12 real CLF-C02 sample questions, each with a worked explanation and a rationale for every option, right and wrong. No account, no card. This is the reasoning the CLF-C02 tests: knowing why the tempting answer is wrong, not just spotting the right one.
The real CLF-C02 is 65 questions in 90 minutes, pass mark 700 / 1000. For a domain-by-domain breakdown and a study plan, read the CLF-C02 study guide. The full bank has 299 questions.
lock_openFree sampleCloud Technology and Servicesmedium
An operations engineer wants to script the launch of dozens of identical Amazon EC2 instances from a terminal and re-run that script as part of a nightly job. Which way of interacting with AWS best supports this automated, repeatable approach?
- AThe AWS Command Line Interface, a tool that issues AWS service commands from a terminal and can be placed inside scriptscheck_circle Correct
- BThe AWS Management Console, a web interface where each instance is launched by pointing and clicking through the browser pages
- CAWS Trusted Advisor, a tool that inspects an account and recommends improvements for cost, security and fault tolerance
- DAmazon CloudWatch, a monitoring service that gathers metrics and alarms from resources once those resources are already running
The AWS CLI lets users run AWS service commands from a terminal so provisioning can be scripted and repeated automatically. The AWS CLI exposes AWS service operations as terminal commands, so they can be embedded in shell scripts and scheduled jobs, giving the repeatable, automated provisioning a graphical console cannot provide.
Why A is correct: The AWS CLI sends commands from a terminal, so the launch can be written into a script and re-run automatically on a schedule as the engineer wants.
Why B is wrong: The console is a manual web interface, so it cannot be scripted into a nightly job and would force the engineer to click through every launch by hand.
Why C is wrong: Trusted Advisor only reviews an account and suggests improvements, so it does not launch instances or run scripted provisioning at all.
Why D is wrong: CloudWatch watches resources after they exist, so it reports on instances but cannot launch them from a scriptable terminal command.
lock_openFree sampleCloud Technology and Servicesmedium
A new staff member with no scripting experience needs to explore AWS services, view dashboards and adjust a few settings using a guided graphical interface in a web browser. Which method of accessing AWS suits this person best?
- AThe AWS Command Line Interface, which runs typed service commands from a terminal session rather than from a browser window
- BThe AWS Management Console, a web based graphical interface for browsing services and changing settings by pointing and clickingcheck_circle Correct
- CAn AWS software development kit, which lets a programmer call AWS services directly from application code written in a language
- DAWS CloudFormation, which provisions resources from declarative template files that the user authors and submits to the service
The AWS Management Console is the browser based graphical interface for exploring services and changing settings without code. The AWS Management Console presents AWS services as web pages with menus and dashboards, so users navigate and configure resources by pointing and clicking, which suits people who do not write scripts or code.
Why A is wrong: The CLI is text driven and assumes terminal familiarity, so it does not match a new user who wants a guided graphical experience.
Why B is correct: The console is the browser based graphical interface for AWS, so it lets a non technical user explore services and adjust settings without writing any code.
Why C is wrong: An SDK is meant for developers writing code, so it is not the point and click browser experience a non technical staff member needs.
Why D is wrong: CloudFormation expects the user to write template files, so it is an infrastructure as code tool rather than a guided graphical interface.
lock_openFree sampleCloud Technology and Servicesmedium
A company keeps sensitive workloads in its own on-premises data centre but wants to extend into AWS so the two environments connect and operate together as one. Which deployment model does this arrangement describe?
- AA cloud deployment model, where every part of the application is built and run entirely on AWS with no on-premises infrastructure
- BAn on-premises deployment model, where all infrastructure stays inside the company data centre and nothing is extended into AWS
- CA hybrid deployment model, where on-premises infrastructure is connected to and works together with resources running in the AWS Cloudcheck_circle Correct
- DA multi-account model, where one organisation separates its workloads across several distinct AWS accounts for isolation and billing
A hybrid deployment model connects on-premises infrastructure with AWS Cloud resources so they operate together. A hybrid model links a company data centre to the AWS Cloud so workloads and data can span both, letting sensitive systems stay on-premises while other components run in AWS as one connected environment.
