Try 30 sample questions
These are real samples from the CLF-C02 bank — the full version has 865 like these.
1. A company is evaluating the AWS Cloud. Which statement BEST describes the benefit of economies of scale on AWS?
- AWS can offer lower pay-as-you-go prices because it aggregates usage across many customers
- AWS prices are identical in every Region because infrastructure costs do not vary by location.
- AWS removes the need for the company to plan capacity for new applications
- AWS allows the company to stop paying for security and compliance controls
Correct answer: A. Because AWS aggregates usage across hundreds of thousands of customers, it achieves higher economies of scale than any single company can, which translates into lower pay-as-you-go prices. Why others are wrong: B) Per-unit prices differ by Region; economies of scale is about AWS lowering prices by aggregating usage across customers, not about identical regional pricing.; C) Economies of scale is about price, not capacity planning. Not having to guess capacity is a separate cloud benefit.; D) Security and compliance remain a shared responsibility in the cloud; their cost is not eliminated.
2. Engineers are designing the AWS account structure, network topology, and shared services that all migrated applications will use. Which AWS CAF perspective covers this work?
- Business perspective
- Governance perspective
- Platform perspective
- People perspective
Correct answer: C. The platform perspective focuses on designing, engineering, and optimizing the cloud platform itself, including the landing zone, account structure, networking foundations, and platform services engineers build on. Why others are wrong: A) The business perspective handles strategy, budgets, and outcomes, not platform engineering.; B) Governance covers portfolio management, risk, and policy oversight, not building the platform.; D) The people perspective covers skills and organizational change, not the technical platform design.
3. A startup needs to test its application on 50 different server configurations for one weekend, then shut everything down. On AWS it creates all 50 environments in an hour. Which benefit of the AWS Cloud does this demonstrate?
- Economies of scale - AWS buys hardware more cheaply than the startup
- Agility - environments can be provisioned and discarded in minutes as needs change
- Fault tolerance - the application survives component failures
- Durability - test data is stored without loss
Correct answer: B. Agility is the ability to rapidly provision, experiment, and release resources. Creating 50 throwaway test environments in an hour - impossible with purchased hardware - is agility in action. Why others are wrong: A) Lower unit prices are real, but the scenario is about how fast environments can be created and removed, not price.; C) Nothing in the scenario involves a failure; it is about rapid provisioning for a short test.; D) Durability concerns data loss, not the speed of creating test environments.
4. Which AWS service gives a single place to track the progress of migrations performed with several different tools?
- AWS Service Catalog
- AWS CloudFormation
- AWS Config
- AWS Migration Hub
Correct answer: D. AWS Migration Hub provides a single location to track the progress of application migrations across multiple AWS and partner migration tools. Why others are wrong: A) Service Catalog manages approved product portfolios, not migration tracking.; B) CloudFormation deploys infrastructure as templates; it does not track migration progress.; C) Config records resource configuration changes for governance, not migration status.
5. An operations team replaces its manual, checklist-driven server setup with automated templates, so every environment is built identically and any change is proposed, reviewed, and applied as code. Which Well-Architected Framework pillar does this practice support?
- Performance efficiency
- Operational excellence
- Security
- Reliability
Correct answer: B. Operational excellence includes performing operations as code: defining infrastructure and procedures in templates and code so builds are consistent and repeatable, changes are reviewed before they are applied, and human error from manual steps is reduced. Why others are wrong: A) Performance efficiency concerns using computing resources efficiently to meet requirements, such as choosing the right resource types. It is not about how operational tasks are performed.; C) The security pillar concerns protecting data, systems, and assets. Automating a build process is an operations practice; no protection mechanism is described here.; D) Reliability concerns recovering from failures and meeting availability demands. Identical builds help consistency, but the practice described - operations as code - belongs to operational excellence.
6. A CFO is evaluating a move to AWS. Which value proposition matters MOST to her?
- Choosing the right EC2 instance family for each workload
- Writing application code with managed development tools
- Replacing large up-front data center investments with predictable operational spending that is visible per project
- Keeping all IT spending as capital expenditure to preserve its tax treatment
Correct answer: C. The CFO cares about the financial model: trading CapEx for OpEx with per-project cost visibility, removing data center capital commitments. Why others are wrong: A) Instance selection is an engineering task, not the CFO's primary concern.; B) Developer tooling matters to engineering teams, not to the CFO's financial evaluation.; D) Preserving capital expenditure is a reason to stay on premises; the cloud's financial value proposition is moving away from large up-front capital investments toward operational spending.
