CLF-C02 Amazon Web Services AWS Certified Cloud Practitioner Free Practice Exam Questions (2025 Updated)

Best practices for using AWS Identity and Access Management (IAM) include:

B. Create individual IAM users: Each user should have their own IAM credentials to ensure accountability, control, and traceability. Sharing credentials can lead to security risks and difficulty in auditing.

E. Use groups to assign permissions to IAM users: Assigning permissions through IAM groups simplifies permission management. You can assign the necessary permissions to the group, and then add or remove users from the group as needed, rather than managing permissions for each user individually.

Why other options are not suitable:

A. Share access keys: Sharing access keys is a security risk and violates AWS security best practices. Each user should have their own credentials.

C. Use inline policies instead of customer-managed policies: Customer-managed policies are preferred over inline policies because they offer better control, reusability, and versioning.

D. Grant maximum privileges to IAM users: Granting the least privilege necessary is a best practice to reduce the risk of accidental or malicious actions.

AWS Security Hub is a cloud security posture management (CSPM) service that performs security best practice checks, aggregates alerts, and enables automated remediation. Security Hub collects findings from the security services enabled across your AWS accounts, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, and sensitive data identification findings from Amazon Macie. Security Hub also collects findings from partner security products using a standardized AWS Security Finding Format, eliminating the need for time-consuming data parsing and normalization efforts. Customers can designate an administrator account that can access all findings across their accounts. References: AWS Security Hub Overview, AWS Security Hub FAQs

AWS Management Console is a web application that allows you to manage and monitor your AWS Cloud resources through a user-friendly interface. You can use the AWS Management Console to access and experiment with over 150 AWS services, view and modify your account and billing information, get in-console help from AWS Support, and customize your dashboard with widgets that display key metrics and information for your applications567. You can also use the AWS Management Console to launch and configure AWS resources using wizards andtemplates, without writing any code5. References: 5: Manage AWS Resources - AWS Management Console - AWS, 6: Getting Started with the AWS Management Console, 7: Manage AWS Resources - AWS Management Console Features - AWS

When a company hosts its databases on Amazon EC2 instances, AWS and the customer share the responsibility for the security and management of the database environment. According to the AWS shared responsibility model, AWS is responsible for the security of the cloud, while the customer is responsible for the security in the cloud. This means that AWS is responsible for protecting the infrastructure that runs the EC2 instances, such as the hardware, software, networking, and facilities. The customer is responsible for properly configuring the security of the provided service, such as the guest operating system, the database software, the data, and the network traffic12.

One of the tasks that belongs to AWS when a company hosts its databases on Amazon EC2 instances is operating system patches. AWS provides regular updates and patches to the operating system of the EC2 instances, which are applied automatically by default. The customer can also choose to manually apply the patches or schedule them for a specific time window3. Operating system patches are important for maintaining the security and performance of the EC2 instances and the databases running on them.

The other tasks that belong to AWS when a company hosts its databases on Amazon EC2 instances are:

Operating system installations: AWS provides a variety of operating system options for the EC2 instances, such as Linux, Windows, and Amazon Linux. The customer can choose the operating system that best suits their database needs and AWS will install it on the EC2 instances4.

Server maintenance: AWS performs regular maintenance and repairs on the physical servers that host the EC2 instances, ensuring that they are in optimal condition and have adequate power, cooling, and network connectivity5.

Hardware lifecycle: AWS manages the lifecycle of the hardware that supports the EC2 instances, such as replacing faulty components, upgrading equipment, and decommissioning old servers.

The tasks that do not belong to AWS when a company hosts its databases on Amazon EC2 instances are:

Database backups: The customer is responsible for backing up their data and databases on the EC2 instances, using tools such as Amazon S3, Amazon EBS snapshots, or AWS Backup. Database backups are essential for data protection and recovery in case of failures or disasters.

Database software patches: The customer is responsible for applying patches and updates to the database software on the EC2 instances, such as MySQL, PostgreSQL, Oracle, or SQL Server. Database software patches are important for fixing bugs, improving features, and addressing security vulnerabilities.

