CLF-C02 Domain 4: Billing, Pricing, and 12 Exam Traps to Avoid

Originally published on CertLand.

Domain 4 (Billing, Pricing, and Support)accounts for*12% of the CLF-C02 exam— approximately 8 out of 65 scored questions. It is the smallest domain, but experienced candidates call it the most predictable: the same concepts appear on almost every exam administration, the tables are finite, and the traps are well-documented. Candidates who study this domain properly walk into the exam knowing they will get 7 or 8 of those 8 questions correct before they sit down. This post covers every billing and pricing concept the exam tests, then catalogs the12 most common exam trapsacross all four domains — the questions that candidates answer incorrectly not because they don't know the material, but because a precise distinction was not studied. **In this guide:*

1. AWS Pricing Fundamentals
2. AWS Free Tier: Three Types
3. Pricing and Cost Management Tools
4. Savings Plans vs. Reserved Instances
5. EC2 Purchasing Options
6. AWS Support Plans
7. AWS Organizations and Consolidated Billing
8. 12 Most Common CLF-C02 Exam Traps
9. 4 Practice Questions with Explanations

AWS Pricing Fundamentals

AWS pricing is built on three core principles. The exam may present a scenario and ask which principle it reflects: # Pricing Principle What It Means Example 1 Pay as you go Pay only for the resources you consume, with no upfront commitment or minimum fee for most services Lambda charges per invocation and per GB-second of execution — zero charge when idle 2 Save when you reserve Commit to using a service for 1 or 3 years in exchange for a significant discount vs. on-demand rates EC2 Reserved Instances save up to 72%; RDS Reserved Instances save up to 69% 3 Pay less when you use more Volume discounts — the per-unit price decreases as usage increases, tiered pricing S3 storage pricing: the first 50 TB/month costs more per GB than the next 450 TB/month

Beyond these three principles, several AWS services are*always free*regardless of usage:

• AWS IAM— no charge for creating users, groups, roles, or policies
• Amazon VPC— no charge for creating VPCs, subnets, route tables, or security groups (data transfer and NAT Gateway have charges)
• AWS Auto Scaling— no charge for the Auto Scaling service itself (you pay for the EC2 instances it provisions)
• AWS CloudFormation— no charge for the service (you pay for the resources the templates create)
• AWS Elastic Beanstalk— no charge for the platform (you pay for the underlying EC2, RDS, etc.)
• AWS OpsWorks— no charge for the service

AWS Free Tier: Three Types

The AWS Free Tier is tested regularly. The exam distinguishes between three distinct types — knowing which type applies to which service is a quick exam point: Free Tier Type Duration Examples Always Free Never expires; available to all AWS customers forever AWS Lambda (1M requests/month free), DynamoDB (25 GB storage free), Amazon CloudWatch (10 custom metrics free), SNS (1M publishes free) 12 Months Free Available for the first 12 months after AWS account creation EC2 (750 hours/month of t2.micro or t3.micro), S3 (5 GB standard storage), RDS (750 hours/month db.t2.micro), CloudFront (50 GB data transfer) Trials Short-term trials activated when you first use a service (30–90 days typically) Amazon Inspector (90-day free trial), Amazon GuardDuty (30-day free trial), Amazon Macie (30-day free trial) Exam tip — Free Tier question pattern:

Questions about the Free Tier typically describe a scenario and ask which type applies, or they describe a service and ask whether it is always free, 12-months free, or a trial. The most frequently tested fact: Lambda and DynamoDB are*Always Free*(within limits) even after 12 months. EC2 and S3 Free Tier expires after 12 months.

