AWS Cloud Practitioner Practice Exam 3

49 questions with the correct answer and an explanation for each. Topic: CLF-C02. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A small company finds that a cloud provider's pay-as-you-go prices for hardware, power and bandwidth are lower than it could obtain by buying them itself. What best explains the lower prices?

  1. Customers commit to capacity before launch in exchange for a discount
  2. The provider aggregates the usage of hundreds of thousands of customers and buys at a scale no single organisation can match
  3. Customers' spending shifts from capital expenditure to operating expenditure
  4. The provider removes the need for customers to maintain data centres

Answer: B — The provider aggregates the usage of hundreds of thousands of customers and buys at a scale no single organisation can match

Aggregated usage gives the provider purchasing power that is passed on as lower prices. The other options are real cloud benefits but do not explain why the unit prices are lower.

2. A company compares running its own data centre with using the cloud. Which two outcomes reflect advantages of the cloud? (Choose two.)

  1. Racking, stacking and powering servers becomes the provider's work
  2. New resources are available in minutes rather than the weeks a hardware purchase takes
  3. Deployment is limited to a single Region
  4. Costs stay fixed regardless of consumption
  5. Capacity must be committed before launch to secure the lowest price

Answer: A,B — Racking, stacking and powering servers becomes the provider's work / New resources are available in minutes rather than the weeks a hardware purchase takes

Resources arrive in minutes and server upkeep moves to the provider. Committing capacity up front contradicts stop guessing capacity, fixed costs contradict pay-for-what-you-consume, and the cloud allows deployment in several Regions.

3. Which two statements correctly distinguish elasticity, high availability and agility? (Choose two.)

  1. High availability is about speed of change
  2. Agility is achieved by running across more than one isolated location
  3. Agility is organisational rather than technical
  4. Elasticity is about surviving failure
  5. Elasticity is about cost tracking demand

Answer: C,E — Agility is organisational rather than technical / Elasticity is about cost tracking demand

Elasticity is cost tracking demand and agility is organisational, the speed at which ideas can be tried and discarded. Surviving failure and running across isolated locations are high availability, and speed of change is agility.

4. A review asks whether the same outcome could be obtained at the lowest price. Which pillar does the question belong to?

  1. Operational excellence
  2. Cost optimization
  3. Performance efficiency
  4. Sustainability

Answer: B — Cost optimization

Getting the outcome at the lowest price is the cost optimization question. Performance efficiency asks whether the resources are the right ones.

5. A working group must ensure the confidentiality, integrity and availability of data and workloads moving to the cloud, including encryption of stored data. Which AWS CAF perspective owns this?

  1. Platform
  2. Operations
  3. Security
  4. Governance

Answer: C — Security

Confidentiality, integrity and availability of data and workloads belong to the Security perspective. Operations concerns delivering services at the level the business needs.

6. An organisation needs to orchestrate its cloud initiatives so benefits are maximised and transformation risk is minimised, and also to deliver cloud services at the level the business needs. Which two AWS CAF perspectives apply? (Choose two.)

  1. Business
  2. Security
  3. Operations
  4. Governance
  5. Platform

Answer: C,D — Operations / Governance

Orchestrating initiatives for benefits and risk is Governance, and delivering services at the required level is Operations. Platform builds the platform, Security protects data, and Business ensures investment advances outcomes.

7. Rather than moving a traditionally licensed product to the cloud, a company switches to a different product delivered as a subscription service. Which migration strategy is this?

  1. Replatform
  2. Retire
  3. Repurchase
  4. Rehost

Answer: C — Repurchase

Repurchase means switching to a different product, typically replacing a traditional licence with a SaaS subscription. Replatform still moves the same application.

8. A company wants to move two workloads to the cloud without changing them. Which two strategies move things unchanged? (Choose two.)

  1. Replatform
  2. Repurchase
  3. Refactor
  4. Rehost
  5. Relocate

Answer: D,E — Rehost / Relocate

Rehost and relocate both move things unchanged. Replatform optimises along the way, refactor rebuilds the architecture, and repurchase switches to a different product.

