Most Cloud Practitioner candidates study compute, storage, databases, networking, and security thoroughly — and then meet a question about a contact center, a virtual desktop, or a fleet of temperature sensors and realize they have never opened that page of the exam guide. These services belong to what the CLF-C02 calls the other in-scope AWS service categories, and they are the definition of cheap marks: each one needs only a single sentence of knowledge, but that sentence has to be in your head on exam day.
This guide covers the four categories that candidates most often skip — business applications, end-user computing, frontend web and mobile, and Internet of Things (IoT) — one service at a time, with the recognition cue for each and the confusable pairs that the exam uses as distractors. You do not need hands-on experience with any of them. You need to read a plain-English scenario and name the service.
Where These Services Sit on the CLF-C02
The exam’s largest domain, Cloud Technology and Services (34% of scored content), is mostly about the core categories. Its final task statement asks you to identify AWS services from other in-scope categories. That statement covers several small groups:
| Category | Services to recognize | Covered in |
|---|---|---|
| Business applications | Amazon Connect, Amazon SES | This guide |
| End-user computing | Amazon WorkSpaces, Amazon AppStream 2.0, WorkSpaces Secure Browser | This guide |
| Frontend web and mobile | AWS Amplify, AWS AppSync | This guide |
| IoT | AWS IoT Core, AWS IoT Greengrass | This guide |
| Application integration | Amazon SQS, Amazon SNS, Amazon EventBridge, AWS Step Functions | Core services guide |
| Developer tools | AWS CodeBuild, AWS CodePipeline, AWS X-Ray | Summary below |
| Customer engagement | AWS Support, AWS Activate, AWS Managed Services | Support plans guide |
Depth is recognition only. Nobody will ask you to configure an MQTT topic or a GraphQL resolver. A typical question is one or two sentences describing a business need, followed by four service names. For how this domain is weighted against the others, see the CLF-C02 domains breakdown.
Business Applications
Amazon Connect
Amazon Connect is a cloud contact center service. A company can set up a customer service operation — phone numbers, call routing, queues, chat, agent workspaces, and analytics — in a browser, without buying telephony hardware or signing long-term licenses. Pricing is pay-as-you-go, based on usage.
A few properties make it recognizable:
- It is omnichannel: voice, chat, and messaging handled in one service.
- It scales up and down with demand, so a retailer can add hundreds of agents for a holiday peak and remove them afterwards.
- It includes built-in AI capabilities, such as conversational self-service bots and real-time and post-call analytics.
Recognition cue: contact center, call center, customer service agents, call routing. If the scenario is about handling customer phone calls or support chats at scale, the answer is Amazon Connect.
Amazon Simple Email Service (SES)
Amazon SES is a cloud email service for sending — and receiving — email at scale. Applications use it for three kinds of mail:
- Transactional email: order confirmations, password resets, receipts.
- Marketing email: newsletters and promotional campaigns.
- Bulk notifications to large recipient lists.
SES handles the difficult operational parts of email, such as sender reputation and deliverability, and you pay for what you send rather than running mail servers.
Recognition cue: send email from an application, marketing emails, transactional emails, high-volume email.
SES vs SNS trap: both can put an email in an inbox, which is why they appear together as answer options. Amazon SNS is a publish/subscribe notification service — a message published to a topic fans out to subscribers over email, SMS, HTTP, SQS, or Lambda, and its emails are simple plain notifications to people who subscribed. Amazon SES is a dedicated email platform for rich, formatted, high-volume email to customers. “Notify the operations team when an alarm fires” is SNS. “Send formatted marketing emails to 200,000 customers” is SES.
End-User Computing
End-user computing (EUC) services deliver desktops and applications to people — employees, contractors, students — instead of delivering infrastructure to developers. There are three to know, and the exam’s favourite question is telling them apart.
Amazon WorkSpaces
Amazon WorkSpaces is a managed Desktop-as-a-Service (DaaS) offering. Each user gets a full, persistent virtual desktop — Windows or Linux — running in the AWS Cloud, which they reach from a laptop, tablet, thin client, or browser. Their files, settings, and installed applications are there the next time they log in.
Why organizations choose it:
- No on-premises VDI servers to buy and operate.
- Fast onboarding — a desktop for a new hire or contractor in minutes, removed just as quickly.
