AWS CLF-C02 · Updated 2026
Free AWS Cloud Practitioner Practice Exam (CLF-C02)
Full-length CLF-C02 mock exams with the same number of questions and time as the real exam. Cloud concepts, security, core services and billing questions, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 1 hour 30 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Cloud Technology & Services
Bayside Learning must create identical test, staging and production environments, each with a VPC, EC2 instances and a database, and rebuild them on demand. Which service should it use?
Correct answer: C. AWS CloudFormation
AWS CloudFormation uses templates to provision and manage resources as code, so the same stack can be created repeatedly and consistently. Elastic Beanstalk deploys and manages web applications, but it is not a general tool for defining any combination of infrastructure as code.
AWS CloudFormation uses templates to provision and manage resources as code, so the same stack can be created repeatedly and consistently. Elastic Beanstalk deploys and manages web applications, but it is not a general tool for defining any combination of infrastructure as code.
Question 2Security & Compliance
Maple Analytics runs its application on Amazon EC2 instances. Under the shared responsibility model, which task belongs to Maple Analytics?
Correct answer: B. Patching the guest operating system on its instances
EC2 is infrastructure as a service, so the customer is responsible for the guest operating system, including updates and security patches, plus its applications and security group settings. The hypervisor and physical hosts are part of the infrastructure that AWS secures.
EC2 is infrastructure as a service, so the customer is responsible for the guest operating system, including updates and security patches, plus its applications and security group settings. The hypervisor and physical hosts are part of the infrastructure that AWS secures.
Question 3Cloud Concepts
Brightleaf Bakery, a startup, wants to launch an online ordering site but cannot afford to buy servers upfront. Which AWS Cloud benefit addresses this concern most directly?
Correct answer: D. Trade fixed capital expense for variable expense
Paying only for the resources you consume, instead of buying hardware before you know how you will use it, is the trade capital expense for variable expense benefit. Economies of scale lower AWS prices over time, but they do not remove the need for an upfront purchase.
Paying only for the resources you consume, instead of buying hardware before you know how you will use it, is the trade capital expense for variable expense benefit. Economies of scale lower AWS prices over time, but they do not remove the need for an upfront purchase.
Question 4Billing & Pricing
Fairview Clinic runs a database server on one specific EC2 instance type 24 hours a day and expects to keep it for three years. It cannot tolerate interruptions and wants a large discount in exchange for a commitment. Which pricing option fits BEST?
Correct answer: A. Standard Reserved Instances
Standard Reserved Instances give a significant discount over On-Demand pricing in exchange for a one-year or three-year commitment, which suits steady, always-on workloads. Spot Instances can be cheaper but can be interrupted, which is not acceptable for a database that must run constantly.
Standard Reserved Instances give a significant discount over On-Demand pricing in exchange for a one-year or three-year commitment, which suits steady, always-on workloads. Spot Instances can be cheaper but can be interrupted, which is not acceptable for a database that must run constantly.
Question 5Cloud Technology & Services
A German health insurer must keep customer data inside Germany to meet local law. What is the FIRST thing it should decide when choosing where to deploy on AWS?
Correct answer: B. Pick a Region located in Germany
Data stored in a Region stays in that Region unless you move it, so compliance and data residency rules should drive the Region choice first, here the Europe (Frankfurt) Region. Price matters, but it cannot override a legal requirement to keep data in the country.
Data stored in a Region stays in that Region unless you move it, so compliance and data residency rules should drive the Region choice first, here the Europe (Frankfurt) Region. Price matters, but it cannot override a legal requirement to keep data in the country.
Question 6Security & Compliance
An auditor asks Quarry Bank for AWS's SOC 2 report and ISO certifications so it can review AWS's controls. Where can the bank download these documents on demand?
Correct answer: A. AWS Artifact
AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance reports, such as SOC and ISO reports, and to select online agreements. AWS Audit Manager helps you collect evidence about your own AWS usage, but it does not provide AWS's third-party audit reports.
AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance reports, such as SOC and ISO reports, and to select online agreements. AWS Audit Manager helps you collect evidence about your own AWS usage, but it does not provide AWS's third-party audit reports.
Question 7Cloud Concepts
A ticket sales company sees traffic jump tenfold for a few hours when concert tickets go on sale, then drop back. Which cloud characteristic lets it add capacity for the spike and release it afterward automatically?
Correct answer: D. Elasticity
Elasticity is the ability to acquire resources when demand rises and release them when it falls, so you pay only for what the spike needs. High availability keeps a system running through failures, but it does not by itself match capacity to demand.
Elasticity is the ability to acquire resources when demand rises and release them when it falls, so you pay only for what the spike needs. High availability keeps a system running through failures, but it does not by itself match capacity to demand.
Question 8Cloud Technology & Services
Solstice Photo has customers worldwide who complain that images load slowly from its single US Region. Which service caches content at edge locations close to viewers?
Correct answer: A. Amazon CloudFront
Amazon CloudFront is a content delivery network that caches content at edge locations around the world, reducing latency for viewers. Global Accelerator also uses the AWS edge network, but it routes traffic to application endpoints rather than caching content.
