AWS Certified Cloud Practitioner (CLF-C02)

Correct answer: A. Spot Instance

Spot Instances are ideal for flexible workloads that can tolerate interruptions, offering steep discounts compared to On-Demand pricing. As a practical exam cue, always match the phrase 'can be interrupted' directly to Spot Instances to find the most cost-effective option.

Correct answer: B. Cost Optimization · C. Service Limits

Trusted Advisor inspects your AWS environment and recommends best practices across five pillars: cost optimization, performance, security, fault tolerance, and service limits. For the exam, remember that Trusted Advisor specifically tracks service limits to help you avoid throttling.

Correct answer: D. AWS Cost & Usage Report (AWS CUR)

The AWS Cost and Usage Report publishes comprehensive billing data into an S3 bucket and allows you to break down costs hourly. Cost Explorer is the strongest distractor, but it only provides visual dashboards rather than detailed raw data exports.

Correct answer: A. A security group is stateful, that is, it automatically allows the return traffic · D. A network access control list (network ACL) contains a numbered list of rules and evaluates these rules in the increasing order while deciding whether to allow the traffic

Security groups are stateful, automatically allowing return traffic regardless of inbound rules. Network access control lists are stateless, meaning you must explicitly allow return traffic, and they evaluate numbered rules sequentially from lowest to highest.

Correct answer: D. AWS Lambda

AWS Lambda is a serverless compute service that runs code in response to events like S3 object uploads. While Simple Queue Service can receive S3 event notifications, it cannot execute code itself, making Lambda the correct choice.

Correct answer: C. Operational Excellence

The Operational Excellence pillar champions running and monitoring systems, which includes managing infrastructure as code. For your exam, associate the practice of automating operational procedures and infrastructure deployments directly with this specific pillar.

Correct answer: D. Number of requests for the AWS Lambda function · E. The time it takes for the AWS Lambda function to execute

AWS Lambda bills you based on the total number of requests and the execution duration of your code. The deployment package size only affects storage limits, while your programming language runtime choice has no impact on the final price.

Correct answer: B. Amazon Redshift

Amazon Redshift is the correct choice because it is a fully managed data warehouse designed specifically for running complex analytical queries. For the exam, remember that traditional databases like Amazon RDS handle transactional workloads, whereas Redshift targets analytics and reporting.

Correct answer: C. Use Amazon CloudWatch Logs for both the Amazon Elastic Compute Cloud (Amazon EC2) instance and the on-premises servers

Amazon CloudWatch Logs is correct because it can monitor and store log files from both Amazon EC2 instances and on-premises servers, creating a centralized location. Be careful not to choose AWS CloudTrail, which specifically records API activity for AWS accounts rather than application server logs.

Correct answer: D. Amazon S3 Glacier Flexible Retrieval

Amazon S3 Glacier Flexible Retrieval is the correct choice because it provides low-cost storage designed specifically for long-term archiving and backups. For the exam, use One Zone-Infrequent Access for rarely accessed but quickly needed data, and use Glacier classes when immediate retrieval is unnecessary.

Correct answer: D. Use Amazon CloudFront to improve the performance of your website

Amazon CloudFront caches your static website files at edge locations globally, significantly reducing latency for international users. S3 Transfer Acceleration is for uploads, not downloads, making it the strongest distractor for this scenario.

Correct answer: A. AWS Transit Gateway

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs, simplifying complex network topologies. VPC peering is a weaker distractor because it requires separate connections for each pair and lacks transitive routing.

Correct answer: B. Read Replica improves database scalability

Amazon RDS Read Replicas improve database scalability by offloading read traffic from the primary instance. Do not confuse this with Multi-AZ deployments, which provide high availability and durability instead of scaling.

Correct answer: C. Auto Scaling group scales out and adds more number of Amazon EC2 instances to match an increase in demand · E. Auto Scaling group scales in and reduces the number of Amazon EC2 instances to match a decrease in demand

Auto Scaling groups scale horizontally by adding instances during scale out and removing instances during scale in. Upgrading to larger instance sizes is scaling vertically, which Auto Scaling groups do not handle automatically.

Correct answer: D. Amazon GuardDuty

Amazon GuardDuty is an intelligent threat detection service that continuously monitors for malicious activity across your AWS accounts. CloudTrail records API activity for auditing, but it does not actively detect threats.

Correct answer: B. AWS Region

An AWS Region is a physical geographic location hosting AWS data centers, forming the foundation of the AWS Global Infrastructure. VPCs and subnets are logical customer constructs you build inside those regions.

Correct answer: B. Use S3 cross-region replication (S3 CRR) to replicate data between distant AWS Regions

S3 Cross-Region Replication asynchronously copies your objects to a bucket in a different region, meeting compliance needs efficiently. Writing custom Lambda functions or EC2 scripts is a distractor that requires unnecessary operational overhead.

Correct answer: A. Operating system patches and updates of an Amazon Elastic Compute Cloud (Amazon EC2) instance · D. Managing IAM users and roles

Under the Shared Responsibility Model, customers handle security in the cloud, including EC2 operating system patches and IAM management. AWS is responsible for the global network security and protecting the underlying physical infrastructure.

Correct answer: A. AWS CodeDeploy

AWS CodeDeploy is correct because it specifically automates software deployments to both Amazon EC2 instances and on-premises servers. Remember that AWS CodePipeline only orchestrates the overall continuous delivery workflow by integrating various tools, while AWS CodeCommit securely hosts the source code repositories.

Correct answer: A. AWS is responsible for Security 'of' the Cloud · C. For abstracted services like Amazon S3, AWS operates the infrastructure layer, the operating system, and platforms

AWS is responsible for security of the cloud, managing the physical infrastructure and host operating systems. For abstracted services like S3, AWS fully manages the underlying platform, whereas customers handle guest operating systems and application security.

Correct answer: B. Amazon S3 Versioning

Amazon S3 Versioning is the right choice because it preserves, retrieves, and restores every variant of an object, directly protecting against accidental deletion or overwrites. Lifecycle rules move data between storage classes, while Transfer Acceleration simply improves upload speeds.

Correct answer: C. Software as a service (SaaS)

Gmail represents Software as a Service because it provides a complete, fully managed application directly to the end user over the internet. For the exam, associate SaaS with finished applications managed entirely by the provider, whereas IaaS and PaaS require you to build or manage components.

Correct answer: A. Amazon S3 Glacier Deep Archive

Amazon S3 Glacier Deep Archive is the lowest-cost storage class, explicitly designed for long-term retention of data to meet strict regulatory compliance. While Glacier Flexible Retrieval is also for archives, it costs slightly more than the Deep Archive tier.

Correct answer: C. Amazon Kendra

Amazon Kendra is an intelligent search service that uses machine learning to extract precise answers from unstructured data like PDFs and text files. Remember that Comprehend only extracts insights and entities from text, whereas Kendra functions as a natural language search engine.

Correct answer: C. AWS Knowledge Center

The AWS Knowledge Center provides actionable solutions to the most frequent requests and common problems faced by AWS customers. The Support Center is a strong distractor, but it is used to open and manage technical support cases rather than browse self-service articles.

Correct answer: B. Amazon S3 One Zone-Infrequent Access (S3 One Zone-IA)

S3 One Zone-Infrequent Access stores data in a single Availability Zone, giving it the lowest availability of all S3 classes. Standard and Intelligent-Tiering span multiple Availability Zones, while Glacier is primarily designed for long-term archival.

Correct answer: C. Failover routing

Failover routing routes traffic to a secondary resource only when the primary resource fails health checks, creating an active-passive setup. Weighted routing splits traffic proportionally, which is used for load balancing or testing rather than simple failover.

Correct answer: B. Amazon ElastiCache

ElastiCache is a fully managed in-memory data store that delivers microsecond latency for caching and real-time workloads. RDS relies on disk-backed storage, and DynamoDB is a serverless NoSQL database, so neither provides true in-memory performance.

Correct answer: B. Amazon Machine Image (AMI)

An Amazon Machine Image provides the required template information to launch an instance, including the operating system. EBS provides block storage, EFS provides file storage, and Lambda runs serverless code without requiring a launch template.

Correct answer: C. AWS Database Migration Service (AWS DMS) · E. AWS Snowball

Database Migration Service and Snowball directly facilitate large-scale data migration into AWS. Direct Connect and Site-to-Site VPN establish network connectivity but require you to provide the actual transfer mechanisms.

Correct answer: D. Maintain versions of an AWS Lambda function

Maintaining function versions is the correct answer because managing code and platform configurations remains the customer's responsibility under the shared responsibility model. AWS manages the underlying infrastructure and runtime environments, so patching operating systems or networking components is handled automatically by the provider.

Correct answer: C. AWS Storage Gateway · E. Amazon Simple Storage Service (Amazon S3)

Amazon S3 and AWS Storage Gateway both have encryption enabled automatically by default to protect your data. For the exam, remember that you must manually enable encryption on other storage services like EBS and EFS.

