AWS Cloud Practitioner Practice Questions with Explanations

How to use these questions

Answer each question before reading the explanation. These are newly written illustrative items aligned to public CLF-C02 topics; they are not actual AWS exam questions and do not reproduce secured content. For each item, identify the business need, select the service or concept that fits, and explain why the alternatives are weaker. Some items are multiple choice and one is multiple response, matching the public format at a broad level.

The live exam has 65 questions in 90 minutes. Fifty questions affect the score and 15 are unscored, but candidates cannot identify unscored items. AWS reports a scaled score from 100 to 1,000, with 700 passing. Performance on this short set does not convert to an official score or guarantee a result.

Question 1: elasticity

A retail website has a predictable period of much higher traffic each year. The company wants compute capacity to increase during the busy season and reduce when demand falls. Which AWS concept most directly supports this need?

1. A. Auto Scaling
2. B. AWS Artifact
3. C. AWS CloudTrail
4. D. Amazon Route 53

Best answer: A. Auto Scaling adjusts compute capacity in response to demand, supporting elasticity. Artifact provides compliance reports, CloudTrail records account activity, and Route 53 provides DNS services. These are real AWS services, but they do not address variable compute capacity.

Do not confuse elasticity with high availability. The scenario emphasizes capacity changing with traffic. If it instead asked how to withstand a failure in one location, the relevant idea would involve availability across isolated infrastructure such as Availability Zones.

Question 2: shared responsibility

A customer runs a Linux application on Amazon EC2. Which task remains the customer's responsibility under the shared responsibility model?

1. A. Securing the physical data center
2. B. Patching the guest operating system
3. C. Maintaining the physical host hardware
4. D. Controlling access to AWS facilities

Best answer: B. With EC2, the customer manages the guest operating system and its patches, along with applications and relevant configurations. AWS operates the underlying physical infrastructure and facilities. The customer does not take over data-center access control by launching an instance.

The service matters. A more managed service shifts additional tasks to AWS, but customers still control data, identities, permissions, and their service configuration. The shared model is not a blanket transfer of all security duties.

Question 3: cost estimate

Before building an application, a project manager wants to estimate the monthly cost of a proposed collection of AWS services. Which resource is intended for this purpose?

1. A. AWS Pricing Calculator
2. B. AWS Cost Explorer
3. C. AWS Budgets
4. D. AWS CloudTrail

Best answer: A. Pricing Calculator estimates costs for a planned design. Cost Explorer helps examine actual spending patterns, Budgets can alert against thresholds, and CloudTrail logs account activity. The timing in the scenario is the clue: estimate before deployment rather than analyze or alert after usage exists.

Question 4: choose two storage types

A web application needs to store user-uploaded photos as objects and attach a low-latency block volume to an Amazon EC2 instance. Which two services fit these separate storage needs?

1. A. Amazon S3 for the photos
2. B. Amazon EBS for the instance volume
3. C. Amazon Route 53 for the photos
4. D. AWS CloudTrail for the block volume
5. E. Amazon SNS for both storage needs

Best answers: A and B. Amazon S3 provides object storage, while Amazon EBS provides block storage volumes that can be attached to EC2. Route 53 handles DNS, CloudTrail records account activity, and SNS publishes notifications. The item asks for two services because the scenario has two distinct storage requirements.

A frequent distractor is a service that is part of an application but not a storage system. Recognize object, block, and file as different storage models, then select based on the workload rather than the generic word 'data.'

Question 5: account activity

A security analyst needs to determine which identity made an API call that changed an access policy. Which AWS service most directly records this account activity?

1. A. AWS CloudTrail
2. B. Amazon CloudWatch
3. C. Amazon Route 53
4. D. AWS Pricing Calculator

Best answer: A. CloudTrail records AWS account activity and API events, helping identify actions and their sources. CloudWatch focuses on monitoring metrics, logs, and alarms. Route 53 handles DNS; Pricing Calculator estimates costs. CloudWatch logs can be useful in other investigations, but the prompt specifically asks which identity made an API call.

Question 6: availability and global delivery

A media company wants to deliver cached images to users in multiple countries from locations closer to them. Which service category best fits?

1. A. Content delivery through Amazon CloudFront
2. B. Relational database through Amazon RDS
3. C. Account auditing through AWS CloudTrail
4. D. Cost tracking through AWS Budgets

Best answer: A. CloudFront is AWS's content delivery network, designed to cache and deliver content closer to users. RDS manages relational databases, CloudTrail records account activity, and Budgets monitors cost or usage thresholds. The phrase 'closer to users' signals edge delivery rather than compute, database, or billing.

If the question instead described a failure of one isolated location and asked for resilience, availability zones or multi-Region design might be relevant. Here, the stated issue is user proximity and content delivery.

Question 7: compliance reports

A compliance team wants to download AWS-provided reports and other documentation to support its assessment of the AWS environment. Which service should it use?

1. A. AWS Artifact
2. B. AWS Config
3. C. Amazon SQS
4. D. AWS Lambda

Best answer: A. AWS Artifact provides access to AWS compliance reports and related documentation. AWS Config tracks resource configurations and evaluates rules, SQS queues messages, and Lambda runs serverless code. The distinction is between provider compliance documentation and customer-side configuration or operation tools.

