Practice for the AWS Certified Cloud Practitioner (CLF-C02) exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A developer has written a simple web application in PHP and wants to just upload the code to AWS Cloud and have AWS hand. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- A developer has written a simple web application in PHP and wants to just upload the code to AWS Cloud and ha…
- According to the AWS Shared Responsibility Model, which of the following are responsibilities of the customer…
- A photo sharing web application wants to store thumbnails of user-uploaded images on Amazon Simple Storage Se…
- Which of the following statements is correct for a Security Group and a Network Access Control List (Network…
- What are the fundamental drivers of cost with AWS Cloud?
- Which of the following statement is correct regarding the AWS pricing policy for data transfer charges into o…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A developer has written a simple web application in PHP and wants to just upload the code to AWS Cloud and have AWS handle the deployment automatically, but still wants access to the underlying operating system for further enhancements. As…
Answer: C. AWS Elastic Beanstalk
AWS Elastic Beanstalk automatically handles deployment and capacity provisioning while retaining full access to underlying resources. EC2 requires manual deployment, and CloudFormation requires explicit resource templates.
Q2. According to the AWS Shared Responsibility Model, which of the following are responsibilities of the customer for Amazon RDS?
Answer: A. Database encryption
Under the Shared Responsibility Model, the customer manages data security, including database encryption. AWS handles the underlying infrastructure, server hardware, and operating system patching for managed services.
Q3. A photo sharing web application wants to store thumbnails of user-uploaded images on Amazon Simple Storage Service (Amazon S3). The thumbnails are rarely used but need to be immediately accessible from the web application. The thumbnails c…
Answer: C. Use Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA) to store the thumbnails
Amazon S3 One Zone-Infrequent Access is the most cost-effective tier for rarely accessed, easily regenerable data needing immediate retrieval. Standard-IA is more expensive because it stores data across multiple Availability Zones.
Q4. Which of the following statements is correct for a Security Group and a Network Access Control List (Network ACL)?
Answer: D. Security Group acts as a firewall at the instance level whereas Network Access Control List (Network ACL) acts as a firewall at the subnet level
Security groups operate at the instance level to control traffic, while network ACLs operate at the subnet level. Remember this exam cue: security groups are stateful, whereas network ACLs are stateless.
Q5. What are the fundamental drivers of cost with AWS Cloud?
Answer: A. Compute, Storage and Outbound Data Transfer
Compute, storage, and outbound data transfer are correct because these are the three fundamental pricing drivers across AWS services. As a practical exam cue, remember that inbound data transfer is typically free, which immediately eliminates any option pairing compute and storage with inbound traffic.
Q6. Which of the following statement is correct regarding the AWS pricing policy for data transfer charges into or out of an AWS Region?
Answer: D. Only outbound data transfer is charged
Only outbound data transfer is charged because AWS does not bill for data incoming from the internet into its regions. Outbound data is aggregated and billed at region specific tiered rates, making inbound transfer a consistently free service across standard exam scenarios.
Q7. Multi-AZ deployment is an example of which of the following?
Answer: A. High Availability
High availability is correct because deploying resources across multiple Availability Zones ensures your architecture can withstand a single data center failure. Scaling out involves adding more instances to handle increased load, whereas multi AZ focuses strictly on resilience and uptime.
Q8. Which AWS technology/service helps you to scale your resources to match supply with demand while still keeping your cloud solution cost-effective?
Answer: B. AWS Auto Scaling
AWS Auto Scaling automatically adjusts compute capacity to match demand, ensuring steady performance at the lowest possible cost. Cost Explorer is only a reporting tool for visualizing past spending, so it lacks the capability to actively scale your resources.
Q9. A customer has created a VPC and a subnet within AWS Cloud. Which of the following statements is correct?
Answer: D. An Amazon Virtual Private Cloud (Amazon VPC) spans all of the Availability Zones (AZ) in the Region whereas a subnet spans only one Availability Zone (AZ) in the Region
A virtual private cloud spans all Availability Zones within a specific Region, providing a broad isolated network boundary. In contrast, a subnet must be confined to a single Availability Zone to provide highly available architectural designs.
Q10. A company is using a message broker service on its on-premises application and wants to move this messaging functionality to AWS Cloud. Which of the following AWS services is the right choice to move the existing functionality easily?
Answer: D. Amazon MQ
Amazon MQ is a managed broker service for ActiveMQ and RabbitMQ, designed specifically for easily migrating existing messaging applications to AWS. Use SQS and SNS when building brand new cloud-native applications rather than lifting and shifting legacy code.
Q11. Which characteristic of Cloud Computing imparts the ability to acquire resources as you need and release when you no longer need them?
Answer: C. Elasticity
Elasticity refers to the ability to acquire resources as needed and release them when they are no longer required, matching capacity to dynamic demand. Reliability and durability describe system uptime and data protection, not dynamic resource scaling.
Q12. Which AWS service can be used to store, manage, and deploy Docker container images?
Answer: A. Amazon Elastic Container Registry (Amazon ECR)
Amazon Elastic Container Registry is a fully managed service used to store, manage, and deploy Docker container images securely. Do not confuse this with Amazon ECS, which actually runs and orchestrates the containers rather than storing the images.
Q13. A social media company wants to protect its web application from common web exploits such as SQL injection and cross-site scripting. Which of the following AWS services can be used to address this use-case?
Answer: C. AWS Web Application Firewall (AWS WAF)
The Web Application Firewall protects web applications from common exploits like SQL injection and cross-site scripting by filtering malicious traffic. GuardDuty focuses on broader account threat detection, lacking specific layer seven application filtering capabilities.
Q14. Which AWS service would you use to send alerts when the costs for your AWS account exceed your budgeted amount?
Answer: B. AWS Budgets
AWS Budgets allows you to set custom cost or usage budgets and trigger alerts when thresholds are exceeded. As a helpful exam tip, AWS Cost Explorer is used for visualizing historical data rather than triggering proactive billing alerts.
Q15. The engineering team at an IT company wants to monitor the CPU utilization for its fleet of Amazon Elastic Compute Cloud (Amazon EC2) instances and send an email to the administrator if the utilization exceeds 80%. As a Cloud Practitioner…
Answer: B,D. Amazon Simple Notification Service (SNS) || Amazon CloudWatch
Amazon CloudWatch monitors metrics like CPU utilization and can trigger alarms, which then use Amazon SNS to send email notifications. SQS is a queue service and CloudTrail tracks API activity, so they do not fit operational metric alerting.
Q16. An organization has a complex IT architecture involving a lot of system dependencies and it wants to track the history of changes to each resource. Which AWS service will help the organization track the history of configuration changes for…
Answer: D. AWS Config
AWS Config continuously monitors and records resource configurations, allowing you to track historical changes and map dependencies. CloudTrail records API account activity rather than tracking state changes of the resources themselves.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.