AWS Cloud Practitioner: Networking, Storage and AI

24 questions with the correct answer and an explanation for each. Topic: Technology: Networking, Storage and AI. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A company is designing a VPC for a three-tier application. Its database servers must not be reachable directly from the internet. Where should the company place them?

  1. In a public subnet, with a network ACL rule that denies inbound internet traffic
  2. In a private subnet
  3. In a subnet whose route table sends traffic to an internet gateway
  4. Outside the VPC, reached over AWS Direct Connect

Answer: B — In a private subnet

Private subnets are the subnets that hold instances that should not be reachable from the internet directly. A network ACL can deny traffic, but the document names the private subnet as the placement for instances that must not be directly reachable; a route to an internet gateway is what connects a VPC to the internet, and Direct Connect is a private link from on-premises to AWS, not a placement for VPC instances.

2. Instances in a private subnet need to reach the internet to download software patches, but must not accept connections initiated from the internet. Which component enables this?

  1. Internet gateway
  2. NAT gateway
  3. Route table
  4. AWS Direct Connect

Answer: B — NAT gateway

A NAT gateway lets instances in a private subnet reach out to the internet without being reachable from it.

3. A company allows inbound traffic on port 443 to an EC2 instance but configures no matching outbound rule. Traffic returning to the requester is still permitted automatically. Which control is responsible for that behavior?

  1. Network ACL
  2. Security group
  3. NAT gateway
  4. Internet gateway

Answer: B — Security group

Security groups are stateful, so return traffic is automatically allowed without a separate outbound rule.

4. A company wants to explicitly block traffic from a known bad range of IP addresses at the subnet boundary, using rules that are evaluated in order until one matches and that can either allow or deny. Which control fits?

  1. Security group
  2. Network ACL
  3. NAT gateway
  4. AWS Transit Gateway

Answer: B — Network ACL

Network ACLs operate at the subnet level, support allow and deny rules, and are evaluated in ascending order until a match.

5. A company wants its VPC resources to reach an AWS service using private IP addresses, without routing through an internet gateway or a NAT device. Which service fits?

  1. AWS Direct Connect
  2. AWS PrivateLink
  3. AWS Transit Gateway
  4. AWS Global Accelerator

Answer: B — AWS PrivateLink

PrivateLink is built specifically to reach AWS services over private IP addresses without needing an internet gateway or NAT device.

6. A company needs to connect its on-premises office to AWS quickly, is comfortable transporting the traffic encrypted over the public internet, and does not want a lengthy provisioning process. Which option fits best?

  1. AWS Direct Connect
  2. AWS VPN
  3. AWS Transit Gateway
  4. AWS PrivateLink

Answer: B — AWS VPN

VPN is encrypted over the public internet and quick to set up, unlike Direct Connect's dedicated physical link, which takes longer to provision.

7. An application runs on Windows-based EC2 instances and needs a shared file system that multiple instances can mount at once. Which service should it use?

  1. Amazon EFS
  2. Amazon FSx
  3. Amazon EBS
  4. Amazon S3

Answer: B — Amazon FSx

EFS is not supported with Windows-based EC2 instances, so a Windows file-server workload needs Amazon FSx instead.

8. An engineer reboots an EC2 instance that has data on its instance store volume. What happens to that data?

  1. It persists
  2. It is cryptographically erased, as it would be on a stop or hibernate
  3. It is lost, because the volume is detached from the instance during the reboot
  4. It is lost unless it was copied to EBS or S3 before the reboot

Answer: A — It persists

A reboot is different from a stop, hibernate, or terminate. The table gives reboot as the one event where instance store data persists; cryptographic erasure applies on stop, hibernate or terminate, not reboot.

9. A team wants to attach an additional instance store volume to an EC2 instance that has already been running for weeks. What should they expect?

  1. It can be attached at any time, just like an EBS volume
  2. It can only be attached at launch, so this running instance cannot get one now
  3. It can be attached now, but only while the instance is stopped
  4. It can be attached now, but only if the instance type is changed first

Answer: B — It can only be attached at launch, so this running instance cannot get one now

Instance store volumes are attached only at launch and cannot be added to an instance afterward.

10. A company keeps data it accesses roughly once a quarter, needs millisecond retrieval when it is accessed, and requires the data to stay available even if an entire Availability Zone is lost. Which storage class fits?

  1. S3 Standard-IA
  2. S3 One Zone-IA
  3. S3 Glacier Instant Retrieval
  4. S3 Glacier Flexible Retrieval

Answer: C — S3 Glacier Instant Retrieval

S3 Glacier Instant Retrieval is designed for quarterly access with millisecond retrieval and spans multiple Availability Zones, unlike One Zone-IA (single AZ) or Flexible Retrieval (minutes to hours, not real time).

11. A company stores data that is easy to re-create if it is lost and is accessed infrequently, and it accepts losing access to that data if a single Availability Zone goes down. Which storage class fits?

  1. S3 Standard-IA
  2. S3 One Zone-IA
  3. S3 Intelligent-Tiering
  4. S3 Glacier Flexible Retrieval

Answer: B — S3 One Zone-IA

One Zone-IA matches the Standard-IA access profile but is for re-creatable data held in a single Availability Zone, so it is the only option here that is not resilient to losing an AZ. Standard-IA, Intelligent-Tiering and Glacier Flexible Retrieval all span at least three AZs.

12. An organization runs its applications on-premises but wants those applications to get cached, low-latency access to data that actually resides in the cloud. Which service fits?

  1. AWS Backup
  2. AWS Storage Gateway
  3. Amazon S3 Lifecycle policies
  4. Amazon FSx

Answer: B — AWS Storage Gateway

AWS Storage Gateway is the hybrid service that gives on-premises applications cached access to cloud storage.

