AWS Cloud Practitioner Practice Exam 2

51 questions with the correct answer and an explanation for each. Topic: CLF-C02. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A finance team currently makes a large up-front purchase of servers before it knows how much they will be used. After moving to the cloud, it wants spending to be a running cost that tracks actual usage. How does the nature of the expenditure change?

  1. From capital expenditure to operating expenditure
  2. Capital expenditure is reduced but still paid before use
  3. From operating expenditure to capital expenditure
  4. From variable cost to fixed cost

Answer: A — From capital expenditure to operating expenditure

A large up-front purchase is capital expenditure; a running cost that follows usage is operating expenditure, and the cloud moves spending in that direction. The reverse options describe the on-premises model.

2. A retailer wants shoppers on other continents to experience lower latency, without building anything in those places. Which cloud advantage describes deploying to serve them?

  1. Benefit from massive economies of scale
  2. Go global in minutes
  3. Stop spending money running and maintaining data centres
  4. Increase speed and agility

Answer: B — Go global in minutes

Deploying in several Regions puts the application closer to users and lowers their latency without local construction. Speed and agility is about how quickly resources can be obtained, not where they are located.

3. A workload adds machines at peak and removes them afterwards, yet the whole service goes down when a single location fails. Which property is it missing?

  1. Agility
  2. Economies of scale
  3. Elasticity
  4. High availability

Answer: D — High availability

The workload already has elasticity; what it lacks is the ability to stay usable when part of it fails, which is high availability. Elasticity is about cost tracking demand, not surviving failure.

4. A workload responds very quickly but fails and does not recover when an instance is lost. Which pillar is it weak on?

  1. Cost optimization
  2. Operational excellence
  3. Reliability
  4. Performance efficiency

Answer: C — Reliability

Recovering from failure is the reliability question, and a system can be fast yet fragile. Performance efficiency is about using the right resources, which the fast response suggests is satisfied.

5. A company plans to re-architect an application around cloud-native features, but its staff lack advanced skills and its culture and leadership are not yet aligned. Which AWS CAF perspective addresses this gap?

  1. Governance
  2. Platform
  3. People
  4. Operations

Answer: C — People

People covers culture, structure, leadership and skills. Platform covers building and modernising workloads, not the organisation's skills.

6. Which two perspectives are among the three AWS CAF perspectives concerned with the business rather than the technology? (Choose two.)

  1. Business
  2. Security
  3. Operations
  4. Platform
  5. People

Answer: A,E — Business / People

The first three perspectives (Business, People and Governance) concern the business. Platform, Security and Operations are the three technology perspectives.

7. A team moves an application to AWS and, along the way, switches its self-managed database to a managed one, leaving the rest as it is. Which migration strategy is this?

  1. Replatform
  2. Refactor
  3. Repurchase
  4. Rehost

Answer: A — Replatform

Replatform moves the application and makes a limited optimisation such as adopting a managed database. Refactor rebuilds the architecture around cloud-native features.

8. A portfolio review finds an application that nobody uses any more. Which strategy applies?

  1. Repurchase
  2. Relocate
  3. Retain
  4. Retire

Answer: D — Retire

An application that is no longer needed is decommissioned, which is retire. Retain keeps it running where it is.

9. Which two migration strategies change the application or its architecture as part of the move? (Choose two.)

  1. Replatform
  2. Rehost
  3. Retain
  4. Refactor
  5. Relocate

Answer: A,D — Replatform / Refactor

Replatform and refactor both change something, with replatform making a limited optimisation and refactor rebuilding the architecture. Rehost and relocate move things unchanged, and retain leaves them in place.

10. A company must move its databases to AWS while the source databases remain in use during the move. Which service does the move?

  1. AWS Application Migration Service
  2. AWS Database Migration Service
  3. AWS Migration Hub
  4. AWS Schema Conversion Tool

Answer: B — AWS Database Migration Service

AWS DMS moves databases with the source able to stay in use. Application Migration Service lifts servers rather than databases.

11. A company has no existing software licences and would otherwise have to buy them. Which AWS licensing approach suits it?

  1. Retaining the software on premises
  2. AWS License Manager alone
  3. Bring Your Own License (BYOL)
  4. Instances where the licence cost is included in the hourly price

Answer: D — Instances where the licence cost is included in the hourly price

Included licensing suits an organisation that would otherwise have to buy licences. BYOL needs existing agreements already paid for.

12. Which two statements correctly describe fixed and variable costs? (Choose two.)

  1. A variable cost moves with consumption
  2. A fixed cost is paid whether or not anything is used
  3. A purchased server is a variable cost
  4. Cloud computing converts variable costs into fixed costs
  5. A purchased server costs less at three in the morning than at midday

Answer: A,B — A variable cost moves with consumption / A fixed cost is paid whether or not anything is used

A fixed cost is paid regardless of use and a variable cost moves with consumption. A purchased server is a fixed cost that depreciates the same at any hour, and cloud converts fixed costs into variable ones.

13. A team migrates a workload from Amazon EC2 instances to AWS Lambda functions. Which task is no longer part of the team's responsibilities after the move?

  1. Applying security patches to the guest operating system
  2. Classifying the data the application processes
  3. Deciding whether the application's data is encrypted
  4. Managing the permissions granted through IAM

Answer: A — Applying security patches to the guest operating system

Lambda has no operating system the customer can reach, so there is nothing to patch. IAM permissions, data classification and encryption remain the customer's responsibility in the cloud.

14. An auditor asks about the physical and environmental security of the facilities hosting a customer's workload, which the customer relies on AWS for entirely. What type of control is this?

  1. Customer-specific control
  2. Shared control
  3. Inherited control
  4. Federated control

Answer: C — Inherited control

Controls that you inherit wholly from AWS, with physical and environmental security as the standard example, are inherited controls. A shared control would need the customer to act at its own layer too.

15. Which two items are always on the customer's side of the shared responsibility model, whatever the service used? (Choose two.)

  1. Guarding data centre doors
  2. Granting permissions with IAM
  3. Deciding how its data is classified
  4. Patching the hypervisor
  5. Replacing failed disks

Answer: B,C — Granting permissions with IAM / Deciding how its data is classified

Security in the cloud covers the customer's data, how it is classified, whether it is encrypted, and the permissions granted with IAM. Doors, hypervisors and disks belong to AWS's infrastructure.

16. Which two statements about AWS Artifact are true? (Choose two.)

  1. It records API calls and account activity
  2. It charges per report downloaded
  3. It is free of charge
  4. It lets you review, accept and track your agreements with AWS
  5. It provides documents that prove the customer's own compliance

Answer: C,D — It is free of charge / It lets you review, accept and track your agreements with AWS

Artifact is where agreements with AWS are reviewed, accepted and tracked, and it costs nothing. It provides documents about AWS's compliance, not the customer's, and recording API calls is CloudTrail.

17. A team needs a service that creates and controls the encryption keys protecting its data. Which service should it use?

  1. AWS IAM Identity Center
  2. AWS Config
  3. AWS Secrets Manager
  4. AWS Key Management Service (AWS KMS)

Answer: D — AWS Key Management Service (AWS KMS)

AWS KMS creates and controls keys. Secrets Manager stores application credentials, Identity Center handles single sign-on, and Config records configuration.

18. Which two statements correctly distinguish AWS's logging, monitoring and auditing services? (Choose two.)

  1. CloudTrail assesses resource configuration against rules
  2. CloudWatch records resource configuration over time
  3. CloudTrail records API calls and account activity
  4. CloudWatch provides metrics, logs and alarms
  5. Config provides metrics and alarms

Answer: C,D — CloudTrail records API calls and account activity / CloudWatch provides metrics, logs and alarms

CloudTrail is the audit trail of API calls and account activity, and CloudWatch is the monitoring service with metrics, logs and alarms. Configuration recording and rule assessment belong to Config.

19. In a standalone account, the only IAM administrator accidentally revoked their own permissions, and now no one can manage IAM. How can permissions be restored?