Database software install: The customer is responsible for installing the database software on the EC2 instances, choosing the version and configuration that meets their requirements. AWS provides some preconfigured AMIs (Amazon Machine Images) that include common database software, or the customer can use their own custom AMIs.

Shared Responsibility Model - Amazon Web Services (AWS)

Shared responsibility model - Amazon Web Services: Risk and Compliance

Patching Amazon EC2 instances - AWS Systems Manager

Amazon EC2 FAQs - Amazon Web Services

Maintenance and Retirements - Amazon Elastic Compute Cloud

[Hardware Lifecycle - Amazon Web Services (AWS)]

[Backing Up Your Data - Amazon Web Services (AWS)]

[Database Patching - Amazon Web Services (AWS)]

[Installing Database Software on Amazon EC2 Instances - Amazon Web Services (AWS)]

AWS Artifact is a service provided by AWS that offers on-demand access to AWS compliance reports, including the Payment Card Industry (PCI) reports. It is the primary tool for retrieving compliance reports such as Service Organization Control (SOC) reports, ISO certifications, and Payment Card Industry Data Security Standard (PCI DSS) reports.

To obtain these reports:

The company should log into the AWS Management Console and navigate to AWS Artifact.

From there, they can select and download the necessary compliance reports.

Why other options are not suitable:

A. Contact AWS Support: AWS Support is not needed to obtain these reports; they are readily available through AWS Artifact.

C. Download reports from AWS Security Hub: AWS Security Hub is a service that provides a comprehensive view of security alerts and compliance status, but it does not host or provide compliance reports like PCI DSS.

D. Contact an AWS technical account manager (TAM): While a TAM may assist in various AWS-related queries, they are not required to obtain PCI reports. AWS Artifact is designed for this purpose.

Amazon EC2 Auto Scaling is a service that helps you maintain application availability and allows you to automatically add or remove EC2 instances according to definable conditions. You can create collections of EC2 instances, called Auto Scaling groups, and specify the minimum and maximum number of instances in each group. You can also define scaling policies that adjust the number of instances based on the demand on your application. Amazon EC2 Auto Scaling helps you improve the performance, reliability, and cost-efficiency of your EC2workloads123. References: 1: VDI Desktops - Amazon WorkSpaces Family - AWS, 2: What is Amazon EC2 Auto Scaling? - Amazon EC2 Auto Scaling, 3: Discover Amazon EC2 Auto Scaling Unit | Salesforce Trailhead

Amazon Simple Queue Service (Amazon SQS) is a fully managed message queuing service that lets you send, store, and receive messages between software components at any volume, without losing messages or requiring other services to be available1. Amazon SQS is designed to provide a simpleand reliable way for customers to decouple and connect components (microservices) together using queues2. Queues are an important mechanism for providing fault tolerance and scalability in distributed systems, and help decouple different parts of your application3. The other options are not AWS services that are used specifically for sending messages between applications

According to theAWS Shared Responsibility Model, AWS is responsible for the security "of" the cloud (such as protecting the infrastructure, including hardware, software, networking, and facilities that run AWS Cloud services). In contrast, customers are responsible for security "in" the cloud. This includes configuring and using AWS services securely.

D. Use AWS Identity and Access Management (IAM) according to the principle of least privilegeis a customer's responsibility. Customers must manage their credentials, control access to resources, and ensure that IAM policies follow the principle of least privilege, which means granting only the permissions necessary to perform a task.

Why other options are not suitable:

A. Patch the Amazon DynamoDB operating system: AWS is responsible for managing and patching the infrastructure for managed services like DynamoDB.

B. Secure Amazon CloudFront edge locations by allowing physical access according to the principle of least privilege: AWS handles physical security of its edge locations.

C. Protect the hardware that runs AWS services: AWS is responsible for protecting the physical hardware that runs AWS services.