Review a question by its decision clue

A question can include extra details that are not decisive. Do not let every word trigger a different service. Identify the outcome requested and compare each choice with that outcome. A service can be technically related to the scenario and still be the wrong answer because it does a different job.

How to learn from a miss

1. Rewrite the requirement in one short phrase, such as 'estimate future cost' or 'record API caller.'
2. Name the relevant service category before looking at answer choices.
3. Explain why the correct option fits and why each distractor solves a different task.
4. Record the concept in your own words, especially when two services are easy to confuse.
5. Attempt a new question that tests the same distinction in a different setting.

For example, if you confused CloudWatch and CloudTrail, do not only memorize their names. Create one situation about a CPU metric crossing a threshold and another about which identity changed an IAM policy. Explain which service supports each task and what information it records.

Use practice ethically and realistically

These questions are original and illustrative. They are not recalled from any live exam and should not be treated as AWS item replicas. Use AWS's official practice question set, pretest, and other current preparation resources for authorized exam-style practice. Avoid dumps or claims to provide actual protected exam content.

Practice scores identify gaps but do not map directly to the AWS scaled score. Complete a mixed timed session, include both multiple-choice and multiple-response items, and answer every question. Review explanations for wrong answers and guesses. The strongest outcome is being able to reason through new scenarios without depending on memorized wording.

Additional original practice: recognize elasticity

A product team expects traffic to jump during a seasonal promotion and fall sharply afterward. Which cloud benefit most directly helps it add resources for the surge and release them when demand drops? Answer: elasticity. It describes adjusting capacity as demand changes. Scalability is the ability to accommodate growth; availability concerns continued access to a service. The decisive clues are variable demand and avoiding permanently provisioned peak capacity.

Additional original practice: identify who configures access

A company saves customer files in an Amazon S3 bucket and wants to ensure the objects are not publicly accessible. Who configures the bucket policy and access settings? Answer: the customer. AWS protects and operates the underlying cloud infrastructure; the customer controls data permissions and service configuration. The key is that access policy for customer content is a configuration in the cloud. Using a managed service does not transfer the customer's authorization decisions to AWS.

Additional original practice: match the database requirement

An online order application needs a managed relational database and wants AWS to handle routine database administration. Which service is the closest fit? Answer: Amazon RDS. It is AWS's managed relational database service. DynamoDB is a managed NoSQL database, Redshift is a data warehouse, and EC2 provides virtual compute instances. Solve the service category first: relational database narrows the answer more reliably than recognizing a familiar product name.

Additional original practice: select the cost tool

A finance analyst wants to examine historical AWS spending by service and see a forecast of future costs. Which tool best matches the request? Answer: AWS Cost Explorer. It supports analysis and visualization of historical and forecast cost. AWS Budgets is used to set thresholds and alerts; the AWS Pricing Calculator estimates the cost of a planned design. The question asks to inspect actual spending trends, so the calculator is not the closest fit.

Additional original practice: distinguish monitoring from audit history

An administrator needs to investigate which identity called an API to change a security group rule. Which service provides the relevant event history? Answer: AWS CloudTrail. CloudTrail records account activity and API events. CloudWatch monitors metrics, logs, and alarms for operational behavior. A CPU threshold alert points toward CloudWatch; attribution of an API action points toward CloudTrail.

Use a consistent method on unfamiliar questions

Before comparing options, reduce the requirement to a short phrase: relational database, object storage, global content delivery, identity permissions, API activity, cost estimate, or spending alert. Then remove choices from the wrong service family. If two answers sound plausible, ask which one directly satisfies the stated requirement and which one adds a capability the scenario never requested. Foundational items reward the closest fit, not the most elaborate architecture.

Keep an error log with four fields: the decisive clue, the answer you selected, the correct answer, and why your choice missed the requirement. For example: I selected CloudFront because the scenario mentioned a website; it actually asked who changed an IAM policy, so CloudTrail is the relevant event record. Revisit the log a day later and several days later. Immediate rereading can create recognition without proving you can make the distinction in a new scenario.

Additional original practice: match a managed service

A small business wants to move a relational database to AWS and reduce the routine work of provisioning and maintaining database infrastructure. Which service should it investigate first? Answer: Amazon RDS. It is a managed relational database service. The scenario does not ask for a NoSQL key-value database, a data warehouse, or a virtual server on which the customer installs a database. The decision clue is relational data plus a managed database service.

Why the alternatives are wrong: DynamoDB is a managed NoSQL database and may fit key-value or document access patterns, but the question explicitly says relational. Redshift is intended for analytics and warehousing, not as the default transaction database for a small order system. EC2 offers compute instances but shifts more operating-system and database administration to the customer. This item tests service category and responsibility, not database engine tuning.

A final review checklist for practice sets

• Can you explain the difference between availability, scalability, and elasticity in a business scenario?
• Can you identify customer configuration duties such as IAM permissions and S3 access settings?
• Can you distinguish compute, storage, database, networking, monitoring, audit, and cost-management service categories?
• Can you explain why your selected answer directly meets a stated need while the distractors address another need?
• Can you complete mixed questions at a steady pace without leaving any item unanswered?

A strong practice routine includes both correct answers and confident guesses in review. A lucky selection does not prove understanding. Record the concept behind the item, then try a different scenario that tests the same distinction. Use authorized questions for practice, and treat these original examples as learning exercises rather than predictions of live exam wording.