AWS Certified Cloud Practitioner (CLF-C02) Practice Exam: Free Questions and Mock Tests

Free AWS Certified Cloud Practitioner (CLF-C02) practice exam: 483 questions with explanations, timed 65-question mock tests and practice by domain, updated for 2026 AWS changes.

Exam format

Domains

Full mock test

65 questions in 90 minutes, drawn by domain weight, with a score per domain and an explanation for every answer.

What changed since most study guides were written

Sample questions with answers

Cloud Concepts

  1. A company wants to serve customers in several countries with low latency, without building or leasing data centers in those countries. Which benefit of the AWS Cloud does this describe?
    1. Benefit from massive economies of scale
    2. Trade fixed expense for variable expense
    3. Go global in minutes (correct)
    4. Stop guessing capacity

    Go global in minutes means you can deploy workloads in AWS Regions around the world with a few clicks, putting applications close to end users. Economies of scale is about lower prices, trading fixed for variable expense is about paying only for what you use, and stop guessing capacity is about matching capacity to demand.

  2. A startup does not want to buy servers up front. Instead, it wants to pay only for the compute it actually consumes each month. Which benefit of the AWS Cloud does this describe?
    1. Trade fixed expense for variable expense (correct)
    2. Increase speed and agility
    3. Go global in minutes
    4. Benefit from high availability

    Instead of investing heavily in data centers and servers before knowing how they will be used, you trade fixed (upfront) expense for variable expense and pay only when you consume resources. Speed and agility is about how fast resources can be provisioned, going global is about deploying in many Regions, and high availability is about resilience, not the spending model.

  3. Because AWS aggregates usage from a very large number of customers, it can achieve lower costs and offer lower pay-as-you-go prices. Which advantage of cloud computing is this?
    1. Elasticity
    2. Agility
    3. Stop guessing capacity
    4. Benefit from massive economies of scale (correct)

    AWS describes this as benefit from massive economies of scale: aggregated usage across many customers lets AWS operate more efficiently and pass the savings on as lower prices. Elasticity is about scaling resources with demand, agility is about speed of provisioning and experimentation, and stop guessing capacity is about avoiding over- or under-provisioning.

  4. A retailer buys enough on-premises servers to handle its holiday peak, and most of them sit idle for the rest of the year. Which AWS Cloud benefit most directly addresses this problem?
    1. Go global in minutes
    2. Stop guessing capacity (correct)
    3. Benefit from massive economies of scale
    4. Stop spending money on application development

    With stop guessing capacity, you can scale up for the peak and scale back down afterwards, instead of buying for the peak and leaving hardware idle. Going global is about geographic reach, economies of scale is about lower unit prices, and the cloud does not remove the need to spend on application development.

  5. Which statement best describes elasticity in the AWS Cloud?
    1. The ability to deploy an application in multiple AWS Regions
    2. The ability to acquire resources when you need them and release them when you no longer need them (correct)
    3. The ability of an application to keep running if one Availability Zone fails
    4. The ability to pay a lower price per unit as total usage grows

    Elasticity means automatically or quickly adding resources as demand rises and releasing them as demand falls, so you pay only for what you need. Multi-Region deployment is global reach, surviving an AZ failure is high availability, and lower unit prices with volume relate to economies of scale or tiered pricing.

  6. Developers at a company can now create new test environments in minutes instead of waiting weeks for hardware, so they try more ideas. Which benefit of the AWS Cloud does this describe?
    1. Economies of scale
    2. High availability
    3. Increased speed and agility (correct)
    4. Fault tolerance

    In the cloud, new IT resources are only a click away, which reduces the time to make them available to developers from weeks to minutes. This is increased speed and agility. Economies of scale relates to price, while high availability and fault tolerance relate to keeping workloads running during failures.

  7. Which of the following are advantages of cloud computing described by AWS? (Choose two.)
    1. Trade fixed expense for variable expense (correct)
    2. Remove all customer responsibility for securing applications
    3. Guarantee zero downtime for every workload
    4. Stop spending money running and maintaining data centers (correct)
    5. Pay a fixed annual price regardless of usage

    Trade fixed expense for variable expense and stop spending money running and maintaining data centers are two of the advantages of cloud computing that AWS lists. Under the shared responsibility model customers still secure their applications and data, AWS does not guarantee zero downtime for every workload, and pay-as-you-go pricing is the opposite of a fixed annual price.

  8. A company wants its web application to keep running if a single data center fails. What should the company do?
    1. Use a larger instance type in one Availability Zone
    2. Store backups in the same Availability Zone as the application
    3. Enable detailed monitoring on the instances
    4. Deploy the application across multiple Availability Zones in a Region (correct)

    Availability Zones are physically separate, isolated locations in a Region, so running the application in multiple AZs keeps it available if one data center or AZ fails. A larger instance in one AZ is still a single point of failure, backups in the same AZ share its failure, and detailed monitoring only gives more frequent metrics.