9. Before moving anything, an organisation wants to inventory its on-premises estate so it knows what it actually has. Which service does this?

  1. AWS Application Discovery Service
  2. AWS Migration Hub
  3. AWS Application Migration Service
  4. Migration Evaluator

Answer: A — AWS Application Discovery Service

Application Discovery Service inventories the on-premises estate before the move. Migration Hub only tracks a migration already in progress.

10. A team wants to track a migration in progress from a single place and also lift its servers into AWS. Which two services fit? (Choose two.)

  1. AWS Schema Conversion Tool
  2. AWS Migration Hub
  3. AWS Application Migration Service
  4. Migration Evaluator
  5. AWS Application Discovery Service

Answer: B,C — AWS Migration Hub / AWS Application Migration Service

Migration Hub tracks the work and Application Migration Service lifts servers. Discovery inventories, Evaluator prices, and the Schema Conversion Tool converts database schemas.

11. A team wants a service that analyses usage and recommends a better-fitting instance size, and another that tracks licence usage against the terms it holds. Which two services fit? (Choose two.)

  1. Migration Evaluator
  2. AWS License Manager
  3. AWS Compute Optimizer
  4. AWS Application Discovery Service
  5. AWS Well-Architected Tool

Answer: B,C — AWS License Manager / AWS Compute Optimizer

Compute Optimizer recommends rightsizing from usage analysis and License Manager tracks licence usage against held terms. The Well-Architected Tool reviews against pillars, Evaluator estimates cost on AWS, and Discovery inventories the estate.

12. A team needs to explain the difference between the Well-Architected Framework and the Well-Architected Tool. Which two statements are correct? (Choose two.)

  1. The Framework consists of five pillars
  2. The Framework is the ideas
  3. The Tool reviews a workload against the pillars and reports where it falls short
  4. The Tool is the set of design principles
  5. The Framework is a service you run

Answer: B,C — The Framework is the ideas / The Tool reviews a workload against the pillars and reports where it falls short

The Framework is the set of design principles and the Tool is the service that reviews a workload against the pillars. The Framework has six pillars, including sustainability.

13. Which two tasks does AWS perform as part of security of the cloud? (Choose two.)

  1. Configuring the firewall on a customer's EC2 instance
  2. Granting IAM permissions to a customer's developers
  3. Classifying the data stored in a customer's account
  4. Replacing failed disks in AWS data centres
  5. Patching the hypervisor that runs customer workloads

Answer: D,E — Replacing failed disks in AWS data centres / Patching the hypervisor that runs customer workloads

Hardware, software, networking and facilities are AWS's side: you never patch a hypervisor or replace a failed disk. Data classification, IAM permissions and instance firewall configuration belong to the customer.

14. AWS patches the infrastructure while the customer patches its own guest operating systems. What is this kind of control called?

  1. Abstracted control
  2. Inherited control
  3. Shared control
  4. Customer-specific control

Answer: C — Shared control

Shared controls are those where both parties do their part at their own layer, and patch management is the standard example. Inherited controls would leave nothing for the customer to do.

15. A company stores data in Amazon DynamoDB. Which two things does AWS operate for this abstracted service? (Choose two.)

  1. The platform
  2. The operating system
  3. The company's choices about encrypting its data
  4. The classification of the company's data
  5. The permissions on the company's tables

Answer: A,B — The platform / The operating system

For abstracted services such as S3 and DynamoDB, AWS operates the infrastructure, the operating system and the platform. The customer manages its data and its permissions.

16. A company's data is encrypted on disk, but a review finds it crosses the network between clients and the application in readable form. Which protection is missing?

  1. A least-privilege IAM policy
  2. Encryption in transit, typically using TLS
  3. A dedicated single-tenant hardware security module
  4. Encryption at rest

Answer: B — Encryption in transit, typically using TLS

Encryption in transit protects data while it moves across a network, typically with TLS. The data is already encrypted at rest, so the gap is in movement.

17. An S3 bucket was unexpectedly deleted, and the team must determine which user made the call that deleted it. Which service answers this?