  1. Sign in as the root user and restore the IAM user permissions
  2. Use AWS Config to roll the policy back
  3. Use IAM Identity Center to reassign the permissions
  4. Create a new IAM group and attach a policy to it

Answer: A — Sign in as the root user and restore the IAM user permissions

Restoring IAM user permissions when the only IAM administrator has revoked their own is a task that requires the root user.

20. In an AWS Organizations environment, a member account's S3 bucket policy denies every principal, and nobody holds root credentials for that account. How can the bucket be unlocked?

  1. A user signs in as root to the member account using the default password
  2. The management account or a delegated administrator performs the unlock centrally
  3. A root access key is generated for the member account
  4. The member account must be closed

Answer: B — The management account or a delegated administrator performs the unlock centrally

Within an organization the management account or a delegated administrator performs privileged tasks centrally, including unlocking such a bucket or queue. Member accounts cannot sign in as root by default.

21. An application running on an AWS service needs permissions only temporarily, and the team wants no long-term credentials involved. Which IAM building block fits?

  1. An IAM group
  2. The root user
  3. An IAM user with access keys
  4. An IAM role

Answer: D — An IAM role

A role is a set of permissions assumed temporarily by a service, an application, or a user from another account, with no long-term credentials.

22. A company with many AWS accounts wants its staff to sign in once and reach multiple accounts and applications, instead of creating IAM users in every account. Which service does AWS recommend?

  1. AWS KMS
  2. AWS CloudHSM
  3. AWS Secrets Manager
  4. AWS IAM Identity Center

Answer: D — AWS IAM Identity Center

IAM Identity Center provides single sign-on across multiple AWS accounts and applications and is recommended for human access instead of IAM users per account.

23. In a standalone account, which two tasks require the root user? (Choose two.)

  1. Changing contact information
  2. Updating alternate contacts
  3. Restoring IAM user permissions when the only IAM administrator has revoked their own
  4. Registering as a seller in the Reserved Instance Marketplace
  5. Changing the payment currency preference

Answer: C,D — Restoring IAM user permissions when the only IAM administrator has revoked their own / Registering as a seller in the Reserved Instance Marketplace

Reserved Instance Marketplace registration and restoring IAM permissions are root-only. Contact information, alternate contacts and payment currency do not require root credentials.

24. After a finding is raised by another service, an analyst needs to work out the root cause using log data that is collected automatically. Which service is built for this?

  1. Amazon Detective
  2. Amazon GuardDuty
  3. Amazon Inspector
  4. Amazon Macie

Answer: A — Amazon Detective

Detective does not find new problems; it investigates the root cause of findings the other services raised. GuardDuty raises findings rather than investigating them.

25. A security team wants a single place that consumes and prioritises findings from GuardDuty, Inspector, Macie and partner products. Which service fits?

  1. Amazon Detective
  2. AWS Artifact
  3. AWS Security Hub
  4. AWS Trusted Advisor

Answer: C — AWS Security Hub

Security Hub sits above the other services, consuming and prioritising their findings and checking the environment against security standards. Detective investigates root causes instead.

26. A security engineer wants to read AWS's published security guidance and articles. Which two sources does AWS provide for this? (Choose two.)

  1. AWS Artifact
  2. AWS Marketplace
  3. AWS Trusted Advisor
  4. AWS Security Blog
  5. AWS Knowledge Center

Answer: D,E — AWS Security Blog / AWS Knowledge Center

The Knowledge Center, Security Center and Security Blog are where AWS publishes security information. Marketplace offers third-party products, Trusted Advisor inspects your account, and Artifact provides compliance documents.

27. A team wants a service that inspects its account and flags issues, including security ones. Which service does this?

  1. Amazon Macie
  2. AWS Firewall Manager
  3. AWS Trusted Advisor
  4. AWS Shield

Answer: C — AWS Trusted Advisor

Trusted Advisor inspects the account and flags issues, including security ones. Shield provides DDoS protection and Firewall Manager manages firewall rules.

28. A developer wants a Python application to create and manage AWS resources from within its own code. Which access method fits?