Security and Compliance

  1. A company runs its application on Amazon EC2 instances. Under the AWS shared responsibility model, which task is the responsibility of the company?
    1. Patching the guest operating system on the instances (correct)
    2. Maintaining the physical hosts that run the instances
    3. Securing the data center facilities that house the hosts
    4. Replacing failed storage hardware in the data centers

    With EC2 (infrastructure as a service), the customer manages the guest operating system, including updates and security patches. Physical hosts, data center facilities and hardware replacement are all part of the infrastructure that AWS secures ("security of the cloud").

  2. A company moves its self-managed database from Amazon EC2 to Amazon RDS. Which task does AWS now take on for the company?
    1. Creating and managing the database user accounts
    2. Applying operating system patches to the underlying database host (correct)
    3. Configuring security group rules that control access to the database
    4. Deciding whether the database storage should be encrypted

    Amazon RDS is a managed service, so AWS handles the underlying operating system and database software patching (applied during a maintenance window the customer can choose). The customer still manages database users, security group rules, and the choice to enable encryption.

  3. A team builds a serverless application with AWS Lambda. Which of the following is the responsibility of the team under the shared responsibility model?
    1. Patching the operating system of the execution environment
    2. Scaling the fleet of servers that run the functions
    3. Writing secure function code and managing its IAM permissions (correct)
    4. Maintaining the virtualization layer that isolates functions

    With Lambda, the customer is responsible for their function code, the data it handles, and the IAM permissions (such as the execution role). AWS manages the operating system, the underlying server fleet and its scaling, and the virtualization layer.

  4. A compliance officer needs to download AWS's SOC 2 report to give to an external auditor. Which AWS service provides this report?
    1. AWS Audit Manager
    2. AWS Config
    3. AWS Security Hub
    4. AWS Artifact (correct)

    AWS Artifact is the self-service portal for on-demand access to AWS's own compliance reports (such as SOC and ISO reports) and agreements. Audit Manager collects evidence about the customer's own resources, AWS Config tracks resource configurations, and Security Hub aggregates security findings.

  5. Which of the following are responsibilities of AWS under the shared responsibility model? (Choose two.)
    1. Physical security of AWS data centers (correct)
    2. Configuring security group rules for EC2 instances
    3. Maintaining the global network infrastructure that runs AWS services (correct)
    4. Creating IAM users and assigning their permissions
    5. Classifying and protecting sensitive customer data

    AWS is responsible for security of the cloud: the physical data centers and the hardware, software and networking infrastructure that run AWS services. Security group rules, IAM users and permissions, and data classification are customer responsibilities (security in the cloud).

  6. A security team needs to find out which IAM user terminated an Amazon EC2 instance yesterday. Which AWS service should the team use?
    1. AWS CloudTrail (correct)
    2. Amazon CloudWatch
    3. AWS Config
    4. Amazon Inspector

    AWS CloudTrail records API calls made in an account, including who made the call, when, and from where, so it answers "who did what". CloudWatch collects metrics and logs for monitoring, AWS Config records resource configuration state, and Inspector scans for software vulnerabilities.

  7. A company wants to see how the rules of a security group have changed over time and to evaluate whether its resources comply with internal configuration rules. Which AWS service meets these requirements?
    1. AWS CloudTrail
    2. AWS Config (correct)
    3. Amazon CloudWatch
    4. AWS Trusted Advisor

    AWS Config records resource configuration history and evaluates resources against Config rules for compliance. CloudTrail records the API calls that made changes but does not evaluate compliance, CloudWatch is for metrics, logs and alarms, and Trusted Advisor gives general best-practice recommendations.

  8. A company wants to collect application log files from its servers and be alerted when the number of failed login messages in those logs exceeds a threshold. Which AWS service should it use?
    1. AWS Config
    2. AWS CloudTrail
    3. Amazon CloudWatch (correct)
    4. Amazon Detective

    Amazon CloudWatch can collect application logs in CloudWatch Logs, turn log patterns into metrics with metric filters, and trigger alarms on thresholds. AWS Config tracks resource configurations, CloudTrail records AWS API calls rather than application logs, and Detective is used to investigate security findings.

Cloud Technology and Services

  1. Which statement best describes an AWS Availability Zone?
    1. A geographic area that contains multiple isolated AWS Regions
    2. A site that caches content close to end users for Amazon CloudFront
    3. One or more discrete data centers with redundant power and networking within a Region (correct)
    4. An extension of a Region placed in a large metro area close to users

    An Availability Zone is one or more discrete data centers with redundant power, networking and connectivity, isolated from the other AZs in the same Region. A Region contains multiple AZs, not the other way around. Sites that cache content for CloudFront are edge locations, and a Region extension placed in a metro area is an AWS Local Zone.

