AWS CLF-C02: Cloud Practitioner Practice Exam

What the AWS CLF-C02 exam covers

• Cloud Concepts199 questions
• Security and Compliance250 questions
• Cloud Technology and Services274 questions
• Billing, Pricing, and Support101 questions

Free AWS CLF-C02 sample questions

A sample of 10 questions with answers and explanations. Sign up free to practice all 824.

1. Question 1Cloud Concepts

   A company wants to avoid the upfront cost of purchasing physical servers and instead pay only for the compute resources it actually uses. Which cloud computing advantage does this describe?

   • ATrade fixed expense for variable expenseCorrect
   • BIncreased speed and agility
   • CGlobal deployment in minutes
   • DHigh availability
   ✓ Correct answer: A

   Cloud computing eliminates the need for upfront capital expenditure on physical servers by shifting to an operational expenditure model. Instead of purchasing expensive hardware infrastructure that depreciates over time, companies pay only for the compute resources they actually use on a per-use basis. This transforms a fixed cost (buying servers) into a variable cost (paying for usage), providing financial flexibility and allowing companies to scale costs directly with business needs. This advantage is fundamental to cloud economics and represents one of the primary business drivers for cloud adoption.

   Why the other options are wrong

   • BIncreased speed and agility is incorrect because this is an advantage of cloud computing, but it refers to the ability to deploy and iterate on applications quickly rather than the cost structure.
   • CGlobal deployment in minutes is incorrect because it is another cloud benefit, but it addresses geographic distribution capabilities rather than cost transformation.
   • DHigh availability is incorrect because it is an infrastructure reliability benefit, not related to trading fixed expenses for variable expenses.
2. Question 2Cloud Concepts

   A company stores sensitive financial data in AWS. Regulators require that data must remain in a specific country. Which AWS feature ensures data residency compliance?

   • AUsing Amazon CloudFront to cache the data at edge locations worldwide
   • BEnabling AWS WAF to filter malicious web requests to the data
   • CSelecting an AWS Region within the required country for data storageCorrect
   • DConfiguring Amazon Route 53 health checks to monitor data endpoints
   ✓ Correct answer: C

   AWS Regions are geographically isolated clusters of data centers located in specific countries. By storing data in an AWS Region that resides within the required country, organizations can guarantee that data does not leave that jurisdiction, satisfying data residency and sovereignty regulations without any additional tooling.

   Why the other options are wrong

   • ACloudFront caches copies of content across global edge locations, which spreads data widely rather than keeping it inside one required country.
   • BAWS WAF filters malicious web traffic and protects applications; it does not control the physical location where regulated data is stored.
   • DRoute 53 health checks monitor endpoint availability for DNS routing and have no effect on where data physically resides for residency compliance.
3. Question 3Security and Compliance

   Which AWS service lets you create users, groups, and roles and control their access to AWS services and resources?

   • AAWS Organizations
   • BAmazon Cognito
   • CAWS Directory Service
   • DAWS Identity and Access Management (IAM)Correct
   ✓ Correct answer: D

   AWS Identity and Access Management (IAM) is the service for creating and managing users, groups, and roles and for attaching policies that control access to AWS services and resources. It is the primary tool for authentication and authorization within an AWS account. Organizations manages multiple accounts, Cognito handles application user sign-in, and Directory Service provides managed Active Directory.

   Why the other options are wrong

   • AAWS Organizations manages multiple accounts, not individual IAM identities.
   • BAmazon Cognito manages sign-in for app end users, not AWS account access.
   • CDirectory Service provides managed directories, not core IAM identity management.
4. Question 4Cloud Technology and ServicesSelect all that apply

   Which of the following are AWS compute services? (Select TWO.)

   • AAWS LambdaCorrect
   • BAmazon VPC
   • CAmazon S3
   • DAmazon RDS
   • EAmazon EC2Correct
   ✓ Correct answer: A, E

   AWS Lambda is a serverless compute service that runs code in response to events without provisioning servers, while Amazon EC2 provides scalable virtual machine instances where you have full control over the operating system and configuration. Both are compute services - they execute workloads and process data, as opposed to storage, networking, or database services.

   Why the other options are wrong

   • BAmazon VPC (Virtual Private Cloud) is a networking service that provides logically isolated virtual network environments - it enables connectivity and segmentation but does not itself execute compute workloads.
   • CAmazon S3 is an object storage service used to store and retrieve any amount of data - it holds data but does not execute application code or perform compute processing.
   • DAmazon RDS is a managed relational database service - it stores and queries structured data but is categorized as a database service, not a compute service.
5. Question 5Cloud Technology and Services

   A development team needs to isolate its application resources in a logically separated virtual network within AWS, with full control over IP address ranges, subnets, route tables, and network gateways. Which AWS service provides this capability?

   • AAmazon VPC (Virtual Private Cloud)Correct
   • BAWS Transit Gateway for interconnecting existing networks
   • CAWS Direct Connect for dedicated on-premises links
   • DAmazon Route 53 for DNS and traffic routing
   ✓ Correct answer: A

   Amazon Virtual Private Cloud (VPC) lets you provision a logically isolated section of the AWS Cloud where you define your own IP address ranges using CIDR notation, create public and private subnets, configure route tables, and set up internet gateways, NAT gateways, and security groups. This gives teams complete control over their virtual network topology, equivalent to managing a traditional on-premises network.

