Free CLF-C02 practice exam questions

What the 20 questions cover

Every question here passed the same checks as the full bank: the quoted sentence was found on the live official page, and an independent blind reviewer matched the answer. How we check questions.

The questions

Answers are hidden. Open “Show answer and source” under a question after you have picked yours.

1. Question 1 of 20 · D1: Cloud Concepts · clf-d1-001

   A startup expects its user base to change sharply over its first year and does not want to buy servers before it knows how much capacity it will use. Which benefit of the AWS Cloud addresses this concern most directly?

   • A. Option A: Signing a multi-year hardware lease that AWS refreshes automatically
   • B. Option B: Keeping its own servers but having AWS staff manage them on site
   • C. Option C: Paying only for the resources it consumes instead of buying servers up front
   • D. Option D: Prepaying for a fixed amount of capacity in exchange for a deep volume discount
   Show answer and source

   Answer: C. Pay-as-you-go pricing removes the need to invest in data centers and servers before demand is known.

   • A (incorrect): AWS does not lease hardware to customers; a multi-year commitment is the opposite of paying only for usage.
   • B (incorrect): That is a managed hosting arrangement for owned hardware, so the startup would still buy servers up front.
   • C (correct): Correct. AWS describes this as trading fixed expense for variable expense: you pay when you consume, and only for what you consume.
   • D (incorrect): Prepaying for a fixed block of capacity still requires guessing usage in advance, which is what the startup wants to avoid.

   Official sourcedocs.aws.amazon.com

   you can pay only when you consume computing resources, and pay only for how much you consume

   docs.aws.amazon.com/whitepapers/latest/aws-overview/six-advantages-of-cloud-computing.html (official page)

2. Question 2 of 20 · D1: Cloud Concepts · clf-d1-002

   An architect reviews a workload and finds two virtual servers that each run at about 30% CPU around the clock. Consolidating them onto one server running at about 60% would cut the energy needed for the same output. Which AWS Well-Architected Framework pillar names this design principle?

   • A. Option A: Reliability
   • B. Option B: Performance efficiency
   • C. Option C: Operational excellence
   • D. Option D: Sustainability
   Show answer and source

   Answer: D. The sustainability pillar's 'Maximize utilization' principle says right-size workloads because baseline power per host makes low-utilization hosts wasteful.

   • A (incorrect): Reliability focuses on recovering from failure and meeting demand; consolidating hosts does not improve resilience.
   • B (incorrect): Performance efficiency is about using resources efficiently to meet performance requirements, not about reducing energy per unit of work.
   • C (incorrect): Operational excellence covers running and improving operations, such as observability and small reversible changes.
   • D (correct): Correct. 'Maximize utilization' is a sustainability design principle; AWS uses this very comparison of two hosts at 30% versus one at 60%.

   Official sourcedocs.aws.amazon.com

   Two hosts running at 30% utilization are less efficient than one host running at 60% due to baseline power consumption per host

   docs.aws.amazon.com/wellarchitected/latest/framework/sus-design-principles.html (official page)

3. Question 3 of 20 · D1: Cloud Concepts · clf-d1-003

   A company has agreed on its cloud goals and now needs to find capability gaps across the AWS CAF perspectives, surface stakeholder concerns and identify cross-organizational dependencies. Which AWS CAF transformation phase is this?

   • A. Option A: Envision
   • B. Option B: Align
   • C. Option C: Scale
   • D. Option D: Launch
   Show answer and source

   Answer: B. The AWS CAF uses four iterative phases: Envision, Align, Launch and Scale. Align is where readiness gaps and dependencies are surfaced.

   • A (incorrect): Envision identifies and prioritizes transformation opportunities and ties them to business outcomes; gap analysis comes next.
   • B (correct): Correct. The Align phase identifies capability gaps across the six perspectives, cross-organizational dependencies and stakeholder concerns.
   • C (incorrect): Scale expands successful pilots to the desired scale and makes sure the benefits are sustained.
   • D (incorrect): Launch delivers pilot initiatives in production to show incremental value.