Pricing and Cost Management Tools

The exam consistently presents scenarios asking which cost management tool is appropriate for a given need. These four tools are regularly confused: Tool Primary Purpose When to Use It Cost AWS Pricing Calculator Estimate the cost of a planned architecture before you build it "How much will this new architecture cost?" — pre-deployment cost modeling, budget approval, TCO comparisons with on-premises Free AWS Cost Explorer Visualize and analyze historical AWS spending; forecast future costs "Why did my bill spike last month?" — explore spend by service, account, region, or tag; identify Reserved Instance savings opportunities; 12-month spending forecasts Free to use (API calls have a charge) AWS Budgets Set spending thresholds and receive alerts when actual or forecasted costs exceed them "Alert me when we spend more than $500/month on EC2" — proactive cost governance; can trigger SNS notifications or AWS Chatbot messages when thresholds are crossed First 2 budgets free; $0.02/day per additional budget AWS Cost and Usage Report (CUR) Most granular billing data available — hourly/daily resource-level cost and usage data delivered to S3 Billing teams, cost allocation analysis, feeding data into Athena or QuickSight for custom reporting; detailed chargeback/showback to business units Free (S3 storage and Athena query charges apply) Quick decision guide for pricing tool questions:

Before you build→ Pricing Calculator.After you've been spending(analyze history/forecast) → Cost Explorer.Alert when you exceed a threshold→ Budgets.Most detailed billing data for custom analysis→ Cost and Usage Report. These four scenarios cover the vast majority of Domain 4 pricing tool questions.

Savings Plans vs. Reserved Instances

Both Savings Plans and Reserved Instances offer discounts in exchange for a usage commitment. The CLF-C02 exam tests when to use each and how they differ: Attribute Savings Plans Reserved Instances Commitment Commit to a dollar amount of usage per hour (e.g., $10/hour) Commit to a specific instance type, Region, and optionally OS/tenancy Flexibility Compute Savings Plans apply across EC2 instance families, sizes, AZs, Regions, OS; also covers Lambda and Fargate Standard RIs: locked to a specific instance type; Convertible RIs: can change instance family/OS with some restrictions Discount Up to 66% (Compute Savings Plans) or up to 72% (EC2 Instance Savings Plans) Standard RI: up to 72%; Convertible RI: up to 54% Services covered EC2, Lambda, Fargate (Compute Savings Plans); EC2 only (EC2 Instance Savings Plans) EC2 RIs, RDS RIs, ElastiCache RIs, Redshift RIs (service-specific) Term 1 year or 3 years 1 year or 3 years Payment options All Upfront, Partial Upfront, No Upfront All Upfront, Partial Upfront, No Upfront Critical exam trap — Reserved Instances are NOT capacity reservations:

Reserved Instances provide a*billing discount— they do not guarantee that EC2 capacity will be available in a specific AZ during an outage. If you need to guarantee capacity (e.g., for disaster recovery), useOn-Demand Capacity Reservations*. Questions may describe a company that needs both the discount AND guaranteed capacity — the correct answer combines a Capacity Reservation with a Reserved Instance or Savings Plan.

EC2 Purchasing Options

EC2 purchasing options are tested in both Domain 3 and Domain 4. This table covers all five options with the key exam-relevant attributes: Option Commitment Max Discount Can Be Interrupted? Best Use Case On-Demand None — No Short-term, unpredictable workloads; new application development and testing Reserved (Standard) 1 or 3 year; specific instance type and Region 72% No Steady-state workloads running continuously (databases, always-on web servers) Reserved (Convertible) 1 or 3 year; can change instance family/OS 54% No Long-term workloads where instance type may change (migrating to newer generation) Spot None 90% Yes — 2-minute warning Fault-tolerant batch jobs, data analysis, CI/CD workers, big data processing Dedicated Hosts On-Demand or 1/3-year reservation; per-host billing Varies No Bring-Your-Own-License (BYOL); regulatory compliance requiring dedicated physical server

AWS Support Plans

Support plans are one of the most reliably tested topics in Domain 4. AWS has five tiers. Learn the distinguishing features of each — especially response times for critical issues and TAM availability: Feature Basic Developer Business Enterprise On-Ramp Enterprise Price Free $29/month+ $100/month+ $5,500/month+ $15,000/month+ Who can open cases No technical support cases 1 person Unlimited IAM users Unlimited IAM users Unlimited IAM users Critical issue response
(Business-critical system down) — — < 1 hour < 30 minutes < 15 minutes AWS Support API access No No Yes Yes Yes Trusted Advisor full checks 7 core checks only 7 core checks only All checks All checks All checks Technical Account Manager (TAM) No No No Pool of TAMs Designated TAM Infrastructure Event Management No No For additional fee Included Included Exam tip — TAM questions appear on almost every CLF-C02 exam:

