AWS Certified Cloud Practitioner (CLF-C02) — Questions and Answers

Question 1: Which architectural pattern decouples application components so they can scale and fail independently?

Loose coupling (Correct answer)
Tight coupling
Monolithic architecture
Hard coding

Correct answer: Loose coupling

Loose coupling uses queues, APIs, or events to separate components, so failures or scaling needs in one part don't directly impact others.

Question 2: Which of the following is NOT a benefit of moving to the AWS Cloud from an on-premises data center?

Converting capital expenses to variable expenses
Maintaining full physical access to servers (Correct answer)
Benefiting from massive economies of scale
Eliminating the cost of running and maintaining data centers

Correct answer: Maintaining full physical access to servers

In AWS, you do not have physical access to the underlying servers — this is AWS's responsibility, not a benefit customers receive.

Question 3: Which service provides on-demand access to AWS compliance reports such as SOC and PCI DSS documentation?

AWS Config
AWS Security Hub
AWS Artifact (Correct answer)
AWS Trusted Advisor

Correct answer: AWS Artifact

AWS Artifact is a self-service portal that gives you on-demand access to AWS compliance reports and agreements.

Question 4: Which AWS service provides a managed firewall to filter malicious web traffic before it reaches your application?

AWS Shield
AWS WAF (Correct answer)
AWS Firewall Manager
Amazon GuardDuty

Correct answer: AWS WAF

AWS WAF (Web Application Firewall) filters HTTP/HTTPS traffic based on rules you define to block common exploits like SQL injection and XSS.

Question 5: What is AWS Fargate?

A serverless compute engine for containers that removes the need to manage servers or EC2 instances (Correct answer)
A dedicated hardware service for containers
A monitoring service for containerized applications
A container registry for storing Docker images

Correct answer: A serverless compute engine for containers that removes the need to manage servers or EC2 instances

AWS Fargate is a serverless compute engine for Amazon ECS and EKS that lets you run containers without managing the underlying EC2 servers.

Question 6: Which AWS service is used to manage and automate the deployment of infrastructure using code templates?

AWS Config
AWS Systems Manager
AWS CodeDeploy
AWS CloudFormation (Correct answer)

Correct answer: AWS CloudFormation

AWS CloudFormation is the Infrastructure as Code (IaC) service that provisions and manages AWS resources using JSON or YAML templates.

Question 7: Which AWS Support plan is the minimum tier that offers 24/7 access to Cloud Support Engineers via phone, chat, and email?

Basic
Enterprise
Business (Correct answer)
Developer

Correct answer: Business

AWS Business Support is the minimum plan that includes 24/7 access to Cloud Support Engineers via phone, chat, and email, plus a 1-hour response SLA for urgent issues.

Question 8: What is the benefit of using multiple AWS Regions for a global application?

Simplified IAM management
Lower storage costs
Reduced latency for users in different geographic locations and improved disaster recovery (Correct answer)
Automatic Reserved Instance discounts

Correct answer: Reduced latency for users in different geographic locations and improved disaster recovery

Deploying in multiple Regions reduces latency for globally distributed users and provides geographic redundancy for disaster recovery purposes.

Question 9: Which type of Elastic Load Balancer operates at the connection level (Layer 4)?

Gateway Load Balancer
Classic Load Balancer
Application Load Balancer
Network Load Balancer (Correct answer)

Correct answer: Network Load Balancer

Network Load Balancer operates at the transport layer (Layer 4) and is capable of handling millions of requests per second with ultra-low latency, making it ideal for TCP/UDP traffic.

Question 10: Which AWS service allows you to set spending thresholds and receive alerts when your costs or usage exceed defined limits?

AWS Pricing Calculator
AWS Budgets (Correct answer)
AWS Cost Explorer
AWS Bills

Correct answer: AWS Budgets

AWS Budgets lets you define cost, usage, or reservation budgets and sends alerts via SNS or email when thresholds are breached.

Question 11: Which AWS compute service runs code without requiring you to provision or manage servers?

Amazon EC2
Amazon ECS
AWS Elastic Beanstalk
AWS Lambda (Correct answer)

Correct answer: AWS Lambda

AWS Lambda is a serverless compute service that executes code in response to events without any server management, billing only for execution time.