   Why the other options are wrong

   • BAWS Transit Gateway is a network transit hub that connects multiple VPCs and on-premises networks together - it simplifies large-scale network connectivity between already-existing isolated networks rather than creating and defining the isolated network itself.
   • CAWS Direct Connect provides a dedicated physical network connection from an on-premises data center to AWS - it is used to establish private connectivity to AWS but does not create or manage the virtual network address space and subnets within AWS.
   • DAmazon Route 53 is a DNS service that manages domain names and routes user traffic to AWS resources - it operates at the DNS layer and does not create virtual networks, manage IP address ranges, or configure subnets and route tables.
6. Question 6Cloud Concepts

   During a migration, a team decides to move an application to AWS with minimal changes by simply moving it as is to EC2. Which of the 6 R migration strategies is this?

   • ARefactoring
   • BRepurchasing
   • CRehostingCorrect
   • DRetiring
   ✓ Correct answer: C

   Rehosting (often called lift and shift) moves an application to AWS with little or no modification, commonly onto Amazon EC2. It is fast and low-effort, making it a common first step before deeper optimization.

   Why the other options are wrong

   • ARefactoring re-architects the application, which involves significant changes.
   • BRepurchasing means switching to a different product, often SaaS.
   • DRetiring means decommissioning an application that is no longer needed.
7. Question 7Cloud Technology and ServicesSelect all that apply

   Which of the following are types of Elastic Load Balancers available in AWS? (Select TWO.)

   • AApplication Load Balancer (ALB)Correct
   • BBasic Load Balancer (BLB)
   • CNetwork Load Balancer (NLB)Correct
   • DStandard Load Balancer (SLB)
   • EPremium Load Balancer (PLB)
   ✓ Correct answer: A, C

   The correct approach follows cloud best practices and ensures proper implementation, security, and maintainability.

   Why the other options are wrong

   • BBasic Load Balancer (BLB) is incorrect because this option doesn't align with AWS best practices.
   • DStandard Load Balancer (SLB) is incorrect because this option doesn't align with AWS best practices.
   • EPremium Load Balancer (PLB) is incorrect because this option doesn't align with AWS best practices.
8. Question 8Security and Compliance

   A company wants to enable single sign-on (SSO) for its employees to access multiple AWS accounts and business applications. Which AWS service provides this capability?

   • AAWS IAM
   • BAWS IAM Identity Center (AWS SSO)Correct
   • CAmazon Cognito
   • DAWS Directory Service
   ✓ Correct answer: B

   AWS IAM Identity Center, formerly known as AWS Single Sign-On, provides a centralized portal where employees can sign in once and gain access to multiple AWS accounts as well as SAML 2.0 business applications, making it the dedicated SSO solution for multi-account and multi-application access.

   Why the other options are wrong

   • AAWS IAM manages user identities and permissions within a single AWS account but does not natively provide a centralized SSO portal for accessing multiple accounts or external business applications.
   • CAmazon Cognito is designed for adding user sign-up, sign-in, and access control to web and mobile applications, not for employee SSO across internal AWS accounts.
   • DAWS Directory Service connects AWS resources to on-premises Microsoft Active Directory or provides a managed directory, but it does not serve as the SSO portal for multi-account access by itself.
9. Question 9Security and Compliance

   A company needs to encrypt data before sending it to Amazon S3. Which approach describes client-side encryption?

   • AUsing SSE-S3 to have Amazon S3 manage the encryption
   • BEncrypting data on the client before uploading it to S3Correct
   • CUsing SSE-KMS to have AWS KMS manage the encryption keys
   • DEnabling default encryption on the S3 bucket
   ✓ Correct answer: B

   Client-side encryption is the practice of encrypting data on the client (your application or local machine) before transmitting it to Amazon S3. The encryption and decryption logic runs entirely outside AWS, and AWS never sees the plaintext data. This gives the customer full control over the encryption keys and the encryption process, as opposed to server-side encryption where S3 performs the encryption after receiving the data.

   Why the other options are wrong

   • AUsing SSE-S3 is a server-side encryption method where Amazon S3 manages the AES-256 encryption keys and encrypts the data after it arrives at S3, not on the client before upload.
   • CUsing SSE-KMS is also a server-side encryption method where AWS KMS manages the encryption keys and S3 encrypts the data upon receipt - the encryption still happens on the server side.
   • DEnabling default encryption on an S3 bucket configures S3 to automatically apply server-side encryption to all objects written to that bucket, which is not client-side encryption.
10. Question 10Cloud Technology and Services

    A company runs a fleet of EC2 instances and wants traffic to reach an instance by a fixed public IP address that can be quickly remapped to another instance if one fails. Which AWS feature provides a static public IPv4 address that you can reassign?

    • AElastic IP addressCorrect
    • BAmazon CloudFront distribution
    • CInternet gateway
    • DAvailability Zone
    ✓ Correct answer: A

    An Elastic IP address is a static, public IPv4 address allocated to your AWS account that you can associate with an EC2 instance. If the instance fails, you can quickly remap the same Elastic IP to a healthy instance, masking the failure from users who connect to that fixed address.

    Why the other options are wrong

    • BCloudFront is a content delivery network that caches content at edge locations; it is not a static IP address you assign to an instance.
    • CAn internet gateway allows a VPC to communicate with the internet but does not provide a remappable static IP for a specific instance.
    • DAn Availability Zone is a physical data center location, not a network address.

Related AWS resources

• AWS CLF-C02 study guideKey concepts
• AWS practice examsAll AWS
• Certification pathWhere this fits
• Certification exam guides & tipsBlog
• Plans & pricingFree & paid
• AWS SCS-C03 practice examRelated
• AWS Certified AI Practitioner (AIF-C01) practice examRelated
• AWS Certified Data Engineer - Associate (DEA-C01) practice examRelated

AWS CLF-C02 practice exam FAQ