   Official sourcedocs.aws.amazon.com

   Align phase focuses on identifying capability gaps across the six AWS CAF perspectives, identifying cross-organizational dependencies, and surfacing stakeholder concerns and challenges

   docs.aws.amazon.com/whitepapers/latest/overview-aws-cloud-adoption-framework/your-cloud-transformation-journey.html (official page)

4. Question 4 of 20 · D1: Cloud Concepts · clf-d1-004

   A company is moving a self-managed Microsoft SQL Server database to Amazon RDS for SQL Server during its migration. The application code stays the same, but the team no longer patches the database host. Which migration strategy is this?

   • A. Option A: Replatform
   • B. Option B: Refactor
   • C. Option C: Repurchase
   • D. Option D: Rehost
   Show answer and source

   Answer: A. Replatform ('lift, tinker, and shift') introduces some optimization, such as a managed database, without redesigning the application.

   • A (correct): Correct. Moving to a managed service with some optimization but no re-architecture is replatforming; AWS uses this exact SQL Server to RDS example.
   • B (incorrect): Refactoring changes the application's architecture to use cloud-native features, which is not happening here.
   • C (incorrect): Repurchasing replaces the application with a different product, such as a SaaS offering.
   • D (incorrect): Rehosting moves the workload without any changes, for example the same database on an EC2 instance.

   Official sourcedocs.aws.amazon.com

   For example, you might replatform a Microsoft SQL Server database to Amazon RDS for SQL Server.

   docs.aws.amazon.com/prescriptive-guidance/latest/large-migration-guide/migration-strategies.html (official page)

5. Question 5 of 20 · D1: Cloud Concepts · clf-d1-005

   A company owns software licenses from Microsoft and Oracle and wants to reuse them on AWS while tracking usage across its accounts to avoid licensing overages. Which AWS service is designed for this?

   • A. Option A: AWS Marketplace
   • B. Option B: AWS Service Catalog
   • C. Option C: AWS Artifact
   • D. Option D: AWS License Manager
   Show answer and source

   Answer: D. License Manager helps companies re-purpose existing licenses (BYOL) and stay compliant by tracking and limiting use.

   • A (incorrect): Marketplace sells third-party software and licenses; it does not track a company's existing license inventory.
   • B (incorrect): Service Catalog lets administrators publish approved products for users to deploy; it does not track license consumption.
   • C (incorrect): Artifact provides AWS compliance reports and agreements, not license tracking.
   • D (correct): Correct. License Manager tracks license usage, sets limits on consumption and supports bring-your-own-license use across accounts.

   Official sourcedocs.aws.amazon.com

   you can save costs by using Bring Your Own License model (BYOL) opportunities. That is, you can re-purpose your existing license inventory

   docs.aws.amazon.com/license-manager/latest/userguide/license-manager.html (official page)

6. Question 6 of 20 · D2: Security and Compliance · clf-d2-001

   A company runs its web application on Amazon EC2 instances. A new vulnerability is announced in the Linux distribution installed on those instances. Under the AWS shared responsibility model, who must apply the operating system patch?

   • A. Option A: AWS, during the scheduled maintenance events that it runs on the underlying hosts
   • B. Option B: AWS, because Amazon EC2 is a managed service that includes guest OS updates
   • C. Option C: AWS, because the instances were launched from an AWS-provided Amazon Linux AMI
   • D. Option D: The customer, because it manages the guest operating system on its EC2 instances
   Show answer and source

   Answer: D. EC2 is infrastructure as a service, so the customer handles the guest OS, installed software and security group configuration.

   • A (incorrect): Scheduled events cover the host and virtualization layer, not the guest OS that the customer manages.
   • B (incorrect): EC2 is infrastructure as a service; managed services such as RDS or Lambda are where AWS patches the OS.
   • C (incorrect): AWS publishes updated AMIs and packages, but applying patches to the guest OS on running instances is the customer's job.
   • D (correct): Correct. For EC2, the customer manages the guest OS, including updates and security patches.

   Official sourceaws.amazon.com

   Customers that deploy an Amazon EC2 instance are responsible for management of the guest operating system (including updates and security patches)

   aws.amazon.com/compliance/shared-responsibility-model/ (official page)

7. Question 7 of 20 · D2: Security and Compliance · clf-d2-002

   A company moves its MySQL database from self-managed Amazon EC2 instances to Amazon RDS for MySQL. Which task shifts from the company to AWS as a result?

   • A. Option A: Classifying the sensitivity of the data in the tables
   • B. Option B: Patching the database engine software
   • C. Option C: Designing the database schema and optimizing queries
   • D. Option D: Deciding which users and applications may connect
   Show answer and source

   Answer: B. Moving to a managed service such as RDS shifts operational tasks like engine patching to AWS, while data and access stay with the customer.

   • A (incorrect): Customers are always responsible for their data, including classifying it.
   • B (correct): Correct. Amazon RDS manages database software patching, backups, failure detection and recovery.
   • C (incorrect): Application and query optimization remain the customer's responsibility on EC2 and on RDS.
   • D (incorrect): Controlling access to the database stays with the customer on every deployment model.

   Official sourcedocs.aws.amazon.com

   Amazon RDS manages backups, software patching, automatic failure detection, and recovery.

   docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Welcome.html (official page)

8. Question 8 of 20 · D2: Security and Compliance · clf-d2-003

   An auditor asks a company for the AWS SOC and PCI compliance reports that cover the AWS infrastructure the company uses. Where can the company download these documents on demand?

   • A. Option A: AWS Artifact
   • B. Option B: AWS Trusted Advisor
   • C. Option C: AWS Security Hub CSPM
   • D. Option D: AWS Config
   Show answer and source

   Answer: A. AWS Artifact offers AWS compliance reports and agreements free of charge.

   • A (correct): Correct. AWS Artifact provides on-demand downloads of AWS security and compliance documents such as SOC and PCI reports.
   • B (incorrect): Trusted Advisor makes recommendations about your account; it does not provide compliance reports.
   • C (incorrect): Security Hub CSPM checks your own resources against standards; it does not provide AWS's audit reports.
   • D (incorrect): Config records your resource configurations and rule compliance, not AWS's third-party audit reports.

   Official sourcedocs.aws.amazon.com

   reports on compliance with International Organization for Standardization (ISO) standards and Payment Card Industry (PCI) Security Standards, and System and Organization Controls (SOC) reports

   docs.aws.amazon.com/artifact/latest/ug/what-is-aws-artifact.html (official page)

9. Question 9 of 20 · D2: Security and Compliance · clf-d2-004

   A small business has one standalone AWS account that is not part of AWS Organizations. It no longer needs the account and wants to close it. Which identity must perform this task?

   • A. Option A: AWS Support, after the business opens a case
   • B. Option B: An IAM user with the AdministratorAccess policy
   • C. Option C: The AWS account root user
   • D. Option D: An IAM role assumed from another AWS account
   Show answer and source

   Answer: C. Only a few tasks require the root user, and closing a standalone account is one of them.

   • A (incorrect): AWS Support does not close the account on the customer's behalf; the root user does it.
   • B (incorrect): Full IAM administrator permissions are not enough to close a standalone account; this task requires the root user.
   • C (correct): Correct. Standalone accounts outside AWS Organizations require root user credentials to close the account.
   • D (incorrect): Cross-account roles cannot close a standalone account.

   Official sourcedocs.aws.amazon.com

   Standalone AWS accounts that are not part of AWS Organizations require root credentials to close the account.

   docs.aws.amazon.com/IAM/latest/UserGuide/root-user-tasks.html (official page)

10. Question 10 of 20 · D2: Security and Compliance · clf-d2-005

    Developers have hard-coded a database password in application source code. The security team wants the password removed from code, retrieved at runtime and changed on a regular schedule without redeploying the application. Which AWS service is designed for this?

    • A. Option A: AWS Key Management Service (AWS KMS)
    • B. Option B: Amazon Macie
    • C. Option C: AWS Certificate Manager (ACM)
    • D. Option D: AWS Secrets Manager
    Show answer and source

    Answer: D. Secrets Manager replaces hard-coded credentials with a runtime call and can rotate them automatically.

    • A (incorrect): KMS creates and controls encryption keys; it is not built to store and rotate database passwords for applications.
    • B (incorrect): Macie discovers sensitive data in Amazon S3; it does not store or rotate secrets.
    • C (incorrect): ACM manages SSL/TLS certificates, not database credentials.
    • D (correct): Correct. Secrets Manager stores secrets for runtime retrieval and supports automatic rotation schedules.

    Official sourcedocs.aws.amazon.com

    With Secrets Manager, you can configure an automatic rotation schedule for your secrets.

    docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html (official page)

11. Question 11 of 20 · D2: Security and Compliance · clf-d2-006

    An online store wants to block HTTP requests that come from certain IP addresses or that contain suspicious query strings before they reach its Application Load Balancer. Which AWS service should it use?

    • A. Option A: AWS Shield Standard
    • B. Option B: AWS WAF
    • C. Option C: Amazon Inspector
    • D. Option D: Amazon GuardDuty
    Show answer and source

    Answer: B. AWS WAF rules can allow or block requests based on conditions such as source IP or query string values.

    • A (incorrect): Shield Standard protects against common network and transport layer DDoS attacks, not request rules based on query strings.
    • B (correct): Correct. AWS WAF monitors and filters HTTP and HTTPS requests to protected resources such as Application Load Balancers.
    • C (incorrect): Inspector scans workloads for vulnerabilities; it does not inspect incoming web traffic.
    • D (incorrect): GuardDuty detects threats by analyzing logs; it does not filter web requests.

    Official sourcedocs.aws.amazon.com

    AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to your protected web application resources.

    docs.aws.amazon.com/waf/latest/developerguide/what-is-aws-waf.html (official page)

12. Question 12 of 20 · D3: Cloud Technology and Services · clf-d3-001

    A company runs its application in a single Availability Zone and wants it to keep running if a power or cooling failure affects that zone's data centers. What should the company do?

    • A. Option A: Add more instances in the same Availability Zone behind a load balancer
    • B. Option B: Run the application across multiple Availability Zones in the Region
    • C. Option C: Move the application to a larger instance type in the same Availability Zone
    • D. Option D: Put the application behind Amazon CloudFront edge locations only
    Show answer and source

    Answer: B. Each Availability Zone has separate, redundant power, networking and connectivity, so multi-AZ designs achieve high availability.

    • A (incorrect): More instances in one zone share that zone's failure domain.
    • B (correct): Correct. Availability Zones do not share common points of failure such as generators and cooling, so spreading across them protects against a single-zone failure.
    • C (incorrect): A bigger instance in the same zone still fails if the zone loses power or cooling.
    • D (incorrect): CloudFront caches content near users, but the origin application would still depend on one zone.

    Official sourcedocs.aws.amazon.com

    Common points of failure, like generators and cooling equipment, are not shared across Availability Zones

    docs.aws.amazon.com/whitepapers/latest/aws-fault-isolation-boundaries/availability-zones.html (official page)

13. Question 13 of 20 · D3: Cloud Technology and Services · clf-d3-002

    A developer wants to run a small piece of code whenever a file is uploaded, without provisioning or managing any servers. Which AWS service fits best?

    • A. Option A: Amazon EC2
    • B. Option B: Amazon Lightsail
    • C. Option C: AWS Lambda
    • D. Option D: AWS Elastic Beanstalk
    Show answer and source

    Answer: C. Lambda is AWS's serverless compute service; it handles server maintenance, scaling and patching.

    • A (incorrect): EC2 provides virtual servers that the developer would have to provision and manage.
    • B (incorrect): Lightsail offers simple virtual private servers, which are still servers to manage.
    • C (correct): Correct. Lambda runs code in response to events without provisioning or managing servers.
    • D (incorrect): Elastic Beanstalk deploys web applications onto EC2 instances or EKS clusters that it provisions for you.

    Official sourcedocs.aws.amazon.com

    With Lambda, you can run code without provisioning or managing servers.

    docs.aws.amazon.com/lambda/latest/dg/welcome.html (official page)

14. Question 14 of 20 · D3: Cloud Technology and Services · clf-d3-003

    A mobile game stores player profiles and session data as key-value items and needs consistent single-digit millisecond performance whether it has ten users or millions. Which database service fits best?

    • A. Option A: Amazon Redshift
    • B. Option B: Amazon RDS for MySQL
    • C. Option C: Amazon Neptune
    • D. Option D: Amazon DynamoDB
    Show answer and source

    Answer: D. DynamoDB is the AWS NoSQL database built for consistent performance at any scale.

    • A (incorrect): Redshift is a data warehouse for analytics, not a low-latency key-value store for an application.
    • B (incorrect): RDS is relational; DynamoDB is the NoSQL service designed for this key-value access pattern at scale.
    • C (incorrect): Neptune is a graph database for highly connected data.
    • D (correct): Correct. DynamoDB is a serverless NoSQL database with single-digit millisecond performance at any scale.

    Official sourcedocs.aws.amazon.com

    Amazon DynamoDB is a serverless, fully managed, distributed NoSQL database with single-digit millisecond performance at any scale.

    docs.aws.amazon.com/amazondynamodb/latest/developerguide/Introduction.html (official page)

15. Question 15 of 20 · D3: Cloud Technology and Services · clf-d3-004

    A network engineer wants a rule that denies traffic from a specific IP address range for every resource in a subnet, rather than configuring each instance separately. Which VPC feature works at the subnet level?

    • A. Option A: A network access control list (network ACL)
    • B. Option B: A security group attached to each instance
    • C. Option C: A NAT gateway
    • D. Option D: A route table with an internet gateway route
    Show answer and source

    Answer: A. Network ACLs filter traffic for whole subnets and can deny traffic; security groups control traffic for the resources they are attached to.

    • A (correct): Correct. A network ACL allows or denies specific inbound or outbound traffic at the subnet level.
    • B (incorrect): Security groups are associated with resources such as instances, and their rules allow traffic; they are not subnet-level deny rules.
    • C (incorrect): A NAT gateway lets private instances reach outside services; it is not a traffic filter.
    • D (incorrect): An internet gateway connects the VPC to the internet; it does not filter traffic.

    Official sourcedocs.aws.amazon.com

    A network access control list (ACL) allows or denies specific inbound or outbound traffic at the subnet level.

    docs.aws.amazon.com/vpc/latest/userguide/vpc-network-acls.html (official page)

16. Question 16 of 20 · D3: Cloud Technology and Services · clf-d3-005

    A company stores millions of objects in Amazon S3, and nobody can predict which objects will be read often and which will sit untouched. It wants storage costs to drop automatically without retrieval delays or extra operational work. Which storage class fits?

    • A. Option A: S3 Glacier Deep Archive
    • B. Option B: S3 Standard
    • C. Option C: S3 One Zone-IA
    • D. Option D: S3 Intelligent-Tiering
    Show answer and source

    Answer: D. Intelligent-Tiering is the S3 class for changing or unknown access patterns.

    • A (incorrect): Deep Archive is for rarely accessed data and has retrieval times and minimum storage durations.
    • B (incorrect): S3 Standard is for frequently accessed data and does not move objects to cheaper tiers on its own.
    • C (incorrect): One Zone-IA stores data in a single Availability Zone and charges retrieval fees; it suits known infrequent access to re-creatable data.
    • D (correct): Correct. S3 Intelligent-Tiering moves data to the most cost-effective access tier automatically, without performance impact or operational overhead.

    Official sourcedocs.aws.amazon.com

    designed to optimize storage costs by automatically moving data to the most cost-effective access tier, without performance impact or operational overhead

    docs.aws.amazon.com/AmazonS3/latest/userguide/storage-class-intro.html (official page)

17. Question 17 of 20 · D3: Cloud Technology and Services · clf-d3-006

    An analyst wants to run ad-hoc SQL queries directly against log files stored in Amazon S3 without loading them into a database or managing any servers. Which service should the analyst use?

    • A. Option A: Amazon ElastiCache
    • B. Option B: Amazon Polly
    • C. Option C: Amazon Athena
    • D. Option D: Amazon Kinesis Data Streams
    Show answer and source

    Answer: C. Athena lets you point at data in S3 and run standard SQL queries in seconds.

    • A (incorrect): ElastiCache is an in-memory cache, not a query service for S3.
    • B (incorrect): Polly converts text into speech.
    • C (correct): Correct. Athena is an interactive query service for analyzing data in S3 with standard SQL.
    • D (incorrect): Kinesis Data Streams collects and processes streaming data records in real time; it does not query files in S3 with SQL.

    Official sourcedocs.aws.amazon.com

    Amazon Athena is an interactive query service that makes it easy to analyze data directly in Amazon Simple Storage Service (Amazon S3) using standard SQL

    docs.aws.amazon.com/athena/latest/ug/what-is.html (official page)

18. Question 18 of 20 · D3: Cloud Technology and Services · clf-d3-007

    A company must create the same network, load balancer, instances and database in three AWS Regions, and it wants every copy to match exactly. Which approach supports this best?

    • A. Option A: Have an administrator create the resources in the AWS Management Console in each Region
    • B. Option B: Describe the resources in an AWS CloudFormation template and deploy it in each Region
    • C. Option C: Copy the resources between Regions with AWS DataSync
    • D. Option D: Write instructions in a runbook for each Region's operations team
    Show answer and source

    Answer: B. Infrastructure as code with CloudFormation makes environment builds repeatable.

    • A (incorrect): Manual console work is fine for one-time tasks, but it is slow and error prone for identical, repeatable builds.
    • B (correct): Correct. A CloudFormation template describes the resources, and CloudFormation provisions and configures them the same way every time.
    • C (incorrect): DataSync transfers files and objects; it does not provision infrastructure.
    • D (incorrect): Runbooks followed by hand are hard to keep repeatable and consistent.

    Official sourcedocs.aws.amazon.com

    CloudFormation takes care of provisioning and configuring those resources for you.

    docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/Welcome.html (official page)

19. Question 19 of 20 · D4: Billing, Pricing, and Support · clf-d4-001

    A research team runs large batch analysis jobs that can be stopped and restarted at any time, and finishing them a few hours late is acceptable. Which EC2 purchasing option usually costs the least for this?

    • A. Option A: Spot Instances
    • B. Option B: Dedicated Hosts
    • C. Option C: On-Demand Instances
    • D. Option D: On-Demand Capacity Reservations
    Show answer and source

    Answer: A. Spot is the low-cost choice when timing is flexible and interruptions are acceptable.

    • A (correct): Correct. Spot Instances use spare EC2 capacity at steep discounts and suit flexible workloads that can be interrupted.
    • B (incorrect): Dedicated Hosts are physical servers dedicated to you, mainly for licensing or compliance needs; they are not the cheapest option.
    • C (incorrect): On-Demand works for any workload but costs more than Spot for interruptible jobs.
    • D (incorrect): Capacity Reservations guarantee capacity; they do not lower the price of interruptible work.

    Official sourcedocs.aws.amazon.com

    Spot Instances are a cost-effective choice if you can be flexible about when your applications run and if your applications can be interrupted.

    docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-spot-instances.html (official page)

20. Question 20 of 20 · D4: Billing, Pricing, and Support · clf-d4-002

    A startup wants an email alert when its monthly AWS spending is forecast to go over a set amount, before the money is actually spent. Which service should it use?

    • A. Option A: AWS Cost and Usage Reports
    • B. Option B: AWS Budgets
    • C. Option C: AWS Artifact
    • D. Option D: AWS Pricing Calculator
    Show answer and source

    Answer: B. Budgets can notify you on both actual and forecasted spend.

    • A (incorrect): CUR delivers detailed billing data files to S3; it does not send budget alerts.
    • B (correct): Correct. AWS Budgets tracks costs and usage and can alert on actual or forecasted spending against a target.
    • C (incorrect): Artifact provides compliance reports and agreements.
    • D (incorrect): Pricing Calculator estimates costs before you build; it does not watch real spending.

    Official sourcedocs.aws.amazon.com

    You can choose to be alerted for both actual (after accruing) and forecasted (before accruing) spends.

    docs.aws.amazon.com/cost-management/latest/userguide/budgets-managing-costs.html (official page)