7. A logistics company builds dashboards that detect failed deliveries within seconds, alerts the operations team, and feeds lessons back into its runbooks. Which pillar do these practices belong to?
- Security
- Reliability
- Sustainability
- Operational excellence
Correct answer: D. Running and monitoring systems to detect business-relevant events, alerting the right people, and continuously improving those processes is operational excellence (observability). Why others are wrong: A) Security protects assets; detecting failed deliveries is an operations concern.; B) Reliability is about the workload recovering from failure, not about business-event monitoring and runbook improvement.; C) Sustainability addresses environmental impact, not delivery monitoring.
8. Who is responsible for configuring automated backup schedules and retention periods for an Amazon RDS database?
- The customer
- AWS, because RDS is a fully managed service
- The database engine vendor, such as Oracle or Microsoft
- It is shared: AWS sets the backup schedule and the customer sets the retention period
Correct answer: A. RDS provides automated backup capability, but enabling it and choosing the backup window and retention period are configuration decisions the customer makes. AWS manages the engine and the host; how the customer's data is protected is configured by the customer. Why others are wrong: B) RDS being managed covers engine patching and host maintenance. Backup scheduling and retention are customer-controlled settings, in the same family as access control and encryption choices.; C) Engine vendors license the database software but have no role in operating or configuring a customer's RDS backups.; D) Both the schedule and the retention period are set by the customer in the RDS configuration. AWS does not choose either of them.
9. A developer joins a project and needs read access to the project's S3 buckets. What is the BEST way to grant this access?
- Create an IAM user for the developer, add the user to a group, and attach a policy granting the required S3 read permissions
- Add the developer's corporate email address to the S3 bucket's access control list
- Attach the S3FullAccess managed policy directly to the developer's existing IAM user
- Create a pre-signed URL for each object the developer needs to read
Correct answer: A. The best practice is one IAM user per person, placed in a group, with a policy granting only the required access - never sharing credentials and never using root. Why others are wrong: B) ACLs are a legacy mechanism for simple cases; the recommended approach is IAM users, groups, and policies.; C) S3FullAccess grants far more than the read-only access required; least privilege calls for a narrower policy.; D) Pre-signed URLs grant temporary access to individual objects, not ongoing read access to whole buckets.
10. A team of five shares a single IAM user and password. Why is this a bad practice?
- Each person should have an individual IAM user, so actions are attributable and access can be revoked per person
- Sharing one IAM user among the team saves money
- Sharing is acceptable because multi-factor authentication can be enabled on the shared user
- Shared IAM users cannot sign in to the console
Correct answer: A. Individual users preserve accountability: CloudTrail shows exactly who performed each action, and access can be granted or revoked per person. Why others are wrong: B) IAM users are free; there is no cost saving from sharing.; C) MFA protects the sign-in, but it does not show which of the five people performed an action.; D) Shared users can sign in fine - that is precisely the problem.
11. A financial company has a policy requiring encryption keys to be stored in dedicated hardware under its sole control. Which AWS offering meets this requirement?
- AWS KMS
- AWS Secrets Manager
- AWS Certificate Manager
- AWS CloudHSM
Correct answer: D. AWS CloudHSM provides dedicated, customer-controlled hardware security modules in the AWS Cloud, giving the customer sole control over the keys in FIPS-validated hardware - unlike KMS, where AWS operates the underlying infrastructure. Why others are wrong: A) KMS is a managed multi-tenant service where AWS operates the hardware; it does not provide dedicated customer-controlled HSMs.; B) Secrets Manager stores secrets like passwords and API keys, not customer-controlled hardware key storage.; C) Certificate Manager provisions TLS certificates, not dedicated key-storage hardware.
12. A company needs to review and sign AWS's Business Associate Addendum (BAA). Where is this done?
- In AWS Artifact, under customer agreements
- In the IAM console, under access keys
- On the AWS Marketplace product page
- On the Billing dashboard under payment methods
Correct answer: A. AWS Artifact provides both compliance reports and customer agreements such as the BAA, which the customer reviews and accepts there. Why others are wrong: B) The IAM console manages users and credentials, not legal agreements with AWS.; C) Marketplace is for third-party software listings, not AWS customer agreements.; D) The Billing dashboard handles invoices and payment methods, not compliance agreements.
13. A company discovers that an S3 bucket containing sensitive reports is publicly accessible. What is the BEST immediate action?
- Turn on S3 Block Public Access (account or bucket level) and correct the bucket policy
- Remove the bucket policy statement that grants public access, but leave the object ACLs unchanged
- Enable S3 versioning and nothing else
- Move the bucket to a different Region
Correct answer: A. Block Public Access is the immediate control that prevents public exposure, followed by fixing the policy that caused it. Why others are wrong: B) Public exposure can also come from object ACLs, not just the bucket policy; fixing only the policy can leave the bucket exposed, so enabling Block Public Access is the safe immediate step.; C) Versioning protects against overwrites, not against public read access.; D) A public bucket is public in any Region; moving it changes nothing about access.
14. A company wants misconfigurations found by AWS Security Hub to be fixed automatically without waiting for a human. Which approach achieves this?
- Rely on scheduled Systems Manager patching, which updates the flagged resources automatically
- An administrator must manually fix each finding in the console
- GuardDuty automatically quarantines resources flagged by Security Hub
- Send Security Hub findings to Amazon EventBridge and trigger automated remediation such as a Lambda function or Systems Manager runbook
Correct answer: D. Security Hub findings can be sent to Amazon EventBridge, where rules trigger automated responses such as Lambda functions or Systems Manager runbooks that remediate the issue - for example, blocking public access on an S3 bucket. Why others are wrong: A) Systems Manager patching updates operating system software; it does not correct configuration findings such as public S3 buckets or permissive security groups. Findings must be routed to EventBridge for targeted automated remediation.; B) Manual remediation does not scale and defeats the automation goal.; C) GuardDuty detects threats; it does not quarantine resources or process Security Hub findings.
15. A customer enables MFA on its IAM users and encrypts files before uploading them to Amazon S3. Meanwhile, an AWS technician replaces a failed hard drive inside an AWS data center. Which statement is CORRECT?
- Both the customer's actions and the technician's work are 'security OF the cloud'
- Both the customer's actions and the technician's work are 'security IN the cloud'
- The customer's actions are 'security IN the cloud', and the technician's work is 'security OF the cloud'
- The drive replacement is the customer's responsibility because the drive may have held customer data
Correct answer: C. Security IN the cloud covers what the customer configures and protects - identities, access controls, and their data. Security OF the cloud covers the infrastructure AWS operates, including its facilities and hardware such as the failed drive. Why others are wrong: A) The customer's own MFA and encryption choices are the customer's security work, which is security IN the cloud, not OF it.; B) Replacing hardware inside an AWS facility is AWS's infrastructure responsibility - security OF the cloud - regardless of whose data the hardware held.; D) Customers never handle AWS hardware. Physical media handling sits entirely on the AWS side of the shared responsibility model.
16. A company must guarantee that no S3 bucket in any of its 40 AWS accounts can ever be made public, to satisfy a compliance mandate. What enforces this organization-wide?
- Require every team to add the aws:PrincipalOrgID condition key to their own bucket policies
- Use a Service Control Policy (SCP) in AWS Organizations to deny S3 public-access actions in all accounts
- Enable versioning and MFA Delete on all buckets in every account
- Use an AWS Config rule that alerts whenever a bucket becomes public
Correct answer: B. Service Control Policies in AWS Organizations can deny actions such as making S3 buckets public across every account, enforcing a compliance rule centrally even if individual teams try to change it. Why others are wrong: A) The condition key helps, but it depends on every team applying it to every bucket. It is a per-policy control, not an organization-wide guarantee - only an SCP denies the action centrally in all accounts.; C) Versioning and MFA Delete protect against accidental deletion, not against public access. They do not enforce the no-public-bucket rule.; D) A Config rule detects and alerts on public buckets, but detection is not enforcement. It does not stop a bucket from being made public.
17. A study guide lists the exact number of AWS Regions. Why should a candidate be cautious about memorizing that number for the exam?
- New Regions are announced only once a year at re:Invent
- AWS publishes a fixed five-year roadmap of Region launches
- Only AWS Partners can see the current Region count
- AWS adds Regions over time, so a memorized count quickly becomes outdated
Correct answer: D. AWS opens new Regions over time, so any memorized count goes stale. The exam tests concepts - what Regions and AZs are and how to choose them - not the current tally. Why others are wrong: A) AWS announces new Regions throughout the year, not only at re:Invent. The count changes at any time.; B) AWS announces Regions as they open. There is no fixed published roadmap that makes the count stable.; C) The current count is public information. The problem is that it keeps growing, not that it is hidden.
18. A company will run the same database servers 24/7 for the next two years with completely predictable usage. Which EC2 purchasing option name BEST fits this pattern?
- Spot Instances
- Reserved Instances
- On-Demand Capacity Reservations for a single day
- Instances with default tenancy only
Correct answer: B. Reserved Instances suit steady-state, predictable workloads: the customer commits to consistent usage in exchange for a lower price compared to On-Demand. Why others are wrong: A) Spot Instances can be interrupted and suit flexible workloads, not a steady 24/7 database.; C) A one-day Capacity Reservation does not match a two-year predictable pattern.; D) Tenancy describes hardware sharing, not a purchasing option.
19. How do containers differ from virtual machines?
- Containers virtualize hardware while virtual machines virtualize the operating system
- Containers require a dedicated physical server per application
- Containers share the host operating system kernel while remaining isolated, unlike virtual machines which virtualize hardware
- Containers and virtual machines are the same technology with different names
Correct answer: C. Containers virtualize the operating system: multiple isolated containers share the host's OS kernel, making them lighter and faster to start than virtual machines, which virtualize hardware. Why others are wrong: A) The relationship is reversed: virtual machines virtualize hardware, containers virtualize the operating system.; B) Containers are designed to share hosts efficiently; they do not require dedicated physical servers.; D) They are distinct technologies with different isolation models and overhead.
20. A company is lifting and shifting a legacy application that requires a shared POSIX-compliant file system mounted on multiple Linux servers, with minimal application changes. Which storage service fits BEST?
- Amazon S3
- Amazon EBS
- Instance store
- Amazon EFS
Correct answer: D. EFS provides a fully managed, POSIX-compliant shared file system over NFS that legacy Linux applications can mount with minimal changes. Why others are wrong: A) S3 is object storage with an API, not a POSIX file system, so legacy applications would need rewriting.; B) EBS attaches to a single instance, so it cannot serve a shared file system across servers.; C) Instance store is ephemeral and local to one host, unsuitable for shared persistent data.
21. A company runs web servers that must accept traffic from the internet and a database that must NOT be reachable from the internet. Where should each be placed?
- Both in public subnets
- Web servers in a private subnet and the database in a public subnet
- Web servers in a public subnet and the database in a private subnet
- Web servers in a private subnet with access provided through a VPN
Correct answer: C. Public subnets route to the internet via an internet gateway, so internet-facing web servers go there; the database goes in a private subnet with no direct internet route. Why others are wrong: A) A database in a public subnet would be directly reachable from the internet.; B) This is reversed: the web tier needs internet access, the database must not have it.; D) A VPN provides private connectivity for administrators or branch offices, not public internet access for web visitors. Internet-facing web servers must sit in a public subnet.
22. Which AWS service lets business users create interactive dashboards and visualizations, with machine learning-powered insights, from their data?
- Amazon EMR
- AWS Glue
- Amazon QuickSight
- Amazon Athena
Correct answer: C. Amazon QuickSight is a scalable BI service for interactive dashboards, reports, and ML-powered insights such as anomaly detection. Why others are wrong: A) EMR processes big data; it does not build dashboards.; B) Glue prepares data; QuickSight visualizes it.; D) Athena queries data with SQL; it does not create interactive dashboards.
23. Which statement BEST describes AWS CloudFormation?
- A service that records who changed which AWS resources and when
- A service that provisions and manages AWS resources using infrastructure-as-code templates
- A monitoring service that collects metrics and alarms on resource utilization
- A backup service that copies data between AWS Regions on a schedule
Correct answer: B. AWS CloudFormation lets customers define their AWS infrastructure in templates and deploy those templates as stacks, so identical environments are provisioned repeatedly and changes are tracked. Why others are wrong: A) Recording who changed resources is the role of AWS CloudTrail, not CloudFormation.; C) Metrics and alarms are provided by Amazon CloudWatch, not CloudFormation.; D) Scheduled backup and replication is handled by services such as AWS Backup and S3 replication, not CloudFormation.
24. A company wants its business partners to upload files directly into Amazon S3 using the SFTP protocol they already use today. Which AWS service enables this without the company running its own SFTP servers?
- AWS Direct Connect
- AWS Storage Gateway
- Amazon S3 Transfer Acceleration
- AWS Transfer Family
Correct answer: D. AWS Transfer Family provides fully managed SFTP, FTPS, and FTP endpoints that store transferred files directly in Amazon S3, so the company avoids operating file-transfer servers. Why others are wrong: A) Direct Connect provides a dedicated network link to AWS; it does not provide managed file-transfer protocol endpoints.; B) Storage Gateway connects on-premises storage to AWS over standard storage protocols, not managed SFTP endpoints.; C) Transfer Acceleration speeds up uploads over the public internet; it does not provide managed SFTP protocol endpoints for partners.
25. A team deploys containerized microservices and wants to keep using Kubernetes APIs, but it does not want to manage any cluster servers or worker nodes itself. Which combination meets this requirement?
- Amazon EC2 with Kubernetes installed manually
- AWS Lambda functions
- AWS Fargate with Amazon ECS
- Amazon EKS with AWS Fargate
Correct answer: D. Amazon EKS provides managed Kubernetes control planes, and AWS Fargate runs the containers serverlessly, so the team uses standard Kubernetes APIs with no servers or nodes to manage. Why others are wrong: A) Self-installed Kubernetes on EC2 leaves the team managing every server and the control plane - the opposite of the requirement.; B) Lambda runs functions, not Kubernetes workloads; it does not provide the Kubernetes API.; C) Fargate with ECS is serverless containers but uses the ECS API, not Kubernetes.
26. A company wants its on-premises servers to read and write the same shared file system that its EC2 instances use, over its existing private AWS connection. Which storage option supports this?
- EC2 instance store volumes shared over the network
- Amazon EBS, which can be attached to on-premises servers directly
- Amazon EFS, which can be mounted from on-premises servers over Direct Connect or VPN as well as from EC2 instances
- An EBS volume with Multi-Attach enabled, shared between the EC2 instances and the on-premises servers
Correct answer: C. EFS is a shared NFS file system that EC2 instances mount natively and that on-premises servers can also mount over Direct Connect or VPN, giving both environments one common file system. Why others are wrong: A) Instance store is ephemeral local disk on one instance; it is neither shared nor durable.; B) EBS volumes attach to a single EC2 instance in one Availability Zone; they cannot be attached to on-premises servers.; D) EBS Multi-Attach shares a volume between EC2 instances in a single Availability Zone, but EBS volumes can never be attached to on-premises servers.
27. A new AWS customer wants to experiment with several services without incurring charges during the first month. Which statement about the AWS Free Tier is TRUE?
- It includes three types of offers: services that are always free, 12 months of free usage for new accounts, and short-term free trials
- Free Tier allowances apply only in the US East (N. Virginia) Region
- Free Tier usage never appears on the monthly bill
- The Free Tier covers unlimited usage of any included service
Correct answer: A. The Free Tier's three offer types, Always Free, 12 Months Free, and Trials, let new users explore AWS, but each has defined limits that must be monitored. Why others are wrong: B) Free Tier offers apply in the Regions where each service is available; they are not limited to us-east-1.; C) Free Tier usage is itemized on the bill and simply shows a zero charge while it stays within the free limits.; D) Each Free Tier offer has usage limits, and usage beyond those limits is charged at standard rates.
28. A team lead wants developers to see their own project's AWS costs each week to encourage cost accountability. Which combination supports this?
- Have each developer estimate their project's costs in a shared spreadsheet each week
- Rely on the AWS Free Tier to cover project costs
- Publish the costs from AWS Artifact
- Tag resources with the project name as a cost allocation tag, activate the tags, and share AWS Cost Explorer views filtered by those tags
Correct answer: D. Cost allocation tags plus Cost Explorer is the classic showback pattern: each project's spend becomes visible, filterable, and reportable, driving accountability. Why others are wrong: A) Manual estimates are error-prone and unenforceable; cost allocation tags with Cost Explorer views give automated, auditable per-project visibility.; B) The Free Tier is a limited billing allowance, not a cost visibility or accountability tool.; C) AWS Artifact contains AWS compliance documentation; it has nothing to do with customer cost reporting.
29. Two services both claim to help control costs: one requires the team to set thresholds, the other learns spending patterns by itself. Which pairing is correct?
- AWS Budgets (team sets thresholds); AWS Cost Anomaly Detection (learns patterns itself)
- AWS Cost Explorer (team sets thresholds); AWS Budgets (learns patterns itself)
- AWS Trusted Advisor (team sets thresholds); AWS Cost Explorer (learns patterns itself)
- The Billing dashboard (team sets thresholds); the CUR (learns patterns itself)
Correct answer: A. Budgets are threshold-based alerts you configure; Cost Anomaly Detection uses machine learning on your history so no thresholds are needed - knowing which is which is the point of the question. Why others are wrong: B) Cost Explorer has no thresholds or alerts at all; it is a visualization tool.; C) Trusted Advisor runs fixed best-practice checks; it does not learn spending patterns.; D) The Billing dashboard and CUR are reporting surfaces; neither sends alerts nor learns patterns.
30. A startup's CTO is choosing between Developer and Business support. The deciding factor is whether the team can reach an engineer by phone at midnight during an outage. Which plan meets this need?
- Neither plan; phone support requires Enterprise
- Developer, because it includes 24/7 phone access
- Either plan, since both offer identical access hours
- Business, because it includes 24/7 phone, chat, and email access
Correct answer: D. Business support provides 24/7 technical support by phone, chat, and email; Developer is business-hours email only - so the midnight-phone requirement decides for Business. Why others are wrong: A) Business already includes 24/7 phone support; Enterprise is not required for it.; B) Developer does not include phone support at all, let alone 24/7.; C) The access hours differ sharply between the two plans. CLF-C02 - Real-exam format questions (Q801-865) 65 additional questions in the other formats used by the real exam: multiple response (Select TWO), ordering, matching, and case-study sets. Each question includes the correct answer and full explanations. Multiple Response Questions (Select TWO)
Exam facts: AWS Certified Cloud Practitioner (CLF-C02)
- Exam: AWS Certified Cloud Practitioner (CLF-C02)
- Cost: $100 USD
- Duration: 90 minutes
- Questions: 65 — multiple choice and multiple response (50 scored, 15 unscored)
- Passing score: 700 (scaled score of 100–1,000)
- Validity: 3 years
Frequently asked questions
How long do I get access?
Three months (90 days) from purchase, covering both the interactive online bank and the full PDF download. Access can be extended.
Is there a free trial?
Yes — a free 30-question sample quiz and a free sample PDF are available with no account required, so you can judge the quality before paying.
Are these questions like the real CLF-C02 exam?
All 865 questions are mapped to the official CLF-C02 exam objectives, written in the same style and difficulty as the real exam.
Can I study offline?
Yes. Your purchase includes the complete question bank as a downloadable PDF for offline study.
What is the refund policy?
Full access is refundable within 15 days, or before 25% of the questions have been attempted — whichever comes first. Downloaded PDFs are non-refundable.
How much does the AWS Cloud Practitioner exam cost?
The CLF-C02 exam costs $100 USD.
How many questions are on the CLF-C02 exam?
65 questions in 90 minutes — multiple choice and multiple response. 50 questions are scored and 15 are unscored trial questions, and you can't tell which is which during the exam.
What is the passing score for CLF-C02?
700 on AWS's scaled score range of 100 to 1,000. Scoring is compensatory — you need to pass the exam overall, not each section.
How long is the AWS Cloud Practitioner certification valid?
Three years. Before it expires, you recertify by passing the current exam or a higher-level AWS exam.
Where can I practice for the CLF-C02 exam for free?
Right here on CertCrack. Start with the free 30-question sample quiz and the free sample PDF on this page — no account needed — and read the free Cloud Practitioner study guidebook. When you're ready for the full bank, this page gives you every practice question with detailed explanations for $10.