit Manager
Collect evidence for your own audit Audit Manager Artifact
AWS-managed keys, integrated with services KMS CloudHSM
Dedicated single-tenant hardware for keys CloudHSM KMS
Storeand auto-rotate DB passwords Secrets Manager KMS
Free public SSL/TLS certificates Certificate Manager KMS
Workforce single sign-on to many accounts IAM Identity Center Cognito
Sign-up and sign-in forapp customers Cognito IAM
Limit whatan entireaccount can do SCP (Organizations) IAM policy
Firewall foran instance, stateful Security group Network ACL
Subnet firewall with deny rules Network ACL Security group
Private dedicated line to AWS Direct Connect Site-to-Site VPN
Encrypted tunnel over the internet, fast setup Site-to-Site VPN Direct Connect
Hub for many VPCsand on-premises Transit Gateway VPC peering
Private subnet needs outbound internet NAT gateway Internet gateway
Cache static and video content near users CloudFront Global Accelerator
Static anycast IPs fora TCP/UDP app Global Accelerator CloudFront
Domain namesand DNS routing Route 53 CloudFront
Spread traffic across instances Elastic Load Balancing Auto Scaling
Add or remove instances with demand EC2 Auto Scaling Load balancer
Queue messages to decouple components SQS SNS
Push one message to many subscribers SNS SQS
Route events from SaaS apps with rules EventBridge SNS
Coordinate steps ofa workflow Step Functions SQS
Real-time streaming ingestion Kinesis Data Streams SQS
Deliver streams into S3, no code Data Firehose Data Streams
SQL queries directly on S3 data Athena Redshift
Petabyte data warehouse Redshift RDS
ETL jobsand a data catalog Glue Athena
Business dashboards QuickSight CloudWatch
Managed MySQL or PostgreSQL RDS or Aurora DynamoDB
Serverless key-value, millisecond reads DynamoDB RDS
In-memory cache fora database ElastiCache DynamoDB
Relationships, social graph Neptune DynamoDB
MongoDB-compatible documents DocumentDB Neptune
Disk forasingle EC2 instance EBS EFS
Shared Linux file system EFS EBS
Windows SMB file shares FSx for Windows EFS
On-premisesapps use cloud storage Storage Gateway DataSync
Online transfer of large datasets DataSync Snowball Edge
Offline transfer, little bandwidth Snowball Edge DataSync
Migratea database with little downtime DMS DataSync
Lift-and-shift servers Application Migration Service DMS
Templates that create infrastructure CloudFormation Elastic Beanstalk
Upload code, AWS handles the platform Elastic Beanstalk CloudFormation
Simple server with a fixed monthly price Lightsail EC2
Containers without managing servers Fargate EC2 launch type
Managed Kubernetes EKS ECS
Run code on an event, no servers Lambda EC2
Physical server for per-socket licenses Dedicated Host Dedicated Instance
AWS racks in your own data center Outposts Local Zones
Ultra-low latency for 5G devices Wavelength Local Zones
Alert when spend passesathreshold Budgets Cost Explorer
Chartand forecast past spending Cost Explorer Budgets
Estimate cost before building Pricing Calculator Cost Explorer
Most detailed line-item billing Costand Usage Report Cost Explorer
Account-wide best-practice checks Trusted Advisor Inspector
AWS eventsaffecting your resources Health Dashboard CloudWatch
Call foundation models through an API Bedrock SageMaker AI
Build and train your own ML model SageMaker AI Bedrock
AI coding assistant Q Developer Q Business
Extract textand forms from documents Textract Rekognition
Detect objectsand faces in images Rekognition Textract
Sentiment of customer reviews Comprehend Translate
Speech to text Transcribe Polly
Text to lifelike speech Polly Transcribe
Build a chatbot Lex Polly
Patch and run commands on a fleet Systems Manager AWS Config
Send marketing or transactional email SES SNS

Common trap

Several pairs differ only in direction. CloudTrail answers “who did it”, CloudWatch answers “how is it performing”, and AWS Config answers “what does it look like now and has it changed”. If a question mentions a user, an API call, or an audit trail of actions, lean to CloudTrail.

17.8 Numbers to remember

The Cloud Practitioner exam is not a numbers exam, but a handful of figures come up often enough to be worth memorizing.