Question 12: Which AWS service allows you to run AWS infrastructure and services in your own on-premises data center?

AWS Wavelength
AWS Outposts (Correct answer)
AWS Local Zones
AWS Direct Connect

Correct answer: AWS Outposts

AWS Outposts brings native AWS services, infrastructure, and operating models to virtually any data center or on-premises facility.

Question 13: Which AWS service is used to distribute incoming application traffic across multiple Amazon EC2 instances?

Amazon CloudFront
Amazon Route 53
Elastic Load Balancing (Correct answer)
AWS Global Accelerator

Correct answer: Elastic Load Balancing

Elastic Load Balancing automatically distributes incoming traffic across multiple EC2 instances to improve availability and fault tolerance.

Question 14: Which AWS tool provides automated recommendations to help optimize costs, security, performance, and fault tolerance?

AWS Cost Explorer
AWS Compute Optimizer
AWS Trusted Advisor (Correct answer)
AWS Config

Correct answer: AWS Trusted Advisor

AWS Trusted Advisor inspects your AWS environment and provides real-time recommendations across cost optimization, security, performance, and fault tolerance.

Question 15: Under the AWS Shared Responsibility Model, who is responsible for patching the guest operating system on an Amazon EC2 instance?

Both AWS and the customer equally
AWS
The customer (Correct answer)
AWS Support

Correct answer: The customer

In the Shared Responsibility Model, customers manage the guest OS, including updates and patches, on EC2 instances.

Question 16: Which AWS service enables multi-factor authentication (MFA) enforcement for IAM users?

Amazon Cognito
AWS IAM (Correct answer)
AWS SSO
AWS Directory Service

Correct answer: AWS IAM

AWS IAM allows administrators to require MFA for individual users or enforce it via IAM policies across the account.

Question 17: Which AWS compliance program ensures that AWS services meet the security requirements for processing US federal government data?

SOC 2
HIPAA
PCI DSS
FedRAMP (Correct answer)

Correct answer: FedRAMP

FedRAMP (Federal Risk and Authorization Management Program) is the US government compliance framework that AWS participates in for federal cloud services.

Question 18: What is the minimum number of Availability Zones in each AWS Region?

3 (Correct answer)
2
4
1

Correct answer: 3

Each AWS Region has a minimum of three Availability Zones to support high availability and fault-tolerant architectures.

Question 19: Which AWS service stores and rotates database credentials, API keys, and other secrets securely?

AWS Key Management Service
AWS Secrets Manager (Correct answer)
AWS Parameter Store
Amazon Cognito

Correct answer: AWS Secrets Manager

AWS Secrets Manager stores secrets like database passwords and API keys, and can automatically rotate them on a schedule.

Question 20: Which security service protects AWS applications from common web exploits like SQL injection?

AWS WAF (Correct answer)
AWS Shield
Amazon GuardDuty
Amazon Macie

Correct answer: AWS WAF

AWS Web Application Firewall (WAF) protects web applications from common exploits like SQL injection and cross-site scripting.

Question 21: What does 'infrastructure as code' (IaC) mean in cloud architecture?

Defining and managing infrastructure through machine-readable configuration files (Correct answer)
Using GUI consoles to configure services
Writing application code that runs on servers
Manually scripting server configurations in bash

Correct answer: Defining and managing infrastructure through machine-readable configuration files

Infrastructure as Code means defining your servers, networks, and services in code files (like CloudFormation templates), enabling repeatable, version-controlled deployments.

Question 22: Which AWS service allows you to audit user activity and API calls across your AWS infrastructure?

Amazon CloudWatch
AWS CloudTrail (Correct answer)
Amazon Inspector
AWS Config

Correct answer: AWS CloudTrail

AWS CloudTrail records API calls and user activity in your AWS account, providing a complete audit trail for compliance and security analysis.

Question 23: Under the AWS Shared Responsibility Model, which of the following is AWS responsible for?

Configuring security groups
Encrypting application data
Managing IAM user permissions
Patching underlying physical hardware (Correct answer)

Correct answer: Patching underlying physical hardware

AWS is responsible for the security 'of' the cloud, including maintaining and patching the physical hardware and underlying infrastructure.