  2. A company must keep its customer data stored inside Germany to comply with data residency laws. What should the company do when deploying on AWS?
    1. Store the data in an AWS Region located in Germany (correct)
    2. Deploy the data across multiple Availability Zones in any Region
    3. Serve the data through Amazon CloudFront edge locations in Germany
    4. Enable AWS Global Accelerator for users located in Germany

    AWS does not move your data out of the Region you store it in unless you choose to, so selecting a Region in the required country (such as Europe (Frankfurt)) addresses data sovereignty. Using multiple AZs improves availability but does not control which country the data is in. CloudFront and Global Accelerator improve performance for users; they do not determine where the source data is stored.

  3. Which part of the AWS global infrastructure does Amazon CloudFront use to cache content closer to end users?
    1. Availability Zones
    2. AWS Outposts racks
    3. VPC subnets
    4. Edge locations (correct)

    CloudFront caches copies of content at edge locations (points of presence) around the world to reduce latency for viewers. Availability Zones host Regional resources such as EC2 instances, Outposts brings AWS infrastructure into a customer data center, and subnets are IP address ranges inside a VPC.

  4. A film studio in a large city runs graphics-rendering workloads that need single-digit millisecond latency to AWS compute, but the nearest AWS Region is far away. The studio does not want to install any hardware in its own facility. Which option should it use?
    1. AWS Wavelength
    2. AWS Local Zones (correct)
    3. Amazon CloudFront
    4. AWS Direct Connect

    AWS Local Zones place AWS compute, storage and other services in large metro areas close to users, for latency-sensitive workloads such as media rendering and real-time gaming. Wavelength embeds AWS infrastructure in 5G carrier networks for mobile devices. CloudFront caches content but does not run rendering compute, and Direct Connect is a network connection that does not move compute closer to users.

  5. A company is building a mobile application that needs ultra-low latency for users on 5G devices. Which AWS service embeds AWS compute and storage inside telecommunications providers' 5G networks?
    1. AWS Local Zones
    2. AWS Wavelength (correct)
    3. AWS Outposts
    4. AWS Global Accelerator

    AWS Wavelength deploys AWS compute and storage within communications service providers' 5G networks, so traffic from 5G devices reaches the application without leaving the carrier network. Local Zones are in metro areas but not inside 5G networks, Outposts runs in a customer's own data center, and Global Accelerator routes traffic over the AWS global network to Regional endpoints.

  6. A company must keep some workloads in its own data center for low-latency access to on-premises systems, but wants to use the same AWS infrastructure, APIs and tools that it uses in the cloud. Which service should it use?
    1. AWS Local Zones
    2. AWS Storage Gateway
    3. AWS Direct Connect
    4. AWS Outposts (correct)

    AWS Outposts is fully managed AWS infrastructure installed in the customer's data center, offering the same AWS APIs and tools for a consistent hybrid experience. Local Zones are AWS-operated locations, not the customer's facility. Storage Gateway only gives on-premises access to cloud storage, and Direct Connect is a dedicated network connection.

  7. A company wants its web application to keep running if one data center fails. Which actions help the application achieve high availability? (Choose two.)
    1. Deploy Amazon EC2 instances across multiple Availability Zones (correct)
    2. Run all instances in a single Availability Zone on larger instance types
    3. Store all application data on EC2 instance store volumes
    4. Use Elastic Load Balancing to distribute traffic across healthy instances (correct)
    5. Keep user session data only in the memory of each instance

    Spreading instances across multiple Availability Zones removes a single data center as a point of failure, and Elastic Load Balancing sends traffic only to healthy instances in those AZs. A single AZ is still a single point of failure regardless of instance size. Instance store data and per-instance session data are lost when an instance fails, which hurts availability.

  8. A company runs a critical application in one AWS Region across three Availability Zones. Management wants the application to keep working even if an event affects that entire Region. What should the company do?
    1. Replicate data and deploy a standby copy of the application in a second AWS Region (correct)
    2. Add more Availability Zones in the same Region
    3. Move the application to larger Amazon EC2 instance types
    4. Place the application behind Amazon CloudFront

    Protecting against a Region-wide event requires a multi-Region disaster recovery design, with data replicated to and the application deployable in another Region. More AZs or larger instances in the same Region do not help if the whole Region is affected. CloudFront caches content at the edge but cannot run the application's backend if the origin Region is unavailable.