A Technical Account Manager (TAM) is a dedicated AWS expert who works proactively with your account. TAMs are available only on*Enterprise On-Ramp(pooled TAMs) andEnterprise*(designated TAM) support plans. Business support does NOT include a TAM. This is the single most frequently tested Support plan fact on the exam — if a question mentions needing a proactive dedicated technical advisor, the answer is Enterprise support.

AWS Organizations and Consolidated Billing

AWS Organizations allows a company to manage multiple AWS accounts from a central management account. Consolidated billing is one of its key features:

• Single bill:All member accounts roll up to a single invoice from the management account — simplifies accounting and payment.
• Volume pricing aggregation:Usage from all accounts is pooled together. If one account uses 40 TB of S3 and another uses 20 TB, the 60 TB total qualifies for the third pricing tier — better than each account paying at the first tier individually.
• Reserved Instance sharing:Reserved Instances and Savings Plans purchased in one account can apply to qualifying usage in any other account in the organization (unless sharing is explicitly disabled).
• Service Control Policies (SCPs):Applied at the Organization Unit (OU) or account level to set maximum permission boundaries. SCPs restrict what IAM policies in member accounts can grant — they never grant permissions themselves. Consolidated billing exam tip:

If the question describes a company with multiple AWS accounts that wants to get better pricing by combining usage, the answer is AWS Organizations consolidated billing. The key benefit: aggregating usage across accounts unlocks higher volume discount tiers that individual accounts would not reach on their own.

12 Most Common CLF-C02 Exam Traps

These are the distinctions that trip candidates who know the material but haven't studied the precise edge cases. Each trap is phrased the way the exam frames it — read the_why_column carefully.

Trap 1: Security Group is stateful; NACL is stateless

The trap:A question says an instance cannot receive responses to outbound requests, even though inbound rules allow the traffic. Candidates add more inbound rules to the Security Group — but the answer is to add an outbound rule to the NACL.

Why:Security Groups are stateful — if you allow outbound traffic, the return inbound is automatically allowed. NACLs are stateless — you must explicitly allow BOTH directions. If outbound is allowed but no inbound rule covers the ephemeral port range (1024–65535) of the return traffic, the connection is dropped at the NACL.

Trap 2: S3 is not inside a VPC

The trap:A question asks how an EC2 instance in a private subnet can access S3 without going through the internet gateway. Candidates assume S3 is "in the VPC."

Why:S3 is a public AWS service — by default, access goes over the public internet via the internet gateway. To keep traffic private and avoid internet routing, use a*VPC Gateway Endpoint for S3*. This routes S3 traffic through the private AWS network without an internet gateway, NAT Gateway, or VPN.

Trap 3: IAM policies deny by default; explicit Deny always wins

The trap:A user has a policy that grants access to S3 but belongs to a group that has no S3 policy. Candidates assume the user has no S3 access because the group policy is silent. Or, a policy grants S3 but another policy explicitly denies it — candidates pick the outcome based on which policy is "more specific."

Why:IAM evaluation rules: (1) everything is denied by default; (2) an explicit Allow grants access; (3) an explicit Deny in ANY applicable policy overrides all Allows — there is no "most specific wins" — Deny always wins absolutely.

Trap 4: CloudTrail vs. CloudWatch — they are NOT the same

The trap:A question asks which service records "all API calls made to AWS." Candidates pick CloudWatch because it's the primary monitoring service.

Why:CloudWatch monitors metrics, collects application logs, and triggers alarms. CloudTrail records every AWS management API call (who called the API, from where, when, and what action). "Who deleted the EC2 instance?" → CloudTrail. "What is the CPU utilization of this EC2 instance?" → CloudWatch.