Question 24: Which AWS service helps you orchestrate multi-step workflows and coordinate distributed application components?

AWS Step Functions (Correct answer)
Amazon SQS
Amazon SNS
Amazon EventBridge

Correct answer: AWS Step Functions

AWS Step Functions is a serverless workflow orchestration service that coordinates multiple AWS services into visual, automated workflows using state machines.

Question 25: Under the AWS Shared Responsibility Model, who is responsible for patching the guest operating system on an Amazon EC2 instance?

Both AWS and the customer equally
The customer (Correct answer)
A third-party vendor
AWS

Correct answer: The customer

Under the shared responsibility model, the customer is responsible for patching and maintaining the guest OS on EC2 instances.

Question 26: Which service continuously monitors AWS accounts and workloads for malicious activity using machine learning and threat intelligence?

Amazon GuardDuty (Correct answer)
Amazon Macie
AWS Security Hub
Amazon Inspector

Correct answer: Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to identify suspicious activity.

Question 27: Which AWS pricing model allows you to commit to a consistent usage amount in exchange for a lower hourly rate?

On-Demand
Reserved Instances (Correct answer)
Spot Instances
Dedicated Hosts

Correct answer: Reserved Instances

Reserved Instances offer significant discounts over On-Demand pricing in exchange for a 1- or 3-year usage commitment.

Question 28: Which AWS service provides a dedicated private connection from an on-premises data center to AWS?

Amazon VPC Peering
AWS VPN
AWS Transit Gateway
AWS Direct Connect (Correct answer)

Correct answer: AWS Direct Connect

AWS Direct Connect establishes a dedicated physical network connection between an on-premises facility and AWS, bypassing the public internet.

Question 29: Which AWS service allows you to set custom cost and usage thresholds and receive alerts when they are exceeded?

AWS Trusted Advisor
AWS Cost Explorer
AWS Budgets (Correct answer)
AWS Pricing Calculator

Correct answer: AWS Budgets

AWS Budgets lets you set custom cost and usage budgets and sends alerts via email or SNS when thresholds are breached.

Question 30: Which AWS pricing model offers the largest discount compared to On-Demand pricing in exchange for a 1- or 3-year commitment?

Savings Plans
Reserved Instances (Correct answer)
Dedicated Hosts
Spot Instances

Correct answer: Reserved Instances

Reserved Instances offer up to 72% savings over On-Demand pricing when you commit to a specific instance type for 1 or 3 years.

Question 31: Which Well-Architected Framework pillar addresses reducing the environmental impact of your cloud workloads?

Cost Optimization
Operational Excellence
Performance Efficiency
Sustainability (Correct answer)

Correct answer: Sustainability

The Sustainability pillar, added in 2021, focuses on minimizing the environmental impact of running cloud workloads through efficient resource utilization.

Question 32: What is the difference between Amazon SQS and Amazon SNS?

SQS is for storage, SNS is for networking
SQS is a pull-based message queue for decoupling services; SNS is a push-based pub/sub notification service (Correct answer)
SQS is for emails, SNS is for SMS only
They are identical services with different names

Correct answer: SQS is a pull-based message queue for decoupling services; SNS is a push-based pub/sub notification service

SQS is a message queue where consumers poll for messages (decoupling producers and consumers), while SNS pushes messages to multiple subscribers simultaneously.

Question 33: Which AWS service lets you set fine-grained permissions for AWS services and resources using JSON-based policies?

AWS Organizations
AWS IAM (Correct answer)
Amazon Cognito
AWS Control Tower

Correct answer: AWS IAM

AWS Identity and Access Management (IAM) lets you manage access to AWS services and resources securely using policies.

Question 34: What is a key characteristic of AWS's pay-as-you-go pricing model?

Pricing is fixed regardless of usage
You must sign a minimum 1-year contract
You pay only for the resources you use with no upfront cost (Correct answer)
You must pay for resources even when they are stopped

Correct answer: You pay only for the resources you use with no upfront cost

AWS's pay-as-you-go model means you only pay for the exact resources you consume, with no upfront fees or long-term contracts required.

Question 35: What is the AWS Professional Services team?

