AWS CCP · Domain 3 of 4

AWS CCP Domain 3: Cloud Technology and Services

This is the largest CCP domain. It covers how AWS is deployed and operated, the global infrastructure, and the core compute, storage, database, network, AI and analytics services, so you can match a common need to the right service.

Exam format
34%
Official task statements
8
Assessment estimate
~17
Suggested study time estimate
10–15 hrs

About 12 min read Reviewed October 2026

Overview

Domain 3 covers AWS technology breadth across eight task statements: methods of deploying and operating in AWS, the global infrastructure, and identifying compute, database, network, storage, AI and machine learning and analytics, and other core services. It is recognition-level: knowing what each major service does and when to use it, not how to configure it. Examples include EC2 for virtual machines, S3 for object storage, RDS and DynamoDB for databases, VPC for networking, Lambda for serverless, and the Regions and Availability Zones that make up the global infrastructure.

At 34%, this is the heaviest domain by weight, and it is broad rather than deep. The exam rewards recognizing which service fits a common use case, such as object storage pointing to S3 or a managed relational database pointing to RDS. The breadth makes a service cheat sheet the most useful study tool.

How it's tested

CLF-C02 questions in this domain describe a common need and ask which AWS service fits, or which deployment or infrastructure concept applies. They are recognition-level, rewarding knowing what each service does rather than configuring it. Read the full scenario and all options before choosing.

  • Match service to use case

    A common need is described, and you choose the AWS service that fits, such as S3 for object storage.

  • Infrastructure concept

    A global-infrastructure or deployment term is described, and you identify it, such as Region, Availability Zone or edge location.

  • Distinguish similar services

    Two similar services could apply, and you pick the right one, such as RDS versus DynamoDB.

Reasoning it through

A team needs durable storage for large numbers of files accessed over the internet, without managing servers or file systems. EBS and EFS are tempting, but EBS is block storage for one instance and EFS is a shared file system. Durable object storage accessed over HTTP points to Amazon S3, which is the service for this use case.

Task statements 8

Official task statements from the Amazon Web Services outline, in outline order.