Trap 5: AWS manages the hypervisor — not the customer

The trap:A question asks about the Shared Responsibility Model and includes "hypervisor patching" as an answer option. Candidates who haven't studied this specifically sometimes select "customer" because they know the EC2 OS is their responsibility.

Why:The hypervisor (the software that creates and runs virtual machines) runs on physical AWS hardware and is entirely managed by AWS. Customers never touch the hypervisor. Customers manage the guest OS inside the VM — not the virtualization layer itself.

Trap 6: Reserved Instances are a billing discount, not a capacity guarantee

The trap:A company wants guaranteed EC2 capacity in a specific AZ during a disaster recovery event. Candidates select Reserved Instances because they've learned it guarantees resources.

Why:Reserved Instances reduce your bill — they do NOT reserve or guarantee that EC2 capacity will be physically available in a specific AZ. For capacity guarantees, use*On-Demand Capacity Reservations*(can be combined with a Savings Plan for the billing discount).

Trap 7: RDS Multi-AZ ≠ Read Replicas

The trap:"A company needs to improve RDS read performance under high load." Candidates pick Multi-AZ deployment.

Why:Multi-AZ creates a synchronous standby for failover — the standby cannot serve read traffic. Read Replicas are asynchronous copies that CAN serve read queries, reducing load on the primary. Multi-AZ = high availability. Read Replicas = read scalability. They solve different problems.

Trap 8: Spot Instances can be terminated by AWS with only 2 minutes' notice

The trap:A question describes a workload that must never be interrupted. Spot Instances offer 90% discount — why not use them?

Why:AWS can reclaim Spot Instances at any time when EC2 spare capacity is needed by On-Demand users. The only warning is a 2-minute interruption notice via EC2 instance metadata. Spot Instances are only appropriate for fault-tolerant, interruptible workloads that can save state and resume. For "must never be interrupted" → On-Demand or Reserved.

Trap 9: Route 53 Alias records can point to AWS resources; CNAME cannot point to the zone apex

The trap:A company wants to map their root domain (example.com — not www.example.com) to an Elastic Load Balancer. Candidates create a CNAME record.

Why:DNS standards prohibit CNAME records at the zone apex (root domain). Route 53 Alias records are AWS-specific records that can point to AWS resources (ELB, CloudFront, S3 website endpoint, API Gateway) at any level including the zone apex. Use an Alias record to map the root domain to an ALB or CloudFront distribution.

Trap 10: TAM is only available on Enterprise and Enterprise On-Ramp plans

The trap:"A company needs a proactive, designated AWS expert to help with architecture reviews and operational guidance." The answer choices include Business support. Candidates pick Business because it's cheaper and includes more features than Developer.

Why:Business support does NOT include a Technical Account Manager. Only Enterprise On-Ramp (pooled TAMs — not a dedicated individual) and Enterprise (a designated TAM) include this role. If the question mentions a "dedicated" or "designated" technical advisor, the answer is Enterprise support only.

Trap 11: AWS Artifact provides compliance reports — it is NOT a security scanning service

The trap:"A company needs to access AWS's SOC 2 Type II report to satisfy a security audit." Candidates answer Amazon Inspector (because it sounds like it "inspects" compliance).

Why:Amazon Inspector scans your EC2 instances and containers for OS vulnerabilities (CVEs). AWS Artifact is the on-demand portal where you download AWS's own compliance documents: SOC reports, PCI-DSS attestations, ISO certifications, and HIPAA eligibility documentation. If the question involves an auditor asking for AWS's compliance certification, the answer is AWS Artifact.

Trap 12: Global Accelerator is for TCP/UDP; CloudFront is for HTTP/HTTPS content delivery

The trap:A question describes a gaming company that needs to improve global performance for a TCP-based multiplayer game. Candidates pick CloudFront because it has 400+ global edge locations and improves global performance.

