Prepare for AWS Certified Cloud Practitioner (CLF-C02) with free sample questions, a full-length diagnostic, topic drills, timed practice, cloud concepts, security, core AWS services, pricing, billing, support, and detailed explanations in IT Mastery.
CLF-C02 is AWS’s foundational cloud certification for candidates who need strong AWS basics across cloud concepts, security, core services, billing, and support. If you are searching for CLF-C02 sample questions, CLF-C02 practice exam questions, a Cloud Practitioner practice test, mock exam, or exam simulator, this is the main IT Mastery page to start on web and continue on iOS or Android with the same IT Mastery account.
Start a practice session for AWS Certified Cloud Practitioner (CLF-C02) below, or open the full app in a new tab. For the best experience, open the full app in a new tab and navigate with swipes/gestures or the mouse wheel—just like on your phone or tablet.
Open Full App in a New TabA small set of questions is available for free preview. Subscribers can unlock full access by signing in with the same app-family account they use on web and mobile.
Prefer to practice on your phone or tablet? Download the IT Mastery – AWS, Azure, GCP & CompTIA exam prep app for iOS or IT Mastery app on Google Play (Android) and use the same IT Mastery account across web and mobile.
Free diagnostic: Try the 65-question AWS CLF-C02 full-length practice exam before subscribing. Use it as one baseline run, then return to IT Mastery for timed mocks, topic drills, explanations, and the full Cloud Practitioner question bank.
CLF-C02 questions usually reward the option that chooses the correct high-level AWS service or pricing/support model without adding unnecessary architectural detail.
| Domain | Weight |
|---|---|
| Cloud Concepts | 24% |
| Security and Compliance | 30% |
| Cloud Technology and Services | 34% |
| Billing, Pricing, and Support | 12% |
Use these filters when an answer choice looks plausible but too broad:
| Area | What strong readiness looks like |
|---|---|
| Cloud concepts | You can explain elasticity, high availability, global infrastructure, cloud economics, and migration benefits without memorizing slogans. |
| Security and compliance | You can apply shared responsibility, IAM basics, encryption, monitoring, compliance programs, and least-privilege reasoning to short scenarios. |
| Cloud technology and services | You can choose the right AWS service family for common business needs without confusing similar services. |
| Billing, pricing, and support | You can identify the right cost tool, pricing model, support plan, and account-management feature from the wording of the scenario. |
| Day | Practice focus |
|---|---|
| 7 | Take the free full-length diagnostic and record misses by domain. |
| 6 | Drill shared responsibility, IAM basics, encryption, monitoring, and compliance wording. |
| 5 | Drill compute, storage, database, networking, migration, and managed service selection. |
| 4 | Drill billing, support, cost visibility, pricing models, and account-organization scenarios. |
| 3 | Complete a timed mixed set and rewrite each miss as a one-sentence rule. |
| 2 | Review only weak domains, confusing AWS service pairs, and support/billing traps. |
| 1 | Do a light confidence pass; avoid cramming unfamiliar service trivia late. |
If you can complete several unseen mixed attempts above roughly 75%, explain why each missed answer was tempting, and map most stems to the correct AWS service or responsibility boundary, you are probably ready to schedule the exam instead of overtraining. Additional practice should improve reasoning, not turn the bank into memorized answer recognition.
Use these child pages when you want focused IT Mastery practice before returning to mixed sets and timed mocks.
Need concept review first? Read the AWS CLF-C02 Cheat Sheet on Tech Exam Lexicon, then return here for timed mocks, topic drills, and full IT Mastery practice.
These are original IT Mastery practice questions aligned to CLF-C02 cloud concepts, AWS core services, security and compliance, pricing, billing, support, and workload-fit decisions. They are not AWS exam questions and are not copied from any exam sponsor. Use them to check readiness here, then continue in IT Mastery with mixed sets, topic drills, and timed mocks.
Topic: Domain 2: Security and Compliance
Which statement best describes how compliance requirements are handled when using AWS Cloud services?
Options:
Best answer: D
Explanation: The choice stating that customers must identify and meet their own compliance obligations, which can differ by country and industry, while AWS manages the compliance of the cloud infrastructure best matches the shared responsibility model. It correctly highlights that compliance requirements vary by geography and industry, and that AWS and the customer each have distinct roles in meeting those obligations.
Topic: Domain 4: Billing, Pricing, and Support
A company wants to implement internal chargeback so each department pays for the AWS resources it uses. The finance team plans to use AWS billing reports for this purpose. Which of the following approaches to tagging and tracking costs should the team AVOID? (Select TWO.)
Options:
Correct answers: C and D
Explanation: The approach that lets each team invent its own tag keys and meanings, even reusing the same key name differently, should be avoided because it prevents consistent grouping of costs across accounts or departments. The approach that uses untagged shared infrastructure with manual spreadsheet estimates should also be avoided, because it bypasses cost allocation tags entirely and results in error-prone, manual chargeback instead of leveraging AWS’s built-in cost reporting.
Topic: Domain 3: Cloud Technology and Services
A company is designing a messaging layer using Amazon SNS and Amazon SQS for its new application. The architects want to follow the intended messaging patterns for each service. Which TWO of the following approaches represent an inappropriate use of these services and should be avoided? (Select TWO.)
Options:
Correct answers: A and D
Explanation: The option that uses an Amazon SNS topic to distribute background image-processing jobs expecting only one EC2 instance to pick up each job is an anti-pattern because SNS delivers messages to all subscribers and does not enforce single-consumer processing. The option that uses a single Amazon SQS queue for multiple independent reporting services when every service must receive every message is also an anti-pattern, because SQS shares messages among consumers instead of broadcasting copies to each; separate queues or SNS with fanout would be more appropriate.
Topic: Domain 3: Cloud Technology and Services
An organization configures an Elastic Load Balancer to distribute incoming web traffic across multiple Amazon EC2 instances in different Availability Zones so that the application remains available if one instance becomes unhealthy. Which AWS Well-Architected pillar does this practice primarily support?
Options:
Best answer: A
Explanation: The choice that names Reliability is correct because the described practice directly improves system availability and fault tolerance. By distributing requests across multiple instances and Availability Zones, the application can withstand individual instance failures and continue operating, which is exactly what the Reliability pillar addresses.
Topic: Domain 1: Cloud Concepts
Which of the following statements about using AWS Database Migration Service (AWS DMS) and native database replication for database migrations is NOT correct?
Options:
Best answer: D
Explanation: The statement saying that AWS DMS can be used only for one-time bulk migrations and does not support ongoing replication is incorrect because AWS DMS explicitly supports ongoing replication (change data capture). With AWS DMS, you can load existing data and then continuously replicate changes from the source to the target, reducing downtime when you switch applications to the new database. This capability is a key benefit of using AWS DMS for minimal-downtime migrations.
Topic: Domain 3: Cloud Technology and Services
A company runs its public website on a single Amazon EC2 instance. During busy periods, the instance is overloaded, and if it fails, the website becomes unavailable. The company wants to improve availability and automatically spread user traffic across multiple EC2 instances in different Availability Zones. Which of the following actions/solutions will meet these requirements? (Select TWO.)
Options:
Correct answers: D and E
Explanation: Both using an Application Load Balancer in front of multiple EC2 instances and combining an Elastic Load Balancer with EC2 Auto Scaling rely on managed load balancing to spread traffic across several instances in different Availability Zones. These approaches eliminate the single point of failure and allow the website to handle more users by distributing incoming requests across multiple healthy targets.
Topic: Domain 3: Cloud Technology and Services
A startup is building a new web application on AWS. They want a fully managed service that will automatically compile their source code, run unit tests on every code commit, and produce build artifacts without managing any build servers. Which AWS service best meets this requirement?
Options:
Best answer: A
Explanation: AWS CodeBuild directly addresses all requirements by providing a fully managed build environment that compiles code, runs unit tests on each change (when integrated with a source trigger), and outputs build artifacts without any need to provision or manage build servers.
Topic: Domain 3: Cloud Technology and Services
A company is expanding an internal web application from one AWS Region to two Regions to improve latency and availability. The company wants to manage administrators’ AWS access in a single place so their permissions apply in both Regions, while keeping the application’s compute resources separate in each Region. Which approach BEST uses AWS global and Regional services to meet these needs?
Options:
Best answer: A
Explanation: The option that uses a single AWS account with IAM users and roles for administrators and separate EC2 instances in each Region correctly treats IAM as a global service and EC2 as a Regional service, while also meeting the requirements for centralized access control and Region-separated compute resources.
Topic: Domain 3: Cloud Technology and Services
Which TWO of the following statements about AWS developer tools and their purposes are INCORRECT? (Select TWO.)
Options:
Correct answers: B and E
Explanation: The statement claiming that AWS X-Ray is a service for storing and archiving application and system logs for long-term compliance is incorrect because X-Ray focuses on distributed tracing and visualizing request paths, not on log retention. The statement describing AWS CodeBuild as a full CI/CD service that provisions pipelines, manages all release stages, and directly deploys to production is also incorrect, because CodeBuild handles only the build and test steps, while other services such as AWS CodePipeline and deployment tools manage the broader CI/CD workflow.
Topic: Domain 2: Security and Compliance
A company hosts a public web application on AWS and wants protection from large-scale Distributed Denial of Service (DDoS) attacks with minimal operational effort. Which of the following is NOT an appropriate way to address this requirement?
Options:
Best answer: B
Explanation: The choice to rely only on security groups and network ACLs for DDoS protection is incorrect because these tools are meant for allowing or blocking traffic based on rules, not for detecting and absorbing large, distributed attack volumes. This approach ignores AWS’s managed DDoS services such as AWS Shield, which are purpose-built for this type of threat. At a Cloud Practitioner level, treating basic network filters as a full DDoS solution is a clear violation of best practice.
Topic: Domain 1: Cloud Concepts
A company is planning to migrate several on-premises applications to AWS. Leadership has heard about performing a migration readiness assessment and wants to understand its main benefit. Which statement best describes how a migration readiness assessment helps the company plan its cloud adoption?
Options:
Best answer: B
Explanation: The option that describes identifying gaps in skills, processes, and governance and producing a prioritized plan matches the purpose of a migration readiness assessment. The assessment is about organizational readiness and planning, not doing the migration itself or final technical sizing. Creating a roadmap to close those gaps is exactly how it helps plan cloud adoption.
Topic: Domain 3: Cloud Technology and Services
Which of the following statements about using the AWS Management Console are NOT correct? (Select TWO.)
Options:
Correct answers: D and E
Explanation: The statement that the console is the preferred tool for large-scale, repeatable automation is incorrect because such automation is better achieved with tools like AWS CloudFormation, the AWS CLI, or SDKs, which can be scripted and integrated into pipelines. The statement that the console is required for all security-sensitive operations is also incorrect, because secure access can be provided programmatically using IAM roles, least-privilege policies, and proper credential management without relying solely on the console.
Topic: Domain 3: Cloud Technology and Services
A company is modernizing a legacy application into containers on AWS. The team wants to follow AWS best practices for deploying and managing containers at scale. Which of the following approaches is NOT recommended for running containerized workloads on AWS?
Options:
Best answer: D
Explanation: The approach that manually launches EC2 instances and starts containers over SSH without using any orchestration service is not recommended. It ignores managed container orchestration solutions like Amazon ECS and Amazon EKS, leading to poor scalability, higher operational burden, and increased risk of configuration drift. This violates the best practice of using managed services to simplify container management on AWS.
Topic: Domain 3: Cloud Technology and Services
A large company is migrating its mission‑critical workloads to AWS. Leaders want a designated AWS expert to provide proactive guidance, best practices reviews, and act as a primary point of contact for complex issues. Which AWS Support plan best meets this requirement?
Options:
Best answer: B
Explanation: Enterprise Support is correct because it is specifically designed for large or business‑critical environments that need proactive, strategic engagement with AWS. It includes a designated Technical Account Manager (TAM) who provides ongoing best practices guidance, architectural reviews, and acts as a primary point of contact, which matches the company’s requirement in the scenario.
Topic: Domain 2: Security and Compliance
A company runs a public website using an Application Load Balancer (ALB) in a VPC. Users recently reported that the site was slow and sometimes unavailable during a large traffic spike that the security team suspects was a DDoS attack.
The team reviews the current protections for the application:
| Component | Protection type | Status |
|---|---|---|
| VPC public subnets | Network ACLs | Configured |
| ALB security group | Allow HTTP/HTTPS only | Configured |
| Amazon CloudFront CDN | Web ACL (AWS WAF) | Basic rules |
| DDoS protection (Shield) | Managed DDoS service | Not enabled |
Based on the information in the table, which action is the most appropriate NEXT STEP to add managed DDoS protection for this internet-facing application?
Options:
Best answer: A
Explanation: Enabling AWS Shield Advanced directly addresses the gap shown in the exhibit, where the “DDoS protection (Shield)” status is “Not enabled.” Shield Advanced is specifically designed as a managed service to protect against DDoS attacks on internet-facing endpoints such as CloudFront distributions and Application Load Balancers, making it the best next step for managed DDoS protection in this scenario.
Topic: Domain 2: Security and Compliance
A healthcare startup in Country A runs its patient records application entirely in an AWS Region located on another continent. During a compliance review, regulators state that all patient data for Country A must be stored and processed within Country A’s borders. What should the company do to address this issue while continuing to use AWS?
Options:
Best answer: B
Explanation: Migrating the patient records workload to an AWS Region that meets the in-country data residency requirements aligns directly with the regulator’s concern that data must stay within Country A’s borders. AWS allows customers to choose Regions based on geographic and regulatory needs, so placing both primary data and backups in a compliant Region is the correct way to meet this geographic compliance requirement.
Topic: Domain 4: Billing, Pricing, and Support
A company is planning to reduce its Amazon EC2 compute costs and is comparing Savings Plans with Reserved Instances. Which of the following statements about these pricing options is INCORRECT?
Options:
Best answer: C
Explanation: The statement that says Savings Plans require committing to a specific instance type, Region, and operating system and that Reserved Instances automatically apply across different instance families and compute services is incorrect. In reality, Savings Plans are the more flexible mechanism, especially Compute Savings Plans, which can apply across multiple services and instance families. Reserved Instances are typically tied more narrowly to specific EC2 instance attributes in a given Region. Recognizing this inversion is key to understanding why that statement is wrong.
Topic: Domain 3: Cloud Technology and Services
Which statement best describes how using multiple Availability Zones (AZs) within an AWS Region improves application availability and fault tolerance?
Options:
Best answer: A
Explanation: The option stating that application resources run in separate data centers so the application can continue operating if one AZ becomes unavailable is correct because it captures the core idea of eliminating a single data center as a failure point. Spreading workloads across multiple AZs allows the application to remain online even during an AZ-level disruption, which is exactly how AZs are designed to improve resilience.
Topic: Domain 2: Security and Compliance
Which of the following statements about compliance in the AWS Cloud are NOT accurate? (Select TWO.)
Options:
Correct answers: A and E
Explanation: The statement that AWS ensures all workloads in every Region automatically comply with all global laws and regulations is incorrect because AWS only manages compliance of the underlying cloud infrastructure, not how each customer uses it. Customers must still assess legal requirements, configure services appropriately, and maintain their own compliance programs.
The statement that one certified service in a Region makes all services in that Region automatically certified is also incorrect. Compliance attestations are typically scoped to specific services and sometimes Regions; customers must confirm that each service they plan to use is covered for the relevant compliance program.
Topic: Domain 3: Cloud Technology and Services
A company is planning where to host its customer database in AWS. The team compared several options and estimated the ongoing operations work and ability to scale.
Use the following table to choose the MOST appropriate option for a company that wants to minimize database administration effort and easily support rapid growth.
| Option | Admin effort per month (hours) | Scaling flexibility |
|---|---|---|
| Keep current on-premises database | 40 | Limited, hardware upgrades required |
| Run database on Amazon EC2 | 20 | Moderate, manual instance changes |
| Use Amazon RDS | 8 | Good, change instance class and storage |
| Use Amazon DynamoDB | 2 | Excellent, automatic capacity adjustment |
Options:
Best answer: D
Explanation: The choice to use Amazon DynamoDB is best because its row in the table lists the lowest admin effort (2 hours per month) and “Excellent, automatic capacity adjustment” for scaling. This directly satisfies the need to reduce operational work while handling rapid growth without manual capacity changes.
Topic: Domain 2: Security and Compliance
A security engineer is planning basic security controls for a new AWS account. The exhibit shows three planned controls.
Based on the exhibit, which AWS service should the engineer enable to satisfy Control 1?
Exhibit:
| Control | Description | Example question it answers |
|---|---|---|
| 1 | Record all console sign-ins and API calls for auditing | “Who changed this security group yesterday?” |
| 2 | Identify S3 buckets with public access | “Which buckets are publicly readable?” |
| 3 | Detect unusual API activity that may indicate compromised credentials | “Why are there many failed ConsoleLogins?” |
Options:
Best answer: D
Explanation: AWS CloudTrail is correct because it is the AWS service designed to log console sign-ins and API calls. In the exhibit, Control 1 specifically needs an audit trail to answer questions like “Who changed this security group yesterday?” CloudTrail records those management events with timestamps, identity information, and details of the action, enabling exactly that type of audit and compliance review.
Topic: Domain 3: Cloud Technology and Services
Which statement correctly describes the relationship among AWS Regions, Availability Zones, and edge locations?
Options:
Best answer: C
Explanation: The correct choice states that an AWS Region is a geographic area composed of multiple isolated Availability Zones and that edge locations are separate sites used to deliver content closer to users. This matches AWS’s published definition of Regions, Availability Zones, and edge locations and captures both the high-availability design (multiple AZs per Region) and the content delivery role of edge locations.
Topic: Domain 3: Cloud Technology and Services
A startup is choosing how to run a new backend service on AWS. The following table summarizes their requirements.
| Characteristic | Value |
|---|---|
| Workload type | HTTP-based API requests, each under 2 seconds |
| Traffic pattern | Highly variable, long idle periods, sudden spikes |
| State | Stateless, no session persistence required |
| Management preference | No server or container management; pay only when code is running |
Based only on this information, which AWS compute option is the most appropriate?
Options:
Best answer: D
Explanation: Implementing the API as functions on AWS Lambda invoked through Amazon API Gateway aligns with every row in the exhibit. Lambda is ideal for short-lived, stateless requests, scales automatically for sudden spikes, and has billing based on actual code execution time and number of requests, which matches the “pay only when code is running” requirement. It is also fully managed from a server perspective, so the team does not need to manage servers or containers, satisfying the management preference in the table.
Topic: Domain 3: Cloud Technology and Services
A company must store financial records for 10 years to meet regulatory requirements. The records are rarely accessed, and when they are needed, the company can wait several days for retrieval. The main goal is to minimize ongoing storage cost.
Based on the following information, which storage class is the most appropriate choice?
| Storage class | Retrieval speed (relative) | Storage cost (relative) | Intended use |
|---|---|---|---|
| S3 Standard | Fast | Highest | Frequently accessed application data |
| S3 Glacier Instant Retrieval | Fast | Low | Long-lived data needing immediate access |
| S3 Glacier Flexible Retrieval | Slower | Very low | Archives accessed occasionally |
| S3 Glacier Deep Archive | Slowest | Lowest | Long-term archives rarely accessed |
Options:
Best answer: B
Explanation: S3 Glacier Deep Archive is described in the exhibit as having the slowest retrieval, the lowest storage cost, and an intended use of “long-term archives rarely accessed.” This aligns perfectly with the company’s situation: 10-year retention, very rare access, and willingness to wait several days, all while prioritizing minimum storage cost.
Use this map after the sample questions to connect individual items to the AWS Cloud Practitioner service, billing, security, and architecture decisions these practice samples test.
flowchart LR
S1["Business cloud need"] --> S2
S2["Identify AWS service category"] --> S3
S3["Apply shared responsibility and security basics"] --> S4
S4["Choose pricing and support concept"] --> S5
S5["Review reliability and operations"] --> S6
S6["Pick next AWS role route"]
| Cue | What to remember |
|---|---|
| Service categories | Know compute, storage, database, networking, security, analytics, integration, and management families. |
| Shared responsibility | Separate what AWS secures from what the customer configures, patches, governs, or protects. |
| Pricing | Understand pay-as-you-go, reservations, savings plans, free tier, budgets, and cost allocation. |
| Reliability | Use regions, Availability Zones, backup, scaling, and managed services appropriately. |
| Support | Know account, billing, documentation, Trusted Advisor, and support-plan cues. |