Practice for the AWS Certified Cloud Practitioner (CLF-C02) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A global e-commerce platform wants to restrict access to its website from specific countries to comply with regional reg. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- A global e-commerce platform wants to restrict access to its website from specific countries to comply with r…
- A financial services enterprise plans to enable Multi-Factor Authentication (MFA) for its employees. For ease…
- Amazon CloudWatch billing metric data is stored in which AWS Region?
- A multi-national company has its business-critical data stored on a fleet of Amazon Elastic Compute Cloud (Am…
- An AWS hardware failure has impacted one of your Amazon Elastic Block Store (Amazon EBS) volumes. Which AWS s…
- Which of the following are recommended best practices for AWS Identity and Access Management (AWS IAM) servic…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A global e-commerce platform wants to restrict access to its website from specific countries to comply with regional regulations. Which AWS service is best suited to implement this restriction?
Answer: B. Amazon WAF
Amazon WAF is a web application firewall that lets you create geographic match conditions to block traffic from specific countries. Shield protects against DDoS attacks but does not handle geographic restrictions.
Q2. A financial services enterprise plans to enable Multi-Factor Authentication (MFA) for its employees. For ease of travel, they prefer not to use any physical devices to implement Multi-Factor Authentication (MFA). Which of the below options…
Answer: D. Virtual Multi-Factor Authentication (MFA) device
A virtual MFA device runs on a smartphone or tablet, generating time-based codes without requiring physical hardware. Hardware MFA and U2F security keys require carrying a separate physical device, which defeats the travel preference.
Q3. Amazon CloudWatch billing metric data is stored in which AWS Region?
Answer: C. US East (N. Virginia) – us-east-1
CloudWatch billing metric data is always stored in the US East N. Virginia Region, representing worldwide charges. A common exam trap is assuming billing data is stored in the region where the resources are actually provisioned.
Q4. A multi-national company has its business-critical data stored on a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances, in various countries, configured in region-specific compliance rules. To demonstrate compliance, the company…
Answer: B. AWS Config
AWS Config records resource configurations over time, enabling compliance auditing and historical troubleshooting. CloudTrail tracks API calls and user activity, while Config focuses specifically on the state of the resources themselves.
Q5. An AWS hardware failure has impacted one of your Amazon Elastic Block Store (Amazon EBS) volumes. Which AWS service will alert you of the affected resources and provide a remedial action?
Answer: C. AWS Health Dashboard – Your account health
The AWS Health Dashboard alerts you to events affecting your specific resources and provides remediation guidance. Trusted Advisor offers general best practice checks, whereas the Health Dashboard is targeted to your exact account resources.
Q6. Which of the following are recommended best practices for AWS Identity and Access Management (AWS IAM) service? (Select two)
Answer: B,D. Rotate credentials regularly || Enable multi-factor authentication (MFA) for all users
Rotating credentials regularly and enabling multi-factor authentication are fundamental IAM security best practices. Always apply least privilege and never share account credentials or root user access keys.
Q7. Which of the following use cases is best suited for Amazon EFS Standard-Infrequent Access (EFS Standard-IA) storage class?
Answer: C. Storing files in an accessible location to satisfy audit requirements
EFS Standard Infrequent Access offers lower costs for files accessed less frequently while remaining readily accessible for audits. It is a multi-zone file system, whereas One Zone is for single availability zone storage.
Q8. Which AWS service will you use to privately connect your virtual private cloud (VPC) to Amazon Simple Storage Service (Amazon S3)?
Answer: D. VPC Endpoint
A VPC endpoint privately connects your virtual private cloud to services like S3 without needing an internet gateway. Remember that S3 and DynamoDB use gateway endpoints, while most other services use interface endpoints.
Q9. AWS Identity and Access Management (AWS IAM) policies are written as JSON documents. Which of the following are mandatory elements of an IAM policy?
Answer: B. Effect, Action
Effect and Action are mandatory elements within an IAM policy statement, defining whether access is allowed or denied and the specific operations. Elements like Sid and Condition are optional, providing extra logic or labeling.
Q10. An IT company has deployed a static website on Amazon Simple Storage Service (Amazon S3), but the website is still inaccessible. As a Cloud Practitioner, which of the following solutions would you suggest to address this issue?
Answer: D. Fix the Amazon S3 bucket policy
Fixing the Amazon S3 bucket policy resolves access issues by explicitly allowing the necessary public read permissions for website hosting. For the exam, remember that configuring static website hosting requires disabling block public access settings and attaching a valid bucket policy.
Q11. Which of the following improves the availability for a fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances?
Answer: A. Deploy the Amazon Elastic Compute Cloud (Amazon EC2) instances across different Availability Zones (AZ) in the same AWS Region
Deploying Amazon EC2 instances across different Availability Zones in the same Region correctly improves availability by isolating workloads from localized failures. Remember that Availability Zones are physically separated data centers within a single Region, not spanning multiple Regions.
Q12. Which of the following statements is correct regarding the Amazon Elastic File System (Amazon EFS) storage service?
Answer: A. EC2 instances can access files on an Amazon Elastic File System (Amazon EFS) file system across many Availability Zones (AZ), Regions and VPCs
Amazon Elastic File System is a regional service natively accessible across multiple Availability Zones, VPCs, and even different Regions using peering connections. Distractors incorrectly restrict this access, but the service inherently provides broad, shared file storage for Linux-based workloads.
Q13. Which of the following statements are true about Cost Allocation Tags in AWS Billing? (Select two)
Answer: C,D. You must activate both AWS generated tags and user-defined tags separately before they can appear in Cost Explorer or on a cost allocation report || For each resource, each tag key must be unique, and each tag key can have only one value
Each tag key must be unique per resource and have exactly one value. Additionally, both user-defined and AWS-generated cost allocation tags must be individually activated in the billing console before they appear in Cost Explorer.
Q14. Which of the following capabilities does Amazon Rekognition provide as a ready-to-use feature?
Answer: C. Identify objects in a photo
Amazon Rekognition identifies objects, people, text, and scenes in photos, acting as a ready-to-use machine learning feature. It does not handle basic image manipulation tasks like resizing or converting to greyscale, which require different image processing services.
Q15. A research lab wants to optimize the caching capabilities for its scientific computations application running on Amazon EC2 instances. Which Amazon EC2 storage option is best suited for this use case?
Answer: C. Instance Store
An instance store provides temporary, high-speed block storage physically attached to the host computer, making it perfect for fast caches and scratch data. Block storage like EBS is persistent, but it cannot match the raw hardware speed needed for temporary data caching.
Q16. Which AWS service will you use if you have to move large volumes of on-premises data to AWS Cloud from a remote location with limited bandwidth?
Answer: A. AWS Snowball
AWS Snowball provides physical devices to move massive datasets offline, bypassing the network constraints of limited bandwidth entirely. Direct Connect takes months to provision and still relies on high-capacity physical network lines, which fails the limited bandwidth constraint.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.