  1. AWS CloudTrail
  2. Amazon CloudWatch
  3. AWS Config
  4. Amazon Inspector

Answer: A — AWS CloudTrail

CloudTrail records API calls and account activity, so it answers who did what. CloudWatch covers performance metrics and logs, and Config covers how resources are set up.

18. A new administrator signs in every day with the identity created along with the AWS account, which is identified by the account's email address and has complete access. What is the guidance for this identity?

  1. It should not be used for daily work
  2. It should be shared among all administrators of the account
  3. It may be used daily as long as MFA is enabled
  4. It is the recommended identity for everyday administration

Answer: A — It should not be used for daily work

The root user has complete access to everything, and AWS's guidance is not to use it for daily work. MFA does not change that guidance.

19. In a standalone account, which two tasks require root user credentials? (Choose two.)

  1. Configuring an S3 bucket to enable MFA Delete
  2. Updating alternate contacts
  3. Activating IAM access to the Billing and Cost Management console
  4. Changing the payment currency preference
  5. Changing the account name

Answer: A,C — Configuring an S3 bucket to enable MFA Delete / Activating IAM access to the Billing and Cost Management console

Billing console IAM access and S3 MFA Delete are root-only tasks. Account name, alternate contacts and payment currency do not require root credentials.

20. A company creates new accounts within AWS Organizations. What root user credentials do these accounts have by default?

  1. A set of root access keys
  2. A root MFA device enforced at creation
  3. A root password emailed at creation
  4. None; they cannot sign in as root unless account recovery is enabled

Answer: D — None; they cannot sign in as root unless account recovery is enabled

New accounts created in an organization have no root user credentials by default, and cannot sign in as root or recover the password unless account recovery is enabled.

21. A team writes its own reusable permission documents and wants to keep maintaining them itself. Which type of policy is this?

  1. Customer managed policy
  2. AWS managed policy
  3. Service control list
  4. Root user policy

Answer: A — Customer managed policy

Reusable policies written and maintained by the customer are customer managed policies, which the exam guide calls custom policies. AWS managed policies are maintained by AWS.

22. Employees authenticate with the company's existing identity provider and receive no AWS credentials of their own. What is this arrangement called?

  1. Customer managed policy
  2. IAM user with access keys
  3. Root user access
  4. Federated identity

Answer: D — Federated identity

Federated identity means users authenticate with an existing identity provider rather than getting AWS credentials of their own.

23. A security team wants to detect cryptomining activity and compromised credentials without scheduling any scans. Which service fits?

  1. Amazon Macie
  2. Amazon Detective
  3. Amazon GuardDuty
  4. Amazon Inspector

Answer: C — Amazon GuardDuty

GuardDuty finds threats such as compromised credentials, cryptomining, malware and data exfiltration, and runs continuously. Inspector looks for vulnerabilities, not intruders.

24. Which set of data sources does Amazon GuardDuty analyze to find threats?

  1. Objects in S3 and container images in ECR
  2. CloudTrail management events, VPC flow logs and DNS logs
  3. EC2 instances and Lambda functions
  4. Resource configuration history and Config rules

Answer: B — CloudTrail management events, VPC flow logs and DNS logs

GuardDuty looks at CloudTrail management events, VPC flow logs and DNS logs. EC2, ECR and Lambda are examined by Inspector, and S3 objects by Macie.

25. A team wants to find unintended network exposure on its EC2 instances. Which service looks for this?

  1. Amazon GuardDuty
  2. Amazon Detective
  3. Amazon Inspector
  4. Amazon Macie

Answer: C — Amazon Inspector

Inspector finds software vulnerabilities and unintended network exposure on EC2 instances, container images and Lambda functions. GuardDuty watches for malicious activity.

26. Which two statements correctly describe Amazon Detective and AWS Security Hub? (Choose two.)

  1. Security Hub scans S3 objects for PII
  2. Security Hub investigates root causes of findings from log data
  3. Detective investigates the root cause of findings raised by other services
  4. Detective discovers new vulnerabilities on EC2 instances
  5. Security Hub consumes and prioritises findings from GuardDuty, Inspector and Macie

Answer: C,E — Detective investigates the root cause of findings raised by other services / Security Hub consumes and prioritises findings from GuardDuty, Inspector and Macie

Detective investigates findings rather than raising new ones, and Security Hub aggregates and prioritises findings. Vulnerability discovery is Inspector and PII discovery is Macie.

