Practice for the AWS Certified Cloud Practitioner (CLF-C02) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: According to the AWS Shared Responsibility Model, which of the following are the responsibilities of AWS? (Select two). Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- According to the AWS Shared Responsibility Model, which of the following are the responsibilities of AWS? (Se…
- What is the primary use case for Amazon GuardDuty?
- Which AWS service can inspect Amazon CloudFront distributions running on any HTTP web server?
- Which of the following are the advantages of using the AWS Cloud? (Select TWO)
- Which AWS service can be used to send, store, and receive messages between software components at any volume…
- Which Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling feature can help with fault tolerance?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. According to the AWS Shared Responsibility Model, which of the following are the responsibilities of AWS? (Select two)
Answer: C,D. Data center security || Network operability
Under the Shared Responsibility Model, AWS handles security of the cloud, including physical data center security and network operability. Customers must handle security in the cloud, which includes patching guest operating systems and configuring access.
Q2. What is the primary use case for Amazon GuardDuty?
Answer: C. Detecting malicious activity and threats in your AWS accounts and workloads
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior. For the exam, do not confuse this with the Web Application Firewall, which actively blocks common web exploits.
Q3. Which AWS service can inspect Amazon CloudFront distributions running on any HTTP web server?
Answer: D. AWS Web Application Firewall (AWS WAF)
AWS WAF protects web applications by inspecting HTTP requests forwarded to Amazon CloudFront. This allows you to block malicious traffic at the edge locations before it ever reaches your origin servers.
Q4. Which of the following are the advantages of using the AWS Cloud? (Select TWO)
Answer: D,E. Stop guessing about capacity || Increase speed and agility
Stop guessing capacity and increase speed and agility are core advantages of cloud computing. Remember that cloud computing shifts expenses from upfront capital expenditures to flexible operational expenses.
Q5. Which AWS service can be used to send, store, and receive messages between software components at any volume to decouple application tiers?
Answer: A. Amazon Simple Queue Service (Amazon SQS)
Amazon Simple Queue Service securely decouples application tiers by letting you send, store, and receive messages between software components. Simple Notification Service is pub/sub and pushes messages, whereas queues pull and retain them.
Q6. Which Amazon Elastic Compute Cloud (Amazon EC2) Auto Scaling feature can help with fault tolerance?
Answer: B. Replacing unhealthy Amazon EC2 instances
Amazon EC2 Auto Scaling improves fault tolerance by automatically detecting and replacing unhealthy instances to maintain application availability. Distributing load is a feature of Elastic Load Balancing, which works alongside Auto Scaling but serves a different purpose.
Q7. Which of the following statements is an AWS best practice when architecting for the Cloud?
Answer: B. Automation
Automation is a core AWS architectural best practice because it improves system stability and operational efficiency. For the exam, associate the other options with anti-patterns: AWS promotes loose coupling, services over servers, and security as the top priority.
Q8. Which of the following options are the benefits of using AWS Elastic Load Balancing (ELB)? (Select TWO)
Answer: D,E. High availability || Fault tolerance
Elastic Load Balancing provides high availability and fault tolerance by automatically distributing incoming traffic across multiple healthy targets. It does not provide storage, and while it helps optimize resource use, its primary value is resilience, not direct cost reduction.
Q9. Which of the following AWS Support plans is the MOST cost-effective when getting enhanced technical support by Cloud Support Engineers?
Answer: D. AWS Business Support
AWS Business Support is the most cost-effective plan that provides enhanced technical support from Cloud Support Engineers. Enterprise Support also offers this but is significantly more expensive, while Developer and Basic tiers do not provide full engineer access.
Q10. Which types of monitoring can be provided by Amazon CloudWatch? (Select TWO)
Answer: B,C. Resource utilization || Application performance
Amazon CloudWatch provides visibility into resource utilization and application performance for AWS workloads. Remember that CloudTrail records API access, while the AWS Health Dashboard shows the overall availability of regional AWS services.
Q11. Which of the following AWS Identity and Access Management (AWS IAM) Security Tools allows you to review permissions granted to an IAM user?
Answer: D. AWS Identity and Access Management (IAM) access advisor
IAM access advisor displays the service permissions granted to a user and when they were last accessed, helping you identify unnecessary permissions. The credentials report only lists credential status, such as password or key rotation, not the attached permissions.
Q12. Which of the following statements is the MOST accurate when describing AWS Elastic Beanstalk?
Answer: D. It is a Platform as a Service (PaaS) that allows you to deploy and scale web applications and services
AWS Elastic Beanstalk is a Platform as a Service offering that automatically handles deployment, capacity provisioning, and scaling for web applications. Distinguish it from CloudFormation, which is an Infrastructure as Code tool used to model and provision resources.
Q13. A company needs to keep sensitive data in its own data center due to compliance but would still like to deploy resources using AWS. Which cloud deployment model does this refer to?
Answer: A. Hybrid Cloud
A hybrid cloud deployment connects AWS cloud resources with your existing on-premises infrastructure. Remember that private cloud refers to an isolated environment running solely within AWS, while hybrid specifically mixes on-premises data centers and the public cloud.
Q14. An engineering team is new to the AWS Cloud and would like to launch a dev/test environment with low monthly pricing. Which AWS service can address this use case?
Answer: C. Amazon LightSail
Amazon Lightsail is a virtual private server service designed for easy deployment at a low, predictable monthly price, making it ideal for beginners. Standard EC2 requires more networking configuration, making it overly complex for simple dev/test environments.
Q15. Which of the following statements is CORRECT regarding the scope of an Amazon Virtual Private Cloud (VPC)?
Answer: C. A VPC spans all Availability Zones (AZs) within an AWS region
A Virtual Private Cloud spans all Availability Zones within a single, specific AWS Region. Remember that a subnet is confined to a single Availability Zone, while the overarching VPC operates at the regional level.
Q16. Which security control tool can be used to deny traffic from a specific IP address?
Answer: B. Network Access Control List (network ACL)
A network access control list can explicitly deny traffic from specific IP addresses at the subnet level. A practical exam cue is that security groups are stateful and only allow rules, so you must use stateless network ACLs to explicitly block bad IP addresses.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.