AWS Certified Cloud Practitioner · CLF-C02

Cloud Technology and Services

Domain 3 — Comprehensive Study Guide
Task Statements 3.1 through 3.8

34% of Exam Score — Largest Domain

Domain 3 Overview — 8 Task Statements

3.1 Deploying & Operating

Access methods, IaC, deployment models

3.2 Global Infrastructure

Regions, AZs, edge locations, HA

3.3 Compute Services

EC2, containers, serverless, scaling

3.4 Database Services

Relational, NoSQL, in-memory, migration

3.5 Network Services

VPC, security, Route 53, connectivity

3.6 Storage Services

Object, block, file, lifecycle, backup

3.7 AI/ML & Analytics

SageMaker, Lex, Kendra, Athena, Glue

3.8 Other Service Categories

Integration, business apps, dev tools, IoT

3.1Task Statement 3.1

Deploying & Operating in the AWS Cloud

Access Methods · One-Time vs. Repeatable · Deployment Models

3.1

Access Methods & Deployment Models

Method	Best For
AWS Management Console	Web-based GUI — exploring services, one-time or ad hoc tasks, learning
AWS CLI	Command-line, scriptable access — repeatable tasks, automation
SDKs	Programmatic access from application code in languages like Python, Java, JavaScript
Infrastructure as Code (IaC)	AWS CloudFormation / AWS CDK — defines infrastructure in templates for consistent, repeatable, version-controlled deployment

Deployment Models

Cloud — fully in AWS. On-premises — fully in a private data center. Hybrid — a mix, connecting on-premises infrastructure to AWS (e.g., via VPN or Direct Connect).

The AWS Management Console is the web-based graphical interface, best suited for exploring services, learning, and one-off manual tasks. The AWS CLI provides command-line access that can be scripted, making it a better fit for repeatable operational tasks than clicking through the console each time. SDKs let developers call AWS services directly from application code in their language of choice. Infrastructure as code, through AWS CloudFormation or the AWS Cloud Development Kit, takes repeatability further — infrastructure is defined in a template file that can be version-controlled, reviewed, and deployed identically every time, which is the preferred approach for production environments that need to be reproducible. On deployment models: a fully cloud deployment runs entirely in AWS, an on-premises deployment runs entirely in a company's own data center, and a hybrid deployment connects the two together, often used during a gradual migration or when certain workloads must legally remain on-premises.

3.2Task Statement 3.2

The AWS Global Infrastructure

Regions · Availability Zones · Edge Locations · High Availability

3.2

Regions, AZs & Edge Locations

Region

A geographic area containing multiple, isolated Availability Zones (e.g., us-east-1). Choose based on latency, compliance, and service availability.

Availability Zone (AZ)

One or more discrete data centers with redundant power, networking, and connectivity — physically separated so AZs do not share single points of failure.

Edge Location

Sites used by Amazon CloudFront and Route 53 to cache content and route traffic closer to end users, reducing latency.

Exam trigger: "Eliminate a single point of failure" → deploy across multiple AZs. "Reduce latency for global users" → edge locations or an additional Region. "Meet data residency/sovereignty laws" → choose a specific Region.

A Region is a geographic area, such as us-east-1 in Northern Virginia, that contains multiple Availability Zones. Choosing a Region is typically driven by three factors: proximity to your users for latency, legal or compliance requirements around where data can reside, and which services or pricing are available in that Region. An Availability Zone is one or more physically separate data centers within a Region, each with its own independent power, cooling, and network connectivity, engineered so that a failure in one AZ — a power outage or a network issue — does not cascade into another. High availability is achieved by deploying redundant resources across multiple AZs, so that the failure of a single AZ doesn't take down the whole application. Edge locations are a different, much larger set of sites used by services like Amazon CloudFront and Route 53 to cache content and resolve DNS closer to the end user, reducing the round-trip time for requests. Using multiple Regions serves different purposes than multiple AZs — common reasons include disaster recovery and business continuity in case an entire Region becomes unavailable, reducing latency for users spread across different parts of the world, and satisfying data sovereignty requirements that require certain data to remain within a specific country or region.

