AWS Certified Cloud Practitioner — CLF-C02 fundamentals, not Solutions Architect

Which is NOT one of the six Well-Architected pillars?

1. Reliability pillar of the framework
2. Performance Efficiency framework pillar
3. Scalability pillar of the framework
4. Sustainability pillar of the framework

Answer: C — Scalability pillar of the framework

C, Scalability is a goal, not a named pillar. The six pillars are Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, Sustainability.

Which Well-Architected pillar was added to the framework in December 2021?

1. Operational Excellence pillar
2. Reliability pillar practices
3. Sustainability pillar practices
4. Performance Efficiency pillar

Answer: C — Sustainability pillar practices

C, Sustainability was added in 2021. A, B, D are original pillars from the initial framework.

Which AWS pillar of the Well-Architected Framework focuses on running and monitoring systems to deliver business value?

1. Three pillars limited to security
2. Five pillars limited to cost topics
3. One pillar covering only for AWS workloads
4. Six pillars for building on AWS

Answer: D — Six pillars for building on AWS

Six pillars: Ops, Security, Reliability, Performance, Cost, Sustainability. The other options undercount or misscope.

Under Sustainability shared responsibility, what is the customer responsible for?

1. Hardware decommissioning process work
2. Renewable-energy purchasing programs
3. Workload design and right-sizing choices
4. Datacenter cooling optimization runs

Answer: C — Workload design and right-sizing choices

C, customer owns Sustainability 'in the cloud': workload design, right-sizing, data lifecycle, Region choice. A, B, D are AWS responsibilities.

How do Spot Instances for batch work support Sustainability?

1. Spot instances draw from cleaner power grids
2. Spot uses AWS spare capacity efficiently
3. Spot instances turn off cooling systems
4. Spot instances are physically smaller units

Answer: B — Spot uses AWS spare capacity efficiently

B, Spot consumes spare capacity that would otherwise sit idle, improving fleet utilization and energy efficiency. A, C, D are wrong.

AWS Organizations:

1. Central IAM users across one account
2. Central logging of API calls only for AWS workloads
3. Central management of multiple accounts
4. Central control-plane for containers

Answer: C — Central management of multiple accounts

Organizations manages many accounts with SCPs and consolidated billing. IAM handles users. CloudTrail logs API. ECS/EKS manages containers.

Under Shared Responsibility, who patches the EC2 guest OS versus the hypervisor?

1. AWS patches guest OS and hypervisor
2. Customer patches guest OS and hypervisor
3. AWS patches guest OS; customer hypervisor
4. Customer patches guest OS; AWS hypervisor

Answer: D — Customer patches guest OS; AWS hypervisor

D, customer owns guest OS, apps, data. AWS owns hypervisor, hardware, facility. A, B, C reverse or merge the split.

How should an application on EC2 obtain credentials to call the S3 API?

1. Embed long-lived access keys in code
2. Store the root user keys as env vars
3. Save keys in Parameter Store as plaintext
4. Attach an IAM role to the EC2 instance

Answer: D — Attach an IAM role to the EC2 instance

D, IAM roles for EC2 provide auto-rotated temporary credentials. A, B, C are anti-patterns; embedded or long-lived keys should never be used.

Which is the BEST description of an IAM group?

1. Managed TLS certificate provisioning for AWS workloads
2. Managed application secret rotation for AWS workloads
3. A collection of IAM users that share a set of attached
4. Managed configuration parameters store for AWS workloads

Answer: C — A collection of IAM users that share a set of attached

C) Correct: A collection of IAM users that share a set of attached. Other options describe different AWS services that are common confusions.

Which AWS service provides automatic DDoS protection at no additional cost for all AWS customers?

1. AWS WAF
2. Amazon GuardDuty
3. AWS Shield
4. AWS Inspector

Answer: C — AWS Shield

Shield protects against DDoS attacks. WAF blocks web exploits. GuardDuty detects threats. Inspector scans for vulns.

Which AWS service is a serverless event bus that ingests events from AWS services, custom apps, and many SaaS providers, routing them via rules?

1. Amazon SNS
2. Amazon SQS
3. Amazon EventBridge
4. AWS Step Functions

Answer: C — Amazon EventBridge

A) SNS does pub/sub fan-out, but without EventBridge's native SaaS-partner integrations and rule-based content filtering. B) SQS is a queue for one consumer group, not an event bus routing to multiple rule-matched targets. C) Correct: EventBridge is a serverless event bus that ingests events from AWS services, custom apps, and SaaS providers and routes them via rules. D) Step Functions orchestrates a defined workflow, not a general-purpose event bus.

AWS Auto Scaling:

1. Manual scaling by an administrator
2. Automatic capacity adjustment by demand
3. Vertical scaling to larger instances only
4. One-time provisioning at forecast peak

Answer: B — Automatic capacity adjustment by demand

Auto Scaling Groups adjust capacity automatically. Manual scaling is not elastic. Vertical scaling misses horizontal add. Fixed provisioning contradicts elasticity.

Which service provides NFS-mounted shared file storage across many EC2 instances?

1. Amazon Elastic Block Store volume
2. Amazon Simple Storage Service
3. Amazon Elastic File System share
4. AWS Snowball Edge appliance ship

Answer: C — Amazon Elastic File System share

C, EFS is the NFS-mounted shared filesystem. A is per-instance block. B is object. D is data-transfer hardware.

Which AWS service is used to define infrastructure as code using templates that AWS provisions as stacks?

1. AWS Systems Manager
2. AWS Config
3. AWS OpsWorks
4. AWS CloudFormation

Answer: D — AWS CloudFormation

A) Systems Manager provides operational tooling, not template-based resource provisioning. B) AWS Config tracks configuration state; it doesn't provision resources. C) OpsWorks manages configuration via Chef/Puppet — a different IaC model than declarative stacks. D) Correct: CloudFormation defines infrastructure as code using templates that AWS provisions as stacks.

Which AWS service automatically distributes incoming application traffic across multiple targets?

1. AWS Lambda functions invoked per request
2. Amazon EC2 Dedicated Hosts billed hourly
3. Elastic Load Balancing (ELB)
4. Amazon EKS control plane only

Answer: C — Elastic Load Balancing (ELB)

A) Lambda executes code per event but doesn't itself distribute traffic across targets. B) Dedicated Hosts are billed EC2 capacity, not a traffic-distribution service. C) Correct: Elastic Load Balancing automatically distributes incoming application traffic across multiple targets. D) The EKS control plane manages the Kubernetes API, not application-layer load balancing.

A workload runs 24/7 for 3 years at predictable load. Which model gives the largest discount?

1. On-Demand hourly instance pricing
2. 3-year All-Upfront Reserved Instance
3. Spot Instances for constant workloads
4. Dedicated Hosts at on-demand rates

Answer: B — 3-year All-Upfront Reserved Instance

B, 3-year all-upfront RIs maximize the commitment discount. A is baseline. C can be interrupted. D provides no commitment discount.

A workload needs software licensed per physical socket. Which tenancy model fits?

1. Spot Instances at market pricing
2. Dedicated Hosts with socket visibility
3. Dedicated Instances without socket view
4. On-Demand default shared tenancy

Answer: B — Dedicated Hosts with socket visibility

B, Dedicated Hosts give socket visibility for BYOL licensing. C is dedicated hardware but no socket view. A, D do not fit licensing needs.

Which AWS Support plan includes a dedicated Technical Account Manager?

1. Basic Support included with account
2. Developer Support for individual builders
3. Business Support with 24/7 phone
4. Enterprise Support with dedicated TAM

Answer: D — Enterprise Support with dedicated TAM

D, Enterprise tier includes a dedicated TAM. A is free with limited tooling. B is business-hours. C is 24/7 but no TAM.

The Free Tier 12-month EC2 offer includes approximately what?

1. 750 hours per month of a t2/t3 micro
2. Unlimited EC2 instances for one month
3. Any instance type free for 12 months
4. One hour of free EC2 per calendar day

Answer: A — 750 hours per month of a t2/t3 micro

A, 750 hours = one micro instance running continuously all month. B, C, D misstate the offer.

How much notice does AWS give before reclaiming a Spot Instance?

1. One hour before reclamation notice
2. Two minutes before reclamation notice
3. Thirty seconds before reclamation notice
4. No advance notice is provided ever

Answer: B — Two minutes before reclamation notice

B, the two-minute Spot interruption notice is the canonical figure. A, C, D are wrong.

What is AWS Direct Connect?

Dedicated private network connection from on-premises to AWS. Consistent performance, lower latency vs. internet.

What is the AWS Shared Responsibility Model for S3?

AWS: S3 infrastructure, availability, durability. Customer: data classification, IAM policies, bucket policies, encryption settings, access logging.

What is AWS Amplify?

Set of tools for building full-stack web and mobile apps, including hosting, authentication, APIs, and storage.

What is the AWS Pricing Calculator?

A tool to estimate the cost of AWS services for your specific use case before deploying.

What is Amazon CloudWatch Logs Insights?

Interactively search and analyze log data in CloudWatch Logs using a purpose-built query language.

What is the root user?

The account created when setting up AWS. Full unrestricted access. Best practice: secure with MFA, use minimally, create IAM users for daily tasks.