  1. AWS Management Console
  2. AWS SDKs
  3. AWS CLI
  4. AWS CloudFormation

Answer: B — AWS SDKs

The AWS SDKs are libraries for languages such as Python, Java, Go and .NET, used for calling AWS from your own application. The CLI is for commands at a terminal, not for embedding in application code.

29. A regulator requires a company's data to remain within one country. What should the company do when deciding where to deploy?

  1. Choose the lowest-priced Region
  2. Choose an AWS Region located in that country
  3. Cache the data in edge locations in that country
  4. Spread the workload across multiple Availability Zones in any Region

Answer: B — Choose an AWS Region located in that country

Data sovereignty is a reason for choosing a Region: law requiring data stay in a country. Availability Zones add availability inside a Region, and edge locations only cache content close to users.

30. Which statement correctly describes how the AWS global infrastructure is organised?

  1. Edge locations are housed inside Availability Zones
  2. Each Availability Zone is exactly one data centre sharing a facility with the others
  3. An Availability Zone contains multiple Regions
  4. A Region contains multiple Availability Zones, each made of one or more data centres

Answer: D — A Region contains multiple Availability Zones, each made of one or more data centres

A Region is a location with multiple Availability Zones, and each zone is one or more data centres in separate facilities. Edge locations are separate and far more numerous.

31. A dev and test environment is quiet most of the time and occasionally busy. Which instance type fits, and how is its ability to exceed baseline CPU governed?

  1. Burstable performance instances; credits are earned while below baseline and spent while bursting
  2. Burstable performance instances; CPU runs continuously at the burst level, with no baseline
  3. Burstable performance instances; credits are earned while bursting and spent while below baseline
  4. Compute optimized instances; CPU credits are earned while below baseline and spent while bursting

Answer: A — Burstable performance instances; credits are earned while below baseline and spent while bursting

Burstable (T family) instances give a baseline CPU level with bursting governed by CPU credits earned below baseline and spent while bursting, which suits workloads quiet most of the time such as dev and test. Option B reverses how credits work, compute optimized is for CPU-heavy work, and option D contradicts the baseline.

32. A company needs guaranteed capacity in one specific Availability Zone for a launch event. Which option fits?

  1. Capacity Reservations
  2. Spot Instances
  3. Savings Plans
  4. Dedicated Instances

Answer: A — Capacity Reservations

Capacity Reservations reserve capacity in a specific Availability Zone. Spot capacity can be interrupted and Savings Plans only commit to spend, so neither guarantees capacity.

33. A developer wants code to run in response to events, billed only for the time it runs, with no servers and no containers to manage. Which service fits?

  1. Amazon ECS
  2. Amazon EKS
  3. AWS Fargate
  4. AWS Lambda

Answer: D — AWS Lambda

Lambda runs code without any server, is triggered by events and is billed for the time it runs. Fargate still runs containers, just without managing servers.

34. A developer wants to upload an application and have AWS handle the infrastructure configuration, while another team needs to run batch jobs. Which two services fit? (Choose two.)

  1. AWS Batch
  2. Amazon Lightsail
  3. AWS Outposts
  4. AWS Lambda
  5. AWS Elastic Beanstalk

Answer: A,E — AWS Batch / AWS Elastic Beanstalk

Elastic Beanstalk deploys and manages an application without you configuring the infrastructure, and AWS Batch runs batch jobs. Lightsail is a simplified bundle and Outposts puts AWS hardware in your own data centre.

35. Which two statements about a Multi-AZ instance deployment are correct? (Choose two.)

  1. Replication to the standby is asynchronous
  2. Its purpose is to improve read performance
  3. The standby serves read traffic
  4. The standby replica is in a different Availability Zone
  5. Replication to the standby is synchronous

Answer: D,E — The standby replica is in a different Availability Zone / Replication to the standby is synchronous

A Multi-AZ deployment provisions a standby in a different Availability Zone and replicates to it synchronously, for availability and failover. The standby does not serve reads, and it is not meant for performance.

36. A company moves a MySQL database to another MySQL database, and the source must remain usable during the move. What is needed?

