Amazon CLF-C02: AWS Global Infrastructure — Study Guide
Part of the AWS Cloud Practitioner CLF-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Core constructs: Regions, Availability Zones, and edge locations
AWS’s physical footprint is organized into Regions, Availability Zones (AZs), and edge locations. A Region is a geographically isolated area that contains multiple AZs; each AZ is one or more discrete data centers with independent power, networking, and cooling. Designing for high availability means spreading resources across multiple AZs within a Region so that an AZ failure does not cause a complete outage. Edge locations and Regional edge caches are part of the Amazon CloudFront content delivery network and place caching and compute (via Lambda@Edge) close to end users to reduce latency. When choosing a Region, consider latency to users, data sovereignty and compliance requirements, available services (not every Region has identical services or instance types), and cost differences. A common trap is assuming AZs are completely independent across Regions — AZ names may be identical across Regions but represent distinct physical locations; don’t treat AZs as Regions for compliance. Another trap is assuming all AWS services are global; many services are regional or zonal and require explicit multi-region architecture for disaster recovery.
Global networking and hybrid connectivity
AWS provides multiple options for connecting on‑premises networks and optimizing global application traffic. For hybrid connectivity, AWS Site-to-Site VPN gives encrypted tunnels over the public Internet for rapid setup, while AWS Direct Connect offers a dedicated network link with consistent throughput and lower egress costs; Transit Gateway simplifies routing at scale by acting as a hub for VPCs and on-premises connections and now supports inter-region peering. For private, service-level connectivity, VPC endpoints enable private access to supported AWS services: Gateway endpoints for S3 and DynamoDB, and Interface endpoints (AWS PrivateLink) for many other services. To accelerate and route user traffic over the AWS backbone, AWS Global Accelerator optimizes TCP/UDP routing and offers static anycast IPs; Route 53 provides global DNS routing policies (latency, geoproximity, failover) with health checks. Decision criteria include expected throughput, cost sensitivity, failover objectives, and required security posture; a common mistake is failing to account for cross-region data transfer charges and forgetting to use VPC endpoints to avoid unnecessary public egress.
Service endpoints, placement, and managed offerings
Understanding where services run and how they are exposed influences latency, resilience, and operational overhead. Some AWS services are global (Route 53, IAM), many are regional (EC2, RDS, S3 regional endpoints), and a few are zonal (EBS volumes are AZ-scoped). Use managed services where operational burden should be minimized: Amazon S3 for highly durable object storage (11 nines of durability), Amazon RDS or Amazon Aurora for managed relational databases, Amazon Redshift or Redshift Serverless for analytics without managing data warehouse infrastructure, and Amazon SQS for decoupled asynchronous messaging. For infrastructure automation and repeatability, AWS CloudFormation and the AWS Cloud Development Kit (CDK) enable infrastructure as code, while SDKs let developers embed AWS API calls in applications. Placement choices affect design: EBS volumes live in a single AZ and must be snapshotted for cross-AZ/Region recovery; load balancers and Auto Scaling groups should be configured across AZs. A frequent practitioner trap is assuming managed services remove all responsibility—operational tasks like configuration, data backups, and access control remain customer responsibilities in many services.
Operational models, pricing, security model, and decision criteria
Selecting an operational and pricing model requires balancing cost, performance, and manageability. AWS pricing models include:
- On-demand: pay per use with no long-term commitment.
- Reserved Instances / Savings Plans: commit to usage for lower unit pricing.
- Spot Instances: use spare capacity at steep discounts with interruption risk.
- Free tier / trial: limited free usage for evaluation.
Consolidated billing across AWS Organizations centralizes invoices, enables aggregated usage discounts, and simplifies chargeback. Security follows the shared responsibility model: AWS secures the global infrastructure, physical hosts, and foundational services; customers are responsible for guest OS, application security, identity and access management, and data protection. For encryption needs, AWS Key Management Service (KMS) is used to manage keys for services like EBS encryption and S3 server-side encryption. The Well-Architected principle of “principled automation” favors infrastructure as code and least-privilege IAM roles. Common traps include underestimating data transfer costs, over-provisioning for peak without autoscaling, and granting overly broad IAM permissions instead of applying least privilege.
Practical Problem: Use-Case Scenario
Scenario: Acme Retail operates a global e-commerce platform with a primary Region in us-east-1, several AZs, and an on-premises data center for legacy systems. They must reduce latency for global customers, secure hybrid connectivity, and maintain cost predictability.
Challenge: Customers in Europe are experiencing high latency and large transfer costs between Regions; the on-premises systems require a reliable private connection for inventory sync.
Recommended Approach:
- Deploy CloudFront with S3 and origin failover to cache static assets at edge locations near users for low-latency delivery.
- Create an additional read-only deployment in eu-west-1 for user-facing APIs and replicate data asynchronously using Amazon RDS read replicas or Amazon Aurora Global Database.
- Establish AWS Direct Connect at a nearby colocation point and connect it to the primary Region via AWS Transit Gateway with redundant VPN fallback for secure, consistent hybrid connectivity.
- Use Savings Plans for predictable compute baseline, enable Auto Scaling for peak variance, and use the AWS Pricing Calculator to model cross-region transfer costs before cutover.
Rationale: Caching at edge locations reduces latency and egress from the origin, regional read replicas provide locality and resilience, Direct Connect with Transit Gateway offers stable hybrid throughput while minimizing transfer costs, and combining Savings Plans with autoscaling balances cost-efficiency and scalability per cloud best practices.
← Cloud Concepts · All domains · Core Compute Services →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →