11 CLF-C02 practice questions with answer reveals and spoken explanations. Choose before the reveal and keep your score.
Certification: AWS Certified Cloud Practitioner (CLF-C02). Independent practice, not an official exam.
How to use this round:
– Pause each question if you need more time to decide.
– Compare your answer after the reveal.
– Review the concepts you missed, then practice again.
Practice free with CertPunch:
Web: https://certpunch.com/
iPhone and iPad: https://apps.apple.com/app/certpunch/id6797541734
Android: https://play.google.com/store/apps/details?id=com.certpunch.app
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- When storing passwords on AWS, what is the MOST secure method?
- What are two components of Amazon S3? (Select TWO.)
- Which AWS service uses machine learning to analyze historical usage patterns and identify the optimal AWS res…
- Which of the following are architectural best practices for the AWS Cloud? (Select TWO.)
- A user has an AWS account with a Business-level AWS Support plan and needs assistance with handling a product…
- Which Amazon EC2 pricing model should be used to comply with per-core software license requirements?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. When storing passwords on AWS, what is the MOST secure method?
Answer: C. Store passwords in AWS Secrets Manager.
AWS Secrets Manager is purpose-built for storing, rotating, and retrieving credentials like passwords securely. An S3 bucket, even encrypted, lacks built-in rotation and access controls designed specifically for secrets.
Q2. What are two components of Amazon S3? (Select TWO.)
Answer: B,E. Buckets || Objects
Amazon S3 stores data as objects inside buckets, which are the two core building blocks of the service. Directories, block devices, and file systems belong to file and block storage offerings like EFS and EBS, not S3.
Q3. Which AWS service uses machine learning to analyze historical usage patterns and identify the optimal AWS resources for reducing costs and improving performance for your workloads?
Answer: C. AWS Compute Optimizer
AWS Compute Optimizer uses machine learning on historical usage to recommend optimal resources that lower cost and improve performance. Cost Explorer and Budgets only track and manage spending, while Trusted Advisor gives best-practice checks without ML-based sizing.
Q4. Which of the following are architectural best practices for the AWS Cloud? (Select TWO.)
Answer: B,D. Deploy into multiple Availability Zones || Design for fault tolerance
Deploying across multiple Availability Zones and designing for fault tolerance are core cloud design principles. Close coupling, monolithic architectures, and single-AZ deployments all increase the blast radius of a single failure.
Q5. A user has an AWS account with a Business-level AWS Support plan and needs assistance with handling a production service disruption. Which action should the user take?
Answer: B. Open a production system down support case
A production system down case is the correct severity for a Business support plan outage, with a one-hour response target. Business-critical system down, the concierge team, and a dedicated TAM are exclusive to the Enterprise support plan.
Q6. Which Amazon EC2 pricing model should be used to comply with per-core software license requirements?
Answer: C. Dedicated Hosts
Dedicated Hosts give you a physical server fully dedicated to your use, which lets you use per-core software licenses from vendors like Microsoft or Oracle. On-Demand and Reserved Instances are shared tenancy models, so they don't satisfy per-core license requirements.
Q7. As part of its cloud architecture, a company wants its workloads to be resilient, perform correctly, consistently, and recover from errors in a timely manner. Which pillar of the AWS Well-Architected Framework are these requirements relate…
Answer: B. Reliability
Resilience, consistent correct operation, and timely recovery from failures are the definition of the Reliability pillar. Operational excellence is about running and improving systems day to day, not recovering from failures, so it fails here.
Q8. What AWS service offers managed DDoS protection?
Answer: D. AWS Shield
AWS Shield is the managed DDoS protection service, with Standard always-on and Advanced tiers. GuardDuty detects threats and Inspector scans for vulnerabilities, but neither mitigates DDoS attacks.
Q9. When an Amazon EC2 instance is stopped, which of the following AWS services can be used to identify the user who stopped it?
Answer: C. AWS CloudTrail
AWS CloudTrail records API calls, including who made them, from which IP, and when, so it identifies the user who stopped the EC2 instance. CloudWatch monitors metrics, and VPC Flow Logs only capture network traffic, not user identity.
Q10. Which AWS service lets you add user sign up, sign-in and access control to web and mobile apps?
Answer: B. Amazon Cognito
Amazon Cognito adds user sign-up, sign-in, and access control to web and mobile apps, scaling to millions of users. Directory Service manages Active Directory, while Artifact handles compliance documents, not application authentication.
Q11. Which AWS service monitors AWS accounts continuously for malicious activity and unauthorized behavior?
Answer: C. Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors accounts and workloads for malicious activity and unauthorized behavior. Inspector finds vulnerabilities and Macie discovers sensitive data in S3, so neither fits threat monitoring.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days.