The team that manages Reserved Instance billing
A global team of AWS experts who help customers achieve business outcomes using AWS (Correct answer)
An on-call team that fixes AWS infrastructure outages
AWS's internal security audit team

Correct answer: A global team of AWS experts who help customers achieve business outcomes using AWS

AWS Professional Services is a global team of experts that helps customers accelerate their move to the cloud and achieve specific business and technical outcomes.

Question 36: What does 'designing for failure' mean in AWS cloud architecture?

Running systems in degraded mode permanently
Expecting systems to always fail
Reducing feature scope to avoid bugs
Building systems that assume component failures will happen and remain operational anyway (Correct answer)

Correct answer: Building systems that assume component failures will happen and remain operational anyway

Designing for failure means architecting systems with redundancy and auto-recovery so they remain available even when individual components fail.

Question 37: What is an IAM role used for in AWS?

Defining password policies for AWS accounts
Creating groups of users with shared permissions
Storing long-term access credentials for a user
Granting temporary permissions to entities that need access to AWS resources (Correct answer)

Correct answer: Granting temporary permissions to entities that need access to AWS resources

IAM roles are used to delegate access to AWS resources with temporary security credentials, without sharing long-term keys.

Question 38: Which AWS service enables you to model and provision infrastructure as code using templates?

AWS CloudFormation (Correct answer)
AWS Elastic Beanstalk
AWS Systems Manager
AWS OpsWorks

Correct answer: AWS CloudFormation

AWS CloudFormation lets you define your entire infrastructure in JSON or YAML templates and provision it consistently and repeatedly.

Question 39: Which AWS service provides a managed message queuing service that decouples microservices and distributed systems?

Amazon EventBridge
AWS Step Functions
Amazon SNS
Amazon SQS (Correct answer)

Correct answer: Amazon SQS

Amazon SQS (Simple Queue Service) is a fully managed message queuing service used to decouple and scale microservices and distributed systems.

Question 40: Which IAM best practice recommends avoiding the use of root account credentials for everyday tasks?

Principle of Least Privilege
Role-Based Access Control
Root Account Protection (Correct answer)
Identity Federation

Correct answer: Root Account Protection

AWS recommends locking away root account credentials and creating individual IAM users for day-to-day operations to minimize risk.

Question 41: What AWS tool helps you identify S3 buckets that contain sensitive data such as PII?

Amazon GuardDuty
AWS Inspector
Amazon Macie (Correct answer)
AWS Trusted Advisor

Correct answer: Amazon Macie

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data in Amazon S3.

Question 42: What is the AWS Personal Health Dashboard?

A fitness tracking integration for AWS employees
A tool for monitoring application health metrics
A security compliance dashboard
A personalized view of the performance and availability of AWS services that affect your specific resources (Correct answer)

Correct answer: A personalized view of the performance and availability of AWS services that affect your specific resources

The AWS Personal Health Dashboard provides proactive, tailored notifications about AWS service events that may affect your specific account and resources.

Question 43: Which AWS feature allows you to define fine-grained permissions for AWS users and roles using JSON policy documents?

AWS Organizations
Amazon Cognito
AWS IAM Policies (Correct answer)
AWS Config

Correct answer: AWS IAM Policies

IAM (Identity and Access Management) policies are JSON documents that define what actions are allowed or denied on which AWS resources.

Question 44: What does AWS Direct Connect provide?

A service that automatically discovers and connects AWS resources
A managed VPN service that encrypts traffic over the public internet
A dedicated, private network connection from an on-premises data center to AWS (Correct answer)
A free tier for connecting EC2 instances within the same VPC

Correct answer: A dedicated, private network connection from an on-premises data center to AWS

AWS Direct Connect establishes a dedicated private network connection between your on-premises environment and AWS, offering consistent network performance and reduced data transfer costs compared to internet-based connections.

Question 45: Which AWS Well-Architected pillar focuses on the ability of a system to recover from failures and meet demand?

Sustainability
Operational Excellence
Security
Reliability (Correct answer)

Correct answer: Reliability

The Reliability pillar addresses designing systems that can recover from infrastructure failures, scale to meet demand, and mitigate disruptions.

