Based on the CLF-C02 exam guideReport an error
This week we built up, step by step, the cloud concepts that form the most basic foundation of AWS certification. We learned what the cloud is (Day 1), where it is laid out (Day 2), how security responsibility is divided (Day 3), and what the standards of good design are (Day 4). Today we put all of these pieces back together into one big picture and make sure they settle firmly in your head.
If you read a review article from start to finish and close it, little stays. We recommend using it in the following order.
| Day | Topic | One line you must remember |
|---|---|---|
| 1 | What is cloud computing | Rent resources over the internet and pay for what you use + six advantages |
| 2 | AWS global infrastructure | Region > Availability Zone > data center, edge locations, global/Regional services |
| 3 | Shared responsibility model | AWS is "the cloud itself (OF)," the customer is "inside the cloud (IN)" |
| 4 | Well-Architected six pillars | O-S-R-P-C-S + the value of cloud adoption |
Cloud computing is a model where you rent computing resources over the internet when you need them and pay only for the amount you use. You rent servers the way you draw electricity from an outlet.
Let's memorize again the six advantages AWS emphasizes.
Underlying the six advantages is "elasticity (automatically growing and shrinking with demand)." In particular, ③ no need to guess capacity and ④ speed and agility are possible thanks to elasticity.
This is where people often go wrong. Many people confuse ① and ②. ① is a change in the way of paying (in advance → as you use), while ② is a change in unit price (AWS buys in bulk and supplies cheaply). If the passage says "without upfront investment," it is ①; if it says "thanks to AWS's massive purchasing power," it is ②.
⚠️ Pitfall: The choice "the cloud is always cheaper" is wrong in most cases. The advantage of the cloud is not "it's cheap" but "you pay only for what you use." For a workload that runs at full capacity around the clock at maximum performance, on-premises can even be cheaper. The exam often uses absolute expressions such as "total cost is guaranteed to go down" as wrong answers. If you see words like "always," "unlimited," "completely free," or "100%," be suspicious first.
AWS infrastructure is a three-tier structure.
Region <- a geographic foothold around the world (Seoul, Tokyo, etc.)
└ Availability Zone (AZ) <- an independent facility within a Region (usually three or more)
└ Data center <- the physical building that makes up an AZ
On top of that come edge locations (caching and delivering content close to users, e.g., CloudFront).
Services fall into two kinds.
The basics of a high-availability design is "spread placement across two or more AZs." That is because even if one AZ goes down entirely, the service survives in another AZ.
Why are Regions divided? Summarizing it into three reasons makes it stay in memory longer.
Adding that cost can also differ per Region, and that not every service exists in every Region, covers almost every "criteria for choosing a Region" question.
⚠️ Pitfall: The most common mistake is confusing an AZ with a data center. An AZ is a logical unit made up of one or more data centers, physically separated from other AZs in the same Region yet connected to them by a fast network. And another thing: an edge location is not a place that runs applications. It is a place that delivers and caches content close to users. If it is "deliver static content to users quickly," it is the edge; if it is "where should we put the servers," it is a Region.
The core in one sentence: AWS is responsible for security "OF the cloud," and the customer is responsible for security "IN the cloud."
| AWS responsibility | Customer responsibility |
|---|---|
| Data centers, hardware | Data, data encryption |
| Virtualization (hypervisor) | IAM users and permissions |
| Global network infrastructure | Guest OS patching (EC2), firewall settings, app security |
And the boundary moves with the service. The further you go EC2 → RDS → Lambda (the more managed), the smaller the customer's responsibility, but data and IAM permissions are always the customer's share.
"As the level of abstraction rises, the customer's responsibility narrows from the top." However, data and permissions never shrink at any stage — these two sentences are the master key to shared responsibility model problems.
Comparing the shared responsibility model to an apartment rental gives you the feel for it. The building structure, elevators, and entrance access system are the landlord's (AWS's) share. But locking your own front door, not giving your password to just anyone, and managing the valuables inside your home are the tenant's (the customer's) share. No matter how sturdy the building, if the tenant leaves the door open, a thief gets in.
A good share of real cloud security incidents were caused not by AWS infrastructure being breached but by cases where the customer set a storage bucket to public, so anyone could view the data. The responsibility for such incidents lies 100% on the customer's side. When a passage like "data was leaked. Whose responsibility is it?" appears on the exam, the answer splits depending only on whether the cause lies in configuration, permissions, or data, or in physical infrastructure or the hypervisor.
