20 free AWS Certified Cloud Practitioner (CLF-C02) practice questions

Correct answer: C · Rightsize each instance to a smaller type that still meets its measured demand

Rightsizing means matching instance types and sizes to the capacity a workload actually uses. AWS Compute Optimizer, an in-scope CLF-C02 service, analyzes CloudWatch utilization metrics (the last 14 days by default) and gives rightsizing recommendations and flags idle resources. Instances averaging under 10% CPU and a quarter of their memory are oversized, so smaller types cut cost without starving them; the Well-Architected sustainability guidance also lists rightsizing under its maximize-utilization principle. Reserved Instances lower the rate, but committing to the oversized sizes for one or three years locks in the waste. Another Region changes the price a little and leaves every instance just as oversized. Auto Scaling adds or removes instances as demand changes; it does not shrink instances that are too large to begin with.

Look for this next time: Rightsizing matches instance type and size to measured use; AWS Compute Optimizer recommends smaller types for oversized instances.

Correct answer: A · Trade fixed expense for variable expense

AWS's Overview of Amazon Web Services whitepaper lists six advantages of cloud computing. Trade fixed expense for variable expense describes this case: rather than buying data centers and servers up front, before demand is known, the company pays as it uses computing resources and only for the amount it uses. Economies of scale is about price: because AWS aggregates usage from many customers, it can offer lower pay-as-you-go prices than one company could reach on its own. Go global in minutes is about deploying in several Regions quickly to give users lower latency. Speed and agility is about new resources being available in minutes instead of weeks. The founders' concern is the large upfront purchase, so the fixed-to-variable advantage is the one that fits.

Look for this next time: Paying only for what you consume, instead of buying servers up front, is trading fixed expense for variable expense.

Correct answer: D · Repurchase, also known as drop and shop

AWS Prescriptive Guidance names seven migration strategies, the 7 Rs. Repurchase, also known as drop and shop, replaces an application with a different version or product, and its first listed use case is moving from a traditionally licensed application to SaaS, which is what this company is doing. Rehost moves the application to AWS without changes, so the company would still run its own copy of the CRM. Replatform also keeps the application but adds some optimization, such as moving its database to a managed service. Retain keeps the application in the source environment for now, the opposite of this decision. After repurchasing, AWS notes that the remaining work includes training users, migrating data, and integrating the new product with existing authentication.

Look for this next time: Replacing an application with a SaaS product is the repurchase strategy; rehost and replatform keep running your own copy.

Correct answer: B · People perspective

AWS CAF groups its capabilities into six perspectives: Business, People, Governance, Platform, Security, and Operations. The People perspective serves as a bridge between technology and business and focuses on culture, organizational structure, leadership, and workforce, which covers resistance to change, outdated job roles, and missing training plans. The Governance perspective helps orchestrate cloud initiatives while maximizing organizational benefits and minimizing transformation-related risks. The Platform perspective is about building an enterprise-grade, scalable hybrid cloud platform and modernizing workloads. The Operations perspective is about delivering cloud services at a level that meets the needs of the business. Every symptom in this scenario concerns people and culture rather than risk, technology, or service delivery, so the People perspective is the one to apply.

Look for this next time: In AWS CAF, culture, organizational structure, leadership, and workforce skills belong to the People perspective.

Correct answer: C · Sustainability

The Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. AWS says the Sustainability pillar focuses on environmental impacts, especially energy consumption and efficiency, and one of its design principles is to maximize utilization: two hosts at 30% utilization are less efficient than one host at 60%. Cost optimization often benefits from the same changes, because idle resources cost money, but AWS defines it as running systems to deliver business value at the lowest price point. Performance efficiency is about using cloud resources efficiently to meet performance requirements as demand changes. Reliability is about a workload performing its intended function correctly and consistently. The review names energy consumption as the goal, which is the Sustainability pillar's focus.

Look for this next time: Energy use and environmental impact belong to the Sustainability pillar; lowest price belongs to Cost optimization.

Correct answer: D · The customer, because the guest OS on EC2 is the customer's responsibility

AWS's shared responsibility model page says that for Amazon EC2, the customer manages the guest operating system, including updates and security patches, plus any software it installs and the security group configuration. AWS is responsible for protecting the infrastructure that runs AWS services. The Amazon RDS User Guide draws the contrast: OS patching is AWS's job on Amazon RDS but the customer's job on EC2, so EC2 is not a service where AWS patches the operating system. AWS Support can give guidance on a case, but the model still leaves the guest OS with the customer. Patch management is listed as a shared control, but the work is split rather than done together: AWS patches its infrastructure, and the customer patches its own guest operating systems and applications.

Look for this next time: On Amazon EC2, the customer patches the guest OS and its applications; AWS secures the infrastructure that runs the service.

Correct answer: A · AWS Artifact

AWS Artifact provides on-demand downloads of AWS security and compliance documents, such as SOC reports, PCI reports, and ISO reports, and AWS provides them free of charge. Artifact is also where customers review and accept agreements with AWS. AWS Config records the configuration of the customer's own resources and evaluates it against rules, so it describes the startup's environment, not AWS's audited controls. AWS Security Hub collects security findings and checks the customer's environment against best-practice standards. AWS Trusted Advisor inspects the customer's account and recommends improvements, for example for cost and security. Keep the boundary in mind: Artifact documents cover AWS's side of the shared responsibility model, and the startup still has to show its own compliance for what it builds.

Look for this next time: Download AWS compliance reports, such as SOC and PCI reports, from AWS Artifact; they cover AWS's side of shared responsibility.

Correct answer: B · AWS CloudTrail, which records account activity as events

AWS CloudTrail records actions taken by a user, role, or AWS service as events, whether they come from the console, the AWS CLI, or the SDKs and APIs. Each event record includes the identity that made the request, the time, the action, and the source IP address, which is exactly what the team needs. Event history keeps the last 90 days of management events at no charge, and a trail can store events in Amazon S3 for longer. CloudWatch metrics track performance numbers, such as CPU use, not who changed a configuration. Amazon Inspector scans workloads for software vulnerabilities and unintended network exposure. VPC Flow Logs record IP traffic to and from network interfaces, so they show connections, not the API call that changed the rule.

Look for this next time: For who changed what and when in an AWS account, use AWS CloudTrail; CloudWatch tracks metrics and Flow Logs track traffic.

Correct answer: D · Attach an IAM role to the instance that can read only that bucket

The IAM User Guide says to use an IAM role to manage temporary credentials for applications that run on Amazon EC2, instead of storing long-term credentials on the instance. The role reaches the instance through an instance profile, the application gets temporary credentials from the instance metadata, and those credentials are updated automatically, so there is no long-term key to leak or rotate by hand. Limiting the role to reading one bucket also applies least privilege. Putting the key in user data still leaves a long-term access key on the instance that someone must protect and rotate. The root user has full access to the whole account, and AWS strongly recommends not creating root access keys at all. A public bucket exposes the objects to anyone on the internet.

Look for this next time: Give applications on EC2 an IAM role with least-privilege permissions; its temporary credentials rotate automatically, unlike stored access keys.

Correct answer: C · Delete the root access key and give each administrator their own admin identity

AWS's root user best practices say to use the root user only for tasks that require it, to create an administrative user for everyday tasks, and not to create access keys for the root user, because it has full access to every service and resource in the account, including billing. Deleting the root key and giving each administrator their own administrative identity, for example through IAM Identity Center, ends the shared credential and makes actions traceable to a person. Rotating the key every 90 days still keeps an all-powerful long-term key in use, and the password is still shared. Turning off MFA removes a protection that AWS now requires for the root user of every account type. Each AWS account has a single root user, so a second one cannot be created.

Look for this next time: Use the root user only for root-only tasks, never create root access keys, and give each person their own administrative identity.

