Amazon CLF-C02: Cloud Architecture & Well-Architected Framework — Study Guide
Part of the AWS Cloud Practitioner CLF-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Design principles and compute purchasing decisions
Good cloud architecture begins with small, iterative changes, automation, and loose coupling so you can scale parts of an application independently. Architect for elasticity by designing stateless services where possible, push immutability and ephemeral compute, and apply the principle of least privilege for access. When choosing compute pricing models, weigh time horizon, utilization predictability, and tolerance for interruption: long-running, steady-state workloads favor committed pricing; bursty or unpredictable workloads favor On-Demand or Spot where appropriate. A common trap is committing to long-term Reserved Instances or Savings Plans without understanding variable growth, which can create wasted spend or lock you into the wrong instance family. Another mistake is using Spot for critical stateful workloads without designing for interruption. Consider licensing and placement needs: Dedicated Hosts support software-bound licenses and physical isolation, while Savings Plans provide flexibility across families and regions for compute spend. Tagging and automated cost allocation are essential — without consistent tags it’s hard to apply Savings Plans or perform rightsizing analyses. Use monitoring and alerts to detect inefficiency early and revisit purchase decisions quarterly as utilization changes.
- On-Demand: pay-per-hour/second, highest flexibility, no commitment
- Reserved Instances / Standard RIs: long-term discount for specific instance attributes, cost-effective for steady state
- Savings Plans: flexible discounts across instance families in exchange for committed spend
- Spot Instances: deep discounts for interruptible workloads
- Dedicated Hosts: physical host allocation for license or compliance constraints
Infrastructure as code, provisioning, and isolation
Infrastructure as code (IaC) brings repeatability, reviewability, and versioning to infrastructure. AWS CloudFormation is the native declarative IaC service used to describe and provision stacks; templates codify resources, dependencies, and parameterization. The AWS Cloud Development Kit (CDK) provides higher-level constructs and supports multiple languages (including TypeScript, Python, Java, C#, and Go), letting developers synthesize CloudFormation from familiar languages. Programmatic provisioning can also be done via the AWS CLI, SDKs, AWS CDK, and third-party tools like Terraform; choose native tooling when you want tight AWS feature parity and CloudFormation drift detection. Logical isolation is provided by Amazon Virtual Private Cloud (VPC), which, when combined with subnets, route tables, security groups, and network ACLs, establishes network boundaries. IAM controls identities and permissions — users, roles, groups, and policies — and is used to manage programmatic credentials and access to resources. Common practitioner traps include storing root account access keys, failing to establish cross-account roles for automation, and not enforcing tagging policies in templates. CloudFormation templates should be treated as code: reviewed, linted, and stored in version control to avoid configuration drift and to enable predictable deployments.
Well-Architected pillars — practical focus
The Well-Architected Framework centers on five pillars that guide design decisions and trade-offs. Understanding and mapping services to each pillar helps prioritize work and compare alternatives.
- Operational Excellence: design for observable operations, use CloudWatch metrics, logs, and Systems Manager automation; drive runbooks and continuous improvement.
- Security: enforce least privilege with IAM, encrypt data at rest with KMS, enable CloudTrail and GuardDuty for audit and detection, and protect edges with WAF and Shield.
- Reliability: design for failure using Multi-AZ, automated recovery, Route 53 health checks, and backups (EBS snapshots, RDS automated backups, AWS Backup) to meet recovery objectives.
- Performance Efficiency: right-size with Compute Optimizer, leverage caching (CloudFront, ElastiCache), choose managed services (Aurora, DynamoDB) and the appropriate storage tiers to optimize I/O and latency.
- Cost Optimization: implement cost-aware architecture with lifecycle policies (S3 Intelligent-Tiering or Standard-IA for infrequently accessed objects requiring immediate retrieval), use Savings Plans, and schedule non-production shutdowns.
A frequent decision criterion is whether to use managed services to trade operational overhead for cost. A common trap is overprovisioning for worst-case peak rather than leveraging autoscaling and caching to maintain performance at lower cost.
Operational tooling, data services, security, and edge choices
Operational visibility and security tooling are the backbone of a well-architected environment. AWS CloudTrail records API activity for auditing, while Amazon GuardDuty provides continuous threat detection against account-level anomalous behavior. CloudWatch collects metrics and logs and supports alarms for events such as EBS volume write spikes; use the CloudWatch Agent for OS-level metrics if native metrics are insufficient. For managed data services, RDS provides automated patching and backups for relational databases, DynamoDB is the NoSQL, fully managed key-value and document store, and Amazon Neptune is a managed graph database optimized for highly connected datasets. For global content delivery and low-latency distribution, CloudFront at the edge combined with Shield and WAF provides CDN plus DDoS protection and application-layer filtering. For edge or on-prem low-latency needs, evaluate AWS Outposts or Local Zones; Outposts places AWS hardware on-premises for the lowest possible latency and consistent APIs. Identity federation and account access for users is handled through AWS IAM Identity Center (formerly AWS SSO). When designing monitoring, combine alarms with automated remediation (Lambda or Systems Manager) and avoid common mistakes like relying on a single availability zone, using root credentials, or selecting deep archival storage (Glacier) for objects that must be retrieved instantly.
- Key service choices vs use-case: RDS for managed relational DBs; DynamoDB for NoSQL; Neptune for graph; Lex for chatbots; CloudFront + WAF + Shield for global web delivery and DDoS protection
Practical Problem: Use-Case Scenario
Scenario: Acme Manufacturing runs a mixed workload on AWS with production EC2 instances in a VPC, an RDS instance for order processing, and a static assets website deployed via S3 and CloudFront. The team uses the AWS CLI and CloudFormation, and developers need secure cross-account access for CI/CD.
Challenge: They must reduce compute costs for continuously running application servers, secure automation without using root credentials, and ensure quick recovery of an EBS-backed instance with minimal downtime.
Recommended Approach:
- Commit to a Savings Plan that matches the sustained compute hourly spend, and convert eligible instances to use Savings Plans for immediate savings.
- Migrate long-lived specific-instance needs to Reserved Instances only after analyzing utilization and apply instance size flexibility where appropriate.
- Replace any root-account access with IAM users and roles: create an IAM role for CI/CD with least-privilege policies and use short-lived credentials via STS AssumeRole for cross-account automation.
- Implement automated EBS snapshots using AWS Backup or scheduled Data Lifecycle Manager policies, and use AMIs plus user-data for rapid instance replacement and Auto Scaling group with attached EBS snapshot restore for minimal downtime.
Rationale: Matching committed pricing to predictable spend reduces costs without sacrificing availability; replacing root usage with IAM roles and short-lived credentials follows least-privilege best practices; automated snapshots and AMIs support rapid recovery consistent with the Reliability and Operational Excellence pillars.
← Billing · All domains · Management →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →