11 CLF-C02 practice questions with answer reveals and spoken explanations. Choose before the reveal and keep your score.
Certification: AWS Certified Cloud Practitioner (CLF-C02). Independent practice, not an official exam.
How to use this round:
– Pause each question if you need more time to decide.
– Compare your answer after the reveal.
– Review the concepts you missed, then practice again.
Practice free with CertPunch:
Web: https://certpunch.com/
iPhone and iPad: https://apps.apple.com/app/certpunch/id6797541734
Android: https://play.google.com/store/apps/details?id=com.certpunch.app
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Cloud Practitioner (CLF-C02) practice test →
What you will practice
- Which of the following can be used to identify a specific user who terminated an Amazon RDS DB instance?
- A Cloud Practitioner wants to configure the AWS CLI for programmatic access to AWS services. Which credential…
- Which of the following should be used to improve the security of access to the AWS Management Console? (Selec…
- According to the shared responsibility model, which security-related task is the responsibility of the custom…
- Which technology can automatically adjust compute capacity as demand for an application increases or decrease…
- How can an organization gain access to compliance reports natively through the AWS console?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which of the following can be used to identify a specific user who terminated an Amazon RDS DB instance?
Answer: C. AWS CloudTrail
AWS CloudTrail records API-level account activity, including who terminated the RDS instance, capturing user identity and event details. CloudWatch monitors performance metrics, while Inspector and Trusted Advisor handle security assessments and best-practice checks, not audit trails.
Q2. A Cloud Practitioner wants to configure the AWS CLI for programmatic access to AWS services. Which credential components are required? (Select TWO.)
Answer: B,E. A secret access key || An access key ID
Programmatic CLI access requires the access key ID and secret access key, which together authenticate AWS API requests. Public or private keys relate to encryption and EC2 key pairs, and IAM roles delegate access rather than configuring local CLI credentials.
Q3. Which of the following should be used to improve the security of access to the AWS Management Console? (Select TWO.)
Answer: A,C. Strong password policies || AWS Multi-Factor Authentication (AWS MFA)
Strong password policies and MFA directly strengthen Management Console sign-in security. Security groups control instance traffic, Secrets Manager stores credentials for applications, and ACM issues TLS certificates, none of which protect console logins.
Q4. According to the shared responsibility model, which security-related task is the responsibility of the customer?
Answer: D. Maintaining server-side encryption.
Under the shared responsibility model, the customer handles encryption of data in the cloud, including server-side encryption choices. Physical networking, hardware firewalls, and data center security fall to AWS as part of security of the cloud.
Q5. Which technology can automatically adjust compute capacity as demand for an application increases or decreases?
Answer: D. Auto Scaling
Auto Scaling automatically adds or removes compute capacity as demand changes, matching resources to load. Load balancing only distributes traffic, while high availability and fault tolerance describe resilience goals, not capacity adjustment mechanisms.
Q6. How can an organization gain access to compliance reports natively through the AWS console?
Answer: C. AWS Artifact
AWS Artifact provides on-demand access to AWS compliance reports and agreements directly from the console. Remember ACM handles SSL certificates and Security Hub manages security posture; Artifact is the exam keyword for audit and compliance documents.
Q7. A company needs a consistent and dedicated connection between AWS resources and an on-premise system. Which AWS service can fulfil this requirement?
Answer: D. AWS Direct Connect
AWS Direct Connect provides a private, dedicated physical link between on-premises and AWS, delivering consistent bandwidth since it bypasses the internet. A Managed VPN runs over the public internet, so its performance cannot be guaranteed as consistent.
Q8. According to the AWS Shared responsibility model, which two tasks are the responsibility of AWS? (Select TWO.)
Answer: C,E. Provide physical security for Availability Zones. || Patch the operating system of Amazon S3.
AWS owns security of the cloud, meaning physical security of Availability Zones and patching of managed services like S3's underlying platform. Customers handle their own data, encryption, and IAM permissions, so those distractors sit on the customer's side.
Q9. What should a Cloud Practitioner ensure when designing a highly available architecture on AWS?
Answer: C. The failure of a single component should not affect the application.
High availability means no single point of failure; one component failing should not bring the application down. Overprovisioning peak capacity wastes money, and a monolithic component actually creates a single point of failure.
Q10. A cloud practitioner needs to migrate 70 TB of data from an on-premises data center into the AWS Cloud. The company has a slow and unreliable internet connection. Which AWS service can the cloud practitioner leverage to transfer the data?
Answer: A. AWS Snowball
AWS Snowball uses a physical device to move large datasets, so a 70 TB transfer avoids the unreliable internet entirely. DataSync transfers over the network, Storage Gateway connects on-premises storage to cloud, and Glacier is an archival storage class, not a transfer service.
Q11. A company is migrating virtual machines (VMs) from their data center to the AWS Cloud. The company plans to deploy these migrated machines on Amazon EC2. Which cloud computing model will the company use for this operation?
Answer: A. Infrastructure as a Service (IaaS)
EC2 gives you raw compute, storage, and networking you manage yourself, which is the definition of Infrastructure as a Service. On the exam, remember the ladder: EC2 equals IaaS, Elastic Beanstalk equals PaaS, and Lambda maps to serverless or FaaS.
More AWS Certified Cloud Practitioner (CLF-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days.