Why A is wrong: An all cloud model runs nothing on-premises, so it contradicts the requirement to keep sensitive workloads in the company data centre.
Why B is wrong: A purely on-premises model never reaches the cloud, so it ignores the stated goal of extending the environment into AWS.
Why C is correct: A hybrid model joins on-premises infrastructure with AWS so the two run together, which is exactly what keeping local data centre workloads while extending into AWS describes.
Why D is wrong: Using several AWS accounts is an organisation structure within AWS, not a link between a data centre and the cloud, so it does not fit the scenario.
lock_openFree sampleSecurity and Compliancemedium
A company runs its application on Amazon EC2 instances. Under the AWS shared responsibility model, which task is the responsibility of the customer rather than AWS?
- AMaintaining the physical security of the data centres that host the instances
- BInstalling operating system patches on the guest operating system of the instancescheck_circle Correct
- CPatching the firmware of the underlying host servers that run the hypervisor
- DReplacing failed physical disks in the storage racks that back the volumes
On Amazon EC2 the customer is responsible for patching and maintaining the guest operating system they run. Amazon EC2 is an infrastructure service where the responsibility boundary sits at the guest OS, so the customer patches and hardens the OS while AWS secures the hardware, hypervisor and facilities below it.
Why A is wrong: Physical security of the facilities is security OF the cloud, which AWS owns; the customer never sees the hardware, so this cannot be a customer task.
Why B is correct: On Amazon EC2 the customer controls the guest operating system, so patching, updating and hardening that OS is squarely a customer responsibility.
Why C is wrong: Host firmware and the hypervisor sit below the guest OS boundary, so AWS maintains them; a candidate may confuse host patching with guest patching.
Why D is wrong: Hardware replacement is part of the global infrastructure AWS operates; customers have no physical access, so this is never their duty.
lock_openFree sampleSecurity and Compliancemedium
A team migrates a database from a self-managed engine on Amazon EC2 to Amazon RDS. After the move, which security task becomes the responsibility of AWS rather than the customer?
- ACreating database user accounts and granting the correct in-database privileges
- BConfiguring which IAM principals may call the Amazon RDS management actions
- CPatching the underlying operating system that the database engine runs oncheck_circle Correct
- DDeciding whether to encrypt the data stored in the database instance
Moving to a managed service like Amazon RDS shifts operating system and engine patching to AWS. With a managed service the responsibility boundary moves up the stack, so AWS takes over patching the OS and database engine while the customer keeps control of data, access and configuration.
Why A is wrong: Managing database accounts and privileges stays with the customer on Amazon RDS, because access to the data itself is always a customer responsibility.
Why B is wrong: Controlling IAM permissions is security IN the cloud and remains a customer task regardless of how managed the service is.
Why C is correct: Amazon RDS is a managed service, so AWS patches the host operating system and database engine software that the customer previously maintained on EC2.
Why D is wrong: Enabling encryption and choosing the keys is a customer configuration choice, so this duty does not transfer to AWS when moving to RDS.
lock_openFree sampleSecurity and Compliancemedium
An auditor asks which part of the AWS environment is described as security OF the cloud and is therefore handled entirely by AWS. Which item fits that description?
- AThe IAM users, roles and policies that grant access to company resources
- BThe customer data placed into Amazon S3 buckets and its access settings
- CThe security group rules applied to the company Amazon EC2 instances
- DThe physical hardware and global infrastructure that runs every AWS servicecheck_circle Correct
Security OF the cloud is the hardware and global infrastructure that AWS operates and protects. AWS describes its own duty as security OF the cloud, meaning the compute, storage, networking hardware and facilities, while customers handle security IN the cloud such as data and access.
Why A is wrong: Identity and access management is security IN the cloud and stays with the customer, so a learner may wrongly place it on the AWS side.
Why B is wrong: Customer data and its access settings are always a customer responsibility, so this never falls under security OF the cloud.
Why C is wrong: Security group configuration is a customer task because it controls traffic to their own resources, so it is security IN the cloud.
Why D is correct: Security OF the cloud covers the hardware, facilities and global infrastructure, which AWS operates and protects on behalf of all customers.
lock_openFree sampleCloud Conceptseasy
A startup is unsure how many customers it will attract and does not want to buy a large fleet of servers before launch. Which benefit of the AWS Cloud most directly addresses this concern?
- AIt lets the firm trade a large upfront capital expense for a variable expense tied to usagecheck_circle Correct
- BIt guarantees that every workload will run faster than on the firm's own hardware
- CIt removes the need to apply any security controls because AWS handles all of them
- DIt provides a single fixed monthly price that never changes regardless of how much is used
Trading capital expense for variable expense lets a business pay for capacity as it is used instead of buying it upfront. The AWS Cloud lets a customer consume resources on demand and pay only for what they use, so an uncertain startup avoids a large upfront purchase and matches spend to actual demand.
Why A is correct: Paying only for the capacity actually used removes the need to buy servers in advance, which is exactly what a startup with uncertain demand wants.
Why B is wrong: AWS does not promise universally faster performance, and raw speed is not the concern here; the startup is worried about committing to hardware it may not need.
Why C is wrong: AWS uses a shared responsibility model and does not handle all security, so this misstates how the cloud works and does not address the hardware concern.
Why D is wrong: Cloud pricing usually scales with consumption rather than a flat fee, so the idea of an unchanging fixed bill is the opposite of the variable expense benefit.
lock_openFree sampleCloud Conceptseasy
An AWS instructor explains that because AWS aggregates the usage of hundreds of thousands of customers, it can buy infrastructure at lower cost and pass the savings on through lower prices. Which cloud benefit is being described?
- AGaining agility by provisioning new resources within minutes when they are needed
- BBenefiting from economies of scale that lower prices as aggregated usage growscheck_circle Correct
- CTrading a variable expense for a fixed capital expense paid once at the start
- DImproving resilience by spreading each workload across many separate data centres
Economies of scale mean AWS aggregates many customers' usage to buy cheaply and pass lower prices on. When many customers share the same platform, AWS achieves a higher purchasing volume than any single firm could, lowering its unit costs and allowing it to charge lower pay-as-you-go prices.
Why A is wrong: Agility describes fast provisioning rather than purchasing power, so it does not explain why aggregated demand lowers the price.
Why B is correct: Massive aggregated demand lets AWS purchase at lower unit cost and reduce prices, which is the textbook definition of economies of scale.
Why C is wrong: This reverses the actual benefit, since the cloud moves spend toward variable expense, and it is unrelated to bulk purchasing power.
Why D is wrong: Spreading workloads concerns availability rather than cost, so it does not describe the pricing effect of aggregated customer demand.
lock_openFree sampleCloud Conceptseasy
A development team wants to spin up a test environment of several servers in minutes, run experiments, and then shut it all down the same afternoon. Which benefit of the AWS Cloud best supports this way of working?
- AEconomies of scale, because aggregated demand reduces the unit price of the servers
- BCapital expense, because the team can purchase the servers it needs in advance
- CAgility, because resources can be provisioned on demand and released within minutescheck_circle Correct
- DShared responsibility, because AWS secures the hardware that the servers run on
Agility is the benefit of provisioning resources on demand in minutes and releasing them just as quickly. The AWS Cloud lets a team request compute capacity through self-service and have it ready in minutes, then release it when finished, so experimentation no longer waits on hardware procurement.
Why A is wrong: Lower unit pricing is a real benefit, but it speaks to cost rather than how quickly the team can stand up and tear down an environment.
Why B is wrong: Buying servers in advance is the on-premises model the cloud avoids, so it works against the team's wish to provision and release quickly.
Why C is correct: Agility is the ability to provision and dispose of resources quickly, which is exactly what a same-day experiment needs.
Why D is wrong: The shared responsibility model describes who secures what, not the speed of provisioning, so it does not address the team's goal.
lock_openFree sampleBilling, Pricing, and Supportmedium
A company runs a production web application on Amazon EC2 that must stay on around the clock and has a stable, predictable load expected to continue for the next three years. The team wants the lowest hourly rate for this steady usage. Which pricing model best fits this need?
- AOn-Demand Instances, paying the standard per-second rate with no commitment for the running servers
- BSpot Instances, bidding on spare capacity to run the steady production workload at a deep discount
- CDedicated Hosts billed On-Demand, reserving a whole physical server for the steady production workload
- DReserved Instances, committing to a one-year or three-year term in exchange for a much lower hourly ratecheck_circle Correct
Reserved Instances give the lowest rate for steady, predictable workloads through a one-year or three-year commitment. A commitment to a one-year or three-year term lets AWS offer Reserved Instances at a much lower hourly rate than On-Demand, so a stable workload that runs continuously for years pays far less than paying the standard rate.
Why A is wrong: On-Demand suits short or unpredictable workloads, but for steady multi-year usage it costs more than a committed model, so it is the tempting default rather than the cheapest choice.
Why B is wrong: Spot offers large discounts but AWS can reclaim the capacity at short notice, which is unsuitable for an always-on production site that must not be interrupted.
Why C is wrong: Dedicated Hosts address licensing and isolation needs on physical servers, not cost savings, so paying that premium does not give the lowest rate for steady use.
Why D is correct: Reserved Instances reward a one-year or three-year commitment with a large discount over On-Demand, which matches a stable workload running continuously for years.
lock_openFree sampleBilling, Pricing, and Supportmedium
A data team runs a nightly batch analysis job that can stop and restart safely, and they want the largest possible discount on the Amazon EC2 compute it uses. Brief interruptions to the job are acceptable. Which pricing model best matches this fault-tolerant, interruptible work?
- ASpot Instances, using spare Amazon EC2 capacity at a steep discount that AWS can reclaim with short noticecheck_circle Correct
- BOn-Demand Instances, paying the standard per-second rate so the batch job is guaranteed to run uninterrupted
- CReserved Instances, committing to a three-year term so the nightly batch job earns the largest discount
- DDedicated Hosts, reserving a whole physical server so the nightly batch job runs in isolation each night
Spot Instances offer the deepest discount for fault-tolerant, interruptible workloads that can stop and resume safely. Spot Instances sell spare AWS capacity at a steep discount on the condition that AWS may reclaim it with little warning, which is acceptable for batch jobs designed to pause and restart without losing work.
Why A is correct: Spot taps unused capacity at the deepest discount, and because AWS may reclaim it on short notice it fits fault-tolerant batch jobs that can stop and resume safely.
Why B is wrong: On-Demand guarantees the capacity but at full price, so it is the safe default and does not deliver the deep discount the team is seeking.
Why C is wrong: Reserved Instances need a long commitment for steady usage and give a smaller discount than Spot, so they do not suit an occasional interruptible job.
Why D is wrong: Dedicated Hosts carry a premium for hardware isolation and licensing, the opposite of the cheap, interruptible capacity this batch job actually wants.
lock_openFree sampleBilling, Pricing, and Supportmedium
A startup is testing a brand new feature on Amazon EC2 for a few weeks. The traffic is hard to predict and the team is not ready to commit to any long-term term or upfront payment. Which pricing model best suits this short, uncertain trial?
- AReserved Instances with a three-year commitment, locking in a low rate before the feature trial begins
- BOn-Demand Instances, paying the standard per-second rate with no commitment for the short trial periodcheck_circle Correct
- CSpot Instances, accepting that AWS may reclaim the capacity while the feature trial is still running
- DA Compute Savings Plan with a one-year commitment to a fixed hourly spend during the feature trial
On-Demand Instances suit short, unpredictable workloads because they need no upfront payment or long-term commitment. On-Demand pricing bills per second at the standard rate with no commitment, so a team running a brief trial with uncertain traffic can start and stop freely without paying for capacity in advance.
Why A is wrong: A three-year commitment is wrong for a few weeks of uncertain testing, since the startup would pay for years of capacity it may not keep using.
Why B is correct: On-Demand charges the standard rate with no upfront payment or term, so it suits short, unpredictable trials where flexibility matters more than a discount.
Why C is wrong: Spot is cheap but can be reclaimed at short notice, which adds avoidable risk to an interactive trial that the small team needs to watch closely.
Why D is wrong: A Savings Plan still requires committing to a fixed hourly spend for a year, so it does not fit a team that wants no long-term commitment for a brief test.
Examworthy is not affiliated with or endorsed by Amazon Web Services. All questions are original, blueprint-aligned practice material. We never reproduce live exam items. CLF-C02 and related marks belong to their respective owners.
