Amazon CLF-C02: Core Storage Services — Study Guide
Part of the AWS Cloud Practitioner CLF-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Core storage types and choosing the right model
AWS provides three primary storage paradigms—object, block, and file—each optimized for different access patterns and SLAs. Object storage, exemplified by Amazon S3, is the default for large-scale, durable data with metadata and variable-size objects; S3 is designed for 99.999999999% durability and supports global distribution, lifecycle policies, cross-region replication, versioning, and object lock for immutability. Block storage, represented by Amazon EBS, is low-latency storage attached to EC2 instances for OS and transactional workloads; EBS offers volume types tuned for general purpose, throughput, or IOPS and supports snapshots for point-in-time backups. File storage, provided by Amazon EFS, offers a managed NFS file system for concurrent access by multiple instances and scales throughput with storage. Archive storage options—S3 Glacier Flexible Retrieval and Glacier Deep Archive—are for long-term retention where retrieval time and cost trade-offs dominate. When selecting services, match access latency and consistency needs: transactional databases require block storage with consistent IOPS; shared content and analytics often favor object storage; multi-client POSIX workloads use EFS. A common trap is selecting archive tiers for data still in active use—consider retrieval penalties and lifecycle policies before transitioning data.
Encryption, secrets, and governance controls
Protecting data at rest and controlling access requires combining encryption, key management, identity policies, and audit trail services. Object encryption in S3 can be implemented server-side with AWS-managed keys (SSE-S3), customer-managed KMS keys (SSE-KMS), or customer-provided keys (SSE-C); client-side encryption is an option when keys must never touch AWS. EBS supports encryption at the volume level, typically backed by AWS KMS; snapshots inherit encryption status. AWS KMS centralizes key lifecycle, access policies, and key rotation; ensure IAM and KMS key policies are coordinated—misconfigured KMS policies can block legitimate access. Secrets Manager stores and rotates database credentials and API keys securely, whereas AWS Systems Manager Parameter Store is an alternative for simpler needs. For compliance evidence, AWS Artifact provides access to AWS security and compliance reports. Audit and change-tracking come from AWS CloudTrail and AWS Config; CloudTrail records API calls while Config tracks resource configuration and drift. A frequent practitioner trap is underestimating KMS request costs with high-volume SSE-KMS usage or relying solely on ACLs instead of bucket policies and IAM roles for secure S3 access.
Backup, restore, immutability and lifecycle strategy
A robust backup and retention strategy balances recovery objectives, cost, and operational simplicity. AWS Backup centralizes backup policies across EBS, RDS, DynamoDB, EFS, and Storage Gateway volumes, enabling scheduled snapshots and lifecycle transition to lower-cost vault storage. EBS snapshots are incremental, reducing transfer time and cost for repeated backups, but snapshot consistency for application data often requires quiescing or using application-consistent snapshot tools. S3 lifecycle policies automate tiering from S3 Standard to Intelligent‑Tiering, Standard-IA, Glacier Instant Retrieval, Glacier Flexible Retrieval, and Deep Archive based on age and access patterns; enable versioning and object lock for protection against accidental deletes and ransomware. Cross-region replication guards against regional failures but is not a substitute for immutable backups with retention policies. Recovery testing is commonly neglected—regular restores validate playbooks and RTO/RPO assumptions. A common mistake is assuming replication equals backup; replication preserves deletions and corruptions unless coupled with versioning or object lock. Cost considerations include request pricing, retrieval fees from archive tiers, and KMS request charges for SSE-KMS-backed backups.
Hybrid transfers, edge appliances, and tiering decisions
For large-scale data movement and hybrid integration, AWS offers Storage Gateway, the Snow family, and DataSync to bridge on-premises and cloud. Storage Gateway operates in file, volume, and tape modes: File Gateway exposes S3 as NFS/SMB for on-premises apps, Volume Gateway presents iSCSI volumes with cloud-backed snapshots, and Tape Gateway replaces physical tape jobs with virtual tapes in S3/Glacier. The Snow family—Snowcone, Snowball Edge, and Snowmobile—handles offline data transport when network transfer is impractical; choose by data size, ruggedness, and compute requirements at edge. DataSync provides efficient online transfer for large datasets with built-in scheduling and validation. Tiering decisions should weigh access frequency, retrieval latency, and request patterns: S3 Intelligent‑Tiering reduces manual classification for variable patterns but has monitoring costs; EFS lifecycle management automates movement to EFS Infrequent Access to reduce costs for cold files. Common practitioner traps include underestimating network egress costs for frequent restores, forgetting to enable lifecycle transitions after migration, and selecting offline appliances without validating supply-chain timelines for urgent deadlines.
Practical Problem: Use-Case Scenario
Scenario: Acme Retail has a hybrid environment with 200 TB of transactional logs on-premises and an AWS account hosting web assets in S3 and EC2 instances. They need to centralize backups, archive cold logs cost‑effectively, and ensure encryption and compliance evidence are in place.
Challenge: Move the 200 TB to AWS reliably within a month, implement lifecycle archiving and encrypt data with customer-managed keys while preserving auditability.
Recommended Approach:
- Use Snowball Edge (compute-enabled) to physically import the 200 TB to S3, encrypting data in transit and at rest with AWS KMS customer-managed keys.
- Ingest into Amazon S3 bucket with versioning enabled and a lifecycle policy to transition objects to S3 Glacier Flexible Retrieval after 30 days, and to Glacier Deep Archive after 180 days.
- Configure AWS Backup to create application-consistent backups for EC2/EBS and enable vault lock rules for immutable retention where required.
- Enable SSE-KMS for S3 objects, set KMS key policies and IAM roles for access, activate CloudTrail and AWS Config to record access and configuration changes, and obtain compliance reports via AWS Artifact.
Rationale: The Snow family accelerates large data transfer without saturating network links, while S3 lifecycle and Glacier tiers provide cost-effective long-term retention. SSE-KMS and centralized backup with audit trails align with strong governance and recoverability practices.
← Core Compute Services · All domains · Core Database Services →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →