AWS Cloud Practitioner Glossary: 55 Terms for CLF-C02 (2026)

An automated vulnerability-management service that scans EC2 instances, container images and Lambda functions for known software vulnerabilities and unintended network exposure.

On the examCue: 'scan for CVEs', 'software vulnerabilities', 'unpatched packages'. It is not a firewall and not threat detection - those answers are AWS WAF and GuardDuty.

Don’t confuse with GuardDuty

One or more discrete data centers with redundant power, networking and connectivity inside a Region, physically separated from other AZs so they share no single point of failure.

On the examCue: 'high availability' or 'survive a data center failure' - deploy across multiple AZs. Multi-Region is for disaster recovery or global latency, a bigger and costlier step.

Don’t confuse with Region

A self-service portal for downloading AWS's own compliance reports, such as SOC and ISO attestations, and for accepting agreements like the HIPAA Business Associate Addendum.

On the examWhenever an auditor needs AWS compliance reports or certifications, the answer is Artifact. AWS Config and CloudTrail describe your resources, not AWS's attestations.

Lets you set custom cost, usage, Reserved Instance or Savings Plans budgets and sends alerts, or triggers actions, when actual or forecasted amounts cross a threshold.

On the examCue: 'alert me when spending exceeds', 'notify before we overspend', 'threshold'. Budgets looks forward and alerts; Cost Explorer looks back and analyzes.

Don’t confuse with Cost Explorer

Guidance that helps an organization plan its cloud adoption across six perspectives - Business, People, Governance, Platform, Security and Operations - and tie the move to business outcomes.

On the examScenarios about organizational change, staff skills or business outcomes of migration point to the CAF. Know the guide's listed benefits: reduced business risk, better ESG performance, increased revenue, operational efficiency.

Don’t confuse with Well-Architected Framework

Continuously records the configuration of your AWS resources, keeps a history of changes and evaluates resources against rules to flag non-compliant settings.

On the examCue: 'what did this security group look like last week', 'check resources comply with a rule'. Config tracks resource state; CloudTrail tracks the API call that changed it.

Don’t confuse with CloudTrail

Managed DDoS protection. Shield Standard is automatic and free for every customer; Shield Advanced adds enhanced detection, a response team and DDoS cost protection for a fee.

On the examCue: 'DDoS'. Shield Standard is already included at no cost; pick Shield Advanced when the scenario wants 24/7 DDoS response team access or protection from scaling charges.

Don’t confuse with AWS WAF

A web application firewall that filters HTTP(S) requests to CloudFront, Application Load Balancer or API Gateway using rules, blocking patterns such as SQL injection and cross-site scripting.

On the examCue: 'SQL injection', 'block requests from certain IPs or countries', 'layer 7'. WAF inspects requests, Shield absorbs volumetric DDoS, and security groups filter at the resource level.

Don’t confuse with AWS Shield

The entry paid plan in AWS's current support lineup, combining AI-powered assistance with 24/7 access to AWS experts. It replaces Developer and Business Support, which end on January 1, 2027.

On the examThe current CLF-C02 guide lists Basic, Business Support+, Enterprise and Unified Operations. Older practice banks still cite Developer, Business and Enterprise On-Ramp - learn the current names.

Don’t confuse with Enterprise Support

Up-front spending on physical assets such as servers and data centers. Moving to AWS trades this fixed capital expense for a variable operating expense (OpEx) billed only for what you use.

On the examThe classic cloud benefit is 'trade fixed expense for variable expense'. If a scenario mentions big upfront hardware purchases or guessing capacity, the cloud answer turns CapEx into OpEx.

Infrastructure as code: you describe AWS resources in JSON or YAML templates and CloudFormation creates, updates and deletes them together as a stack, repeatably.

On the examCue: 'repeatable', 'infrastructure as code', 'provision identical environments'. The guide contrasts IaC with one-time console clicks; repeatable deployments point to CloudFormation.

AWS's content delivery network, caching static and dynamic content at edge locations worldwide to cut latency for users who are far from the origin server.

On the examCue: 'global users', 'reduce latency', 'cache videos or images'. It integrates with Shield and WAF at the edge. Route 53 resolves names; CloudFront delivers content.

Records API calls and account activity - who did what, when and from where - creating an audit trail of actions taken through the console, CLI and SDKs.

On the examCue words: 'who deleted', 'which user', 'audit API calls'. CloudTrail answers who did it; CloudWatch answers how the resource is performing.

Don’t confuse with CloudWatch

The monitoring service that collects metrics, logs and events from AWS resources and applications, and drives alarms and dashboards based on thresholds.

On the examCue: 'CPU utilization', 'set an alarm', 'monitor performance'. The exam guide files CloudWatch under monitoring and CloudTrail and Config under auditing - keep that split.

Don’t confuse with CloudTrail

An AWS Organizations feature that rolls all member accounts into one bill paid by the management account, pooling usage so the organization reaches volume pricing tiers sooner.

On the examCue: 'single bill for multiple accounts', 'combine usage for volume discounts'. Reserved Instance and Savings Plans discounts can also be shared across accounts in the organization.

An interactive tool to visualize, filter and analyze your past AWS costs and usage, with forecasts and Reserved Instance or Savings Plans purchase recommendations.

On the examCue: 'analyze spending trends', 'which service cost the most last quarter'. To estimate a workload you have not built yet, the answer is AWS Pricing Calculator instead.

A dedicated private network connection from your data center or office to AWS that bypasses the public internet for more consistent bandwidth and latency.

On the examCue: 'dedicated', 'private', 'consistent performance', 'does not traverse the internet'. Site-to-Site VPN is quicker to set up and encrypted but runs over the public internet.

A fully managed, serverless NoSQL key-value and document database that delivers single-digit millisecond performance at virtually any scale.

On the examCue: 'NoSQL', 'key-value', 'millions of requests per second', 'serverless database'. A relational schema or complex joins points back to RDS or Aurora.

Don’t confuse with RDS

Block-storage volumes that attach to EC2 instances like a network hard drive, persisting independently of the instance and backed up with point-in-time snapshots.

On the examCue: 'boot volume', 'database on an EC2 instance', 'block storage'. A volume lives in a single AZ; instance store is temporary storage lost when the instance stops.

Don’t confuse with S3

Resizable virtual servers, called instances, where you choose the instance type, operating system and storage, and you manage the OS, patching and applications.

On the examKnow instance families by use case: general purpose, compute optimized, memory optimized, storage optimized. Full OS control or long-running servers point to EC2.

Automatically adds or removes EC2 instances based on demand, schedules or health checks, keeping the right capacity running and replacing unhealthy instances.

On the examOften paired with ELB in one scenario. Auto Scaling changes how many instances exist; ELB spreads traffic across them. Elasticity questions resolve to Auto Scaling.

Don’t confuse with ELB

AWS buys hardware, power and network capacity at enormous volume and passes the lower unit cost on to customers through pay-as-you-go prices that tend to fall over time.

On the examQuestion asks why AWS can charge less than running your own data center, or why prices drop over time. The answer is economies of scale, not elasticity or agility.

A site in AWS's global network, far more numerous than Regions, where CloudFront caches content and Route 53 answers DNS queries close to end users.

On the examCue: 'lower latency for global users', 'cache static content near viewers'. Edge locations do not run your EC2 instances; that is a Region and Availability Zone job.

The ability to add or remove resources automatically as demand rises and falls, so you pay only for the capacity you actually use instead of buying for peak load.

On the examCue words: 'unpredictable traffic', 'scale in and out automatically'. Elasticity is the benefit; EC2 Auto Scaling is the service that delivers it. Don't pick 'high availability' for a demand-driven scenario.

Distributes incoming traffic across multiple targets, such as EC2 instances in several Availability Zones, and routes requests only to targets that pass health checks.

On the examCue: 'distribute traffic', 'single point of entry', 'route around unhealthy instances'. It does not launch new instances - that is EC2 Auto Scaling.

The support tier for business-critical workloads, including a designated Technical Account Manager, 15-minute response for critical cases and proactive guidance. Enterprise On-Ramp customers are being moved to it during 2026.

On the examCue: 'designated TAM', 'proactive architecture guidance', 'business-critical'. AWS Unified Operations sits above it for the most demanding mission-critical environments.

A managed threat-detection service that analyzes sources such as CloudTrail events, VPC Flow Logs and DNS logs with machine learning to spot malicious or unusual activity.

On the examCue: 'detect compromised instances', 'unusual API activity', 'intelligent threat detection'. GuardDuty watches behavior; Inspector scans workloads for software vulnerabilities.

Don’t confuse with Amazon Inspector

The AWS service, successor to AWS Single Sign-On, for centrally managing workforce access to multiple AWS accounts and applications, optionally federated with an external identity provider.

On the examCue: 'employees need single sign-on across many accounts in AWS Organizations' or 'use our existing corporate directory'. Creating IAM users in every account is the wrong answer.

An identity with permissions but no permanent credentials. A trusted user, AWS service or another account assumes it and receives temporary security credentials.

On the examPick a role when an EC2 instance needs to call S3, or for cross-account access. Storing access keys on the instance is the distractor.

Don’t confuse with IAM User

An identity inside an AWS account representing one person or application, with long-term credentials such as a password or access keys and permissions granted through policies.

On the examBest-practice answers assign permissions through groups and prefer roles or IAM Identity Center over long-term access keys. 'Share one IAM user across the team' is always wrong.

Don’t confuse with IAM Role

A managed service to create, control and audit the cryptographic keys used to encrypt data across AWS services, with keys protected by hardware security modules.

On the examCue: 'create and manage encryption keys', 'encryption at rest'. Don't confuse it with Secrets Manager, which stores and rotates passwords and API keys rather than encryption keys.

Serverless compute that runs your code in response to events and scales automatically, billed by number of requests and execution duration, with no servers to manage.

On the examCue: 'run code without provisioning servers', 'triggered by an S3 upload'. Under shared responsibility AWS manages the OS and runtime; you still own the code and its permissions.

Don’t confuse with EC2

Granting only the permissions required to perform a task and nothing more, then reviewing and trimming access over time as needs change.

On the examWhen options differ in how much access they grant, the least-privilege answer is the narrowest one that still works. Granting AdministratorAccess 'to be safe' is the trap.

Sign-in that requires a second factor, such as a code from an authenticator app or a hardware security key, in addition to the password.

On the examThe top answer for 'how do you protect the root user' and for adding a layer of sign-in security. A stronger password policy alone does not satisfy 'second factor'.

A stateless firewall at the subnet boundary, with numbered allow and deny rules evaluated in order; inbound and outbound traffic are checked separately.

On the examCue: 'subnet level', 'stateless', 'deny a specific IP range'. Security groups cannot deny, so blocking one address for a whole subnet points to a network ACL.

Don’t confuse with Security Group

Pay for compute by the second or hour with no commitment or upfront payment. The highest per-hour rate, but you can start and stop whenever you like.

On the examCue: 'short-term', 'unpredictable', 'cannot be interrupted', 'testing a new app'. If the workload runs steadily for a year or more, commit with Reserved Instances or Savings Plans.

The Well-Architected pillar about using computing resources efficiently to meet requirements and keeping that efficiency as demand and technology change, for example by choosing the right instance type or going serverless.

On the examKeywords: 'select the right resource type', 'go global in minutes', 'experiment more often'. Distinct from Reliability (recovering from failure) and Cost Optimization (eliminating waste).

Don’t confuse with Reliability

Managed relational databases such as MySQL, PostgreSQL, MariaDB, Oracle and SQL Server, where AWS handles provisioning, engine patching, backups and Multi-AZ failover.

On the examCue: 'SQL', 'relational', 'joins', 'reduce admin work'. With RDS, AWS patches the database engine; on EC2 you would. Aurora is the AWS-built, MySQL- and PostgreSQL-compatible option.

Don’t confuse with DynamoDB

A separate geographic area containing multiple isolated Availability Zones. You choose a Region based on compliance, latency to users, service availability and price.

On the examFour selection factors appear constantly: data sovereignty or compliance, proximity to users, available services, pricing. Multiple Regions answer disaster recovery and data residency scenarios.

The Well-Architected pillar about a workload performing its intended function correctly and consistently, including recovering automatically from failure and regularly testing recovery procedures.

On the examKeywords: 'recover from failure', 'multiple Availability Zones', 'test recovery procedures'. Pick Reliability over Performance Efficiency when the goal is staying up, not running faster.

Don’t confuse with Performance Efficiency

A billing discount of up to roughly 72% versus On-Demand in exchange for a 1- or 3-year commitment to a specific instance configuration; Standard and Convertible types exist.

On the examCue: 'steady-state', 'predictable usage', '1 or 3 years'. Know that Reserved Instance discounts can be shared across accounts under consolidated billing in AWS Organizations.

Don’t confuse with Savings Plans

Matching instance types and sizes to a workload's real performance needs, then downsizing or switching instance families when monitoring shows resources are underused.