Amazon Redshift is a fast, fully managed, petabyte-scale data warehouse service that makes it simple and cost-effective to analyze all your data using your existing business intelligence tools. You can start small with no commitments, and scale to petabytes for less than a tenth of the cost of traditional solutions. Amazon Redshift does not require manual hardware and software management, as AWS handles all the tasks such as provisioning, patching, backup, recovery, failure detection, and repair12. Amazon Redshift also offers serverless capabilities, which allow you to access and analyze data without any configurations or capacity planning. Amazon Redshift automatically scales the data warehouse capacity to deliver fast performance for even the most demanding and unpredictable workloads3. Therefore, Amazon Redshift meets the requirements of the company, compared to the other options.

The other options are not suitable for the company’s requirements, because:

Amazon DocumentDB (with MongoDB compatibility) is a fast, scalable, highly available, and fully managed document database service that supports MongoDB workloads. It is not designed for petabyte-scale data warehousing or analytics4.

Amazon Neptune is a fast, reliable, and fully managed graph database service that makes it easy to build and run applications that work with highly connected datasets. It is not designed for petabyte-scale data warehousing or analytics5.

Amazon ElastiCache is a fully managed in-memory data store and cache service that supports Redis and Memcached. It is not designed for petabyte-scale data warehousing or analytics.

What is Amazon Redshift? - Amazon Redshift

Amazon Redshift Features - Amazon Redshift

Amazon Redshift Serverless - Amazon Redshift

What Is Amazon DocumentDB (with MongoDB compatibility)? - Amazon DocumentDB (with MongoDB compatibility)

What Is Amazon Neptune? - Amazon Neptune

[What Is Amazon ElastiCache for Redis? - Amazon ElastiCache for Redis]

AWS Cost Exploreris a tool that enables you to view and analyze your costs and usage. It provides an easy-to-use interface to visualize, understand, and manage AWS costs and usage over time. Cost Explorer allows the company to monitor ongoing costs, set budget alerts, and analyze cost drivers, which is ideal for keeping the cost of running an ecommerce website within a specific budget.

B. AWS SDKs: Incorrect, as they are software development kits that allow integration with AWS services but do not provide cost monitoring or management capabilities.

C. EC2 Image Builder: Incorrect, as it is a service for automating the creation of virtual machine images, not for monitoring costs.

D. AWS CloudFormation: Incorrect, as it is used for provisioning and managing infrastructure as code, not for cost monitoring.

AWS Cloud References:

AWS Cost Explorer

TheAWS Cloud Development Kit (AWS CDK)currently supports multiple programming languages, includingPythonandTypeScript. These languages allow developers to define cloud infrastructure using familiar programming constructs. Python and TypeScript are among the first languages supported by AWS CDK, which also supports Java, C#, and JavaScript. This enables developers to use their existing programming skills and tools to define cloud infrastructure in code.

B. Swift: Incorrect, as Swift is not currently supported by AWS CDK.

D. Ruby: Incorrect, as Ruby is not currently supported by AWS CDK.

E. PHP: Incorrect, as PHP is not currently supported by AWS CDK.

AWS Cloud References:

AWS Cloud Development Kit (AWS CDK)

Amazon Elastic File System (Amazon EFS) is a fully managed, scalable, and serverless NFS (Network File System) file system specifically designed for use with AWS services and on-premises resources. It enables companies to create and configure file systems that can be accessed from multiple Amazon EC2instances simultaneously, making it ideal for use cases that require shared file storage for AWS compute services.

Why Amazon EFS Fits the Requirements:

Managed Service: Amazon EFS is a fully managed file storage service that simplifies the process of setting up and managing NFS file systems.

Scalability and Elasticity: EFS automatically scales to accommodate the storage needs of applications, without the need to provision or manage storage capacity.

NFS Compatibility: Amazon EFS natively supports the NFSv4 protocol, making it compatible with a wide range of applications and workloads that require NFS access.

Integration with AWS Compute Services: EFS integrates seamlessly with Amazon EC2 and other AWS services, providing a shared file storage solution across multiple instances and services within the AWS cloud environment.

Why Other Options Do Not Fit:

A. Amazon Elastic Block Store (Amazon EBS): While EBS provides block-level storage that can be attached to individual EC2 instances, it is not a file system, nor does it provide managed NFS file storage capabilities. EBS is designed for single-instance access rather than shared file access across multiple instances.

B. AWS Storage Gateway Tape Gateway: Tape Gateway is designed for archival purposes and allows companies to store virtual tape backups in Amazon S3 or Glacier. It does not support NFS file storage and is not intended for regular compute access.

C. Amazon S3 Glacier Flexible Retrieval: Amazon S3 Glacier is optimized for data archiving and long-term storage of infrequently accessed data, but it does not provide NFS file system capabilities, nor is it suitable for high-performance access needs associated with compute services.

For more details, you can refer to theAWS Cloud Practitioner Essentialscontent, specifically the modules onStorage Serviceswhere Amazon EFS is covered as the managed NFS file storage solution offered by AWS.

AWS Lambdais a serverless compute service that allows users to run code in response to events without provisioning or managing servers. It automatically scales the application by running code only when needed, and users are charged only for the compute time consumed. This service is ideal for applications that require event-driven compute functions.

B. AWS CloudFormation: Incorrect, as it is an infrastructure-as-code service that helps users automate the deployment of AWS resources, not a serverless compute service.

C. AWS Elastic Beanstalk: Incorrect, as it is a Platform-as-a-Service (PaaS) that still involves managing servers, even though it abstracts much of the infrastructure management.

D. Elastic Load Balancing: Incorrect, as it is a service for distributing incoming application or network traffic across multiple targets, not a serverless compute service.

AWS Cloud References:

AWS Lambda

By implementingAWS CloudTrail, a company is adhering to the AWS Cloud design principle ofactivating traceability. AWS CloudTrail provides detailed logs of all API calls made in an AWS account, which helps monitor, troubleshoot, and detect unusual activity, thereby improving security and compliance. This supports the principle of "activating traceability" by enabling continuous monitoring and auditing of all actions and changes within the AWS environment.

B. Use serverless compute architectures: Incorrect, as this principle encourages the use of managed services that handle infrastructure, such as AWS Lambda, and is not directly related to CloudTrail.

C. Perform operations as code: Incorrect, as this principle emphasizes the use of code and automation for infrastructure management.

D. Go global in minutes: Incorrect, as this principle relates to the global deployment of applications and services.

AWS Cloud References:

AWS Well-Architected Framework

AWS CloudTrail

TheAWS Pricing Calculatoris a web-based tool that allows customers to estimate their monthly AWS costs by configuring and projecting the costs of different AWS services. The calculator is specifically designed to help customers plan their AWS spending based on their specific architecture and usage patterns. The other options are not correct because:

B. Calculate historical AWS costs: This is incorrect as the AWS Pricing Calculator does not track or calculate historical costs. For historical costs, AWS Cost Explorer is used.

C. Provide in-depth information about AWS pricing strategies: While the AWS Pricing Calculator provides cost estimations, it does not provide detailed insights into AWS pricing strategies.

D. Provide users with access to their monthly bills: This is incorrect; AWS Billing and Cost Management provides access to actual billing information.

AWS Cloud References:

AWS Pricing Calculator

AWS Artifact is a self-service portal that provides on-demand access to AWS security and compliance reports and select online agreements. Users can download reports such as AWS ISO certifications, PCI reports, SOC reports, and GDPR DPA, and review and accept agreements such as BAA and NDA. AWS Artifact helps users to understand and meet compliance requirements for various standards and regulations that apply to AWS services and infrastructure. AWS Artifact is the best resource for a user to find compliance-related information and reports about AWS, whereas the other options are not

Economies of scale are the cost advantages that result from increasing the scale of production or operation. In cloud computing, economies of scale are achieved by pooling resources and sharing them among multiple users, which reduces the unit cost of computing and storage. One of the benefits of economies of scale in cloud computing is increased speed and agility, which means the ability to deploy applications faster and respond to changing business needs more quickly. Cloud computing allows users to access computing resources on demand, without having to invest in expensive infrastructure or wait for lengthy provisioning processes. This enables users to scale up or down as needed, experiment with new ideas, and deliver value to customers faster123. References:

Economics of Cloud Computing - GeeksforGeeks

What is Cloud Economics? | VMware Glossary

ECONOMIES OF SCALE WITH CLOUD COMPUTING & SERVICES PRACTICE - IDC-Online

Amazon CloudFront and AWS Global Accelerator are two AWS services that make use of global edge locations. Edge locations are AWS sites that are deployed worldwide in major cities and places with a high population. Edge locations are used to cache data and reduce latency for end-user access1.

Amazon CloudFront is a content delivery network (CDN) service that securely delivers data, videos, applications, and APIs to customers globally with low latency and high transfer speeds. Amazon CloudFront uses a global network of over 200 edge locations and 13 regional edge caches to cache your content closer to your viewers, improving performance and reducing costs23.

AWS Global Accelerator is a networking service that improves the availability and performance of your applications with local or global users. AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint based on health, performance, and policies. AWS Global Accelerator uses over 100 edge locations to bring your application endpoints closer to your users, reducing networkhops and improving user experience45. References: 1: AWS for the Edge - Amazon Web Services (AWS), 2: Content Delivery Network (CDN) - Amazon CloudFront - AWS, 3: Amazon CloudFront Documentation, 4: AWS Global Accelerator - Amazon Web Services, 5: AWS Global Accelerator Documentation

Compute Savings Plans provide the most flexibility and help to reduce your costs by up to 66%. These plans automatically apply to EC2 instance usage regardless of instance family, size, AZ, Region, OS or tenancy, and also apply to Fargate or Lambda usage. For example, with Compute Savings Plans, you can change from C4 to M5 instances, shift a workload from EU (Ireland) to EU (London), or move a workload from EC2 to Fargate or Lambda at any time and automatically continue to pay the Savings Plans price.

https://aws.amazon.com/savingsplans/compute-pricing/

AWS Elastic Beanstalkis a fully managed service designed for developers who want to deploy and manage their applications without having to provision and manage the underlying infrastructure themselves. Developers can simply upload their code, and Elastic Beanstalk automatically handles the deployment, including provisioning the necessary resources (such as EC2 instances, load balancers, and auto-scaling).

A. AWS CloudFormation: Incorrect, as it is an infrastructure-as-code service for defining and provisioning AWS resources but does not directly deploy applications.

B. AWS CodeBuild: Incorrect, as it is a service for building and testing code, not for deploying applications.

D. AWS CodeDeploy: Incorrect, as it is specifically designed for automating software deployments to a variety of compute services, including EC2, but it does not manage the underlying infrastructure.

AWS Cloud References:

AWS Elastic Beanstalk

One of the primary advantages of the AWS Cloud is the ability to provision resources on demand. Users no longer need to over-provision or guess the capacity needed for infrastructure, which helps optimizecosts and improve agility. AWS handles infrastructure scaling dynamically based on the actual usage. Options B, C, and D are incorrect as users do not maintain sole ownership of IT hardware or control of underlying infrastructure, and while they do maintain some control over the operating system in some cases, it is not an advantage specific to the cloud.

On-Demand Instances are ideal for workloads that require flexibility, offering compute capacity with no upfront cost, allowing users to pay by the second for the instances they use. This makes it suitable for applications with short-term, spiky, or unpredictable workloads that cannot be interrupted. Reserved Instances require long-term commitments, Spot Instances can be interrupted, and Dedicated Instances are for specific hardware requirements, making On-Demand the correct choice for uninterruptible and flexible instance usage.