Question 46: Which AWS service streams real-time data at scale, such as log data, clickstreams, or IoT telemetry?

Amazon EMR
Amazon Kinesis (Correct answer)
AWS Glue
Amazon SQS

Correct answer: Amazon Kinesis

Amazon Kinesis is a platform for collecting, processing, and analyzing real-time streaming data like application logs, website clickstreams, and IoT sensor data.

Question 47: What is the AWS Free Tier, and how long does it last for new accounts?

Free usage of all AWS services for 30 days
Free usage limits on selected services for 12 months after account creation (Correct answer)
Free usage of EC2 and S3 only, for 6 months
Unlimited free usage for selected services, forever

Correct answer: Free usage limits on selected services for 12 months after account creation

The AWS Free Tier provides limited free usage of many services for 12 months after account creation, plus some services that are always free.

Question 48: Which AWS service provides a centralized view of security alerts and compliance status across your AWS accounts?

AWS Inspector
Amazon GuardDuty
AWS Shield
AWS Security Hub (Correct answer)

Correct answer: AWS Security Hub

AWS Security Hub provides a comprehensive view of your security state in AWS and helps you check your environment against security industry standards.

Question 49: Which AWS database service is a fully managed, serverless NoSQL key-value and document database?

Amazon Redshift
Amazon RDS
Amazon DynamoDB (Correct answer)
Amazon Aurora

Correct answer: Amazon DynamoDB

Amazon DynamoDB is a fully managed serverless NoSQL database offering single-digit millisecond performance at any scale.

Question 50: Which AWS service performs automated security assessments of EC2 instances and container workloads to find vulnerabilities?

AWS Macie
Amazon GuardDuty
Amazon Inspector (Correct answer)
AWS Shield

Correct answer: Amazon Inspector

Amazon Inspector automatically assesses applications for software vulnerabilities and unintended network exposures on EC2 and container workloads.

Question 51: What does Amazon EC2 Auto Scaling use to determine when to launch or terminate instances?

AWS Trusted Advisor recommendations
Scaling policies based on CloudWatch metrics such as CPU utilization (Correct answer)
Manually defined schedules only
The AWS billing console

Correct answer: Scaling policies based on CloudWatch metrics such as CPU utilization

EC2 Auto Scaling uses CloudWatch metrics (like CPU utilization or request counts) combined with scaling policies to trigger launch or termination of instances.

Question 52: Which AWS service provides a managed relational database that can automatically scale storage?

Amazon Redshift
Amazon RDS (Correct answer)
Amazon DynamoDB
Amazon ElastiCache

Correct answer: Amazon RDS

Amazon RDS is a managed relational database service that supports automatic storage scaling with features like Aurora storage auto-scaling.

Question 53: Which AWS service helps you detect unusual activity and potential threats in your AWS account using machine learning?

Amazon Macie
Amazon GuardDuty (Correct answer)
AWS WAF
AWS Config

Correct answer: Amazon GuardDuty

Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and anomalous behavior using machine learning.

Question 54: Which AWS service enables you to run code without provisioning or managing servers?

Amazon EC2
AWS Elastic Beanstalk
AWS Lambda (Correct answer)
Amazon ECS

Correct answer: AWS Lambda

AWS Lambda is a serverless compute service that runs your code in response to events without requiring server management.

Question 55: What is an AWS Region?

A virtual network within AWS
A geographic area containing multiple, isolated Availability Zones (Correct answer)
A single data center used by AWS
A group of edge locations used for content delivery

Correct answer: A geographic area containing multiple, isolated Availability Zones

An AWS Region is a physical location around the world where AWS clusters multiple data centers (Availability Zones) to provide redundancy and low latency.

Question 56: Which deployment strategy releases new application versions to a small subset of users before a full rollout?

Blue/Green Deployment
Immutable Deployment
Canary Deployment (Correct answer)
Rolling Deployment

Correct answer: Canary Deployment

A Canary deployment routes a small percentage of traffic to the new version first, allowing issues to be detected before affecting all users.

Question 57: What are AWS Edge Locations primarily used for?