3.3Task Statement 3.3

AWS Compute Services

EC2 · Containers · Serverless · Auto Scaling · Load Balancing

3.3

EC2, Containers & Serverless Compute

Service / Family	Use Case
EC2 — General Purpose	Balanced compute/memory/network — web servers, dev environments
EC2 — Compute Optimized	High-performance processors — batch processing, gaming servers, HPC
EC2 — Memory Optimized	Large in-memory datasets — real-time big data analytics, in-memory caches
EC2 — Storage Optimized	High, sequential read/write to local storage — data warehousing, distributed file systems
Amazon ECS	AWS-native container orchestration
Amazon EKS	Managed Kubernetes container orchestration
AWS Fargate	Serverless compute engine for containers — no EC2 instances to manage, works with ECS & EKS
AWS Lambda	Run code in response to events, without provisioning or managing any servers

EC2 instance families are grouped by the resource they optimize for. General purpose instances balance compute, memory, and networking for a broad range of workloads. Compute optimized instances favor high-performance processors for CPU-intensive tasks like batch processing or gaming servers. Memory optimized instances are built for workloads that process large datasets in memory, such as real-time analytics. Storage optimized instances are built for workloads needing very high, sequential read and write access to large local datasets, like data warehousing. On the container side, Amazon ECS is AWS's own native container orchestration service, while Amazon EKS is a managed Kubernetes service for teams standardized on the open-source Kubernetes ecosystem. AWS Fargate is a serverless compute engine that works with both ECS and EKS, removing the need to provision or manage the underlying EC2 instances that containers run on. AWS Lambda takes serverless a step further for individual functions — code runs only in response to a triggering event, and AWS handles all provisioning, scaling, and server management, so cost is based purely on execution time and requests rather than an always-on server.

3.3

Auto Scaling & Load Balancing

Auto Scaling

Automatically adds or removes EC2 instances in response to real-time demand, providing elasticity — capacity grows during spikes and shrinks during quiet periods so you only pay for what's needed.

Elastic Load Balancing (ELB)

Automatically distributes incoming application traffic across multiple targets (EC2 instances, containers, IP addresses) in one or more Availability Zones, improving fault tolerance and availability.

Exam trigger: "Automatically add capacity when traffic spikes" → Auto Scaling. "Spread incoming traffic evenly across several servers" → Load Balancer. They're commonly used together.

Auto Scaling is the service responsible for the elasticity benefit discussed back in Domain 1 — it monitors demand and automatically launches new instances when load increases, then terminates instances when load drops, so an application always has roughly the right amount of capacity without manual intervention and without paying for idle, unused capacity. Elastic Load Balancing solves a related but distinct problem: it sits in front of a fleet of instances or containers and distributes incoming requests across them, which both improves performance under load and adds fault tolerance, since traffic is automatically routed away from an unhealthy target. Auto Scaling and load balancers are frequently deployed together — as Auto Scaling adds or removes instances, the load balancer automatically adjusts where it sends traffic, so the exam often describes them as a paired solution for a scenario involving unpredictable traffic and availability requirements.

3.4Task Statement 3.4

AWS Database Services

Relational · NoSQL · In-Memory · Migration Tools

3.4

Database Services & Migration

Category	Service	Use Case
Relational	Amazon RDS	Managed relational database (MySQL, PostgreSQL, SQL Server, etc.) — handles patching, backups
Relational	Amazon Aurora	AWS-built MySQL/PostgreSQL-compatible engine — higher performance & availability than standard RDS engines
NoSQL	Amazon DynamoDB	Key-value / document database — single-digit millisecond performance at any scale
In-Memory	Amazon ElastiCache	Managed Redis/Memcached — caching layer for microsecond read latency
Migration	AWS DMS	Migrates databases to AWS with minimal downtime
Migration	AWS SCT	Converts database schema from one engine to a different target engine

Exam trigger: EC2-hosted database → full control, full management burden. Managed database (RDS/Aurora/DynamoDB) → AWS handles patching, backups, and scaling infrastructure.

Choosing between hosting a database on EC2 yourself versus using a managed database service mirrors the shared responsibility discussion from Domain 2: self-hosting on EC2 gives full control over the database engine and OS but requires you to handle patching, backups, and high availability yourself, while a managed service like RDS offloads that operational burden to AWS. Amazon RDS supports several common relational engines and automates patching and backups. Amazon Aurora is AWS's own MySQL- and PostgreSQL-compatible engine, built for higher throughput and availability than the equivalent open-source engine running on RDS. Amazon DynamoDB is AWS's NoSQL, key-value and document database, designed for consistent, very low millisecond latency regardless of scale. Amazon ElastiCache adds an in-memory caching layer in front of a database using Redis or Memcached, used to reduce load on the primary database and serve extremely latency-sensitive reads. For migration, AWS Database Migration Service, or DMS, moves an existing database into AWS while minimizing downtime, and the AWS Schema Conversion Tool, or SCT, is used alongside it when the source and target engines are different, converting the database schema and code to be compatible with the new engine.

