AWS CLF-C02 · Updated 2026
Free AWS Cloud Practitioner Practice Exam (CLF-C02)
Full-length CLF-C02 mock exams with the same number of questions and time as the real exam. Cloud concepts, security, core services and billing questions, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
65 questions · 1 hour 30 min · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 7
🏆
Question 1Cloud Technology & Services
Developers at Pixel Forge want their Python application to upload files to S3 and send messages to SQS directly from code. What should they use?
Correct answer: A. An AWS SDK for Python
AWS SDKs provide language-specific libraries, such as Boto3 for Python, so applications can call AWS services directly from code. The Management Console is a web interface for people, not a way for application code to call services.
AWS SDKs provide language-specific libraries, such as Boto3 for Python, so applications can call AWS services directly from code. The Management Console is a web interface for people, not a way for application code to call services.
Question 2Security & Compliance
Quantum Ledger moves a workload to AWS Lambda. Under the shared responsibility model, what is Quantum Ledger still responsible for?
Correct answer: C. Its function code and the IAM permissions it grants
With Lambda, AWS manages the infrastructure, operating system and scaling, while the customer remains responsible for its code, data and the permissions it configures. Operating system patching is handled by AWS because Lambda is a serverless, managed service.
With Lambda, AWS manages the infrastructure, operating system and scaling, while the customer remains responsible for its code, data and the permissions it configures. Operating system patching is handled by AWS because Lambda is a serverless, managed service.
Question 3Cloud Concepts
Product teams at Marigold Fashion want to test new ideas in hours instead of waiting weeks for hardware, and drop the ones that fail at little cost. Which cloud benefit does this describe?
Correct answer: D. Increased speed and agility
Agility means resources are only a click away, so teams can experiment quickly and cheaply and discard failed ideas. Economies of scale lower prices, but they do not explain the faster time to experiment.
Agility means resources are only a click away, so teams can experiment quickly and cheaply and discard failed ideas. Economies of scale lower prices, but they do not explain the faster time to experiment.
Question 4Billing & Pricing
Kiteline Apps uses EC2 today but plans to move some workloads to AWS Fargate and Lambda next year. It wants a discount for committing to steady compute spend while staying flexible across these services. Which option fits?
Correct answer: D. Compute Savings Plans
Compute Savings Plans give lower prices in exchange for a commitment to a consistent amount of compute usage in dollars per hour, and they apply across EC2, Fargate and Lambda. Standard Reserved Instances apply only to EC2 and lock in specific instance attributes.
Compute Savings Plans give lower prices in exchange for a commitment to a consistent amount of compute usage in dollars per hour, and they apply across EC2, Fargate and Lambda. Standard Reserved Instances apply only to EC2 and lock in specific instance attributes.
Question 5Cloud Technology & Services
Osprey Logistics has no data residency rules and serves customers across North America. Besides latency, what should it compare when choosing between two US Regions?
Correct answer: B. Service availability and pricing in each Region
Not every service or feature is offered in every Region, and prices for the same service can differ between Regions, so both belong in the decision along with latency and compliance. IAM is a global service, so the number of IAM users does not vary by Region.
Not every service or feature is offered in every Region, and prices for the same service can differ between Regions, so both belong in the decision along with latency and compliance. IAM is a global service, so the number of IAM users does not vary by Region.
Question 6Security & Compliance
Redwood Pay processes card payments on AWS and knows that AWS infrastructure is PCI DSS certified. What does this mean for Redwood Pay's own workload?
Correct answer: B. Redwood must still make its own workload compliant
AWS compliance programs certify the AWS infrastructure, but customers remain responsible for designing and operating their own workloads to meet the standard. A PCI DSS certified infrastructure does not make every application running on it compliant automatically.
AWS compliance programs certify the AWS infrastructure, but customers remain responsible for designing and operating their own workloads to meet the standard. A PCI DSS certified infrastructure does not make every application running on it compliant automatically.
Question 7Cloud Concepts
An online pharmacy wants to apply security at every layer, keep traceability of who did what and protect data in transit and at rest. Which Well-Architected pillar contains these design principles?
Correct answer: D. Security
Implementing a strong identity foundation, enabling traceability, applying security at all layers and protecting data in transit and at rest are design principles of the security pillar. Operational excellence covers how teams run and improve operations, not data protection and traceability.
Implementing a strong identity foundation, enabling traceability, applying security at all layers and protecting data in transit and at rest are design principles of the security pillar. Operational excellence covers how teams run and improve operations, not data protection and traceability.
Question 8Cloud Technology & Services
A factory at Steelhead Motors must process data on site with very low latency to local equipment, and it wants to use the same AWS services and APIs as in the cloud. Which option fits BEST?
Correct answer: C. AWS Outposts
AWS Outposts brings AWS infrastructure, services and APIs into a customer's own data center or site for low latency and local data processing. Local Zones are AWS-operated locations in metro areas, so they do not sit inside the factory.
AWS Outposts brings AWS infrastructure, services and APIs into a customer's own data center or site for low latency and local data processing. Local Zones are AWS-operated locations in metro areas, so they do not sit inside the factory.
