1150+ AWS Cloud Practitioner Practice Exam Questions (CLF-C02) – Free MCQs with Answers & Explanations

1150+ AWS Cloud Practitioner Practice Exam Questions (CLF-C02) – Free MCQs with Answers & Explanations

Full Length Test No. 8

1. What is the main benefit of attaching security groups to an Amazon RDS instance?

  1. Manages user access and encryption keys
  2. Controls what IP address ranges can connect to your database instance
  3. Deploys SSL/TLS certificates for use with your database instance
  4. Distributes incoming traffic across multiple targets

Answer : B
Explanation: Security groups act as virtual firewalls for your Amazon RDS instance, controlling inbound and outbound traffic by specifying which IP address ranges and ports are allowed to connect to your database. This is the primary benefit of attaching security groups to RDS. IAM manages user access and encryption keys. AWS Certificate Manager deploys SSL/TLS certificates. Elastic Load Balancing distributes traffic — none of these are functions of security groups.

2. A company wants to use Amazon Elastic Container Service (Amazon ECS) to run its containerized applications. For compliance reasons, the company wants to retain complete visibility and control over the underlying server cluster. Which Amazon ECS launch type will satisfy these requirements?

  1. EC2 launch type
  2. Fargate launch type
  3. Lightsail launch type
  4. Lambda launch type

Answer : A
Explanation: The EC2 launch type for Amazon ECS allows you to run containers on a cluster of EC2 instances that you provision and manage yourself, giving you complete visibility and control over the underlying server infrastructure. The Fargate launch type is serverless — AWS manages the underlying servers and you have no visibility or control over them. Lightsail and Lambda launch types are not valid ECS launch types.

3. You have multiple standalone AWS accounts and you want to decrease your AWS monthly charges. What should you do?

  1. Try to remove unnecessary AWS accounts
  2. Add the accounts to an AWS Organization and use Consolidated Billing
  3. Track the AWS charges that are incurred by the member accounts
  4. Enable AWS tiered-pricing before provisioning resources

Answer : B
Explanation: Adding accounts to an AWS Organization and enabling Consolidated Billing combines the usage across all accounts, which can qualify for volume pricing discounts that individual accounts might not reach alone. It also allows sharing of Reserved Instance benefits across accounts. Removing accounts (A) reduces services, not costs. Tracking charges (C) provides visibility but does not reduce costs. AWS tiered pricing is automatic — there is no feature to “enable” it separately (D).

4. You have been tasked with auditing the security of your VPC. As part of this process, you need to start by analyzing what inbound and outbound traffic is allowed on your EC2 instances. What two parts of the VPC do you need to check to accomplish this task?

  1. Network ACLs and Traffic Manager
  2. Network ACLs and Subnets
  3. Security Groups and Internet Gateways
  4. Security Groups and Network ACLs

Answer : D
Explanation: Security Groups control inbound and outbound traffic at the EC2 instance level (stateful), and Network ACLs (NACLs) control inbound and outbound traffic at the subnet level (stateless). Together they define what traffic is allowed to and from your EC2 instances. Traffic Manager is a Microsoft Azure service, not an AWS VPC component. Subnets are network segments, not traffic control mechanisms. Internet Gateways enable internet access but do not define allow/deny rules for instances.

5. What does the AWS Business Support plan provide? (Choose TWO)

  1. Access to the full set of Trusted Advisor checks
  2. Support Concierge Service
  3. Less than 15 minutes response-time support if your business critical system goes down
  4. AWS Support API
  5. Proactive Technical Account Management

Answer : A, D
Explanation: AWS Business Support provides access to the full set of Trusted Advisor checks across all five categories (A), and access to the AWS Support API (D) for programmatic case management and Trusted Advisor integration. The Support Concierge Service (B) and a Technical Account Manager (E) are exclusive to Enterprise Support. The less-than-15-minutes response time (C) is also an Enterprise Support feature — Business Support offers less than 1 hour for production system down cases.

6. You have just finished writing your application code. Which service can be used to automate the deployment and scaling of your application?

  1. Amazon Simple Storage Service
  2. AWS Elastic Beanstalk
  3. AWS CodeCommit
  4. Amazon Elastic File System

Answer : B
Explanation: AWS Elastic Beanstalk is a PaaS service that automatically handles the deployment, scaling, load balancing, and health monitoring of your application. You simply upload your code and Elastic Beanstalk manages the underlying infrastructure. Amazon S3 is object storage, AWS CodeCommit is a source code repository, and Amazon EFS is a file storage service — none automate application deployment and scaling.

