CLF-C02 Amazon Web Services AWS Certified Cloud Practitioner Free Practice Exam Questions (2025 Updated)

AWS Transit Gateway acts as a cloud router for connecting multiple VPCs and on-premises networks, simplifying network management by creating a hub-and-spoke model for routing traffic. Direct Connect provides a private connection to AWS but does not function as a central router. Amazon Connect is unrelated, and Route 53 is for DNS services, not VPC connectivity.

AWS Direct Connect provides a dedicated private network connection from on-premises data centers directly to the AWS Cloud, bypassing the public internet. This setup is ideal for reducing network costs, increasing bandwidth throughput, and providing a more consistent network experience compared to standard internet connections. Other services, such as Amazon VPC, relate to networking but do not establish a private network connection from on-premises to AWS.

One of the main advantages of cloud computing is the ability to trade fixed capital expenditures for variable operating expenses. By moving to the AWS Cloud, the company pays only for the resources it uses on a per-usage basis, reducing the need for large upfront investments in data center infrastructure. This benefit allows for more flexible and cost-effective spending based on actual usage. Other options, such as increased speed and agility or global reach, are also cloud benefits but do not specifically address the shift from fixed to variable expenses.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards AWS applications against network and transport layer attacks. AWS Shield Standard is automatically included with all AWS services and offers protection against common DDoS attacks. For more advanced protection, AWS Shield Advanced provides additional DDoS mitigation measures. Although AWS WAF, Firewall Manager, and GuardDuty contribute to security, they do not specialize in DDoS mitigation at the network layer like AWS Shield does.

Scaling horizontally, or adding more instances of resources rather than increasing the size of a single instance, is a core principle of the Performance Efficiency pillar of the AWS Well-Architected Framework. It enables applications to handle increasing loads by distributing traffic across multiple resources. Other options, such as serverless architectures, managed services, and cost measurement, align with other pillars of the framework.

Amazon Rekognition provides machine learning capabilities to analyze images and videos, enabling the detection of objects, people, text, and scenes. It is designed specifically for image and video analysis, making it suitable for various use cases like facial recognition and content moderation. Other services like Amazon Connect, Lightsail, and Personalize do not offer image or video analysis capabilities.

AWS Outposts extend AWS infrastructure and services to on-premises locations, providing low-latency access to AWS resources and ensuring data residency. This service is suitable for hybrid environments that require the same AWS services and infrastructure to be available locally. Wavelength, Transit Gateway, and Ground Station do not specifically address low-latency access to on-premises resources or data residency.

AWS Lambda is a serverless compute service that is ideal for applications with short-running processes and low-frequency invocation, as it only charges for the compute time consumed. Since the application is invoked only a few times a day and runs for less than 5 minutes, Lambda is the most cost-effective option. ECS, EKS, and EC2 are better suited for more persistent workloads and would be more costly in this use case.

Amazon Route 53 is a scalable Domain Name System (DNS) web service that routes end-user requests to infrastructure running in AWS. It is specifically designed to host domain names and manage DNS records, making it the ideal service for hosting the domain name of a public website. AWS Lambda, CloudFront, and Direct Connect serve different functions and are not DNS hosting services.

Amazon S3 Glacier Flexible Retrieval is optimized for storing infrequently accessed data at a very low cost, making it suitable for data archiving and long-term backups. It provides flexible retrieval options for archived data. Other services like FSx for Lustre, EBS, and EFS are more suited for frequently accessed data and higher-performance use cases, not archival storage.

Under the AWS shared responsibility model, AWS is responsible for managing the underlying infrastructure, including operating system-level updates on managed services like Amazon RDS. Customers are responsible for managing the database instance and configurations, but AWS handles OS updates for the infrastructure supporting RDS.

Amazon Rekognition is a machine learning service that can analyze and recognize objects, people, text, scenes, and activities in images and videos. It is specifically designed for organizing, categorizing, and searching large volumes of images based on various attributes. Amazon Transcribe is for speech-to-text, Amazon Aurora is a relational database service, and Amazon QuickSight is a business intelligence tool for data visualization.

Refactoring involves re-architecting and modifying an application to take advantage of cloud-native features. In this case, the company wants to modernize a monolithic application by breaking it into microservices. This process aligns with the Refactor strategy, which is aimed at modernizing and re-architecting applications. Rehost, Repurchase, and Replatform do not involve the level of re-architecting needed to move from a monolithic to a microservices architecture.

The AWS Architecture Center provides examples, best practices, and architectural blueprints for various AWS Cloud solutions. It includes whitepapers, reference architectures, and detailed diagrams to help users design secure, scalable, and reliable applications on AWS. Other services like AWS Marketplace, Service Catalog, and Trusted Advisor do not offer solution design examples.

AWS DataSync is designed for large-scale data transfers, especially involving large datasets with millions of files from on-premises to AWS. It provides fast and efficient transfer capabilities, and supports a one-time migration. AWS DMS is specific to databases, while Migration Hub is for tracking migrations, and Application Migration Service is for continuous replication rather than one-time file migrations.

Amazon Neptune is a managed graph database service that is well-suited for complex queries involving relationships, such as detecting patterns indicative of fraud in credit card transactions. It supports graph query languages like Gremlin and SPARQL, making it ideal for use cases requiring intricate relationship analysis. DocumentDB, Timestream, and DynamoDB are not designed for graph-based queries.

Enforcing multi-factor authentication (MFA) for privileged users enhances account security by requiring a second form of authentication. It reduces the risk of unauthorized access, even if credentials are compromised. Removing the root account is not possible, and creating access keys for the root account or privileged users can increase security risks rather than reduce them.

In the AWS Cloud Adoption Framework (AWS CAF), theGovernanceperspective focuses on aligning IT strategy and goals with business processes, which includes managing data assets, setting up an inventory of data products, and ensuring that data cataloging and metadata management are in place. This perspective is crucial for organizing data products and services, which aligns with building a comprehensive data catalog. Other perspectives like Operations, Business, and Platform do not specifically address the management of a data catalog.

Using multiple Availability Zones within the same AWS Region meets the requirements for having instances in different locations with independent power and networking. Availability Zones are distinct physical locations within a region, each with separate power sources and networking. Edge locations are used for content delivery, and Amazon Connect and AWS Artifact locations are not relevant to EC2 deployment and infrastructure.

SSH keys provide secure login for Linux-based Amazon EC2 instances by establishing a secure connection over SSH (Secure Shell), protecting login credentials from interception. VPNs and encryption enhance security in other contexts, but SSH keys are the standard approach for accessing Linux EC2 instances. Amazon Route 53 is unrelated to EC2 instance access.

The AWS Management Console provides a web-based graphical user interface (GUI) that allows users to manage AWS services. It is user-friendly and accessible, enabling users to control and configure resources without needing to interact with AWS through code or command-line interfaces. AWS CLI and SDKs are command-line and programming tools, respectively, and do not offer a graphical interface.

The reliability pillar of the AWS Well-Architected Framework emphasizes building systems that can recover from failures and dynamically adjust to meet demand. This includes designing to automatically recover from failures and implementing mechanisms to manage capacity demands, avoiding manual guesswork. The other options do not align with core reliability principles, as operating in a single Availability Zone or preemptively adjusting quotas in a secondary region does not inherently improve reliability.