3.5Task Statement 3.5

AWS Network Services

VPC Components · VPC Security · Route 53 · Connectivity

3.5

VPC, Security & Connectivity

VPC Components

Subnets — segments of a VPC's IP range; public (internet-facing) or private
Internet Gateway — connects a VPC to the internet
NAT Gateway — lets private subnet resources reach the internet outbound only
Route Tables — control where subnet traffic is directed

VPC Security Layers

Network ACLs — stateless, subnet-level allow/deny rules
Security Groups — stateful, instance-level firewall rules
Amazon Inspector — automated vulnerability scanning of resources in the VPC

Amazon Route 53

AWS's scalable DNS web service — domain registration, DNS routing, and health checking, with multiple routing policies (e.g., latency-based, geolocation, failover).

Connectivity to AWS

AWS VPN — encrypted connection over the public internet
AWS Direct Connect — dedicated private network connection, bypassing the public internet

A VPC is a logically isolated section of the AWS Cloud where you launch resources. Subnets divide a VPC's IP address range into smaller segments, and are labeled public or private depending on whether they route to an internet gateway. The internet gateway is what actually connects a VPC to the public internet, while a NAT gateway lets resources in a private subnet initiate outbound internet connections — for things like software updates — without being directly reachable from the internet. Route tables determine which path traffic takes out of a subnet. On security, network ACLs operate at the subnet level and are stateless, meaning inbound and outbound rules are evaluated independently, while security groups operate at the individual instance level and are stateful, meaning a response to an allowed inbound request is automatically allowed back out. Amazon Route 53 is AWS's DNS service, handling domain registration and traffic routing, with several routing policy options such as routing based on latency, geographic location, or automatic failover to a healthy resource. For connecting an external network into AWS, AWS VPN creates an encrypted tunnel over the public internet — quicker to set up but subject to internet variability — while AWS Direct Connect establishes a dedicated, private physical network connection between an on-premises location and AWS, offering more consistent performance for higher cost and lead time.

3.6Task Statement 3.6

AWS Storage Services

Object · Block · File · Lifecycle Policies · AWS Backup

3.6

Object, Block & File Storage

Type	Service	Use Case
Object	Amazon S3	Unstructured data at massive scale — backups, static websites, data lakes
Block	Amazon EBS	Persistent, durable block storage attached to a single EC2 instance
Block	Instance Store	High-performance, physically attached, but ephemeral — data is lost on stop/termination
File	Amazon EFS	Managed NFS file system shared across many Linux EC2 instances
File	Amazon FSx	Managed Windows File Server or Lustre (high-performance computing) file systems
Hybrid / Cached	AWS Storage Gateway	Bridges on-premises environments to AWS storage, caching frequently used data locally

Object storage, delivered through Amazon S3, is best for unstructured data at virtually unlimited scale, such as backups, media files, and data lake storage, and it's accessed over HTTP(S) rather than mounted like a traditional disk. Block storage divides data into fixed-size blocks and behaves like a traditional hard drive attached to a server — Amazon EBS provides persistent block storage that survives an instance stopping and can be detached and reattached, while an instance store is physically attached to the underlying host for very high performance but loses its data the moment the instance is stopped or terminated, making it suitable only for temporary or replaceable data. File storage provides a shared file system that multiple instances can mount at once — Amazon EFS offers this using the NFS protocol for Linux workloads, while Amazon FSx offers managed Windows File Server for Windows-based file shares or FSx for Lustre for high-performance computing workloads. AWS Storage Gateway serves organizations with a hybrid setup, presenting a local, cached interface on-premises while actually storing data durably in AWS, letting existing on-premises applications use AWS storage without being rewritten.