Amazon CloudFront is a content delivery network that caches content at edge locations around the world, reducing latency for viewers. Global Accelerator also uses the AWS edge network, but it routes traffic to application endpoints rather than caching content.
Question 9Security & Compliance
Thistle Design just created its AWS account. Which action follows AWS best practices for the root user?
Correct answer: C. Enable MFA and use the root user only for tasks that require it
AWS recommends protecting the root user with MFA, not creating root access keys, and using it only for the few tasks that require it, while daily work is done with other identities. Root access keys give unrestricted access to the account, so creating them increases risk.
AWS recommends protecting the root user with MFA, not creating root access keys, and using it only for the few tasks that require it, while daily work is done with other identities. Root access keys give unrestricted access to the account, so creating them increases risk.
Question 10Cloud Concepts
A logistics firm wants its order system to recover automatically when a component fails and to keep working if one data center goes offline. Which Well-Architected Framework pillar focuses on this goal?
Correct answer: A. Reliability
The reliability pillar covers a workload's ability to perform its intended function correctly and recover from failures, for example by using multiple Availability Zones. Performance efficiency is about using resources efficiently as demand changes, not about recovery.
The reliability pillar covers a workload's ability to perform its intended function correctly and recover from failures, for example by using multiple Availability Zones. Performance efficiency is about using resources efficiently as demand changes, not about recovery.
Question 11Cloud Technology & Services
A visual effects studio in Los Angeles needs single-digit millisecond latency to AWS compute for artists in that city, but it does not want to run AWS hardware in its own building. Which option fits BEST?
Correct answer: D. AWS Local Zones
Local Zones place AWS compute, storage and other services close to large population and industry centers, such as Los Angeles, for single-digit millisecond latency. AWS Outposts also gives low latency, but it installs AWS hardware in your own facility, which the studio wants to avoid.
Local Zones place AWS compute, storage and other services close to large population and industry centers, such as Los Angeles, for single-digit millisecond latency. AWS Outposts also gives low latency, but it installs AWS hardware in your own facility, which the studio wants to avoid.
Question 12Security & Compliance
Zephyr Media has 40 developers who all need the same permissions, and new developers join every month. What is the MOST efficient way to manage their permissions?
Correct answer: B. Attach the policy to an IAM group and add the developers to it
An IAM group lets you attach permissions once and grant them to every user you add, which makes onboarding and changes simple. Attaching policies to each user works but becomes hard to manage and audit as the team grows.
An IAM group lets you attach permissions once and grant them to every user you add, which makes onboarding and changes simple. Attaching policies to each user works but becomes hard to manage and audit as the team grows.
Question 13Billing & Pricing
Quartz Studios renders animation frames in batch jobs that can stop and restart at any time without harm. It wants the lowest possible compute cost. Which option fits BEST?
Correct answer: C. Spot Instances
Spot Instances use spare EC2 capacity at discounts of up to 90 percent compared with On-Demand prices, and they can be interrupted with a two-minute warning, which flexible batch jobs can tolerate. Reserved Instances require a long-term commitment and suit steady workloads rather than interruptible jobs.
Spot Instances use spare EC2 capacity at discounts of up to 90 percent compared with On-Demand prices, and they can be interrupted with a two-minute warning, which flexible batch jobs can tolerate. Reserved Instances require a long-term commitment and suit steady workloads rather than interruptible jobs.
Question 14Cloud Technology & Services
Wildflower Prints wants to resize each image as soon as it is uploaded to S3, without managing servers and paying only when code runs. Which service fits BEST?
Correct answer: B. AWS Lambda
AWS Lambda runs code in response to events, such as an S3 upload, without provisioning servers, and you pay only for the compute time used. EC2 would require managing instances that keep running even when no images arrive.
AWS Lambda runs code in response to events, such as an S3 upload, without provisioning servers, and you pay only for the compute time used. EC2 would require managing instances that keep running even when no images arrive.
Question 15Cloud Concepts
Granite Insurance is moving to AWS, and many staff fear their roles will change. Leaders want a plan for training, culture change and new job roles. Which AWS Cloud Adoption Framework (AWS CAF) perspective covers this work?
Correct answer: D. People
The People perspective helps an organization with culture, workforce transformation, training and organizational change during cloud adoption. Governance focuses on managing risk, the cloud portfolio and benefits, not on staff skills and culture.
The People perspective helps an organization with culture, workforce transformation, training and organizational change during cloud adoption. Governance focuses on managing risk, the cloud portfolio and benefits, not on staff skills and culture.
Question 16Security & Compliance
An application on an EC2 instance at Saffron Foods needs to read files from an S3 bucket. What is the MOST secure way to give it access?
Correct answer: B. Assign an IAM role with read access to the instance
An IAM role attached to an instance provides temporary credentials that AWS rotates automatically, so no long-term keys are stored on the server. Storing an IAM user's access keys on the instance works, but those long-term keys can leak and must be rotated manually.
An IAM role attached to an instance provides temporary credentials that AWS rotates automatically, so no long-term keys are stored on the server. Storing an IAM user's access keys on the instance works, but those long-term keys can leak and must be rotated manually.
Question 17Cloud Technology & Services
Tern Analytics runs a large in-memory database that needs a very high ratio of RAM to vCPU. Which EC2 instance category should it choose?
