AWS Cloud Practitioner Practice Exam 4

49 questions with the correct answer and an explanation for each. Topic: CLF-C02. Free, no account needed.

These questions are written from AWS’s published exam guide and service documentation. They are not real exam questions — nobody who has sat the exam may reproduce those, and any site offering them is putting your certification at risk.

Take this test interactively

1. A team now runs far more experiments than it used to, because new resources are ready in minutes rather than weeks and trying an idea costs little. Which cloud advantage does this describe?

  1. Stop guessing capacity
  2. Increase speed and agility
  3. Benefit from massive economies of scale
  4. Go global in minutes

Answer: B — Increase speed and agility

Fast, cheap access to resources makes an organisation willing to try more things, which is the speed and agility advantage. Stop guessing capacity is about sizing infrastructure, not experimentation.

2. An online retailer's load peaks twice a year. It wants to pay for roughly what it uses rather than for a peak that rarely occurs. Which property does it need?

  1. High availability
  2. Elasticity
  3. Economies of scale
  4. Agility

Answer: B — Elasticity

Elasticity is capacity following demand, added when load rises and removed when it falls. High availability concerns surviving failure, not cost tracking demand.

3. During a design review, a team asks whether it can run and monitor the workload and keep improving how it does so. Which pillar of the Well-Architected Framework is being examined?

  1. Reliability
  2. Security
  3. Performance efficiency
  4. Operational excellence

Answer: D — Operational excellence

Running, monitoring and continually improving how the workload is operated is the question operational excellence answers. Reliability asks about recovering from failure and meeting demand.

4. Months after launch, a team checks whether the resource types it chose are still the right ones as its requirements change. Which pillar does this check serve?

  1. Reliability
  2. Operational excellence
  3. Performance efficiency
  4. Cost optimization

Answer: C — Performance efficiency

Using the right resources, and still the right ones as things change, is the performance efficiency question. Cost optimization is about the lowest price for the outcome.

5. Executives ask whether the organisation's cloud investment is actually advancing its business outcomes. Which AWS CAF perspective does this question belong to?

  1. Governance
  2. Operations
  3. Business
  4. People

Answer: C — Business

Making sure cloud investment advances business outcomes is the Business perspective. Governance is about orchestrating initiatives to maximise benefits and minimise transformation risk.

6. A company rehosts an application that already suffers from a platform problem on premises. What is the most likely result?

  1. The cloud's capabilities remove the problem during the move
  2. The problem is carried across to the cloud unchanged
  3. The move cannot proceed until the problem is fixed
  4. The migration delivers the greatest long-term benefit

Answer: B — The problem is carried across to the cloud unchanged

Rehosting moves the application without changing it, so a pre-existing platform problem comes along. Rehosting gains the least, so it cannot be the greatest long-term benefit.

7. A company wants to rebuild an application's architecture around cloud-native features for agility, performance and scalability, and accepts the greatest cost in skills and time. Which migration strategy fits?

  1. Rehost
  2. Replatform
  3. Relocate
  4. Refactor

Answer: D — Refactor

Refactor rebuilds the architecture around cloud-native features and delivers the most while costing the most. Replatform only makes a limited optimisation.

8. A team compares refactoring with rehosting for an application. Which two statements are true of refactoring? (Choose two.)

  1. It needs advanced skills and takes the longest
  2. It is the least disruptive approach
  3. It is the fastest approach
  4. It is the most cost-effective approach in the end
  5. It gains the least

Answer: A,D — It needs advanced skills and takes the longest / It is the most cost-effective approach in the end

Refactoring is most cost-effective in the end but needs advanced skills and takes longest. Fastest, least disruptive and least gain describe rehosting.

9. A company needs a business case for migrating and wants an estimate of what running its estate on AWS would cost. Which service fits?

  1. Migration Evaluator
  2. AWS Migration Hub
  3. AWS Compute Optimizer
  4. AWS Application Discovery Service

Answer: A — Migration Evaluator

Migration Evaluator builds the business case by estimating the cost of running the estate on AWS. Discovery only finds what exists and does not price it.

10. A workload settles into using about half the capacity of the instance chosen at launch. Which action is the most common single source of cloud savings in this situation?

  1. Deploying in additional Regions
  2. Automating provisioning
  3. Rightsizing the instance to fit the workload
  4. Bringing existing licences

Answer: C — Rightsizing the instance to fit the workload

Rightsizing matches the resource to the actual workload and is the most common single source of savings, because launch capacity rarely matches where the workload settles. Automation saves time and mistakes rather than oversized capacity.

11. A business case for staying on premises counts only the hardware purchase price. Which two additional costs should it include? (Choose two.)