3.1 Define methods of deploying and operating in the AWS CloudProvisioning and operating options and deployment models.
What it means
This covers the ways to provision and operate in AWS, such as the Management Console, the command line interface, software development kits and infrastructure as code, and the cloud deployment models: cloud, hybrid and on-premises.
What to understand
AWS can be operated through the console for a graphical interface, the command line or SDKs for automation, and infrastructure as code for repeatable provisioning. Deployment models range from fully cloud, through hybrid connecting on-premises and cloud, to on-premises. Knowing which option suits a need is enough at this level.
How it shows up
A provisioning or deployment need is described, and you must choose the method or deployment model.
Common confusion
Confusing hybrid with cloud deployment; hybrid connects on-premises and cloud, while a cloud deployment runs entirely in AWS.
3.2 Define the AWS global infrastructureRegions, Availability Zones, edge locations and their purpose.
What it means
This covers the AWS global infrastructure: Regions, Availability Zones, edge locations and points of presence, and the reasons to choose a Region, such as latency, compliance, service availability and pricing.
What to understand
A Region is a geographic area containing multiple isolated Availability Zones. Availability Zones let you build highly available designs within a Region. Edge locations serve content closer to users through CloudFront. Region choice depends on latency to users, data-residency compliance, which services are available and cost.
How it shows up
An infrastructure term or a Region-selection factor is described, and you must identify it.
Common confusion
Confusing a Region with an Availability Zone; a Region contains multiple Availability Zones.
3.3 Identify AWS compute servicesEC2, containers, serverless and when to use each.
What it means
This covers AWS compute services: EC2 virtual machines, container services such as ECS and EKS, serverless Lambda, and related options. It matches a compute need to the service, at recognition level.
What to understand
EC2 provides virtual machines with full control. Containers package applications. Lambda runs code without managing servers, billed per use, suited to event-driven work. Knowing which service fits a common scenario, such as serverless for short event-driven functions, is the goal.
How it shows up
A compute need is described, and you must choose EC2, containers or serverless.
Common confusion
Confusing EC2 with Lambda; EC2 is a managed virtual machine you control, while Lambda runs code without servers.
3.4 Identify AWS database servicesRelational, key-value and other managed databases.
What it means
This covers AWS database services: relational databases with RDS and Aurora, the DynamoDB key-value and document database, in-memory caching with ElastiCache, and other purpose-built databases. It matches a data need to the service.
What to understand
RDS and Aurora are managed relational databases for structured data. DynamoDB is a key-value and document store for high-scale, low-latency access. ElastiCache caches data in memory. Recognizing which fits a common use case, such as a managed relational database pointing to RDS, is enough.
How it shows up
A data storage need is described, and you must choose the right database service.
Common confusion
Confusing RDS with DynamoDB; RDS is relational, while DynamoDB is a key-value and document store.
3.5 Identify AWS network servicesVPC, Route 53, CloudFront and connectivity options.
What it means
This covers AWS network services: the VPC for isolated networking, Route 53 for DNS, CloudFront for content delivery, and connectivity options such as VPN and Direct Connect. It matches a networking need to the service.
What to understand
A VPC is a logically isolated network in AWS. Route 53 provides DNS and routing. CloudFront delivers content from edge locations. Direct Connect provides a dedicated network link to AWS. Knowing each service's purpose is the goal at this level.
How it shows up
A networking need is described, and you must choose the AWS network service.
Common confusion
Confusing CloudFront with Route 53; CloudFront delivers content, while Route 53 provides DNS and routing.
3.6 Identify AWS storage servicesObject, block and file storage and archival.
What it means
This covers AWS storage services: S3 object storage, EBS block storage, EFS and FSx file storage, S3 Glacier for archival, and hybrid storage with Storage Gateway. It matches a storage need to the service.
What to understand
S3 is durable object storage accessed over HTTP. EBS is block storage for a single instance. EFS and FSx are shared file systems. Glacier is low-cost archival. Recognizing the storage type a scenario needs, object, block or file, points to the right service.
How it shows up
A storage need is described, and you must choose object, block or file storage.
Common confusion
Confusing S3, EBS and EFS; S3 is object storage, EBS is single-instance block storage, and EFS is a shared file system.
3.7 Identify AWS AI/ML services and analytics servicesManaged AI, machine learning and analytics services.
What it means
This covers AWS artificial intelligence and machine learning services such as Amazon SageMaker and pre-trained AI services, and analytics services such as Amazon Athena, Amazon Kinesis, AWS Glue and Amazon QuickSight. It matches a need to the service at recognition level.
What to understand
SageMaker builds and trains machine learning models, while pre-trained AI services provide capabilities such as image or language processing without building models. Analytics services query, stream, transform and visualize data. Knowing what each broadly does is sufficient.
How it shows up
An AI, machine learning or analytics need is described, and you must identify the service.
Common confusion
Confusing a pre-trained AI service with SageMaker; pre-trained services provide ready capabilities, while SageMaker builds custom models.
3.8 Identify services from other in-scope AWS service categoriesManagement, monitoring, messaging and developer services.
What it means
This covers other in-scope service categories: management and monitoring with CloudWatch and CloudTrail, messaging with SQS and SNS, developer and deployment tools, and services such as Systems Manager. It matches a need to the service at recognition level.
What to understand
CloudWatch monitors metrics and logs, while CloudTrail records API activity for auditing. SQS and SNS provide messaging and notifications. Recognizing the purpose of each service category, monitoring, auditing, messaging or deployment, points to the right service.
How it shows up
A management, monitoring or messaging need is described, and you must identify the service.
Common confusion
Confusing CloudWatch with CloudTrail; CloudWatch monitors performance and logs, while CloudTrail records API activity for auditing.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Region vs. Availability Zone

    A Region is a geographic area containing multiple isolated Availability Zones.

    Remember
    AZs enable high availability within a Region.
    Tested as
    Infrastructure questions.
    Trap
    Confusing a Region with an AZ.

  • Edge location

    A point of presence that serves content closer to users via CloudFront.

    Remember
    It reduces latency for content delivery.
    Tested as
    Infrastructure and networking questions.
    Trap
    Confusing it with an Availability Zone.