7. Which statement is true in relation to security in AWS?

  1. AWS manages everything related to EC2 operating systems
  2. AWS customers are responsible for patching any database software running on Amazon EC2
  3. Server-side encryption is the responsibility of AWS
  4. AWS is responsible for the security of your application

Answer : B
Explanation: Under the AWS Shared Responsibility Model, when a customer installs and runs database software on an Amazon EC2 instance, they are fully responsible for patching and maintaining that software — including the OS and any applications on it. AWS manages the underlying hypervisor and physical infrastructure, not the EC2 operating system (A). Server-side encryption configuration is the customer’s responsibility (C). AWS is not responsible for the security of customer applications (D).

8. Amazon EC2 instances are conceptually very similar to traditional servers. However, using Amazon EC2 server instances in the same manner as traditional hardware server instances is only a starting point. What are the main benefits of using AWS EC2 instances instead of traditional servers? (Choose TWO)

  1. Improves Fault-Tolerance
  2. Provides your business with seamless remote accessibility
  3. Prevents unauthorized users from getting into your network
  4. Provides automatic data backups
  5. Can be scaled manually in a shorter period of time

Answer : A, E
Explanation: EC2 improves fault tolerance (A) by enabling deployment across multiple Availability Zones, making it easy to architect resilient systems that traditional servers cannot match without significant hardware investment. EC2 instances can also be scaled up or down manually in minutes (E), unlike traditional servers which require procurement, shipping, and installation that takes days or weeks. EC2 does not inherently prevent unauthorized network access (C) — that requires security groups and NACLs. Automatic backups (D) are not a default EC2 feature. Remote accessibility (B) is not a unique EC2 advantage.

9. Which statement is true regarding AWS pricing? (Choose TWO)

  1. With the AWS pay-as-you-go pricing model, you don’t have to pay any upfront fee
  2. You have no responsibility for third-party software license costs
  3. You only pay for the individual services that you need with no long-term contracts
  4. For some services, you have to pay a startup fee in order to get the service running
  5. There are no reservations on AWS, you only pay for what you use

Answer : A, C
Explanation: With the AWS pay-as-you-go pricing model, there are no upfront fees required — you pay only for what you consume (A). AWS also allows you to use only the specific services you need with no long-term contracts required for On-Demand usage (C). Customers may still be responsible for third-party software license costs when using software from the AWS Marketplace (B is incorrect). AWS does not charge startup fees for services (D). AWS does offer reservations such as Reserved Instances (E is incorrect).

10. Which AWS service provides the EASIEST way to set up and manage a secure, well-architected, multi-account AWS environment?

  1. AWS Control Tower
  2. Amazon Macie
  3. AWS Systems Manager Patch Manager
  4. AWS Security Hub

Answer : A
Explanation: AWS Control Tower provides the easiest way to set up and govern a secure, multi-account AWS environment based on AWS best practices. It automates the setup of a landing zone, including account vending, guardrails, and compliance monitoring. Amazon Macie is a data security service that detects sensitive data in S3. AWS Systems Manager Patch Manager automates OS patching. AWS Security Hub aggregates security findings — none set up multi-account environments.

11. A company is running a large web application that needs to always be available. The application tends to slow down when CPU usage is greater than 60%. How can they track when CPU usage goes above 60% for any of the EC2 Instances in their account?

  1. Use CloudFront to monitor the CPU usage
  2. Set the AWS Config CPU threshold to 60% to receive a notification when EC2 usage exceeds that value
  3. Use CloudWatch Alarms to monitor the CPU and alert when the CPU usage is greater than or equal to 60%
  4. Use SNS to monitor the utilization of the server

Answer : C
Explanation: Amazon CloudWatch Alarms can monitor EC2 CPU utilization metrics and trigger notifications (via SNS) or actions (like Auto Scaling) when the CPU usage meets or exceeds a defined threshold such as 60%. CloudFront is a CDN and does not monitor EC2 metrics. AWS Config tracks resource configuration changes, not performance metrics. SNS is a notification service but cannot monitor utilization on its own — it requires CloudWatch to trigger it.

12. What is the recommended storage option when hosting an often-changing database on an Amazon EC2 instance?

  1. Amazon EBS
  2. Amazon RDS
  3. You cannot run a database inside an Amazon EC2 instance
  4. Amazon DynamoDB

Answer : A
Explanation: Amazon EBS (Elastic Block Store) is the recommended storage option for a database running on an EC2 instance because it provides persistent, high-performance block storage with low latency that is well-suited for frequently changing data. EBS volumes persist independently of the EC2 instance lifecycle. Amazon RDS is a managed database service, not a storage option for EC2-hosted databases. You can absolutely run databases on EC2 (C is incorrect). DynamoDB is a separate managed NoSQL service, not EC2 storage.

13. You are working as a site reliability engineer (SRE) in an AWS environment. Which of the following services helps monitor your applications?

  1. Amazon CloudWatch
  2. Amazon CloudSearch
  3. Amazon Elastic MapReduce
  4. Amazon CloudHSM

Answer : A
Explanation: Amazon CloudWatch is the primary AWS monitoring and observability service. It collects metrics, logs, and events from AWS resources and applications, allowing SREs to set alarms, create dashboards, and troubleshoot operational issues. Amazon CloudSearch is a managed search service. Amazon EMR is a big data processing platform. Amazon CloudHSM is a hardware security module service — none provide application monitoring.

14. What factors determine how you are charged when using AWS Lambda? (Choose TWO)

  1. Storage consumed
  2. Number of requests to your functions
  3. Number of volumes
  4. Placement groups
  5. Compute time consumed

Answer : B, E
Explanation: AWS Lambda pricing is based on two factors: the number of requests (B) — you are charged per million requests after a free tier — and the compute time consumed (E) — measured in GB-seconds, which is the memory allocated multiplied by the duration of execution. Storage (A) and volumes (C) are not Lambda pricing factors. Placement groups (D) are an EC2 concept unrelated to Lambda pricing.

15. What are the main differences between an IAM user and an IAM role in AWS? (Choose TWO)

  1. An IAM user is uniquely associated with only one person, however a role is intended to be assumable by anyone who needs it
  2. An IAM user has permanent credentials associated with it, however a role has temporary credentials associated with it
  3. IAM users are more cost effective than IAM roles
  4. A role is uniquely associated with only one person, however an IAM user is intended to be assumable by anyone who needs it
  5. An IAM user has temporary credentials associated with it, however a role has permanent credentials associated with it

Answer : A, B
Explanation: An IAM user is associated with a specific individual and has permanent, long-term credentials (username/password and access keys) (A, B). An IAM role, on the other hand, is not tied to a specific person — it can be assumed by any authorized entity (users, services, or applications) and provides temporary security credentials that automatically expire. IAM users and roles are both free — neither is more cost effective than the other (C is incorrect). Options D and E have the descriptions reversed.

Cybersecurity Careers: Salaries, Jobs, and How to Break In With Zero Experience

16. Which of the following actions may reduce Amazon EBS costs? (Choose TWO)

  1. Deleting unused buckets
  2. Using reservations
  3. Deleting unnecessary snapshots
  4. Changing the type of the volume
  5. Distributing requests to multiple volumes

Answer : C, D
Explanation: Deleting unnecessary EBS snapshots (C) reduces costs because snapshots are stored in S3 and you are charged for the storage they consume. Changing the volume type (D) — for example, switching from a more expensive io2 volume to a cheaper gp3 volume if performance requirements allow — can also reduce costs. Deleting unused buckets (A) reduces S3 costs, not EBS costs. EBS does not have reservation pricing like EC2 (B). Distributing requests across volumes (E) affects performance but not cost.

17. What does Amazon GuardDuty do to protect AWS accounts and workloads?

  1. Notifies AWS customers about abuse events once they are reported
  2. Continuously monitors AWS infrastructure and helps detect threats such as attacker reconnaissance or account compromise
  3. Helps AWS customers identify the root cause of potential security issues
  4. Checks security groups for rules that allow unrestricted access to AWS resources

Answer : B
Explanation: Amazon GuardDuty is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity using machine learning, anomaly detection, and threat intelligence. It detects threats such as unusual API calls, compromised credentials, and attacker reconnaissance. Abuse notifications (A) are handled by the AWS Abuse team. Root cause analysis (C) is performed by Amazon Detective. Security group rule checks (D) are done by AWS Trusted Advisor.