27. A company wants to filter incoming web application traffic using rules that it sets. Which service fits?

  1. Amazon GuardDuty
  2. AWS Shield
  3. AWS Firewall Manager
  4. AWS WAF

Answer: D — AWS WAF

AWS WAF is a web application firewall that filters traffic by rules you set. Shield provides DDoS protection and Firewall Manager only manages rules centrally across accounts.

28. A company wants cloud resources connected to infrastructure it still runs itself, and wants AWS infrastructure physically placed in its own data centre. Which two terms describe this? (Choose two.)

  1. Cloud deployment model
  2. Amazon Lightsail
  3. On-premises deployment model
  4. Hybrid deployment model
  5. AWS Outposts

Answer: D,E — Hybrid deployment model / AWS Outposts

Hybrid connects cloud resources to infrastructure you still run, and AWS Outposts places AWS infrastructure in your own data centre. The cloud model runs everything in the cloud, on-premises is only your own facilities, and Lightsail is a simplified bundle for straightforward workloads.

29. An application must stay highly available through the loss of a single data centre, and all its data must remain in one Region. What is the appropriate design?

  1. Run the application across multiple Availability Zones
  2. Deploy the application in two or more Regions
  3. Add more edge locations
  4. Use a larger instance in a single Availability Zone

Answer: A — Run the application across multiple Availability Zones

Availability Zones are in separate facilities and do not share single points of failure, so running across several gives high availability inside one Region. Multiple Regions serve disaster recovery, latency and sovereignty, and edge locations only cache content.

30. Which two characteristics of Availability Zones support high availability? (Choose two.)

  1. They are housed in separate facilities and share no single points of failure
  2. Each zone consists of exactly one data centre
  3. Each has its own redundant power, networking and connectivity
  4. Each zone is located in a different Region
  5. All zones in a Region share one network path

Answer: A,C — They are housed in separate facilities and share no single points of failure / Each has its own redundant power, networking and connectivity

Availability Zones have redundant power, networking and connectivity in separate facilities, so they do not share single points of failure. A zone can be more than one data centre, and zones sit inside a Region rather than in different Regions.

31. A company expects to spend a steady amount in USD per hour for three years, but it cannot commit to an instance type or Region. Which purchasing option fits?

  1. Reserved Instances
  2. Dedicated Hosts
  3. Savings Plans
  4. Capacity Reservations

Answer: C — Savings Plans

Savings Plans commit to a consistent amount of usage in USD per hour rather than to a configuration. Reserved Instances commit to a specific instance type and Region.

32. Which two statements about EC2 purchasing commitments are correct? (Choose two.)

  1. Reserved Instances commit to a consistent instance configuration of type and Region
  2. Reserved Instances commit to a consistent amount of spend in USD per hour
  3. Spot Instances require a one- or three-year commitment
  4. Savings Plans commit to a consistent amount of usage in USD per hour
  5. Savings Plans commit to a specific instance type and Region

Answer: A,D — Reserved Instances commit to a consistent instance configuration of type and Region / Savings Plans commit to a consistent amount of usage in USD per hour

Savings Plans commit to money per hour, while Reserved Instances commit to a configuration. Spot requires no commitment, only acceptance that capacity can be interrupted.

33. A team that already uses Kubernetes wants a managed Kubernetes service and also needs a place to store its container images. Which two services meet these needs? (Choose two.)

  1. AWS Fargate
  2. Amazon EKS
  3. Amazon ECS
  4. Amazon ECR
  5. AWS Lambda

Answer: B,D — Amazon EKS / Amazon ECR

EKS is managed Kubernetes and ECR is the registry where container images are stored. ECS is AWS's own orchestration rather than Kubernetes, and Fargate is serverless compute, not an image registry.

34. A company runs its database on an Amazon EC2 instance. Which of the following remains AWS's responsibility rather than the company's?