Correct answer: C. Memory optimized
Memory optimized instances, such as the R family, deliver fast performance for workloads that process large data sets in memory. Compute optimized instances favor high CPU performance relative to memory, which suits batch processing or game servers instead.
Memory optimized instances, such as the R family, deliver fast performance for workloads that process large data sets in memory. Compute optimized instances favor high CPU performance relative to memory, which suits batch processing or game servers instead.
Question 18Cloud Concepts
Harbor Clinic must leave its leased data center in six weeks. It plans to move its virtual machines to Amazon EC2 with no code changes and optimize later. Which migration strategy is this?
Correct answer: A. Rehost
Rehost, often called lift and shift, moves applications as they are, which is the fastest way to meet a tight deadline. Replatform makes a few cloud optimizations along the way, such as switching to a managed database, which adds work.
Rehost, often called lift and shift, moves applications as they are, which is the fastest way to meet a tight deadline. Replatform makes a few cloud optimizations along the way, such as switching to a managed database, which adds work.
Question 19Security & Compliance
A contractor at Velvet Events only needs to upload images to one S3 bucket. Which principle should guide the IAM policy you create?
Correct answer: D. Grant least privilege for only that bucket and action
Least privilege means granting only the permissions needed to perform a task, here uploading to one bucket. Enabling MFA makes sign-in stronger, but it does not limit what an overprivileged identity can do once signed in.
Least privilege means granting only the permissions needed to perform a task, here uploading to one bucket. Enabling MFA makes sign-in stronger, but it does not limit what an overprivileged identity can do once signed in.
Question 20Cloud Technology & Services
A startup runs containers on Amazon ECS and does not want to provision, patch or scale the underlying EC2 instances. Which option should it use?
Correct answer: A. AWS Fargate
AWS Fargate is a serverless compute engine for containers that works with ECS and EKS, so you do not manage servers or instance clusters. EC2 Auto Scaling adjusts the number of instances, but you still manage and patch those instances.
AWS Fargate is a serverless compute engine for containers that works with ECS and EKS, so you do not manage servers or instance clusters. EC2 Auto Scaling adjusts the number of instances, but you still manage and patch those instances.
Question 21Billing & Pricing
Moss Lane Startups wants an email alert when its forecasted AWS spend for the month is expected to go over $500. Which service should it use?
Correct answer: C. AWS Budgets
AWS Budgets lets you set custom cost or usage budgets and sends alerts when actual or forecasted amounts exceed your thresholds. Cost Explorer visualizes and forecasts spending, but alerting on a budget threshold is what AWS Budgets is built for.
AWS Budgets lets you set custom cost or usage budgets and sends alerts when actual or forecasted amounts exceed your thresholds. Cost Explorer visualizes and forecasts spending, but alerting on a budget threshold is what AWS Budgets is built for.
Question 22Cloud Technology & Services
A developer at Ginkgo Tea has a Java web application and wants AWS to handle capacity provisioning, load balancing and health monitoring after simply uploading the code. Which service fits?
Correct answer: D. AWS Elastic Beanstalk
Elastic Beanstalk lets you upload application code while it automatically handles deployment, capacity provisioning, load balancing, scaling and health monitoring. CloudFormation can build the same resources, but you must define each of them yourself in templates.
Elastic Beanstalk lets you upload application code while it automatically handles deployment, capacity provisioning, load balancing, scaling and health monitoring. CloudFormation can build the same resources, but you must define each of them yourself in templates.
Question 23Security & Compliance
Tidewater Energy wants a managed service that continuously analyzes CloudTrail events, VPC Flow Logs and DNS logs to detect threats such as cryptocurrency mining on its instances. Which service should it enable?
Correct answer: D. Amazon GuardDuty
Amazon GuardDuty is a threat detection service that analyzes sources such as CloudTrail events, VPC Flow Logs and DNS logs to find malicious or unexpected activity. Amazon Inspector scans workloads for software vulnerabilities, not for active threats in log data.
Amazon GuardDuty is a threat detection service that analyzes sources such as CloudTrail events, VPC Flow Logs and DNS logs to find malicious or unexpected activity. Amazon Inspector scans workloads for software vulnerabilities, not for active threats in log data.
Question 24Cloud Concepts
During a migration assessment, Pinecrest Media finds an old reporting application that nobody has used in a year. What is the MOST appropriate migration strategy for it?
Correct answer: B. Retire
Retire means decommissioning applications that are no longer useful, which removes their cost and risk instead of moving them. Retain means keeping an application in its current environment for now, which would leave the unused system running.
Retire means decommissioning applications that are no longer useful, which removes their cost and risk instead of moving them. Retain means keeping an application in its current environment for now, which would leave the unused system running.
Question 25Cloud Technology & Services
Orchard Credit Union must keep scanned loan files for 10 years. The files are almost never read, and a retrieval time of up to 12 hours is acceptable. Which S3 storage class is the MOST cost-effective?
Correct answer: C. S3 Glacier Deep Archive
S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of rarely accessed data, with standard retrievals completing within 12 hours. Glacier Instant Retrieval offers millisecond access at a higher storage price, which this use case does not need.
