AWS Cloud Practitioner
AWS Cloud Practitioner CLF-C02 Practice Questions (Free)
The AWS Certified Cloud Practitioner (CLF-C02) is the entry-level AWS certification and the best starting
point for anyone moving into cloud. It covers 65 questions in 90 minutes with a passing score of 700/1000.
Here are 15 free practice questions covering all four domains.
Exam overview: CLF-C02 · 65 questions · 90 minutes · Passing score: 700/1000 · 4 domains:
Cloud Concepts (24%), Security and Compliance (30%), Cloud Technology and Services (34%), Billing and Pricing (12%)
What you actually need to know
The Cloud Practitioner is conceptual, not technical. You won't be asked to write code or configure services — you need to understand what services exist and when to use them.
- Know the core services by category: compute (EC2, Lambda), storage (S3, EBS, EFS, Glacier), database (RDS, DynamoDB), networking (VPC, Route 53, CloudFront)
- Understand the Shared Responsibility Model cold — it appears in multiple questions
- Know the pricing models: On-Demand, Reserved, Spot, Savings Plans
- Know the support plans: Basic, Developer, Business, Enterprise
15 free CLF-C02 practice questions
Question 1
Which cloud computing benefit allows a company to pay only for the compute resources they consume, without any upfront commitments?
✓ B is correct. Pay-as-you-go means you're billed only for what you use with no upfront costs — a core cloud economic benefit. Elasticity is the ability to scale capacity up or down automatically. High availability ensures systems remain operational. Fault tolerance means systems continue operating despite component failures.
Question 2
A startup wants to avoid purchasing servers and instead run applications in a cloud environment managed by AWS. Which cloud deployment model does this describe?
✓ A is correct. A public cloud is owned and operated by a provider (AWS) and made available to the public — no hardware to purchase. A private cloud is dedicated infrastructure for one organization. Hybrid cloud combines public and private. On-premises means the company owns and manages the hardware themselves.
Question 3
Which AWS feature allows resources to automatically increase capacity during traffic spikes and reduce it during quiet periods?
✓ C is correct. Elasticity automatically adjusts capacity to match demand — scaling out during peak loads and in during low demand. High availability minimizes downtime. Fault tolerance keeps systems running through failures. Durability refers to data persistence (S3 has 11 nines of durability).
Question 4
According to the AWS Shared Responsibility Model, which of the following is the CUSTOMER'S responsibility?
✓ C is correct. The Shared Responsibility Model: AWS is responsible for security OF the cloud (hardware, network, hypervisor, physical facilities). Customers are responsible for security IN the cloud — their data, applications, OS configuration, and IAM permissions. Always think: if you configure it, it's yours.
Question 5
A company wants to enforce that all users must use multi-factor authentication when accessing the AWS Console. Which service is used to configure this?
✓ A is correct. IAM controls who can access AWS and what they can do — including enforcing MFA requirements. AWS Shield protects against DDoS. WAF filters web traffic for malicious requests. Cognito manages end-user authentication for applications, not AWS Console access.
Question 6
Which AWS service provides DDoS protection automatically for all AWS customers at no additional cost?
✓ A is correct. AWS Shield Standard is automatically enabled for all AWS customers at no cost and protects against common DDoS attacks. Shield Advanced is a paid tier with additional protections and 24/7 DDoS response team access. WAF is a web application firewall. GuardDuty is a threat detection service using ML.
Question 7
Which AWS service continuously monitors for malicious activity and unauthorized behavior in your AWS account using machine learning?
✓ C is correct. GuardDuty uses ML and threat intelligence to detect threats like compromised instances, unusual API calls, or unauthorized access. AWS Config tracks resource configuration compliance. CloudTrail logs all API calls for auditing. Inspector scans EC2 instances and Lambda functions for vulnerabilities.
Question 8
A developer needs to run code in response to events (like file uploads to S3) without managing any servers. Which AWS service should they use?
✓ C is correct. Lambda is a serverless compute service — you run code triggered by events and pay only for execution time, with no server management. EC2 requires you to manage instances. ECS runs containers. Elastic Beanstalk deploys and manages web applications but still provisions EC2 instances underneath.
Question 9
Which S3 storage class is designed for data that is accessed infrequently but must be retrieved immediately when needed, at a lower cost than S3 Standard?
✓ B is correct. S3 Standard-IA is for infrequently accessed data that still needs immediate retrieval — lower storage cost but per-retrieval charges. Glacier is for archiving where retrieval takes minutes to hours. One Zone-IA is cheaper but stores data in only one AZ. Intelligent-Tiering automatically moves data between tiers based on access patterns.
Question 10
A company needs a fully managed relational database service that handles backups, patching, and failover automatically. Which AWS service should they use?
✓ B is correct. Amazon RDS (Relational Database Service) is a managed relational database supporting MySQL, PostgreSQL, Oracle, SQL Server, and Aurora — handling backups, patching, and Multi-AZ failover. DynamoDB is a NoSQL key-value database. Redshift is a data warehousing service. ElastiCache is an in-memory caching service.
Question 11
Which AWS service acts as a global content delivery network (CDN), caching content at edge locations to reduce latency for end users?
✓ B is correct. CloudFront is AWS's CDN — it caches content at 400+ edge locations worldwide so users retrieve it from a nearby location, reducing latency. Route 53 is DNS. Global Accelerator routes traffic over AWS's private network for improved performance. ELB distributes traffic across instances within a region.
Question 12
A company knows they will need a specific EC2 instance type for the next 3 years. Which pricing option provides the GREATEST discount?
✓ C is correct. Reserved Instances with a 3-year, all-upfront commitment offer up to 75% discount over On-Demand. Spot Instances can be cheaper but can be interrupted. Savings Plans offer flexibility but typically smaller discounts than max Reserved. On-Demand has no discount but no commitment.
Question 13
Which AWS tool allows you to view and analyze your AWS costs and usage over time, and create custom cost reports?
✓ A is correct. Cost Explorer visualizes, filters, and analyzes your actual AWS spending and usage trends. AWS Budgets sets spending alerts. The Pricing Calculator estimates costs before deploying. Trusted Advisor provides recommendations across cost, security, performance, and reliability.
Question 14
A company needs 24/7 phone and chat access to AWS Support engineers for production system issues. Which support plan provides this?
✓ C is correct. Business plan provides 24/7 phone, chat, and email access to Cloud Support Engineers. Basic only includes documentation and community access. Developer offers email support during business hours. Enterprise adds a dedicated Technical Account Manager (TAM) and faster response times for critical issues.
Question 15
Which AWS service provides recommendations to help reduce costs, improve performance, and increase security — checking against AWS best practices?
✓ C is correct. Trusted Advisor checks your account against AWS best practices across 5 pillars: cost optimization, performance, security, fault tolerance, and service limits — then provides actionable recommendations. AWS Config tracks configuration compliance. Inspector scans for vulnerabilities. Well-Architected Tool evaluates your architecture against the 6 pillars framework.
255 more AWS questions waiting for you
aprencert has 270 AWS Cloud Practitioner questions with full explanations — free to start.
Start practicing free →Services cheat sheet — what to remember
| Category | Key Services |
|---|---|
| Compute | EC2 (VMs), Lambda (serverless), ECS/EKS (containers), Elastic Beanstalk (PaaS) |
| Storage | S3 (object), EBS (block, for EC2), EFS (file), Glacier (archive) |
| Database | RDS (relational), DynamoDB (NoSQL), Redshift (data warehouse), ElastiCache (cache) |
| Networking | VPC (isolation), Route 53 (DNS), CloudFront (CDN), ELB (load balancing) |
| Security | IAM (access), Shield (DDoS), WAF (web), GuardDuty (threat detection), KMS (encryption keys) |
| Monitoring | CloudWatch (metrics/logs), CloudTrail (API auditing), Config (compliance), Trusted Advisor |
Practice all 270 AWS Cloud Practitioner questions at aprencert.com — free tier available, no credit card needed.