Here is a quick way to judge.
| Cause in the passage | Responsible party |
|---|---|
| Set a storage bucket to public, granted excessive permissions | Customer |
| Did not patch the guest OS (EC2) | Customer |
| Did not encrypt data | Customer |
| Data center fire, physical intrusion | AWS |
| Hardware failure, hypervisor vulnerability | AWS |
| Engine patching of a managed DB | AWS |
The six pillars of good cloud design — O-S-R-P-C-S.
When solving problems, first identifying "which pillar is this scenario asking about?" makes the answer visible.
There is one more thing to keep in mind here. You must not confuse the CAF (Cloud Adoption Framework), which has a similar name to Well-Architected. Well-Architected is six Pillars that look at whether you built one system well, and CAF is six Perspectives (business, people, governance, platform, security, operations) that look at how the whole organization will move to the cloud.
Most of the places the exam actually targets in this week's material are "two concepts that are similar but different." The table below is the substance of Week 1.
| Confusing pair | Left | Right | One-line distinction |
|---|---|---|---|
| Region vs Availability Zone (AZ) | A geographic foothold around the world | A group of independent facilities within a Region | The Region is the big container, the AZ is a partition inside it |
| Availability Zone vs data center | A logical unit made up of one or more DCs | The physical building that makes up an AZ | The AZ is logical, the DC is a building |
| Regional service vs global service | EC2, RDS, S3, etc. — you pick a Region | IAM, Route 53, CloudFront — one worldwide | If the passage says "select a Region," it is a Regional service |
| Edge location vs Region | Delivers and caches content close to users | Actually runs the service | The edge is delivery, the Region is the kitchen |
| Scalability vs elasticity | The ability to add resources | Automatically grows and shrinks with demand | If the word "automatic" is there, it is elasticity |
| Capital expense vs variable expense | Large upfront investment that goes out in advance | Cost that goes out as you use | The cloud is capital expense → variable expense |
| High availability vs disaster recovery | Keeps working even when failures occur | A plan to recover after a major incident | High availability is about not stopping, disaster recovery is about bringing back to life |
| Public vs private vs hybrid | Shared by many customers | Dedicated to one organization | Connecting the two (or on-premises) is hybrid |
| IaaS vs PaaS vs SaaS | Rent only the infrastructure | Rent up to the runtime environment | Up to finished software is SaaS |
| AWS responsibility vs customer responsibility | The cloud itself (OF) | Inside the cloud (IN) | Data and permissions are always the customer's |
| Well-Architected vs CAF | System design review (six pillars) | Organizational transition plan (six perspectives) | If the subject is a workload, WA; if a company, CAF |
| Performance efficiency vs cost optimization | Worried about speed and latency | Worried about the bill and waste | Is the object of worry time or money? |
Pitfall: Scalability and elasticity are a pair easily swapped on the exam. If you see "automatically," "according to demand," or "shrinks when not needed," it is elasticity. If it is just "can handle a larger scale," it is scalability. The decisive difference is that elasticity includes the shrinking direction too.
When you meet these expressions in a passage, immediately think of this direction.
| Passage keyword | Answer to think of |
|---|---|
| "without upfront investment," "without spending a large sum in advance" | Trade capital expense for variable expense |
| "it is hard to predict how much we'll need" | No need to guess capacity / elasticity |
| "unit prices are low thanks to AWS's massive purchasing power" | Economies of scale |
| "to users in other countries in minutes" | Go global in minutes / global reach |
| "removes the burden of power, cooling, and hardware replacement" | Lower data center operating costs |
| "service continues even if one AZ goes down" | Multi-AZ placement / reliability (high availability) |
| "deliver content from near the user" | Edge location / CloudFront |
| "data must not cross the border" | Region selection (compliance) |
| "whose responsibility is guest OS patching?" | Customer (for EC2) |
| "whose responsibility is data center physical security?" | AWS |
| "always the customer's responsibility regardless of service" | Data, IAM permissions |
| "least privilege, encryption, access control" | Security pillar |
| "automate repetitive tasks, monitoring, alerts" | Operational Excellence pillar |
| "reduce spending by turning off unused resources" | Cost Optimization pillar |
| "reduce carbon emissions and energy use" | Sustainability pillar |
| "organizational transition readiness, workforce skills, governance" | CAF |
In case your mind goes blank in the exam room, memorize three flows.
