AWS Certified Cloud Practitioner (CLF-C02) Exam Questions

A company currently provisions new servers over weeks by ordering, racking, and configuring physical hardware. After migrating to AWS, the company can provision equivalent compute capacity in minutes. Which benefit of the AWS Cloud does this illustrate?

⬜ A. Elasticity
✅ B. Speed of deployment (agility)
⬜ C. Economies of scale
⬜ D. Global reach

Explanation:
Speed of deployment, often described as agility, refers to the ability to provision and access computing resources in minutes instead of the weeks or months required to procure and set up physical, on-premises hardware.
Why other options are incorrect:
A: Elasticity refers to automatically scaling resources up or down to match demand, not the initial speed of first provisioning them.
C: Economies of scale refers to AWS’s ability to lower costs as it aggregates usage across many customers, not deployment speed.
D: Global reach refers to the ability to deploy applications in multiple geographic locations worldwide, not deployment speed.
Source: What is Cloud Computing?

---

An application’s traffic fluctuates significantly between daytime and nighttime. Which benefit of the AWS Cloud allows compute capacity to automatically increase during peak hours and decrease during off-peak hours?

⬜ A. High availability
✅ B. Elasticity
⬜ C. Global infrastructure
⬜ D. Fixed costs

Explanation:
Elasticity is the ability to automatically scale computing resources up or down to match actual demand, which is exactly what’s needed to handle an application’s fluctuating daytime/nighttime traffic cost-efficiently.
Why other options are incorrect:
A: High availability refers to designing a system to remain operational and accessible, not to scaling capacity with demand.
C: Global infrastructure refers to AWS’s worldwide network of Regions and Availability Zones, not automatic scaling.
D: Fixed costs describe unchanging on-premises capital expenses, the opposite of the flexible, usage-based cost model the cloud enables.
Source: What is Cloud Computing?

---

Which AWS Well-Architected Framework pillar focuses on the ability to run workloads effectively, gain insight into their operations, and continuously improve supporting processes?

⬜ A. Security
⬜ B. Reliability
✅ C. Operational Excellence
⬜ D. Performance Efficiency

Explanation:
The Operational Excellence pillar focuses on running and monitoring systems to deliver business value and continually improving processes and procedures.
Why other options are incorrect:
A: Security focuses on protecting information, systems, and assets, not operational processes.
B: Reliability focuses on a workload’s ability to recover from failures and meet demand, not on operational monitoring/improvement processes specifically.
D: Performance Efficiency focuses on using computing resources efficiently, not on operational processes.
Source: AWS Well-Architected Framework

---

A company wants to select AWS resource types (such as compute) that most efficiently meet its workload’s requirements, and to keep that efficiency as demand and technology change over time. Which Well-Architected Framework pillar does this describe?

⬜ A. Cost Optimization
✅ B. Performance Efficiency
⬜ C. Sustainability
⬜ D. Security

Explanation:
The Performance Efficiency pillar focuses on using computing resources efficiently to meet system requirements, and maintaining that efficiency as demand changes and technologies evolve.
Why other options are incorrect:
A: Cost Optimization focuses on avoiding unnecessary costs, which is related but distinct from selecting resource types for performance.
C: Sustainability focuses on minimizing the environmental impacts of running cloud workloads.
D: Security focuses on protecting data, systems, and assets, not resource-type efficiency.
Source: AWS Well-Architected Framework

---

A company is planning its migration to AWS and wants a structured set of guidance covering business, people, governance, platform, security, and operations perspectives to help it succeed. Which AWS resource is designed for this?

⬜ A. AWS Well-Architected Framework
✅ B. AWS Cloud Adoption Framework (AWS CAF)
⬜ C. AWS Trusted Advisor
⬜ D. AWS Marketplace

Explanation:
The AWS Cloud Adoption Framework (AWS CAF) provides guidance across multiple perspectives (business, people, governance, platform, security, and operations) to help organizations plan and execute a successful cloud transformation.
Why other options are incorrect:
A: The Well-Architected Framework helps design and evaluate cloud architectures, not the broader organizational adoption journey.
C: AWS Trusted Advisor provides recommendations for individual accounts (cost, security, performance), not organization-wide migration guidance.
D: AWS Marketplace is a digital catalog for buying third-party software, unrelated to adoption planning guidance.
Source: AWS Cloud Adoption Framework

---

A company wants to migrate a database from on-premises to AWS with minimal changes to the underlying database engine, essentially moving it as-is to run on AWS infrastructure. Which migration strategy does this describe?

⬜ A. Refactor
✅ B. Rehost (“lift and shift”)
⬜ C. Retire
⬜ D. Retain

Explanation:
Rehosting, often called “lift and shift,” involves moving an application or database to AWS largely as-is, with minimal or no changes to the underlying architecture — the fastest and often first step in a migration journey.
Why other options are incorrect:
A: Refactoring involves re-architecting the application to take advantage of cloud-native features, which is a much larger change than described.
C: Retiring means decommissioning an application/database that’s no longer needed, not migrating it.
D: Retaining means keeping the application/database on-premises for now, not migrating it to AWS.
Source: Migration strategies for application

---

Which statement correctly distinguishes between the on-premises and AWS Cloud cost models regarding compute infrastructure?

⬜ A. On-premises infrastructure is typically a variable cost, while AWS Cloud usage is a fixed cost paid upfront.
✅ B. On-premises infrastructure typically requires a large upfront capital expenditure (a fixed cost), while AWS Cloud usage is generally billed as a variable operating expense based on actual consumption.
⬜ C. There is no cost model difference between on-premises and AWS Cloud infrastructure.
⬜ D. AWS Cloud requires the same upfront hardware purchase as on-premises infrastructure.

Explanation:
On-premises infrastructure typically requires significant upfront capital expenditure (fixed costs) to purchase hardware regardless of how much it’s used, while AWS Cloud usage is generally billed as a variable expense based on actual consumption — trading capital expense for operating expense.
Why other options are incorrect:
A: This reverses the correct relationship; on-premises is the fixed/upfront cost model, not AWS.
C: There is a meaningful cost model difference, which is a key benefit of cloud economics.
D: AWS Cloud specifically eliminates the need for upfront hardware purchases, unlike on-premises infrastructure.
Source: Cloud Economics Center

---

A company notices that several of its Amazon EC2 instances are consistently underutilized, running at low CPU utilization most of the time. Which cost-optimization concept involves adjusting resource types and sizes to better match actual workload requirements?

✅ A. Rightsizing
⬜ B. Reserved Instance purchasing only
⬜ C. Consolidated billing
⬜ D. Data transfer optimization

Explanation:
Rightsizing is the practice of matching instance types and sizes to actual workload performance and capacity requirements at the lowest possible cost, which directly addresses consistently underutilized resources.
Why other options are incorrect:
B: Reserved Instances offer a discount for committed usage, but don’t by themselves fix a mismatch between instance size and actual need.
C: Consolidated billing combines billing across multiple AWS accounts; it doesn’t address individual resource utilization.
D: Data transfer optimization concerns network cost, not compute resource sizing.
Source: Right Sizing

---

A software vendor wants to bring an existing on-premises software license to AWS and use it on AWS infrastructure, rather than paying for a new AWS-included license. Which licensing concept does this describe?

✅ A. Bring Your Own License (BYOL)
⬜ B. License-included pricing
⬜ C. Reserved Instance pricing
⬜ D. Spot pricing

Explanation:
Bring Your Own License (BYOL) allows a customer to use an existing, already-purchased software license on AWS infrastructure, as an alternative to paying for AWS’s own included-license pricing for that software.
Why other options are incorrect:
B: License-included pricing bundles the software license cost into the AWS service price, which is the opposite of using an existing license.
C and D: Reserved Instance and Spot pricing are EC2 compute purchasing options and are unrelated to software licensing models.
Source: Cloud Economics Center

---

Which of these is an example of achieving high availability for an application running on AWS?

⬜ A. Running the application on a single Amazon EC2 instance in one Availability Zone.
✅ B. Deploying the application across multiple Availability Zones within a Region.
⬜ C. Storing all application data only on a local laptop.
⬜ D. Disabling all monitoring to reduce costs.

Explanation:
Deploying an application across multiple Availability Zones within a Region is a standard way to achieve high availability, since Availability Zones are physically separated and don’t share single points of failure, so a failure in one doesn’t take down the whole application.
Why other options are incorrect:
A: A single EC2 instance in one Availability Zone is a single point of failure, the opposite of high availability.
C: Storing data on a local laptop offers no availability or durability at all in the context of a cloud-hosted application.
D: Disabling monitoring doesn’t affect availability directly and removes visibility needed to detect and respond to failures.
Source: What is Cloud Computing?

---

A large enterprise deploying the same workload individually would incur high infrastructure costs, but AWS can offer lower prices because it aggregates usage from millions of customers to negotiate better rates and achieve operational efficiencies. Which cloud economics concept does this describe?

⬜ A. Rightsizing
✅ B. Economies of scale
⬜ C. Bring Your Own License (BYOL)
⬜ D. Total cost of ownership (TCO) only for on-premises

Explanation:
Economies of scale refers to AWS’s ability to lower per-unit costs as it aggregates demand and usage across a very large number of customers, and to pass some of those savings on through lower prices.
Why other options are incorrect:
A: Rightsizing is about matching individual resource sizes to workload needs, not about aggregate-scale cost advantages.
C: BYOL is a software licensing approach, unrelated to aggregate scale-driven pricing.
D: TCO is a cost-comparison concept used to evaluate on-premises vs. cloud costs, not the scale-driven pricing mechanism itself.
Source: Cloud Economics Center

---

Which AWS Well-Architected Framework pillar was added to address minimizing the environmental impact of running cloud workloads, such as energy efficiency and resource usage?

⬜ A. Reliability
✅ B. Sustainability
⬜ C. Cost Optimization
⬜ D. Security

Explanation:
The Sustainability pillar focuses on minimizing the environmental impacts of running cloud workloads, including energy efficiency, resource efficiency, and reducing the overall environmental footprint of a workload.
Why other options are incorrect:
A: Reliability addresses a workload’s ability to recover from failures and meet demand, not environmental impact.
C: Cost Optimization focuses on avoiding unnecessary spending, which can be related to efficiency but is a distinct concern from environmental sustainability.
D: Security focuses on protecting data, systems, and assets, not environmental impact.
Source: AWS Well-Architected Framework

---

Under the AWS Shared Responsibility Model, which of the following is generally AWS’s responsibility, not the customer’s?

⬜ A. Configuring security group rules for an EC2 instance.
✅ B. Security OF the cloud — protecting the physical infrastructure, hardware, and host operating systems that run AWS services.
⬜ C. Encrypting the customer’s own application data.
⬜ D. Managing IAM users and permissions.

Explanation:
AWS is responsible for security OF the cloud: protecting the underlying global infrastructure, including hardware, software, networking, and facilities that run AWS services.
Why other options are incorrect:
A: Configuring security groups is a customer responsibility (security IN the cloud) for controlling their own resources’ network access.
C: Encrypting application data is a customer responsibility, since AWS doesn’t know what needs to be encrypted or how.
D: Managing IAM users and permissions is a customer responsibility for controlling access to their own AWS account and resources.
Source: AWS Shared Responsibility Model

---

For a managed database service like Amazon RDS, which of the following is the CUSTOMER’s responsibility under the Shared Responsibility Model?

⬜ A. Patching the underlying database engine software.
⬜ B. Maintaining the physical data center facilities.
✅ C. Managing database access permissions, data content, and network configuration (such as security groups) for their database instance.
⬜ D. Replacing failed physical hard drives in the data center.

Explanation:
For managed services like Amazon RDS, AWS manages more of the underlying infrastructure and patching, but the customer remains responsible for managing access permissions, the data itself, and network-level configuration such as security groups controlling access to the database.
Why other options are incorrect:
A: For RDS specifically, AWS manages patching of the underlying database engine as part of the managed service.
B: Physical data center facilities are always an AWS responsibility, regardless of the service.
D: Physical hardware maintenance is always an AWS responsibility, never a customer one.
Source: AWS Shared Responsibility Model

---

A company needs to download AWS’s compliance reports, such as SOC reports and ISO certifications, to satisfy an internal audit requirement. Which AWS service provides on-demand access to this compliance documentation?

✅ A. AWS Artifact
⬜ B. AWS Trusted Advisor
⬜ C. AWS Config
⬜ D. AWS Shield

Explanation:
AWS Artifact is a self-service portal that provides on-demand access to AWS’s compliance reports and select online agreements, exactly meeting the need to download reports like SOC and ISO certifications for an audit.
Why other options are incorrect:
B: AWS Trusted Advisor provides account-specific best-practice recommendations, not AWS’s own compliance reports.
C: AWS Config tracks and evaluates the configuration of a customer’s own AWS resources, not AWS’s compliance certifications.
D: AWS Shield provides DDoS protection and has nothing to do with compliance documentation.
Source: AWS Artifact

---

Which AWS service continuously monitors for malicious activity and unauthorized behavior, such as unusual API calls or potentially compromised EC2 instances, using machine learning and threat intelligence?

✅ A. Amazon GuardDuty
⬜ B. AWS Config
⬜ C. AWS Artifact
⬜ D. AWS Budgets

Explanation:
Amazon GuardDuty is a threat detection service that continuously monitors for malicious activity and unauthorized behavior across AWS accounts and workloads, using machine learning, anomaly detection, and integrated threat intelligence.
Why other options are incorrect:
B: AWS Config tracks and evaluates resource configuration compliance, not real-time threat detection.
C: AWS Artifact provides compliance documentation, not threat monitoring.
D: AWS Budgets tracks costs and usage against budgets, unrelated to security threat detection.
Source: Amazon GuardDuty

---

A company’s public-facing web application needs protection against common web exploits, such as SQL injection and cross-site scripting (XSS), at the application layer. Which AWS service is purpose-built for this?

✅ A. AWS WAF (Web Application Firewall)
⬜ B. AWS Shield only
⬜ C. Amazon Route 53
⬜ D. AWS Direct Connect

Explanation:
AWS WAF is a web application firewall that helps protect web applications from common web exploits like SQL injection and cross-site scripting by letting customers configure rules that filter and monitor HTTP/HTTPS requests.
Why other options are incorrect:
B: AWS Shield primarily provides protection against Distributed Denial of Service (DDoS) attacks, not general web application-layer exploits like SQL injection.
C: Amazon Route 53 is a DNS and domain registration service, unrelated to web application firewalling.
D: AWS Direct Connect provides a dedicated network connection to AWS, unrelated to web application protection.
Source: What is AWS WAF?

---

Which AWS service is specifically designed to provide protection against Distributed Denial of Service (DDoS) attacks?

✅ A. AWS Shield
⬜ B. AWS Config
⬜ C. Amazon Inspector
⬜ D. AWS Trusted Advisor

Explanation:
AWS Shield is a managed service specifically designed to provide protection against Distributed Denial of Service (DDoS) attacks, with a Standard tier included automatically and an Advanced tier offering enhanced protections.
Why other options are incorrect:
B: AWS Config monitors resource configuration compliance, not DDoS protection.
C: Amazon Inspector performs automated vulnerability assessments of workloads, not DDoS protection specifically.
D: AWS Trusted Advisor gives best-practice recommendations, not active DDoS protection.
Source: AWS Shield

---

A company wants to continuously track configuration changes to its AWS resources and evaluate whether those configurations comply with internal policies over time. Which AWS service should they use?

✅ A. AWS Config
⬜ B. AWS Budgets
⬜ C. Amazon SNS
⬜ D. AWS Direct Connect

Explanation:
AWS Config records and evaluates the configuration of AWS resources over time, allowing a company to assess and audit compliance against defined configuration rules — a governance and compliance capability.
Why other options are incorrect:
B: AWS Budgets tracks costs and spending against budgets, not resource configuration compliance.
C: Amazon SNS is a messaging/notification service, unrelated to configuration tracking.
D: AWS Direct Connect provides dedicated network connectivity, unrelated to configuration compliance.
Source: What Is AWS Config?

---

Which AWS service records a detailed history of API calls made within an AWS account, including who made the call and when, supporting security analysis and auditing?

✅ A. AWS CloudTrail
⬜ B. Amazon CloudWatch only
⬜ C. AWS Organizations
⬜ D. Amazon QuickSight

Explanation:
AWS CloudTrail records detailed account activity, including API calls made through the AWS Management Console, SDKs, and CLI, along with who made the call and when — essential for security auditing and governance.
Why other options are incorrect:
B: Amazon CloudWatch focuses on monitoring metrics, logs, and alarms for operational performance, which is complementary but distinct from CloudTrail’s API call auditing.
C: AWS Organizations manages multiple AWS accounts centrally, but doesn’t itself record detailed API call history.
D: Amazon QuickSight is a business intelligence/visualization service, unrelated to API call auditing.
Source: AWS CloudTrail User Guide

---

Which of these is considered a best practice for protecting the AWS account root user?

⬜ A. Use the root user account for all daily administrative tasks.
✅ B. Enable multi-factor authentication (MFA) on the root user and avoid using it for everyday tasks, creating IAM users/roles instead.
⬜ C. Share the root user credentials with the entire engineering team for convenience.
⬜ D. Disable password requirements on the root user account.

Explanation:
Best practice is to enable MFA on the root user account, secure its credentials carefully, and avoid using it for day-to-day tasks — instead creating individual IAM users or roles with only the permissions each person or workload actually needs.
Why other options are incorrect:
A: Using the root user for daily tasks unnecessarily increases risk, since the root user has unrestricted access to the account.
C: Sharing root credentials among many people eliminates accountability and dramatically increases security risk.
D: Disabling password requirements would weaken, not strengthen, root user security.
Source: Root user tasks

---

A company wants to require users to provide a second form of verification, such as a code from an authenticator app, in addition to their password when signing in to AWS. Which security feature should they enable?

✅ A. Multi-factor authentication (MFA)
⬜ B. AWS Organizations
⬜ C. AWS Config rules
⬜ D. Amazon Route 53 failover routing

Explanation:
Multi-factor authentication (MFA) adds an extra layer of security by requiring users to provide a second verification factor, such as a one-time code from an authenticator app, in addition to their username and password.
Why other options are incorrect:
B: AWS Organizations manages multiple accounts centrally; it doesn’t itself provide the second-factor sign-in mechanism.
C: AWS Config rules evaluate resource configuration compliance, unrelated to sign-in authentication.
D: Route 53 failover routing manages DNS traffic failover, unrelated to user authentication.
Source: Using multi-factor authentication (MFA) in AWS

---

A company wants its employees to sign in once through a centralized portal and then access multiple AWS accounts and business applications without separate credentials for each. Which AWS service is designed for this kind of centralized workforce identity and single sign-on?

✅ A. AWS IAM Identity Center
⬜ B. Amazon GuardDuty
⬜ C. AWS Shield
⬜ D. AWS Artifact

Explanation:
AWS IAM Identity Center (successor to AWS Single Sign-On) provides centralized workforce identity management, letting employees sign in once and access multiple AWS accounts and supported business applications.
Why other options are incorrect:
B: GuardDuty is a threat detection service, unrelated to workforce single sign-on.
C: AWS Shield provides DDoS protection, unrelated to identity/access management.
D: AWS Artifact provides compliance documentation, unrelated to single sign-on.
Source: What is IAM Identity Center?

---

A development team needs to securely store and automatically rotate a database credential used by an application, rather than hardcoding it. Which AWS service is purpose-built for this?

✅ A. AWS Secrets Manager
⬜ B. Amazon S3 Standard storage class
⬜ C. AWS Direct Connect
⬜ D. Amazon Route 53

Explanation:
AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate secrets such as database credentials, API keys, and other sensitive values, removing the need to hardcode them in application code.
Why other options are incorrect:
B: Amazon S3 Standard is general-purpose object storage; it isn’t designed with the credential rotation and fine-grained secret access controls Secrets Manager provides.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to secret storage.
D: Amazon Route 53 is a DNS service, unrelated to secret storage.
Source: What Is AWS Secrets Manager?

---

Which principle states that users and systems should be granted only the minimum permissions necessary to perform their required tasks, and no more?

✅ A. Principle of least privilege
⬜ B. Principle of shared responsibility
⬜ C. Principle of economies of scale
⬜ D. Principle of elasticity

Explanation:
The principle of least privilege states that identities (users, roles, or systems) should be granted only the permissions strictly necessary to perform their intended tasks, reducing the potential impact if credentials are compromised.
Why other options are incorrect:
B: Shared responsibility describes how security obligations are divided between AWS and the customer, a different concept from permission scoping.
C and D: Economies of scale and elasticity are cloud economics and scaling concepts, unrelated to access permission scoping.
Source: Security best practices in IAM

---

A company wants to identify security misconfigurations, get consolidated security findings, and check compliance status across multiple AWS security services in one centralized dashboard. Which AWS service aggregates this?

✅ A. AWS Security Hub
⬜ B. Amazon Route 53
⬜ C. AWS Direct Connect
⬜ D. Amazon QuickSight

Explanation:
AWS Security Hub provides a centralized view that aggregates, organizes, and prioritizes security findings and compliance status from multiple AWS security services (such as GuardDuty and Inspector) and partner tools.
Why other options are incorrect:
B: Amazon Route 53 is a DNS service, unrelated to security findings aggregation.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to security findings.
D: Amazon QuickSight is a business intelligence tool, not a security findings aggregator.
Source: What is AWS Security Hub?

---

Which AWS service encrypts data and manages the cryptographic keys used to protect that data across many AWS services, such as Amazon S3 and Amazon RDS?

✅ A. AWS Key Management Service (AWS KMS)
⬜ B. Amazon CloudWatch
⬜ C. AWS Trusted Advisor
⬜ D. Amazon SNS

Explanation:
AWS Key Management Service (AWS KMS) lets customers create and manage cryptographic keys used to encrypt data across many integrated AWS services, supporting both encryption at rest and in transit use cases.
Why other options are incorrect:
B: Amazon CloudWatch is a monitoring and observability service, unrelated to encryption key management.
C: AWS Trusted Advisor provides best-practice recommendations, not key management.
D: Amazon SNS is a messaging/notification service, unrelated to encryption.
Source: AWS Key Management Service Concepts

---

A company wants to define and provision its AWS infrastructure using version-controlled, repeatable configuration files rather than manually clicking through the AWS Management Console each time. Which approach does this describe?

✅ A. Infrastructure as Code (IaC), such as using AWS CloudFormation.
⬜ B. Manual console-only provisioning.
⬜ C. Only using the AWS Command Line Interface interactively, one command at a time, with no saved files.
⬜ D. Physically racking new on-premises servers.

Explanation:
Infrastructure as Code (IaC) — such as AWS CloudFormation templates — lets a company define infrastructure in version-controlled configuration files that can be repeatably and consistently provisioned, rather than manually configuring resources through the console each time.
Why other options are incorrect:
B: Manual console provisioning is repeatable but not version-controlled or automated, which is the opposite of the IaC approach described.
C: Ad hoc, one-off CLI commands with no saved files aren’t repeatable or version-controlled either.
D: Racking physical on-premises servers is unrelated to how AWS Cloud resources are provisioned.
Source: What is AWS CloudFormation?

---

Which statement correctly describes the relationship between AWS Regions and Availability Zones?

⬜ A. A Region contains exactly one Availability Zone.
✅ B. A Region is a physical geographic location that contains multiple, isolated Availability Zones, each consisting of one or more discrete data centers.
⬜ C. Availability Zones span multiple Regions.
⬜ D. Regions and Availability Zones are the same thing, just different names.

Explanation:
An AWS Region is a physical geographic area that contains multiple, isolated Availability Zones (each made up of one or more discrete data centers), which are designed not to share single points of failure with one another.
Why other options are incorrect:
A: Regions contain multiple Availability Zones (typically three or more), not exactly one.
C: Availability Zones exist within a single Region; they do not span multiple Regions.
D: Regions and Availability Zones are distinct concepts at different levels of AWS’s global infrastructure hierarchy.
Source: AWS Global Infrastructure

---

A company wants to serve cached content to end users with the lowest possible latency by placing content physically closer to users around the world. Which AWS global infrastructure component is designed for this?

⬜ A. Availability Zones
✅ B. Edge locations (used by services like Amazon CloudFront)
⬜ C. AWS Direct Connect locations only
⬜ D. AWS Local Zones exclusively

Explanation:
Edge locations are AWS’s globally distributed points of presence used by services like Amazon CloudFront to cache and deliver content closer to end users, reducing latency for content delivery.
Why other options are incorrect:
A: Availability Zones are part of a Region’s core infrastructure for running workloads with high availability, not specifically for edge caching.
C: Direct Connect locations provide dedicated network connectivity points, not content caching for end users.
D: AWS Local Zones extend AWS infrastructure closer to large population centers for low-latency compute, which is a different concept from edge caching locations.
Source: AWS Global Infrastructure

---

A company running a business-critical application wants to ensure the application remains available even if an entire AWS Region becomes unavailable. Which strategy addresses this?

⬜ A. Deploy the application in a single Availability Zone only.
⬜ B. Deploy the application across multiple Availability Zones within a single Region only.
✅ C. Deploy the application across multiple AWS Regions, so it can fail over if one Region becomes unavailable.
⬜ D. Rely solely on a single on-premises data center as a backup.

Explanation:
Deploying an application across multiple AWS Regions provides protection against an entire Region becoming unavailable, supporting disaster recovery and business continuity requirements that a multi-AZ, single-Region design cannot address.
Why other options are incorrect:
A: A single Availability Zone offers no protection against an AZ failure, let alone a Region-wide event.
B: Multiple Availability Zones protect against an AZ-level failure but not against a Region-wide outage.
D: Relying on a single on-premises data center doesn’t leverage AWS’s global infrastructure and reintroduces a single point of failure.
Source: AWS Global Infrastructure

---

A company has a short-lived, fault-tolerant batch processing workload that can be interrupted, and wants to minimize compute costs. Which EC2 purchasing/compute option is typically the most cost-effective fit?

⬜ A. On-Demand Instances
✅ B. Spot Instances
⬜ C. Dedicated Hosts
⬜ D. Savings Plans requiring a 3-year commitment

Explanation:
Spot Instances let a company use spare EC2 capacity at steep discounts compared to On-Demand pricing, making them well suited for fault-tolerant, interruptible workloads like short batch jobs, where the possibility of interruption is an acceptable tradeoff for lower cost.
Why other options are incorrect:
A: On-Demand Instances offer flexibility with no interruption risk, but at a higher price point than Spot for this fault-tolerant use case.
C: Dedicated Hosts provide a physical server dedicated to one customer, mainly for licensing/compliance needs, and are generally more expensive, not optimized for short interruptible batch jobs.
D: A 3-year Savings Plan commitment doesn’t fit a short-lived workload and is meant for steady, predictable long-term usage.
Source: Amazon EC2 Spot Instances

---

A company wants to run containerized applications without having to manage the underlying EC2 servers or clusters themselves. Which combination of AWS services fits this serverless container requirement?

⬜ A. Amazon EC2 with manually managed instances
✅ B. Amazon ECS or Amazon EKS running on AWS Fargate
⬜ C. AWS Direct Connect
⬜ D. Amazon Route 53

Explanation:
Running Amazon ECS or Amazon EKS on AWS Fargate lets a company run containers without provisioning or managing the underlying EC2 instances or clusters, since Fargate is a serverless compute engine for containers.
Why other options are incorrect:
A: Manually managed EC2 instances require the company to provision and manage the underlying servers, the opposite of the serverless requirement.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to container compute.
D: Amazon Route 53 is a DNS service, unrelated to container compute.
Source: AWS Fargate

---

A company wants to run short-lived, event-driven code (such as processing an uploaded file) without provisioning or managing any servers at all, paying only for the compute time consumed. Which AWS service fits this best?

✅ A. AWS Lambda
⬜ B. Amazon EC2 Reserved Instances
⬜ C. AWS Direct Connect
⬜ D. Amazon WorkSpaces

Explanation:
AWS Lambda is a serverless compute service that runs code in response to events (such as a file upload) without requiring any server provisioning or management, charging only for the compute time actually consumed.
Why other options are incorrect:
B: EC2 Reserved Instances still require managing EC2 servers and are billed for reserved capacity, not per-event execution.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to event-driven compute.
D: Amazon WorkSpaces provisions virtual desktops, unrelated to event-driven serverless code execution.
Source: AWS Lambda

---

A company’s web application experiences unpredictable spikes in traffic. Which AWS capability automatically adjusts the number of EC2 instances up or down based on demand?

✅ A. Amazon EC2 Auto Scaling
⬜ B. Amazon Route 53 only
⬜ C. AWS Direct Connect
⬜ D. AWS Artifact

Explanation:
Amazon EC2 Auto Scaling automatically adds or removes EC2 instances according to defined scaling policies and actual demand, helping maintain application availability and cost efficiency during traffic spikes and lulls.
Why other options are incorrect:
B: Amazon Route 53 handles DNS routing, not automatic instance scaling.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to scaling compute capacity.
D: AWS Artifact provides compliance documents, unrelated to scaling.
Source: What Is Amazon EC2 Auto Scaling?

---

A company wants to distribute incoming application traffic automatically across multiple EC2 instances in different Availability Zones to improve fault tolerance and availability. Which AWS service is designed for this?

✅ A. Elastic Load Balancing (ELB)
⬜ B. Amazon S3
⬜ C. AWS Storage Gateway
⬜ D. AWS Direct Connect

Explanation:
Elastic Load Balancing automatically distributes incoming application traffic across multiple targets, such as EC2 instances, in one or more Availability Zones, improving fault tolerance and availability.
Why other options are incorrect:
B: Amazon S3 is an object storage service, unrelated to distributing network traffic across compute instances.
C: AWS Storage Gateway connects on-premises environments to cloud storage, unrelated to load balancing.
D: AWS Direct Connect provides dedicated network connectivity to AWS, not load balancing across instances.
Source: What Is Elastic Load Balancing?

---

A company needs a fully managed relational database compatible with MySQL that automatically handles patching, backups, and replication. Which type of AWS database service fits this need?

⬜ A. Amazon DynamoDB
✅ B. Amazon RDS (or Amazon Aurora)
⬜ C. Amazon ElastiCache
⬜ D. Amazon S3 Glacier

Explanation:
Amazon RDS (and Amazon Aurora, which is MySQL- and PostgreSQL-compatible) are managed relational database services that handle much of the operational burden — including patching, backups, and replication — automatically.
Why other options are incorrect:
A: Amazon DynamoDB is a managed NoSQL database, not a relational (SQL-compatible) database service.
C: Amazon ElastiCache is an in-memory caching service, not a relational database.
D: Amazon S3 Glacier is a low-cost archival object storage service, not a database.
Source: Amazon RDS

---

A company needs a fully managed, key-value and document NoSQL database that delivers consistent, single-digit millisecond performance at virtually any scale. Which AWS service fits this requirement?