  1. AWS Schema Conversion Tool alone
  2. A Multi-AZ deployment of the target
  3. AWS Schema Conversion Tool, then AWS Database Migration Service
  4. AWS Database Migration Service alone

Answer: D — AWS Database Migration Service alone

With the same engine on both sides no schema conversion is needed, so DMS alone moves the data and keeps the source usable. SCT is only required when the target engine differs.

37. A security engineer is configuring the firewall rules attached to a fleet of EC2 instances. Which two statements describe how security groups behave? (Choose two.)

  1. They support allow rules only.
  2. Return traffic for allowed requests is automatically permitted.
  3. They operate at the subnet level.
  4. They can include explicit deny rules.
  5. Their rules are evaluated in ascending order until the first match.

Answer: A,B — They support allow rules only. / Return traffic for allowed requests is automatically permitted.

Security groups are stateful, so return traffic is automatically allowed, and they contain allow rules only. Deny rules, subnet-level operation and ordered evaluation describe network ACLs or are not security group behaviour.

38. A subnet's network ACL has rule 100 allowing inbound HTTPS from a given CIDR range and rule 200 denying all inbound traffic from the same range. What happens to HTTPS traffic from that range?

  1. It is allowed, because rules are evaluated in ascending order until a match and rule 100 matches first.
  2. It is allowed, but only because return traffic is automatically permitted.
  3. It is denied, because all rules are evaluated before a decision is made.
  4. It is denied, because a deny rule always overrides an allow rule.

Answer: A — It is allowed, because rules are evaluated in ascending order until a match and rule 100 matches first.

Network ACLs evaluate rules in ascending order and stop at the first match, so rule 100 allows the traffic. Evaluating all rules before deciding is how security groups work.

39. An application keeps scratch data on instance store volumes. In which two situations will the data still be present afterwards? (Choose two.)

  1. A power failure occurs and the instance is then rebooted.
  2. The instance is stopped.
  3. The instance is hibernated.
  4. The instance is rebooted.
  5. The instance type is changed.

Answer: A,D — A power failure occurs and the instance is then rebooted. / The instance is rebooted.

Instance store data persists across a reboot and after a power failure upon reboot. Stop, hibernate and an instance type change all lose the data.

40. A company stores data whose access patterns are unknown and change over time, and it must not pay retrieval fees on any object. Which S3 storage class fits?

  1. S3 Intelligent-Tiering
  2. S3 One Zone-IA
  3. S3 Glacier Instant Retrieval
  4. S3 Standard-IA

Answer: A — S3 Intelligent-Tiering

Intelligent-Tiering is designed for unknown or changing access patterns and has no retrieval fees. Standard-IA, One Zone-IA and Glacier Instant Retrieval all charge per-GB retrieval fees.

41. Log files are used heavily during their first month, rarely over the following months, and must be deleted after seven years. The team wants the movement between storage classes to happen automatically. What should they use?

  1. S3 lifecycle policies
  2. AWS Backup
  3. S3 Express One Zone
  4. AWS Storage Gateway

Answer: A — S3 lifecycle policies

Lifecycle policies transition objects between classes as they age and can delete them later. AWS Backup centralises backups across services but does not age objects through storage classes.

42. A company wants employees to ask an AI assistant questions that are answered from the company's own content and internal systems. Which service fits?

  1. Amazon Q Developer
  2. Amazon Q Business
  3. Amazon Lex
  4. Amazon SageMaker AI

Answer: B — Amazon Q Business

Amazon Q Business is an assistant tailored to the business and connected to its own content and systems. Q Developer helps with building and operating applications on AWS.

43. An analyst wants to run ad hoc SQL queries directly against data stored in S3, without provisioning or managing any servers. Which service fits?

  1. Amazon Athena
  2. Amazon Redshift
  3. Amazon EMR
  4. Amazon Kinesis

Answer: A — Amazon Athena

Athena runs SQL queries directly on data in S3 with no server. Redshift is a data warehouse for large-scale analytics, and EMR runs big data frameworks such as Spark and Hadoop.