  1. Database backups
  2. High availability
  3. Hardware lifecycle
  4. Operating system patching

Answer: C — Hardware lifecycle

On EC2, AWS handles the hardware, including its lifecycle, while the customer handles the operating system and everything above it. OS patching, backups and high availability stay with the customer on EC2.

35. A company wants to store and query the relationships between accounts in order to detect fraud rings. Which database service fits best?

  1. Amazon Aurora
  2. Amazon Neptune
  3. Amazon DynamoDB
  4. Amazon DocumentDB

Answer: B — Amazon Neptune

Neptune is the graph database, for relationships such as social networks and fraud rings. DynamoDB is key-value and document, and DocumentDB is MongoDB-compatible.

36. Application servers in a private subnet must download software updates from the internet, but they must not be reachable from the internet. What should be added to the VPC?

  1. AWS Transit Gateway
  2. An internet gateway
  3. AWS PrivateLink
  4. A NAT gateway

Answer: D — A NAT gateway

A NAT gateway lets instances in a private subnet reach out without being reachable. An internet gateway simply connects the VPC to the internet and does not provide that outbound-only behaviour.

37. A company wants to register a domain name and route users to its application, and also to deliver content to users worldwide from edge locations. Which two services meet these needs? (Choose two.)

  1. AWS Transit Gateway
  2. Amazon Route 53
  3. Amazon CloudFront
  4. AWS PrivateLink
  5. AWS Direct Connect

Answer: B,C — Amazon Route 53 / Amazon CloudFront

Route 53 provides DNS and domain registration, and CloudFront is a content delivery network using edge locations. Direct Connect, PrivateLink and Transit Gateway are connectivity services, not DNS or content delivery.

38. An operations team realises that a running EC2 instance needs additional instance store capacity for temporary files. What is true about adding it?

  1. The volume can be attached after the instance is hibernated.
  2. The volume can be attached after the instance is stopped.
  3. The volume can be attached at any time while the instance is running.
  4. Instance store volumes can only be attached at launch, so they cannot be added to the existing instance later.

Answer: D — Instance store volumes can only be attached at launch, so they cannot be added to the existing instance later.

Instance store volumes are attached only at launch and cannot be added afterwards. Stopping or hibernating the instance does not change this, and it also erases the existing data.

39. A team stores millions of 64 KB objects in S3 Intelligent-Tiering, and many are almost never read. How are these objects handled?

  1. They are never moved out of the Frequent Access tier.
  2. They are stored in a single Availability Zone.
  3. They are moved to S3 Glacier Deep Archive after 180 days.
  4. They are charged a retrieval fee each time they are read.

Answer: A — They are never moved out of the Frequent Access tier.

Objects under 128 KB are never moved out of the Frequent Access tier. Intelligent-Tiering has no retrieval fees and uses at least three Availability Zones.

40. On-premises applications must read and write data that is held in AWS, using local cached access. Which service is the hybrid answer?

  1. AWS Direct Connect
  2. Amazon EFS
  3. AWS Backup
  4. AWS Storage Gateway

Answer: D — AWS Storage Gateway

Storage Gateway gives on-premises applications cached access to cloud storage. AWS Backup only centralises backups across services.

41. A development team wants a generative AI assistant inside their IDE that gives code assistance and helps them understand and operate their workloads on AWS. Which service fits?

  1. AWS Glue
  2. Amazon Q Developer
  3. Amazon Q Business
  4. Amazon Comprehend

Answer: B — Amazon Q Developer

Q Developer helps you understand, build, extend and operate applications and workloads on AWS, including code assistance in an IDE. Q Business is aimed at the company's own content and systems.

42. An analytics team needs to transform data and keep a catalogue of it, and also publish dashboards for business users. Which two services should it use? (Choose two.)

  1. Amazon QuickSight
  2. Amazon Kinesis
  3. Amazon Redshift
  4. AWS Glue
  5. Amazon OpenSearch Service

Answer: A,D — Amazon QuickSight / AWS Glue

Glue handles extract, transform, load and the data catalogue, and QuickSight provides dashboards and business intelligence. Kinesis is for streaming data, OpenSearch for search and log analytics, and Redshift is a data warehouse.