Billing, Pricing, and Support

  1. A startup is launching a new application with short-term, unpredictable traffic. The workload cannot be interrupted, and the company does not want to make any long-term commitment. Which EC2 pricing model fits best?
    1. Spot Instances
    2. Standard Reserved Instances
    3. On-Demand Instances (correct)
    4. Dedicated Hosts

    On-Demand Instances have no commitment and cannot be interrupted by AWS, so they suit short-term, unpredictable workloads. Spot Instances can be interrupted, Standard Reserved Instances need a 1- or 3-year term, and Dedicated Hosts are physical servers for licensing or compliance needs, not a way to handle unpredictable usage cheaply.

  2. A company runs nightly batch jobs that can be stopped and restarted at any time without affecting results. The company wants the lowest possible compute cost. Which EC2 purchasing option should it use?
    1. Spot Instances (correct)
    2. On-Demand Instances
    3. Convertible Reserved Instances
    4. On-Demand Capacity Reservations

    Spot Instances use spare EC2 capacity at steep discounts and are ideal for fault-tolerant, interruptible work such as batch jobs. On-Demand is more expensive, Convertible Reserved Instances need a long-term commitment, and Capacity Reservations are billed at On-Demand rates to guarantee capacity rather than lower cost.

  3. A company will run EC2 instances steadily for the next 3 years. It wants a Reserved Instance discount but expects to change to different instance families and operating systems over time. Which option should it buy?
    1. Standard Reserved Instances
    2. Spot Instances
    3. Dedicated Instances
    4. Convertible Reserved Instances (correct)

    Convertible Reserved Instances can be exchanged for RIs with a different instance family, operating system or tenancy during the term. Standard RIs cannot change instance family, Spot Instances are not a reservation and can be interrupted, and Dedicated Instances are a tenancy option, not a discount model.

  4. A company no longer needs some of its unused EC2 reservations and wants to sell them to another AWS customer through the Reserved Instance Marketplace. Which type of commitment can be sold there?
    1. Convertible Reserved Instances
    2. Standard Reserved Instances (correct)
    3. Compute Savings Plans
    4. Spot Instances

    Only Standard Reserved Instances can be listed on the Reserved Instance Marketplace. Convertible RIs and Savings Plans cannot be resold, and Spot Instances are not a reservation at all.

  5. A company runs workloads on Amazon EC2, AWS Fargate and AWS Lambda across several Regions. It wants one commitment that lowers the cost of all three, even if it changes instance families or Regions later. Which option meets this need?
    1. EC2 Instance Savings Plans
    2. Standard Reserved Instances
    3. Compute Savings Plans (correct)
    4. Convertible Reserved Instances

    Compute Savings Plans apply automatically to EC2 usage regardless of instance family, size, Region, OS or tenancy, and also to Fargate and Lambda. EC2 Instance Savings Plans are tied to one instance family in one Region and do not cover Fargate or Lambda, and EC2 Reserved Instances (Standard or Convertible) cover only EC2 instances.

  6. Which statements about EC2 Instance Savings Plans are true? (Choose two.)
    1. The commitment applies to a specific instance family in a chosen Region (correct)
    2. The discount automatically applies to AWS Fargate and AWS Lambda usage
    3. The customer commits to a consistent amount of usage in dollars per hour for a 1-year or 3-year term (correct)
    4. Unused commitments can be resold on the Reserved Instance Marketplace
    5. The plan reserves EC2 capacity in a specific Availability Zone

    An EC2 Instance Savings Plan is a 1- or 3-year commitment to a dollar-per-hour spend on one instance family in one Region, with flexibility on size, OS and tenancy within that family. Fargate and Lambda are covered only by Compute Savings Plans, Savings Plans cannot be resold, and Savings Plans give a billing discount without reserving capacity.

  7. A company wants to bring its existing per-socket and per-core server software licenses to AWS. It needs visibility into the physical sockets and cores of the server its instances run on. Which EC2 option should it use?
    1. Dedicated Instances
    2. Spot Instances
    3. On-Demand Capacity Reservations
    4. Dedicated Hosts (correct)

    Dedicated Hosts are physical servers allocated to you, with visibility into sockets and cores, which supports bring-your-own-license (BYOL) models tied to physical hardware. Dedicated Instances run on single-tenant hardware but do not expose sockets and cores, Spot Instances are shared spare capacity, and Capacity Reservations only reserve capacity.

  8. Which statement correctly describes Amazon EC2 Dedicated Instances?
    1. They run on hardware dedicated to one customer but do not give visibility into physical sockets and cores (correct)
    2. They let the customer control which specific physical server instances are placed on across launches
    3. They share physical hardware with other AWS accounts but are isolated by the hypervisor
    4. They can be interrupted with short notice when AWS needs the capacity back

    Dedicated Instances run on hardware dedicated to a single customer, but AWS manages placement and you get no host-level visibility. Controlling placement on a specific server (host affinity) is a Dedicated Hosts feature, shared hardware describes default tenancy, and interruption describes Spot Instances.

Study the topics

AWS Cloud lessons · CLF-C02 exam guide and study path