- Security — data stays in AWS rather than on a laptop that can be lost.
- Flexible billing — monthly for full-time users, hourly for occasional ones.
Recognition cue: virtual desktop, remote workers, desktop as a service, replace on-premises VDI, persistent desktop.
Amazon AppStream 2.0
Amazon AppStream 2.0 is a managed application streaming service. Instead of a whole desktop, it streams individual desktop applications to a user’s browser or client. The application runs on AWS; the user sees and interacts with it as if it were local. Sessions are typically non-persistent — each user gets a fresh instance from a centrally managed image.
Typical uses are delivering a heavyweight desktop application (CAD, engineering, or a legacy Windows program) to users on any device, software vendors offering trials or SaaS versions of desktop software, and student computer labs.
AWS has been bringing this service under the WorkSpaces family name, so you may also see it referred to as WorkSpaces Applications in newer console pages and documentation. The CLF-C02 exam guide lists it as AppStream 2.0 — learn both names, answer with the one on the screen.
Recognition cue: stream a desktop application to a browser, no need to install or rewrite the application, deliver a specific application to any device.
Amazon WorkSpaces Secure Browser
WorkSpaces Secure Browser (previously called WorkSpaces Web) gives users a managed, isolated browser session for reaching internal websites and SaaS applications. There is no desktop and no application streaming — only a locked-down browser running in AWS, with web content streamed to the user. It suits organizations that want secure access to web apps from unmanaged or personal devices without issuing VPNs or full desktops.
Recognition cue: secure browser access to internal web applications, no VPN, unmanaged devices.
Telling the Three Apart
| Need | Service | Think of it as |
|---|---|---|
| A complete, persistent desktop per user | Amazon WorkSpaces | A PC in the cloud |
| One or more specific applications streamed to a device | Amazon AppStream 2.0 | An app in the cloud |
| Only a secure browser for web apps | WorkSpaces Secure Browser | A browser in the cloud |
All three are fully managed, and none requires you to run virtual desktop infrastructure yourself. A common wrong answer in this category is Amazon EC2: you could launch a Windows instance and connect over RDP, but when the scenario says “managed virtual desktops for 500 employees,” the purpose-built answer is WorkSpaces. The same “purpose-built beats build-it-yourself” logic runs through the compute services guide.
Frontend Web and Mobile
These services help developers build the part of an application that users touch — web and mobile front ends — and the APIs behind them.
AWS Amplify
AWS Amplify is a set of tools and services for building and hosting full-stack web and mobile applications quickly. It has two halves:
- Amplify Hosting — fully managed hosting for web applications with a built-in CI/CD workflow: connect a Git repository and every push builds and deploys the site, served through a global content delivery network.
- Backend building — a simplified way for frontend developers to add cloud features such as authentication, data APIs, and file storage, without assembling each underlying AWS service by hand.
Amplify’s audience is the frontend or mobile developer who wants to ship an app without becoming an infrastructure specialist.
Recognition cue: quickly build and deploy a web or mobile app, full-stack, frontend developers, host a web app with CI/CD from Git.
AWS AppSync
AWS AppSync is a fully managed service for building GraphQL APIs (and real-time pub/sub APIs). A single AppSync endpoint lets a client request exactly the data it needs from multiple sources — DynamoDB tables, Lambda functions, relational databases, HTTP APIs — in one call. It also supports real-time updates over subscriptions and offline data synchronization for mobile apps.
Recognition cue: GraphQL, real-time data synchronization, combine data from multiple sources in a single API, offline mobile apps.
Amplify vs AppSync vs API Gateway: Amplify is the toolkit and hosting for the whole app. AppSync is a managed GraphQL API — one of the building blocks Amplify can create for you. Amazon API Gateway is the managed service for REST, HTTP, and WebSocket APIs. At Cloud Practitioner level, the word GraphQL points to AppSync, and REST API points to API Gateway.
A Note on AWS Device Farm
You may also meet AWS Device Farm, an application testing service that runs your web and mobile apps against real phones, tablets, and desktop browsers hosted by AWS. The cue is test a mobile app on many real devices. One sentence of knowledge is enough.
Internet of Things (IoT)
IoT workloads connect physical devices — sensors, vehicles, appliances, industrial machines — to the cloud. Two services cover what the CLF-C02 expects.
