CLF-C02 Amazon Web Services AWS Certified Cloud Practitioner Free Practice Exam Questions (2026 Updated)

The AWS Cloud ' s global infrastructure enables rapid deployment across multiple geographic regions, allowing companies to extend applications to new markets quickly. This capability to " go global in minutes " is especially valuable for businesses looking to reach customers in new countries without building data centers. Other options, like speed and agility, are advantages but do not specifically address global deployment.

Rightsizing involves adjusting instance types based on actual utilization to optimize costs and performance. Changing the size and type of EC2 instances according to utilization data achieves this with minimal operational overhead. Adding instances or changing payment methods does not directly address instance resizing, and reprovisioning with larger instances may not be optimal based on actual usage.

AWS Secrets Manager is a service designed to securely store and manage access to sensitive information such as API keys, passwords, and database credentials. It allows automatic rotation, secure storage, and fine-grained access control for these credentials, ensuring they are securely managed. The other options do not provide encrypted storage for credentials specifically.

A fundamental financial advantage of AWS Cloud services is the ability to replace substantial upfront capital expenditure with variable, usage-based expenditure. Purchasing on-premises infrastructure normally requires an organization to buy servers, storage, networking equipment, and data-center capacity before the actual demand is fully known. These purchases create fixed costs and can leave the organization with idle capacity or insufficient capacity. With AWS, customers can provision resources when needed, pay for measured usage under the applicable pricing model, and scale resources as demand changes. Therefore, eliminating upfront hardware purchases lowers fixed infrastructure costs, making option B correct. Option A incorrectly describes higher variable costs as the benefit; AWS presents cloud economics as providing low variable costs and economies of scale, not higher costs. Option C is incorrect because required long-term commitments are not the defining cloud benefit. AWS provides On-Demand options, while Savings Plans and Reservations are optional pricing mechanisms for eligible workloads. Option D refers to volume discounts on hardware, which still requires purchasing and maintaining physical equipment. The key exam contrast is capital expense and fixed capacity on premises versus variable expense and elasticity in the cloud.

AWS Organizations provides consolidated billing, which allows a company to combine billing and payment for multiple AWS accounts. An organization has a management account that is responsible for paying the charges incurred by its member accounts. This provides a single consolidated bill and centralized payment management, making option B correct. AWS Cost and Usage Reports provide detailed line-item information about usage and estimated charges but do not establish a multi-account consolidated payment structure. AWS Cost Explorer provides visualizations, filters, forecasts, and analysis of AWS costs and usage. It can analyze consolidated organization data when appropriately configured, but it is not the service that creates the consolidated billing relationship. AWS Budgets allows customers to establish cost, usage, reservation, or Savings Plans thresholds and receive alerts or initiate supported actions. It does not combine account payments. Consolidated billing can also provide pricing benefits by combining qualifying usage across accounts for applicable volume pricing and allowing certain discount benefits to be shared. The central exam association is that AWS Organizations manages multiple accounts and provides consolidated billing and payment through the organization’s management account.

Savings Plans offer cost savings for predictable, steady workloads over a one or three-year term, with flexibility in instance family and size, making them suitable for critical workloads on EC2 instances that will run for a long term like three years. Spot Instances are more cost-effective but not suitable forcritical, predictable workloads due to potential interruptions. Dedicated Hosts and On-Demand Instances would be more costly.

According to AWS official service documentation,AWS Outpostsis designed to run AWS infrastructure and serviceson premiseswhile maintaining seamless integration with the AWS cloud. AWS Outposts enables customers to deliverlow-latency application experiencesby keeping compute and storage physically close to end users or on-premises systems.

Amazon Connect is a cloud-based contact center service and does not run workloads on premises. Amazon Lightsail is a simplified cloud service that runs entirely in AWS Regions. AWS Direct Connect provides a dedicated network connection to AWS but does not run workloads locally.

AWS explicitly states that AWS Outposts extends AWS services, APIs, and tools to customer data centers, enabling hybrid architectures that requirelocal processing, data residency, or ultra-low latency. This makes AWS Outposts the correct and only service among the options that directly supports running workloads on premises for low-latency use cases.

AWS Shield is a managed Distributed Denial of Service (DDoS) protection service that safeguards AWS applications against network and transport layer attacks. AWS Shield Standard is automatically included with all AWS services and offers protection against common DDoS attacks. For more advanced protection, AWS Shield Advanced provides additional DDoS mitigation measures. Although AWS WAF, Firewall Manager, and GuardDuty contribute to security, they do not specialize in DDoS mitigation at the network layer like AWS Shield does.

AWS CloudFormation allows developers to create, manage, and deploy AWS resources using templates, ensuring a standardized and repeatable infrastructure setup. It’s ideal for setting up development, test, and production environments consistently. AWS Cloud Map, CloudFront, and CloudTrail do not provide templated infrastructure management capabilities.

On-Demand Instances are recommended for short-term, irregular workloads that cannot be interrupted. The company needs capacity for only 24 hours once per year, so it would not be economical to make a one-year or three-year Reserved Instance commitment for such limited usage. With On-Demand pricing, the company pays only while the instances are running, without a long-term commitment. Therefore, option A is correct. Spot Instances can provide significant discounts but use spare EC2 capacity that AWS can interrupt. Because the workload explicitly cannot be interrupted, Spot Instances do not meet the requirement. Reserved Instances can reduce costs for steady, predictable, long-running usage, but paying for a commitment to cover an annual 24-hour workload would generally be less economical than paying the On-Demand rate for that brief period. Dedicated Instances run on hardware dedicated to one customer and normally cost more; the question includes no compliance, tenancy, or licensing requirement that would justify dedicated hardware. The decisive combination is “cannot be interrupted” plus “short-term and infrequent,” which maps directly to the documented On-Demand use case.

Under the AWS Shared Responsibility Model, AWS manages the securityofthe cloud, while customers manage securityinthe cloud. For EC2 instances, it is the customer’s responsibility to manage the guestoperating system, including patching and encrypting data stored on attached storage volumes. AWS is responsible for the underlying infrastructure, including physical security and hypervisor maintenance.

DynamoDB global tables provide a fully managed, multi-Region, multi-active database capability. Global tables automatically replicate DynamoDB table data across the AWS Regions selected by the customer. Applications can perform local reads and writes against replica tables, and DynamoDB propagates changes to the other replicas without requiring the customer to build a separate cross-Region replication system. Therefore, option A is correct. DynamoDB Accelerator is an in-memory cache designed to reduce DynamoDB response times for read-intensive workloads. It does not synchronize complete tables across Regions. A global secondary index provides an alternative partition key and optional sort key for querying data within a DynamoDB table; despite the word “global,” it is not a cross-Region replication feature. A service-linked IAM role allows DynamoDB to perform specified actions on behalf of a customer but does not independently replicate table data. Global tables are designed for globally distributed applications, business continuity, high availability, and low-latency access by users in different geographic locations. The direct exam association is DynamoDB global tables for automatic multi-Region table synchronization and replication.

Amazon Relational Database Service reduces database administration work by managing common operational tasks. AWS documentation states that Amazon RDS manages activities including database backups, software patching, automatic failure detection, and recovery. Customers can configure settings such as backup retention periods and maintenance windows, while RDS performs the underlying managed operations. Therefore, option C is correct. Amazon RDS does not automatically guarantee better query performance than a self-managed database. Query performance depends on database design, indexing, SQL queries, instance sizing, data distribution, and workload characteristics, and customers remain responsible for query tuning. RDS also supports a defined set of database engines rather than necessarily supporting more engines than any self-managed environment. Automatic horizontal scaling for both read and write workloads is not a general feature of every RDS engine or configuration. Some engines support read replicas or specialized scaling features, but these are not equivalent to universal automatic horizontal scaling for all database operations. The primary managed-service benefit described in the question is reduced administrative effort because AWS performs routine database infrastructure maintenance, backups, and patching on the customer’s behalf.

For a reporting application that runs only periodically, On-Demand Instances are the most cost-effective choice because they allow the company to pay only for the compute capacity used, without long-term commitments. Reserved Instances are less flexible due to the need for upfront payment or long-term contracts, which would not be cost-effective given the application’s intermittent usage. On-Demand Capacity Reservations would also be more costly, as they hold capacity regardless of usage.

Amazon Rekognition is a machine learning service that can analyze and recognize objects, people, text, scenes, and activities in images and videos. It is specifically designed for organizing, categorizing, and searching large volumes of images based on various attributes. Amazon Transcribe is for speech-to-text, Amazon Aurora is a relational database service, and Amazon QuickSight is a business intelligence tool for data visualization.

AWS CloudTrail records account activity and API actions as events, allowing customers to review who performed an action, what action was performed, when it occurred, and relevant request details. CloudTrail captures activity originating from sources such as the AWS Management Console, AWS CLI, AWS SDKs, APIs, IAM identities, and AWS services. This provides the audit history described in the question, so option A is correct. Amazon Inspector scans supported workloads, including EC2 instances, container images, and Lambda functions, for software vulnerabilities and unintended network exposure. AWS WAF protects web applications by inspecting and controlling HTTP and HTTPS requests. AWS Config records resource configurations, configuration changes, and compliance against rules; it answers questions about how resources were configured over time rather than serving as the primary audit trail for all account API activity. CloudTrail and AWS Config can complement each other, but their roles are different. For foundational exam questions, associate CloudTrail with governance, compliance, operational auditing, risk auditing, and a history of user and API actions across the AWS account.

