Practice for the AWS Certified Cloud Practitioner (CLF-C02) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A financial services company needs to retain its data for 10 years to meet compliance norms. Which Amazon Simple Storage. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- A financial services company needs to retain its data for 10 years to meet compliance norms. Which Amazon Sim…
- Which of the following is the least effort way to encrypt data for AWS services only in your AWS account usin…
- A manufacturing company is looking at a service that can offer AWS infrastructure, AWS services, APIs, and to…
- Which of the following will help you control the incoming traffic to an Amazon EC2 instance?
- A security group has been changed in an AWS account, and the manager of the account has asked you to find out…
- A company is looking at real-time processing of streaming big data for their ad-tech platform. Which of the f…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A financial services company needs to retain its data for 10 years to meet compliance norms. Which Amazon Simple Storage Service (Amazon S3) storage class is the best fit for this use case considering that the data has to be stored at a mi…
Answer: B. Amazon S3 Glacier Deep Archive
Amazon S3 Glacier Deep Archive is the lowest-cost storage class, explicitly designed for long-term retention and compliance needs spanning seven to ten years. Standard-IA is more expensive for long-term storage, making Deep Archive the definitive choice when minimizing cost is the primary objective.
Q2. Which of the following is the least effort way to encrypt data for AWS services only in your AWS account using AWS Key Management Service (KMS)?
Answer: D. Use AWS managed master keys that are automatically created in your account for each service
AWS managed keys are automatically created in your account for integrated services, providing encryption with the absolute least administrative effort. Customer managed keys require manual policy configuration, and AWS owned keys are completely invisible and shared across multiple accounts.
Q3. A manufacturing company is looking at a service that can offer AWS infrastructure, AWS services, APIs, and tools to its on-premises data center for running low latency applications. Which of the following service/tool is the best fit for t…
Answer: B. AWS Outposts
AWS Outposts delivers native AWS infrastructure, services, and APIs directly into your on-premises data centers to support hybrid workloads requiring ultra-low latency. Contrast this with Local Zones, which extend AWS infrastructure into major metropolitan areas rather than your private facilities.
Q4. Which of the following will help you control the incoming traffic to an Amazon EC2 instance?
Answer: D. Security Group
A security group acts as a virtual firewall at the instance level to control incoming and outgoing traffic. A network ACL secures the entire subnet, while route tables only dictate where network traffic is directed.
Q5. A security group has been changed in an AWS account, and the manager of the account has asked you to find out the details of the user who changed it. As a Cloud Practitioner, which AWS service will you use to fetch the necessary informatio…
Answer: B. AWS CloudTrail
AWS CloudTrail records user activity and API calls, making it the correct choice for auditing account changes like modified security groups. Amazon Inspector assesses vulnerabilities, while Trusted Advisor offers best practice checks.
Q6. A company is looking at real-time processing of streaming big data for their ad-tech platform. Which of the following AWS services is the right choice for this requirement?
Answer: D. Amazon Kinesis Data Streams
Amazon Kinesis Data Streams is the correct choice because it is purpose-built to continuously capture and process real-time streaming data. For the exam, remember Kinesis handles streaming data, whereas Amazon Redshift and EMR are used for batch processing and data warehousing.
Q7. A team manager needs data about the changes that have taken place for AWS resources in his account during the past two weeks. Which AWS service can help get this data?
Answer: B. AWS Config
AWS Config is the correct service because it records and evaluates the configurations of your AWS resources over time. Do not confuse this with CloudTrail, which records API calls and user activity for auditing who made a change.
Q8. Which of the following AWS services will help provision a logically isolated network for your AWS resources?
Answer: B. Amazon Virtual Private Cloud (Amazon VPC)
Amazon Virtual Private Cloud is correct because it provisions an isolated virtual network where you can launch AWS resources securely. For the exam, associate basic network isolation directly with Amazon VPC.
Q9. Which of the following AWS services can be used to continuously monitor both malicious activities as well as unauthorized behavior to protect your AWS accounts and workloads?
Answer: D. Amazon GuardDuty
Amazon GuardDuty is the correct choice because it is an intelligent threat detection service that monitors for malicious activity. Security Hub aggregates findings, while Detective investigates existing issues.
Q10. Which free tool helps to review the state of your workloads and compares them to the latest AWS architectural best practices after you have answered a series of questions about your workload?
Answer: B. AWS Well-Architected Tool
The AWS Well-Architected Tool is correct because it provides a structured way to review your workloads against architectural best practices. Trusted Advisor optimizes infrastructure but does not evaluate workload architecture.
Q11. An organization is looking to break down its AWS spending so that each department and project can be accurately charged for the resources they consume. Which AWS feature or service is the best fit for this use-case?
Answer: C. AWS cost allocation tags
AWS cost allocation tags are correct because they let you assign metadata to resources for granular billing visibility. While the Cost and Usage Report displays spending, those reports depend completely on these tags to organize the data.
Q12. A company is moving its on-premises application to AWS Cloud. The application uses in-memory caches for running custom workloads. Which Amazon Elastic Compute Cloud (Amazon EC2) instance type is the right choice for the given requirement?
Answer: B. Memory Optimized instance types
Memory optimized instances are correct because they deliver fast performance for workloads processing large data sets in memory. On the exam, immediately map in-memory databases and caches to this instance family.
Q13. Per the AWS Shared Responsibility Model, management of which of the following AWS services is the responsibility of the customer?
Answer: D. Amazon Elastic Compute Cloud (Amazon EC2)
Under the shared responsibility model, EC2 is an infrastructure as a service offering, so you must manage the guest operating system and its security. For abstracted services like S3 and DynamoDB, AWS handles the underlying infrastructure and operating systems entirely.
Q14. An e-learning company wants to build a knowledge graph by leveraging a fully managed database. Which of the following is the best fit for this requirement?
Answer: B. Amazon Neptune
Amazon Neptune is a fully managed graph database optimized for storing billions of relationships, making it perfect for building knowledge graphs. RDS and DocumentDB handle relational and document workloads respectively, not highly connected graph datasets.
Q15. Which of the following are the security best practices suggested by AWS for Identity and Access Management (IAM)? (Select two)
Answer: A,E. Do not share security credentials between accounts, use IAM roles instead || When you create IAM policies, grant the least privileges required to perform a task
Applying least privilege and using IAM roles instead of sharing credentials are foundational AWS security best practices. You should never share root user credentials, and MFA protects an account rather than distributing root access to multiple users.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.