AWS IoT Core
AWS IoT Core is a managed cloud service that lets connected devices securely interact with cloud applications and with each other. It can support very large fleets — billions of devices and trillions of messages — without you managing any servers. The pieces worth recognizing:
- Device connectivity using lightweight protocols such as MQTT, built for small, low-power devices and unreliable networks.
- Authentication and encryption for every device connection.
- A rules engine that routes incoming device data to other AWS services — for example to Amazon S3, DynamoDB, Lambda, or Kinesis for storage and analysis.
- Device shadows, a cloud-side copy of each device’s state, so applications can read or set the state even when the device is offline.
Recognition cue: connect IoT devices to the cloud, sensors sending data to AWS, MQTT, millions of devices.
AWS IoT Greengrass
AWS IoT Greengrass extends AWS to the edge. It is software you run on local devices — gateways, industrial PCs, cameras — so they can execute code, process and filter data, run machine learning inference, and talk to each other locally, even with intermittent or no internet connectivity. When a connection is available, they synchronize with the cloud.
Recognition cue: run compute locally on edge devices, operate offline, process data close to where it is generated, local ML inference on devices.
IoT Core vs IoT Greengrass: IoT Core is the cloud side — the service devices connect to. Greengrass is the edge side — software that runs on the devices to act locally. If the scenario stresses connecting and managing device communication, choose IoT Core. If it stresses local processing or working without a connection, choose Greengrass.
IoT questions frequently continue into analytics: sensor data lands through IoT Core and then flows into streaming and query services. The analytics services guide picks up the pipeline from there.
The Rest of the Task Statement in Brief
Two more small categories share the same task statement. A sentence each is sufficient:
| Service | One-line purpose |
|---|---|
| AWS CodeBuild | Fully managed build service — compiles code, runs tests, produces artifacts |
| AWS CodePipeline | Continuous delivery service that automates the build, test, and deploy stages of a release |
| AWS X-Ray | Traces requests through a distributed application to find errors and bottlenecks |
| Amazon EventBridge | Serverless event bus that routes events between AWS services, SaaS apps, and your code |
| AWS Step Functions | Orchestrates multi-step workflows across AWS services |
| AWS Activate | Program offering credits, training, and support to startups |
| AWS Managed Services (AMS) | AWS operates your AWS infrastructure on your behalf |
Scenario-to-Service Cheat Sheet
| The scenario says… | Answer | Why |
|---|---|---|
| ”Set up a customer contact center without telephony hardware” | Amazon Connect | Cloud contact center, pay-as-you-go |
| ”Send order confirmation and marketing emails at scale” | Amazon SES | Purpose-built email platform |
| ”Email the on-call team when an alarm triggers” | Amazon SNS | Pub/sub notifications |
| ”Provide persistent virtual desktops for remote employees” | Amazon WorkSpaces | Managed DaaS |
| ”Stream a desktop application to users’ browsers” | Amazon AppStream 2.0 | Application streaming, nothing to install |
| ”Secure browser access to internal sites from personal devices” | WorkSpaces Secure Browser | Managed, isolated browser |
| ”Frontend team needs to build and host a full-stack app fast” | AWS Amplify | Toolkit plus hosting with CI/CD |
| ”Managed GraphQL API with real-time updates” | AWS AppSync | Managed GraphQL and subscriptions |
| ”Test a mobile app on many real devices” | AWS Device Farm | Real-device testing |
| ”Connect millions of sensors securely to the cloud” | AWS IoT Core | Managed device connectivity and messaging |
| ”Devices must process data locally and work offline” | AWS IoT Greengrass | Edge runtime |
Common Mistakes to Avoid
| Mistake | The correction |
|---|---|
| Choosing SNS for bulk marketing email | That is SES; SNS is for pub/sub notifications |
| Choosing EC2 for employee virtual desktops | WorkSpaces is the managed desktop service |
| Mixing up WorkSpaces and AppStream 2.0 | WorkSpaces = full persistent desktop; AppStream 2.0 = streamed applications |
| Treating Amplify and AppSync as the same thing | Amplify = app-building toolkit and hosting; AppSync = managed GraphQL API |
| Choosing API Gateway when the question says GraphQL | AppSync is the GraphQL service |
| Choosing IoT Core for local, offline processing | That is IoT Greengrass at the edge |
| Picking Amazon Connect for networking questions | Despite the name, Connect is a contact center — AWS Direct Connect is the dedicated network link |
That last trap deserves a second look: Amazon Connect and AWS Direct Connect share a word and nothing else. Direct Connect is a private network connection from your data center to AWS, covered in the networking and content delivery guide.