18. Which database service should you use if your application and data schema require “joins” or complex transactions?

  1. Amazon RDS
  2. AWS Outposts
  3. Amazon DocumentDB
  4. Amazon DynamoDB

Answer : A
Explanation: Amazon RDS is a relational database service that supports SQL joins, complex queries, and ACID transactions — making it the right choice for applications requiring relational data modeling with complex queries. AWS Outposts extends AWS infrastructure on-premises. Amazon DocumentDB is a document database that does not support SQL joins. Amazon DynamoDB is a NoSQL key-value database that does not natively support SQL joins or complex relational transactions.

19. Which of the following makes it easier for you to categorize, manage and filter your resources?

  1. Amazon CloudWatch
  2. AWS Service Catalog
  3. AWS Directory Service
  4. AWS Tagging

Answer : D
Explanation: AWS Tagging allows you to assign key-value metadata labels to AWS resources, making it easy to categorize, manage, filter, and search for resources across your account. Tags are commonly used for cost allocation, environment separation, and resource organization. Amazon CloudWatch is for monitoring, AWS Service Catalog manages approved IT services, and AWS Directory Service manages Active Directory — none provide resource categorization through labels.

20. What should you consider when storing data in Amazon S3 Glacier?

  1. Amazon S3 Glacier only accepts data in a compressed format
  2. Glacier can only be used to store frequently accessed data and data archives
  3. Amazon S3 Glacier does not provide immediate retrieval of data
  4. Attach Glacier to an EC2 instance to be able to store data

Answer : C
Explanation: A key consideration when using Amazon S3 Glacier is that it does not provide immediate data retrieval — retrieval times range from minutes (Expedited) to hours (Standard and Bulk), making it unsuitable for use cases requiring instant access. Glacier accepts data in any format, not just compressed (A). Glacier is designed for infrequently accessed archival data, not frequently accessed data (B). Glacier is accessed via S3 APIs and does not need to be attached to EC2 (D).

21. Engineers are wasting a lot of time and effort managing batch computing software in traditional data centers. Which of the following AWS services allows them to easily run thousands of batch computing jobs?

  1. Amazon EC2
  2. AWS Batch
  3. Lambda@Edge
  4. AWS Fargate

Answer : B
Explanation: AWS Batch is a fully managed service that enables developers and engineers to easily and efficiently run hundreds of thousands of batch computing jobs on AWS. It dynamically provisions the optimal quantity and type of compute resources based on the volume and resource requirements of the batch jobs, eliminating the need to manage batch computing software or server clusters. Amazon EC2 provides compute but requires manual batch management. Lambda@Edge runs lightweight functions at Edge Locations. AWS Fargate is for containerized workloads — none specifically manage batch computing jobs.

22. How can you increase your application’s fault tolerance while it is being hosted in AWS?

  1. Deploy your application across multiple EC2 instances
  2. Deploy your application across multiple Availability Zones
  3. Host your application on one powerful EC2 instance type instead of multiple smaller instances
  4. Deploy the underlying application resources across multiple subnets

Answer : B
Explanation: Deploying your application across multiple Availability Zones is the most effective way to increase fault tolerance. If one AZ experiences an outage, your application continues running from another AZ without interruption. Multiple EC2 instances in the same AZ (A) do not protect against an AZ-level failure. A single powerful instance (C) creates a single point of failure. Multiple subnets in the same AZ (D) do not provide AZ-level redundancy.

23. Which of the following AWS Support Plans gives you 24/7 access to Cloud Support Engineers via email and phone? (Choose TWO)

  1. Developer
  2. Premium
  3. Enterprise
  4. Standard
  5. Business

Answer : C, E
Explanation: Both AWS Enterprise Support (C) and AWS Business Support (E) provide 24/7 access to Cloud Support Engineers via phone, chat, and email. Developer Support only provides email-based support during business hours. “Premium” and “Standard” are not actual AWS support plan names — the four official plans are Basic, Developer, Business, and Enterprise.

24. Which of the following requires an access key ID and a secret access key to get long-lived programmatic access to AWS resources? (Choose TWO)

  1. IAM group
  2. IAM user
  3. IAM role
  4. AWS account root user
  5. TAM

Answer : B, D
Explanation: IAM users (B) can be assigned long-term access keys (Access Key ID and Secret Access Key) for programmatic access to AWS APIs and CLI. The AWS account root user (D) also has the ability to create long-term access keys, though this is strongly discouraged for security reasons. IAM groups cannot have access keys — only users can. IAM roles provide temporary credentials, not long-lived access keys. TAM (Technical Account Manager) is an AWS support role, not an IAM entity.

25. Which of the following is a benefit of the “Loose Coupling” architecture principle?

  1. It eliminates the need for change management
  2. It allows for Cross-Region Replication
  3. It helps AWS customers reduce Privileged Access to AWS resources
  4. It allows individual application components or services to be modified without affecting other components

Answer : D
Explanation: The key benefit of Loose Coupling is that individual components or services of an application can be updated, scaled, or replaced independently without causing failures in or requiring changes to other components. This improves resilience and agility. Loose coupling does not eliminate change management (A), enable Cross-Region Replication (B), or reduce privileged access (C) — those are unrelated concepts.

26. A company needs to host a big data application on AWS using EC2 instances. Which of the following AWS Storage services would they choose to automatically get high throughput to multiple compute nodes?

  1. Amazon Elastic Block Store
  2. AWS Storage Gateway
  3. Amazon Elastic File System
  4. Amazon S3

Answer : C
Explanation: Amazon Elastic File System (EFS) is a fully managed NFS file system that can be mounted simultaneously on thousands of EC2 instances, automatically providing high throughput to multiple compute nodes. This makes it ideal for big data workloads requiring shared storage across many instances. Amazon EBS can only be attached to one instance at a time (with limited exceptions). AWS Storage Gateway is for hybrid cloud connectivity. Amazon S3 is object storage accessed via HTTP APIs, not a high-throughput shared file system.

27. Which of the following Cloud Computing deployment models eliminates the need to run and maintain physical data centers?

  1. On-premises
  2. IaaS
  3. PaaS
  4. Cloud

Answer : D
Explanation: The Cloud deployment model (public cloud) eliminates the need to run and maintain physical data centers — all infrastructure is owned and operated by the cloud provider (such as AWS). On-premises requires organizations to manage their own physical data centers. IaaS and PaaS are cloud service models, not deployment models — and while they reduce physical infrastructure burden, the Cloud deployment model is the correct answer to this question.

28. What are the benefits of the AWS Marketplace service? (Choose TWO)

  1. Protects customers by performing periodic security checks on listed products
  2. Per-second billing
  3. Provides cheaper options for purchasing Amazon EC2 On-Demand instances
  4. Provides flexible pricing options that suit most customer needs
  5. Provides software solutions that run on AWS or any other Cloud vendor

Answer : D, E
Explanation: AWS Marketplace provides flexible pricing options (D) including free trials, hourly, monthly, annual, and BYOL models to suit different customer needs. It also provides software solutions that can run on AWS or in other environments (E), including SaaS products and multi-cloud compatible software. AWS Marketplace does not perform periodic security checks on products (A). Per-second billing (B) is an EC2 feature, not Marketplace. Marketplace does not offer cheaper EC2 On-Demand instances (C).

29. What is the benefit of Amazon EBS volumes being automatically replicated within the same Availability Zone?

  1. Elasticity
  2. Durability
  3. Traceability
  4. Accessibility

Answer : B
Explanation: Amazon EBS volumes are automatically replicated within their Availability Zone to protect against component failure, providing high durability. This replication ensures that your data is protected even if individual hardware components fail. Elasticity refers to the ability to scale resources up and down. Traceability relates to logging and auditing. Accessibility refers to who or what can access the data — none describe the benefit of internal replication.

30. You are planning to launch an advertising campaign over the coming weekend to promote a new digital product. It is expected that there will be heavy spikes in load during the campaign period, and you cannot afford any downtime. You need additional compute resources to handle the additional load. What is the most cost-effective EC2 instance purchasing option for this job?

  1. Savings Plans
  2. Spot Instances
  3. Reserved Instances
  4. On-Demand Instances

Answer : D
Explanation: For a short-term campaign over a weekend where downtime cannot be tolerated, On-Demand Instances are the most appropriate and cost-effective choice. They can be launched immediately with no upfront commitment and terminated after the campaign ends. Spot Instances offer lower cost but can be interrupted by AWS at any time — unsuitable when downtime is not an option. Reserved Instances require long-term commitments. Savings Plans also require a commitment period — not suitable for a one-weekend workload.

31. Which of the following AWS services integrates with AWS Shield and AWS Web Application Firewall (AWS WAF) to protect against network and application layer DDoS attacks?

  1. Amazon EFS
  2. AWS Secrets Manager
  3. AWS Systems Manager
  4. Amazon CloudFront

Answer : D
Explanation: Amazon CloudFront integrates natively with AWS Shield (for DDoS protection) and AWS WAF (for application-layer filtering) to protect web applications from network and application layer attacks. CloudFront distributes traffic globally through Edge Locations, absorbing volumetric DDoS attacks before they reach your origin. Amazon EFS is a file system, AWS Secrets Manager manages credentials, and AWS Systems Manager handles operational management — none integrate with Shield and WAF for DDoS protection.