Flow 1 — If it asks who is responsible
What is the cause of the incident in the passage?
├ configuration, permissions, data, app code -> customer responsibility (IN the cloud)
└ buildings, hardware, virtualization layer -> AWS responsibility (OF the cloud)
* If ambiguous: "Can the customer change it in the console?"
If they can change it, it is the customer's responsibility.
Flow 2 — If it asks which pillar
What does the passage worry about most?
├ stopping -> Reliability
├ being breached -> Security
├ being slow -> Performance Efficiency
├ money -> Cost Optimization
├ too much manual effort -> Operational Excellence
└ environmental impact -> Sustainability
Flow 3 — If it asks about infrastructure concepts
"Where do we put it" -> Region (latency, compliance, cost, service availability)
"To keep it from stopping" -> spread across multiple AZs
"To deliver quickly" -> edge location
"Does it operate as one worldwide" -> global service (IAM, Route 53, CloudFront)
Consider a passage: "A financial company that cannot keep data overseas because of domestic regulations wants to build a system where service interruption is not allowed." Taking the pieces apart one by one, the answer comes out by itself. "Data cannot be kept overseas" → choose a domestic Region, "interruption is not allowed" → spread across multiple AZs within that Region, and the pillar that this whole design asks about is reliability. Even if the passage is long, when split into pieces, each piece is one thing you learned this week.
If you can answer the following questions without hesitation in your own words, you have passed Week 1.
CLF-C02 is often decided by avoiding traps rather than by knowledge. The wrong-answer types that recur in this week's scope are as follows.
| Wrong-answer pattern | Why it is wrong |
|---|---|
| "The cloud is always cheaper" | The essence of the cloud is not cheapness but usage-based billing |
| "AWS is responsible for all of the customer's data security" | Data and permissions are always the customer's share |
| "A Region is inside an Availability Zone" | The containment is reversed. AZs are inside a Region |
| "Applications run at edge locations" | The edge's role is delivery and caching |
| "Compliance is one of the six pillars" | It is not a pillar. It is handled within the security pillar |
| "Scalability = automatically growing and shrinking" | That is elasticity |
| "Hybrid = using multiple public clouds together" | Hybrid is a public + private/on-premises connection |
Pitfall: Among the choices, those containing absolute expressions such as "all," "always," "never," "unlimited," or "fully automatic" are often wrong. Conversely, those with conditional expressions such as "is suitable when ~" or "can reduce ~" are often the correct answer. Of course there are exceptions where an absolute expression is the correct answer — as in "data is always the customer's responsibility." Use it not as a rule but as a warning sign.
This week's four pieces connect into one.
[What is it] Cloud = rented computing + six advantages (Day 1)
↓
[Where is it] Global infrastructure laid out in Regions, AZs, edges (Day 2)
↓
[Who is responsible] Shared responsibility model: AWS (OF) vs customer (IN) (Day 3)
↓
[How to do it well] Good design through the Well-Architected six pillars (Day 4)
In other words, once you know what the cloud is → draw the map of the infrastructure it is spread across → understand how responsibility is divided on top of it → and finally have the standard of "how to build well," the foundation of cloud concepts is complete. From next week, we will place actual AWS services on this foundation one by one.
Also look at how these four pieces support one another. If you don't know the infrastructure (Day 2), you cannot understand reliability design (Day 4), and if you don't know the responsibility boundary (Day 3), the security pillar (Day 4) becomes hollow. Services like EC2 and S3 that you will learn next week also come back, in the end, to three questions: "which Region is this service in, how far is my responsibility, and which pillar does it satisfy?" That is why this week's material is not just one piece of the exam scope but a lens for reading everything else.
Click a choice to reveal the answer and explanation.
Question 1
Which of the following is the most appropriate definition of the cloud as learned in Week 1?
Question 2
Which of the following correctly describes the structure of AWS global infrastructure?
Question 3
In the Shared Responsibility Model, which area is always the customer's responsibility no matter which service is used?
Question 4
The activity of "protecting the system through least-privilege grants and data encryption" corresponds to which Well-Architected pillar?
Question 5
Which of the following is NOT one of the six advantages of the cloud?