43. A company wants events from AWS services and its own applications routed to different targets according to matching rules. Which service fits?

  1. Amazon EventBridge
  2. AWS Step Functions
  3. Amazon SNS
  4. Amazon SQS

Answer: A — Amazon EventBridge

EventBridge is an event bus that routes events between AWS services and applications by rule. Step Functions coordinates several services into a workflow rather than routing events.

44. A company must keep compliance records for years and almost never reads them. It wants the lowest cost to hold the data and can accept slow, more expensive reads when they are needed. Which storage class fits?

  1. S3 Glacier Instant Retrieval
  2. S3 Glacier Deep Archive
  3. S3 Standard-IA
  4. S3 Standard

Answer: B — S3 Glacier Deep Archive

Glacier Deep Archive is the cheapest to hold, at the price of the slowest and most expensive reads. S3 Standard has no retrieval fee but costs more to hold.

45. A finance team wants to filter and group last quarter's spend by service to see what drove an increase, using visuals. It also wants the most detailed line-item cost data exported for its own analysis. Which two tools meet these needs? (Choose two.)

  1. AWS Cost Explorer
  2. AWS Cost Optimization Hub
  3. AWS Pricing Calculator
  4. AWS Budgets
  5. AWS Cost and Usage Reports / data exports

Answer: A,E — AWS Cost Explorer / AWS Cost and Usage Reports / data exports

Cost Explorer analyses past cost and usage with visuals, filtering and grouping. Cost and Usage Reports / data exports provide the most detailed line-item data. Budgets and the Pricing Calculator do neither of these jobs.

46. A company's accounts are in an AWS Organization. Which two statements describe consolidated billing? (Choose two.)

  1. Reserved Instance and Savings Plans discounts are shared across the accounts.
  2. Each member account is charged a small monthly fee for being consolidated.
  3. Each member account pays its own charges directly to AWS.
  4. Cost data is deleted when a member account leaves.
  5. Usage is combined across accounts so volume pricing discounts are shared.

Answer: A,E — Reserved Instance and Savings Plans discounts are shared across the accounts. / Usage is combined across accounts so volume pricing discounts are shared.

Combined usage shares volume discounts, Reserved Instance discounts and Savings Plans. Consolidated billing costs nothing extra, the management account pays all charges, and data from a departed account is kept rather than deleted.

47. An account has only the Basic support plan. Its owner has a question about an unexpected charge and a separate question about how to design a new workload. What can Basic support do?

  1. Answer neither, because one-on-one responses need a paid plan.
  2. Answer the billing question one-on-one, but it does not include technical support on how to build things.
  3. Answer only the design question, because billing questions need a paid plan.
  4. Answer both questions one-on-one, around the clock.

Answer: B — Answer the billing question one-on-one, but it does not include technical support on how to build things.

Every account gets 24x7 one-on-one responses to account and billing questions. Basic does not include technical support for how to build things.

48. A team wants to see whether an AWS service event is affecting its resources. It also wants recommendations on whether its own account configuration follows best practice for security and fault tolerance. Which two services does it need? (Choose two.)

  1. AWS Cost Explorer
  2. AWS Pricing Calculator
  3. AWS Budgets
  4. AWS Trusted Advisor
  5. AWS Health Dashboard

Answer: D,E — AWS Trusted Advisor / AWS Health Dashboard

Health Dashboard shows AWS's status as it affects you, and Trusted Advisor inspects your own configuration. The cost tools do neither.

49. A company wants to buy third-party software that runs on AWS. It wants cost management, governance and entitlement handled through its AWS bill. Which option fits?

  1. AWS Prescriptive Guidance
  2. AWS Partner Network
  3. AWS Professional Services
  4. AWS Marketplace

Answer: D — AWS Marketplace

AWS Marketplace is where you buy third-party software, with cost management, governance and entitlement handled through your AWS bill. The Partner Network is a program for vendors and integrators, not a purchasing channel.

Take this test interactively

More AWS Cloud Practitioner practice tests