Correct answer: D. Instance Store · E. Amazon Elastic Block Store (Amazon EBS)

Instance Store and Amazon Elastic Block Store provide block-level storage. For the exam, remember that S3 is object storage, EFS is file storage, and ECS is a container orchestration service, not a storage type.

Correct answer: B. Amazon WAF

Amazon WAF is a web application firewall that lets you create geographic match conditions to block traffic from specific countries. Shield protects against DDoS attacks but does not handle geographic restrictions.

Correct answer: D. Virtual Multi-Factor Authentication (MFA) device

A virtual MFA device runs on a smartphone or tablet, generating time-based codes without requiring physical hardware. Hardware MFA and U2F security keys require carrying a separate physical device, which defeats the travel preference.

Correct answer: C. US East (N. Virginia) - us-east-1

CloudWatch billing metric data is always stored in the US East N. Virginia Region, representing worldwide charges. A common exam trap is assuming billing data is stored in the region where the resources are actually provisioned.

Correct answer: B. AWS Config

AWS Config records resource configurations over time, enabling compliance auditing and historical troubleshooting. CloudTrail tracks API calls and user activity, while Config focuses specifically on the state of the resources themselves.

Correct answer: C. AWS Health Dashboard – Your account health

The AWS Health Dashboard alerts you to events affecting your specific resources and provides remediation guidance. Trusted Advisor offers general best practice checks, whereas the Health Dashboard is targeted to your exact account resources.

Correct answer: B. Rotate credentials regularly · D. Enable multi-factor authentication (MFA) for all users

Rotating credentials regularly and enabling multi-factor authentication are fundamental IAM security best practices. Always apply least privilege and never share account credentials or root user access keys.

Correct answer: C. Storing files in an accessible location to satisfy audit requirements

EFS Standard Infrequent Access offers lower costs for files accessed less frequently while remaining readily accessible for audits. It is a multi-zone file system, whereas One Zone is for single availability zone storage.

Correct answer: D. VPC Endpoint

A VPC endpoint privately connects your virtual private cloud to services like S3 without needing an internet gateway. Remember that S3 and DynamoDB use gateway endpoints, while most other services use interface endpoints.

Correct answer: B. Effect, Action

Effect and Action are mandatory elements within an IAM policy statement, defining whether access is allowed or denied and the specific operations. Elements like Sid and Condition are optional, providing extra logic or labeling.

Correct answer: D. Fix the Amazon S3 bucket policy

Fixing the Amazon S3 bucket policy resolves access issues by explicitly allowing the necessary public read permissions for website hosting. For the exam, remember that configuring static website hosting requires disabling block public access settings and attaching a valid bucket policy.

Correct answer: A. Deploy the Amazon Elastic Compute Cloud (Amazon EC2) instances across different Availability Zones (AZ) in the same AWS Region

Deploying Amazon EC2 instances across different Availability Zones in the same Region correctly improves availability by isolating workloads from localized failures. Remember that Availability Zones are physically separated data centers within a single Region, not spanning multiple Regions.

Correct answer: A. EC2 instances can access files on an Amazon Elastic File System (Amazon EFS) file system across many Availability Zones (AZ), Regions and VPCs

Amazon Elastic File System is a regional service natively accessible across multiple Availability Zones, VPCs, and even different Regions using peering connections. Distractors incorrectly restrict this access, but the service inherently provides broad, shared file storage for Linux-based workloads.

Correct answer: C. You must activate both AWS generated tags and user-defined tags separately before they can appear in Cost Explorer or on a cost allocation report · D. For each resource, each tag key must be unique, and each tag key can have only one value

Each tag key must be unique per resource and have exactly one value. Additionally, both user-defined and AWS-generated cost allocation tags must be individually activated in the billing console before they appear in Cost Explorer.

Correct answer: C. Identify objects in a photo

Amazon Rekognition identifies objects, people, text, and scenes in photos, acting as a ready-to-use machine learning feature. It does not handle basic image manipulation tasks like resizing or converting to greyscale, which require different image processing services.

Correct answer: C. Instance Store

An instance store provides temporary, high-speed block storage physically attached to the host computer, making it perfect for fast caches and scratch data. Block storage like EBS is persistent, but it cannot match the raw hardware speed needed for temporary data caching.

Correct answer: A. AWS Snowball

AWS Snowball provides physical devices to move massive datasets offline, bypassing the network constraints of limited bandwidth entirely. Direct Connect takes months to provision and still relies on high-capacity physical network lines, which fails the limited bandwidth constraint.