How to Study This Category Efficiently
Because every service here is a one-sentence fact, the efficient approach is different from the core domains:
- Build flashcards from the cheat sheet — scenario phrase on the front, service on the back. Twenty minutes covers the whole category.
- Drill the confusable pairs — SES vs SNS, WorkSpaces vs AppStream 2.0, Amplify vs AppSync, IoT Core vs Greengrass, Connect vs Direct Connect. These pairs are where the distractors come from.
- Open each console page once. If you have a Free Tier account, simply reading the landing page of Amazon Connect or IoT Core cements the purpose more than re-reading notes. You do not need to deploy anything.
- Revisit after a few days using spaced repetition, then confirm with timed practice questions.
Recognition is built by answering the same style of question repeatedly until the service name surfaces without effort. Sailor.sh’s AWS Cloud Practitioner mock exam bundle is aligned to the CLF-C02 blueprint and includes the less-studied service categories alongside the core ones, under timed conditions with explanations. To sample the format first, try the free CLF-C02 practice questions and the practice questions walkthrough.
To place this category in your overall plan, start with the CLF-C02 exam guide for 2026, schedule topics with the Cloud Practitioner study plan, and pick up final-week tactics from the exam tips guide.
Frequently Asked Questions
What is Amazon Connect used for?
Amazon Connect is AWS’s cloud contact center service. It lets a business set up customer service over voice and chat — with call routing, queues, agent tools, and analytics — without telephony hardware, and pay only for usage. On the CLF-C02, any scenario about a call center or customer service agents points to Amazon Connect.
What is the difference between Amazon SES and Amazon SNS?
Amazon SES is an email platform for sending transactional, marketing, and bulk email at scale. Amazon SNS is a publish/subscribe notification service that fans a message out to subscribers over several protocols, including email, SMS, HTTP, SQS, and Lambda. Use SES for rich, high-volume customer email; use SNS for application and operational notifications.
What is the difference between Amazon WorkSpaces and Amazon AppStream 2.0?
Amazon WorkSpaces gives each user a full, persistent virtual desktop in the cloud. Amazon AppStream 2.0 streams individual desktop applications to a browser or client, usually with non-persistent sessions. Choose WorkSpaces when users need an entire desktop; choose AppStream 2.0 when they need specific applications delivered to any device.
Is AWS Amplify the same as AWS AppSync?
No. AWS Amplify is a toolkit and hosting service for building and deploying full-stack web and mobile apps. AWS AppSync is a managed GraphQL API service with real-time and offline capabilities. Amplify can create an AppSync API as part of an app’s backend, but they are separate services with different purposes.
What is the difference between AWS IoT Core and AWS IoT Greengrass?
AWS IoT Core is the cloud service that connected devices communicate with — it handles secure connectivity, messaging, and routing of device data to other AWS services. AWS IoT Greengrass is software that runs on edge devices so they can process data, run code, and operate locally even without an internet connection.
How many questions on the CLF-C02 cover these services?
AWS does not publish per-service question counts. These services fall under a single task statement within the Cloud Technology and Services domain, so expect only a small number of questions. Because each requires just one sentence of knowledge, they offer a high return for very little study time.
Do I need hands-on experience with these services for the Cloud Practitioner exam?
No. The CLF-C02 tests them at recognition level only — you need to identify each service’s purpose from a short scenario. Hands-on practice is not required, although opening each service’s console page once can help the purpose stick.
Conclusion
The “other in-scope” categories reward a small, deliberate investment. Amazon Connect is the contact center and Amazon SES is email. Amazon WorkSpaces is a desktop in the cloud, AppStream 2.0 is an application in the cloud, and WorkSpaces Secure Browser is a browser in the cloud. AWS Amplify builds and hosts full-stack apps, while AWS AppSync is the managed GraphQL API behind them. AWS IoT Core connects devices to the cloud, and AWS IoT Greengrass brings AWS to the devices. Memorize those one-liners, drill the confusable pairs, and a category most candidates skip turns into marks you can count on.