On the examCost-optimization cue: 'instances average 10% CPU'. Rightsizing is the action; Cost Explorer and Trusted Advisor are tools that surface the recommendation. Buying bigger instances is never the answer.

The identity created with the AWS account's email address. It has unrestricted access and is required for a few account-level tasks, such as closing the account or changing the root email and password.

On the examCorrect answers: enable MFA on root, don't create root access keys, use it only for root-only tasks. Using root for daily administration is always the wrong option.

Object storage for virtually unlimited data, accessed over the web through an API, designed for eleven nines of durability, with storage classes priced by access frequency.

On the examCue: 'static website', 'backups', 'data lake', 'store objects'. Lifecycle policies move objects between storage classes automatically. S3 is not a boot volume for EC2 - that is EBS.

Don’t confuse with EBS

The lowest-cost S3 storage class, meant for data accessed once or twice a year and retained for long periods, with standard retrievals completing within hours.

On the examCue: 'retain for 7-10 years', 'rarely accessed', 'lowest cost'. If retrieval must take milliseconds, choose S3 Glacier Instant Retrieval or S3 Standard-IA instead.

A flexible pricing model where you commit to a consistent amount of compute spend, in dollars per hour, for 1 or 3 years and get discounted rates on matching usage.

On the examCue: 'commit to spend, not to a specific instance'. Compute Savings Plans also cover Fargate and Lambda and follow usage across instance families and Regions - Reserved Instances cannot.

Don’t confuse with Reserved Instances

A stateful virtual firewall attached to instances and other resources, with allow rules only; return traffic for an allowed request is permitted automatically.

On the examCue: 'instance level', 'stateful', 'allow rules only'. If the scenario needs an explicit deny rule or subnet-wide filtering, the answer is a network ACL instead.

Don’t confuse with Network ACL

The split of security duties: AWS secures the cloud itself (facilities, hardware, global network, managed-service software), while customers secure what they put in it (data, identities, configuration).

On the examClassic stems: 'who patches the guest OS on EC2?' (customer) versus 'on RDS?' (AWS). Responsibility shifts toward AWS as services become more managed, such as Lambda.

A publish/subscribe messaging service that pushes each message to many subscribers at once, such as email addresses, SMS numbers, Lambda functions or SQS queues.

On the examCue: 'send alerts', 'notify', 'fan out', 'push to many subscribers'. CloudWatch alarms commonly publish to an SNS topic to email administrators.

Don’t confuse with SQS

Spare EC2 capacity sold at discounts of up to 90% off On-Demand, which AWS can reclaim with a two-minute interruption notice.

On the examCue: 'flexible start and end times', 'fault tolerant', 'batch jobs', 'cheapest option'. If the job cannot tolerate interruption, Spot is wrong however cheap it is.

Don’t confuse with On-Demand Instances

A fully managed message queue that stores messages until a consumer polls and processes them, decoupling application components so each can scale and fail independently.

On the examCue: 'decouple', 'buffer', 'queue', 'process asynchronously'. SQS holds messages for a consumer to pull; SNS pushes them out to subscribers immediately.

Don’t confuse with SNS

The newest Well-Architected pillar, focused on reducing the environmental impact of cloud workloads, for example by maximizing utilization and choosing efficient managed services and hardware.

On the examKeywords: 'carbon footprint', 'energy consumption', 'environmental impact'. When a question lists five pillars and asks for the missing sixth, Sustainability is the one candidates forget.

Inspects your AWS account against best-practice checks and recommends improvements across cost optimization, performance, security, fault tolerance, service limits and operational excellence.

On the examCue: 'identify idle resources', 'check service quotas', 'find open S3 permissions'. The full set of checks comes with higher support plans; Basic Support gets only core checks.

A logically isolated virtual network in AWS where you define IP ranges, subnets, route tables and gateways that control how resources reach the internet and each other.

On the examKnow the parts: public subnet (route to an internet gateway), private subnet, NAT gateway for outbound-only access. Security groups and network ACLs filter traffic inside it.

AWS's best practices and review questions for building cloud workloads, organized into six pillars: operational excellence, security, reliability, performance efficiency, cost optimization and sustainability.

On the examExpect 'which pillar' questions: match the scenario keyword to one pillar. The framework guides workload design, while the CAF guides organizational adoption - a frequent distractor swap.

Don’t confuse with AWS CAF