20 AWS Cloud Practitioner Practice Questions, Explained

These 20 questions are written in the same style and format as the real CLF-C02 exam — scenario-first, multiple choice, one correct answer per question — and split across all four domains in roughly the same proportion AWS uses. Cover the options with your hand, commit to an answer, then check the explanation. The explanation is the important part: knowing why the other three are wrong is what actually transfers to exam day.

Cloud Concepts

1. CapEx vs. OpEx

A company currently buys and maintains its own physical servers. A consultant recommends moving to AWS to convert this spending pattern from capital expenditure to operational expenditure. What does this mean?

• A. The company will pay a large upfront cost for AWS hardware
• B. The company will pay only for what it consumes, as it consumes it
• C. The company will no longer need to pay for compute at all
• D. The company will lease AWS hardware for a fixed multi-year term

Answer: B.CapEx means paying large amounts upfront for infrastructure you own; OpEx means paying incrementally for what you actually use. AWS's pay-as-you-go model turns fixed infrastructure costs into a variable expense — that's the core economic argument for moving to the cloud, independent of any specific service.

2. Elasticity vs. scalability

An e-commerce site sees traffic spike 10x during a flash sale, then return to normal within hours. Which cloud characteristic describes the infrastructure automatically shrinking back down afterward?

• A. Scalability
• B. High availability
• C. Elasticity
• D. Fault tolerance

Answer: C. Scalability is the ability to handle growth (usually in one direction — up). Elasticity specifically means resources expand andcontract automatically to match real-time demand, which is exactly the “spike then shrink back” behavior described here.

3. Regions, Availability Zones, and edge locations

A company wants its application to survive the complete failure of one data center without any downtime. What should the architecture span, at minimum?

• A. A single Availability Zone with two EC2 instances
• B. Two or more Availability Zones within one Region
• C. A single edge location with caching enabled
• D. One Region only, with automated backups

Answer: B. Each Availability Zone is one or more physically separate data centers with independent power and networking. Spanning two or more AZs within a Region is the standard pattern for surviving a full data-center failure. A single AZ (A) shares the underlying facility risk; edge locations (C) are for content caching, not compute resilience.

4. The Well-Architected Framework

A team is reviewing their workload and asks, “are we paying for more compute than we actually need?” Which Well-Architected Framework pillar does this question belong to?

• A. Operational Excellence
• B. Reliability
• C. Cost Optimization
• D. Performance Efficiency

Answer: C.Cost Optimization is specifically about avoiding unnecessary spend and right-sizing resources. Performance Efficiency (D) is about using resources efficiently for performance — a related but distinct question of “is this the right tool,” not “are we overpaying.”

5. Migration strategy

A company wants to move a legacy application to AWS as fast as possible, with the smallest number of code changes, before optimizing it later. Which migration strategy is this?

• A. Refactor
• B. Rehost (“lift and shift”)
• C. Repurchase
• D. Retire

Answer: B. Rehosting moves an application to AWS with minimal changes — often just moving VMs to EC2 — and is the fastest of the migration strategies. Refactoring (A) means re-architecting for cloud-native services, which takes longer but pays off more over time.

Security & Compliance

6. Shared Responsibility Model

A company runs an application on EC2. Under the Shared Responsibility Model, who is responsible for patching the guest operating system on that instance?

• A. AWS
• B. The customer
• C. Both AWS and the customer, split equally
• D. Whichever party set up the instance

Answer: B.For EC2, AWS secures the physical infrastructure, hypervisor, and networking — this is “security ofthe cloud.” The customer is responsible for the guest OS, patching, application software, and data — “security inthe cloud.” This split changes depending on the service (it's different for a managed service like Lambda), which is exactly why this pattern gets tested so often.

7. Root account best practice

What is the recommended first action after creating a new AWS account?

• A. Use the root account for all daily administrative tasks
• B. Enable MFA on the root account and create an IAM user for daily work
• C. Delete the root account entirely
• D. Share the root credentials with the operations team

Answer: B.AWS best practice is to lock down the root account with MFA, avoid using it day-to-day, and do all regular work through an IAM user or role with least-privilege permissions. The root account can't be deleted (C), and sharing root credentials (D) violates basic security hygiene.

8. Service control policies

A company uses AWS Organizations and wants to prevent every account in a specific organizational unit from ever launching resources outside two approved Regions. What should they use?

• A. An IAM permissions boundary on each user
• B. A Service Control Policy (SCP) on the organizational unit
• C. A resource-based policy on each S3 bucket
• D. AWS Config rules

Answer: B. SCPs are applied at the AWS Organizations level and set the maximum available permissions for every account underneath them — including the root user of member accounts. This makes them the right tool for organization-wide guardrails like Region restrictions, not an individual IAM policy.

9. Encryption at rest

A company needs to encrypt data stored in S3 and wants AWS to manage the encryption keys automatically without any extra configuration. Which option satisfies this with the least setup?

• A. Client-side encryption before upload
• B. SSE-S3 (server-side encryption with Amazon S3-managed keys)
• C. A custom encryption Lambda triggered on upload
• D. No encryption, relying on IAM policies alone

Answer: B. SSE-S3 lets AWS manage the encryption keys entirely, requiring no extra setup — you just enable it. SSE-KMS would give you more control over key policies and audit trails, but the question asks for the least setup, which points to SSE-S3.

10. Compliance documentation

Where would a company go to download AWS compliance reports, such as SOC and PCI DSS reports, for an internal audit?

• A. AWS Trusted Advisor
• B. AWS Artifact
• C. AWS Config
• D. Amazon Inspector

Answer: B. AWS Artifact is the self-service portal for AWS compliance reports and select agreements. Trusted Advisor (A) checks account best practices, and Inspector (D) is a vulnerability scanning service — neither hosts audit documentation.

11. GuardDuty

A security team wants continuous, automated threat detection across their AWS accounts, using machine learning to flag unusual API activity, without deploying any agents. Which service fits?

• A. Amazon GuardDuty
• B. AWS Shield
• C. Amazon Macie
• D. AWS WAF

Answer: A. GuardDuty is an agentless, managed threat detection service that analyzes account and network activity for malicious behavior. Macie (C) focuses specifically on discovering and protecting sensitive data in S3, and Shield/WAF (B, D) protect against DDoS and web exploits respectively — different problems.

Cloud Technology & Services

12. EC2 pricing model

A company runs a nightly batch job that can tolerate interruptions and restart later if needed. Which EC2 pricing model minimizes cost for this workload?

• A. On-Demand Instances
• B. Reserved Instances
• C. Spot Instances
• D. Dedicated Hosts

Answer: C. Spot Instances offer the deepest discount — up to 90% off On-Demand — in exchange for AWS being able to reclaim the capacity with short notice. That trade-off is a perfect fit for an interruption-tolerant batch job, and a poor fit for anything that must stay running continuously.

13. S3 storage class

A media company needs to store archival footage accessed once or twice a year, and can tolerate a retrieval time of several hours. Which storage class minimizes storage cost?

• A. S3 Standard
• B. S3 Standard-IA
• C. S3 Glacier Flexible Retrieval
• D. S3 Intelligent-Tiering

Answer: C.Glacier Flexible Retrieval is built for long-term archives that are rarely accessed and can tolerate retrieval delays measured in minutes to hours — and it's dramatically cheaper per GB than Standard or Standard-IA, which are meant for data you access far more often.

14. Relational vs. NoSQL

A gaming company needs a database for player session data with single-digit millisecond latency at massive scale, with a flexible, non-relational data structure. Which service fits best?

• A. Amazon RDS
• B. Amazon DynamoDB
• C. Amazon Redshift
• D. Amazon Aurora

Answer: B. DynamoDB is a fully managed NoSQL database built for exactly this profile — key-value/document data, single-digit millisecond performance, and massive horizontal scale. RDS and Aurora (A, D) are relational and better suited to structured, joinable data; Redshift (C) is a data warehouse for analytics, not low-latency transactional access.

15. Serverless compute

A company wants to run short code snippets in response to file uploads, without provisioning or managing any servers, paying only for the milliseconds of execution time. What should they use?

• A. Amazon EC2
• B. AWS Lambda
• C. Amazon Lightsail
• D. AWS Elastic Beanstalk

Answer: B. Lambda runs code in response to events (like an S3 upload) with zero server management and billing measured in execution time — the definition of serverless compute. EC2 and Lightsail (A, C) both involve managing a running server continuously.

16. Auto Scaling and Elastic Load Balancing

A web application needs to automatically add EC2 instances during peak traffic and distribute incoming requests evenly across them. Which two services together provide this?

• A. Amazon CloudFront and Route 53
• B. AWS Auto Scaling and Elastic Load Balancing
• C. Amazon S3 and Amazon CloudFront
• D. AWS Direct Connect and VPN

Answer: B. Auto Scaling adjusts the number of EC2 instances based on demand, and Elastic Load Balancing distributes incoming traffic across them — the standard pairing for elastic, highly available web applications.

17. Public vs. private subnets

In a VPC, a database instance should never be reachable directly from the internet, while a web server in front of it should be. Where should the database instance be placed?

• A. In a public subnet with a security group blocking all traffic
• B. In a private subnet with no route to an internet gateway
• C. In the same subnet as the web server, using the same security group
• D. Outside the VPC entirely

Answer: B. A private subnet has no direct route to an internet gateway, which is what actually prevents inbound internet access — not just a security group rule on an otherwise internet-facing subnet. This public/private split is the standard two-tier VPC architecture.

18. Content delivery

A company with users worldwide wants to reduce latency when delivering static website assets like images and videos. Which service is purpose-built for this?

• A. Amazon CloudFront
• B. AWS Direct Connect
• C. Amazon VPC
• D. AWS Global Accelerator

Answer: A.CloudFront is AWS's content delivery network — it caches content at edge locations close to users worldwide, directly reducing latency for static (and some dynamic) content. Global Accelerator (D) improves routing to application endpoints generally, but CDN caching is CloudFront's specific job.

Billing, Pricing & Support

19. Support plan tiers

A company needs 24/7 access to Cloud Support Engineers via phone, chat, and email, with a guaranteed response time for production-system-down issues. Which is the minimum support plan that provides this?

• A. Basic
• B. Developer
• C. Business
• D. Enterprise On-Ramp

Answer: C. Business is the first tier with full 24/7 access to Cloud Support Engineers across phone, chat, and email, plus a guaranteed one-hour response for production-system-down cases. Developer support (B) is business-hours email only for general guidance, and Basic (A) is account/billing support only.

20. Cost visibility tools

A finance team wants to visualize and forecast AWS spending trends over time and break costs down by service and tag. Which tool is built for this?

• A. AWS Trusted Advisor
• B. AWS Cost Explorer
• C. AWS Budgets
• D. AWS Config

Answer: B.Cost Explorer is specifically built to visualize, analyze, and forecast spend over time with filtering by service, tag, and more. AWS Budgets (C) sets spending thresholds and alerts once you cross them — useful, but it doesn't provide the same historical visualization and forecasting.

How you scored

If you got 16 or more of these right on your first pass without peeking, you're close to exam-ready — spend your remaining time on timed full-length mocks. If you missed several in Security & Compliance or Cloud Technology & Services, that's useful signal: those two domains carry 64% of the real exam, so that's where your next study block should go. Our study guide breaks that prioritization down week by week.