44. A team is comparing Amazon SQS and Amazon SNS. Which two statements are accurate? (Choose two.)

  1. SQS supports publisher-subscriber messaging.
  2. SNS routes events between applications by rule.
  3. SNS provides queues.
  4. SNS endpoints include email, SMS and mobile push.
  5. SQS messages are typically processed by a single subscriber.

Answer: D,E — SNS endpoints include email, SMS and mobile push. / SQS messages are typically processed by a single subscriber.

SQS messages are typically processed by one subscriber, and SNS supports endpoints such as email, SMS and mobile push. SNS has no queues, SQS does not do publisher-subscriber, and routing events by rule is EventBridge.

45. A company needs to coordinate several AWS services into a single workflow. Which service is designed for this?

  1. Amazon SNS
  2. Amazon SQS
  3. Amazon EventBridge
  4. AWS Step Functions

Answer: D — AWS Step Functions

Step Functions coordinates several services into a workflow. EventBridge routes events by rule, and SQS and SNS handle queuing and publish-subscribe messaging.

46. A company uploads large datasets to AWS from the internet. It also runs chatty services across several Availability Zones and Regions. Which two kinds of traffic are generally free of data transfer charges? (Choose two.)

  1. Traffic between resources inside one Availability Zone using private IP addresses
  2. Traffic between two Regions
  3. Traffic from the internet into AWS
  4. Traffic from AWS out to the internet
  5. Traffic between Availability Zones within a Region

Answer: A,C — Traffic between resources inside one Availability Zone using private IP addresses / Traffic from the internet into AWS

Inbound traffic and same-AZ traffic over private IPs are generally free. Outbound-to-internet, inter-Region and cross-AZ traffic are generally charged.

47. A finance manager wants to set a monthly spending limit for a project and be automatically alerted when spending crosses 80% of it. Which service meets this requirement?

  1. AWS Pricing Calculator
  2. AWS Cost Anomaly Detection
  3. AWS Budgets
  4. AWS Cost Explorer

Answer: C — AWS Budgets

Budgets lets you set custom cost and usage budgets and alerts you when spending crosses your thresholds. Cost Anomaly Detection alerts on unusual spend rather than on user-defined thresholds.

48. Several teams share one networking platform, and finance wants its cost divided among the teams using defined allocation rules in cost reporting. Which capability supports split-charge rules for shared costs?

  1. Cost categories
  2. AWS Budgets alerts
  3. Cost allocation tags
  4. The AWS Pricing Calculator

Answer: A — Cost categories

Cost categories map costs to teams, applications or environments and can define split-charge rules for shared costs. Cost allocation tags only break cost down by the tagged dimension.

49. A new AWS user wants to avoid surprise charges by seeing both current and forecast usage against the free tier allowances. Which resource does this?

  1. AWS Cost and Usage Reports
  2. The AWS Free Tier page
  3. AWS Cost Anomaly Detection
  4. AWS Pricing Calculator

Answer: B — The AWS Free Tier page

The Free Tier page monitors current and forecast free tier usage. Cost Anomaly Detection alerts on unusual spend, not on free tier consumption.

50. A company compares paid plans. Which two features are included with Enterprise Support? (Choose two.)

  1. Strategic business reviews
  2. A Domain Specialist Engineer alongside the TAM
  3. AWS Security Incident Response at no extra cost
  4. No access to the AWS Support API
  5. A response under 5 minutes from an Incident Management Engineer for business-critical cases

Answer: A,C — Strategic business reviews / AWS Security Incident Response at no extra cost

Enterprise Support adds Security Incident Response at no extra cost and strategic business reviews. The Domain Specialist Engineer and the 5-minute engineer response belong to Unified Operations, and the Support API is available on the paid plans.

51. A company wants AWS's own employees to give guidance on, and help deliver, a migration project. It does not want an independent partner. Which resource fits?

  1. AWS Marketplace
  2. AWS Professional Services
  3. AWS re:Post
  4. AWS Partner Network systems integrators

Answer: B — AWS Professional Services

AWS Professional Services and AWS solutions architects are AWS's own people for guidance and delivery. APN systems integrators are independent partners.

Take this test interactively

More AWS Cloud Practitioner practice tests