Step2Study

AWS Certified Cloud Practitioner (CLF-C02) practice questions

200 free questions with answers and explanations.

Practice test
  1. 1.A healthcare company wants to build an application that processes protected health information (PHI) on AWS and needs assurance that the underlying AWS services used are eligible for a HIPAA Business Associate Addendum (BAA). Where should the company confirm which services are HIPAA-eligible and obtain the necessary agreement?Security and Compliance
  2. 2.A holding company uses AWS Organizations with consolidated billing across five member accounts. One member account purchases a Reserved Instance for a specific EC2 instance type. How does consolidated billing typically affect the RI discount across the organization?Billing, Pricing, and Support
  3. 3.A retail company is migrating its monolithic order-processing application. Instead of moving it as-is, the team decides to redesign it into microservices that use managed AWS services like Lambda and DynamoDB to improve scalability. Which of the 7 Rs strategy is being applied?Cloud Concepts
  4. 4.A financial services firm has variable but predictable long-term compute needs and wants to change instance families or regions over the next three years while still receiving a significant discount compared to On-Demand pricing. Which Reserved Instance type best fits this need?Billing, Pricing, and Support
  5. 5.A global e-commerce company needs a fully managed NoSQL database that automatically replicates data across multiple AWS Regions, allowing low-latency reads and writes for customers on different continents while keeping data eventually consistent across all Regions. Which solution meets this requirement?Cloud Technology and Services
  6. 6.A media company runs a public-facing web application on Amazon EC2 instances behind an Application Load Balancer. They want to protect the application from common web exploits such as SQL injection and cross-site scripting by inspecting incoming HTTP requests. Which service should they deploy?Security and Compliance
  7. 7.A company designs its e-commerce application to automatically fail over across multiple Availability Zones and regularly tests disaster recovery procedures to ensure the system can recover quickly from component failures. Which Well-Architected Framework pillar does this best represent?Cloud Concepts
  8. 8.A mobile app backend experiences unpredictable spikes in traffic throughout the day. The company wants EC2 instances to be added or removed automatically based on real-time demand to maintain performance while controlling cost. Which AWS feature should the company use?Cloud Technology and Services
  9. 9.A company stores objects in Amazon S3 and wants encryption at rest where AWS fully manages the encryption keys with no additional configuration, versus another option where the company can control key policies, view usage in CloudTrail, and rotate keys, while paying a per-request and per-key fee. Which pair of options is being compared?Security and Compliance
  10. 10.A mobile app development team needs a fully managed service to handle user sign-up, sign-in, and access control for their application, including support for social identity providers like Google and Facebook, without building custom authentication infrastructure. Which AWS service should they use?Security and Compliance
  11. 11.An e-commerce company wants to release a new version of its application with zero downtime by running the new version alongside the old version in a separate, identical environment, then shifting all production traffic to the new environment at once, with the ability to instantly roll back if issues occur. Which deployment strategy does this describe?Cloud Technology and Services
  12. 12.A developer's application running on an EC2 instance needs to call AWS APIs without embedding long-term access keys in the code. The application should receive short-lived credentials that automatically expire. Which AWS service or feature provides this capability?Security and Compliance
  13. 13.A newly hired administrator logs into the AWS Management Console for the first time using the account's root user credentials. Which action reflects AWS best practice for handling this account going forward?Security and Compliance
  14. 14.A company applies cost allocation tags such as 'Project' and 'Environment' to its AWS resources. What is the primary purpose of these tags?Billing, Pricing, and Support
  15. 15.A security team enables a GuardDuty feature that automatically scans Amazon EBS volumes attached to EC2 instances flagged with suspicious activity, looking for known malware file signatures. Which GuardDuty capability does this describe?Security and Compliance
  16. 16.A startup runs a batch image-rendering job that can tolerate interruptions and needs to run only when compute is cheapest. Which EC2 purchasing option is BEST suited for this workload?Cloud Technology and Services
  17. 17.A company with employees who need access to multiple AWS accounts wants to provide centralized, single sign-on access using their existing corporate directory credentials, without creating separate IAM users in each account. Which AWS service should the company use?Security and Compliance
  18. 18.A startup runs an application on Amazon EC2 that needs to read objects from an S3 bucket. The security team wants to avoid storing long-term access keys on the instance. What should the team do?Security and Compliance
  19. 19.A company wants to deploy a managed network security service that provides stateful traffic inspection, intrusion prevention, and fine-grained filtering rules for traffic entering and leaving its Amazon VPCs. Which AWS service best fits this requirement?Security and Compliance
  20. 20.A software company runs a mix of EC2, Fargate, and Lambda workloads across multiple instance families and Regions. It wants to commit to a consistent hourly spend for one year to receive a discount, while retaining the flexibility to change instance types, sizes, and compute services without losing the discount. Which pricing option should the company choose?Cloud Technology and Services
  21. 21.A developer wants to understand how AWS KMS efficiently encrypts large objects without sending the entire object to the KMS service for direct encryption. Which encryption approach does AWS KMS use to accomplish this?Security and Compliance
  22. 22.A company wants to conduct authorized penetration testing against its EC2 instances and Application Load Balancer to validate its security posture. According to AWS's customer policies, what must the company do before starting the test?Security and Compliance
  23. 23.An engineering lead on the Business support plan needs 24/7 access to a live support engineer via phone because a production database has become unresponsive. What is the maximum first-response time AWS commits to for this severity level under the Business support plan?Billing, Pricing, and Support
  24. 24.A new IAM user is created with no attached policies. The user attempts to list objects in an Amazon S3 bucket. What is the outcome of this request?Security and Compliance
  25. 25.A developer wants an AWS storage service that multiple EC2 instances across different Availability Zones can mount and read/write simultaneously using standard file system protocols. Which service should they use?Cloud Technology and Services
  26. 26.A company runs a containerized application on Amazon ECS and wants full control over the underlying EC2 instances, including the ability to install custom monitoring agents directly on the host operating system and choose specific instance types for cost optimization. Which ECS launch type should the company use?Cloud Technology and Services
  27. 27.A DevOps engineer wants to be automatically notified via email whenever the average CPU utilization of an EC2 Auto Scaling group exceeds 80% for 5 consecutive minutes. Which AWS service combination should be configured to achieve this?Cloud Technology and Services
  28. 28.A systems administrator wants to centrally collect, store, and search application log files generated by dozens of EC2 instances running a fleet of web servers, without managing a separate logging server. Which AWS capability should the administrator use?Cloud Technology and Services
  29. 29.A developer wants to run short pieces of code in response to file uploads to S3, without provisioning or managing any servers, and only pay for the compute time actually consumed. Which AWS service best fits this requirement?Cloud Technology and Services
  30. 30.A company runs containerized microservices and wants AWS to fully manage the underlying compute infrastructure so they never have to provision or patch EC2 instances for their containers. Which service combination BEST meets this requirement?Cloud Technology and Services
  31. 31.A security team needs to control traffic at the subnet level within a VPC, including the ability to explicitly DENY specific IP ranges, and wants the rules evaluated in numbered order as stateless filters. Which VPC feature should they configure?Cloud Technology and Services
  32. 32.A security architect needs to grant a partner AWS account direct decrypt access to objects encrypted with a customer managed KMS key, without adding that partner account's IAM users into the key owner's account. Where must this cross-account permission be defined?Security and Compliance
  33. 33.A holding company uses AWS Organizations with consolidated billing across two member accounts using Amazon S3 Standard storage, priced at $0.023/GB for the first 50,000 GB and $0.022/GB for the next tier. Account A stores 30,000 GB and Account B stores 40,000 GB in the same Region. How much does consolidated billing save compared to billing each account separately?Billing, Pricing, and Support
  34. 34.A compliance analyst needs to view a timeline showing how the configuration of a specific Amazon EC2 security group changed over the past six months, including a snapshot of its settings at each point in time. Which AWS service provides this capability?Security and Compliance
  35. 35.During an AWS Cloud Adoption Framework (CAF) assessment, business managers, finance leaders, and program managers evaluate how cloud migration will support strategic business outcomes, improve time-to-market, and align IT spending with business value. Which CAF perspective does this represent?Cloud Concepts
  36. 36.A company's cloud architecture diagram shows a single geographic location containing three physically separate data centers, each with independent power, cooling, and networking, connected by high-bandwidth, low-latency links. What does this diagram represent?Cloud Technology and Services
  37. 37.A company running a globally distributed e-commerce site is repeatedly targeted by large-scale volumetric DDoS attacks and needs proactive DDoS response support along with cost protection for scaling charges incurred during attacks. Which service tier should they subscribe to?Security and Compliance
  38. 38.A retail analytics company stores customer usage logs with highly unpredictable and changing access patterns—some objects are accessed daily for weeks, then not touched for months, with no way to predict which. The company wants AWS to automatically move objects between access tiers to optimize cost without manual lifecycle rules. Which S3 storage class should they use?Cloud Technology and Services
  39. 39.A developer has long-lived IAM access keys embedded in a script that has not been rotated in over two years. A security audit flags this as a risk. What is the recommended best practice to remediate this finding?Security and Compliance
  40. 40.A company is designing a VPC architecture for a three-tier web application. Web servers must be reachable from the internet, while the database servers must never be directly accessible from the internet. How should the company design the subnets to meet this requirement?Cloud Technology and Services
  41. 41.A company is decoupling a web application from a backend order-processing service using a message queue. Message order does not need to be strictly preserved, but the company wants a highly scalable, fully managed queue that guarantees each message is delivered at least once. Which AWS service and queue type BEST fits this need?Cloud Technology and Services
  42. 42.A security team wants a service that automatically analyzes findings from GuardDuty and other data sources, visually mapping relationships between resources, IP addresses, and users to help investigate the root cause of a potential security incident. Which AWS service should they use?Security and Compliance
  43. 43.A company sets up an AWS Budget with an alert configured to trigger when forecasted spend is projected to exceed the monthly budget amount, rather than waiting until actual spend exceeds it. What is the primary advantage of using a forecasted-based alert instead of an actual-cost alert?Billing, Pricing, and Support
  44. 44.A small business on the Basic Support plan wants to check whether any of its S3 buckets are publicly accessible using AWS Trusted Advisor, even though it has not upgraded to a paid support plan. Is this possible?Billing, Pricing, and Support
  45. 45.A new AWS customer wants to experiment with a small workload using S3, Lambda, and EC2 t2.micro instances for the first 12 months without incurring charges, as long as usage stays within specified monthly limits. Which AWS offering enables this?Billing, Pricing, and Support
  46. 46.A company wants AWS to automatically apply an IAM policy that restricts EC2 launches once a defined monthly budget threshold is exceeded, without manual intervention. Which AWS Budgets feature enables this automated response?Billing, Pricing, and Support
  47. 47.A company's public web application already benefits, at no additional charge, from protection against the most common network and transport layer DDoS attacks. To gain access to the 24/7 DDoS Response Team (DRT) and cost protection for scaling during an attack, which AWS offering must the company subscribe to?Security and Compliance
  48. 48.A large enterprise wants its cloud security team to set a maximum permission ceiling for a delegated administrator IAM role, ensuring that even if the role's attached policy is later broadened, the effective permissions can never exceed a defined limit. Which IAM feature should be used?Security and Compliance
  49. 49.An e-commerce company wants to route 80% of user traffic to a new application version and 20% to the legacy version to test performance before a full rollout. Which Route 53 routing policy should they configure?Cloud Technology and Services
  50. 50.A company hosts private EC2 instances in a VPC that need to download software updates from the internet but must remain unreachable from inbound internet traffic. Which component should they add to the VPC architecture?Cloud Technology and Services