Delivering cached content to users with low latency via Amazon CloudFront (Correct answer)
Running EC2 instances closer to users
Hosting RDS databases near end users
Providing direct connections to AWS from on-premises networks

Correct answer: Delivering cached content to users with low latency via Amazon CloudFront

AWS Edge Locations are part of the global CloudFront CDN network that caches content closer to end users to reduce latency.

Question 58: A company wants to use AWS services in China. What should they be aware of?

China Regions are operated by local partners and require separate accounts (Correct answer)
AWS does not offer services in China
China Regions offer all the same services as US Regions
China Regions use the same AWS accounts as global regions

Correct answer: China Regions are operated by local partners and require separate accounts

AWS China Regions are operated by local Chinese partners (Sinnet and NWCD) and require separate accounts from global AWS accounts.

Question 59: Which design principle recommends replacing failed components automatically rather than fixing them in place?

Principle of Least Privilege
Infrastructure as Code
Treat servers as cattle, not pets (Correct answer)
Defense in Depth

Correct answer: Treat servers as cattle, not pets

The 'cattle not pets' principle means servers are disposable and interchangeable — when one fails, it's replaced automatically rather than manually nursed back to health.

Question 60: When an Amazon EC2 instance is terminated, which service can determine the user who performed the API call?

AWS Identity and Access Management (AWS IAM)
AWS Trusted Advisor
AWS CloudTrail (Correct answer)
AWS X-Ray

Correct answer: AWS CloudTrail

Users that utilize AWS CloudTrail may enable governance, compliance, operational auditing, and risk auditing for their AWS accounts. Events in CloudTrail are the actions that a user, role, or an AWS service has performed. AWS Management Console, AWS Command Line Interface (CLI), AWS SDKs, and APIs all record events.

Question 61: Which AWS Well-Architected Framework pillar focuses on protecting data, systems, and assets through risk assessments and mitigation?

Performance Efficiency
Cost Optimization
Reliability
Security (Correct answer)

Correct answer: Security

The Security pillar of the Well-Architected Framework covers identity management, detecting incidents, protecting data, and automating security best practices.

Question 62: What is the purpose of deploying resources across multiple Availability Zones in AWS?

To comply with GDPR requirements
To improve fault tolerance and eliminate single points of failure (Correct answer)
To reduce data transfer costs
To enable global latency routing

Correct answer: To improve fault tolerance and eliminate single points of failure

Multi-AZ deployments ensure that if one data center fails, your workload continues running in another AZ, eliminating single points of failure.

Question 63: Which AWS pricing benefit consolidates billing for multiple accounts and applies volume discounts across the entire organization?

Enterprise Discount Program
Reserved Instance Sharing
Savings Plans
Consolidated Billing (Correct answer)

Correct answer: Consolidated Billing

Consolidated Billing through AWS Organizations combines usage across all member accounts, enabling volume pricing tiers and a single invoice.

Question 64: Which AWS storage service is best suited for sharing a file system across multiple EC2 instances simultaneously?

Amazon EFS (Correct answer)
Amazon S3
AWS Storage Gateway
Amazon EBS

Correct answer: Amazon EFS

Amazon EFS (Elastic File System) is a managed NFS file system that can be mounted concurrently by thousands of EC2 instances.

Question 65: Which AWS service provides a publish-subscribe messaging model to send notifications to multiple subscribers simultaneously?

Amazon Kinesis
AWS EventBridge
Amazon SQS
Amazon SNS (Correct answer)

Correct answer: Amazon SNS

Amazon SNS (Simple Notification Service) uses a pub-sub model to fan out messages to multiple subscribers including SQS queues, Lambda functions, and email endpoints.

AWS Certified Cloud Practitioner (CLF-C02)

The AWS Certified Cloud Practitioner validates foundational, high-level understanding of AWS Cloud concepts, services, security, and economics. It is intended for individuals seeking to demonstrate overall AWS knowledge independent of a specific job role.

Questions

90 min

Time Limit

70%

To Pass

Checking for saved progress...

Exam Rules

You can skip questions and return to them later
Flag questions for review before submitting
No feedback shown until you submit the entire exam
Unanswered questions count as wrong — answer everything
10 pretest questions are mixed in and don't affect your score
Timer auto-submits when time runs out
Your progress is auto-saved every 30 seconds