  1. The staff who maintain the environment
  2. Capacity changes made within minutes
  3. Lower prices from aggregated purchasing across many customers
  4. Charges that track actual consumption
  5. Spare capacity held for growth

Answer: A,E — The staff who maintain the environment / Spare capacity held for growth

Maintenance staff and spare capacity held for growth are on-premises costs beyond hardware. Consumption-tracking charges, aggregated purchasing prices and capacity changes within minutes are cloud characteristics.

12. A comparison of running a data centre against using the cloud lists only servers. Which two cost categories are missing from the on-premises side? (Choose two.)

  1. Physical security for the facility
  2. Network connectivity
  3. Charges incurred only when resources are consumed
  4. Capacity that can be decreased within minutes
  5. Savings that reach customers as lower pay-as-you-go prices

Answer: A,B — Physical security for the facility / Network connectivity

Physical security and network connectivity are on-premises costs beyond the servers. Pay-as-you-go savings, consumption-only charges and rapid capacity changes are cloud characteristics.

13. A company runs a web server on Amazon EC2. Which two items remain the company's responsibility? (Choose two.)

  1. Replacing failed disks in the host
  2. Software installed on the instance
  3. Physical security of the facility housing the host
  4. Patching the hypervisor beneath the instance
  5. The firewall configuration

Answer: B,E — Software installed on the instance / The firewall configuration

For EC2 the customer looks after the guest OS, any installed software and the firewall configuration. Facilities, hypervisor and disks are AWS's infrastructure responsibility.

14. A company has a security obligation that arises purely from the application it runs, not from anything AWS provides. Under the shared responsibility model, which category does this control fall into?

  1. Shared control
  2. Managed control
  3. Customer-specific control
  4. Inherited control

Answer: C — Customer-specific control

Customer-specific controls are entirely the customer's and arise from what is being run rather than from AWS. Inherited and shared controls both involve AWS.

15. An auditor asks a company for AWS's SOC and ISO reports. The company wants to download them on demand at no cost. Where should it get them?

  1. AWS Security Hub
  2. AWS Config
  3. AWS Artifact
  4. AWS Trusted Advisor

Answer: C — AWS Artifact

AWS Artifact provides on-demand downloads of AWS security and compliance documents such as ISO, PCI and SOC reports, and is free of charge. Config, Trusted Advisor and Security Hub do not host these reports.

16. A regulator requires that objects sitting in a storage bucket be encrypted where they are stored. Which state of encryption does this describe?

  1. Encryption of the network connection between the application and the bucket
  2. Encryption at rest
  3. Encryption applied while the objects move across the network to clients
  4. Encryption in transit using TLS

Answer: B — Encryption at rest

Encryption at rest means data is encrypted where it is stored, on a disk or in a bucket. The other options all describe encryption in transit, which covers data while it moves across a network.

17. A company must confirm that every bucket has encryption switched on, and wants to see how resource configurations have changed over time. Which service fits?

  1. AWS CloudTrail
  2. Amazon Macie
  3. Amazon CloudWatch
  4. AWS Config

Answer: D — AWS Config

Config records resource configuration over time and assesses it against rules. CloudTrail records who made API calls, not how things are configured.

18. A security lead asks how multi-factor authentication applies to root users. Which statement is correct?

  1. It is not available for root users
  2. It is enforced by default, though you add it during account creation or when prompted at sign-in
  3. It is optional and never prompted for root users
  4. It is required only for IAM users, not for the root user

Answer: B — It is enforced by default, though you add it during account creation or when prompted at sign-in

MFA is enforced for root users by default, but it requires you to add it during account creation or when prompted at sign-in.

19. In a standalone account, which two changes can be made without root user credentials? (Choose two.)

  1. Changing the account name
  2. Updating alternate contacts
  3. Changing the root user access keys
  4. Changing the account email address
  5. Changing the root user password

Answer: A,B — Changing the account name / Updating alternate contacts

Account name, contact information, alternate contacts, payment currency and Regions do not need root credentials. The email address, root password and root access keys do.

20. Which two privileged tasks can the management account or a delegated administrator perform centrally for member accounts in an organization? (Choose two.)

  1. Generating root access keys for each new member account
  2. Closing member accounts
  3. Enforcing a root MFA device on each new member account
  4. Updating root email addresses and account names
  5. Signing in as root to a member account with a default password

Answer: B,D — Closing member accounts / Updating root email addresses and account names

The management account or delegated administrator closes member accounts and updates root email addresses, account names, contact information and Regions. Member accounts have no root credentials by default, including passwords, keys and MFA.