S3 Glacier Deep Archive is the lowest-cost S3 storage class, designed for long-term retention of rarely accessed data, with standard retrievals completing within 12 hours. Glacier Instant Retrieval offers millisecond access at a higher storage price, which this use case does not need.
Question 26Security & Compliance
Lumen Health stores millions of documents in Amazon S3 and must find which buckets contain personal data such as names and Social Security numbers. Which service should it use?
Correct answer: D. Amazon Macie
Amazon Macie uses machine learning and pattern matching to discover and report sensitive data, such as personally identifiable information, stored in Amazon S3. GuardDuty looks for threats and suspicious activity, not for sensitive data inside objects.
Amazon Macie uses machine learning and pattern matching to discover and report sensitive data, such as personally identifiable information, stored in Amazon S3. GuardDuty looks for threats and suspicious activity, not for sensitive data inside objects.
Question 27Cloud Concepts
A finance student asks why AWS has been able to cut its prices many times over the years. Which benefit of the cloud BEST explains this?
Correct answer: C. Massive economies of scale from aggregated customer usage
Because usage from hundreds of thousands of customers is aggregated in the cloud, AWS achieves higher economies of scale and passes savings on as lower pay-as-you-go prices. Elasticity helps a single customer match capacity to demand, but it does not explain falling list prices.
Because usage from hundreds of thousands of customers is aggregated in the cloud, AWS achieves higher economies of scale and passes savings on as lower pay-as-you-go prices. Elasticity helps a single customer match capacity to demand, but it does not explain falling list prices.
Question 28Cloud Technology & Services
An EC2 instance at Redfern Clinic needs a persistent block storage volume for its operating system and database that keeps data when the instance stops. Which option provides this?
Correct answer: B. Amazon EBS
Amazon EBS provides persistent block storage volumes that attach to EC2 instances and keep data independently of the instance's life. Instance store volumes are physically attached to the host and lose their data when the instance stops or terminates.
Amazon EBS provides persistent block storage volumes that attach to EC2 instances and keep data independently of the instance's life. Instance store volumes are physically attached to the host and lose their data when the instance stops or terminates.
Question 29Billing & Pricing
Finance staff at Sorrel Media want to view graphs of AWS spending over the last 12 months, broken down by service, to spot trends. Which tool fits BEST?
Correct answer: C. AWS Cost Explorer
AWS Cost Explorer provides an interface to visualize, understand and manage AWS costs and usage over time, with filters by service, account and tag. AWS Pricing Calculator estimates the cost of planned workloads, not historical spending.
AWS Cost Explorer provides an interface to visualize, understand and manage AWS costs and usage over time, with filters by service, account and tag. AWS Pricing Calculator estimates the cost of planned workloads, not historical spending.
Question 30Security & Compliance
An online gaming company has been hit by large DDoS attacks. It wants enhanced protection, 24/7 access to the AWS Shield Response Team and cost protection for scaling during attacks. What should it subscribe to?
Correct answer: A. AWS Shield Advanced
AWS Shield Advanced adds enhanced DDoS detection and mitigation, access to the Shield Response Team and protection against scaling charges caused by attacks. Shield Standard is automatic and free for all customers, but it does not include the response team or cost protection.
AWS Shield Advanced adds enhanced DDoS detection and mitigation, access to the Shield Response Team and protection against scaling charges caused by attacks. Shield Standard is automatic and free for all customers, but it does not include the response team or cost protection.
Question 31Cloud Concepts
Kestrel Games, based in Canada, is launching in Japan and Australia and wants low latency for players there without building data centers. Which benefit of AWS makes this possible?
Correct answer: B. Deploying to Regions around the world in minutes
Go global in minutes: AWS Regions worldwide let a company deploy close to its users with a few clicks, lowering latency. Lower prices from economies of scale reduce cost but do not put the application near players in Asia Pacific.
Go global in minutes: AWS Regions worldwide let a company deploy close to its users with a few clicks, lowering latency. Lower prices from economies of scale reduce cost but do not put the application near players in Asia Pacific.
Question 32Cloud Technology & Services
Twenty Linux web servers at Cobble Media, spread across several Availability Zones, must read and write the same set of files at the same time. Which storage service fits BEST?
Correct answer: A. Amazon EFS
Amazon EFS is a managed NFS file system that many Linux instances across multiple Availability Zones can mount at the same time. An EBS volume normally attaches to one instance in one Availability Zone, so it cannot serve twenty servers across zones.
Amazon EFS is a managed NFS file system that many Linux instances across multiple Availability Zones can mount at the same time. An EBS volume normally attaches to one instance in one Availability Zone, so it cannot serve twenty servers across zones.
Question 33Security & Compliance
Ember Retail's web application, delivered through CloudFront, is receiving requests that attempt SQL injection. Which service can block these requests using rules the company defines?
Correct answer: C. AWS WAF
AWS WAF is a web application firewall that inspects HTTP and HTTPS requests and can block common attacks such as SQL injection and cross-site scripting with rules. Security groups filter traffic by protocol, port and IP address, so they cannot inspect request content.
AWS WAF is a web application firewall that inspects HTTP and HTTPS requests and can block common attacks such as SQL injection and cross-site scripting with rules. Security groups filter traffic by protocol, port and IP address, so they cannot inspect request content.
Question 34Cloud Technology & Services
Mill Creek Library wants its on-premises file servers to store files in Amazon S3 while keeping frequently used files cached locally for low latency. Which service fits?
Correct answer: D. AWS Storage Gateway
AWS Storage Gateway is a hybrid cloud storage service, and its S3 File Gateway lets on-premises applications store files as S3 objects while caching recently used data locally. S3 Transfer Acceleration speeds up long-distance uploads, but it does not provide a local file share or cache.
AWS Storage Gateway is a hybrid cloud storage service, and its S3 File Gateway lets on-premises applications store files as S3 objects while caching recently used data locally. S3 Transfer Acceleration speeds up long-distance uploads, but it does not provide a local file share or cache.
Question 35Cloud Concepts
Evergreen Foods wants to measure and reduce the environmental impact of its cloud workloads, for example by cutting idle resources and using more efficient hardware. Which Well-Architected pillar addresses this?
Correct answer: D. Sustainability
The sustainability pillar focuses on minimizing the environmental impact of workloads, including maximizing utilization and adopting more efficient hardware and services. Cost optimization often leads to similar actions, but its goal is avoiding unnecessary spend rather than reducing energy and carbon impact.
The sustainability pillar focuses on minimizing the environmental impact of workloads, including maximizing utilization and adopting more efficient hardware and services. Cost optimization often leads to similar actions, but its goal is avoiding unnecessary spend rather than reducing energy and carbon impact.
Question 36Security & Compliance
Cedar Payments needs to create, control and rotate the encryption keys used to encrypt its data in Amazon S3 and Amazon EBS, with every key use logged in CloudTrail. Which service should it use?
Correct answer: A. AWS KMS
AWS Key Management Service (AWS KMS) lets you create and manage cryptographic keys, integrates with services such as S3 and EBS, and records key usage in AWS CloudTrail. Secrets Manager stores and rotates secrets like database passwords, not the keys that encrypt S3 and EBS data.
AWS Key Management Service (AWS KMS) lets you create and manage cryptographic keys, integrates with services such as S3 and EBS, and records key usage in AWS CloudTrail. Secrets Manager stores and rotates secrets like database passwords, not the keys that encrypt S3 and EBS data.
Question 37Billing & Pricing
Ridgeline Holdings has five AWS accounts. It wants one monthly bill and to combine usage across the accounts so it reaches volume pricing tiers sooner. What should it use?
Correct answer: B. Consolidated billing in AWS Organizations
Consolidated billing in AWS Organizations gives one bill for all member accounts and treats their combined usage as one for volume pricing and discount sharing. Cost allocation tags help categorize costs, but they do not merge bills or combine usage for pricing tiers.
Consolidated billing in AWS Organizations gives one bill for all member accounts and treats their combined usage as one for volume pricing and discount sharing. Cost allocation tags help categorize costs, but they do not merge bills or combine usage for pricing tiers.
Question 38Cloud Technology & Services
A mobile game needs a fully managed NoSQL key-value database that delivers single-digit millisecond performance at any scale. Which service should it use?
Correct answer: D. Amazon DynamoDB
Amazon DynamoDB is a serverless NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. Amazon RDS is a relational database service, which is not the NoSQL key-value model the game requires.
Amazon DynamoDB is a serverless NoSQL key-value and document database that delivers single-digit millisecond performance at any scale. Amazon RDS is a relational database service, which is not the NoSQL key-value model the game requires.
Question 39Cloud Concepts
Lakeside University is comparing its on-premises costs with AWS in a total cost of ownership (TCO) study. Which on-premises cost should the study include along with the hardware purchase price?
Correct answer: C. Power, cooling, floor space and data center staff
A fair TCO comparison includes indirect on-premises costs such as power, cooling, real estate and the people who run the facility, not just server prices. Data transfer between Availability Zones is an AWS charge, so it does not belong on the on-premises side.
A fair TCO comparison includes indirect on-premises costs such as power, cooling, real estate and the people who run the facility, not just server prices. Data transfer between Availability Zones is an AWS charge, so it does not belong on the on-premises side.
Question 40Security & Compliance
A production S3 bucket at Hillcrest Media was deleted overnight, and managers want to know which IAM user deleted it and when. Which service records this information?
Correct answer: B. AWS CloudTrail
AWS CloudTrail records API calls in your account, including who made each call, from where and when, so it shows who deleted the bucket. CloudWatch collects metrics and logs for monitoring performance, but it is not the record of who made API calls.
AWS CloudTrail records API calls in your account, including who made each call, from where and when, so it shows who deleted the bucket. CloudWatch collects metrics and logs for monitoring performance, but it is not the record of who made API calls.
Question 41Cloud Technology & Services
Bluestone Retail wants a MySQL-compatible relational database that performs better than standard MySQL and automatically keeps six copies of its data across three Availability Zones. Which service is this?
Correct answer: C. Amazon Aurora
Amazon Aurora is a MySQL and PostgreSQL compatible relational database that stores six copies of data across three Availability Zones and offers higher throughput than standard MySQL. DynamoDB is a NoSQL database, so it is not MySQL compatible.
