AWS Certified Cloud Practitioner (CLF-C02) common mistakes
AWS CRAW · Understand the traps and how to avoid them.
Choosing the cheapest or most automated option whenever a scenario mentions cost savings, without first checking whether it satisfies the stated availability, performance, or compliance requirement.
The AWS Cloud Practitioner exam often pairs a cost signal with a non-negotiable requirement; candidates fixate on the price word and skip the constraint, so they pick a technically wrong but inexpensive service.
What to do instead
Before evaluating options, underline every hard requirement in the scenario (availability, region, retention, latency). Eliminate any option that violates one, then compare cost only among the survivors.
Treating the AWS shared responsibility model as a single split point and assuming AWS secures everything below the guest OS or, conversely, that customers secure physical infrastructure.
Candidates memorize a vague slogan without mapping it per service type, so they misassign controls for managed services such as RDS, Lambda, or S3 where the boundary shifts.
What to do instead
Learn the model as a matrix: AWS owns facilities, hardware, and the hypervisor; the customer owns data, identity, and configuration. For managed services, note that AWS patches the engine but the customer still controls access, encryption, and network exposure.
Selecting a single Availability Zone or a single Region for a workload described as mission-critical, or confusing Multi-AZ with read scaling.
Availability Zone, Region, and edge location are introduced together and sound interchangeable; the exam's phrasing about durability versus availability is subtle.
What to do instead
Memorize the hierarchy: Region contains Availability Zones, and edge locations serve content. Multi-AZ gives failover and availability; read replicas give read scaling. Match the scenario's stated goal to the mechanism.
Mixing up IAM users, groups, roles, and policies, and choosing long-term access keys for workloads that run on AWS compute.
All four concepts appear in access-control questions, and the distinction between identity-based and resource-based policy is easy to blur under time pressure.
What to do instead
Use the rule: users are people or applications, groups collect users, roles are assumed temporarily by trusted entities, and policies are the JSON documents that grant or deny. For EC2, Lambda, or ECS workloads, prefer IAM roles over stored access keys.
Confusing support plan features, such as assuming Business support includes a designated Technical Account Manager or that Developer support includes 24/7 phone access.
The four plans differ along several axes at once (response times, channels, TAM, Trusted Advisor depth), and candidates remember one feature and attach it to the wrong tier.
What to do instead
Build a comparison table with columns for channel, response time, TAM, and Trusted Advisor scope. Anchor the top tier as having a TAM, and remember that production workloads generally call for Business or above.
Answering billing questions with the wrong tool, for example using Cost Explorer when the scenario asks for a forecast, budget alert, or consolidated multi-account invoice.
Cost Explorer, AWS Budgets, Cost and Usage Reports, and consolidated billing overlap in purpose, and the question hinges on one distinguishing word such as alert, forecast, or detailed line item.
What to do instead
Attach one verb to each tool: visualize and forecast with Cost Explorer, alert and threshold with Budgets, export granular data with Cost and Usage Reports, and aggregate accounts with consolidated billing under Organizations.
Assuming data is encrypted at rest by default for every service, or assuming it never is, instead of recognizing which services encrypt automatically.
Default encryption behavior varies by service and has changed over time, so candidates generalize from one service to all of them.
What to do instead
Learn the common defaults: S3 applies server-side encryption by default, EBS volumes and RDS instances are encrypted only when specified at creation, and many managed services encrypt automatically. When unsure, choose the option that explicitly enables encryption with KMS.
Picking a compute service by name familiarity rather than by workload shape, such as choosing EC2 for a short event-driven function or Lambda for a long-running stateful process.
EC2, Lambda, Fargate, and Elastic Beanstalk are all compute, and the exam describes workloads in business language rather than technical terms.
What to do instead
Map workload traits to services: bursty short tasks go to Lambda, containers without server management to Fargate, full OS control to EC2, and platform-managed deployment to Elastic Beanstalk. Practice translating phrases like runs for a few seconds into the right service.
Treating the Well-Architected Framework pillars or the Cloud Adoption Framework as unordered lists and failing to connect a scenario to the pillar it exercises.
The pillars are abstract, and exam questions embed them in concrete trade-offs such as cost versus reliability, so candidates cannot map the narrative to the principle.
What to do instead
Learn the pillars with one signature question each: operational excellence (how do we run and improve?), security (how do we protect?), reliability (how do we recover?), performance efficiency (how do we use resources well?), cost optimization (how do we avoid waste?), and sustainability (how do we reduce impact?).
Ignoring the global infrastructure model when answering latency or disaster-recovery questions, such as placing a failover in another Availability Zone when the requirement is Region-level isolation.
The scenario describes a business continuity goal, but candidates default to the Multi-AZ answer they have seen most often without checking the scope of the failure being defended against.
What to do instead
Read the failure scope first: AZ failure means Multi-AZ within a Region, while Regional or geographic failure means a second Region with replication. Then confirm the design meets the stated recovery objective.