  • EC2 vs. Lambda

    EC2 is a managed virtual machine you control; Lambda runs code without managing servers.

    Remember
    Lambda suits event-driven, short-lived work.
    Tested as
    Compute questions.
    Trap
    Using EC2 where serverless fits.

  • S3 vs. EBS vs. EFS

    S3 is object storage, EBS is single-instance block storage, EFS is a shared file system.

    Remember
    Match the storage type to the need.
    Tested as
    Storage questions.
    Trap
    Using EBS for shared or object storage.

  • S3 Glacier

    Low-cost archival storage for rarely accessed data.

    Remember
    Retrieval is cheaper but slower.
    Tested as
    Storage questions.
    Trap
    Using Glacier for frequently accessed data.

  • RDS vs. DynamoDB

    RDS is a managed relational database; DynamoDB is a key-value and document store.

    Remember
    DynamoDB scales to high throughput with low latency.
    Tested as
    Database questions.
    Trap
    Choosing relational for a key-value workload.

  • VPC

    A logically isolated network in AWS.

    Remember
    It is the foundation of AWS networking.
    Tested as
    Network questions.
    Trap
    Confusing it with a subnet or Region.

  • CloudFront vs. Route 53

    CloudFront delivers content from edge locations; Route 53 provides DNS and routing.

    Remember
    Content delivery versus DNS.
    Tested as
    Network questions.
    Trap
    Confusing the two.

  • CloudWatch vs. CloudTrail

    CloudWatch monitors metrics and logs; CloudTrail records API activity.

    Remember
    Monitoring versus auditing.
    Tested as
    Management questions.
    Trap
    Confusing monitoring with auditing.

  • SQS vs. SNS

    SQS is a message queue; SNS is publish/subscribe notifications.

    Remember
    Queue versus fan-out.
    Tested as
    Messaging questions.
    Trap
    Confusing a queue with pub/sub.

  • SageMaker vs. pre-trained AI services

    SageMaker builds custom models; pre-trained services provide ready capabilities.

    Remember
    Build versus use ready-made.
    Tested as
    AI/ML questions.
    Trap
    Using SageMaker where a pre-trained service suffices.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

S3 vs. EBS vs. EFS vs. Glacier

ConceptMeaningKey differenceCommon trap
S3 Object storage over HTTP Durable, massive scale Treating it as a file system
EBS Block storage for one instance Single-instance disk Expecting shared access
EFS Shared file system Many instances mount it Using EBS instead
Glacier Archival storage Low cost, slow retrieval Using it for frequent access

RDS vs. DynamoDB vs. ElastiCache

ConceptMeaningKey differenceCommon trap
RDS / Aurora Managed relational database Structured data and queries Using it for key-value scale
DynamoDB Key-value and document store High throughput, low latency Expecting relational joins
ElastiCache In-memory cache Lowest latency for hot data Treating it as a primary database

EC2 vs. containers vs. Lambda

ConceptMeaningKey differenceCommon trap
EC2 Managed virtual machines Full control Using it for bursty event work
Containers (ECS/EKS) Packaged, portable applications Consistent deployment Confusing with serverless
Lambda Serverless functions No servers, pay per use Using it for long-running workloads

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. EBS for file sharing

    What candidates pick
    Use EBS for durable storage accessed over the internet.
    Why it looks right
    EBS is a known storage service.
    Why it's wrong
    EBS is single-instance block storage. Durable object storage over HTTP is S3.

    Clue to watch for The need is object storage accessed over the internet.

  2. Region is an AZ

    What candidates pick
    Treat a Region and an Availability Zone as the same thing.
    Why it looks right
    Both are infrastructure terms.
    Why it's wrong
    A Region contains multiple isolated Availability Zones; AZs provide high availability within a Region.

    Clue to watch for The question distinguishes geographic area from isolated zones.

  3. RDS for key-value scale

    What candidates pick
    Use RDS for a simple high-throughput key-value workload.
    Why it looks right
    Relational databases are familiar.
    Why it's wrong
    DynamoDB provides high-throughput, low-latency key-value access where relational would struggle.