Question 9Security & Compliance
Sparrow Health wants automated, continuous scanning of its EC2 instances and container images for known software vulnerabilities and unintended network exposure. Which service should it use?
Correct answer: B. Amazon Inspector
Amazon Inspector continuously scans EC2 instances, container images in Amazon ECR and Lambda functions for software vulnerabilities and unintended network exposure. GuardDuty watches account and network activity for threats, but it does not inventory software vulnerabilities.
Amazon Inspector continuously scans EC2 instances, container images in Amazon ECR and Lambda functions for software vulnerabilities and unintended network exposure. GuardDuty watches account and network activity for threats, but it does not inventory software vulnerabilities.
Question 10Cloud Concepts
A video startup wants to use serverless architectures and easily try new instance types so its workloads keep using computing resources efficiently as demand and technology change. Which Well-Architected pillar is this?
Correct answer: C. Performance efficiency
The performance efficiency pillar focuses on using computing resources efficiently, with principles such as using serverless architectures, experimenting more often and democratizing advanced technologies. Cost optimization overlaps in practice, but its focus is avoiding unnecessary cost, not selecting resources efficiently as needs change.
The performance efficiency pillar focuses on using computing resources efficiently, with principles such as using serverless architectures, experimenting more often and democratizing advanced technologies. Cost optimization overlaps in practice, but its focus is avoiding unnecessary cost, not selecting resources efficiently as needs change.
Question 11Cloud Technology & Services
Researchers at Coral Genomics need to train deep learning models that benefit from GPUs. Which EC2 instance category should they choose?
Correct answer: A. Accelerated computing
Accelerated computing instances, such as the P and G families, use hardware accelerators like GPUs, which speed up machine learning training. Burstable general purpose instances suit workloads with a low CPU baseline and occasional spikes, not heavy GPU training.
Accelerated computing instances, such as the P and G families, use hardware accelerators like GPUs, which speed up machine learning training. Burstable general purpose instances suit workloads with a low CPU baseline and occasional spikes, not heavy GPU training.
Question 12Security & Compliance
Developers at Alder Bank hardcode database passwords in their applications. Security wants the passwords stored centrally and rotated automatically on a schedule. Which service should they use?
Correct answer: B. AWS Secrets Manager
AWS Secrets Manager stores secrets such as database credentials and can rotate them automatically on a schedule, while applications retrieve them at run time. Parameter Store can hold encrypted values, but it does not provide built-in automatic rotation of database credentials.
AWS Secrets Manager stores secrets such as database credentials and can rotate them automatically on a schedule, while applications retrieve them at run time. Parameter Store can hold encrypted values, but it does not provide built-in automatic rotation of database credentials.
Question 13Billing & Pricing
Ravenwood Software must bring existing per-socket server licenses to AWS, and the license terms require visibility into the physical cores and sockets of the server. Which option fits?
Correct answer: A. Dedicated Hosts
Dedicated Hosts are physical servers dedicated to your use that give visibility into sockets and cores, which supports bring-your-own-license software with per-socket or per-core terms. Dedicated Instances run on single-tenant hardware but do not give that host-level visibility.
Dedicated Hosts are physical servers dedicated to your use that give visibility into sockets and cores, which supports bring-your-own-license software with per-socket or per-core terms. Dedicated Instances run on single-tenant hardware but do not give that host-level visibility.
Question 14Cloud Technology & Services
Willowbrook Software already runs Kubernetes on premises and wants a managed Kubernetes control plane on AWS so it can keep using standard Kubernetes tools. Which service should it choose?
Correct answer: C. Amazon EKS
Amazon Elastic Kubernetes Service (Amazon EKS) runs a managed, conformant Kubernetes control plane, so existing Kubernetes tools and manifests keep working. Amazon ECS is AWS's own container orchestrator and does not use the Kubernetes API.
Amazon Elastic Kubernetes Service (Amazon EKS) runs a managed, conformant Kubernetes control plane, so existing Kubernetes tools and manifests keep working. Amazon ECS is AWS's own container orchestrator and does not use the Kubernetes API.
Question 15Cloud Concepts
Ironwood Manufacturing wants its cloud program to manage risk, control spending and measure the business benefits of its cloud investments. Which AWS CAF perspective focuses on these capabilities?
Correct answer: D. Governance
The Governance perspective helps orchestrate cloud initiatives while maximizing benefits and minimizing risk, covering program management, risk management and cloud financial management. The People perspective deals with culture and skills, not spending control and risk.
The Governance perspective helps orchestrate cloud initiatives while maximizing benefits and minimizing risk, covering program management, risk management and cloud financial management. The People perspective deals with culture and skills, not spending control and risk.
Question 16Security & Compliance
GuardDuty reported suspicious activity from an IAM role at Kingfisher Media. The security team wants to visualize related activity over time to find the root cause. Which service helps MOST?
Correct answer: D. Amazon Detective
Amazon Detective automatically collects log data and builds visualizations of resource behavior and interactions to help investigate the root cause of security findings. Security Hub gathers findings in one place, but it does not provide the investigation graphs that Detective offers.
Amazon Detective automatically collects log data and builds visualizations of resource behavior and interactions to help investigate the root cause of security findings. Security Hub gathers findings in one place, but it does not provide the investigation graphs that Detective offers.
