AWS Certified Cloud Practitioner (CLF-C02)

Correct answer: A. Performance Efficiency

The Performance Efficiency pillar focuses on selecting the right resource types and sizes to match your workload requirements. Cost Optimization does overlap with sizing, but it strictly prioritizes avoiding unnecessary spend.

Correct answer: B. AWS Cost Explorer

AWS Cost Explorer lets you visualize historical usage and provides forecasting to predict future costs and usage. AWS Budgets sends alerts based on thresholds, but it relies on data rather than being the primary forecasting interface.

Correct answer: A. AWS Systems Manager

AWS Systems Manager provides a unified interface to view operational data and automate tasks across both AWS and on-premises servers. CloudFormation handles infrastructure as code, while Config assesses resource configuration compliance.

Correct answer: B. Credentials Report

The IAM Credentials Report lists all users in your account alongside the status of their passwords, access keys, and MFA devices. Trusted Advisor checks infrastructure, but the credentials report is the designated compliance auditing tool.

Correct answer: C. Simple routing

Simple routing is the correct choice because it configures standard DNS records to route traffic directly to a single resource, like a web server. Choose weighted routing to split traffic across multiple resources instead.

Correct answer: A. One or more data centers in the same location

An Availability Zone consists of one or more discrete data centers within a specific AWS Region. For the exam, remember that multiple locations define a Region, while a single location with redundant power and networking defines an Availability Zone.

Correct answer: C. IAM role

Using an IAM role grants an Amazon EC2 instance temporary credentials to securely access a DynamoDB table. Avoid embedding long-term IAM user access keys directly in applications, as this creates a significant security risk.

Correct answer: C. Volume discounts for Amazon EC2 and Amazon S3 aggregated across the member AWS accounts · D. Share the reserved Amazon EC2 instances amongst the member AWS accounts

AWS Organizations offers consolidated billing, enabling volume discounts and shared Reserved Instances across member accounts. Management tasks like patching instances or provisioning Spot Instances are handled by management services, not Organizations.

Correct answer: B. AWS CodeDeploy

AWS CodeDeploy is the specific service that automates code deployments directly to compute services like Amazon EC2. Elastic Beanstalk is an end-to-end platform, while CodeBuild compiles code, and CloudFormation provisions resources.

Correct answer: A. Amazon Simple Storage Service (Amazon S3)

Amazon S3 is the most effortless way to host a static website by simply configuring bucket permissions. Glacier is for archiving, Storage Gateway connects on-premises systems, and file systems like EFS require attached compute resources.

Correct answer: A. Amazon DynamoDB

Amazon DynamoDB is the correct choice because it is a non-relational, schemaless database that easily handles flexible data structures. For the exam, remember that services like RDS, Aurora, and Redshift are relational databases that require a rigid, predefined schema.

Correct answer: B. Internet Gateway · E. Subnet

Subnets and Internet Gateways are fundamental networking components that exist directly inside an Amazon Virtual Private Cloud. As a quick exam tip, easily eliminate the distractors because API Gateway and Storage Gateway are standalone services, while objects belong to S3 buckets.

Correct answer: B. AWS Transit Gateway · C. AWS Direct Connect

AWS Transit Gateway provides a central hub to route traffic between multiple VPCs, and AWS Direct Connect provides a dedicated, private network path from on-premises data centers into AWS. Avoid VPC peering here because managing individual connections between many networks quickly becomes overly complex.

Correct answer: A. Enable multi-factor authentication (MFA) on all accounts · E. Analyze user access patterns and review AWS Identity and Access Management (AWS IAM) permissions

Under the shared responsibility model, customers are strictly responsible for their own security in the cloud, which includes enabling multi-factor authentication and analyzing user access patterns. AWS handles the security of the underlying infrastructure, managing global networks and compliance validation independently.

Correct answer: C. Amazon S3 Replication

Amazon S3 Replication automatically and asynchronously copies objects across buckets while perfectly retaining all original metadata. On the exam, remember that storage classes simply tier data, Transfer Acceleration speeds up edge uploads, and bucket policies only grant access rather than moving data.

Correct answer: A. Amazon Relational Database Service (Amazon RDS) · E. Amazon Elastic Compute Cloud (Amazon EC2)

Reserved Instances are available for compute services like Amazon EC2 and relational databases like Amazon RDS to provide a billing discount for committed usage. Services such as IAM are free, while S3 and CloudFront do not offer reserved capacity because they are strictly metered by usage.

Correct answer: B. AWS Trusted Advisor

AWS Trusted Advisor is an account-level best practices tool that specifically checks for and flags underutilized Amazon EBS volumes to help optimize costs. While CloudWatch monitors performance metrics, it lacks the native account-wide cost analysis required to automatically identify these idle resources.

Correct answer: A. AWS Pricing Calculator

The AWS Pricing Calculator is designed to estimate potential cloud costs and model solutions before migration, helping compare on-premises infrastructure to AWS. Remember that Cost Explorer and Budgets are only used to track and monitor existing active account spending, not future estimates.

Correct answer: A. When you don't turn on user activity logging (AWS CloudTrail) · D. When you allow public access to Amazon S3 buckets

Trusted Advisor automatically checks for common security gaps like public S3 buckets and disabled CloudTrail logging. Sharing IAM credentials is an operational policy issue that the service cannot technically detect, whereas Glacier encrypts data by default.

Correct answer: A. Amazon S3 Transfer Acceleration (S3TA)

Amazon S3 Transfer Acceleration leverages CloudFront edge locations to speed up long-distance file uploads directly into a bucket. CloudFront only accelerates downloads to users, whereas Direct Connect requires physical setup.

Correct answer: A. Use Spot Instances for ad-hoc jobs that can be interrupted · C. Use Reserved Instances (RI) to run applications with a predictable usage over the next one year

Spot Instances provide the steepest discounts for stateless workloads that tolerate interruptions, while Reserved Instances offer billing discounts for predictable usage. On-Demand Instances offer no long-term savings, making them less cost-optimal.

Correct answer: A. AWS Global Accelerator provides static IP addresses that act as a fixed entry point to your applications · B. AWS Global Accelerator is a good fit for non-HTTP use cases

AWS Global Accelerator provides static IP addresses acting as fixed entry points and is specifically excellent for non-HTTP use cases like gaming or VoIP. Remember that it complements Elastic Load Balancing by routing traffic over the AWS global network.

Correct answer: A. AWS Lambda · E. AWS Fargate

AWS Lambda and AWS Fargate are the correct choices because both let you run applications without provisioning or managing underlying servers. For the exam, remember that EC2 and Elastic Beanstalk require server management, making them non-serverless options.

Correct answer: C. Amazon EC2 instance user data

Amazon EC2 user data is correct because it lets you pass bootstrap scripts to automate configuration tasks when launching an instance. Do not confuse this with instance metadata, which simply provides read-only information about the currently running instance.

Correct answer: A. Deploying the application across two AWS Regions improves availability

Deploying workloads across multiple geographic Regions directly increases fault tolerance and availability by isolating failures. For the exam, associate Regions with disaster recovery and global availability, whereas scaling capacity horizontally is handled within Availability Zones using Auto Scaling.

Correct answer: B. Sell Software as a Service (SaaS) solutions to AWS customers · C. AWS customer can buy software that has been bundled into customized Amazon Machine Image (AMIs) by the AWS Marketplace sellers

AWS Marketplace is a digital catalog where independent software vendors can sell pre-configured AMIs or Software as a Service solutions to AWS customers. Think of Marketplace as an app store for buying and selling deployable software, completely distinct from requesting dedicated network connections or buying compliance reports via Artifact.

Correct answer: A. AWS Fargate

AWS Fargate is a serverless compute engine specifically designed to run containers without managing underlying servers. Use this as an exam cue to link Fargate directly with container workloads, whereas Elastic Beanstalk is for broader application platform management.

Correct answer: D. Set up an IAM user with administrator permissions and do not use AWS account root user for administrative tasks · E. Enable multi-factor authentication (MFA) for the AWS account root user

Securing the root user involves enabling multi-factor authentication and delegating daily administrative duties to an IAM user instead. Remember that root access keys should never be created or shared, and the root account should be locked away for only a few highly specific tasks.

Correct answer: B. Massive economies of scale

Aggregating usage from hundreds of thousands of customers enables providers like AWS to achieve massive economies of scale, resulting in lower pay-as-you-go prices. For the exam, associate this specific phrasing directly with economies of scale, rather than general agility or capital expense reduction.

Correct answer: D. Amazon CloudWatch

Amazon CloudWatch is used to create actual billing alarms that trigger when your account costs exceed a defined monetary threshold. On the exam, distinguish this from AWS Budgets, which provides more flexible alerts based on your specific cost or usage forecasts.

Correct answer: A. Build loosely coupled components

Building loosely coupled components allows individual microservices to operate independently, which improves both system scalability and overall resilience. For the exam, always avoid monolithic or tightly coupled designs, and favor decoupling via queues or pub/sub messaging.

Correct answer: D. AWS Health Dashboard – Your account health

The AWS Health Dashboard provides personalized alerts and remediation guidance regarding your account and resource health, available across every support tier. Contrast this with the full Trusted Advisor checks and third-party software support, which require upgraded Business or Enterprise plans.

Correct answer: A. Amazon Translate

Amazon Translate is a neural machine translation service that easily converts text between languages, making it ideal for localizing subtitles. Do not confuse this with Transcribe, which handles speech to text, or Polly, which converts written text into spoken audio.

Correct answer: C. AWS CloudFormation

AWS CloudFormation uses StackSets to deploy infrastructure across multiple accounts and regions simultaneously using templates. AWS Config monitors resource compliance, and CodeDeploy handles application code, not foundational infrastructure provisioning.

Correct answer: D. AWS Artifact

AWS Artifact provides on-demand access to AWS security and compliance reports, including Payment Card Industry reports. For the exam, reliably associate any need for compliance documentation or audits directly with the AWS Artifact portal.

Correct answer: B. VPC Interface Endpoint

A VPC Interface Endpoint uses AWS PrivateLink to privately connect your VPC to supported services like Amazon SQS. A strong exam rule is that gateway endpoints only support Amazon S3 and DynamoDB, while other services rely on interface endpoints.

Correct answer: C. AWS Web Application Firewall (AWS WAF) can block all requests except the ones that you allow · D. AWS Web Application Firewall (AWS WAF) can check for the presence of SQL code that is likely to be malicious (known as SQL injection)

AWS WAF operates at Layer 7 to inspect web requests, allowing you to block malicious SQL injection attempts or restrict access to specific IP addresses. DDoS response team access is exclusive to Shield Advanced, and infrastructure attacks target lower layers.

Correct answer: A. AWS Business Support · B. AWS Enterprise Support

Both Business and Enterprise Support tiers provide programmatic API access to the AWS Support Center for case management. Developer and Basic tiers lack this API access, and Corporate Support is a distractor that does not exist.

Correct answer: C. Amazon EC2 Instance Connect

Amazon EC2 Instance Connect offers a secure, browser-based SSH client accessible across major operating systems. Standard SSH or PuTTY require standalone software, whereas Direct Connect is a dedicated physical network service.

Correct answer: B. U2F security key

A Universal 2nd Factor security key plugs into a USB port for authentication. Hardware and virtual devices typically generate codes, while SMS relies on text messages, so look for the USB characteristic to identify the correct option.

Correct answer: D. Application Load Balancer

The Application Load Balancer operates at Layer 7 and is designed for routing HTTP and HTTPS traffic. The Network Load Balancer handles lower-level TCP and UDP traffic, and System Load Balancer is a distractor.

Correct answer: A. Business

Business is one of the six core perspectives of the AWS Cloud Adoption Framework, alongside People, Governance, Platform, Security, and Operations. For the exam, use the memory trick that the framework completely avoids standard terms like architecture, process, or product to describe its perspectives.

Correct answer: C. AWS Lambda can be used to execute code in response to events such as updates to DynamoDB tables · D. AWS Lambda can be used for preprocessing of data before it is stored in Amazon S3 buckets

Lambda is a serverless compute service that runs code in response to events like DynamoDB streams, or it can easily process data before storing it in S3. You cannot install applications like databases or container services on it.

Correct answer: D. AWS Device Farm

AWS Device Farm is an application testing service that lets you test mobile apps across various real devices and operating systems. The other options handle application deployment or code pipelines instead of device testing.

Correct answer: D. AWS Budgets

AWS Budgets is the correct choice because it allows you to set custom reservation utilization or coverage targets and receive alerts when usage drops below your defined threshold. Use Cost Explorer to visualize data, but rely on Budgets for alerts.

Correct answer: B. On-Demand Instance

On-Demand Instances are the correct choice for short-term, spiky, and critical workloads because they require no upfront commitment and cannot be unexpectedly interrupted. Avoid Spot Instances for critical workloads since AWS can reclaim them with short notice.

Correct answer: A. Use Amazon S3 Block Public Access to ensure that all Amazon S3 resources stay private

Amazon S3 Block Public Access is the most efficient solution because it provides centralized controls to instantly ensure that all buckets and objects remain private. Custom Lambda functions might work, but native features are always preferred for efficiency.

Correct answer: A. Amazon S3 Intelligent-Tiering · B. Amazon S3 Standard

Amazon S3 Standard and S3 Intelligent-Tiering are correct because neither charges a data retrieval fee for accessing your objects. As a practical rule, expect retrieval fees on infrequent access tiers and Glacier archive classes to offset their lower storage costs.

Correct answer: B. Amazon Simple Storage Service (Amazon S3) is a key value based object storage service · C. Amazon Simple Storage Service (Amazon S3) stores data in a flat non-hierarchical structure

Amazon S3 is an object storage service that uses a flat, non-hierarchical structure rather than traditional file systems. It relies on key-value pairs, so you cannot install databases directly on it, making it very distinct from block storage.

Correct answer: C. Warm Standby strategy

A warm standby strategy runs a smaller, functional version of your environment in another region, allowing you to scale up quickly during a disaster. Pilot light lacks this immediate operational capacity, while multi-site active-active exceeds the cost requirements for non-mission-critical workloads.

Correct answer: A. VPC peering connection

VPC peering connects two VPCs directly, allowing private traffic routing between them as if they are in the same network. Site-to-Site VPN and Direct Connect link on-premises networks to AWS, while VPC endpoints only connect a VPC to AWS services.

Correct answer: A. Application software license costs

Under the shared responsibility model, AWS handles physical security, hardware, and facility power, while customers manage their own application software licenses. This division of labor frees companies from maintaining data centers. Hardware and facility costs never fall to the cloud customer.

Correct answer: D. Amazon Elastic Compute Cloud (Amazon EC2) · E. Amazon CloudFront

AWS Shield Advanced provides specialized DDoS protection for resources like Amazon CloudFront and Amazon EC2. These services sit at the edge or compute layers, unlike storage or deployment services like S3 or Elastic Beanstalk.

Correct answer: A. Amazon S3 Standard

Amazon S3 Standard has no minimum storage duration, making it ideal for frequently accessed data. Archival and infrequent access classes like Glacier and Standard-IA enforce minimum duration fees, so deleting objects early incurs prorated charges.

Correct answer: C. Amazon Simple Storage Service (Amazon S3)

Amazon S3 lifecycle rules transition older objects to cheaper storage classes or delete them entirely to optimize costs. Block storage like EBS and instance stores lack automated lifecycle tiering. Use this feature to manage data retention seamlessly.

Correct answer: D. Data transferred out to an Amazon Elastic Compute Cloud (Amazon EC2) instance, when the instance is in the same AWS Region as the S3 bucket · E. Data transferred in from the internet

S3 does not charge for data transferred into the service from the internet or for data sent to an EC2 instance in the same region. Data going out to other regions incurs standard transfer fees, while all storage classes charge for consumed capacity.

Correct answer: A. You can use both read replicas and multi-AZ deployment for disaster recovery

Both read replicas and Multi-AZ deployments can address disaster recovery needs. Remember that Multi-AZ primarily provides high availability, while read replicas are typically used for scaling read performance, though cross-Region replicas serve as excellent disaster recovery mechanisms.

Correct answer: D. Amazon EC2 Auto Scaling

Amazon EC2 Auto Scaling automatically adjusts the number of instances to handle current traffic demands. A practical exam cue is to associate Auto Scaling with adding or removing capacity, whereas load balancers strictly distribute incoming traffic across existing resources.

Correct answer: A. AWS bills five instances as Reserved Instances, and the remaining four instances as regular instances · E. Bob receives the cost-benefit from Susan's Reserved Instance (RI) only if he launches his instances in the same AWS Region where Susan purchased her Reserved Instances (RI)

Consolidated billing applies Reserved Instance discounts automatically to any matching instance in the organization. The discount applies region-wide, making the Availability Zone requirement in the original explanation a technical inaccuracy.

Correct answer: B. Amazon EC2 can scale with changing computing requirements · D. With Amazon EC2, developers can launch and terminate the instances anytime they need to

Amazon EC2 differs from traditional hosting because it easily scales with changing requirements and allows developers to launch or terminate instances at any time. For the exam, remember that EC2 provides flexible, on-demand compute capacity rather than fixed monthly contracts.

Correct answer: D. Amazon Elastic File System (Amazon EFS)

Amazon EFS provides an NFS file system accessible from both AWS and on-premises servers over a Direct Connect or VPN connection. S3 is also accessible on-premises but is an object store rather than a mountable file system. EBS and instance store attach directly to EC2.

Correct answer: D. To run any containerized workload with Amazon Elastic Container Service (Amazon ECS) that can be interrupted

Spot Instances offer deep discounts for interruptible workloads like flexible containerized tasks. They should not be used for critical workloads or scheduled jobs requiring guaranteed capacity, and they never support database installations.

Correct answer: D. Virtual private Cloud (VPC)

Amazon Virtual Private Cloud lets you provision a logically isolated section of the AWS Cloud where you can launch resources in a custom virtual network. Remember that subnets and network access control lists are features configured inside your VPC.