AWS Certified Cloud Practitioner — Practice Set 1

Question 1

A company is evaluating whether to move its on-premises data center workloads to AWS. A manager asks a solutions architect to explain the primary benefit of the AWS Cloud compared to running servers on-premises. Which answer BEST describes this benefit?

Accepted Answer

A core AWS Cloud advantage is the ability to trade upfront capital expenditure (CapEx) for variable operating expenditure (OpEx), paying only for the resources consumed. AWS does not rack physical servers for customers in their own facilities. Zero downtime is not guaranteed. Security remains a shared responsibility — AWS secures the infrastructure, while customers secure their workloads.

Question 2

An organization wants to deploy its application to multiple AWS Regions to reduce latency for global customers. Which AWS Cloud concept does this architecture BEST demonstrate?

Accepted Answer

Deploying to multiple AWS Regions to serve a global user base in minutes illustrates the 'Go global in minutes' benefit of the AWS Cloud — something that would take months and significant capital with on-premises infrastructure. Economies of scale refers to lower costs due to AWS's purchasing power. Stop guessing capacity relates to auto-scaling. Speed and agility refers to rapid provisioning of development environments.

Question 3

A company is reviewing the AWS Well-Architected Framework before migrating to AWS. The team wants to ensure their workloads recover automatically from infrastructure failures. Which Well-Architected Framework pillar MOST directly addresses this requirement?

Accepted Answer

The Reliability pillar of the AWS Well-Architected Framework focuses on the ability of a workload to recover from infrastructure or service disruptions and to dynamically acquire resources to meet demand. Security covers identity and data protection. Performance Efficiency addresses using computing resources efficiently. Cost Optimization focuses on running systems at the lowest price point.

Question 4

A solutions architect is explaining cloud deployment models to a leadership team. The company must keep sensitive financial data on-premises due to regulatory requirements but wants to leverage cloud computing for non-sensitive workloads. Which deployment model BEST meets these requirements?

Accepted Answer

A hybrid cloud deployment connects on-premises infrastructure with cloud resources, allowing sensitive data to remain on-premises while non-sensitive workloads run in the public cloud. A public cloud deployment moves everything to the cloud provider. A private cloud keeps all resources on-premises or in a dedicated environment. Community cloud is not a standard AWS deployment model.

Question 5

A company is planning to migrate from an on-premises data center to AWS. The infrastructure team is concerned about needing to predict compute capacity 3 years in advance to avoid both over-provisioning and under-provisioning. Which AWS Cloud benefit MOST directly eliminates this concern?

Accepted Answer

The AWS Cloud eliminates the need to guess infrastructure capacity because resources can be scaled up or down on demand. This means a company never pays for idle over-provisioned resources or suffers from under-provisioned infrastructure. Economies of scale refers to lower per-unit costs. Speed and agility relates to faster deployment cycles, not capacity planning.

Question 6

A company operates in a heavily regulated industry and is evaluating AWS for a new application. The compliance team asks which AWS program provides the ability to review detailed information about the security controls AWS implements for its infrastructure. Which resource MOST directly addresses this need?

Accepted Answer

AWS Artifact is a self-service portal for on-demand access to AWS compliance reports and agreements, such as SOC reports and ISO certifications, which document the security controls AWS has in place. AWS Trusted Advisor provides real-time best practice recommendations for cost, security, and performance in a customer's account. Amazon Inspector is an automated vulnerability assessment service for EC2 and container workloads. AWS Config tracks resource configuration changes but does not provide AWS's own compliance documentation.

Question 7

A company is deploying its first workload on AWS. The security team wants to understand which security tasks are the company's responsibility versus AWS's responsibility. According to the AWS shared responsibility model, which task is the customer's responsibility?

Accepted Answer

Under the AWS shared responsibility model, customers are responsible for security 'in' the cloud, which includes managing encryption of their own data. AWS is responsible for security 'of' the cloud, which includes patching the hypervisor, securing physical facilities, and replacing failed hardware components.

Question 8

An organization has just created a new AWS account. The root user is currently used to perform all daily administrative tasks. A security consultant recommends following AWS best practices. Which action should the organization take FIRST?

Accepted Answer

AWS best practices require enabling MFA on the root user account to protect it from unauthorized access and creating individual IAM users with least-privilege permissions for daily tasks. The root account cannot be deleted. Sharing root credentials violates security best practices. A single shared IAM user does not allow for individual accountability or fine-grained permissions.

Question 9

A company wants to ensure that all API calls made to its AWS resources are logged for audit purposes. Which AWS service should the company use to meet this requirement?

Accepted Answer

AWS CloudTrail records all API calls made to AWS services, capturing who made the call, when, from where, and on which resource. This provides an audit trail for compliance and security investigations. Amazon CloudWatch monitors performance metrics and logs. AWS Config tracks resource configuration states and changes. Amazon GuardDuty is a threat detection service that analyzes logs but does not itself record API calls.

Question 10

A company stores sensitive customer data in Amazon S3 and must comply with data privacy regulations. The security team wants to automatically discover and protect personally identifiable information (PII) stored in S3. Which AWS service provides this capability?

Accepted Answer

Amazon Macie uses machine learning to automatically discover, classify, and protect sensitive data such as PII stored in Amazon S3. AWS Shield provides DDoS protection. AWS WAF protects web applications against common exploits. Amazon Inspector assesses EC2 instances and container images for vulnerabilities — it does not analyze S3 data content.

Question 11

A company's application is experiencing distributed denial-of-service (DDoS) attacks against its website hosted on AWS. The company needs protection at the network and transport layers without additional cost. Which AWS service provides this protection at no extra charge?

Accepted Answer

AWS Shield Standard is automatically included at no additional cost for all AWS customers and provides protection against common network and transport layer DDoS attacks. AWS Shield Advanced offers enhanced protections and DDoS cost protection but requires an additional subscription fee. AWS WAF protects against application-layer attacks and has associated costs. Amazon GuardDuty detects threats but does not block DDoS attacks.

Question 12

A company needs to store and manage application secrets such as database passwords, API keys, and OAuth tokens. The security team requires automatic rotation of these credentials. Which AWS service BEST meets this requirement?

Accepted Answer

AWS Secrets Manager is specifically designed to store, retrieve, and automatically rotate secrets like database credentials and API keys. AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation. AWS KMS manages encryption keys, not application-level secrets. Amazon Cognito manages user authentication and authorization, not application secrets.

Question 13

A company is deploying a multi-account AWS environment and needs to ensure consistent security policies are applied across all accounts. The security team wants centralized governance with the ability to restrict what services can be used in each account. Which AWS service MOST directly provides this capability?

Accepted Answer

AWS Organizations with Service Control Policies (SCPs) allows centralized governance across multiple AWS accounts by defining maximum available permissions for accounts or organizational units, preventing usage of services not permitted by the SCP. AWS Config assesses and records resource configurations but cannot prevent API calls. IAM permission boundaries limit a single principal's permissions within one account but cannot span accounts centrally. AWS Security Hub aggregates security findings but does not enforce service restrictions.

Question 14

A company's security team wants to continuously monitor AWS accounts for unusual activity such as unauthorized API calls, compromised EC2 instances, and reconnaissance by malicious actors. The solution must require minimal setup and no agents to install. Which AWS service BEST meets these requirements?

Accepted Answer

Amazon GuardDuty is an intelligent threat detection service that continuously monitors AWS CloudTrail logs, Amazon VPC Flow Logs, and DNS logs for malicious activity and unauthorized behavior without requiring agents or additional software. AWS CloudTrail records API activity but does not analyze it for threats. Amazon Inspector requires agents and assesses vulnerability in EC2 and container workloads rather than detecting active threats. AWS Security Hub aggregates findings from multiple services but requires those services to be enabled first.

Question 15

A company wants to run a web application on AWS without managing the underlying servers or operating systems. The application code is written in Python and the team expects traffic spikes. Which AWS service is MOST appropriate for this requirement?

Accepted Answer

AWS Lambda is a serverless compute service that runs code in response to events without requiring the customer to provision or manage servers. It scales automatically with traffic spikes and supports Python. Amazon EC2 requires managing OS and server configuration. Amazon Lightsail simplifies server management but still involves virtual machine instances. Amazon ECS on Amazon EC2 requires managing the underlying EC2 instances.

Question 16

A company needs a managed relational database on AWS that automatically handles failover, backups, and patching to reduce operational overhead. The application uses MySQL. Which AWS service BEST meets this requirement?

Accepted Answer

Amazon RDS for MySQL is a managed relational database service that automates time-consuming administration tasks such as hardware provisioning, database setup, patching, and backups, while supporting MySQL. Amazon DynamoDB is a NoSQL key-value and document database, not a relational MySQL-compatible service. Amazon Redshift is a data warehousing service optimized for analytics queries. Amazon ElastiCache for Redis is an in-memory caching service, not a relational database.

Question 17

A company hosts a static website with images and video files on AWS. As global user traffic increases, users in Europe and Asia are experiencing slow load times. Which AWS service would MOST effectively reduce latency for these global users?

Accepted Answer

Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations globally, reducing latency by serving static assets from a location geographically close to the end user. AWS Global Accelerator improves availability and performance for dynamic applications using the AWS network, but CloudFront is the standard solution for static content delivery. Amazon Route 53 is a DNS service that routes traffic but does not cache content at the edge. Elastic Load Balancing distributes traffic across servers within a Region.

Question 18

A company wants to decouple its order-processing microservices so that a spike in order submissions does not overwhelm the downstream fulfillment service. The company needs a managed service to buffer messages between the producer and consumer. Which AWS service BEST provides this capability?

Accepted Answer

Amazon SQS (Simple Queue Service) is a fully managed message queuing service that decouples producers and consumers by buffering messages, allowing the fulfillment service to process at its own pace even during traffic spikes. Amazon SNS is a pub/sub notification service for fan-out messaging, not for point-to-point buffering. AWS Step Functions orchestrates workflows, not message buffering. Amazon EventBridge routes events based on rules but is not a buffering queue.

Question 19

A company is migrating its on-premises VMware virtual machines to AWS. The migration team wants to minimize disruption to running applications by replicating live servers continuously. Which AWS service is MOST appropriate for this migration approach?

Accepted Answer

AWS Application Migration Service (AWS MGN) is the primary AWS service for lift-and-shift migrations of physical, virtual, and cloud servers. It continuously replicates source servers to AWS, allowing cutover with minimal downtime. AWS Database Migration Service migrates databases specifically, not full virtual machines. AWS DataSync transfers file and object data, not servers. AWS Snowball is a physical data transfer appliance for very large datasets, not for live VM replication.

Question 20

A company has an application running on Amazon EC2 instances in a single Availability Zone. The operations team wants to improve the application's availability and ensure it continues to run if one Availability Zone experiences an outage. Which combination of actions BEST meets this requirement? (Choose TWO.)

Accepted Answer

Deploying EC2 instances across multiple Availability Zones ensures that if one AZ fails, the other continues serving traffic. An Elastic Load Balancer distributes incoming requests across healthy instances in multiple AZs, completing the high-availability architecture. AWS CloudTrail is an audit logging service and does not improve availability. Adding EBS volumes increases storage but does not provide multi-AZ redundancy. Moving to a larger single instance (vertical scaling) does not address the single point of failure in a single AZ.

Question 21

A company wants to run containerized microservices on AWS without having to provision or manage the underlying EC2 instances. The team prefers a serverless container experience. Which AWS service MOST directly meets this requirement?

Accepted Answer

AWS Fargate is a serverless compute engine for containers that works with both Amazon ECS and Amazon EKS. With Fargate, the customer does not provision, configure, or scale groups of virtual machines to run containers. Amazon ECS on Amazon EC2 and Amazon EKS on Amazon EC2 both require managing the underlying EC2 instances. Amazon Lightsail Containers is a simplified container hosting service but is not the AWS serverless container standard for microservices at scale.

Question 22

A company needs to analyze petabytes of structured data from its data lake to generate business intelligence reports. The queries are complex and run infrequently. The team wants a fully managed solution that does not require maintaining a persistent cluster. Which AWS service is MOST cost-effective for this use case?

Accepted Answer

Amazon Athena is a serverless interactive query service that analyzes data directly in Amazon S3 using standard SQL. There is no infrastructure to manage and you pay only per query, making it cost-effective for infrequent complex queries on a data lake. Amazon RDS for PostgreSQL is an OLTP relational database not designed for petabyte-scale analytics. Amazon DynamoDB is a NoSQL database unsuitable for complex SQL analytics. Amazon Redshift is a managed data warehouse that requires maintaining a persistent cluster, which incurs ongoing cost even when idle.

Question 23

A company wants to receive alerts when its AWS monthly spending exceeds a defined threshold. Which AWS tool should the company use to set up these alerts?

Accepted Answer

AWS Budgets allows customers to set custom cost and usage thresholds and receive alerts via email or Amazon SNS when those thresholds are breached or forecasted to be exceeded. AWS Cost Explorer is a visualization and reporting tool for past spending — it does not send proactive alerts. AWS Pricing Calculator estimates future costs before deployment. AWS Trusted Advisor provides best practice recommendations but does not send budget alerts.

Question 24

A startup company plans to run development workloads on Amazon EC2. The instances can be interrupted at any time if AWS needs the capacity back. The company wants to minimize compute costs. Which Amazon EC2 pricing model is MOST cost-effective for this use case?

Accepted Answer

Amazon EC2 Spot Instances let customers use spare AWS compute capacity at up to 90% discount compared to On-Demand prices, making them the MOST cost-effective option. The trade-off is that Spot Instances can be interrupted with a 2-minute warning when AWS reclaims capacity, making them suitable for fault-tolerant development workloads. On-Demand Instances offer pay-as-you-go pricing with no interruption risk but at full price. Reserved Instances require a 1- or 3-year commitment and are best for steady-state production workloads. Dedicated Hosts are the most expensive option, providing physical server isolation for compliance requirements.

Question 25

A company requires a 24/7 phone and chat support channel with a response time of less than 1 hour for business-critical system outages. The company also wants access to a Technical Account Manager (TAM). Which AWS Support plan MOST directly meets these requirements?

Accepted Answer

AWS Enterprise Support is the only plan that includes a dedicated Technical Account Manager (TAM) and provides a less-than-15-minute response time for business-critical system-down cases. AWS Basic Support does not include phone or chat and has no TAM. AWS Developer Support offers email access during business hours only with no TAM. AWS Business Support provides 24/7 phone and chat and a 1-hour response for production system-down cases but does not include a dedicated TAM.

CLF-C02 — AWS Certified Cloud Practitioner