Question 17Cloud Technology & Services
A freelance photographer with little cloud experience wants to launch a simple WordPress website on a virtual server for a low, predictable monthly price. Which service fits BEST?
Correct answer: A. Amazon Lightsail
Amazon Lightsail offers easy-to-use virtual private servers with bundled storage and data transfer for a predictable monthly price, plus ready-made WordPress blueprints. Dedicated Hosts are entire physical servers meant for licensing and compliance needs, which is far more than a small website requires.
Amazon Lightsail offers easy-to-use virtual private servers with bundled storage and data transfer for a predictable monthly price, plus ready-made WordPress blueprints. Dedicated Hosts are entire physical servers meant for licensing and compliance needs, which is far more than a small website requires.
Question 18Cloud Concepts
Ashford Telecom wants to make sure its cloud services are delivered at agreed service levels, with strong incident management and observability. Which AWS CAF perspective covers this?
Correct answer: B. Operations
The Operations perspective ensures cloud services are delivered at a level that meets business needs, including observability and incident and problem management. The Platform perspective is about building the cloud architecture and engineering, not running services day to day.
The Operations perspective ensures cloud services are delivered at a level that meets business needs, including observability and incident and problem management. The Platform perspective is about building the cloud architecture and engineering, not running services day to day.
Question 19Security & Compliance
An IAM user at Cascade Labs belongs to a group whose policy allows s3:DeleteObject, and the user also has a policy that explicitly denies s3:DeleteObject. What happens when the user tries to delete an object?
Correct answer: D. The request is denied because explicit deny wins
In IAM policy evaluation, an explicit deny in any applicable policy always overrides an allow. Group policies and user policies are evaluated together, so neither one wins over an explicit deny.
In IAM policy evaluation, an explicit deny in any applicable policy always overrides an allow. Group policies and user policies are evaluated together, so neither one wins over an explicit deny.
Question 20Cloud Technology & Services
Dunmore Archives stores data in S3 but cannot predict which objects will be read often and which will sit untouched for months. Which storage class optimizes cost automatically?
Correct answer: C. S3 Intelligent-Tiering
S3 Intelligent-Tiering automatically moves objects between access tiers as access patterns change, without retrieval fees, for a small monitoring charge. S3 Standard keeps every object in the same higher-priced tier no matter how often it is read.
S3 Intelligent-Tiering automatically moves objects between access tiers as access patterns change, without retrieval fees, for a small monitoring charge. S3 Standard keeps every object in the same higher-priced tier no matter how often it is read.
Question 21Billing & Pricing
The new cloud team at Canary Learning is creating IAM users, groups and policies for 200 staff and asks what IAM itself will cost. Which statement is correct?
Correct answer: A. IAM has no additional charge
AWS Identity and Access Management is offered at no additional charge, so creating users, groups, roles and policies costs nothing. You pay only for the other AWS resources those identities use.
AWS Identity and Access Management is offered at no additional charge, so creating users, groups, roles and policies costs nothing. You pay only for the other AWS resources those identities use.
Question 22Cloud Technology & Services
Elmwood Accounting is moving Windows servers to AWS and needs a fully managed shared file system that supports SMB and integrates with Microsoft Active Directory. Which service fits?
Correct answer: C. Amazon FSx for Windows File Server
Amazon FSx for Windows File Server provides fully managed Windows file shares over SMB with Active Directory integration. Amazon EFS uses the NFS protocol and is designed for Linux workloads.
Amazon FSx for Windows File Server provides fully managed Windows file shares over SMB with Active Directory integration. Amazon EFS uses the NFS protocol and is designed for Linux workloads.
Question 23Security & Compliance
Security at Bramble Foods wants to protect IAM users even if their passwords are stolen in a phishing attack. What should it require?
Correct answer: A. MFA for every IAM user sign-in
MFA requires a second factor, such as a code from an authenticator app or a security key, so a stolen password alone is not enough to sign in. Creating separate AWS accounts for each user adds overhead and still leaves each password as the only factor.
MFA requires a second factor, such as a code from an authenticator app or a security key, so a stolen password alone is not enough to sign in. Creating separate AWS accounts for each user adds overhead and still leaves each password as the only factor.
Question 24Cloud Concepts
Willow Dental plans to move its application servers to EC2 unchanged but switch its self-managed Oracle database to Amazon RDS during the move. Which migration strategy is this?
Correct answer: B. Replatform
Replatform, or lift, tinker and shift, makes a few cloud optimizations, such as moving to a managed database, without changing the core architecture. Rehost would move everything as it is, including the self-managed database.
Replatform, or lift, tinker and shift, makes a few cloud optimizations, such as moving to a managed database, without changing the core architecture. Rehost would move everything as it is, including the self-managed database.
Question 25Cloud Technology & Services
Tamarack Health backs up EC2, EBS, RDS and DynamoDB with different scripts for each service. It wants one service to manage backup schedules and retention across all of them. Which should it use?
Correct answer: A. AWS Backup
AWS Backup centrally manages and automates backups across many AWS services, including EC2, EBS, RDS and DynamoDB, using backup plans that set schedules and retention. S3 Lifecycle rules move or expire S3 objects, but they do not back up other services.
