10 free AWS CLF-C02 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 719 questions. Work through them, then open each answer to check your reasoning.
Get all 719 questions (US$39) · Download these 10 as a PDF
Question 1
A company plans to use an Amazon Snowball Edge device to transfer files to the AWS Cloud.
Which activities related to a Snowball Edge device are available to the company at no cost?
Show answer and explanation
Correct answer: C. The transfer of data from the Snowball Edge appliance into Amazon S3
into Amazon S3 Data transfer into AWS is free, so moving data from the Snowball Edge device into Amazon S3 carries no charge. Snowball Edge pricing consists of a per-job service fee plus shipping, with extra daily fees if the device is kept beyond the days included in the job. Data moved out of AWS is billed at standard data transfer rates, so only the inbound transfer is truly a no-cost activity here.
Why the other options are wrong
- A. Appliance use is billed through the job service fee, not free.
- B. Transferring data out of Amazon S3 to the device incurs outbound charges.
- D. Extra daily charges apply for each day the device is kept beyond 10 days.
Question 2
A company has deployed applications on Amazon EC2 instances. The company needs to assess application vulnerabilities and must identify infrastructure deployments that do not meet best practices.
Which AWS service can the company use to meet these requirements?
Show answer and explanation
Correct answer: B. Amazon Inspector
Amazon Inspector is specifically designed to assess EC2 instances for security vulnerabilities and network exposure, identifying deviations from best practices and compliance standards. It performs automated security assessments on EC2 instances and provides detailed findings. AWS Trusted Advisor provides general best practice checks but is not specialized for application vulnerability assessment; AWS Config monitors configuration compliance but not vulnerabilities; Amazon GuardDuty focuses on threat detection rather than vulnerability assessment.
Why the other options are wrong
- A. AWS Trusted Advisor provides general best practice guidance but is not specialized for application vulnerabilities on EC2.
- C. AWS Config tracks configuration changes and compliance but does not perform vulnerability scanning.
- D. Amazon GuardDuty is designed for threat detection and anomalous behavior, not vulnerability assessment.
Question 3
A company has a centralized group of users with large file storage requirements that have exceeded the space available on premises. The company wants to extend its file storage capabilities for this group while retaining the performance benefit of sharing content locally.
What is the MOST operationally efficient AWS solution for this scenario?
Show answer and explanation
Correct answer: B. Configure and deploy an AWS Storage Gateway file gateway. Connect each user’s workstation to the file gateway.
gateway. Connect each user’s workstation to the file gateway. AWS Storage Gateway file gateway is the most operationally efficient solution for this scenario. It provides a local NFS/SMB interface that users can mount like a standard network share, maintaining local performance benefits while seamlessly extending storage to Amazon S3 in the cloud. This approach requires no application changes, provides local caching for performance, and scales storage capacity without on-premises infrastructure expansion. S3 bucket mounting (option A) lacks the seamless local performance; WorkSpaces (option C) requires major infrastructure changes; EC2 with EBS (option D) doesn't extend beyond on-premises capacity effectively.
Why the other options are wrong
- A. Mounting individual S3 buckets via utility does not provide the same seamless local performance and user experience as Storage Gateway.
- C. Migrating to WorkSpaces is operationally complex and represents a major infrastructure change beyond the storage requirements.
- D. An EC2 instance with EBS does not extend on-premises capacity and requires managing another cloud resource rather than transparently extending storage.
Question 4
According to security best practices, how should an Amazon EC2 instance be given access to an Amazon S3 bucket?
Show answer and explanation
Correct answer: C. Have the EC2 instance assume a role to obtain the privileges to upload the file.
privileges to upload the file. According to AWS security best practices, EC2 instances should assume an IAM role to gain temporary, limited-scope credentials for accessing S3. This approach uses temporary security credentials, follows the principle of least privilege, enables audit logging, and avoids storing long-term secrets on the instance. Hard-coding credentials (option A) and storing them in files (option B) both create significant security risks by exposing permanent credentials. Opening the S3 bucket to any service (option D) violates the principle of least privilege and creates uncontrolled access.
Why the other options are wrong
- A. Hard-coding credentials in application code is a critical security vulnerability and makes credential rotation impossible.
- B. Storing credentials in text files on the EC2 instance exposes them to compromise if the instance is breached.
- D. Modifying bucket policy to allow any service at any time violates least privilege principles and creates security risks.
Question 5
Which option is a customer responsibility when using Amazon DynamoDB under the AWS Shared Responsibility Model?
Show answer and explanation
Correct answer: C. Access to DynamoDB tables
Under the AWS Shared Responsibility Model, customers are responsible for controlling access to DynamoDB tables through IAM policies, application-level controls, and access management. AWS is responsible for the physical security of the infrastructure, patching and maintaining the DynamoDB service itself, and managing encryption at rest. While encryption can be customer-managed with KMS, the fundamental responsibility for providing encryption is AWS's as part of the managed service.
Why the other options are wrong
- A. Physical security of the underlying infrastructure is AWS's responsibility in the managed service model.
- B. AWS is responsible for patching and maintaining the DynamoDB service as a fully managed database.
- D. Encryption at rest in DynamoDB is provided and maintained by AWS; customers may manage encryption keys but not the encryption service itself.
Question 6
Which option is a perspective that includes foundational capabilities of the AWS Cloud Adoption Framework (AWS CAF)?
Show answer and explanation
Correct answer: C. Governance
The AWS Cloud Adoption Framework (AWS CAF) consists of six perspectives: Business, People, Governance, Platform, Security, and Operations. Governance is one of the foundational capability perspectives that addresses organizational structures, policies, and controls. Sustainability is not an official CAF perspective; Performance Efficiency and Reliability are AWS Well-Architected Framework pillars, not CAF perspectives.
Why the other options are wrong
- A. Sustainability is not one of the six perspectives in the AWS Cloud Adoption Framework.
- B. Performance Efficiency is a pillar of the Well-Architected Framework, not a CAF perspective.
- D. Reliability is a pillar of the Well-Architected Framework, not a CAF perspective.
Question 7
A company is running and managing its own Docker environment on Amazon EC2 instances. The company wants an alternative to help manage cluster size, scheduling, and environment maintenance.
Which AWS service meets these requirements?
Show answer and explanation
Correct answer: C. AWS Fargate
AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and Amazon EKS. It removes the need to provision, patch, and size EC2 instances, so AWS handles the underlying capacity, scaling, and environment maintenance while the company only defines task or pod resources. That directly replaces the self-managed Docker environment on EC2 described in the scenario.
Why the other options are wrong
- A. AWS Lambda runs event-driven functions, not managed Docker cluster workloads.
- B. Amazon RDS is a managed relational database service, not a container platform.
- D. Amazon Athena queries data in Amazon S3 and does not run containers.
Question 8
A company wants to run a NoSQL database on Amazon EC2 instances.
Which task is the responsibility of AWS in this scenario?
Show answer and explanation
Correct answer: C. Patch the physical infrastructure that hosts the EC2 instances.
instances. When running a NoSQL database on EC2 instances, AWS is responsible for patching and maintaining the physical infrastructure that hosts the instances, including servers, networking hardware, and facilities. The customer is responsible for the guest operating system updates (option A), database high availability (option B), and security group configuration (option D). These customer responsibilities stem from the fact that the customer controls and manages the database software and instance configuration.
Why the other options are wrong
- A. Updating the guest operating system of EC2 instances is the customer's responsibility.
- B. Maintaining high availability at the database layer is the customer's responsibility; AWS provides the infrastructure foundation.
- D. Configuring security group firewall rules is the customer's responsibility for their EC2 instances.
Question 9
Which AWS services or tools can identify rightsizing opportunities for Amazon EC2 instances? (Choose two.)
Show answer and explanation
Correct answer: A, E
A. AWS Cost Explorer E. AWS Compute Optimizer AWS Cost Explorer and AWS Compute Optimizer are the primary AWS services for identifying EC2 rightsizing opportunities. Cost Explorer provides cost analysis and trending data that can reveal underutilized instances, while Compute Optimizer specifically analyzes EC2 instance metrics and provides rightsizing recommendations based on actual usage patterns. Together they enable organizations to optimize instance types and sizes for cost efficiency.
Why the other options are wrong
- B. AWS Billing Conductor is used for setting up billing groups and custom pricing, not for identifying rightsizing opportunities.
- C. Amazon CodeGuru analyzes code quality and application performance, not EC2 instance utilization patterns.
- D. Amazon SageMaker is a machine learning service for building and training models, not for EC2 infrastructure optimization.
Question 10
Which of the following are benefits of using AWS Trusted Advisor? (Choose two.)
Show answer and explanation
Correct answer: C, D
C. Detecting underutilized resources to save costs D. Improving security by proactively monitoring the AWS environment AWS Trusted Advisor provides two key benefits: it detects underutilized resources to help save costs by identifying unused services and oversized instances, and it improves security by proactively monitoring the AWS environment against best practices and compliance checks. These core functions help organizations optimize spending and maintain security posture across their infrastructure.
Why the other options are wrong
- A. High-performance container orchestration is provided by Amazon ECS and EKS, not Trusted Advisor.
- B. Creating and rotating encryption keys is the responsibility of AWS Key Management Service (KMS), not Trusted Advisor.
- E. Implementing enforced tagging across AWS resources is handled by tools like AWS Config and tag policies, not Trusted Advisor.
That was 10 of 719.
The full AWS CLF-C02 pack has all 719 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.