Correct answer: C. Usage budget · E. Reservation budget · F. Cost budget

AWS Budgets lets you create cost, usage, and reservation budgets to track your cloud spending and resource utilization. You can also track Savings Plans, but hardware, software, and resource budgets are not actual features tested on the exam.

Correct answer: D. Customer gateway · E. Virtual private gateway (VGW)

An AWS Site-to-Site VPN requires a virtual private gateway on the AWS side and a customer gateway representing your on-premises network hardware. Remember that an internet gateway simply allows public traffic into a VPC, while a NAT gateway handles private subnet outbound traffic.

Correct answer: B. AWS Cost Explorer · C. AWS Trusted Advisor

Trusted Advisor and Cost Explorer both identify underutilized instances right out of the box with automated rightsizing recommendations. CloudWatch requires manual configuration of alarms and metrics to monitor utilization, so it does not fit the requirement.

Correct answer: C. Business Perspective

The Business Perspective ensures IT investments align with business objectives and deliver measurable value. The Platform Perspective handles technical architecture, while the Governance Perspective focuses on risk and compliance management.

Correct answer: C. Amazon Elastic File System (Amazon EFS) · D. Amazon DynamoDB

DynamoDB and EFS provide built-in high availability by automatically replicating data across multiple availability zones. EBS volumes and subnets are confined to a single availability zone, meaning they require manual setup for resilience.

Correct answer: A. Create separate AWS accounts for development and production environments to receive separate invoices

Creating separate AWS accounts for each environment ensures you naturally receive separate monthly invoices. AWS Organizations actually consolidates billing into one central payer account, while Cost Explorer and tags only help visualize costs.

Correct answer: A. Amazon Elastic Container Service (Amazon ECS)

Amazon Elastic Container Service is correct because it allows you to run Docker containers while retaining direct access and control over the underlying servers. Contrast this with AWS Fargate, which is a serverless compute engine that removes the need to provision or manage any underlying infrastructure.

Correct answer: D. Penetration Testing

Penetration testing is the correct choice because AWS permits customers to perform security assessments on their own infrastructure without prior approval for several common services. Note that prohibited activities like network stress testing still strictly require special authorization from AWS.

Correct answer: A. Agility

Agility is correct because it specifically describes the cloud benefit of rapidly provisioning resources to accelerate development, testing, and launch cycles. Elasticity involves scaling resources dynamically based on real-time demand, whereas global deployment focuses on reducing latency worldwide.

Correct answer: C. AWS Shield Standard

AWS Shield Standard is automatically enabled for all AWS accounts at no extra cost, making its infrastructure security completely the responsibility of AWS. In contrast, services like WAF and Shield Advanced require customer configuration and management, placing them under customer responsibility.

Correct answer: C. You must use an Amazon Machine Image (AMI) from the same region as that of the Amazon EC2 instance. The region of the Amazon Machine Image (AMI) has no bearing on the performance of the Amazon EC2 instance

An Amazon Machine Image must exist in the same AWS Region where you plan to launch your EC2 instance. You can copy an image to the required region if needed, but the region itself only dictates deployment location and has no impact on instance performance.

Correct answer: A. AWS Lambda · E. Amazon Rekognition

AWS Lambda and Amazon Rekognition are regional services because they operate and maintain data within a specific geographic AWS Region. Remember that IAM, CloudFront, and WAF operate globally, meaning their configurations apply universally across all your active regions.

Correct answer: C. 72

Standard Reserved Instances offer a maximum discount of seventy-two percent compared to On-Demand Instance pricing. Memorize this specific seventy-two percent threshold for the exam, as it represents the upper limit of standard reservation savings.

Correct answer: C. AWS Shield Advanced offers protection against higher fees that could result from a DDoS attack

Shield Advanced includes cost protection, covering unanticipated scaling charges caused by a DDoS attack. The service requires an additional fee regardless of your support plan, so it is not a free inclusion for Business or Enterprise users.

Correct answer: A. Amazon Elastic Block Store (Amazon EBS) Snapshots are stored incrementally, which means you are billed only for the changed blocks stored · E. You will pay a fee each time you read from or write data stored on the Amazon Elastic File System (Amazon EFS) - Infrequent Access storage class

EBS snapshots are incremental, so you only pay for changed blocks. EFS Infrequent Access charges lower storage rates but applies access fees for reads and writes, optimizing costs for rarely accessed data.

Correct answer: C. The company should just start creating new resources in the destination AWS Region and then migrate the relevant data and applications into this new AWS Region

Regions are completely independent, so you must manually create new resources in the destination Region and migrate your data. AWS CloudFormation can deploy the new infrastructure, but it cannot automatically move existing data or applications across regions.