AWS Backup centrally manages and automates backups across many AWS services, including EC2, EBS, RDS and DynamoDB, using backup plans that set schedules and retention. S3 Lifecycle rules move or expire S3 objects, but they do not back up other services.
Question 26Security & Compliance
Auditors require that IAM users at Lantern Insurance have passwords of at least 14 characters that include symbols. How should the administrator enforce this?
Correct answer: C. Set a custom IAM account password policy
An IAM account password policy lets administrators set rules for IAM user passwords, such as minimum length and required character types. SCPs control which actions accounts in an organization can perform, not the strength of passwords.
An IAM account password policy lets administrators set rules for IAM user passwords, such as minimum length and required character types. SCPs control which actions accounts in an organization can perform, not the strength of passwords.
Question 27Cloud Concepts
A travel booking firm wants to rebuild its monolithic application as serverless microservices so it can scale features independently and add new capabilities. Which migration strategy is this?
Correct answer: B. Refactor
Refactor, also called re-architect, changes how an application is built, often moving to cloud-native designs such as serverless and microservices, to gain new capabilities. Replatform keeps the core architecture and makes only small optimizations.
Refactor, also called re-architect, changes how an application is built, often moving to cloud-native designs such as serverless and microservices, to gain new capabilities. Replatform keeps the core architecture and makes only small optimizations.
Question 28Cloud Technology & Services
Primrose Insurance runs its policy database on Amazon RDS and wants automatic failover to a standby copy in another Availability Zone if the primary fails. What should it enable?
Correct answer: D. A Multi-AZ deployment
An RDS Multi-AZ deployment keeps a synchronous standby in a different Availability Zone and fails over to it automatically if the primary has a problem. Automated backups let you restore to a point in time, but restoring takes time and is not automatic failover.
An RDS Multi-AZ deployment keeps a synchronous standby in a different Availability Zone and fails over to it automatically if the primary has a problem. Automated backups let you restore to a point in time, but restoring takes time and is not automatic failover.
Question 29Billing & Pricing
Analysts at Wexford Energy need the most detailed line-item data on AWS costs and usage, including resource IDs, delivered to an S3 bucket for analysis in Athena. Which option should they use?
Correct answer: A. AWS Cost and Usage Report
The AWS Cost and Usage Report, delivered through AWS Data Exports, contains the most comprehensive line-item cost and usage data, including resource IDs, and writes it to S3 for tools such as Athena. Cost Explorer reports summarize and visualize costs, but they do not deliver full line-item detail to S3.
The AWS Cost and Usage Report, delivered through AWS Data Exports, contains the most comprehensive line-item cost and usage data, including resource IDs, and writes it to S3 for tools such as Athena. Cost Explorer reports summarize and visualize costs, but they do not deliver full line-item detail to S3.
Question 30Security & Compliance
A developer at Nimbus Tours needs to run AWS CLI commands from a laptop using an IAM user. Which credentials does the CLI use?
Correct answer: B. An access key ID and secret access key
Programmatic access through the AWS CLI and SDKs uses an access key ID and secret access key, or temporary credentials, rather than a console password. An EC2 key pair is used to connect to an instance over SSH, not to call AWS APIs.
Programmatic access through the AWS CLI and SDKs uses an access key ID and secret access key, or temporary credentials, rather than a console password. An EC2 key pair is used to connect to an instance over SSH, not to call AWS APIs.
Question 31Cloud Concepts
Crestview Hospital upgraded a clinical system on premises last month, and its vendor does not yet support running it in the cloud. Which migration strategy fits this system for now?
Correct answer: A. Retain
Retain means keeping an application where it is for now, for example because of a recent upgrade or lack of vendor support, and revisiting it later. Retire would shut the system down, which is wrong for an application that is still in active use.
Retain means keeping an application where it is for now, for example because of a recent upgrade or lack of vendor support, and revisiting it later. Retire would shut the system down, which is wrong for an application that is still in active use.
Question 32Cloud Technology & Services
A news site run by Gullwing Press reads the same popular articles from its database thousands of times per minute, which slows the database. Which service can cache these results in memory?
Correct answer: D. Amazon ElastiCache
Amazon ElastiCache provides managed in-memory caching, with engines such as Valkey, Redis OSS and Memcached, that serves frequently read data with very low latency and reduces database load. Redshift is a data warehouse for analytics, not a cache in front of an application database.
Amazon ElastiCache provides managed in-memory caching, with engines such as Valkey, Redis OSS and Memcached, that serves frequently read data with very low latency and reduces database load. Redshift is a data warehouse for analytics, not a cache in front of an application database.
Question 33Security & Compliance
Bellwether Group uses AWS Organizations and wants to make sure no account in its development OU can create resources outside two approved Regions. What should it use?
Correct answer: A. Service control policies (SCPs)
SCPs set the maximum permissions for accounts in an organization or OU, so they can deny actions in Regions that are not approved. AWS Config can report noncompliant resources after they exist, but it does not prevent the actions.
SCPs set the maximum permissions for accounts in an organization or OU, so they can deny actions in Regions that are not approved. AWS Config can report noncompliant resources after they exist, but it does not prevent the actions.