Item Number
Exam questions 65 (50 scored, 15 unscored)
Exam timeand passing score 90 minutes, 700 of 1000
Domain weights 24%, 30%, 34%, 12%
Well-Architected pillars 6
CAF perspectivesand phases 6 perspectives, 4 phases
Migration strategies 7 Rs
AZs per Region At least 3
S3 durability 99.999999999% (11 nines)
Largest S3 object 5 TB
Lambda maximum run time 15 minutes
Spot discount Up to 90%
Savings Plansand RI discount Up to 72%
Commitment terms 1 or 3 years
Spot interruption notice 2 minutes
CloudTrail event history 90 days (useatrail for longer)
Aurora copies of data 6 copiesacross 3 AZs
Enterprise critical response 15 minutes
Enterprise On-Ramp critical response 30 minutes
Business production down 1 hour

S3 Glacier retrieval at a glance. S3 Glacier Instant Retrieval returns data in milliseconds. S3 Glacier Flexible Retrieval takes minutes to hours (expedited, standard, or bulk options). S3 Glacier Deep Archive is the cheapest and takes hours, typically within 12 hours for a standard retrieval.

Free Tier. AWS accounts created on or after July 15, 2025 start on a free plan with up to 200 USD in credits (100 USD at sign-up plus up to 100 USD more for completing activities) usable for up to six months, plus Always Free offers such as a monthly allowance of AWS Lambda requests. The exam may still describe the older three categories: Always Free, 12 Months Free, and Trials. Know all three words.

17.9 Keyword-to-service cheat sheet

Many questions contain one or two keywords that point straight at a service. The list below is a fast lookup; the lookalike table above is where you check that you have not grabbed the wrong neighbor.

“Audit trail”, “API calls”, “who deleted”: AWS CloudTrail.

“Alarm”, “metric”, “dashboard of CPU”: Amazon CloudWatch.

“Compliance reports”, “SOC 2”, “BAA agreement”: AWS Artifact.

“Recommendations” across cost, security, performance, fault tolerance, service limits, operational excellence: AWS Trusted Advisor.

“Personal Health”, “scheduled maintenance affecting my instances”: AWS Health Dashboard.

“Infrastructure as code”, “template”, “stack”: AWS CloudFormation.

“Event-driven”, “no servers”, “pay per request”: AWS Lambda.

“Decouple”: Amazon SQS. “Fan-out” or “notify”: Amazon SNS.

“Low latency worldwide”, “cache at edge”: Amazon CloudFront.

“Data residency”, “regulations require data to stay in a country”: choose the Region.

“Disaster recovery”, “survive a data center failure”: multiple Availability Zones; for a regional disaster, multiple Regions.

“Unpredictable workload, no commitment”: On-Demand. “Steady state for years”: Savings Plans or Reserved Instances. “Flexible, can be interrupted”: Spot.

“Third-party software, buy through AWS”: AWS Marketplace.

“Hire an expert partner”: AWS Partner Network or AWS Professional Services.

“Report abuse”, “phishing from an AWS IP”: AWS Trust and Safety.

“Account-level guardrails”: SCPs, AWS Control Tower.

“Generative AI”, “foundation model”, “prompt”: Amazon Bedrock. “Chat with company documents”:

Amazon Q Business.

“Virtual desktop”: Amazon WorkSpaces.

“Migrate VMware”: Relocate strategy.

“Large-scale offline data transfer”: AWS Snowball Edge (check current availability; still a common exam answer).

17.10 Exam-day strategy

Before the day. If you test online, run the system check on the same computer, network, and room you will use. Clear your desk completely. If you test at a center, plan to arrive early with an accepted government ID that exactly matches your registration name. If English is not your first language, request the extra-time accommodation (ESL +30 minutes) well before you book; it must be on your account before scheduling.

Pacing. Ninety minutes for 65 questions is about 83 seconds per question. A practical plan:

1. First pass (about 55 minutes): answer every question. If a question takes more than about 90 seconds, pick your best guess, flag it, and move on.
2. Second pass (about 25 minutes): revisit flagged questions with a fresh mind. Later questions sometimes remind you of a fact you needed earlier.
3. Final check (about 10 minutes): make sure no question is unanswered and that every “Choose two” has exactly two choices.

Mindset. The exam rewards the “AWS-recommended” answer. When two answers could work, prefer the one that is managed, serverless, automated, least privilege, multi-AZ, and pay-as-you-go. Avoid answers that involve manual work, sharing credentials, using the root user, or buying hardware up front.