3.6

S3 Storage Classes, Lifecycle & Backup

S3 Storage Class	Use Case
S3 Standard	Frequently accessed data, low latency and high throughput
S3 Intelligent-Tiering	Automatically moves objects between tiers based on changing access patterns
S3 Standard-IA	Infrequently accessed data that still needs rapid access when retrieved
S3 One Zone-IA	Infrequently accessed, re-creatable data stored in a single AZ — lower cost
S3 Glacier tiers	Long-term archival — retrieval times range from minutes (Instant Retrieval) to hours (Flexible / Deep Archive)

Lifecycle Policies

Automatically transition objects to cheaper storage classes, or expire (delete) them, based on rules like object age — reduces storage cost without manual management.

AWS Backup

Centralizes and automates backup across multiple AWS services (EBS, RDS, DynamoDB, EFS, and more) from a single policy-based console.

Amazon S3's storage classes let a customer trade off cost against retrieval speed and availability. S3 Standard is for frequently accessed, latency-sensitive data. S3 Intelligent- Tiering automatically watches access patterns and moves objects between tiers without any manual intervention, which is useful when access patterns are unpredictable. S3 Standard-IA and One Zone-IA are for infrequently accessed data, with One Zone-IA being cheaper because it's stored in only a single Availability Zone rather than replicated across multiple — appropriate only for data that could be recreated if that AZ were lost. The S3 Glacier family of classes is built for long-term archival, with retrieval times ranging from minutes for Glacier Instant Retrieval up to several hours for Glacier Deep Archive, the cheapest storage tier AWS offers. Lifecycle policies automate the movement between these classes — for example, transitioning objects to Glacier after 90 days and deleting them entirely after a year — removing the need to manually manage aging data. AWS Backup is a separate, centralized service that automates and manages backup policies across many AWS services at once, rather than configuring backup separately for EBS, RDS, DynamoDB, and EFS individually.

3.7Task Statement 3.7

AI/ML & Analytics Services

Machine Learning · Language & Vision AI · Data Analytics

3.7

AI/ML & Analytics Services

Service	Category	Purpose
Amazon SageMaker AI	ML Platform	Build, train, and deploy custom machine learning models
Amazon Lex	Conversational AI	Build chatbots and voice interfaces (same technology behind Alexa)
Amazon Kendra	Intelligent Search	Natural-language search across enterprise documents and data
Amazon Rekognition	Computer Vision	Image and video analysis — object, scene, and face detection
Amazon Comprehend	NLP	Extract insights, sentiment, and key phrases from text
Amazon Athena	Analytics	Serverless SQL queries directly against data stored in S3
Amazon Kinesis	Analytics	Ingest and process real-time streaming data
AWS Glue	Analytics	Serverless ETL (extract, transform, load) and data cataloging
Amazon QuickSight	Analytics	Business intelligence dashboards and data visualization

Amazon SageMaker AI is the umbrella platform for building, training, and deploying custom machine learning models. Amazon Lex provides the natural-language understanding used to build chatbots and voice assistants, using the same underlying technology as Alexa. Amazon Kendra adds intelligent, natural-language search on top of a company's own documents and data sources, going beyond simple keyword matching. Amazon Rekognition analyzes images and video for objects, scenes, activities, and faces. Amazon Comprehend applies natural language processing to unstructured text, pulling out sentiment, entities, and key phrases. On the analytics side, Amazon Athena lets you run standard SQL queries directly against data sitting in S3 without needing to load it into a database first, and it's serverless, so there's no infrastructure to manage. Amazon Kinesis is built for ingesting and processing data as a continuous real-time stream, such as clickstream or IoT sensor data. AWS Glue handles the extract-transform-load, or ETL, work of preparing data for analysis and also maintains a data catalog describing where that data lives. Amazon QuickSight is the business intelligence layer, turning processed data into interactive dashboards and visualizations for business stakeholders.

3.8Task Statement 3.8

Other In-Scope Service Categories

Integration · Business Apps · Dev Tools · End-User Computing · Frontend · IoT

3.8

Integration, Business Apps, Support & Dev Tools

Category	Service	Purpose
App Integration	Amazon EventBridge	Serverless event bus connecting applications with event data
App Integration	Amazon SNS	Pub/sub messaging — sends alerts and notifications to many subscribers
App Integration	Amazon SQS	Fully managed message queuing to decouple application components
Business App	Amazon Connect	Cloud-based contact center
Business App	Amazon SES	Send transactional and marketing email at scale
Customer Enablement	AWS Support	Support plans — Basic, Developer, Business, Enterprise
Developer Tools	AWS CodeBuild / CodePipeline	Compile, test, and orchestrate CI/CD deployment pipelines
Developer Tools	AWS X-Ray	Trace and debug requests across distributed applications