Question 34Cloud Technology & Services
Rosewood Clinic wants its web servers reachable from the internet but its database servers not directly reachable. How should it design its VPC?
Correct answer: C. Web tier in a public subnet, databases in a private one
A public subnet has a route to an internet gateway, so web servers there can be reached from the internet, while a private subnet has no such route, which shields the databases. A NAT gateway lets private resources make outbound connections, so it does not make a public subnet a safe place for databases.
A public subnet has a route to an internet gateway, so web servers there can be reached from the internet, while a private subnet has no such route, which shields the databases. A NAT gateway lets private resources make outbound connections, so it does not make a public subnet a safe place for databases.
Question 35Cloud Concepts
Oakridge Logistics runs hundreds of VMware virtual machines on premises. It wants to move them to VMware Cloud on AWS quickly, without converting the machines or changing its VMware tools. Which migration strategy is this?
Correct answer: A. Relocate
Relocate moves servers at the hypervisor level to a cloud version of the same platform, such as VMware Cloud on AWS, without converting machines or buying new hardware. Rehost moves workloads onto Amazon EC2, which usually means converting each virtual machine.
Relocate moves servers at the hypervisor level to a cloud version of the same platform, such as VMware Cloud on AWS, without converting machines or buying new hardware. Rehost moves workloads onto Amazon EC2, which usually means converting each virtual machine.
Question 36Security & Compliance
Gilded Arcade wants to run a penetration test against its own EC2 instances and RDS databases. What does AWS policy say about this?
Correct answer: D. It may test listed services without prior approval
AWS allows customers to run security assessments and penetration tests against a list of permitted services, including EC2 and RDS, without prior approval. Some activities, such as DNS zone walking or DoS simulations, remain prohibited or follow separate policies.
AWS allows customers to run security assessments and penetration tests against a list of permitted services, including EC2 and RDS, without prior approval. Some activities, such as DNS zone walking or DoS simulations, remain prohibited or follow separate policies.
Question 37Billing & Pricing
Thimble Security wants to deploy a third-party firewall appliance on EC2 and pay for the software through its AWS bill. Where should it look?
Correct answer: B. AWS Marketplace
AWS Marketplace is a curated digital catalog where customers find, buy and deploy third-party software, with charges added to their AWS bill. The AWS Partner Network is a program of partner firms, not a catalog for buying and deploying software.
AWS Marketplace is a curated digital catalog where customers find, buy and deploy third-party software, with charges added to their AWS bill. The AWS Partner Network is a program of partner firms, not a catalog for buying and deploying software.
Question 38Cloud Technology & Services
Falcon Arena runs a multiplayer game over UDP in two Regions. It wants fixed static IP addresses that route players over the AWS global network to the nearest healthy endpoint. Which service fits?
Correct answer: C. AWS Global Accelerator
AWS Global Accelerator provides static anycast IP addresses and routes TCP and UDP traffic over the AWS global network to the optimal healthy endpoint. Route 53 latency routing works through DNS answers, so it does not give players fixed IP addresses or carry their traffic over the AWS network.
AWS Global Accelerator provides static anycast IP addresses and routes TCP and UDP traffic over the AWS global network to the optimal healthy endpoint. Route 53 latency routing works through DNS answers, so it does not give players fixed IP addresses or carry their traffic over the AWS network.
Question 39Cloud Concepts
A payments startup wants its web application to stay available even if an entire data center fails. Which design choice BEST supports this?
Correct answer: B. Run instances in at least two Availability Zones
Availability Zones are physically separate groups of data centers within a Region, so spreading instances across two or more of them keeps the application running if one fails. Daily snapshots help with recovery after a failure, but they do not keep the application available during one.
Availability Zones are physically separate groups of data centers within a Region, so spreading instances across two or more of them keeps the application running if one fails. Daily snapshots help with recovery after a failure, but they do not keep the application available during one.
Question 40Security & Compliance
A fitness startup is building a mobile app and wants users to sign up, sign in and use social logins such as Google, without building its own user database. Which service fits?
Correct answer: D. Amazon Cognito
Amazon Cognito provides sign-up, sign-in and access control for web and mobile apps, including federation with social identity providers. IAM users are meant for people and workloads that manage AWS resources, not for large numbers of app customers.
Amazon Cognito provides sign-up, sign-in and access control for web and mobile apps, including federation with social identity providers. IAM users are meant for people and workloads that manage AWS resources, not for large numbers of app customers.
Question 41Cloud Technology & Services
Brightwater Clinic runs its patient portal on six EC2 instances in two Availability Zones. It wants incoming web requests spread across the healthy instances and sent away from any that fail health checks. Which service fits BEST?
Correct answer: B. Elastic Load Balancing
Elastic Load Balancing, for example an Application Load Balancer, distributes incoming traffic across healthy targets in multiple Availability Zones and stops routing to targets that fail health checks. EC2 Auto Scaling adds or replaces instances, but it does not spread individual requests across them.
Elastic Load Balancing, for example an Application Load Balancer, distributes incoming traffic across healthy targets in multiple Availability Zones and stops routing to targets that fail health checks. EC2 Auto Scaling adds or replaces instances, but it does not spread individual requests across them.