21. Which two statements about IAM policies are correct? (Choose two.)

  1. Inline policies are reusable across all groups
  2. AWS managed policies are maintained by AWS
  3. Inline policies are attached directly to a single identity
  4. Customer managed policies are maintained by AWS
  5. AWS managed policies are maintained by the customer

Answer: B,C — AWS managed policies are maintained by AWS / Inline policies are attached directly to a single identity

AWS-managed policies are maintained by AWS, while inline policies are attached directly to a single identity. Customer managed policies are maintained by the customer, and managed policies, not inline ones, are the reusable kind.

22. A team must keep application credentials out of source code. Which two services can store them? (Choose two.)

  1. AWS Artifact
  2. AWS KMS
  3. AWS Secrets Manager
  4. AWS Systems Manager
  5. AWS CloudTrail

Answer: C,D — AWS Secrets Manager / AWS Systems Manager

Secrets Manager and Systems Manager store application credentials so they never end up in source code. KMS creates and controls keys, CloudTrail records API calls, and Artifact provides compliance documents.

23. A company wants to find software vulnerabilities (CVEs) in the container images it stores in Amazon ECR. Which service fits?

  1. Amazon Macie
  2. Amazon Inspector
  3. Amazon Detective
  4. Amazon GuardDuty

Answer: B — Amazon Inspector

Inspector examines EC2 instances, container images in ECR and Lambda functions for software vulnerabilities. GuardDuty looks for threats rather than CVEs.

24. Which two resource types does Amazon Inspector examine for software vulnerabilities? (Choose two.)

  1. Objects in Amazon S3
  2. Lambda functions
  3. VPC flow logs
  4. EC2 instances
  5. DNS logs

Answer: B,D — Lambda functions / EC2 instances

Inspector looks at EC2 instances, container images in ECR and Lambda functions. S3 objects are Macie's domain, and flow and DNS logs are GuardDuty's sources.

25. A company wants to know which of its S3 buckets are publicly accessible. Which service reports this?

  1. Amazon GuardDuty
  2. Amazon Macie
  3. Amazon Inspector
  4. Amazon Detective

Answer: B — Amazon Macie

Macie looks at S3 and finds buckets that are publicly accessible as well as sensitive data. Inspector examines compute resources, not S3 buckets.

26. A company must find PII in its S3 buckets and also find software vulnerabilities on its EC2 instances. Which two services together meet this? (Choose two.)

  1. AWS Artifact
  2. Amazon Detective
  3. Amazon GuardDuty
  4. Amazon Macie
  5. Amazon Inspector

Answer: D,E — Amazon Macie / Amazon Inspector

Macie finds sensitive data such as PII in S3, and Inspector finds software vulnerabilities on EC2. GuardDuty looks for threats and Detective investigates findings.

27. A company wants to buy a third-party security product and receive it through AWS. Where should it look?

  1. AWS Artifact
  2. AWS Marketplace
  3. AWS Trusted Advisor
  4. AWS Security Hub

Answer: B — AWS Marketplace

Third-party security products are available through AWS Marketplace. Trusted Advisor inspects accounts and Artifact provides compliance documents.

28. An administrator needs to perform a one-off task and wants to see which resources currently exist, without writing commands or code. Which method fits?

  1. AWS Management Console
  2. AWS CloudFormation
  3. AWS SDKs
  4. AWS CLI

Answer: A — AWS Management Console

The Management Console is a browser interface suited to exploring, one-off tasks and seeing what exists. The CLI and SDKs require commands or code, and CloudFormation is for repeatable builds.

29. A company serves users in Europe and Asia from a single Region. Which two benefits does deploying across multiple Regions provide? (Choose two.)

  1. Separate power and networking for each data centre
  2. Cached content served from edge locations
  3. Lower latency for distant users
  4. High availability inside one Region
  5. Disaster recovery

Answer: C,E — Lower latency for distant users / Disaster recovery

Multiple Regions give disaster recovery, lower latency for distant users and data sovereignty. High availability inside one Region comes from multiple Availability Zones, and edge locations are a separate caching layer.

30. A workload keeps a very large dataset held in memory for fast processing. Which EC2 instance family fits best?

  1. General purpose
  2. Storage optimized
  3. Compute optimized
  4. Memory optimized

Answer: D — Memory optimized

Memory optimized instances are for large datasets held in memory. Compute optimized targets CPU-heavy work and storage optimized targets disk throughput and IOPS.

31. A batch job can run at any time and can be interrupted and restarted without affecting results. The company wants the lowest cost and no commitment. Which option fits?

