The AWS Certified Cloud Practitioner (CCP) — now exam CLF-C02 — is Amazon's entry-level cloud certification. It's not the most technically demanding AWS credential, but it's consistently one of the most popular certification exams in the tech industry because it's the gateway to AWS's broader certification ecosystem. Pass the CCP and you've verified a baseline cloud fluency that opens doors to associate-level certifications like the Solutions Architect and Developer exams.
Here's what most candidates underestimate: the CCP isn't as easy as "entry-level" implies. It tests a surprising breadth of AWS services, cloud concepts, pricing models, and security principles. Candidates who assume it's a casual read-through-the-docs exam often fail on their first attempt. Candidates who use structured practice exams and understand the exam blueprint pass reliably.
This guide covers the CCP exam structure, what it actually tests, and how to use practice exams strategically to maximize your score.
The current CCP exam (CLF-C02) replaced the older CLF-C01 in 2023. Key specs:
Questions are multiple choice (one answer) and multiple response (select two or more correct answers). Multiple response questions are flagged as such — and they're harder because partial credit isn't given; you need all correct answers selected.
The CLF-C02 blueprint covers four domains:
Cloud computing fundamentals, the value proposition of cloud vs. on-premises infrastructure, cloud deployment models (public, private, hybrid), and the AWS Well-Architected Framework's six pillars (operational excellence, security, reliability, performance efficiency, cost optimization, sustainability). If you're new to cloud, this is where to start — these concepts underpin everything else on the exam.
AWS's shared responsibility model is the most critical concept in this domain — and it appears on nearly every CCP exam in some form. You need to know what AWS is responsible for ("security of the cloud") vs. what you're responsible for ("security in the cloud"). This domain also covers IAM (users, groups, roles, policies), encryption at rest and in transit, AWS compliance programs, and services like Shield, WAF, GuardDuty, and Security Hub.
The broadest domain. Covers core AWS services you need to know by name, function, and use case:
You don't need deep technical expertise in each service — you need to know what problem each service solves and when you'd choose it over similar services.
AWS pricing models (on-demand, reserved, spot instances, Savings Plans), total cost of ownership calculations, AWS Free Tier limitations, Cost Explorer, Cost and Usage Reports, Budgets, and AWS support plans (Basic, Developer, Business, Enterprise).
Practice exams are the most efficient way to prepare for the CCP — but only if you use them correctly. Here's the difference between passive practice testing and active practice testing.
Passive practice testing: Take a practice exam, see your score, move on. This builds familiarity with question formats but doesn't build knowledge or catch conceptual gaps.
Active practice testing: Take a practice exam. For every wrong answer, read the full explanation. Identify the underlying concept that question tested. Ask yourself: do I understand that concept clearly now? If not, go read about it specifically. Then take another practice exam and check whether that concept appears again.
Active practice testing takes longer but produces dramatically better outcomes. Every wrong answer is a signal — it tells you exactly where your preparation has a gap.
Rather than running full 65-question practice exams from the start, begin with domain-specific practice. Take 20-question sets focused on Security and Compliance, then Technology and Services, then Cloud Concepts. This reveals which domains need the most work before you simulate full exam conditions.
The Security domain deserves extra attention even if you think you know it. The shared responsibility model questions are deliberately nuanced — the exam will present scenarios involving specific services and ask who is responsible for specific security aspects. S3 bucket policy misconfiguration = your responsibility. Underlying S3 infrastructure security = AWS's responsibility. Lambda execution environment isolation = AWS's responsibility. Lambda function code vulnerabilities = your responsibility. These distinctions show up constantly.
In the final 2-3 weeks before your exam, switch to timed 65-question full-length practice exams. The 90-minute window is more than adequate for most candidates — the challenge isn't time, it's maintaining focus through service name comparisons and pricing scenario questions. Timed practice builds that sustained attention.
Certain AWS services appear on nearly every CCP exam. Know what each does, when to use it, and how it differs from similar services:
The CCP practice tests here cover all major exam domains including AWS Cloud Security and Compliance and Cloud Architecture and Design Principles. Use domain-specific tests first, then run full practice exams as your exam date approaches.
The CCP is achievable for anyone willing to do the work — but it demands real preparation, not casual browsing of AWS documentation. Know the shared responsibility model cold. Know when to use EC2 vs. Lambda vs. ECS. Know S3 storage classes. Know the difference between CloudWatch and CloudTrail. Practice enough that AWS service names and their functions come automatically.
Use the AWS CCP practice tests here to build domain knowledge systematically. Work through free Cloud Practitioner practice questions and Core Compute and Storage Services questions, then run full-length timed practice exams in the final week. The certification is worth it — it's the first checkpoint on a cloud career path that pays dividends for years.