CLF-C02 Practice Questions — Free

CLF-C02 is AWS's entry-level certification, written for people who may never build anything on AWS: account managers, finance and product people, operations staff who have inherited a cloud bill, and engineers who want the vocabulary before an associate exam. It tests whether you understand what moving to the cloud actually changes — who is responsible for which layer under the shared responsibility model, what the core service families are for, how AWS charges for them, and where each support plan stops.

Its questions are about responsibility, cost and support as much as about services, and that breadth is the trap. Security and Compliance and Cloud Technology and Services together carry most of the exam, but Billing, Pricing, and Support is the domain furthest from technical work and the smallest of the four, which makes it the easiest to leave until last.

It is still enough to decide a close result. AWS reports only a scaled score, so a single weak domain can sit inside a total that looks comfortable until the day it does not.

How CLF-C02 is weighted

Cloud Concepts24%
Security and Compliance30%
Cloud Technology and Services34%
Billing, Pricing, and Support12%

Cloud Concepts

6 questions

Question 1 of 25
What does the AWS Cloud Adoption Framework's 'Operations perspective' primarily address?
- A.Exclusively the security controls applied to a workload
- B.The marketing strategy for a cloud migration announcement
- C.Ensuring cloud-based IT operations run efficiently and reliably, including monitoring and incident responseCorrect
- D.Only the initial cost estimate for a migration project
Answer: C
The Operations perspective within AWS CAF focuses on running, monitoring, and maintaining cloud workloads reliably and efficiently once they're live - one of CAF's six perspectives.
Question 2 of 25
A company must decide whether to lift and shift or refactor an application during migration. Which framework describes these options?
- A.The AWS Support plans and their response commitments
- B.The AWS Well-Architected Framework's six design pillars
- C.The shared responsibility model's division of duties
- D.The migration strategies: rehost, replatform, and refactorCorrect
Answer: D
The migration strategies describe rehost, replatform, refactor, and related paths.
Question 3 of 25
What does the 'Repurchase' migration strategy typically mean?
- A.Purchasing additional on-premises hardware
- B.Rehosting an application without changes
- C.Replacing an existing application with a different product, often a SaaS offeringCorrect
- D.Retiring an application permanently
Answer: C
Repurchase means moving to a different product, commonly replacing a licensed on-premises application with a SaaS alternative.
Question 4 of 25
Which scenario best illustrates the cloud benefit of agility?
- A.Recovering an application after an entire Region fails
- B.Spinning up a test environment in minutes instead of weeksCorrect
- C.Keeping data within the borders of a specific country
- D.Paying only for the compute hours actually consumed
Answer: B
Agility is the speed of provisioning and experimentation.
Question 5 of 25
What are AWS Local Zones designed to provide?
- A.Free-tier-only Regions for testing
- B.Backup storage for S3 Glacier
- C.AWS compute and storage closer to large population centers, for applications needing single-digit-millisecond latencyCorrect
- D.Zones reserved exclusively for government workloads
Answer: C
Local Zones extend AWS infrastructure into metro areas near end users, placing compute/storage closer than the parent Region for latency-sensitive applications like gaming or media.
Question 6 of 25
What distinguishes 'elasticity' from 'scalability' in cloud computing, as commonly discussed?
- A.Scalability only applies to storage, not compute
- B.Elasticity implies automatically scaling both up and down with demand; scalability more broadly refers to the ability to increase capacity to handle growthCorrect
- C.They are unrelated concepts
- D.Elasticity refers exclusively to network bandwidth
Answer: B
Scalability is the broader ability to increase resources to handle growing demand, while elasticity specifically emphasizes automatically scaling both up and down in response to real-time demand.

Security and Compliance

8 questions

Question 7 of 25
A company's developers currently share one root account login. What should the security team do first?
- A.Change the root password and continue sharing it securely
- B.Create individual IAM users or identities and stop using rootCorrect
- C.Add multi-factor authentication and keep the shared login
- D.Move the root credentials into a password manager for the team
Answer: B
Root should not be used for daily work; individual identities give accountability.
Question 8 of 25
A company must protect the root user of its AWS account. Which action is most important?
- A.Share the root password with two administrators for continuity
- B.Use the root user daily so its activity is well understood
- C.Enable multi-factor authentication and lock the credentials awayCorrect
- D.Create access keys for the root user for automation tasks
Answer: C
Root should have MFA enabled and be used only when strictly required.
Question 9 of 25
What is the IAM credential report?
- A.A list of all S3 buckets in the account
- B.A monthly invoice for IAM usage
- C.A downloadable report listing all IAM users and the status of their passwords, access keys, and MFA devicesCorrect
- D.A report on failed login attempts only
Answer: C
The credential report gives auditors a per-user snapshot of credential hygiene - password age, access key rotation status, MFA enablement - useful for periodic security reviews.
Question 10 of 25
What is the primary purpose of AWS Security Hub?
- A.Providing a centralized view of security alerts and compliance status across multiple AWS accounts and servicesCorrect
- B.Automatically writing IAM policies
- C.Providing a managed VPN connection
- D.Serving as a container image registry
Answer: A
AWS Security Hub aggregates, organizes, and prioritizes security findings and compliance status from multiple AWS security services and accounts into a single centralized dashboard.
Question 11 of 25
What kind of encryption does AWS recommend to protect data as it travels between a client and an AWS service?
- A.Encryption in transit, typically using TLS/SSLCorrect
- B.Encryption at rest only
- C.No encryption is needed within AWS
- D.Physical encryption of network cables
Answer: A
Data moving across networks should be protected with encryption in transit (TLS/SSL), distinct from encryption at rest which protects stored data - AWS supports both, and both are the customer's responsibility to enable where applicable.
Question 12 of 25
What is the purpose of S3 Object Lock?
- A.Locking a bucket so no user can ever read its contents
- B.Encrypting objects with a lock icon shown in the console
- C.Restricting a bucket to a single AWS Region permanently
- D.Preventing objects from being deleted or overwritten for a defined retention period, supporting compliance requirements like WORM storageCorrect
Answer: D
S3 Object Lock enforces write-once-read-many (WORM) storage, preventing object deletion or modification for a set retention period or indefinitely (legal hold) - used to meet regulatory retention requirements.
Question 13 of 25
Under the AWS Shared Responsibility Model, what is the customer generally responsible for?
- A.Maintaining the host hypervisor
- B.Security 'in' the cloud, including their data, identity and access management, and guest OS configurationCorrect
- C.The physical security of AWS data centers
- D.The availability of the underlying AWS global network
Answer: B
The customer is responsible for security 'in' the cloud - protecting their own data, managing access controls, and configuring/patching anything they control, such as the guest OS on EC2.
Question 14 of 25
When would a customer choose AWS CloudHSM over AWS KMS?
- A.When they want the cheapest possible key storage
- B.When they need dedicated, single-tenant hardware security modules under their exclusive control, often for strict compliance requirementsCorrect
- C.CloudHSM is required for all S3 encryption
- D.When they don't need encryption at all
Answer: B
CloudHSM provides dedicated hardware security modules that only the customer controls - chosen for compliance regimes demanding single-tenant key custody, whereas KMS is the easier, multi-tenant managed default.

Cloud Technology and Services

8 questions

Question 15 of 25
What is the primary purpose of AWS Step Functions?
- A.Providing raw block storage for EC2
- B.Encrypting data at rest
- C.Coordinating multiple AWS services into serverless workflows using visual state machinesCorrect
- D.Managing DNS routing policies
Answer: C
AWS Step Functions lets you coordinate multiple AWS services (like Lambda functions) into serverless workflows, defined as visual state machines, handling retries and error states.
Question 16 of 25
What is AWS Elastic Beanstalk's relationship to the resources it deploys?
- A.It only deploys Lambda functions
- B.It automatically provisions and manages underlying resources like EC2, load balancers, and Auto Scaling on your behalfCorrect
- C.It requires you to manually create every resource first
- D.It cannot use EC2
Answer: B
Beanstalk orchestrates the underlying AWS resources (EC2, ELB, Auto Scaling groups, etc.) automatically from your uploaded application - you retain access to those resources but don't have to wire them up yourself.
Question 17 of 25
What is Amazon EBS primarily used for?
- A.Providing persistent block storage volumes for use with EC2 instancesCorrect
- B.Storing static website files publicly
- C.Serving as a content delivery network
- D.Managing DNS routing
Answer: A
Amazon Elastic Block Store (EBS) provides persistent block-level storage volumes that attach to EC2 instances, similar to a virtual hard drive.
Question 18 of 25
What does RDS Multi-AZ deployment provide?
- A.Automatic conversion to a NoSQL engine
- B.Free cross-Region backups
- C.Horizontal read scaling across many replicas
- D.High availability via a synchronously replicated standby in another AZ, with automatic failoverCorrect
Answer: D
Multi-AZ maintains a synchronous standby copy in a different Availability Zone strictly for availability - RDS fails over to it automatically during outages. It does not serve read traffic.
Question 19 of 25
When would DynamoDB generally be favored over RDS?
- A.When the application needs a flexible, non-relational data model at very large scale with low-latency accessCorrect
- B.When the application requires complex multi-table joins with strict relational integrity
- C.Only when the data must be stored as static files
- D.Only for applications with no need for persistence
Answer: A
DynamoDB suits workloads needing a flexible schema and consistent low-latency performance at massive scale, while RDS suits workloads that need relational structure and complex queries/joins.
Question 20 of 25
What is the primary purpose of Amazon API Gateway?
- A.Providing a managed relational database
- B.Creating, publishing, and managing APIs at scale, acting as a front door for applications to access backend servicesCorrect
- C.Serving as a content delivery network
- D.Managing IAM user credentials
Answer: B
Amazon API Gateway lets developers create, publish, secure, and monitor APIs that act as an entry point for client applications to reach backend services like Lambda functions or other AWS services.
Question 21 of 25
What is Amazon Rekognition?
- A.A DNS anomaly detector
- B.A service for adding image and video analysis to applications, such as object and face detectionCorrect
- C.A code review automation tool
- D.A service that recognizes anomalous billing patterns
Answer: B
Rekognition provides pre-trained computer vision - identifying objects, scenes, text, and faces in images and video - without requiring customers to build their own ML models.
Question 22 of 25
What is Amazon WorkSpaces?
- A.A physical co-working space rental service
- B.A managed virtual desktop (Desktop-as-a-Service) offering, providing cloud-hosted Windows or Linux desktopsCorrect
- C.A container development environment
- D.A team chat application
Answer: B
Amazon WorkSpaces provides managed, cloud-hosted virtual desktops that users can access from many devices, replacing traditional desktop fleet management.

Billing, Pricing, and Support

3 questions

Question 23 of 25
What is a Reserved Instance in AWS pricing?
- A.A free tier of EC2 usage
- B.A pricing model offering a significant discount in exchange for committing to use a specific instance type for a 1- or 3-year termCorrect
- C.A type of Spot Instance with variable pricing
- D.An instance that is reserved but never billed
Answer: B
Reserved Instances offer a substantial discount compared to On-Demand pricing in exchange for committing to a specific instance configuration for a 1- or 3-year term.
Question 24 of 25
What is the AWS Cost and Usage Report (CUR)?
- A.A report only available to Enterprise Support customers
- B.The most comprehensive available dataset of AWS cost and usage data, which can be exported for detailed analysisCorrect
- C.A tool exclusively for estimating future costs, with no historical data
- D.A simplified one-page monthly bill summary
Answer: B
The Cost and Usage Report provides the most detailed available breakdown of AWS costs and usage, which can be delivered to an S3 bucket and queried with tools like Athena for in-depth analysis.
Question 25 of 25
How does S3 storage pricing behave as your stored volume grows into higher usage tiers?
- A.The per-GB price decreases at higher usage tiers - you pay less per unit as you store moreCorrect
- B.Pricing is a flat monthly fee regardless of volume
- C.Storage becomes free above 1 PB
- D.The per-GB price increases with volume
Answer: A
S3 uses tiered volume pricing - the effective per-GB rate drops as monthly stored volume crosses tier thresholds, one expression of AWS's pay-less-when-you-use-more philosophy.

20 more free after signup, then the full 397-question bank for $9.

Get 20 more free questions