Amazon EventBridge is a serverless event bus, used to route events between decoupled application components and third-party SaaS applications. Amazon SNS follows a publish/subscribe pattern, fanning a single message out to many subscribers at once — commonly used for sending alerts and notifications. Amazon SQS is a managed message queue used to decouple two components of an application, so a producer and consumer don't need to interact directly or at the same time — remember SNS pushes messages out broadly, while SQS holds messages in a queue for one or more consumers to pull. Amazon Connect provides a cloud-based contact center without needing physical call-center infrastructure. Amazon SES is built specifically for sending email at scale, both transactional and marketing. AWS Support offers tiered plans — Basic, Developer, Business, and Enterprise — with the higher tiers unlocking faster response times and more direct access to AWS support engineers. For developer tools, AWS CodeBuild compiles and tests code, AWS CodePipeline orchestrates the overall continuous integration and deployment pipeline, and AWS X-Ray helps developers trace a request as it moves through a distributed, multi-service application to pinpoint where a slowdown or error is occurring.

3.8

End-User Computing, Frontend/Mobile & IoT

Category	Service	Purpose
End-User Computing	Amazon WorkSpaces	Fully managed virtual desktop infrastructure (VDI)
End-User Computing	Amazon AppStream 2.0	Streams individual desktop applications to a browser, without a full virtual desktop
End-User Computing	WorkSpaces Secure Browser	Delivers secure, isolated browser access to internal web apps
Frontend & Mobile	AWS Amplify	Build, deploy, and host full-stack web and mobile applications
Frontend & Mobile	AWS AppSync	Managed GraphQL and Pub/Sub API service for real-time apps
IoT	AWS IoT Core	Connect, manage, and secure billions of IoT devices at scale

Exam trigger: "Give employees a full virtual desktop" → WorkSpaces. "Stream just one application, not a whole desktop" → AppStream 2.0. "Build a mobile app's backend quickly" → Amplify.

Amazon WorkSpaces provides a full, persistent virtual desktop that an end user connects to, functioning like a traditional company laptop but hosted in AWS. Amazon AppStream 2.0 takes a narrower approach, streaming just a single application to a browser or device rather than an entire desktop environment, which is useful when a user only needs occasional access to one specific piece of software. WorkSpaces Secure Browser provides secure, isolated browser sessions for accessing internal web applications without exposing the underlying network. AWS Amplify is a toolset for quickly building and deploying full-stack web and mobile applications, handling hosting, backend provisioning, and CI/CD in one integrated workflow. AWS AppSync is a managed GraphQL service, well suited to applications that need real-time data synchronization, like a live chat or collaborative app, rather than the more traditional REST-style API pattern. AWS IoT Core is the entry point for IoT workloads, providing secure connectivity and device management for potentially billions of connected devices, along with the ability to route their data into other AWS services for processing and analysis.

Quick Review — Domain 3 Checklist

Can you answer these?

3.1 & 3.2

Console vs. CLI vs. IaC
Region vs. AZ vs. edge location

3.3 & 3.4

EC2 families, ECS/EKS, Lambda/Fargate
RDS/Aurora vs. DynamoDB vs. ElastiCache

3.5 & 3.6

NACLs vs. security groups, VPN vs. Direct Connect
S3 classes, EBS vs. EFS vs. FSx

3.7 & 3.8

SageMaker, Lex, Athena, Glue, QuickSight
SNS vs. SQS, WorkSpaces vs. AppStream

Quick Reference — Concept Map

Deploy & Infrastructure

Console → manual/one-time
IaC → repeatable
AZ → no shared failure
Edge → lower latency

Compute & Database

Lambda → event-driven, no servers
Fargate → serverless containers
RDS/Aurora → relational
DynamoDB → NoSQL, key-value

Network & Storage

SG → stateful, instance
NACL → stateless, subnet
S3 → object storage
EBS → block, single instance

AI/ML, Analytics & More

Athena → SQL on S3
Kinesis → real-time streams
SNS → push to many
SQS → queue for pull

Domain 3 Complete

You're Ready for Domain 3

34% of CLF-C02 · Cloud Technology and Services
The largest domain — expect broad service recall, not deep configuration.