Why:CloudFront is an HTTP/HTTPS CDN — it caches web content and serves it from edge locations. It does not accelerate TCP/UDP application traffic beyond HTTP. AWS Global Accelerator uses anycast routing over AWS's global network backbone to route non-HTTP TCP and UDP traffic to the optimal endpoint. Gaming → Global Accelerator. Static website + video streaming → CloudFront.

4 Practice Questions with Explanations

These questions are focused on Domain 4 and the exam trap areas covered above. Question 1: A company is planning to move to AWS and wants to estimate the cost of running 10 EC2 instances, 2 RDS databases, and 5 TB of S3 storage before signing any contracts. Which AWS tool should the solutions architect use?

A. AWS Cost Explorer
B. AWS Budgets
C. AWS Pricing Calculator
D. AWS Cost and Usage Report

Correct Answer: C — AWS Pricing Calculator.The Pricing Calculator is specifically designed for pre-deployment cost estimation — you configure your planned resources and get a cost estimate before building anything. Cost Explorer analyzes existing historical spending (there is none yet for a company planning to move to AWS). Budgets sets spending alerts on active accounts. Cost and Usage Report provides granular billing data for already-running workloads. Question 2: A company wants a dedicated AWS expert who will proactively engage with their team to review cloud architecture, assist with operational planning, and provide personalized guidance. Which AWS Support plan provides this?

A. Business
B. Enterprise On-Ramp
C. Developer
D. Enterprise

Correct Answer: D — Enterprise.Only the Enterprise support plan includes a*designated Technical Account Manager (TAM)*— a single named individual who proactively engages with your account and provides personalized guidance. Enterprise On-Ramp provides access to a pool of TAMs (not a designated individual). Business support includes all full Trusted Advisor checks and <1 hour critical response, but no TAM. Developer support is for development/testing with minimal SLAs. Question 3: A company uses 10 AWS accounts managed through AWS Organizations. One account purchases Reserved Instances for EC2. How can the Reserved Instance discount be shared with other accounts in the organization?

A. By copying the Reserved Instance to each member account
B. Reserved Instances cannot be shared across accounts
C. Consolidated billing in AWS Organizations automatically allows Reserved Instance discount sharing across accounts unless sharing is disabled
D. By creating a new IAM role in each member account that grants access to the Reserved Instance

Correct Answer: C — Consolidated billing in AWS Organizations automatically allows RI sharing.When accounts are linked through AWS Organizations, Reserved Instances and Savings Plans purchased in any account automatically apply to eligible usage in other accounts in the organization. This is one of the key financial benefits of consolidated billing — it enables RI sharing without any configuration, unless the feature is explicitly turned off by the management account. IAM roles govern API access, not billing discounts. Reserved Instances are account-level billing instruments, not resources that can be "copied." Question 4: A company's security team downloads an AWS SOC 2 Type II report to satisfy an external auditor's request. Which AWS service did they use?

A. Amazon Inspector
B. AWS Config
C. Amazon GuardDuty
D. AWS Artifact

Correct Answer: D — AWS Artifact.AWS Artifact is the self-service portal where customers can download AWS's compliance reports (SOC 1, SOC 2, SOC 3), security certifications (ISO 27001, PCI-DSS, FedRAMP), and AWS agreements (BAA for HIPAA). Amazon Inspector scans compute resources for vulnerabilities — it does not provide AWS's own compliance certifications. AWS Config tracks resource configuration state. GuardDuty detects threats via log analysis. None of the other three services produce or store compliance reports about AWS's own infrastructure. Practice all 48 Domain 4 questions on CertLand

CertLand's CLF-C02 question bank includes*48 Domain 4 questionscovering every pricing concept, cost tool, and support plan scenario in this post — plus all 380 questions across all four domains. Start practicing free → **Complete CLF-C02 Study Pack*

• CLF-C02 Complete Guide— exam overview, domains, prerequisites
• 15-Day Study Plan— day-by-day domain assignments and question targets
• Domain 1: Cloud Concepts & Global Infrastructure
• Domains 2 & 3: Security, Compliance & Cloud Technology
• Final Cheat Sheet: Complete Quick Reference— read the night before your exam