✅ A. Amazon DynamoDB
⬜ B. Amazon RDS for PostgreSQL
⬜ C. AWS Database Migration Service (AWS DMS)
⬜ D. Amazon Redshift

Explanation:
Amazon DynamoDB is a fully managed, serverless key-value and document NoSQL database designed to deliver consistent, single-digit millisecond performance at virtually any scale.
Why other options are incorrect:
B: Amazon RDS for PostgreSQL is a relational (SQL) database service, not a NoSQL key-value/document database.
C: AWS DMS is a database migration tool, not a database itself.
D: Amazon Redshift is a data warehouse service optimized for analytics, not a general-purpose low-latency NoSQL database.
Source: Amazon DynamoDB

---

A company wants to reduce database read latency for a frequently accessed dataset by caching query results in memory. Which AWS service is purpose-built for this?

✅ A. Amazon ElastiCache
⬜ B. AWS Storage Gateway
⬜ C. Amazon FSx
⬜ D. AWS Backup

Explanation:
Amazon ElastiCache provides fully managed, in-memory caching services (compatible with Redis and Memcached) specifically designed to reduce latency for frequently accessed data by caching it in memory rather than repeatedly querying the primary database.
Why other options are incorrect:
B: AWS Storage Gateway connects on-premises environments to AWS cloud storage; it is not an in-memory caching service.
C: Amazon FSx provides managed file storage systems, not in-memory caching.
D: AWS Backup is a centralized backup management service, unrelated to caching.
Source: Amazon ElastiCache

---

Which core components make up an Amazon VPC (Virtual Private Cloud) network, allowing a company to define an isolated section of the AWS Cloud with its own IP address range?

✅ A. Subnets, route tables, and gateways
⬜ B. S3 buckets only
⬜ C. DynamoDB tables only
⬜ D. AWS Lambda functions only

Explanation:
A VPC is built from components like subnets (dividing the VPC’s IP range across Availability Zones), route tables (controlling traffic routing), and gateways (such as internet gateways or NAT gateways for external connectivity) to define an isolated, configurable network.
Why other options are incorrect:
B, C, and D: S3 buckets, DynamoDB tables, and Lambda functions are compute/storage/database services that run within (or alongside) a VPC’s networking setup, but they are not themselves core VPC networking components.
Source: What Is Amazon VPC?

---

A company wants a scalable Domain Name System (DNS) web service to route end users to their application, and also wants to register a new domain name. Which AWS service provides both capabilities?

✅ A. Amazon Route 53
⬜ B. AWS Direct Connect
⬜ C. Amazon CloudFront only
⬜ D. Amazon VPC

Explanation:
Amazon Route 53 is a highly available and scalable DNS web service that also supports domain name registration, health checking, and traffic routing policies, fitting both requirements described.
Why other options are incorrect:
B: AWS Direct Connect provides a dedicated physical network connection to AWS, unrelated to DNS or domain registration.
C: Amazon CloudFront is a content delivery network (CDN); it does not provide domain registration.
D: Amazon VPC provides isolated cloud networking, not DNS resolution or domain registration.
Source: Amazon Route 53

---

A company wants a dedicated, private network connection between its on-premises data center and AWS, bypassing the public internet for more consistent network performance. Which AWS service should they use?

✅ A. AWS Direct Connect
⬜ B. Amazon Route 53
⬜ C. Amazon CloudFront
⬜ D. AWS Config

Explanation:
AWS Direct Connect establishes a dedicated, private network connection between a company’s on-premises environment and AWS, offering more consistent network performance than a typical internet-based connection.
Why other options are incorrect:
B: Amazon Route 53 is a DNS service, unrelated to dedicated private network connectivity.
C: Amazon CloudFront is a content delivery network, unrelated to dedicated on-premises-to-AWS connections.
D: AWS Config tracks resource configuration compliance, unrelated to network connectivity.
Source: AWS Direct Connect

---

A company stores infrequently accessed data that must still be retrievable within milliseconds when needed, but wants to minimize storage costs compared to its frequently accessed data. Which Amazon S3 storage class fits this use case?

⬜ A. S3 Standard
✅ B. S3 Standard-Infrequent Access (S3 Standard-IA)
⬜ C. S3 Glacier Deep Archive
⬜ D. Amazon EBS Provisioned IOPS

Explanation:
S3 Standard-IA is designed for data that is accessed less frequently but requires rapid access when needed, offering lower storage costs than S3 Standard while still providing millisecond first-byte retrieval.
Why other options are incorrect:
A: S3 Standard is optimized for frequently accessed data and costs more than S3 Standard-IA for infrequent access patterns.
C: S3 Glacier Deep Archive is the lowest-cost storage class but has retrieval times measured in hours, not milliseconds.
D: Amazon EBS is block storage for EC2 instances, not an S3 object storage class.
Source: Amazon S3 Storage Classes

---

A company wants a fully managed AI service that can add pre-built machine learning capabilities like building conversational chatbots to its application without needing deep ML expertise. Which AWS service fits this?

✅ A. Amazon Lex
⬜ B. Amazon EBS
⬜ C. AWS Direct Connect
⬜ D. Amazon Route 53

Explanation:
Amazon Lex is a fully managed AI service for building conversational interfaces (chatbots and voice assistants) using natural language understanding, without requiring deep machine learning expertise to get started.
Why other options are incorrect:
B: Amazon EBS is block storage for EC2, unrelated to conversational AI.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to AI services.
D: Amazon Route 53 is a DNS service, unrelated to conversational AI.
Source: Amazon Lex

---

A company has a steady, predictable EC2 workload it expects to run continuously for the next year and wants to reduce its compute costs compared to On-Demand pricing in exchange for a commitment. Which purchasing option is generally the best fit?

⬜ A. Spot Instances
✅ B. Reserved Instances or Savings Plans
⬜ C. Pay only On-Demand pricing with no commitment
⬜ D. Dedicated Hosts, chosen purely for cost savings

Explanation:
Reserved Instances and Savings Plans both offer significant discounts compared to On-Demand pricing in exchange for a committed usage term (such as 1 or 3 years), making them well suited for steady, predictable workloads.
Why other options are incorrect:
A: Spot Instances offer deep discounts but can be interrupted, making them unsuitable for a workload that must run continuously and predictably.
C: Staying on pure On-Demand pricing forgoes the available discount for a workload with predictable, steady usage.
D: Dedicated Hosts are primarily chosen for licensing or compliance requirements (physical server isolation), not purely for cost savings, and are typically more expensive than Reserved Instances/Savings Plans for pure cost optimization.
Source: Amazon EC2 Reserved Instances

---

A company wants to set spending thresholds for its AWS usage and receive automated alerts when actual or forecasted costs exceed those thresholds. Which AWS service is designed for this?

✅ A. AWS Budgets
⬜ B. AWS Direct Connect
⬜ C. Amazon Route 53
⬜ D. AWS Artifact

Explanation:
AWS Budgets lets a company set custom cost and usage budgets and configure alerts that notify them when actual or forecasted spending exceeds the defined thresholds.
Why other options are incorrect:
B: AWS Direct Connect provides dedicated network connectivity, unrelated to budget alerting.
C: Amazon Route 53 is a DNS service, unrelated to cost budgeting.
D: AWS Artifact provides compliance documentation, unrelated to cost budgeting.
Source: AWS Budgets

---

A company wants to visualize and analyze its historical AWS spending patterns over time, broken down by service, to identify cost trends. Which AWS tool is designed for this?

✅ A. AWS Cost Explorer
⬜ B. Amazon CloudWatch Logs
⬜ C. AWS Direct Connect
⬜ D. Amazon Route 53

Explanation:
AWS Cost Explorer provides visualization and analysis tools for viewing and understanding historical AWS spending and usage patterns over time, including breakdowns by service, which helps identify cost trends.
Why other options are incorrect:
B: Amazon CloudWatch Logs stores and analyzes application/system logs, not billing/cost data specifically.
C: AWS Direct Connect provides dedicated network connectivity, unrelated to cost analysis.
D: Amazon Route 53 is a DNS service, unrelated to cost analysis.
Source: AWS Cost Explorer

---

Before deploying a new workload, a company wants to estimate the monthly cost of a proposed AWS architecture based on selected services and configurations. Which AWS tool is designed for this pre-deployment cost estimation?

✅ A. AWS Pricing Calculator
⬜ B. AWS Config
⬜ C. Amazon GuardDuty
⬜ D. AWS CloudTrail

Explanation:
The AWS Pricing Calculator lets a company build out a proposed architecture and estimate the associated AWS costs before actually deploying any resources, supporting cost planning.
Why other options are incorrect:
B: AWS Config evaluates the configuration of already-deployed resources, not pre-deployment cost estimates.
C: Amazon GuardDuty is a threat detection service, unrelated to cost estimation.
D: AWS CloudTrail records API call history, unrelated to cost estimation.
Source: AWS Pricing Calculator

---

A company manages multiple AWS accounts for different departments and wants to combine usage across all accounts onto a single bill, potentially unlocking volume pricing discounts. Which AWS capability supports this?

✅ A. AWS Organizations consolidated billing
⬜ B. AWS Direct Connect
⬜ C. Amazon Route 53
⬜ D. AWS Artifact

Explanation:
AWS Organizations consolidated billing combines usage from multiple member accounts onto a single paying account’s bill, which can also help the organization take advantage of volume pricing discounts across combined usage.
Why other options are incorrect:
B: AWS Direct Connect provides dedicated network connectivity, unrelated to consolidated billing.
C: Amazon Route 53 is a DNS service, unrelated to billing consolidation.
D: AWS Artifact provides compliance documentation, unrelated to billing consolidation.
Source: Consolidated billing for AWS Organizations

---

A startup with no dedicated operations team wants access to basic AWS Support for billing and account questions at no additional cost beyond their AWS usage. Which AWS Support plan provides this baseline?

✅ A. AWS Basic Support, included automatically with every AWS account
⬜ B. AWS Enterprise Support only
⬜ C. AWS Business Support only
⬜ D. No support is available unless a paid plan is purchased

Explanation:
AWS Basic Support is included automatically with every AWS account at no additional cost, providing access to customer service, documentation, and support forums for account and billing questions, though not technical, service-specific guidance.
Why other options are incorrect:
B and C: Enterprise and Business Support are paid tiers offering more comprehensive technical support with faster response times; they aren’t the free baseline included with every account.
D: Some level of support (Basic Support) is always available automatically, without needing to purchase a plan.
Source: AWS Support Plans