Practice for the AWS Certified Cloud Practitioner (CLF-C02) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which of the following is the MOST cost-effective option to purchase an EC2 Reserved Instance (RI)?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- Which of the following is the MOST cost-effective option to purchase an EC2 Reserved Instance (RI)?
- A research group wants to use EC2 instances to run a scientific computation application that already has a fa…
- Which AWS Service can be used to mitigate a Distributed Denial of Service (DDoS) attack?
- A company wants to have control over creating and using its own keys for encryption on AWS services. Which of…
- Under the AWS Shared Responsibility Model, which of the following is a shared responsibility of both AWS and…
- Which tool/service will help you access AWS services using programming language-specific APIs?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which of the following is the MOST cost-effective option to purchase an EC2 Reserved Instance (RI)?
Answer: C. Partial upfront payment option with standard 3-years term
Reserved Instances offer the highest discounts for the longest commitments and largest upfront payments. However, the option missing a three-year all-upfront choice makes the partial upfront option conditionally correct based on the available selections. A three-year term always yields bigger savings than one year.
Q2. A research group wants to use EC2 instances to run a scientific computation application that already has a fault tolerant architecture. The application needs high-performance hardware disks that provide fast I/O performance. As a Cloud Pra…
Answer: A. Instance Store
Instance Store provides direct access to hardware disks, offering the fast I/O needed for computation without additional storage fees. EBS is a strong distractor, but it incurs extra costs and does not match the raw physical performance of attached hardware.
Q3. Which AWS Service can be used to mitigate a Distributed Denial of Service (DDoS) attack?
Answer: D. AWS Shield
AWS Shield is a managed service specifically designed to protect applications from distributed denial of service attacks. While CloudWatch monitors metrics and alerts you to anomalies, Shield actively provides the mitigation needed to stop the attack traffic.
Q4. A company wants to have control over creating and using its own keys for encryption on AWS services. Which of the following can be used for this use-case?
Answer: D. customer managed key (CMK)
Customer managed keys in AWS KMS give you complete control over your encryption keys, including their policies and rotation. AWS managed keys are handled by the service itself, meaning you cannot explicitly create or manage their underlying policies.
Q5. Under the AWS Shared Responsibility Model, which of the following is a shared responsibility of both AWS and the customer?
Answer: B. Configuration Management
Configuration management is a shared control where AWS secures its infrastructure while customers secure their own guest operating systems. Physical hardware maintenance and guaranteeing data separation between customers remain strictly the responsibility of AWS.
Q6. Which tool/service will help you access AWS services using programming language-specific APIs?
Answer: B. AWS Software Developer Kit (SDK)
The correct answer works because the AWS Software Development Kit provides language-specific APIs to interact with AWS services programmatically. The Command Line Interface is a unified tool for terminal management, but it is not designed to integrate directly into application source code.
Q7. Which of the following is CORRECT regarding removing an AWS account from AWS Organizations?
Answer: A. The AWS account must be able to operate as a standalone account. Only then it can be removed from AWS organizations
The correct answer works because a member account must have the required billing and contact details to operate as a standalone account before removal. Service Control Policies do not block deletion; they simply stop applying once the account leaves the organization.
Q8. A web application stores all of its data on Amazon S3 buckets. A client has mandated that data be encrypted before sending it to Amazon S3. Which of the following is the right technique for encrypting data as needed by the customer?
Answer: B. Enable client-side encryption using AWS encryption SDK
The correct answer works because client-side encryption ensures data is securely encrypted before it ever leaves your local environment for Amazon S3. Server-side encryption options are incorrect because they only protect data after it reaches the AWS servers.
Q9. A multi-national company has just moved its infrastructure from its on-premises data center to AWS Cloud. As part of the shared responsibility model, AWS is responsible for which of the following?
Answer: C. Physical and Environmental controls
The correct answer works because AWS manages the physical security and environmental controls of the data centers under the shared responsibility model. Patching guest operating systems and configuring applications remain strict responsibilities of the customer.
Q10. A multi-national corporation wants to get expert professional advice on migrating to AWS and managing their applications on AWS Cloud. Which of the following entities would you recommend for this engagement?
Answer: A. APN Consulting Partner
An APN Consulting Partner provides professional services to help companies design and migrate applications to AWS. While APN Technology Partners provide software solutions, they do not offer the direct professional management asked for here.
Q11. An intern at an IT company provisioned a Linux based On-demand EC2 instance with per-second billing but terminated it within 30 seconds as he wanted to provision another instance type. What is the duration for which the instance would be c…
Answer: C. 60 seconds
Linux EC2 instances have a 60-second minimum billing duration, so terminating after 30 seconds still incurs a one-minute charge. Windows instances historically had a higher minimum, but Linux per-second billing requires this minute minimum.
Q12. An organization needs to securely access AWS services and establish private connectivity between its Virtual Private Clouds (VPCs) and supported AWS services without using the public internet. Which AWS services can meet this requirement?…
Answer: C. AWS PrivateLink
AWS PrivateLink provides private connectivity between VPCs and supported AWS services without traversing the public internet. While Transit Gateway connects networks privately, remember that an Internet Gateway explicitly enables public access, contradicting the scenario requirements.
Q13. Which of the following AWS services has encryption enabled by default?
Answer: D. AWS CloudTrail Logs
CloudTrail encrypts log files by default using Amazon S3 managed keys when delivering to your bucket. Other storage options like EBS, EFS, and RDS are strong distractors, but they require manual configuration to enable encryption at rest.
Q14. Which options are common stakeholder roles for the AWS Cloud Adoption Framework (AWS CAF) platform perspective? (Select two)
Answer: A,C. Engineer || Chief Technology Officer (CTO)
The correct answer works because the platform perspective focuses on infrastructure provisioning and includes roles like the Chief Technology Officer and engineers. Remember that business leaders like the Chief Information Officer map to the business perspective instead.
Q15. A Project Manager, working on AWS for the first time, is confused about how credits are used in AWS. There are two credits available in the manager's account. Credit one is for $100, expires July 2022, and can be used for either Amazon S3…
Answer: A,D. Then, credit two is applied to the remaining $900 of Amazon EC2 usage || Credit one is applied, which expires in July, to the Amazon EC2 charge which leaves you with a $900 Amazon EC2 charge and a $500 Amazon S3 charge
AWS applies credits chronologically by expiration date, meaning the July credit is consumed first. Since both Amazon S3 and EC2 are eligible, the system applies it to the EC2 charge first. The remaining December credit is then applied to the remaining EC2 usage.
Q16. Compared to the on-demand instance prices, what is the highest possible discount offered for spot instances?
Answer: B. 90
Spot instances allow you to take advantage of unused EC2 capacity at a steep discount. For the exam, remember that spot instances offer up to a ninety percent discount compared to standard on-demand pricing.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.