Amazon Aurora is a MySQL and PostgreSQL compatible relational database that stores six copies of data across three Availability Zones and offers higher throughput than standard MySQL. DynamoDB is a NoSQL database, so it is not MySQL compatible.
Question 42Cloud Concepts
A small IT team at Copperline Retail spends many hours each month patching and backing up its self-managed MySQL servers. Which approach reduces this undifferentiated heavy lifting the MOST?
Correct answer: A. Move the databases to Amazon RDS for MySQL
Amazon RDS is a managed service that automates tasks such as database patching, backups and hardware provisioning, freeing the team to work on the business. Running MySQL on EC2 still leaves the team responsible for the operating system, database patches and backups.
Amazon RDS is a managed service that automates tasks such as database patching, backups and hardware provisioning, freeing the team to work on the business. Running MySQL on EC2 still leaves the team responsible for the operating system, database patches and backups.
Question 43Security & Compliance
Glacier Bay Freight must keep a history of how its security group rules change over time and be alerted when a resource drifts from its internal configuration rules. Which service fits BEST?
Correct answer: B. AWS Config
AWS Config records resource configurations and their history, and Config rules evaluate whether resources match your desired settings. CloudTrail logs the API calls behind a change, but it does not keep configuration snapshots or evaluate resources against rules.
AWS Config records resource configurations and their history, and Config rules evaluate whether resources match your desired settings. CloudTrail logs the API calls behind a change, but it does not keep configuration snapshots or evaluate resources against rules.
Question 44Cloud Technology & Services
Analysts at Fieldstone Grocers want to run complex SQL queries across petabytes of historical sales data for reporting. Which service is designed for this?
Correct answer: A. Amazon Redshift
Amazon Redshift is a fully managed, petabyte-scale data warehouse built for analytics queries over large data sets. Amazon RDS for MySQL is built for transactional workloads and does not scale to petabyte analytics in the same way.
Amazon Redshift is a fully managed, petabyte-scale data warehouse built for analytics queries over large data sets. Amazon RDS for MySQL is built for transactional workloads and does not scale to petabyte analytics in the same way.
Question 45Billing & Pricing
A large enterprise wants a designated technical account manager (TAM) who knows its environment and provides proactive guidance. Which AWS Support plan includes a designated TAM?
Correct answer: C. Enterprise Support
Enterprise Support includes a designated technical account manager who provides proactive guidance and advocacy for the customer. Business Support offers 24/7 access to cloud support engineers, but it does not include a designated TAM.
Enterprise Support includes a designated technical account manager who provides proactive guidance and advocacy for the customer. Business Support offers 24/7 access to cloud support engineers, but it does not include a designated TAM.
Question 46Cloud Technology & Services
A network engineer at Hilltop Telecom needs to block traffic from one specific IP address for an entire subnet. The rules must be stateless and support explicit deny entries. What should the engineer use?
Correct answer: B. A network ACL
Network ACLs act at the subnet level, are stateless and support both allow and deny rules, so they can block one IP address. Security groups work at the instance level, are stateful and support only allow rules, so they cannot explicitly deny an address.
Network ACLs act at the subnet level, are stateless and support both allow and deny rules, so they can block one IP address. Security groups work at the instance level, are stateful and support only allow rules, so they cannot explicitly deny an address.
Question 47Security & Compliance
A small company on the Basic Support plan wants a free automated check that flags risks such as S3 buckets with open access and a root user without MFA. Which service provides these checks?
Correct answer: D. AWS Trusted Advisor
AWS Trusted Advisor inspects your account and, even with Basic Support, provides core security checks such as S3 bucket permissions and MFA on the root account. Amazon Macie discovers sensitive data in S3, but it does not check account settings like root MFA.
AWS Trusted Advisor inspects your account and, even with Basic Support, provides core security checks such as S3 bucket permissions and MFA on the root account. Amazon Macie discovers sensitive data in S3, but it does not check account settings like root MFA.
Question 48Cloud Concepts
Before moving to AWS, Northwind Labs bought servers based on a three-year traffic forecast, and half of them sat idle. Which cloud benefit directly removes this problem?
Correct answer: A. Stop guessing capacity needs
In the cloud you can scale up or down as demand changes, so you no longer buy capacity based on forecasts that may be wrong. Speed and agility is about provisioning resources quickly for experiments, which is related but does not target idle, overprovisioned hardware.
In the cloud you can scale up or down as demand changes, so you no longer buy capacity based on forecasts that may be wrong. Speed and agility is about provisioning resources quickly for experiments, which is related but does not target idle, overprovisioned hardware.
Question 49Cloud Technology & Services
Lindenwood Apps runs its application in two Regions and wants DNS to send each user to the Region that gives the lowest latency. Which service provides this?
Correct answer: B. Amazon Route 53
Amazon Route 53 is a managed DNS service with routing policies such as latency-based routing, which directs users to the Region with the lowest latency. Elastic Load Balancing distributes traffic within a Region, not across Regions through DNS.
Amazon Route 53 is a managed DNS service with routing policies such as latency-based routing, which directs users to the Region with the lowest latency. Elastic Load Balancing distributes traffic within a Region, not across Regions through DNS.