13. A company wants to build, train, and deploy its own custom machine learning models rather than rely on a pre-built AI service for a specific task. Which service should it use?

  1. Amazon Comprehend
  2. Amazon SageMaker AI
  3. Amazon Lex
  4. Amazon Rekognition

Answer: B — Amazon SageMaker AI

Building, training, and deploying custom models is the defining task of Amazon SageMaker AI, while the other services each perform one fixed, pre-built task.

14. A business scans paper invoices into image files and wants to automatically extract the text data from them. Which service fits?

  1. Amazon Comprehend
  2. Amazon Rekognition
  3. Amazon Textract
  4. Amazon Transcribe

Answer: C — Amazon Textract

Extracting text from scanned documents is the specific task performed by Amazon Textract, distinct from general image analysis or finding meaning in already-digital text.

15. Employees at a company need a generative AI assistant they can ask about the company's own content and internal systems. Which service should the company choose?

  1. Amazon Q Developer
  2. Amazon Q Business
  3. Amazon Lex
  4. Amazon Comprehend

Answer: B — Amazon Q Business

Amazon Q Business is the assistant you tailor to your business, connected to your own content and systems, while Amazon Q Developer is aimed at understanding, building, extending, and operating applications and workloads on AWS.

16. A company records customer service phone calls and needs to automatically convert the audio into written text for later analysis. Which service should it use?

  1. Amazon Polly
  2. Amazon Translate
  3. Amazon Lex
  4. Amazon Transcribe

Answer: D — Amazon Transcribe

Converting speech to text is the task performed by Amazon Transcribe, the opposite of Amazon Polly, which converts text to speech.

17. An analyst wants to run SQL queries directly against data files stored in S3 without provisioning or managing any servers. Which service fits?

  1. Amazon Redshift
  2. AWS Glue
  3. Amazon EMR
  4. Amazon Athena

Answer: D — Amazon Athena

Running serverless SQL queries directly against data in S3 is exactly what Amazon Athena provides, unlike the warehouse, ETL, and big-data-framework services.

18. A company needs to ingest and process continuously generated clickstream data as it arrives, in real time. Which service should it use?

  1. AWS Glue
  2. Amazon OpenSearch Service
  3. Amazon QuickSight
  4. Amazon Kinesis

Answer: D — Amazon Kinesis

Real-time streaming data is the defining use case for Amazon Kinesis, distinct from ETL, search/log analytics, and dashboarding services.

19. An application must process orders strictly in the order they were placed, and cannot afford to drop any of them if the processor goes offline briefly. Which service decouples the components while meeting these requirements?

  1. Amazon SQS
  2. Amazon SNS
  3. Amazon EventBridge
  4. AWS Step Functions

Answer: A — Amazon SQS

SQS is a hosted queue that decouples distributed components, and its messages are typically processed by a single subscriber, which suits workflows where order and not losing anything matter; SNS has no queues, EventBridge routes events by rule, and Step Functions coordinates several services into a workflow.

20. A monitoring system needs one publish action to simultaneously trigger a Lambda function, send an SMS, and email an on-call engineer when an alarm fires. Which service delivers a single message to all of these different subscriber types at once?

  1. Amazon SNS
  2. Amazon SQS
  3. Amazon EventBridge
  4. AWS Step Functions

Answer: A — Amazon SNS

SNS publishes to a topic with multiple subscribers across endpoint types including Lambda, SMS, and email, which suits immediate notifications and alarms; SQS messages are typically processed by a single subscriber, and EventBridge and Step Functions route events by rule and coordinate workflows rather than notifying many endpoints.

21. An order event must reach three independent backend systems — inventory, billing, and shipping — and none of them should miss the event even if temporarily unavailable. Which setup fits?

  1. Publish to a topic with a separate queue subscribed for each system
  2. A single queue shared by all three systems
  3. Publish to a topic with each system subscribed directly, with no queues
  4. Route the event directly to each system by rule, with no topic or queues

Answer: A — Publish to a topic with a separate queue subscribed for each system

This is fanout: SNS publishes to a topic and several SQS queues subscribe to it, so one message reaches many consumers and the queues mean nothing is lost while a consumer is offline. A shared queue means messages are typically processed by a single subscriber, and the options without queues leave nothing holding the event while a system is down.

22. A retailer wants to run a contact centre for its customer support team as a cloud service rather than operating one itself. Which service fits?

  1. Amazon Connect
  2. Amazon SES
  3. Amazon WorkSpaces
  4. Amazon SNS

Answer: A — Amazon Connect

Amazon Connect is the cloud contact centre service; SES sends email, WorkSpaces provides virtual desktops, and SNS publishes notifications to subscribers.

23. Requests in a distributed application pass through several microservices, and response times have grown for reasons that are not obvious. Which service traces a request across the services to find where the delay is introduced?

  1. AWS X-Ray
  2. AWS CodeBuild
  3. AWS CodePipeline
  4. AWS Step Functions

Answer: A — AWS X-Ray

X-Ray traces a request through a distributed application to find where it slowed down; CodeBuild compiles and tests, CodePipeline is the CI/CD pipeline, and Step Functions coordinates several services into a workflow.

24. A company needs to deliver one specialised application to a group of external users, streamed to them from AWS. Which service fits?

  1. Amazon AppStream 2.0
  2. Amazon WorkSpaces
  3. Amazon WorkSpaces Secure Browser
  4. AWS Amplify

Answer: A — Amazon AppStream 2.0

AppStream 2.0 streams a single application; WorkSpaces provides virtual desktops, WorkSpaces Secure Browser is a browser delivered as a service, and Amplify builds and deploys frontend and mobile applications.

Take this test interactively

More AWS Cloud Practitioner practice tests