    Clue to watch for The access pattern is simple key lookups at scale.

  4. CloudWatch audits

    What candidates pick
    Use CloudWatch to record who made an API call.
    Why it looks right
    Both are AWS observability services.
    Why it's wrong
    CloudWatch monitors metrics and logs; CloudTrail records API activity for auditing.

    Clue to watch for The need is an audit trail of API calls.

  5. EC2 for event functions

    What candidates pick
    Run short event-driven functions on always-on EC2.
    Why it looks right
    EC2 is a default compute choice.
    Why it's wrong
    Lambda runs event-driven code without servers, billed per use.

    Clue to watch for The workload is short, event-driven functions.

  6. SageMaker for ready AI

    What candidates pick
    Use SageMaker to add ready image or language capabilities.
    Why it looks right
    SageMaker is the AI service name people know.
    Why it's wrong
    Pre-trained AI services provide ready capabilities without building a model; SageMaker builds custom models.

    Clue to watch for The need is a ready-made AI capability, not a custom model.

Answer framework

For any Domain 3 service scenario, use these steps to find the answer CLF-C02 expects.

  1. Identify the category of the need: compute, storage, database, network, AI or analytics, or management.
  2. For storage, decide whether object, block or file is required, pointing to S3, EBS or EFS, and use Glacier for archives.
  3. For databases, match the data model, choosing relational RDS or Aurora for structured data and DynamoDB for key-value scale.
  4. For infrastructure, distinguish Region, Availability Zone and edge location, and choose a Region by latency, compliance, availability and cost.
  5. For other categories, match the purpose to the service, such as CloudWatch for monitoring, CloudTrail for auditing, and SQS or SNS for messaging, matching the purpose precisely to the service.

Practice question

A company needs to store large numbers of image files that are accessed over the internet, with high durability and no servers or file systems to manage. Which AWS service is MOST appropriate?

Want more like this? The AWS CCP practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This domain is broad rather than deep, so the best tool is a service cheat sheet. Build a one-line description of every core service by category, compute, storage, database, network, AI and analytics, management and messaging, and drill matching a use case to a service.

Focus on the distinctions the exam repeats: S3 versus EBS versus EFS, RDS versus DynamoDB, EC2 versus Lambda, CloudWatch versus CloudTrail, and SQS versus SNS. Learn the global infrastructure terms, Region, Availability Zone and edge location, and the four Region-selection factors.

Because coverage matters more than depth, make sure no major service is unfamiliar, since an unheard-of service is an easy question lost. This is an awareness exam, so flashcards and practice questions work well. Afterwards, move to Domain 4, billing, pricing and support, the final and smallest domain. This is an awareness exam, so flashcards and timed practice questions are more valuable than hands-on labs, and reviewing missed questions by domain shows where to focus next.

FAQ

How much of CLF-C02 is Domain 3?

Cloud Technology and Services is 34% of the scored content, the largest domain, tested by breadth of service knowledge.

What is the difference between a Region and an Availability Zone?

A Region is a geographic area that contains multiple isolated Availability Zones. Availability Zones let you build highly available designs within a Region.

When should I use S3 versus EBS versus EFS?

S3 for durable object storage over HTTP, EBS for block storage attached to a single instance, and EFS for a shared file system mounted by many instances.

What is the difference between RDS and DynamoDB?

RDS is a managed relational database for structured data and queries. DynamoDB is a key-value and document store for high-throughput, low-latency access.

What is the difference between CloudWatch and CloudTrail?

CloudWatch monitors metrics and logs for performance and operations. CloudTrail records API activity for auditing and governance.

When should I use Lambda instead of EC2?

For event-driven, short-lived code where you do not want to manage servers and prefer paying only per invocation.

How does Domain 3 connect to the rest of the exam?

The services here are secured under Domain 2's responsibility model and priced under Domain 4's billing concepts, so service knowledge supports both.

Other Cloud Computing certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 3 knowledge

You have covered deployment, global infrastructure and the core compute, storage, database, network, AI and management services. Test whether you can match a use case to the right service under exam conditions.

Take the AWS CCP practice test Check your AWS CCP readiness

Keep going