Question 50Security & Compliance
Orion Consulting has 12 AWS accounts in AWS Organizations and wants employees to sign in once with their existing corporate identities to reach the accounts they need. Which service should it use?
Correct answer: D. AWS IAM Identity Center
IAM Identity Center provides single sign-on to multiple AWS accounts and applications, and it can connect to an existing identity provider. Amazon Cognito is designed for sign-up and sign-in to customer-facing web and mobile apps, not workforce access to AWS accounts.
IAM Identity Center provides single sign-on to multiple AWS accounts and applications, and it can connect to an existing identity provider. Amazon Cognito is designed for sign-up and sign-in to customer-facing web and mobile apps, not workforce access to AWS accounts.
Question 51Cloud Concepts
A DevOps team at Bluebird Travel wants to define its infrastructure as code, make frequent small reversible changes and learn from operational failures. Which Well-Architected pillar do these design principles belong to?
Correct answer: D. Operational excellence
Performing operations as code, making frequent small reversible changes and learning from all operational failures are design principles of the operational excellence pillar. Reliability also values automation, but its focus is recovering from failure and meeting demand, not how teams run and improve operations.
Performing operations as code, making frequent small reversible changes and learning from all operational failures are design principles of the operational excellence pillar. Reliability also values automation, but its focus is recovering from failure and meeting demand, not how teams run and improve operations.
Question 52Cloud Technology & Services
Granary Bank moves large volumes of data between its data center and AWS every day. It needs a private, dedicated connection with consistent network performance that does not use the public internet. Which service fits?
Correct answer: A. AWS Direct Connect
AWS Direct Connect provides a dedicated private network connection between your premises and AWS, giving more consistent performance than internet-based links. A Site-to-Site VPN is encrypted, but it travels over the public internet, so its performance can vary.
AWS Direct Connect provides a dedicated private network connection between your premises and AWS, giving more consistent performance than internet-based links. A Site-to-Site VPN is encrypted, but it travels over the public internet, so its performance can vary.
Question 53Billing & Pricing
Hazel Point University wants to see its AWS costs for each department, such as Biology and Physics, in its billing reports. What should it do?
Correct answer: C. Apply and activate department cost allocation tags
Cost allocation tags, once applied to resources and activated in the Billing console, let you group and filter costs by tag values such as department in Cost Explorer and cost reports. Using different Regions does not label costs by department and could raise latency and prices.
Cost allocation tags, once applied to resources and activated in the Billing console, let you group and filter costs by tag values such as department in Cost Explorer and cost reports. Using different Regions does not label costs by department and could raise latency and prices.
Question 54Security & Compliance
Under the shared responsibility model, which responsibility does AWS handle for Quillfeather Books?
Correct answer: A. Physical security of AWS data center facilities
AWS is responsible for security of the cloud, which includes the physical facilities, hardware and global network. Security groups, access to buckets and encryption choices are security in the cloud, which the customer controls.
AWS is responsible for security of the cloud, which includes the physical facilities, hardware and global network. Security groups, access to buckets and encryption choices are security in the cloud, which the customer controls.
Question 55Cloud Technology & Services
Analysts at Brookline Media want to run standard SQL queries directly on log files stored in Amazon S3 without loading the data into a database or managing servers. Which service should they use?
Correct answer: B. Amazon Athena
Amazon Athena is a serverless, interactive query service that analyzes data in S3 using standard SQL, and you pay per query. Amazon Redshift is a data warehouse that typically involves loading data and running a cluster or serverless workgroup.
Amazon Athena is a serverless, interactive query service that analyzes data in S3 using standard SQL, and you pay per query. Amazon Redshift is a data warehouse that typically involves loading data and running a cluster or serverless workgroup.
Question 56Cloud Concepts
Cost reviews show that many of Orchid Health's EC2 instances run at under 10 percent CPU all month. Which action BEST applies cost optimization?
Correct answer: B. Rightsize the instances to smaller types that fit the load
Rightsizing means matching instance types and sizes to actual workload needs, so underused instances move to smaller, cheaper types. Buying Reserved Instances for oversized instances only locks in a discount on capacity that is not needed.
Rightsizing means matching instance types and sizes to actual workload needs, so underused instances move to smaller, cheaper types. Buying Reserved Instances for oversized instances only locks in a discount on capacity that is not needed.
Question 57Security & Compliance
Pebble Pay wants its website to use HTTPS and needs free public TLS certificates that renew automatically when used with its Application Load Balancer. Which service should it use?
Correct answer: C. AWS Certificate Manager
AWS Certificate Manager provides public SSL/TLS certificates at no extra cost for use with integrated services such as Elastic Load Balancing and CloudFront, and it renews them automatically. AWS Private Certificate Authority issues private certificates for internal use and is a paid service.
AWS Certificate Manager provides public SSL/TLS certificates at no extra cost for use with integrated services such as Elastic Load Balancing and CloudFront, and it renews them automatically. AWS Private Certificate Authority issues private certificates for internal use and is a paid service.
Question 58Cloud Technology & Services
Harborview Security wants to automatically detect people and objects in video from its building cameras without building its own machine learning models. Which service fits?
