11 CLF-C02 practice questions with answer reveals and spoken explanations. Choose before the reveal and keep your score.
Certification: AWS Certified Cloud Practitioner (CLF-C02). Independent practice, not an official exam.
How to use this round:
– Pause each question if you need more time to decide.
– Compare your answer after the reveal.
– Review the concepts you missed, then practice again.
Practice free with CertPunch:
Web: https://certpunch.com/
iPhone and iPad: https://apps.apple.com/app/certpunch/id6797541734
Android: https://play.google.com/store/apps/details?id=com.certpunch.app
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- A company is developing a new web application. Logging in to the application through a social identity provid…
- Which authentication method is used to authenticate programmatic calls to AWS services?
- A company has been using an AWS managed IAM policy for granting permissions to users but needs to add some pe…
- A manager is planning to migrate applications to the AWS Cloud and needs to obtain AWS compliance reports. Ho…
- Which Amazon EC2 pricing model is the most cost-effective for an always-up, right-sized database server runni…
- Which AWS service can be used to track the activity of users on AWS?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A company is developing a new web application. Logging in to the application through a social identity provider is a must-have requirement for the company. Which AWS service will meet this requirement?
Answer: C. Amazon Cognito.
Amazon Cognito adds sign-up and sign-in to web and mobile apps and supports social identity providers like Google, Facebook, and Apple. IAM only handles AWS identities, so it cannot authenticate external app users.
Q2. Which authentication method is used to authenticate programmatic calls to AWS services?
Answer: B. Access keys
Access keys, made up of an access key ID and secret access key, authenticate programmatic API and CLI calls. Do not confuse them with key pairs, which are used to log in to Amazon EC2 instances.
Q3. A company has been using an AWS managed IAM policy for granting permissions to users but needs to add some permissions. How can this be achieved?
Answer: C. Create a custom IAM policy.
AWS managed policies are read-only, so the solution is creating a customer managed policy with the extra permissions. Remember, service control policies restrict rather than grant permissions, so that option fails.
Q4. A manager is planning to migrate applications to the AWS Cloud and needs to obtain AWS compliance reports. How can these reports be generated?
Answer: D. Download the reports from AWS Artifact.
AWS Artifact provides on-demand downloads of AWS security and compliance reports like SOC and PCI, so no human contact is required. Remember that Artifact gives you AWS's own compliance documents, while AWS Config tracks your own resources.
Q5. Which Amazon EC2 pricing model is the most cost-effective for an always-up, right-sized database server running a project that will last 1 year?
Answer: D. Standard Reserved Instances
A steady, right-sized workload running for a full year fits Standard Reserved Instances, which give the deepest discount with a one-year term. Spot is cheaper per hour but can be interrupted, and Convertible RIs trade savings for flexibility that is not needed here.
Q6. Which AWS service can be used to track the activity of users on AWS?
Answer: A. AWS CloudTrail
AWS CloudTrail records user and API activity across the account, answering who did what and when. CloudWatch monitors performance and metrics, not user actions, so it fails the auditing requirement in the wording.
Q7. Which AWS service or feature can be used to capture information about inbound and outbound IP traffic on network interfaces in a VPC?
Answer: D. VPC Flow Logs
VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, and can be sent to CloudWatch Logs or S3. CloudTrail only logs API calls, not network packet-level traffic.
Q8. Which IAM entity can be used for assigning permissions to multiple users?
Answer: B. IAM Group
An IAM Group is a collection of users, and policies attached to the group apply to every member, making bulk permission assignment easy. A role is assumed temporarily and is not the way to attach permissions to many users at once.
Q9. How can an organization track resource inventory and configuration history for the purpose of security and regulatory compliance?
Answer: C. Configure AWS Config with the resource types
AWS Config records resource inventory, configuration history, and configuration changes, which is exactly what compliance auditing of your own resources requires. Artifact covers AWS's compliance reports, and CloudTrail only tracks API activity.
Q10. A company has a website that delivers static content from an Amazon S3 bucket to users from around the world. Which AWS service will deliver the content with low latency?
Answer: B. Amazon CloudFront
Amazon CloudFront is a CDN that caches S3 static content at edge locations close to users, delivering low latency worldwide. Global Accelerator is the strongest distractor, but it routes traffic over the AWS network and does not cache content.
Q11. A user needs a quick way to determine if any Amazon EC2 instances have ports that allow unrestricted access. Which AWS service will support this requirement?
Answer: D. AWS Trusted Advisor
AWS Trusted Advisor includes security checks that flag security groups with unrestricted access on any port. VPC Flow Logs is the tempting distractor, but it only records IP traffic; it doesn't analyze security group rules for you.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days.