Question 42Cloud Concepts
Juniper Bank keeps its core banking system in its own data center but runs its mobile app back end on AWS, with the two connected by a private link. Which cloud deployment model is this?
Correct answer: C. Hybrid
A hybrid deployment connects on-premises infrastructure with cloud resources so they work together. A cloud-only model would run all of the bank's applications in the cloud, which is not the case here.
A hybrid deployment connects on-premises infrastructure with cloud resources so they work together. A cloud-only model would run all of the bank's applications in the cloud, which is not the case here.
Question 43Security & Compliance
Haven Records wants to make sure no S3 bucket in its account can ever be made public by mistake, even if someone edits a bucket policy. What should it turn on?
Correct answer: A. S3 Block Public Access at the account level
S3 Block Public Access settings at the account level override bucket policies and ACLs that would grant public access, for all current and future buckets. Versioning and MFA Delete protect against accidental deletion, not against public exposure.
S3 Block Public Access settings at the account level override bucket policies and ACLs that would grant public access, for all current and future buckets. Versioning and MFA Delete protect against accidental deletion, not against public exposure.
Question 44Cloud Technology & Services
Spinnaker Sports wants to collect and process clickstream data from millions of fans in real time to update live leaderboards. Which service is designed for this?
Correct answer: D. Amazon Kinesis Data Streams
Amazon Kinesis Data Streams captures and processes large streams of data records in real time, such as clickstreams. Athena queries data at rest in S3, so scheduled queries cannot keep a leaderboard updated in real time.
Amazon Kinesis Data Streams captures and processes large streams of data records in real time, such as clickstreams. Athena queries data at rest in S3, so scheduled queries cannot keep a leaderboard updated in real time.
Question 45Billing & Pricing
Carrow Foods has no in-house cloud experts and wants an experienced consulting firm to plan and run its AWS migration. What should it use?
Correct answer: A. An AWS Partner from the AWS Partner Network
The AWS Partner Network includes consulting partners with validated AWS expertise who can plan and carry out migrations, and customers can find them through the AWS Partner Solutions Finder. AWS re:Post is a community question and answer site, not a source of hired consulting services.
The AWS Partner Network includes consulting partners with validated AWS expertise who can plan and carry out migrations, and customers can find them through the AWS Partner Solutions Finder. AWS re:Post is a community question and answer site, not a source of hired consulting services.
Question 46Cloud Technology & Services
Data engineers at Cypress Retail need a serverless service to discover data in S3, build a data catalog and run extract, transform and load (ETL) jobs. Which service fits?
Correct answer: C. AWS Glue
AWS Glue is a serverless data integration service that crawls data sources, builds the Glue Data Catalog and runs ETL jobs. Athena runs SQL queries on data in S3 and relies on a catalog such as the Glue Data Catalog, rather than building ETL pipelines itself.
AWS Glue is a serverless data integration service that crawls data sources, builds the Glue Data Catalog and runs ETL jobs. Athena runs SQL queries on data in S3 and relies on a catalog such as the Glue Data Catalog, rather than building ETL pipelines itself.
Question 47Security & Compliance
A new team at Sable Robotics asks whether objects uploaded to new Amazon S3 buckets are encrypted at rest if they configure nothing. What is correct?
Correct answer: D. Yes, new objects get SSE-S3 encryption by default
Since January 2023, Amazon S3 applies server-side encryption with S3 managed keys (SSE-S3) to all new object uploads by default at no extra cost. Customers can still choose SSE-KMS or other options when they need more control over keys.
Since January 2023, Amazon S3 applies server-side encryption with S3 managed keys (SSE-S3) to all new object uploads by default at no extra cost. Customers can still choose SSE-KMS or other options when they need more control over keys.
Question 48Cloud Concepts
Development environments at Cobalt Software run 24 hours a day, but developers work only 9 hours on weekdays. Which Well-Architected cost optimization principle does stopping them outside working hours apply?
Correct answer: D. Adopt a consumption model
Adopting a consumption model means paying only for the computing resources you need, which includes stopping development environments when nobody is using them. Automatically recovering from failure is a reliability principle and does nothing to reduce idle spend.
Adopting a consumption model means paying only for the computing resources you need, which includes stopping development environments when nobody is using them. Automatically recovering from failure is a reliability principle and does nothing to reduce idle spend.
Question 49Cloud Technology & Services
Lark Hotels wants to analyze thousands of guest reviews to detect sentiment and key phrases without building machine learning models. Which service fits?
Correct answer: B. Amazon Comprehend
Amazon Comprehend is a natural language processing service that finds sentiment, key phrases, entities and language in text. Amazon Lex builds conversational chatbots, which is different from analyzing existing reviews.
Amazon Comprehend is a natural language processing service that finds sentiment, key phrases, entities and language in text. Amazon Lex builds conversational chatbots, which is different from analyzing existing reviews.
Question 50Security & Compliance
A government contractor must store its encryption keys in dedicated, single-tenant hardware security modules that it alone controls. Which service meets this requirement?