Correct answer: B. Amazon Rekognition
Amazon Rekognition is a pretrained computer vision service that identifies objects, people, text and activities in images and videos. Amazon SageMaker AI could build a custom model, but that requires the machine learning work the company wants to avoid.
Amazon Rekognition is a pretrained computer vision service that identifies objects, people, text and activities in images and videos. Amazon SageMaker AI could build a custom model, but that requires the machine learning work the company wants to avoid.
Question 59Cloud Concepts
Riverbend Bank wants a free, guided way to review its workloads against AWS best practices and get a list of high-risk issues to fix. Which AWS service should it use?
Correct answer: D. AWS Well-Architected Tool
The AWS Well-Architected Tool walks you through questions for each pillar, compares your workload to best practices and lists high and medium risks with improvement plans, at no extra charge. Trusted Advisor runs automated checks on account resources, but it does not conduct a question-based review of a workload's architecture.
The AWS Well-Architected Tool walks you through questions for each pillar, compares your workload to best practices and lists high and medium risks with improvement plans, at no extra charge. Trusted Advisor runs automated checks on account resources, but it does not conduct a question-based review of a workload's architecture.
Question 60Security & Compliance
Fairhaven Bank uses GuardDuty, Inspector and Macie across several accounts. It wants one place to see all their findings and to check its accounts against security best practice standards. Which service should it use?
Correct answer: A. AWS Security Hub
AWS Security Hub aggregates and prioritizes findings from services such as GuardDuty, Inspector and Macie, and it runs automated checks against best practice standards. Trusted Advisor offers its own account checks, but it is not the central place to collect findings from other security services.
AWS Security Hub aggregates and prioritizes findings from services such as GuardDuty, Inspector and Macie, and it runs automated checks against best practice standards. Trusted Advisor offers its own account checks, but it is not the central place to collect findings from other security services.
Question 61Cloud Technology & Services
When orders spike, Sunfield Market's order service overwhelms its slower payment service. The team wants orders to wait in a buffer until the payment service can process them. Which service fits?
Correct answer: C. Amazon SQS
Amazon SQS is a managed message queue that decouples components, so producers keep sending messages while consumers process them at their own pace. Amazon SNS pushes messages to subscribers immediately, so it does not hold work in a queue for later processing.
Amazon SQS is a managed message queue that decouples components, so producers keep sending messages while consumers process them at their own pace. Amazon SNS pushes messages to subscribers immediately, so it does not hold work in a queue for later processing.
Question 62Billing & Pricing
Before migrating, Bridgewater Dental wants to estimate the monthly cost of three EC2 instances, an RDS database and S3 storage on AWS. Which tool should it use?
Correct answer: A. AWS Pricing Calculator
AWS Pricing Calculator lets you model planned services and configurations to estimate monthly costs before you deploy anything. Cost Explorer analyzes costs you have already incurred, so it cannot help before any usage exists.
AWS Pricing Calculator lets you model planned services and configurations to estimate monthly costs before you deploy anything. Cost Explorer analyzes costs you have already incurred, so it cannot help before any usage exists.
Question 63Cloud Concepts
Summit Legal runs a self-hosted customer relationship management (CRM) application on old servers. It decides to drop it and subscribe to a software as a service (SaaS) CRM product instead. Which migration strategy is this?
Correct answer: D. Repurchase
Repurchase, sometimes called drop and shop, means moving to a different product, often a SaaS offering, instead of migrating the existing application. Refactor means rewriting the application itself to use cloud-native features, which is not what Summit Legal is doing.
Repurchase, sometimes called drop and shop, means moving to a different product, often a SaaS offering, instead of migrating the existing application. Refactor means rewriting the application itself to use cloud-native features, which is not what Summit Legal is doing.
Question 64Security & Compliance
Marlow Studios notices that an IP address hosted on AWS is sending spam and port scans to its servers. Which AWS resource should it contact to report this activity?
Correct answer: A. The AWS Trust & Safety team
The AWS Trust & Safety team handles reports of AWS resources being used for abusive or illegal purposes, such as spam, port scanning and DDoS attacks. The AWS Partner Network connects customers with third-party firms and is not the channel for reporting abuse.
The AWS Trust & Safety team handles reports of AWS resources being used for abusive or illegal purposes, such as spam, port scanning and DDoS attacks. The AWS Partner Network connects customers with third-party firms and is not the channel for reporting abuse.
Question 65Cloud Technology & Services
Operators at Wavecrest Hotels want a notification when the average CPU utilization of their EC2 instances stays above 80 percent for 10 minutes. Which feature should they use?
Correct answer: C. Amazon CloudWatch alarms
Amazon CloudWatch collects metrics such as EC2 CPU utilization, and CloudWatch alarms can send notifications when a metric crosses a threshold for a set period. CloudTrail records API calls and does not monitor performance metrics.
Amazon CloudWatch collects metrics such as EC2 CPU utilization, and CloudWatch alarms can send notifications when a metric crosses a threshold for a set period. CloudTrail records API calls and does not monitor performance metrics.
The real AWS Cloud Practitioner exam at a glance
65questions
1h 30mtime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Cloud Practitioner exam. They are not real exam questions. AWS Cloud Practitioner and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 90 minutes · passing score 700 on a 100-1000 scale.