Correct answer: A · AWS WAF, with rules for requests that reach the load balancer

AWS WAF is a web application firewall that monitors the HTTP(S) requests forwarded to protected resources, and an Application Load Balancer is one of the resource types it protects. Its rules can match criteria such as the source IP address and the contents of the request, including SQL injection patterns, and matching requests can be blocked. AWS Shield Standard is automatic protection, at no additional cost, against common network- and transport-layer DDoS attacks such as SYN floods; it does not inspect request content for SQL injection. Amazon GuardDuty is a threat detection service that analyzes logs and activity in the account and reports findings, rather than filtering web requests inline. Amazon Inspector scans workloads for software vulnerabilities and network exposure, not live web traffic.

Look for this next time: AWS WAF filters HTTP(S) requests by rules such as SQL injection patterns or IP sets; Shield addresses DDoS, and GuardDuty detects threats.

Correct answer: B · Describe the resources in an AWS CloudFormation template and deploy it as stacks

AWS CloudFormation is infrastructure as code: a template describes the resources and their properties, and creating a stack from it provisions and configures them, including their dependencies. The CloudFormation User Guide says you can reuse a template to create resources in a consistent and repeatable manner and provision the same resources over and over in multiple Regions. Because templates are text files, they can be kept in version control, so every change is tracked. A runbook with double checks still depends on manual console work, which is what caused the differences. Copying AMIs moves only server images; it does not create the VPC, subnets, load balancer, scaling group, or database. A monthly support case does not give the team a repeatable, versioned build process.

Look for this next time: For repeatable, identical environments across Regions or accounts, use infrastructure as code such as AWS CloudFormation templates.

Correct answer: D · Run instances in at least two Availability Zones behind a load balancer

AWS describes Availability Zones as one or more discrete data centers with redundant power, networking, and connectivity, housed in separate facilities. Each AZ is engineered to be isolated from failures in other AZs and to have low-latency network links to the other AZs in the same Region. Running instances in two or more AZs behind a load balancer lets traffic continue if one AZ fails, while the tiers stay close enough for low latency. Larger instances in the same AZ still share that AZ's failure risk. CloudFront caches content at edge locations to lower latency for users, but it does not run the application's servers. Nightly backups help recovery, but they do not keep the application running during a failure, and data written since the last backup would be lost.

Look for this next time: For high availability within a Region, spread instances across multiple Availability Zones behind a load balancer.

Correct answer: C · An AWS Lambda function triggered by the S3 upload event

AWS Lambda runs code without provisioning or managing servers. A Lambda function can be triggered by events from services such as Amazon S3, scales automatically with the number of events, and is billed per request and for execution time, so there is no compute charge when no photos arrive. A two-second task fits easily within Lambda's limit of 15 minutes per invocation. An On-Demand instance that checks the bucket is a server to patch and pay for even on nights with no uploads. A Dedicated Host is a physical server dedicated to one customer, which adds cost and server management. Spot Instances are cheaper than On-Demand, but a fleet kept running still means servers to manage, and Amazon EC2 can interrupt Spot capacity.

Look for this next time: Short, event-driven tasks with unpredictable volume suit AWS Lambda: no servers to manage and no compute charge while idle.

Correct answer: A · Amazon RDS for MySQL

Amazon RDS is a managed relational database service that supports MySQL. The Amazon RDS User Guide compares management models: with Amazon RDS, AWS handles OS installation and patching, database software installation and patching, database backups, and high availability, while the customer keeps application optimization, such as query tuning. Installing MySQL on EC2 gives full control, but the same comparison lists OS patching, database patching, and backups as the customer's work on EC2. Amazon DynamoDB is a managed NoSQL key-value and document database, so the application would have to be rewritten to stop using MySQL. Amazon Redshift is a data warehouse for analytics, not a drop-in replacement for an existing transactional MySQL database.

Look for this next time: Amazon RDS shifts OS and database patching and backups to AWS; running the database on EC2 keeps those tasks with you.

