CLF-C02 Amazon Web Services AWS Certified Cloud Practitioner Free Practice Exam Questions (2025 Updated)

When you run a NoSQL database on Amazon EC2 instances, you are responsible for managing the database layer and the guest operating system of the instances. This means that you need to perform tasks such as updating the operating system, maintaining high availability, and configuring the security group firewall. AWS is responsible for managing the physical infrastructure that hosts the EC2 instances. This means that AWS ensures that the hardware and firmware of the servers, routers, switches, and other devices are updated and secure. AWS also handles the power, cooling, networking, and security of the data centers12. References: CLF-C02: Which task is responsibility of AWS to run NoSQL database on …, Best Practices for Hosting NoSQL Databases on Amazon EC2

"The Reliability pillar encompasses the ability of a workload to perform its intended function correctly and consistently when it’s expected to. This includes the ability to operate and test the workload through its total lifecycle." https://docs.aws.amazon.com/wellarchitected/latest/framework/reliability.html

According to the AWS shared responsibility model, the customer is responsible for the security in the cloud, which includes configuring firewalls and networks. AWS provides security groups and network access control lists (NACLs) as firewall features that customers can use to control the traffic to andfrom their AWS resources. Customers are also responsible for managing their own virtual private clouds (VPCs), subnets, route tables, internet gateways, and other network components. AWS is responsible for the security of the cloud, which includes the physical security of the facilities, thehost operating system and virtualization layer, and the AWS global network infrastructure12. References:

Shared Responsibility Model - Amazon Web Services (AWS)

Shared responsibility model - Amazon Web Services: Risk and Compliance

Amazon GuardDutyis a threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior to help protect your AWS resources. It uses machine learning, anomaly detection, and integrated threat intelligence to detect when an instance or account might be compromised or if there are threats from attacks.

B. AWS WAF: Incorrect, as it is a web application firewall that protects against common web exploits but does not provide comprehensive threat detection.

C. AWS Shield: Incorrect, as it provides protection against DDoS attacks but does not detect compromises within AWS accounts.

D. Amazon Inspector: Incorrect, as it is a service that helps improve the security and compliance of applications deployed on AWS by assessing for vulnerabilities, not for threat detection.

AWS Cloud References:

Amazon GuardDuty

The AWS Cloud Adoption Framework (AWS CAF) is a tool that helps organizations plan and execute their cloud transformation journey. The AWS CAF defines four phases of the cloud transformation journey: Envision, Align, Launch, and Scale. Each phase has a specific purpose and outcome1:

Envision: This phase helps you define your vision, goals, and expected outcomes for your cloud transformation. It also helps you identify and prioritize transformation opportunities across four domains: business, people, governance, and platform2.

Align: This phase helps you identify capability gaps across six perspectives: business, people, governance, platform, security, and operations. It also helps you create strategies for improving your cloud readiness, ensure stakeholder alignment, and facilitate relevant organizational change management activities3.

Launch: This phase helps you deliver pilot initiatives in production and demonstrate incremental business value. It also helps you learn from pilots and adjust your approach before scaling to full production4.

Scale: This phase helps you expand production pilots and business value to desired scale and ensure that the business benefits associated with your cloud investments are realized and sustained.

The options A and B are the correct AWS CAF cloud transformation journey recommendations, as they are part of the four phases defined by the AWS CAF. The options C, D, and E are not AWS CAFcloud transformation journey recommendations, as they are not part of the four phases defined by the AWS CAF

Understanding Cost Optimization Recommendations: In AWS, cost optimization involves identifying ways to reduce costs while maintaining or improving performance and capacity.

Top-Level KPI - Estimated Monthly Saving:

Definition: This KPI provides an estimate of how much you can save per month by following the recommended actions.

Importance: It helps you quantify the potential cost savings from rightsizing, purchasing reserved instances, or optimizing resource usage.

Decision-Making: Provides a clear financial benefit to justify changes in your resource configurations.

How to Use Estimated Monthly Saving:

Access Recommendations: Navigate to the AWS Cost Management Console to view rightsizing recommendations.

Review Savings Estimates: Look at the estimated monthly savings for each recommendation to understand the potential financial impact.

Implement Recommendations: Prioritize actions based on the savings estimates to maximize cost reduction.

AWS Cost Management

AWS Rightsizing Recommendations

AWS Direct Connectis a cloud service solution that makes it easy to establish a dedicated network connection from your premises to AWS. This requires the use of an Internet Service Provider (ISP) and a colocation facility to connect to the Direct Connect location. It provides a private, high-speed, low-latency connection that does not go over the public internet.

A. AWS VPN: Incorrect, as AWS VPN establishes secure connections over the internet and does not necessarily require a colocation facility.

B. Amazon Connect: Incorrect, as it is a cloud-based contact center service.

D. Internet Gateway: Incorrect, as it is a horizontally scaled, redundant, and highly available VPC component that allows communication between instances in your VPC and the internet.

AWS Cloud References:

AWS Direct Connect

AWS Marketplace is an online store that helps customers find, buy, and immediately start using the software and services that run on AWS. Customers can choose from a wide range of software products in popular categories such as security, networking, storage, machine learning, business intelligence, database, and DevOps. Customers can also use AWS Marketplace to purchase software as a service (SaaS) solutions that are integrated with AWS. Customers can benefit from simplified procurement, billing, and deployment processes, as well as flexible pricing options and free trials. Customers can also leverage AWS Marketplace to discover and subscribe to solutions offered by AWS Partners, such as the security software vendor mentioned in the question. References: AWS Marketplace, [AWS Marketplace: Software as a Service (SaaS)], [AWS Cloud Practitioner Essentials: Module 6 - AWS Pricing, Billing, and Support]

AWS Storage Gateway is a hybrid cloud storage service that provides on-premises access to virtually unlimited cloud storage. You can use AWS Storage Gateway to simplify storage management and reduce costs for key hybrid cloud storage use cases. One of these use cases is tape-based backup, which allows you to store data backups on virtual tapes in the AWS Cloud. You can use the Tape Gateway feature of AWS Storage Gateway to extend your existing physical tape library to the AWS Cloud. Tape Gateway provides a virtual tape infrastructure that scales seamlessly with your backup needs and eliminates the operational burden of provisioning, scaling, and maintaining a physical tape infrastructure123. References: 1: CloudStorage Appliances, Hybrid Device - AWS Storage Gateway - AWS, 2: AWS Storage Gateway Documentation, 3: AWS Storage Gateway Features | Amazon Web Services

AWS CloudFormation is a service that allows developers to model and provision their AWS infrastructure in a repeatable and declarative way, using code and templates. AWS CloudFormation enables developers to define the resources they need for their development and production environments, such as compute, storage, network, and application services, and automate their creation and configuration. AWS CloudFormation also provides features such as change sets, nested stacks, and rollback triggers to help developers manage and update their infrastructure safely and efficiently12. References:

AWS CloudFormation

What is AWS CloudFormation?

AWS Storage Gatewayis a hybrid cloud storage service that provides on-premises access to virtually unlimited cloud storage. TheFile Gatewayconfiguration allows for on-premises applications to store data in Amazon S3 using NFS and SMB protocols, while keeping frequently accessed data cached locally. This meets the company's requirement for cloud-based storage that is locally cached.

B. AWS Snowcone: Incorrect, as it is a portable edge computing and storage device, not a storage service that provides local caching for cloud storage.

C. AWS Backup: Incorrect, as it is a centralized backup service to automate data protection across AWS services but does not provide local caching.

D. Amazon Elastic File System (Amazon EFS): Incorrect, as it provides scalable file storage for use with Amazon EC2 but does not offer local caching for on-premises storage needs.

AWS Cloud References:

AWS Storage Gateway

AWS serverless computing is a way of building and running applications without thinking about servers. AWS manages the infrastructure for you, so you don’t have to provision, scale, patch, or monitor servers. You only pay for the compute time you consume, and you can focus on your application logic instead of managing servers12. References: Serverless Computing – Amazon Web Services, AWS Serverless Computing, Benefits, Architecture and Use-cases - XenonStack

A Network Access Control List (ACL) is a stateless network filtering mechanism provided by AWS for controlling traffic in and out of subnets within a VPC. Unlike security groups, which are stateful, network ACLs are stateless. This means that they do not automatically allow responses to inbound traffic unlessexplicitly specified. Network ACLs allow you to set rules for both inbound and outbound traffic, making them suitable for stateless filtering. Security groups, on the other hand, are stateful, while AWS WAF is primarily for web application-level security. AWS PrivateLink is used for privately connecting VPCs to AWS services without using an internet gateway. Therefore, for stateless network filtering, Network ACL is the correct choice.

AWS PrivateLink provides private connectivity between VPCs, AWS services, and on-premises applications without exposing traffic to the public internet. It enables private access to AWS services by creating private endpoints within a VPC, which enhances security and simplifies network architecture by keeping all communication on the AWS network. This service is ideal for scenarios where a company wants to connect AWS services and VPCs privately.

Amazon Elastic File System (Amazon EFS)is a scalable, fully managed, shared file storage service that is accessible from multiple Amazon EC2 instances. EFS is designed to provide highly available and durable file storage that can be mounted across multiple instances, making it ideal for shared file access.

Why other options are not suitable:

A. AWS Direct Connect: A network service to establish a dedicated network connection to AWS, not a file-sharing solution.

B. AWS Snowball Edge: A data transfer device for migrating data to and from AWS, not for ongoing file sharing.

C. AWS Backup: A service for centralized backup management, not for sharing files between EC2 instances.

 Elasticity in the AWS Cloud refers to the ability to acquire resources as you need them and release resources when you no longer need them. In the cloud, you want to do this automatically1. This means that you can rightsized resources as demand shifts, and you can easily procure resources when they are needed. Elasticity is not related to how quickly an Amazon EC2 instance can be restarted, the maximum amount of RAM an Amazon EC2 instance can use, or the pay-as-you-go billing model. These are aspects of scalability, performance, and cost, respectively2.

For more information on elasticity, you can refer to the following sources:

Elasticity - AWS Well-Architected Framework

Elastic - Reactive Systems on AWS

What is the difference between scalability and elasticity?

Amazon EC2 Spot Instancesoffer spare AWS compute capacity at a significantly reduced cost compared to On-Demand Instances. Spot Instances are ideal for fault-tolerant and flexibleworkloads that can tolerate interruptions, such as batch jobs, data processing, or large-scale computations. These instances may be interrupted by AWS if there is a demand for capacity, but they provide the best cost optimization for workloads that can handle such interruptions.

Why other options are not suitable:

A. Amazon Macie: A data security and privacy service, not relevant to running batch jobs.

B. Amazon Neptune: A graph database service, not relevant to compute optimization.

D. Amazon EC2 On-Demand Instances: Provide flexible compute capacity but at a higher cost than Spot Instances, which are more suitable for cost optimization.

AWS App Runneris a fully managed service that makes it easy for developers to quickly deploy containerized web applications and APIs at scale. It can automatically build container images from source code or directly from a container registry, and then deploy the application without requiring deep container knowledge or expertise.

AWS App Runner meets the requirements of:

Automatically creating container images from source code.

Managing the deployment of the containerized application with minimal operational overhead.

Why other options are not suitable:

A. AWS Elastic Beanstalk: While it simplifies deploying and scaling web applications, it does not automatically create container images from source code.

B. Amazon Elastic Container Service (Amazon ECS): ECS is a container orchestration service that requires more manual setup for creating and managing container images and deployments.

D. Amazon EC2: This service provides virtual servers but does not offer managed container image creation or deployment.

AWS Cloud Development Kit (AWS CDK) is an open source software development framework that allows you to model and provision your cloud infrastructure using familiar programming languages such as TypeScript, Python, Java, and .NET. AWS CDK enables you to use the expressive power of your favorite language to define your cloud resources, such as compute, storage, network, and application services. AWS CDK also provides a library of high-level constructs that represent AWS services and best practices. AWS CDK uses AWS CloudFormation in the background to deploy your resources in a safe and repeatable manner12. References:

AWS Cloud Development Kit (CDK) – TypeScript and Python are Now Generally Available

AWS Cloud Development Kit (AWS CDK) - Introduction to DevOps on AWS

AWS Budgets is a service that allows you to set custom budgets for your AWS costs and usage, and receive alerts via email or Amazon SNS notifications if you exceed or are forecasted to exceed your budgeted amount1. You can create budgets based on different dimensions, such as service, linked account, tag, or purchase option, and define various types of alerts, such as actual, forecasted, or RI utilization alerts2. You can also configure custom actions to automatically execute remediation tasks or workflows when a budget threshold is breached3. AWS Budgets is the only service among the options that can send alerts to customers if custom spending thresholds are exceeded. The other options are not AWS services that provide this functionality.

AWS Application Migration Service (AWS MGN) is the primary service for migrating Amazon EC2 instances and on-premises servers to AWS, and it supports migration from one AWS Region to another. It automates the process of replicating and converting the source servers (including their applications, configurations, and data) to run natively on AWS. AWS Database Migration Service (DMS) is for migrating databases, AWS DataSync is for data transfer, and AWS Migration Hub provides a single location to track migration tasks across multiple AWS services but does not perform the migration itself.

AWS Direct Connect is a service that establishes a dedicated network connection between your on-premises network and one or more AWS Regions. AWS Direct Connect can be used to create a private connection between an on-premises workload and an AWS Cloud workload, bypassing the public internet and reducing network costs, latency, and bandwidth issues. AWS Direct Connect can also provide increased security and reliability for your hybrid cloud applications and data transfers. References:

AWS Direct Connect

What is AWS Direct Connect?

AWS Direct Connect User Guide

Understanding the Reliability Pillar: The Reliability pillar of the AWS Well-Architected Framework focuses on the ability of a system to recover from infrastructure or service disruptions, dynamically acquire computing resources to meet demand, and mitigate disruptions such as misconfigurations or transient network issues.

Key Concepts of Reliability:

Foundations: Ensure a solid foundation on which to build, including AWS account management, limits, and networking.

Change Management: Manage changes in automation to ensure systems remain reliable during modifications.

Failure Management: Design systems to detect failures and automatically recover from them.

How to Align with Reliability Pillar:

Implement Multi-AZ Deployments: Deploy applications across multiple Availability Zones to ensure fault tolerance.

Use Auto Scaling: Automatically adjust resources to maintain system performance during demand fluctuations.

Monitor and Respond: Implement monitoring and alerting mechanisms using services like CloudWatch to detect and respond to issues proactively.

AWS Well-Architected Framework: Reliability Pillar

AWS Artifact is your go-to, central resource for compliance-related information that matters to you. It provides on-demand access to AWS’s security and compliance reports and select online agreements. Reports available in AWS Artifact include our Service Organization Control (SOC) reports, Payment Card Industry (PCI) attestation of compliance, and certifications from accreditation bodies across geographies and compliance verticals that validate the implementation and operating effectiveness of AWS security controls. Agreements available in AWS Artifact include the Business Associate Addendum (BAA) and the Nondisclosure Agreement (NDA). AWS Artifact helps you answer the most frequently asked security and compliance questions that AWS receives from its users. References: Compliance FAQ, Compliance Solutions Guide

AWS Organizations is the AWS service or feature that allows users to create new AWS accounts, group multiple accounts to organize workflows, and apply policies to groups of accounts. AWS Organizations enables users to centrally manage and govern their AWS environment across multiple accounts. Users can create organizational units (OUs) to group accounts based on their business needs, such as by function, project, or region. Users can also apply service control policies (SCPs) toOUs or individual accounts to define the permissions and restrictions for the AWS services and resources that they can access. AWS Organizations also offers features such as consolidated billing, account creation automation, and trusted access12. References:

AWS Organizations

What is AWS Organizations?

Amazon Route 53 is a highly available and scalable Domain Name System (DNS) web service that can route internet traffic to the company’s ecommerce platform1. Route 53 can also register domain names, check the health of resources, and provide global DNS features2. Route 53 can connect users to the platform by translating human-readable names like www.example.com into the numeric IP addresses that computers use to communicate witheach other2. References: 1: Amazon Route 53 | DNS Service | AWS; 2: What is Amazon Route 53? - Amazon Route 53

Amazon EC2 On-Demand Instances are ideal for unpredictable workloads that do not require a long-term commitment. This option allows users to pay for compute capacity by the hour or second, with no long-term commitments. It is suitable for short-term, spiky, or unpredictable workloads that cannot be interrupted and require flexibility. Option A is better suited for Reserved Instances, Option B is ideal for Spot Instances, and Option D is more suited for Reserved Instances due to cost optimization for long-term use.

"There is no long-term commitment required when you purchase On-Demand Instances. You pay only for the seconds that your On-Demand Instances are in the running state, with a 60-second minimum. The price per second for a running On-Demand Instance is fixed, and is listed on the Amazon EC2 Pricing, On-Demand Pricing page. We recommend that you use On-Demand Instances for applications with short-term, irregular workloads that cannot be interrupted."https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-on-demand-instances.html

According to the AWS shared responsibility model, AWS is responsible for protecting the infrastructure that runs all ofthe services offered in the AWS Cloud, such as data centers, hardware, software, networking, and facilities1. This includes the configuration of infrastructure devices, such as routers, switches, firewalls, and load balancers2. Customers are responsible for managing their data, applications, operating systems, security groups, and other aspects of their AWS environment1. Therefore, options A, B, and D are customer responsibilities, not AWS responsibilities. References: 1: AWS Well-Architected Framework - Elasticity; 2: Reactive Systems on AWS - Elastic

AWS Technical Account Managers (TAMs) are available to customers who subscribe to either theAWS Enterprise On-RamporAWS Enterprise Supportplans. TAMs provide proactive guidance and ongoing support, assisting with architecture reviews, operational performance improvements, and business reviews. TheBasicandDeveloperSupport plans do not include access to TAMs, and whileBusiness Supportoffers enhanced technical support, it does not include TAMs either.