Entry-level certification covering core AWS cloud concepts, services, and pricing. The ideal starting point for any cloud career.
Benefits of Cloud, Cloud Deployment Models, AWS Value Proposition, Design Principles
Shared Responsibility Model, AWS IAM, AWS Shield, AWS Artifact
EC2, S3, RDS, Lambda, VPC, CloudFront
AWS Pricing Models, Cost Explorer, AWS Support Plans, Trusted Advisor
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
A mid-sized IT company wants to review the overall health of its AWS environment.
The company wants to check cost reduction opportunities, security vulnerabilities, system availability risks, performance issues, and service limit risks all in one place. Which AWS service automatically checks these five categories and provides recommendations?
Which AWS service automatically checks these five categories and provides recommendations?
Answer: C. AWS Trusted Advisor
AWS Trusted Advisor automatically checks your AWS environment across five categories — cost optimization, security, fault tolerance (availability), performance, and service limits — and provides actionable recommendations. The five items listed in this question exactly match Trusted Advisor's five check pillars, making it the BEST fit for reviewing overall AWS environment health from a single dashboard.
AWS Trusted Advisor runs hundreds of best practice checks automatically and visualizes risk levels with color codes: red (critical), yellow (warning), and green (normal). Basic and Developer Support plans provide access to a limited set of checks, while Business or Enterprise Support unlocks the full set of checks.
!image
The most commonly confused wrong answers are AWS Config and AWS Security Hub. AWS Config tracks the history of resource configuration changes and is not a comprehensive health check tool, while AWS Security Hub is a security-only dashboard. When the question mentions "five-category automated checks and recommendations," always select AWS Trusted Advisor.
A company is running its application on Amazon EC2 instances. According to the AWS shared responsibility model, who is responsible for applying operating system patches and managing the security configuration of the EC2 instances?
Which answer BEST describes this responsibility?
Answer: C. The customer
This question tests understanding of the shared responsibility model regarding who is responsible for operating system patching and security configuration management of Amazon EC2 instances. Under the AWS shared responsibility model, EC2 is classified as IaaS (Infrastructure as a Service), and all responsibility at the operating system level and above belongs to the customer. AWS is responsible for the security of the hypervisor, physical servers, and data center infrastructure, but OS patching and application security configuration within EC2 instances must be managed directly by the customer.
The AWS shared responsibility model operates on the principle that 'AWS is responsible for security OF the cloud' and 'the customer is responsible for security IN the cloud.' For EC2, guest OS patching, security group configuration, application management, and user data encryption are all within the customer's responsibility. In contrast, for managed services like RDS and Lambda, AWS handles OS-level patching, so the scope of responsibility differs.
!image
When solving shared responsibility model questions on the exam, the most important judgment criterion is the service type. For IaaS services like EC2 where customers directly control the OS, OS patching and security configuration are the customer's responsibility. For PaaS and managed services like RDS and Lambda where AWS manages the infrastructure and OS, OS patching is AWS's responsibility.
A global media company is providing video streaming services to users worldwide. The company wants to cache and deliver content from edge servers close to users so that geographically distributed users can load content quickly.
Which AWS service BEST meets this requirement?
Answer: B. Amazon CloudFront
A global media company needs to deliver content quickly to users worldwide. The condition 'cache and deliver content from edge servers close to users' matches the definition of a CDN (Content Delivery Network), and the AWS service that serves as a CDN is Amazon CloudFront. CloudFront delivers videos, images, and web pages through a network of 600+ edge locations worldwide, serving content from the location closest to each user.
Amazon CloudFront is a fully managed CDN service that can use not only AWS origin servers such as Amazon S3, Amazon EC2, and Elastic Load Balancing, but also on-premises servers as origins. When a user request arrives, CloudFront immediately serves cached content from the geographically closest edge location, retrieving content from the origin only on a cache miss to store it at the edge. This reduces load on origin servers and delivers content to global users with low latency.
!image
CloudFront and AWS Global Accelerator are frequently confused on the exam. CloudFront is a CDN that caches HTTP/HTTPS content at the edge to reduce latency, while Global Accelerator routes TCP/UDP traffic through the AWS global network and provides static Anycast IP addresses. Amazon Route 53 performs only DNS routing and has no content caching capability. When keywords like edge servers, caching, CDN, or video streaming delivery appear, choose CloudFront.
A news portal service database is being overloaded on the primary database instance due to heavy read traffic. The company wants to distribute read traffic effectively without affecting write operations on the database.
Which Amazon RDS feature BEST meets these requirements?
Answer: B. Read Replica
A news portal's primary database instance is overloaded with heavy read traffic, and the company needs to distribute only read traffic without affecting write operations. Amazon RDS Read Replica satisfies both conditions simultaneously — distributing read traffic and having zero impact on write operations. Read Replica creates a separate read-only endpoint by asynchronously replicating data from the primary instance.
!image
Amazon RDS Read Replica asynchronously replicates data from the primary instance to create a separate read-only endpoint. Applications route read requests to the Read Replica and write requests to the primary instance, significantly reducing the load on the primary. RDS supports up to 5 Read Replicas and Aurora supports up to 15, and they can be placed in the same or a different region.
Be careful not to confuse Multi-AZ with Read Replica on the exam. High availability, failover, and disaster recovery keywords point to Multi-AZ. Read performance improvement, read traffic distribution, and read scale-out keywords point to Read Replica. Remember that the Multi-AZ standby instance does NOT serve read traffic.
A company wants to minimize its AWS costs during normal operations while accepting a longer recovery time in the event of a disaster.
Which disaster recovery strategy BEST meets these requirements?
Answer: D. Backup and restore
This question tests your understanding of the trade-off between cost and Recovery Time Objective (RTO) in disaster recovery (DR) strategies. Backup and restore is the ONLY strategy that satisfies both 'minimize AWS costs during normal operations' and 'accept a longer recovery time.' It involves only backing up data to Amazon S3 or S3 Glacier during normal operations, and re-provisioning infrastructure using AMIs and snapshots when a disaster occurs, resulting in near-zero ongoing AWS costs beyond storage.
AWS DR strategies are classified into four tiers by cost. Backup and restore is the least expensive but takes hours to recover. Pilot light keeps only core infrastructure running at minimum scale, while warm standby runs a scaled-down version of the full environment. Multi-site active-active processes traffic in two Regions simultaneously, resulting in near-zero RTO but the highest cost.
!image
When cost minimization with an acceptable longer RTO is the requirement, backup and restore is the answer. When a short RTO is the priority, warm standby or multi-site active-active is more appropriate. Pilot light does not meet the 'no ongoing costs' condition because core services are always running.
The AWS Certified Cloud Practitioner (CLF-C02) exam consists of 65 questions with a 90-minute time limit.
The passing score for the CLF-C02 exam is 700 out of 1000.
The CLF-C02 sample set (20 questions with full explanations) is free. The full bank of 470+ questions is available with a CloudMasterIT subscription.
The CLF-C02 certification is valid for 3 years after passing. Recertification is required after that.