Correct answer: C. AWS CloudHSM
AWS CloudHSM provides dedicated hardware security modules in the AWS Cloud that you manage and that only you can use for key operations. AWS KMS also uses HSMs, but they are shared modules operated by AWS, so KMS with AWS managed keys does not meet a single-tenant requirement.
AWS CloudHSM provides dedicated hardware security modules in the AWS Cloud that you manage and that only you can use for key operations. AWS KMS also uses HSMs, but they are shared modules operated by AWS, so KMS with AWS managed keys does not meet a single-tenant requirement.
Question 51Cloud Concepts
Before migrating, Sterling Insurance needs to collect data about its on-premises servers, such as utilization and dependencies, to plan the move. Which AWS service helps with this?
Correct answer: D. AWS Application Discovery Service
AWS Application Discovery Service gathers information about on-premises servers, including configuration, usage and dependencies, to help plan migrations. AWS Compute Optimizer recommends sizes for resources already running in AWS, not on-premises servers.
AWS Application Discovery Service gathers information about on-premises servers, including configuration, usage and dependencies, to help plan migrations. AWS Compute Optimizer recommends sizes for resources already running in AWS, not on-premises servers.
Question 52Cloud Technology & Services
Data scientists at Fenwick Insurance want a fully managed service to build, train and deploy their own custom machine learning models for fraud detection. Which service fits?
Correct answer: C. Amazon SageMaker AI
Amazon SageMaker AI is a fully managed service for building, training and deploying custom machine learning models on your own data. Rekognition Custom Labels trains custom image models, but it is limited to computer vision and does not fit tabular fraud data.
Amazon SageMaker AI is a fully managed service for building, training and deploying custom machine learning models on your own data. Rekognition Custom Labels trains custom image models, but it is limited to computer vision and does not fit tabular fraud data.
Question 53Billing & Pricing
Lowtide Crafts has only the free Basic Support plan. Which resource is included?
Correct answer: B. Customer service for billing and account questions
Basic Support includes customer service for account and billing questions, documentation, whitepapers, AWS re:Post, the AWS Health Dashboard and core Trusted Advisor checks. Technical support from cloud support engineers requires a paid plan.
Basic Support includes customer service for account and billing questions, documentation, whitepapers, AWS re:Post, the AWS Health Dashboard and core Trusted Advisor checks. Technical support from cloud support engineers requires a paid plan.
Question 54Security & Compliance
Security at Pinnacle Travel wants to find S3 buckets, IAM roles and KMS keys that are shared with accounts outside its organization. Which tool should it use?
Correct answer: C. IAM Access Analyzer
IAM Access Analyzer uses logic-based analysis of resource policies to identify resources that are shared with external entities, such as other accounts. CloudTrail records API activity, but it does not analyze policies to show which resources can be reached from outside.
IAM Access Analyzer uses logic-based analysis of resource policies to identify resources that are shared with external entities, such as other accounts. CloudTrail records API activity, but it does not analyze policies to show which resources can be reached from outside.
Question 55Cloud Technology & Services
Marina Travel wants to add a generative AI chat feature to its app using foundation models from several providers through a single API, without managing infrastructure. Which service should it use?
Correct answer: A. Amazon Bedrock
Amazon Bedrock is a fully managed service that offers foundation models from Amazon and leading AI companies through a single API for building generative AI applications. SageMaker AI is aimed at building and training your own models, which requires more machine learning work.
Amazon Bedrock is a fully managed service that offers foundation models from Amazon and leading AI companies through a single API for building generative AI applications. SageMaker AI is aimed at building and training your own models, which requires more machine learning work.
Question 56Cloud Concepts
Hawthorne Retail wants to move its on-premises PostgreSQL database to Amazon Aurora while the source database keeps running, to minimize downtime. Which AWS service should it use?
Correct answer: B. AWS Database Migration Service
AWS DMS migrates databases to AWS while the source stays fully operational, which minimizes downtime, and it supports moves between different database engines. AWS Backup protects data with backup plans, but it is not designed to move a live database to a new engine.
AWS DMS migrates databases to AWS while the source stays fully operational, which minimizes downtime, and it supports moves between different database engines. AWS Backup protects data with backup plans, but it is not designed to move a live database to a new engine.
Question 57Security & Compliance
Compliance staff at Elmstead Bank spend weeks gathering screenshots as evidence for audits of its AWS environment. Which service can continuously collect this evidence and map it to control frameworks?
Correct answer: A. AWS Audit Manager
AWS Audit Manager continuously collects evidence from your AWS usage and maps it to controls in frameworks such as PCI DSS and HIPAA to simplify audit preparation. AWS Artifact offers AWS's own compliance reports, not evidence about how your company uses AWS.
AWS Audit Manager continuously collects evidence from your AWS usage and maps it to controls in frameworks such as PCI DSS and HIPAA to simplify audit preparation. AWS Artifact offers AWS's own compliance reports, not evidence about how your company uses AWS.
Question 58Cloud Technology & Services
Programmers at Thornbury Tech want a generative AI assistant inside their IDE that suggests code, explains code and helps upgrade applications. Which AWS offering fits?
Correct answer: C. Amazon Q Developer
Amazon Q Developer is a generative AI assistant that works in IDEs to generate and explain code and help with tasks such as application upgrades. AWS CodePipeline automates release pipelines and does not suggest code.