32. Which of the following services is used when encrypting EBS volumes?

  1. AWS WAF
  2. AWS KMS
  3. Amazon Macie
  4. Amazon GuardDuty

Answer : B
Explanation: AWS Key Management Service (KMS) is used to manage the encryption keys when encrypting Amazon EBS volumes. When you enable EBS encryption, AWS KMS generates and manages the data encryption keys used to encrypt the volume data, snapshots, and any data transferred between the volume and the instance. AWS WAF is a web application firewall, Amazon Macie detects sensitive data in S3, and Amazon GuardDuty is a threat detection service — none manage EBS encryption keys.

33. The AWS account administrator of your company has been fired. With the permissions granted to him as an administrator, he was able to create multiple IAM user accounts and access keys. Additionally, you are not sure whether he has access to the AWS root account or not. What should you do immediately to protect your AWS infrastructure? (Choose TWO)

  1. Download all the attached policies in a safe place
  2. Delete all IAM accounts and recreate them
  3. Use the CloudWatch service to check all API calls that have been made in your account since the administrator was fired
  4. Rotate all access keys
  5. Change the email address and password of the root user account and enable MFA

Answer : D, E
Explanation: Immediately rotating all access keys (D) invalidates any access keys the administrator may have retained, preventing unauthorized programmatic access. Changing the root account email and password and enabling MFA (E) secures the root account in case the administrator has those credentials. Downloading policies (A) is not a security action. Deleting all IAM accounts (B) would disrupt all legitimate users. CloudWatch does not log API calls — that is CloudTrail’s function, and reviewing logs should come after securing the account (C).

34. What is the Amazon ElastiCache service used for? (Choose TWO)

  1. Provide an in-memory data storage service
  2. Reduce delivery costs using Edge Locations
  3. Improve web application performance
  4. Provide a Chef-compatible cache to speed up application response
  5. Distribute requests to multiple instances

Answer : A, C
Explanation: Amazon ElastiCache provides an in-memory data storage service (A) using Redis or Memcached, storing frequently accessed data in memory for sub-millisecond response times. This directly improves web application performance (C) by reducing the need to query backend databases for every request. Using Edge Locations (B) is a CloudFront function. ElastiCache is not Chef-compatible (D) — OpsWorks integrates with Chef. Traffic distribution across instances (E) is done by Elastic Load Balancing.

35. The elasticity of the AWS Cloud enables customers to save costs when compared to traditional hosting providers. What can AWS customers do to benefit from the elasticity of the AWS Cloud? (Choose TWO)

  1. Deploy your resources across multiple Availability Zones
  2. Use Amazon EC2 Auto Scaling
  3. Deploy your resources in another region
  4. Use Elastic Load Balancing
  5. Use Serverless Computing whenever possible

Answer : B, E
Explanation: Amazon EC2 Auto Scaling (B) is a direct implementation of elasticity — it automatically adds or removes EC2 instances based on demand, ensuring you only pay for the compute you actually need. Serverless Computing (E) — such as AWS Lambda — is inherently elastic, as it scales automatically to zero when not in use and scales up instantly on demand, eliminating idle resource costs entirely. Deploying across AZs (A) and regions (C) improves availability, not elasticity. Elastic Load Balancing (D) distributes traffic but does not scale compute resources.

36. What are some of the benefits of using On-Demand EC2 instances? (Choose TWO)

  1. They provide free capacity when testing your new applications
  2. They are cheaper than all other EC2 options
  3. They remove the need to buy “safety net” capacity to handle periodic traffic spikes
  4. They only require 1-2 days for setup and configuration
  5. You can increase or decrease your compute capacity depending on the demands of your application

Answer : C, E
Explanation: On-Demand instances remove the need to over-provision “safety net” capacity for traffic spikes (C) — you simply launch additional instances when needed and terminate them when the spike passes. They also allow you to freely increase or decrease compute capacity based on application demand (E). On-Demand instances are not free (A). They are not the cheapest option — Spot Instances offer much lower prices (B). EC2 instances can be launched in minutes, not 1-2 days (D).

37. Each AWS Region is composed of multiple Availability Zones. Which of the following best describes what an Availability Zone is?