Exam tip

Do not change an answer on the second pass unless you can name the specific fact that makes the new answer right. Changing on a vague feeling is more likely to hurt than help.

17.11 How to attack a question

Every question can be handled with the same five steps, shown in Figure 17.3.

How to attack a question

1. Read the last sentence first

What is asked: service, benefit,

pillar, responsibility, or cost tool?

2. Mark keywords and constraints

MOST cost-effective, LEAST overhead,

serverless, real time, temporary

3. Classify the domain

Concepts, security, technology,

or billing and support?

4. Eliminate

Wrong category, breaks a constraint,

bad practice, wrong owner, not real

5. Choose between the last two

Recheck constraint words; prefer managed,
automated, least privilege, multi-AZ
Time guard

Over about 90 seconds?

Pick your best guess,

flag it, move on.

Never leave a blank:

no penalty for guessing.

Choose two? Count

your selections.

Second pass: change an

answer only for a

specific fact.

Figure 17.3: A repeatable decision flow for attacking any exam question, from reading the last sentence first to choosing between the final two options.

1. Read the last sentence first. It tells you what is actually being asked: a service, a benefit, a pillar, a responsibility, or a cost tool.
2. Find the keywords and constraints. Words such as “MOST cost-effective”, “LEAST operational overhead”, “without managing servers”, “temporary credentials”, or “real time” decide between otherwise valid answers.
3. Classify the domain. Is this a concept, a security control, a technology choice, or a billing question? That narrows the family of services you expect.
4. Eliminate. Cross out answers that are the wrong category (a monitoring service offered for a security question), that break a constraint, or that are not real AWS services.
5. Choose between the last two by checking the constraint words once more and applying AWS best practices.

17.12 Elimination techniques

Here are the elimination rules that remove the most wrong answers:

Wrong category. A storage service offered as the answer to a networking question is wrong, however attractive the name.

Violates best practice. Sharing the root user, embedding access keys in code, opening port 22 to the world, or “contact AWS Support to do it for you” are almost never right.

Too much or too little. If the question asks for the simplest solution, a multi-service architecture is wrong. If it asks to survive a Regional outage, a single-Region answer is wrong.

Responsibility mismatch. If an answer gives AWS a task the customer owns (such as configuring security groups) or the reverse (such as the customer maintaining physical data center security), cross it out.

Absolute language in distractors. Options that say “always”, “guarantees zero cost”, or “eliminates all security responsibility” are usually wrong.

Worked example 1

A startup wants to run a small web API that receives traffic only a few times an hour. The team wants to pay nothing when there are no requests and does not want to manage servers. Which service should they use? Options: A. Amazon EC2 Reserved Instances, B. AWS Lambda, C. Amazon Lightsail, D. Amazon EC2 Dedicated Hosts.

The last sentence asks for a compute service. The constraints are “pay nothing when idle” and “no servers to manage”. A, C, and D all involve a running server you pay for whether or not requests arrive, and A and D also require commitments or dedicated hardware. Only B charges per request and per duration with no servers. Answer: B.

Worked example 2

Which tasks are the customer’s responsibility when using Amazon RDS? (Choose two.) Options: A. Patching the database engine, B. Managing database user permissions, C. Maintaining the physical storage hardware, D. Configuring security group rules for the DB instance, E. Replacing failed network equipment.

Classify: shared responsibility. RDS is a managed service, so AWS patches the engine and operating system (A) and owns hardware and networking (C, E). The customer controls who can connect (D) and what database users can do (B). Answer: B and D.

Worked example 3

A company must prove to an external auditor that AWS data centers meet ISO 27001. What is the fastest way to obtain the evidence? Options: A. AWS Audit Manager, B. AWS Artifact, C. AWS Config, D. Open a support case asking for a data center tour.

The question is about AWS’s own compliance, not the company’s resources. Audit Manager (A) collects evidence about your use of AWS, and Config (C) evaluates your resource settings. AWS does not offer data center tours to customers (D). AWS Artifact provides AWS’s certifications and reports on demand. Answer: B.

17.13 The last 48 hours

Take one full practice exam under timed conditions (Practice Exam 1 or 2 in this book), then review every explanation, including the questions you got right.

Reread the lookalike table and the support plan table.

Sleep. A rested brain recalls more than a crammed one.

On exam morning, read the domain recaps in this chapter once, then stop studying.

Good to know

After the exam you receive a pass or fail result, followed by a score report with your scaled score and how you performed in each domain. Your certification is valid for three years.