AWSCLF-C02

AWS Core Services Overview for AWS Cloud Practitioner CLF-C02

The CLF-C02 exam does not expect you to architect AWS solutions. It expects you to recognize which service category addresses which business need, and to distinguish services that are frequently confused. Can you tell GuardDuty from Inspector from Macie? Do you know the difference between SNS and SQS? Between CloudTrail and CloudWatch? These surface-level distinctions appear throughout the exam. This topic maps the core AWS service categories and their flagship services so you can answer 'which service does X?' questions confidently.

8 min
3 sections · 7 exam key points

Compute, storage, and database services

Compute services run your applications. EC2 (Elastic Compute Cloud) provides virtual machines you configure and manage. Lambda runs code in response to events without any server management, charging per invocation and execution duration. Elastic Beanstalk is a PaaS that deploys and manages web applications automatically, while you maintain control over the underlying resources. ECS and EKS run containerized workloads, with EKS managing Kubernetes clusters specifically.

Storage services hold your data. S3 is object storage for any file type, from images to backups to static websites. EBS is block storage for EC2 instances, similar to an attached hard drive. EFS is shared file storage accessible by multiple Linux instances simultaneously. Glacier and Glacier Deep Archive are low-cost archival storage for data you access rarely. Storage Gateway extends on-premises storage to AWS.

Database services cover relational and non-relational needs. RDS manages relational databases (MySQL, PostgreSQL, SQL Server, Oracle). Aurora is AWS's high-performance MySQL/PostgreSQL-compatible engine. DynamoDB is fully managed NoSQL for key-value and document patterns. ElastiCache provides in-memory caching with Redis or Memcached. Redshift is a data warehouse for analytical queries on large datasets.

Networking, security, and other key services

Networking services connect your resources. VPC (Virtual Private Cloud) is your private isolated network within AWS. Route 53 is AWS's DNS service, routing users to your endpoints. CloudFront is the content delivery network that caches content at edge locations worldwide. Direct Connect provides a dedicated private physical connection from your premises to AWS. ELB (Elastic Load Balancing) distributes traffic across multiple instances.

Security services protect your environment. IAM controls who can do what in your account. KMS manages encryption keys. CloudTrail logs every API call for audit purposes. GuardDuty detects threats by analyzing CloudTrail, VPC Flow Logs, and DNS logs using machine learning. Inspector scans EC2 instances and container images for software vulnerabilities. Macie discovers sensitive data in S3. Shield protects against DDoS attacks. WAF filters malicious web requests.

Other key services: CloudWatch collects metrics and logs from AWS resources. SNS is a pub/sub notification service that pushes messages to multiple subscribers. SQS is a message queue where consumers pull messages independently. CloudFormation automates infrastructure deployment using code templates. Trusted Advisor analyzes your account against AWS best practices in cost, performance, security, fault tolerance, and service limits.

How to choose the correct answer

EC2: virtual machines you manage. Lambda: serverless functions, event-driven. Elastic Beanstalk: PaaS, managed app deployment.

S3: object storage, any file, unlimited scale. EBS: block storage attached to one EC2. EFS: shared NFS for multiple Linux instances.

GuardDuty: threat detection from logs (CloudTrail, VPC Flow Logs, DNS). Inspector: vulnerability scanning of instances and containers. Macie: sensitive data discovery in S3.

CloudTrail: who called which API. CloudWatch: metrics, logs, alarms for running resources.

SNS: push to multiple subscribers at once (fan-out). SQS: queue for independent consumers to pull from.

Trusted Advisor: recommendations across cost, performance, security, fault tolerance, service limits. Five pillars.

CloudFormation: infrastructure as code (IaC). Deploy entire environments from templates.

Key exam facts — CLF-C02

  • EC2: IaaS virtual machines. ECS: container orchestration. EKS: managed Kubernetes.
  • S3: unlimited object storage. EBS: block storage per EC2 instance. EFS: shared NFS for multiple instances.
  • RDS: managed relational DB. Aurora: high-performance MySQL/PG. DynamoDB: NoSQL, single-digit ms.
  • GuardDuty: ML threat detection. Inspector: CVE scanning. Macie: PII/sensitive data in S3. Shield: DDoS.
  • CloudTrail: API call audit log. CloudWatch: metrics and operational logs. CloudFormation: IaC templates.
  • SNS: push notifications, pub/sub. SQS: pull queue, decoupled processing. Both are messaging services.
  • Trusted Advisor: best practice recommendations across 5 categories. Full checks require Business/Enterprise support.

Common exam traps

CloudWatch and CloudTrail serve the same monitoring purpose.

CloudWatch monitors resource performance: CPU usage, memory, latency, and application logs. CloudTrail is an audit log of every AWS API call: who did what to which resource and when. CloudWatch answers 'is my application healthy?' CloudTrail answers 'who made this change?' Both are needed for full observability.

Lambda can handle any application workload because it scales automatically.

Lambda has a maximum execution timeout of 15 minutes and is designed for short, event-driven tasks. Applications that maintain persistent connections, require more than 10 GB of memory, or need to run continuously are better served by EC2 or ECS. Lambda scales well for stateless, intermittent workloads, not for long-running or continuously active processes.

GuardDuty and Inspector are both intrusion detection systems that prevent attacks.

GuardDuty analyzes existing AWS logs to detect suspicious behavior patterns and generates findings but does not block anything. Inspector scans software installed on EC2 instances and container images for known CVEs and configuration issues. Neither automatically prevents or blocks attacks. They are detection tools that generate alerts for human or automated remediation.

Practice this topic

Test yourself on AWS Core Services

JT Exams routes you to questions in your exact weak areas — automatically, after every session.

No credit card · Cancel anytime

Related certification topics