AWS Certified Cloud Practitioner (CLF-C02) Exam Questions
Page content
Comprehensive list of Free AWS Certified Cloud Practitioner (CLF-C02) exam questions curated for cracking the exam with confidence.
Disclaimer: AWS is a protected Brand. These exam questions are neither endorsed by nor affiliated with AWS. These are not the AWS official exam questions/dumps. These questions are created from the web resources of the AWS. These questions cover all the objectives and services of the AWS CLF-C02 official exam and once you go through these questions and their concepts, you are more than ready to crack the exam in first attempt.
Free Online Practice Exam
Take all 52 questions as a timed online practice exam, free:-
Overview
- This is a Foundational level certification, ideal for anyone who wants a broad understanding of AWS Cloud concepts, services, and terminology, regardless of technical background.
- Requires 4 to 6 weeks of preparation depending upon your familiarity with cloud concepts.
- Exam code is CLF-C02 and costs 100 USD per attempt.
- You need to solve 65 questions (50 scored + 15 unscored) in 90 mins from your laptop under the supervision of an online proctor.
- Passing score is 700 (out of 1000). No negative scoring so answer all the questions!
- Question format includes multiple choice and multiple response questions.
- Up to 6 months of AWS Cloud exposure (in any role) is recommended, though there are no formal prerequisites.
- The certification is valid for 3 years.
- Exam Guide for more details.
52 Practice Questions
| # | Domain | Weight | Questions below |
|---|---|---|---|
| 1 | Cloud Concepts | 24% | 13 |
| 2 | Security and Compliance | 30% | 15 |
| 3 | Cloud Technology and Services | 34% | 18 |
| 4 | Billing, Pricing, and Support | 12% | 6 |
Domain 1: Cloud Concepts (24%)
A company currently provisions new servers over weeks by ordering, racking, and configuring physical hardware. After migrating to AWS, the company can provision equivalent compute capacity in minutes. Which benefit of the AWS Cloud does this illustrate?
⬜ Elasticity
✅ Speed of deployment (agility)
⬜ Economies of scale
⬜ Global reach
Correct answer: Speed of deployment (agility)
Speed of deployment, often described as agility, refers to the ability to provision and access computing resources in minutes instead of the weeks or months required to procure and set up physical, on-premises hardware.
Why the other options are incorrect:
● Elasticity — Elasticity refers to automatically scaling resources up or down to match demand, not the initial speed of first provisioning them.
● Economies of scale — Economies of scale refers to AWS’s ability to lower costs as it aggregates usage across many customers, not deployment speed.
● Global reach — Global reach refers to the ability to deploy applications in multiple geographic locations worldwide, not deployment speed.
Source: What is Cloud Computing?
An application’s traffic fluctuates significantly between daytime and nighttime. Which benefit of the AWS Cloud allows compute capacity to automatically increase during peak hours and decrease during off-peak hours?
⬜ High availability
✅ Elasticity
⬜ Global infrastructure
⬜ Fixed costs
Correct answer: Elasticity
Elasticity is the ability to automatically scale computing resources up or down to match actual demand, which is exactly what’s needed to handle an application’s fluctuating daytime/nighttime traffic cost-efficiently.
Why the other options are incorrect:
● High availability — High availability refers to designing a system to remain operational and accessible, not to scaling capacity with demand.
● Global infrastructure — Global infrastructure refers to AWS’s worldwide network of Regions and Availability Zones, not automatic scaling.
● Fixed costs — Fixed costs describe unchanging on-premises capital expenses, the opposite of the flexible, usage-based cost model the cloud enables.
Source: What is Cloud Computing?
Which AWS Well-Architected Framework pillar focuses on the ability to run workloads effectively, gain insight into their operations, and continuously improve supporting processes?
⬜ Security
⬜ Reliability
✅ Operational Excellence
⬜ Performance Efficiency
Correct answer: Operational Excellence
The Operational Excellence pillar focuses on running and monitoring systems to deliver business value and continually improving processes and procedures.
Why the other options are incorrect:
● Security — Security focuses on protecting information, systems, and assets, not operational processes.
● Reliability — Reliability focuses on a workload’s ability to recover from failures and meet demand, not on operational monitoring/improvement processes specifically.
● Performance Efficiency — Performance Efficiency focuses on using computing resources efficiently, not on operational processes.
Source: AWS Well-Architected Framework
A company wants to select AWS resource types (such as compute) that most efficiently meet its workload’s requirements, and to keep that efficiency as demand and technology change over time. Which Well-Architected Framework pillar does this describe?
⬜ Cost Optimization
✅ Performance Efficiency
⬜ Sustainability
⬜ Security
Correct answer: Performance Efficiency
The Performance Efficiency pillar focuses on using computing resources efficiently to meet system requirements, and maintaining that efficiency as demand changes and technologies evolve.
Why the other options are incorrect:
● Cost Optimization — Cost Optimization focuses on avoiding unnecessary costs, which is related but distinct from selecting resource types for performance.
● Sustainability — Sustainability focuses on minimizing the environmental impacts of running cloud workloads.
● Security — Security focuses on protecting data, systems, and assets, not resource-type efficiency.
Source: AWS Well-Architected Framework
A company is planning its migration to AWS and wants a structured set of guidance covering business, people, governance, platform, security, and operations perspectives to help it succeed. Which AWS resource is designed for this?
⬜ AWS Well-Architected Framework
✅ AWS Cloud Adoption Framework (AWS CAF)
⬜ AWS Trusted Advisor
⬜ AWS Marketplace
Correct answer: AWS Cloud Adoption Framework (AWS CAF)
The AWS Cloud Adoption Framework (AWS CAF) provides guidance across multiple perspectives (business, people, governance, platform, security, and operations) to help organizations plan and execute a successful cloud transformation.
Why the other options are incorrect:
● AWS Well-Architected Framework — The Well-Architected Framework helps design and evaluate cloud architectures, not the broader organizational adoption journey.
● AWS Trusted Advisor — AWS Trusted Advisor provides recommendations for individual accounts (cost, security, performance), not organization-wide migration guidance.
● AWS Marketplace — AWS Marketplace is a digital catalog for buying third-party software, unrelated to adoption planning guidance.
Source: AWS Cloud Adoption Framework
A company wants to migrate a database from on-premises to AWS with minimal changes to the underlying database engine, essentially moving it as-is to run on AWS infrastructure. Which migration strategy does this describe?
⬜ Refactor
✅ Rehost (“lift and shift”)
⬜ Retire
⬜ Retain
Correct answer: Rehost (“lift and shift”)
Rehosting, often called “lift and shift,” involves moving an application or database to AWS largely as-is, with minimal or no changes to the underlying architecture — the fastest and often first step in a migration journey.
Why the other options are incorrect:
● Refactor — Refactoring involves re-architecting the application to take advantage of cloud-native features, which is a much larger change than described.
● Retire — Retiring means decommissioning an application/database that’s no longer needed, not migrating it.
● Retain — Retaining means keeping the application/database on-premises for now, not migrating it to AWS.
Which statement correctly distinguishes between the on-premises and AWS Cloud cost models regarding compute infrastructure?
⬜ On-premises infrastructure is typically a variable cost, while AWS Cloud usage is a fixed cost paid upfront.
✅ On-premises infrastructure typically requires a large upfront capital expenditure (a fixed cost), while AWS Cloud usage is generally billed as a variable operating expense based on actual consumption.
⬜ There is no cost model difference between on-premises and AWS Cloud infrastructure.
⬜ AWS Cloud requires the same upfront hardware purchase as on-premises infrastructure.
Correct answer: On-premises infrastructure typically requires a large upfront capital expenditure (a fixed cost), while AWS Cloud usage is generally billed as a variable operating expense based on actual consumption.
On-premises infrastructure typically requires significant upfront capital expenditure (fixed costs) to purchase hardware regardless of how much it’s used, while AWS Cloud usage is generally billed as a variable expense based on actual consumption — trading capital expense for operating expense.
Why the other options are incorrect:
● On-premises infrastructure is typically a variable cost, while AWS Cloud usage is a fixed cost paid upfront. — This reverses the correct relationship; on-premises is the fixed/upfront cost model, not AWS.
● There is no cost model difference between on-premises and AWS Cloud infrastructure. — There is a meaningful cost model difference, which is a key benefit of cloud economics.
● AWS Cloud requires the same upfront hardware purchase as on-premises infrastructure. — AWS Cloud specifically eliminates the need for upfront hardware purchases, unlike on-premises infrastructure.
Source: Cloud Economics Center
A company notices that several of its Amazon EC2 instances are consistently underutilized, running at low CPU utilization most of the time. Which cost-optimization concept involves adjusting resource types and sizes to better match actual workload requirements?
✅ Rightsizing
⬜ Reserved Instance purchasing only
⬜ Consolidated billing
⬜ Data transfer optimization
Correct answer: Rightsizing
Rightsizing is the practice of matching instance types and sizes to actual workload performance and capacity requirements at the lowest possible cost, which directly addresses consistently underutilized resources.
Why the other options are incorrect:
● Reserved Instance purchasing only — Reserved Instances offer a discount for committed usage, but don’t by themselves fix a mismatch between instance size and actual need.
● Consolidated billing — Consolidated billing combines billing across multiple AWS accounts; it doesn’t address individual resource utilization.
● Data transfer optimization — Data transfer optimization concerns network cost, not compute resource sizing.
Source: Right Sizing
A software vendor wants to bring an existing on-premises software license to AWS and use it on AWS infrastructure, rather than paying for a new AWS-included license. Which licensing concept does this describe?
✅ Bring Your Own License (BYOL)
⬜ License-included pricing
⬜ Reserved Instance pricing
⬜ Spot pricing
Correct answer: Bring Your Own License (BYOL)
Bring Your Own License (BYOL) allows a customer to use an existing, already-purchased software license on AWS infrastructure, as an alternative to paying for AWS’s own included-license pricing for that software.
Why the other options are incorrect:
● License-included pricing — License-included pricing bundles the software license cost into the AWS service price, which is the opposite of using an existing license.
● Reserved Instance pricing and Spot pricing — Reserved Instance and Spot pricing are EC2 compute purchasing options and are unrelated to software licensing models.
Source: Cloud Economics Center
Which of these is an example of achieving high availability for an application running on AWS?
⬜ Running the application on a single Amazon EC2 instance in one Availability Zone.
✅ Deploying the application across multiple Availability Zones within a Region.
⬜ Storing all application data only on a local laptop.
⬜ Disabling all monitoring to reduce costs.
Correct answer: Deploying the application across multiple Availability Zones within a Region.
Deploying an application across multiple Availability Zones within a Region is a standard way to achieve high availability, since Availability Zones are physically separated and don’t share single points of failure, so a failure in one doesn’t take down the whole application.
Why the other options are incorrect:
● Running the application on a single Amazon EC2 instance in one Availability Zone. — A single EC2 instance in one Availability Zone is a single point of failure, the opposite of high availability.
● Storing all application data only on a local laptop. — Storing data on a local laptop offers no availability or durability at all in the context of a cloud-hosted application.
● Disabling all monitoring to reduce costs. — Disabling monitoring doesn’t affect availability directly and removes visibility needed to detect and respond to failures.
Source: What is Cloud Computing?
A large enterprise deploying the same workload individually would incur high infrastructure costs, but AWS can offer lower prices because it aggregates usage from millions of customers to negotiate better rates and achieve operational efficiencies. Which cloud economics concept does this describe?
⬜ Rightsizing
✅ Economies of scale
⬜ Bring Your Own License (BYOL)
⬜ Total cost of ownership (TCO) only for on-premises
Correct answer: Economies of scale
Economies of scale refers to AWS’s ability to lower per-unit costs as it aggregates demand and usage across a very large number of customers, and to pass some of those savings on through lower prices.
Why the other options are incorrect:
● Rightsizing — Rightsizing is about matching individual resource sizes to workload needs, not about aggregate-scale cost advantages.
● Bring Your Own License (BYOL) — BYOL is a software licensing approach, unrelated to aggregate scale-driven pricing.
● Total cost of ownership (TCO) only for on-premises — TCO is a cost-comparison concept used to evaluate on-premises vs. cloud costs, not the scale-driven pricing mechanism itself.
Source: Cloud Economics Center
Which AWS Well-Architected Framework pillar was added to address minimizing the environmental impact of running cloud workloads, such as energy efficiency and resource usage?
⬜ Reliability
✅ Sustainability
⬜ Cost Optimization
⬜ Security
Correct answer: Sustainability
The Sustainability pillar focuses on minimizing the environmental impacts of running cloud workloads, including energy efficiency, resource efficiency, and reducing the overall environmental footprint of a workload.
Why the other options are incorrect:
● Reliability — Reliability addresses a workload’s ability to recover from failures and meet demand, not environmental impact.
● Cost Optimization — Cost Optimization focuses on avoiding unnecessary spending, which can be related to efficiency but is a distinct concern from environmental sustainability.
● Security — Security focuses on protecting data, systems, and assets, not environmental impact.
Source: AWS Well-Architected Framework
A user deploys an Amazon RDS DB instance in multiple Availability Zones. This strategy involves which pillar of the AWS Well-Architected Framework?
⬜ Cost Optimization
⬜ Performance Efficiency
✅ Reliability
⬜ Operational Excellence
Correct answer: Reliability
Deploying an Amazon RDS DB instance across multiple Availability Zones provides automatic failover and redundancy if the primary AZ becomes unavailable — a core pattern under the Reliability pillar, which focuses on a workload’s ability to recover from infrastructure or service disruptions and consistently perform its intended function.
Why the other options are incorrect:
● Cost Optimization — Cost Optimization is about avoiding unnecessary spending; a Multi-AZ deployment actually increases cost in exchange for higher availability, so it isn’t primarily a cost concern.
● Performance Efficiency — Performance Efficiency is about using computing resources efficiently as demand and technology evolve, not about failover or redundancy.
● Operational Excellence — Operational Excellence focuses on running and monitoring systems and continuously improving processes, not on infrastructure-level redundancy.
Source: Amazon RDS Multi-AZ deployments
Domain 2: Security and Compliance (30%)
Under the AWS Shared Responsibility Model, which of the following is generally AWS’s responsibility, not the customer’s?
⬜ Configuring security group rules for an EC2 instance.
✅ Security OF the cloud — protecting the physical infrastructure, hardware, and host operating systems that run AWS services.
⬜ Encrypting the customer’s own application data.
⬜ Managing IAM users and permissions.
Correct answer: Security OF the cloud — protecting the physical infrastructure, hardware, and host operating systems that run AWS services.
AWS is responsible for security OF the cloud: protecting the underlying global infrastructure, including hardware, software, networking, and facilities that run AWS services.
Why the other options are incorrect:
● Configuring security group rules for an EC2 instance. — Configuring security groups is a customer responsibility (security IN the cloud) for controlling their own resources’ network access.
● Encrypting the customer’s own application data. — Encrypting application data is a customer responsibility, since AWS doesn’t know what needs to be encrypted or how.
● Managing IAM users and permissions. — Managing IAM users and permissions is a customer responsibility for controlling access to their own AWS account and resources.
Source: AWS Shared Responsibility Model
For a managed database service like Amazon RDS, which of the following is the CUSTOMER’s responsibility under the Shared Responsibility Model?
⬜ Patching the underlying database engine software.
⬜ Maintaining the physical data center facilities.
✅ Managing database access permissions, data content, and network configuration (such as security groups) for their database instance.
⬜ Replacing failed physical hard drives in the data center.
Correct answer: Managing database access permissions, data content, and network configuration (such as security groups) for their database instance.
For managed services like Amazon RDS, AWS manages more of the underlying infrastructure and patching, but the customer remains responsible for managing access permissions, the data itself, and network-level configuration such as security groups controlling access to the database.
Why the other options are incorrect:
● Patching the underlying database engine software. — For RDS specifically, AWS manages patching of the underlying database engine as part of the managed service.
● Maintaining the physical data center facilities. — Physical data center facilities are always an AWS responsibility, regardless of the service.
● Replacing failed physical hard drives in the data center. — Physical hardware maintenance is always an AWS responsibility, never a customer one.
Source: AWS Shared Responsibility Model
A company needs to download AWS’s compliance reports, such as SOC reports and ISO certifications, to satisfy an internal audit requirement. Which AWS service provides on-demand access to this compliance documentation?
✅ AWS Artifact
⬜ AWS Trusted Advisor
⬜ AWS Config
⬜ AWS Shield
Correct answer: AWS Artifact
AWS Artifact is a self-service portal that provides on-demand access to AWS’s compliance reports and select online agreements, exactly meeting the need to download reports like SOC and ISO certifications for an audit.
Why the other options are incorrect:
● AWS Trusted Advisor — AWS Trusted Advisor provides account-specific best-practice recommendations, not AWS’s own compliance reports.
● AWS Config — AWS Config tracks and evaluates the configuration of a customer’s own AWS resources, not AWS’s compliance certifications.
● AWS Shield — AWS Shield provides DDoS protection and has nothing to do with compliance documentation.
Source: AWS Artifact
Which AWS service continuously monitors for malicious activity and unauthorized behavior, such as unusual API calls or potentially compromised EC2 instances, using machine learning and threat intelligence?
✅ Amazon GuardDuty
⬜ AWS Config
⬜ AWS Artifact
⬜ AWS Budgets
Correct answer: Amazon GuardDuty
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads, using machine learning, anomaly detection, and integrated threat intelligence.
Why the other options are incorrect:
● AWS Config — AWS Config tracks and evaluates resource configuration compliance, not real-time threat detection.
● AWS Artifact — AWS Artifact provides compliance documentation, not threat monitoring.
● AWS Budgets — AWS Budgets tracks costs and usage against budgets, unrelated to security threat detection.
Source: Amazon GuardDuty
A company’s public-facing web application needs protection against common web exploits, such as SQL injection and cross-site scripting (XSS), at the application layer. Which AWS service is purpose-built for this?
✅ AWS WAF (Web Application Firewall)
⬜ AWS Shield only
⬜ Amazon Route 53
⬜ AWS Direct Connect
Correct answer: AWS WAF (Web Application Firewall)
AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting by letting customers configure rules that filter and monitor HTTP/HTTPS requests.
Why the other options are incorrect:
● AWS Shield only — AWS Shield primarily provides protection against Distributed Denial of Service (DDoS) attacks, not general web application-layer exploits like SQL injection.
● Amazon Route 53 — Amazon Route 53 is a DNS and domain registration service, unrelated to web application firewalling.
● AWS Direct Connect — AWS Direct Connect provides a dedicated network connection to AWS, unrelated to web application protection.
Source: What is AWS WAF?
Which AWS service is specifically designed to provide protection against Distributed Denial of Service (DDoS) attacks?
✅ AWS Shield
⬜ AWS Config
⬜ Amazon Inspector
⬜ AWS Trusted Advisor
Correct answer: AWS Shield
AWS Shield is a managed service specifically designed to provide protection against Distributed Denial of Service (DDoS) attacks, with a Standard tier included automatically and an Advanced tier offering enhanced protections.
Why the other options are incorrect:
● AWS Config — AWS Config monitors resource configuration compliance, not DDoS protection.
● Amazon Inspector — Amazon Inspector performs automated vulnerability assessments of workloads, not DDoS protection specifically.
● AWS Trusted Advisor — AWS Trusted Advisor gives best-practice recommendations, not active DDoS protection.
Source: AWS Shield
A company wants to continuously track configuration changes to its AWS resources and evaluate whether those configurations comply with internal policies over time. Which AWS service should they use?
✅ AWS Config
⬜ AWS Budgets
⬜ Amazon SNS
⬜ AWS Direct Connect
Correct answer: AWS Config
AWS Config records and evaluates the configuration of AWS resources over time, allowing a company to assess and audit compliance against defined configuration rules — a governance and compliance capability.
Why the other options are incorrect:
● AWS Budgets — AWS Budgets tracks costs and spending against budgets, not resource configuration compliance.
● Amazon SNS — Amazon SNS is a messaging/notification service, unrelated to configuration tracking.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to configuration compliance.
Source: What Is AWS Config?
Which AWS service records a detailed history of API calls made within an AWS account, including who made the call and when, supporting security analysis and auditing?
✅ AWS CloudTrail
⬜ Amazon CloudWatch only
⬜ AWS Organizations
⬜ Amazon QuickSight
Correct answer: AWS CloudTrail
AWS CloudTrail records detailed account activity, including API calls made through the AWS Management Console, SDKs, and CLI, along with who made the call and when — essential for security auditing and governance.
Why the other options are incorrect:
● Amazon CloudWatch only — Amazon CloudWatch focuses on monitoring metrics, logs, and alarms for operational performance, which is complementary but distinct from CloudTrail’s API call auditing.
● AWS Organizations — AWS Organizations manages multiple AWS accounts centrally, but doesn’t itself record detailed API call history.
● Amazon QuickSight — Amazon QuickSight is a business intelligence/visualization service, unrelated to API call auditing.
Source: AWS CloudTrail User Guide
Which of these is considered a best practice for protecting the AWS account root user?
⬜ Use the root user account for all daily administrative tasks.
✅ Enable multi-factor authentication (MFA) on the root user and avoid using it for everyday tasks, creating IAM users/roles instead.
⬜ Share the root user credentials with the entire engineering team for convenience.
⬜ Disable password requirements on the root user account.
Correct answer: Enable multi-factor authentication (MFA) on the root user and avoid using it for everyday tasks, creating IAM users/roles instead.
Best practice is to enable MFA on the root user account, secure its credentials carefully, and avoid using it for day-to-day tasks — instead creating individual IAM users or roles with only the permissions each person or workload actually needs.
Why the other options are incorrect:
● Use the root user account for all daily administrative tasks. — Using the root user for daily tasks unnecessarily increases risk, since the root user has unrestricted access to the account.
● Share the root user credentials with the entire engineering team for convenience. — Sharing root credentials among many people eliminates accountability and dramatically increases security risk.
● Disable password requirements on the root user account. — Disabling password requirements would weaken, not strengthen, root user security.
Source: Root user tasks
A company wants to require users to provide a second form of verification, such as a code from an authenticator app, in addition to their password when signing in to AWS. Which security feature should they enable?
✅ Multi-factor authentication (MFA)
⬜ AWS Organizations
⬜ AWS Config rules
⬜ Amazon Route 53 failover routing
Correct answer: Multi-factor authentication (MFA)
Multi-factor authentication (MFA) adds an extra layer of security by requiring users to provide a second verification factor, such as a one-time code from an authenticator app, in addition to their username and password.
Why the other options are incorrect:
● AWS Organizations — AWS Organizations manages multiple accounts centrally; it doesn’t itself provide the second-factor sign-in mechanism.
● AWS Config rules — AWS Config rules evaluate resource configuration compliance, unrelated to sign-in authentication.
● Amazon Route 53 failover routing — Route 53 failover routing manages DNS traffic failover, unrelated to user authentication.
A company wants its employees to sign in once through a centralized portal and then access multiple AWS accounts and business applications without separate credentials for each. Which AWS service is designed for this kind of centralized workforce identity and single sign-on?
✅ AWS IAM Identity Center
⬜ Amazon GuardDuty
⬜ AWS Shield
⬜ AWS Artifact
Correct answer: AWS IAM Identity Center
AWS IAM Identity Center (successor to AWS Single Sign-On) provides centralized workforce identity management, letting employees sign in once and access multiple AWS accounts and supported business applications.
Why the other options are incorrect:
● Amazon GuardDuty — GuardDuty is a threat detection service, unrelated to workforce single sign-on.
● AWS Shield — AWS Shield provides DDoS protection, unrelated to identity/access management.
● AWS Artifact — AWS Artifact provides compliance documentation, unrelated to single sign-on.
Source: What is IAM Identity Center?
A development team needs to securely store and automatically rotate a database credential used by an application, rather than hardcoding it. Which AWS service is purpose-built for this?
✅ AWS Secrets Manager
⬜ Amazon S3 Standard storage class
⬜ AWS Direct Connect
⬜ Amazon Route 53
Correct answer: AWS Secrets Manager
AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate secrets such as database credentials, API keys, and other sensitive values, removing the need to hardcode them in application code.
Why the other options are incorrect:
● Amazon S3 Standard storage class — Amazon S3 Standard is general-purpose object storage; it isn’t designed with the credential rotation and fine-grained secret access controls Secrets Manager provides.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to secret storage.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to secret storage.
Source: What Is AWS Secrets Manager?
Which principle states that users and systems should be granted only the minimum permissions necessary to perform their required tasks, and no more?
✅ Principle of least privilege
⬜ Principle of shared responsibility
⬜ Principle of economies of scale
⬜ Principle of elasticity
Correct answer: Principle of least privilege
The principle of least privilege states that identities (users, roles, or systems) should be granted only the permissions strictly necessary to perform their intended tasks, reducing the potential impact if credentials are compromised.
Why the other options are incorrect:
● Principle of shared responsibility — Shared responsibility describes how security obligations are divided between AWS and the customer, a different concept from permission scoping.
● Principle of economies of scale and Principle of elasticity — Economies of scale and elasticity are cloud economics and scaling concepts, unrelated to access permission scoping.
Source: Security best practices in IAM
A company wants to identify security misconfigurations, get consolidated security findings, and check compliance status across multiple AWS security services in one centralized dashboard. Which AWS service aggregates this?
✅ AWS Security Hub
⬜ Amazon Route 53
⬜ AWS Direct Connect
⬜ Amazon QuickSight
Correct answer: AWS Security Hub
AWS Security Hub provides a centralized view that aggregates, organizes, and prioritizes security findings and compliance status from multiple AWS security services (such as GuardDuty and Inspector) and partner tools.
Why the other options are incorrect:
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to security findings aggregation.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to security findings.
● Amazon QuickSight — Amazon QuickSight is a business intelligence tool, not a security findings aggregator.
Source: What is AWS Security Hub?
Which AWS service encrypts data and manages the cryptographic keys used to protect that data across many AWS services, such as Amazon S3 and Amazon RDS?
✅ AWS Key Management Service (AWS KMS)
⬜ Amazon CloudWatch
⬜ AWS Trusted Advisor
⬜ Amazon SNS
Correct answer: AWS Key Management Service (AWS KMS)
AWS Key Management Service (AWS KMS) lets customers create and manage cryptographic keys used to encrypt data across many integrated AWS services, supporting both encryption at rest and in transit use cases.
Why the other options are incorrect:
● Amazon CloudWatch — Amazon CloudWatch is a monitoring and observability service, unrelated to encryption key management.
● AWS Trusted Advisor — AWS Trusted Advisor provides best-practice recommendations, not key management.
● Amazon SNS — Amazon SNS is a messaging/notification service, unrelated to encryption.
Domain 3: Cloud Technology and Services (34%)
A company wants to define and provision its AWS infrastructure using version-controlled, repeatable configuration files rather than manually clicking through the AWS Management Console each time. Which approach does this describe?
✅ Infrastructure as Code (IaC), such as using AWS CloudFormation.
⬜ Manual console-only provisioning.
⬜ Only using the AWS Command Line Interface interactively, one command at a time, with no saved files.
⬜ Physically racking new on-premises servers.
Correct answer: Infrastructure as Code (IaC), such as using AWS CloudFormation.
Infrastructure as Code (IaC) — such as AWS CloudFormation templates — lets a company define infrastructure in version-controlled configuration files that can be repeatably and consistently provisioned, rather than manually configuring resources through the console each time.
Why the other options are incorrect:
● Manual console-only provisioning. — Manual console provisioning is repeatable but not version-controlled or automated, which is the opposite of the IaC approach described.
● Only using the AWS Command Line Interface interactively, one command at a time, with no saved files. — Ad hoc, one-off CLI commands with no saved files aren’t repeatable or version-controlled either.
● Physically racking new on-premises servers. — Racking physical on-premises servers is unrelated to how AWS Cloud resources are provisioned.
Source: What is AWS CloudFormation?
Which statement correctly describes the relationship between AWS Regions and Availability Zones?
⬜ A Region contains exactly one Availability Zone.
✅ A Region is a physical geographic location that contains multiple, isolated Availability Zones, each consisting of one or more discrete data centers.
⬜ Availability Zones span multiple Regions.
⬜ Regions and Availability Zones are the same thing, just different names.
Correct answer: A Region is a physical geographic location that contains multiple, isolated Availability Zones, each consisting of one or more discrete data centers.
An AWS Region is a physical geographic area that contains multiple, isolated Availability Zones (each made up of one or more discrete data centers), which are designed not to share single points of failure with one another.
Why the other options are incorrect:
● A Region contains exactly one Availability Zone. — Regions contain multiple Availability Zones (typically three or more), not exactly one.
● Availability Zones span multiple Regions. — Availability Zones exist within a single Region; they do not span multiple Regions.
● Regions and Availability Zones are the same thing, just different names. — Regions and Availability Zones are distinct concepts at different levels of AWS’s global infrastructure hierarchy.
Source: AWS Global Infrastructure
A company wants to serve cached content to end users with the lowest possible latency by placing content physically closer to users around the world. Which AWS global infrastructure component is designed for this?
⬜ Availability Zones
✅ Edge locations (used by services like Amazon CloudFront)
⬜ AWS Direct Connect locations only
⬜ AWS Local Zones exclusively
Correct answer: Edge locations (used by services like Amazon CloudFront)
Edge locations are AWS’s globally distributed points of presence used by services like Amazon CloudFront to cache and deliver content closer to end users, reducing latency for content delivery.
Why the other options are incorrect:
● Availability Zones — Availability Zones are part of a Region’s core infrastructure for running workloads with high availability, not specifically for edge caching.
● AWS Direct Connect locations only — Direct Connect locations provide dedicated network connectivity points, not content caching for end users.
● AWS Local Zones exclusively — AWS Local Zones extend AWS infrastructure closer to large population centers for low-latency compute, which is a different concept from edge caching locations.
Source: AWS Global Infrastructure
A company running a business-critical application wants to ensure the application remains available even if an entire AWS Region becomes unavailable. Which strategy addresses this?
⬜ Deploy the application in a single Availability Zone only.
⬜ Deploy the application across multiple Availability Zones within a single Region only.
✅ Deploy the application across multiple AWS Regions, so it can fail over if one Region becomes unavailable.
⬜ Rely solely on a single on-premises data center as a backup.
Correct answer: Deploy the application across multiple AWS Regions, so it can fail over if one Region becomes unavailable.
Deploying an application across multiple AWS Regions provides protection against an entire Region becoming unavailable, supporting disaster recovery and business continuity requirements that a multi-AZ, single-Region design cannot address.
Why the other options are incorrect:
● Deploy the application in a single Availability Zone only. — A single Availability Zone offers no protection against an AZ failure, let alone a Region-wide event.
● Deploy the application across multiple Availability Zones within a single Region only. — Multiple Availability Zones protect against an AZ-level failure but not against a Region-wide outage.
● Rely solely on a single on-premises data center as a backup. — Relying on a single on-premises data center doesn’t leverage AWS’s global infrastructure and reintroduces a single point of failure.
Source: AWS Global Infrastructure
A company has a short-lived, fault-tolerant batch processing workload that can be interrupted, and wants to minimize compute costs. Which EC2 purchasing/compute option is typically the most cost-effective fit?
⬜ On-Demand Instances
✅ Spot Instances
⬜ Dedicated Hosts
⬜ Savings Plans requiring a 3-year commitment
Correct answer: Spot Instances
Spot Instances let a company use spare EC2 capacity at steep discounts compared to On-Demand pricing, making them well suited for fault-tolerant, interruptible workloads like short batch jobs, where the possibility of interruption is an acceptable tradeoff for lower cost.
Why the other options are incorrect:
● On-Demand Instances — On-Demand Instances offer flexibility with no interruption risk, but at a higher price point than Spot for this fault-tolerant use case.
● Dedicated Hosts — Dedicated Hosts provide a physical server dedicated to one customer, mainly for licensing/compliance needs, and are generally more expensive, not optimized for short interruptible batch jobs.
● Savings Plans requiring a 3-year commitment — A 3-year Savings Plan commitment doesn’t fit a short-lived workload and is meant for steady, predictable long-term usage.
Source: Amazon EC2 Spot Instances
A company wants to run containerized applications without having to manage the underlying EC2 servers or clusters themselves. Which combination of AWS services fits this serverless container requirement?
⬜ Amazon EC2 with manually managed instances
✅ Amazon ECS or Amazon EKS running on AWS Fargate
⬜ AWS Direct Connect
⬜ Amazon Route 53
Correct answer: Amazon ECS or Amazon EKS running on AWS Fargate
Running Amazon ECS or Amazon EKS on AWS Fargate lets a company run containers without provisioning or managing the underlying EC2 instances or clusters, since Fargate is a serverless compute engine for containers.
Why the other options are incorrect:
● Amazon EC2 with manually managed instances — Manually managed EC2 instances require the company to provision and manage the underlying servers, the opposite of the serverless requirement.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to container compute.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to container compute.
Source: AWS Fargate
A company wants to run short-lived, event-driven code (such as processing an uploaded file) without provisioning or managing any servers at all, paying only for the compute time consumed. Which AWS service fits this best?
✅ AWS Lambda
⬜ Amazon EC2 Reserved Instances
⬜ AWS Direct Connect
⬜ Amazon WorkSpaces
Correct answer: AWS Lambda
AWS Lambda is a serverless compute service that runs code in response to events (such as a file upload) without requiring any server provisioning or management, charging only for the compute time actually consumed.
Why the other options are incorrect:
● Amazon EC2 Reserved Instances — EC2 Reserved Instances still require managing EC2 servers and are billed for reserved capacity, not per-event execution.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to event-driven compute.
● Amazon WorkSpaces — Amazon WorkSpaces provisions virtual desktops, unrelated to event-driven serverless code execution.
Source: AWS Lambda
A company’s web application experiences unpredictable spikes in traffic. Which AWS capability automatically adjusts the number of EC2 instances up or down based on demand?
✅ Amazon EC2 Auto Scaling
⬜ Amazon Route 53 only
⬜ AWS Direct Connect
⬜ AWS Artifact
Correct answer: Amazon EC2 Auto Scaling
Amazon EC2 Auto Scaling automatically adds or removes EC2 instances according to defined scaling policies and actual demand, helping maintain application availability and cost efficiency during traffic spikes and lulls.
Why the other options are incorrect:
● Amazon Route 53 only — Amazon Route 53 handles DNS routing, not automatic instance scaling.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to scaling compute capacity.
● AWS Artifact — AWS Artifact provides compliance documents, unrelated to scaling.
Source: What Is Amazon EC2 Auto Scaling?
A company wants to distribute incoming application traffic automatically across multiple EC2 instances in different Availability Zones to improve fault tolerance and availability. Which AWS service is designed for this?
✅ Elastic Load Balancing (ELB)
⬜ Amazon S3
⬜ AWS Storage Gateway
⬜ AWS Direct Connect
Correct answer: Elastic Load Balancing (ELB)
Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as EC2 instances, in one or more Availability Zones, improving fault tolerance and availability.
Why the other options are incorrect:
● Amazon S3 — Amazon S3 is an object storage service, unrelated to distributing network traffic across compute instances.
● AWS Storage Gateway — AWS Storage Gateway connects on-premises environments to cloud storage, unrelated to load balancing.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity to AWS, not load balancing across instances.
Source: What Is Elastic Load Balancing?
A company needs a fully managed relational database compatible with MySQL that automatically handles patching, backups, and replication. Which type of AWS database service fits this need?
⬜ Amazon DynamoDB
✅ Amazon RDS (or Amazon Aurora)
⬜ Amazon ElastiCache
⬜ Amazon S3 Glacier
Correct answer: Amazon RDS (or Amazon Aurora)
Amazon RDS (and Amazon Aurora, which is MySQL- and PostgreSQL-compatible) are managed relational database services that handle much of the operational burden — including patching, backups, and replication — automatically.
Why the other options are incorrect:
● Amazon DynamoDB — Amazon DynamoDB is a managed NoSQL database, not a relational (SQL-compatible) database service.
● Amazon ElastiCache — Amazon ElastiCache is an in-memory caching service, not a relational database.
● Amazon S3 Glacier — Amazon S3 Glacier is a low-cost archival object storage service, not a database.
Source: Amazon RDS
A company needs a fully managed, key-value and document NoSQL database that delivers consistent, single-digit millisecond performance at virtually any scale. Which AWS service fits this requirement?
✅ Amazon DynamoDB
⬜ Amazon RDS for PostgreSQL
⬜ AWS Database Migration Service (AWS DMS)
⬜ Amazon Redshift
Correct answer: Amazon DynamoDB
Amazon DynamoDB is a fully managed, serverless key-value and document NoSQL database designed to deliver consistent, single-digit millisecond performance at virtually any scale.
Why the other options are incorrect:
● Amazon RDS for PostgreSQL — Amazon RDS for PostgreSQL is a relational (SQL) database service, not a NoSQL key-value/document database.
● AWS Database Migration Service (AWS DMS) — AWS DMS is a database migration tool, not a database itself.
● Amazon Redshift — Amazon Redshift is a data warehouse service optimized for analytics, not a general-purpose low-latency NoSQL database.
Source: Amazon DynamoDB
A company wants to reduce database read latency for a frequently accessed dataset by caching query results in memory. Which AWS service is purpose-built for this?
✅ Amazon ElastiCache
⬜ AWS Storage Gateway
⬜ Amazon FSx
⬜ AWS Backup
Correct answer: Amazon ElastiCache
Amazon ElastiCache provides fully managed, in-memory caching services (compatible with Redis and Memcached) specifically designed to reduce latency for frequently accessed data by caching it in memory rather than repeatedly querying the primary database.
Why the other options are incorrect:
● AWS Storage Gateway — AWS Storage Gateway connects on-premises environments to AWS cloud storage; it is not an in-memory caching service.
● Amazon FSx — Amazon FSx provides managed file storage systems, not in-memory caching.
● AWS Backup — AWS Backup is a centralized backup management service, unrelated to caching.
Source: Amazon ElastiCache
Which core components make up an Amazon VPC (Virtual Private Cloud) network, allowing a company to define an isolated section of the AWS Cloud with its own IP address range?
✅ Subnets, route tables, and gateways
⬜ S3 buckets only
⬜ DynamoDB tables only
⬜ AWS Lambda functions only
Correct answer: Subnets, route tables, and gateways
A VPC is built from components like subnets (dividing the VPC’s IP range across Availability Zones), route tables (controlling traffic routing), and gateways (such as internet gateways or NAT gateways for external connectivity) to define an isolated, configurable network.
Why the other options are incorrect:
● S3 buckets only, DynamoDB tables only and AWS Lambda functions only — S3 buckets, DynamoDB tables, and Lambda functions are compute/storage/database services that run within (or alongside) a VPC’s networking setup, but they are not themselves core VPC networking components.
Source: What Is Amazon VPC?
A company wants a scalable Domain Name System (DNS) web service to route end users to their application, and also wants to register a new domain name. Which AWS service provides both capabilities?
✅ Amazon Route 53
⬜ AWS Direct Connect
⬜ Amazon CloudFront only
⬜ Amazon VPC
Correct answer: Amazon Route 53
Amazon Route 53 is a highly available and scalable DNS web service that also supports domain name registration, health checking, and traffic routing policies, fitting both requirements described.
Why the other options are incorrect:
● AWS Direct Connect — AWS Direct Connect provides a dedicated physical network connection to AWS, unrelated to DNS or domain registration.
● Amazon CloudFront only — Amazon CloudFront is a content delivery network (CDN); it does not provide domain registration.
● Amazon VPC — Amazon VPC provides isolated cloud networking, not DNS resolution or domain registration.
Source: Amazon Route 53
A company wants a dedicated, private network connection between its on-premises data center and AWS, bypassing the public internet for more consistent network performance. Which AWS service should they use?
✅ AWS Direct Connect
⬜ Amazon Route 53
⬜ Amazon CloudFront
⬜ AWS Config
Correct answer: AWS Direct Connect
AWS Direct Connect establishes a dedicated, private network connection between a company’s on-premises environment and AWS, offering more consistent network performance than a typical internet-based connection.
Why the other options are incorrect:
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to dedicated private network connectivity.
● Amazon CloudFront — Amazon CloudFront is a content delivery network, unrelated to dedicated on-premises-to-AWS connections.
● AWS Config — AWS Config tracks resource configuration compliance, unrelated to network connectivity.
Source: AWS Direct Connect
A company stores infrequently accessed data that must still be retrievable within milliseconds when needed, but wants to minimize storage costs compared to its frequently accessed data. Which Amazon S3 storage class fits this use case?
⬜ S3 Standard
✅ S3 Standard-Infrequent Access (S3 Standard-IA)
⬜ S3 Glacier Deep Archive
⬜ Amazon EBS Provisioned IOPS
Correct answer: S3 Standard-Infrequent Access (S3 Standard-IA)
S3 Standard-IA is designed for data that is accessed less frequently but requires rapid access when needed, offering lower storage costs than S3 Standard while still providing millisecond first-byte retrieval.
Why the other options are incorrect:
● S3 Standard — S3 Standard is optimized for frequently accessed data and costs more than S3 Standard-IA for infrequent access patterns.
● S3 Glacier Deep Archive — S3 Glacier Deep Archive is the lowest-cost storage class but has retrieval times measured in hours, not milliseconds.
● Amazon EBS Provisioned IOPS — Amazon EBS is block storage for EC2 instances, not an S3 object storage class.
Source: Amazon S3 Storage Classes
A company wants a fully managed AI service that can add pre-built machine learning capabilities like building conversational chatbots to its application without needing deep ML expertise. Which AWS service fits this?
✅ Amazon Lex
⬜ Amazon EBS
⬜ AWS Direct Connect
⬜ Amazon Route 53
Correct answer: Amazon Lex
Amazon Lex is a fully managed AI service for building conversational interfaces (chatbots and voice assistants) using natural language understanding, without requiring deep machine learning expertise to get started.
Why the other options are incorrect:
● Amazon EBS — Amazon EBS is block storage for EC2, unrelated to conversational AI.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to AI services.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to conversational AI.
Source: Amazon Lex
An organization is currently operating MySQL databases on its own on-premises servers. To reduce the operational burden of database maintenance and management, the organization wants to move to a fully managed AWS database offering. Which migration strategy best aligns with this goal?
⬜ Rehost the MySQL databases as-is on Amazon EC2 instances, keeping full control over the operating system and database software.
✅ Use AWS Database Migration Service (AWS DMS) to migrate the on-premises MySQL databases to Amazon RDS for MySQL.
⬜ Back up the on-premises databases to Amazon S3 and manually restore them onto new self-managed database servers within a VPC.
⬜ Replace the MySQL databases with Amazon DynamoDB tables to remove the need for database administration entirely.
Correct answer: Use AWS Database Migration Service (AWS DMS) to migrate the on-premises MySQL databases to Amazon RDS for MySQL.
AWS DMS is purpose-built to migrate databases like MySQL into fully managed AWS database services with minimal downtime. Migrating to Amazon RDS for MySQL keeps the same database engine while AWS takes over patching, backups, and replication — directly reducing the organization’s operational burden.
Why the other options are incorrect:
● Rehost the MySQL databases as-is on Amazon EC2 instances, keeping full control over the operating system and database software. — Rehosting on Amazon EC2 still requires the organization to manage the operating system and database software itself, so it does not reduce operational burden the way a fully managed service does.
● Back up the on-premises databases to Amazon S3 and manually restore them onto new self-managed database servers within a VPC. — Manually backing up and restoring onto self-managed servers is not a request for anything managed and introduces unnecessary manual effort and downtime.
● Replace the MySQL databases with Amazon DynamoDB tables to remove the need for database administration entirely. — DynamoDB is a NoSQL database with a different data model; switching engines entirely is a re-architecture, not a straightforward migration path to a fully managed relational service.
Source: Migrate an on-premises MySQL database to Amazon RDS for MySQL
Domain 4: Billing, Pricing, and Support (12%)
A company has a steady, predictable EC2 workload it expects to run continuously for the next year and wants to reduce its compute costs compared to On-Demand pricing in exchange for a commitment. Which purchasing option is generally the best fit?
⬜ Spot Instances
✅ Reserved Instances or Savings Plans
⬜ Pay only On-Demand pricing with no commitment
⬜ Dedicated Hosts, chosen purely for cost savings
Correct answer: Reserved Instances or Savings Plans
Reserved Instances and Savings Plans both offer significant discounts compared to On-Demand pricing in exchange for a committed usage term (such as 1 or 3 years), making them well suited for steady, predictable workloads.
Why the other options are incorrect:
● Spot Instances — Spot Instances offer deep discounts but can be interrupted, making them unsuitable for a workload that must run continuously and predictably.
● Pay only On-Demand pricing with no commitment — Staying on pure On-Demand pricing forgoes the available discount for a workload with predictable, steady usage.
● Dedicated Hosts, chosen purely for cost savings — Dedicated Hosts are primarily chosen for licensing or compliance requirements (physical server isolation), not purely for cost savings, and are typically more expensive than Reserved Instances/Savings Plans for pure cost optimization.
Source: Amazon EC2 Reserved Instances
A company wants to set spending thresholds for its AWS usage and receive automated alerts when actual or forecasted costs exceed those thresholds. Which AWS service is designed for this?
✅ AWS Budgets
⬜ AWS Direct Connect
⬜ Amazon Route 53
⬜ AWS Artifact
Correct answer: AWS Budgets
AWS Budgets lets a company set custom cost and usage budgets and configure alerts that notify them when actual or forecasted spending exceeds the defined thresholds.
Why the other options are incorrect:
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to budget alerting.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to cost budgeting.
● AWS Artifact — AWS Artifact provides compliance documentation, unrelated to cost budgeting.
Source: AWS Budgets
A company wants to visualize and analyze its historical AWS spending patterns over time, broken down by service, to identify cost trends. Which AWS tool is designed for this?
✅ AWS Cost Explorer
⬜ Amazon CloudWatch Logs
⬜ AWS Direct Connect
⬜ Amazon Route 53
Correct answer: AWS Cost Explorer
AWS Cost Explorer provides visualization and analysis tools for viewing and understanding historical AWS spending and usage patterns over time, including breakdowns by service, which helps identify cost trends.
Why the other options are incorrect:
● Amazon CloudWatch Logs — Amazon CloudWatch Logs stores and analyzes application/system logs, not billing/cost data specifically.
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to cost analysis.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to cost analysis.
Source: AWS Cost Explorer
Before deploying a new workload, a company wants to estimate the monthly cost of a proposed AWS architecture based on selected services and configurations. Which AWS tool is designed for this pre-deployment cost estimation?
✅ AWS Pricing Calculator
⬜ AWS Config
⬜ Amazon GuardDuty
⬜ AWS CloudTrail
Correct answer: AWS Pricing Calculator
The AWS Pricing Calculator lets a company build out a proposed architecture and estimate the associated AWS costs before actually deploying any resources, supporting cost planning.
Why the other options are incorrect:
● AWS Config — AWS Config evaluates the configuration of already-deployed resources, not pre-deployment cost estimates.
● Amazon GuardDuty — Amazon GuardDuty is a threat detection service, unrelated to cost estimation.
● AWS CloudTrail — AWS CloudTrail records API call history, unrelated to cost estimation.
Source: AWS Pricing Calculator
A company manages multiple AWS accounts for different departments and wants to combine usage across all accounts onto a single bill, potentially unlocking volume pricing discounts. Which AWS capability supports this?
✅ AWS Organizations consolidated billing
⬜ AWS Direct Connect
⬜ Amazon Route 53
⬜ AWS Artifact
Correct answer: AWS Organizations consolidated billing
AWS Organizations consolidated billing combines usage from multiple member accounts onto a single paying account’s bill, which can also help the organization take advantage of volume pricing discounts across combined usage.
Why the other options are incorrect:
● AWS Direct Connect — AWS Direct Connect provides dedicated network connectivity, unrelated to consolidated billing.
● Amazon Route 53 — Amazon Route 53 is a DNS service, unrelated to billing consolidation.
● AWS Artifact — AWS Artifact provides compliance documentation, unrelated to billing consolidation.
A startup with no dedicated operations team wants access to basic AWS Support for billing and account questions at no additional cost beyond their AWS usage. Which AWS Support plan provides this baseline?
✅ AWS Basic Support, included automatically with every AWS account
⬜ AWS Enterprise Support only
⬜ AWS Business Support only
⬜ No support is available unless a paid plan is purchased
Correct answer: AWS Basic Support, included automatically with every AWS account
AWS Basic Support is included automatically with every AWS account at no additional cost, providing access to customer service, documentation, and support forums for account and billing questions, though not technical, service-specific guidance.
Why the other options are incorrect:
● AWS Enterprise Support only and AWS Business Support only — Enterprise and Business Support are paid tiers offering more comprehensive technical support with faster response times; they aren’t the free baseline included with every account.
● No support is available unless a paid plan is purchased — Some level of support (Basic Support) is always available automatically, without needing to purchase a plan.
Source: AWS Support Plans
Take all 52 questions as a timed online practice exam, free:-
Related Certification Exams
- AWS Certified AI Practitioner Exam Questions
- Google Cloud Associate Cloud Engineer (ACE) Exam Questions — the equivalent entry-level cert on Google Cloud.
- Microsoft Azure Fundamentals (AZ-900) Exam Questions — the equivalent entry-level cert on Azure.