Correct answer: B · A network ACL rule on the subnet that denies the range

The Amazon VPC User Guide compares the two controls. Security groups work at the instance level, support allow rules only, and are stateful. Network ACLs work at the subnet level, support allow and deny rules, evaluate rules in ascending order until one matches, and are stateless. A network ACL rule that denies the range, numbered lower than any rule that would allow the traffic, blocks it for every instance in the subnet. A security group cannot hold a deny rule at all. Route tables decide where traffic leaving a subnet goes, and a NAT gateway serves outbound connections from private subnets, so neither blocks this inbound traffic. Shield Advanced is a paid DDoS protection service for specific resources, not a way to filter a subnet.

Look for this next time: Security groups only allow and are stateful; network ACLs can deny, apply to the whole subnet, and are stateless.

Correct answer: D · Amazon EFS with a Regional file system

Amazon EFS provides serverless, fully elastic file storage that grows and shrinks automatically as files are added and removed. It supports the NFS version 4 protocol, so Linux instances can mount it as one shared file system, and a Regional file system stores data redundantly across multiple Availability Zones so instances in each of them can use it. An EBS volume is block storage that lives in a single Availability Zone, so separate volumes on each instance do not give everyone one shared set of files. Instance store is temporary block storage on the host, and its data is lost when the instance stops or terminates. S3 Glacier Flexible Retrieval is an archive storage class for rarely used data, not a file system that hundreds of instances write to at once.

Look for this next time: Many Linux instances sharing one elastic NFS file system across Availability Zones points to Amazon EFS; EBS volumes are single-AZ block storage.

Correct answer: A · Amazon Transcribe

Amazon Transcribe is an automatic speech recognition service that uses machine learning models to convert audio to text, either as a live stream or for media files stored in Amazon S3, and as a managed service it needs no model training by the customer. Amazon Polly does the reverse, turning text into lifelike speech. Amazon Translate translates text from one language to another, so it could help only after the calls are already text. Amazon Rekognition analyzes images and videos, for example to detect objects or faces, not speech. Once the calls are transcribed, other in-scope services can work with the transcripts, such as Amazon Comprehend, which finds sentiment and key phrases in text.

Look for this next time: Speech to text is Amazon Transcribe, text to speech is Amazon Polly, and text between languages is Amazon Translate.

Correct answer: C · Spot Instances, which use spare EC2 capacity at a discount

Spot Instances use spare EC2 capacity that is available for less than the On-Demand price. The EC2 User Guide says they are a cost-effective choice when you can be flexible about when applications run and when applications can be interrupted, and it names batch jobs as a good fit. Amazon EC2 can reclaim a Spot Instance with a two-minute interruption notice, which these checkpointed, restartable jobs can tolerate. On-Demand Instances need no commitment, but they cost more than Spot for the same capacity. A three-year Reserved Instance pays off for steady, always-on use, not for jobs that run only on weekends. Dedicated Hosts give one customer a physical server, mainly for licensing or compliance needs, and they raise cost rather than lower it.

Look for this next time: Interruptible, flexible work such as checkpointed batch jobs fits Spot Instances; steady always-on use fits Savings Plans or Reserved Instances.

Correct answer: B · AWS Budgets, with a forecasted-cost alert

AWS Budgets tracks costs and usage and can alert on actual spend or on forecasted spend, before the charges accrue, by email or through an Amazon SNS topic. A monthly cost budget of $5,000 with a forecasted-spend notification gives the manager the early warning, and budget actions that apply restrictions are optional, so nothing is blocked. AWS notes that billing data can lag behind usage, so an alert may arrive after some extra spend. AWS Pricing Calculator estimates the cost of a planned architecture before you build it; it does not watch the live bill. Cost and Usage Reports are detailed billing data exports for analysis, not alerts. Trusted Advisor's cost checks point out savings opportunities, such as idle resources, rather than warning about a spending threshold.

Look for this next time: Use AWS Budgets for alerts on actual or forecasted spend, AWS Pricing Calculator for estimates, and Cost Explorer for analysis.