  1. It is a data center designed to be completely isolated from other data centers in the same region
  2. It is a collection of data centers distributed in multiple countries
  3. It is a logically isolated network of the AWS Cloud
  4. It is a distinct location within a region that is insulated from failures in other Availability Zones

Answer : D
Explanation: An Availability Zone is a distinct, isolated location within an AWS Region, consisting of one or more discrete data centers with redundant power, networking, and connectivity. AZs are physically separated from each other to ensure that a failure in one AZ does not affect others, while being connected via low-latency links. Option A is partially correct but overstates isolation — AZs are connected within a Region. Option B describes a Region. Option C describes a VPC.

38. AWS provides disaster recovery capability by allowing customers to deploy infrastructure into multiple […].

  1. Regions
  2. Transportation devices
  3. Support plans
  4. Edge locations

Answer : A
Explanation: AWS provides disaster recovery capability by allowing customers to deploy infrastructure across multiple Regions, which are geographically separated locations worldwide. In the event of a regional disaster, workloads can fail over to another Region. Transportation devices (Snowball/Snowmobile) are for data transfer, not DR. Support plans provide technical assistance. Edge Locations are CDN points of presence used for content delivery, not infrastructure deployment for disaster recovery.

39. A financial services company decides to migrate one of its applications to AWS. The application deals with sensitive data, such as credit card information, and must run on a PCI-compliant environment. Which of the following is the company’s responsibility when building a PCI-compliant environment in AWS? (Choose TWO)

  1. Start the migration process immediately as all AWS services are PCI compliant
  2. Ensure that AWS services are configured properly to meet all PCI DSS standards
  3. Restrict any access to cardholder data and create a policy that addresses information security for all personnel
  4. Configure the underlying infrastructure of AWS services to meet all PCI DSS requirements
  5. Ensure that all PCI DSS physical security requirements are met

Answer : B, C
Explanation: Customers are responsible for configuring AWS services properly to meet PCI DSS requirements (B) — such as enabling encryption, access controls, and logging. They are also responsible for restricting access to cardholder data and establishing information security policies for their staff (C). Not all AWS services are PCI compliant, and migration should not start without proper assessment (A). AWS manages the underlying physical infrastructure (D, E) — customers do not configure or verify physical data center security.

40. What is the maximum amount of data that can be stored in S3 in a single AWS account?

  1. 100 Petabytes
  2. Virtually unlimited storage
  3. 5 Terabytes
  4. 10 Exabytes

Answer : B
Explanation: Amazon S3 provides virtually unlimited storage — there is no maximum limit on the total amount of data you can store across all buckets in an account. Individual objects are limited to 5 TB in size, but the total storage capacity per account is unlimited. This makes S3 suitable for storing any amount of data, from gigabytes to exabytes and beyond.

41. Which pillar of the AWS Well-Architected Framework provides recommendations to help customers select the right compute resources based on workload requirements?

  1. Operational Excellence
  2. Security
  3. Performance Efficiency
  4. Reliability

Answer : C
Explanation: The Performance Efficiency pillar of the AWS Well-Architected Framework focuses on using computing resources efficiently to meet system requirements, including selecting the right instance types, storage, and database services based on workload characteristics. Operational Excellence focuses on running and monitoring systems. Security focuses on protecting data and systems. Reliability focuses on recovering from failures — none specifically guide compute resource selection based on workload requirements.

42. Which AWS service delivers data, videos, applications, and APIs to users globally with low latency and high transfer speeds?

  1. Amazon Route 53
  2. Amazon Connect
  3. Amazon CloudFront
  4. Amazon EC2

Answer : C
Explanation: Amazon CloudFront is a globally distributed CDN service that delivers data, videos, applications, and APIs to users worldwide with low latency and high transfer speeds by caching content at Edge Locations close to users. Amazon Route 53 is a DNS service. Amazon Connect is a contact center service. Amazon EC2 provides compute instances — none deliver content globally via a CDN.

43. Which of the following steps should be taken by a customer when conducting penetration testing on AWS?

  1. Conduct penetration testing using Amazon Inspector, and then notify AWS support
  2. Request and wait for approval from the customer’s internal security team, and then conduct testing
  3. Notify AWS support, and then conduct testing immediately
  4. Request and wait for approval from AWS support, and then conduct testing

Answer : D
Explanation: AWS customers must request and receive prior approval from AWS before conducting penetration testing on their AWS infrastructure. AWS has a penetration testing policy that outlines which services can be tested and requires customers to submit a request through the AWS Vulnerability and Penetration Testing portal. Notifying support after testing (A, C) or only getting internal approval (B) are not sufficient — AWS approval is required first.