The AWS Well-Architected Framework is a set of six pillars and lenses that help cloud architects design and run workloads in the cloud. The six pillars are: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Each pillar has a set of design principles and best practices that guide the architectural decisions. High availability is not a separate pillar, but a quality that can be achieved by applying the principles of the reliability pillar. Going global in minutes and continuous development are not pillars of the framework, but possible benefits of using AWS services and following the framework’s recommendations. References: AWS Well-Architected - Build secure, efficient cloud applications, AWS Well-Architected Framework, The 6 Pillars of the AWS Well-Architected Framework

Users can change their own IAM user password using:

AWS Management Console: The graphical interface allows users to navigate to the "My Security Credentials" page and change their password.

AWS Command Line Interface (CLI): Users with the appropriate permissions can use theaws iam change-passwordcommand to change their password.

Why other options are not suitable:

B. AWS Key Management Service (AWS KMS): Used for creating and managing encryption keys, not for managing user passwords.

D. AWS Resource Access Manager (AWS RAM): Used for resource sharing between accounts, not for password management.

E. AWS Secrets Manager: A service for securely storing and managing secrets, not for changing IAM user passwords.

AWS IAM Access Analyzer is a service that helps you identify the resources in your organization and accounts, such as Amazon S3 buckets or IAM roles, that are shared with an external entity. This lets you identify unintended access to your resources and data, which is a security risk. IAM Access Analyzer uses logic-based reasoning to analyze the resource-based policies in your AWS environment. For each instance of a resource shared outside of your account, IAM Access Analyzer generates a finding. Findings include information about the access and the external principal granted to it345. References: 3: Using AWS Identity and Access Management Access Analyzer, 4: IAM Access Analyzer - Amazon Web Services (AWS), 5: Welcome - IAM Access Analyzer

Understanding Availability Zones (AZs): An Availability Zone is a distinct location within an AWS region that is engineered to be isolated from failures in other AZs.

Characteristics of Availability Zones:

Data Centers: Each AZ consists of one or more discrete data centers with redundant power, networking, and connectivity.

High Availability: AZs are designed for high availability, providing low-latency network connections to other zones in the same region.

Fault Isolation: They provide fault isolation and are used to deploy applications and services to ensure high availability and reliability.

Use Cases for Availability Zones:

Multi-AZ Deployments: For services like RDS, deploying in multiple AZs ensures fault tolerance.

Disaster Recovery: Setting up resources in multiple AZs helps in quick recovery from failures.

Load Balancing: Distributing traffic across AZs using Elastic Load Balancing ensures optimal performance and availability.

AWS Global Infrastructure

Understanding AWS Regions and Availability Zones

Global reach is a cloud computing advantage that a company can apply when it uses AWS Regions to increase application availability to users in different countries. Global reach refers tothe ability to deploy applications and services in multiple geographic locations around the world, and to serve customers with low latency and high performance. AWS has the largest and most reliable global infrastructure of any cloud provider, with 25 Regions and 81 Availability Zones across the Americas, Europe, Asia Pacific, Africa, and the Middle East123. By using AWS Regions, a company can choose the best location for its application based on customer proximity, compliance requirements, and disaster recovery strategies23. References: 1: AWS Global Infrastructure - Amazon Web Services (AWS), 2: Regions and Availability Zones - Amazon Elastic Compute Cloud, 3: AWS Infrastructure: Regions and Availability Zones Explained

Rehosting ("lift and shift") is a migration strategy where applications are moved to the cloud with minimal changes, making it the least effort-intensive method for applications incompatible with the cloud. Repurchasing involves moving to a different product, often a SaaS solution, which can also minimize migration effort by avoiding the need for application-level changes. Retiring, replatforming, and refactoring require significant effort either in terms of analyzing and shutting down the application, making changes to the underlying platform, or redesigning the application architecture, respectively.

AWS Glue is a serverless data integration service that makes it easy to discover, prepare, move, and integrate data from multiple sources for analytics, machine learning, and application development. You can use various data integration engines, such as ETL, ELT, batch, and streaming, and manage your data in a centralized data catalog. AWS Glue is designed specifically for extract, transform, and load (ETL) data, whereas the other options are not.