  1. On-Demand Instances
  2. Spot Instances
  3. Savings Plans
  4. Reserved Instances

Answer: B — Spot Instances

Spot Instances use unused capacity that can be interrupted, need no commitment and are significantly cheaper, which suits work that is flexible about when it runs and tolerates interruption. Savings Plans and Reserved Instances require 1- or 3-year commitments.

32. A company has compliance requirements and wants EC2 capacity on hardware dedicated to it. Which two options fit? (Choose two.)

  1. Savings Plans
  2. Dedicated Hosts
  3. Dedicated Instances
  4. Spot Instances
  5. Capacity Reservations

Answer: B,C — Dedicated Hosts / Dedicated Instances

Compliance requirements point to Dedicated Hosts or Dedicated Instances. Spot is unused capacity that can be interrupted, and Savings Plans only commit to spend.

33. A short-term, unpredictable workload must not be interrupted, and the company wants to pay by the second with no commitment. Which option fits?

  1. On-Demand Instances
  2. Reserved Instances
  3. Savings Plans
  4. Spot Instances

Answer: A — On-Demand Instances

On-Demand requires no commitment and is paid by the second for what you launch. Spot can be interrupted, and Savings Plans and Reserved Instances require 1- or 3-year commitments.

34. A team moves a database from an EC2 instance to Amazon RDS. Which two tasks shift from the team to AWS? (Choose two.)

  1. Hardware lifecycle
  2. Power, network and cooling
  3. Database backups
  4. Application optimization
  5. Operating system patching

Answer: C,E — Database backups / Operating system patching

With RDS, AWS takes over OS patching and database backups, which are the customer's on EC2. Hardware lifecycle and power, network and cooling are already AWS's on EC2, and application optimization stays with the customer on both.

35. An application already uses MongoDB, and the company wants a managed, compatible database service. Which service fits?

  1. Amazon ElastiCache
  2. Amazon DynamoDB
  3. Amazon DocumentDB
  4. Amazon Neptune

Answer: C — Amazon DocumentDB

DocumentDB is the document database listed as MongoDB-compatible. DynamoDB is described as a serverless key-value and document store, ElastiCache is for in-memory caching and Neptune is for graph relationships.

36. A company must interconnect many VPCs and its on-premises network, and wants them all to connect through a single central point rather than separately to each other. Which service fits?

  1. AWS PrivateLink
  2. AWS Direct Connect
  3. AWS Global Accelerator
  4. AWS Transit Gateway

Answer: D — AWS Transit Gateway

Transit Gateway connects many VPCs and on-premises networks through one hub. Direct Connect is a dedicated physical link between premises and AWS, not a hub for many VPCs.

37. A team is designing the layout of a new VPC. Which two statements are correct? (Choose two.)

  1. An internet gateway lets private instances reach out without being reachable.
  2. A NAT gateway makes instances in a private subnet reachable from the internet.
  3. Route tables determine which traffic goes where.
  4. Subnets can be used to separate the tiers of an application.
  5. Private subnets are intended for instances that must be directly reachable from the internet.

Answer: C,D — Route tables determine which traffic goes where. / Subnets can be used to separate the tiers of an application.

Route tables direct traffic, and subnets separate application tiers. Private subnets hold instances that should not be directly reachable, and it is the NAT gateway, not the internet gateway, that allows outbound-only access.

38. A company runs Windows-based EC2 instances and needs shared file storage for them. Which service should it use?

  1. Instance store
  2. Amazon FSx
  3. Amazon EFS
  4. Amazon S3

Answer: B — Amazon FSx

FSx offers Windows File Server and is the answer when EFS cannot be used. EFS is not supported with Windows-based EC2 instances.

39. Compliance records are accessed roughly once a quarter, must be readable in milliseconds when requested, and are kept for years. Which S3 storage class is designed for this?

  1. S3 Glacier Flexible Retrieval
  2. S3 Glacier Deep Archive
  3. S3 Standard-IA
  4. S3 Glacier Instant Retrieval

Answer: D — S3 Glacier Instant Retrieval

Glacier Instant Retrieval is for archives accessed about quarterly with millisecond access. Glacier Flexible Retrieval needs a restore first and takes minutes to hours, and Standard-IA targets roughly monthly access.

40. A company wants to convert recordings of customer calls into text, and then extract meaning from that text. Which two services should it combine? (Choose two.)

  1. Amazon Rekognition
  2. Amazon Polly
  3. Amazon Comprehend
  4. Amazon Transcribe
  5. Amazon Textract

Answer: C,D — Amazon Comprehend / Amazon Transcribe

Transcribe converts speech to text and Comprehend finds meaning in text. Polly does the opposite (text to speech), Textract works on scanned documents, and Rekognition on images and video.