44. Which AWS Cost Management tool allows you to view the most granular data about your AWS bill?

  1. AWS Cost Explorer
  2. AWS Budgets
  3. AWS Cost and Usage Report
  4. AWS Billing Dashboard

Answer : C
Explanation: The AWS Cost and Usage Report (CUR) provides the most granular and comprehensive billing data available, with hourly or daily line items for every AWS service, resource ID, and cost allocation tag. AWS Cost Explorer provides visualizations and summaries but is less detailed than CUR. AWS Budgets tracks spending against thresholds. The AWS Billing Dashboard provides a high-level overview — none match the granularity of the Cost and Usage Report.

45. Which element of the AWS global infrastructure consists of one or more discrete data centers each with redundant power, networking, and connectivity, which are housed in separate facilities?

  1. AWS Regions
  2. Availability Zones
  3. Edge Locations
  4. Amazon CloudFront

Answer : B
Explanation: An Availability Zone consists of one or more discrete data centers, each with redundant power, networking, and connectivity, housed in separate facilities within an AWS Region. AZs are physically separated from each other to ensure fault isolation. AWS Regions are collections of multiple AZs. Edge Locations are smaller CloudFront points of presence used for content caching. Amazon CloudFront is a CDN service, not an infrastructure element.

46. How many Availability Zones should compute resources be provisioned across to achieve high availability?

  1. A minimum of one
  2. A minimum of two
  3. A minimum of three
  4. A minimum of four or more

Answer : B
Explanation: To achieve high availability, compute resources should be provisioned across a minimum of two Availability Zones. If one AZ experiences an outage, the application can continue operating from the other AZ. While deploying across three or more AZs provides greater redundancy, two is the minimum required for high availability. A single AZ provides no AZ-level redundancy.

47. The AWS Cloud’s multiple Regions are an example of:

  1. Agility
  2. Global infrastructure
  3. Elasticity
  4. Pay-as-you-go pricing

Answer : B
Explanation: The AWS Cloud’s multiple Regions around the world are a direct example of AWS’s global infrastructure — a worldwide network of data centers that enables customers to deploy applications close to their users anywhere on the globe. Agility refers to the speed of provisioning resources. Elasticity refers to scaling resources up or down. Pay-as-you-go pricing is the billing model — none describe multiple geographic Regions.

48. Which AWS service can be used to manually launch instances based on resource requirements?

  1. Amazon EBS
  2. Amazon S3
  3. Amazon EC2
  4. Amazon ECS

Answer : C
Explanation: Amazon EC2 allows you to manually launch virtual server instances with specific CPU, memory, storage, and networking configurations based on your resource requirements. You choose the instance type, AMI, and configuration and launch it on demand. Amazon EBS provides block storage volumes. Amazon S3 is object storage. Amazon ECS is a container orchestration service — none allow manually launching configurable server instances.

49. Which is a recommended pattern for designing a highly available architecture on AWS?

  1. Ensure that components have low-latency network connectivity
  2. Run enough Amazon EC2 instances to operate at peak load
  3. Ensure that the application is designed to accommodate failure of any single component
  4. Use a monolithic application that handles all operations

Answer : C
Explanation: A highly available architecture should be designed to accommodate the failure of any single component — ensuring the system continues to operate even when individual parts fail. This is achieved through redundancy, fault tolerance, and automatic failover. Running at peak load capacity at all times (B) wastes resources. Monolithic architecture (D) creates a single point of failure. Low-latency connectivity (A) improves performance but is not the primary pattern for high availability.

50. Which AWS characteristics make AWS cost effective for a workload with dynamic user demand? (Choose TWO)

  1. High availability
  2. Shared security model
  3. Elasticity
  4. Pay-as-you-go pricing
  5. Reliability

Answer : C, D
Explanation: Elasticity (C) allows AWS resources to automatically scale up during peak demand and scale down during low demand, so you never pay for idle capacity during quiet periods. Pay-as-you-go pricing (D) means you only pay for the resources you actually consume, making it inherently cost effective for dynamic workloads compared to fixed on-premises capacity. High availability (A) and reliability (E) improve uptime but do not directly reduce costs. The shared security model (B) is a responsibility framework, not a cost-saving characteristic.

Pages: 1 2 3 4 5 6 7 8 9