Amazon Q Developer is a generative AI assistant that works in IDEs to generate and explain code and help with tasks such as application upgrades. AWS CodePipeline automates release pipelines and does not suggest code.
Question 59Cloud Concepts
IT staff at Fernwood Publishing spend most of their time racking servers and replacing failed disks. Which AWS Cloud benefit would let them refocus on projects that serve readers?
Correct answer: D. Stop spending money running and maintaining data centers
Moving to AWS removes the need to rack, stack and power servers, so staff can focus on customers and projects instead of data center chores. Trading capital for variable expense changes how you pay for IT, but it does not describe removing hardware maintenance work.
Moving to AWS removes the need to rack, stack and power servers, so staff can focus on customers and projects instead of data center chores. Trading capital for variable expense changes how you pay for IT, but it does not describe removing hardware maintenance work.
Question 60Security & Compliance
An administrator at Copperfield Arts has full AdministratorAccess through IAM in a standalone AWS account. Which task still requires signing in as the root user?
Correct answer: D. Closing the AWS account
A small set of tasks, such as closing a standalone account and changing the root user email address, require root user credentials. Viewing billing can be delegated to IAM identities once IAM access to billing is activated.
A small set of tasks, such as closing a standalone account and changing the root user email address, require root user credentials. Viewing billing can be delegated to IAM identities once IAM access to billing is activated.
Question 61Cloud Technology & Services
When a new order arrives, Copperleaf Shop wants one message pushed at once to an email list, an SQS queue and a Lambda function. Which service fits BEST?
Correct answer: A. Amazon SNS
Amazon SNS is a publish and subscribe service that pushes each message to all subscribers, such as email addresses, SQS queues and Lambda functions, which is called fan-out. SQS alone stores messages for consumers to pull, so it does not push one message to several kinds of endpoints.
Amazon SNS is a publish and subscribe service that pushes each message to all subscribers, such as email addresses, SQS queues and Lambda functions, which is called fan-out. SQS alone stores messages for consumers to pull, so it does not push one message to several kinds of endpoints.
Question 62Billing & Pricing
Gannet Media uploads large videos into Amazon S3 from the internet and later serves some of them to viewers over the internet. How is data transfer typically charged?
Correct answer: B. Inbound is free; outbound to the internet is charged
AWS generally does not charge for data transferred into AWS from the internet, while data transferred out to the internet is charged per GB after a monthly free allowance. This is why serving content to viewers, not uploading it, drives data transfer costs.
AWS generally does not charge for data transferred into AWS from the internet, while data transferred out to the internet is charged per GB after a monthly free allowance. This is why serving content to viewers, not uploading it, drives data transfer costs.
Question 63Cloud Concepts
A new employee at Hollow Pine Bakery asks what cloud computing is. Which description BEST matches the AWS definition?
Correct answer: D. On-demand IT resources over the internet with pay-as-you-go pricing
AWS defines cloud computing as the on-demand delivery of IT resources over the internet with pay-as-you-go pricing. Leasing servers on a long fixed contract is traditional hosting, because you commit to capacity whether or not you use it.
AWS defines cloud computing as the on-demand delivery of IT resources over the internet with pay-as-you-go pricing. Leasing servers on a long fixed contract is traditional hosting, because you commit to capacity whether or not you use it.
Question 64Security & Compliance
Delta Shipping has 30 accounts in AWS Organizations. It wants to apply the same AWS WAF rules to all its web applications and enforce them on new accounts automatically. Which service should it use?
Correct answer: C. AWS Firewall Manager
AWS Firewall Manager centrally configures and manages firewall rules, including AWS WAF rules, across accounts in AWS Organizations and applies them to new resources as they appear. Network ACLs are configured one VPC at a time and cannot inspect web requests.
AWS Firewall Manager centrally configures and manages firewall rules, including AWS WAF rules, across accounts in AWS Organizations and applies them to new resources as they appear. Network ACLs are configured one VPC at a time and cannot inspect web requests.
Question 65Cloud Technology & Services
Parkside Loans has a loan approval process with several steps, branching decisions, retries and a wait for human approval. It wants a visual workflow that coordinates Lambda functions. Which service fits?
Correct answer: B. AWS Step Functions
AWS Step Functions orchestrates multi-step workflows as visual state machines with branching, retries and waits, coordinating services such as Lambda. EventBridge routes events between services based on rules, but it does not track the state of a long multi-step process.
AWS Step Functions orchestrates multi-step workflows as visual state machines with branching, retries and waits, coordinating services such as Lambda. EventBridge routes events between services based on rules, but it does not track the state of a long multi-step process.
The real AWS Cloud Practitioner exam at a glance
65questions
1h 30mtime limit
MCQmultiple choice
80%+aim for here
Score 80% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Solutions Architect Professional Practice Test75 questions · SAP-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Cloud Practitioner exam. They are not real exam questions. AWS Cloud Practitioner and Amazon Web Services are trademarks of their owners. Real exam format: 65 questions (50 scored, 15 unscored) · 90 minutes · passing score 700 on a 100-1000 scale.