41. A data science team needs to build, train and deploy its own custom machine learning model. Which service is designed for this?

  1. Amazon Rekognition
  2. Amazon Q Developer
  3. Amazon SageMaker AI
  4. Amazon Comprehend

Answer: C — Amazon SageMaker AI

SageMaker AI is for building, training and deploying your own models. Rekognition and Comprehend are purpose-built services for images/video and text meaning respectively.

42. A web tier hands orders to a back-end component. The two must be decoupled, each message should be processed by a single consumer, and no message may be lost. Which service fits?

  1. Amazon SNS
  2. AWS Step Functions
  3. Amazon EventBridge
  4. Amazon SQS

Answer: D — Amazon SQS

SQS is a hosted queue that decouples components, with messages typically processed by a single subscriber. SNS is publish-subscribe to multiple subscribers and has no queues.

43. A development team needs a managed step that compiles code and runs tests, and a way to trace a request through a distributed application to find where it slowed down. Which two services should it use? (Choose two.)

  1. AWS CodeBuild
  2. AWS X-Ray
  3. AWS Amplify
  4. Amazon SES
  5. AWS IoT Core

Answer: A,B — AWS CodeBuild / AWS X-Ray

CodeBuild compiles and tests, and X-Ray traces a request through a distributed application. Amplify builds and deploys frontend and mobile apps, IoT Core manages devices, and SES sends email.

44. A company has a one-year Reserved Instance. The instance it was covering is terminated and replaced by a new instance of the same type in the same Region. What happens to the commitment?

  1. The discount is converted to On-Demand credit that can be used for any instance type.
  2. The commitment is to the instance configuration, not to one running instance, so the discount can apply to the replacement.
  3. The discount is lost until the one-year term ends, because it was tied to the terminated instance.
  4. The company must buy a new Reserved Instance for the replacement instance.

Answer: B — The commitment is to the instance configuration, not to one running instance, so the discount can apply to the replacement.

A Reserved Instance commits you to a configuration (type and Region), not to a specific running instance. The replacement with the same configuration can therefore benefit.

45. A company wants to be told automatically when AWS detects unusual spend in its account, without defining a spending threshold in advance. Which service fits?

  1. AWS Cost Explorer
  2. AWS Cost Anomaly Detection
  3. AWS Free Tier page
  4. AWS Budgets

Answer: B — AWS Cost Anomaly Detection

Cost Anomaly Detection sends automated alerts when AWS detects unusual spend. Budgets alerts only when spending crosses thresholds you set.

46. A member account leaves an AWS Organization. Which two statements about the Cost Explorer data generated while it was a member are true? (Choose two.)

  1. The account can never regain access to that data, even if it rejoins.
  2. The departed account keeps full access to that data.
  3. The departed account loses access to that data.
  4. AWS deletes that data when the account leaves.
  5. The management account keeps that data.

Answer: C,E — The departed account loses access to that data. / The management account keeps that data.

The data is not deleted: the management account keeps it, and the departed account loses access to it. It regains access if it rejoins.

47. A company wants a designated Technical Account Manager. It also wants a target response of under 15 minutes when a business-critical system is down. Which current plan matches?

  1. Basic Support
  2. Business Support+
  3. Enterprise Support
  4. Unified Operations

Answer: C — Enterprise Support

Enterprise Support has a designated TAM and a target of under 15 minutes for business-critical cases. Business Support+ targets under 30 minutes with no TAM, and Unified Operations targets under 5 minutes.

48. A company wants the full set of Trusted Advisor checks (500+), but its plan should not provide a Technical Account Manager. Which current plan fits?

  1. Enterprise Support
  2. Unified Operations
  3. Basic Support
  4. Business Support+

Answer: D — Business Support+

Business Support+ includes the full set of checks and has no Technical Account Manager. Enterprise Support and Unified Operations both include a TAM.

49. A company wants phone, web and chat access to Cloud Support Engineers around the clock, plus support for third-party software on its EC2 instances. Which two items does Business Support+ include? (Choose two.)

  1. Support for EC2 operating systems and popular software components
  2. 24x7 phone, web and chat access to Cloud Support Engineers
  3. A designated Technical Account Manager
  4. A response target under 15 minutes for business-critical cases
  5. Trusted Advisor Priority

Answer: A,B — Support for EC2 operating systems and popular software components / 24x7 phone, web and chat access to Cloud Support Engineers

Business Support+ includes 24x7 phone, web and chat access to Cloud Support Engineers and third-party software support. A TAM, the 15-minute target and Trusted Advisor Priority belong to higher plans.

Take this test interactively

More AWS Cloud Practitioner practice tests