On-Demand Instances are most cost-effective for short-term, steady, and unpredictable workloads. Using them for a one-month testing period allows flexibility without a long-term commitment. For long-term workloads (like a year or more), Reserved Instances or Savings Plans would be more cost-effective. Spot Instances are better for interruptible, flexible workloads.

AWS CloudTrail is the service that provides the account activity records needed for governance, compliance, operational auditing, and risk auditing. CloudTrail records actions taken by users, IAM roles, AWS services, and other identities as events. These actions can originate from the AWS Management Console, AWS CLI, AWS SDKs, and AWS APIs. Administrators can review event history and configure trails or event data stores for longer-term collection, analysis, and retention. This directly matches the wording of the question, so option A is correct. VPC Flow Logs capture information about IP traffic to and from network interfaces in a VPC; they are valuable for network troubleshooting and security analysis but do not provide the broad AWS account API audit history described. Amazon CloudWatch monitors resources and applications through metrics, logs, alarms, and events, but it is not the primary account governance and risk-auditing record. AWS Trusted Advisor evaluates an AWS environment against best-practice checks and provides recommendations. It does not replace CloudTrail’s record of account activity. The key distinction is recommendations versus an auditable history of actions.

A VPC endpoint enables private connections between an Amazon VPC and AWS services, like Amazon S3, without requiring internet access. This allows secure access to S3 from an EC2 instance within the same VPC, reducing latency and improving security. VPN connections and NAT gateways do not eliminate internet traffic, and an internet gateway would expose the VPC to the public internet.

Amazon Athena Overview:

Amazon Athena is a serverless query service that allows users to analyze data in S3 using standard SQL.

It is commonly used to query AWS Cost and Usage Reports stored in S3.

How It Works for Cost Reports:

Cost and Usage Reports are delivered in a structured format to an S3 bucket.

Athena can query these reports without requiring additional ETL processes.

Why Other Options Are Incorrect:

A. Amazon OpenSearch Service:Designed for search and log analytics, not querying structured data.

C. Amazon Aurora:A relational database service, unsuitable for querying S3 data directly.

D. AWS Glue:Used for ETL tasks but not directly for querying.

IAM Users and Billing Permissions:

IAM users with appropriate permissions can access and view the AWS Billing console.

The root user is required only for certain account-level tasks, such as changing support plans or closing accounts.

Why Other Options Are Incorrect:

A. Change to a different AWS Support plan:Requires root user credentials.

B. Close an AWS account:Requires root user credentials.

D. Activate access to the AWS Billing console:Requires root user credentials.

The reliability pillar of the AWS Well-Architected Framework includes the principle of testing recovery procedures to ensure systems can effectively recover from failures. Regular testing of recovery processes helps verify that systems are resilient and can handle potential disruptions. The other options align with different pillars like cost optimization and operational excellence.

Amazon Neptune is a managed graph database service that is well-suited for complex queries involving relationships, such as detecting patterns indicative of fraud in credit card transactions. It supports graph query languages like Gremlin and SPARQL, making it ideal for use cases requiring intricate relationship analysis. DocumentDB, Timestream, and DynamoDB are not designed for graph-based queries.

AWS IAM Identity Center provides centralized access management across multiple AWS accounts, enabling organizations to manage employee access efficiently. It is specifically designed for this purpose within AWS Organizations. AWS STS provides temporary credentials but does not manage multiple account access centrally, while IAM Access Analyzer and Secrets Manager serve different purposes related to access and secret management.

Under the AWS shared responsibility model, AWS is responsible for securityofthe cloud. For an abstracted managed service such as Amazon S3, this responsibility includes operating and protecting the infrastructure layer, physical facilities, networking, hardware, operating systems, and service platform that run S3. Therefore, option B is correct. The customer remains responsible for securityinthe cloud, including controlling access to stored objects, configuring bucket policies and IAM permissions, classifying data, and selecting appropriate data-protection settings. Enabling S3 Versioning is also a customer configuration decision. Versioning can help protect against accidental deletion or overwriting, but AWS does not automatically decide whether a particular customer bucket should use it. Similarly, AWS provides the mechanisms for bucket policies, but customers must create policies that reflect their access requirements. Data classification is based on the sensitivity, ownership, and regulatory requirements of the customer’s information and therefore cannot be performed automatically by AWS as part of its infrastructure responsibility. The key distinction is that AWS protects the platform running S3, while customers secure and govern their use of S3.