AWS Certified Cloud Practitioner (CRWT) study plan
AWS CRWT · Give each week a clear focus.
8 weeks · About 7 hours per week
Technology
Map the AWS global infrastructure (Regions, Availability Zones, edge locations) and explain in your own notes how each layer affects latency and durability
Sketch the shared responsibility model and label which controls belong to AWS versus the customer for compute, storage, and networking
Distinguish IaaS, PaaS, and SaaS using two AWS services per category and state one trade-off for each
Create a one-page service-selection cheat sheet covering compute, storage, and database options with a when-to-use line for each
Your checkpoint
A one-page service-selection cheat sheet plus a labeled shared responsibility diagram, both self-written from memory before checking notes
Technology
Describe how Amazon VPC subnets, route tables, internet gateways, and NAT gateways combine to make a workload reachable or private
Compare Amazon EC2, AWS Lambda, and container services on scaling model, pricing unit, and operational overhead
Explain the difference between Amazon S3 storage classes and pick a class for three stated access patterns
Diagram a two-tier web application across two Availability Zones and justify each component choice
Your checkpoint
A hand-drawn architecture diagram of a resilient two-tier app with a written justification of every component and a list of single points of failure you removed
Security and Compliance
Apply the principle of least privilege by writing three IAM policies that scope actions and resources narrowly
Compare IAM users, groups, roles, and identity federation, and decide which fits a given workforce scenario
Explain how AWS CloudTrail, Amazon CloudWatch, and AWS Config differ in what they record and when to use each
Identify which data types require encryption at rest and in transit, and name the AWS service that provides each
Your checkpoint
Three least-privilege IAM policy documents with a short written rationale for each statement, plus a monitoring tool comparison table
Security and Compliance
Distinguish security groups from network ACLs on statefulness, scope, and rule evaluation order
Describe how AWS WAF, AWS Shield, and Amazon GuardDuty address different threat categories
Explain the AWS compliance and assurance program at a high level, including what an audit report covers and who can request it
Walk through the incident response lifecycle and name one AWS capability that supports each phase
Your checkpoint
A threat-to-control mapping table listing at least six threats and the specific AWS service or feature that mitigates each
Cloud Concepts
Explain the six advantages of cloud computing and give a concrete business example for each
Compare the Well-Architected Framework pillars and identify which pillar a given design decision affects
Describe the AWS Cloud Adoption Framework perspectives and match each to a stakeholder group
Contrast capital expense with operating expense and show how that shift changes a budgeting conversation
Your checkpoint
A written migration rationale for a hypothetical on-premises workload covering cost, elasticity, and resilience arguments, at least 400 words
Billing and Pricing
Distinguish On-Demand, Reserved, Savings Plans, and Spot pricing on commitment, discount, and interruption risk
Explain how the AWS Free Tier works and identify which usage dimensions trigger charges
Describe AWS Organizations consolidated billing and how cost allocation tags support chargeback
Interpret a sample AWS Cost Explorer report and name two actions that would reduce the bill
Your checkpoint
A cost-optimization recommendation for a stated workload with three pricing-model options, estimated savings, and the risk of each option
Technology & Security and Compliance
Compare managed and unmanaged AWS services and state the operational tasks each removes from the customer
Explain how AWS Backup, versioning, and cross-Region replication differ in the failure scenarios they protect against
Describe how AWS Key Management Service key policies and rotation work alongside IAM permissions
Trace a request from a user through Route 53, a load balancer, and an application tier, naming the failure point at each hop
Your checkpoint
A failure-scenario matrix with at least five failure types and the specific AWS resilience control that addresses each
Cloud Concepts & Security and Compliance & Technology & Billing and Pricing
Re-derive the domain weightings and allocate remaining study time proportionally to your weakest areas
Complete two timed full-length practice sets and log every missed question by domain and root cause
Re-teach your three weakest concepts aloud or in writing without notes as a retention check
Review every flagged item from weeks 1 through 7 and close each open question
Your checkpoint
A scored practice-exam log showing per-domain accuracy, root-cause categories for every miss, and a final one-page review sheet of your weakest concepts
Milestones
Week 2: Explain the shared responsibility model and VPC traffic flow without notes, scoring at least 8 of 10 on a self-written quiz
Week 4: Write three least-privilege IAM policies from scratch and correctly classify 15 security services by function
Week 6: Score at least 80 percent on a mixed practice set covering domains 1, 3, and 4, with no domain below 70 percent
Week 8: Score at least 85 percent on two full-length timed practice sets with domain 2 and domain 3 both above 80 percent