AWS Cloud Practitioner Practice Questions & Quiz

Which describes the pay-as-you-go model of cloud computing?

Answer: You pay only for what you use and avoid large upfront investment

Cloud uses pay-as-you-go billing, charging only for usage and shifting capital expense to operating expense.

Which cloud characteristic automatically adjusts resources to match demand?

Answer: Elasticity

Elasticity automatically scales resources up and down with demand, optimizing cost and performance.

Which is the geographically independent unit that groups multiple Availability Zones?

Answer: A Region

A Region is a geographically separate area composed of multiple AZs; an AZ is one or more isolated data centers.

To improve availability, which deployment is recommended for production systems?

Answer: Distribute across multiple Availability Zones

Spreading across multiple AZs keeps the system running if one AZ fails, improving availability.

In the AWS shared responsibility model, which falls under AWS's responsibility (security 'of' the cloud)?

Answer: Physical data center security and hardware

AWS is responsible for security 'of' the cloud (physical infrastructure, hardware, facilities); customers handle security 'in' the cloud.

Which is the recommended practice for the AWS account root user?

Answer: Enable MFA and use IAM users for daily work instead

Because the root user is powerful, enable MFA and use least-privilege IAM users for daily work.

Which AWS service creates and manages encryption keys and integrates with many services?

Answer: AWS KMS

KMS creates, manages, and rotates encryption keys and integrates with services like S3 and EBS.

Which AWS service provides on-demand access to compliance reports (audit artifacts)?

Answer: AWS Artifact

AWS Artifact provides on-demand access to third-party audit reports and compliance documents.

Which AWS compute service provides virtual servers (instances)?

Answer: Amazon EC2

Amazon EC2 provides virtual servers; S3 is storage, RDS is a database, and VPC is networking.

Which highly durable object storage service offers virtually unlimited capacity?

Answer: Amazon S3

Amazon S3 is durable, scalable object storage widely used for static files and backups.

Which AWS serverless compute service runs code without managing servers?

Answer: AWS Lambda

AWS Lambda runs code without managing servers, event-driven and pay-per-use.

Which AWS service provides managed relational databases?

Answer: Amazon RDS

Amazon RDS is a managed relational database that automates patching and backups; DynamoDB is NoSQL.

Which service builds a logically isolated virtual network in AWS?

Answer: Amazon VPC

Amazon VPC is a logically isolated virtual network where you configure subnets, routing, and security.

Which AWS CDN delivers content from edge locations worldwide with low latency?

Answer: Amazon CloudFront

Amazon CloudFront caches and delivers content from edge locations for low latency.

Which service manages users, groups, and permissions to control access to AWS resources?

Answer: AWS IAM

AWS IAM controls access via users, groups, roles, and policies, and is available at no additional charge.

Which AWS service monitors resource metrics and lets you set alarms?

Answer: Amazon CloudWatch

Amazon CloudWatch monitors metrics and logs with alarms; CloudTrail records API activity.

Which AWS service records who made which API calls and when, for auditing and investigation?

Answer: AWS CloudTrail

AWS CloudTrail records API activity in the account, aiding auditing and security investigation.

Which service automatically checks best practices for cost, performance, security, and fault tolerance?

Answer: AWS Trusted Advisor

AWS Trusted Advisor analyzes your account and advises on cost, performance, security, fault tolerance, and service limits.

Which AWS guidance compiles design principles for reliability, security, cost optimization, and more?

Answer: The AWS Well-Architected Framework

The Well-Architected Framework evaluates designs across pillars such as operations, security, reliability, performance, cost, and sustainability.

Which purchase option discounts EC2 significantly in exchange for a 1- or 3-year usage commitment?

Answer: Reserved Instances / Savings Plans

Reserved Instances and Savings Plans give large discounts for a 1- or 3-year commitment; Spot suits interruptible workloads.

Which offering lets new users try AWS for free within certain limits?

Answer: The AWS Free Tier

The Free Tier offers free usage up to limits, in types such as 12-month free, always free, and trials.

Which tool lets you estimate expected AWS costs in advance?

Answer: AWS Pricing Calculator

AWS Pricing Calculator estimates costs in advance from a configuration; Cost Explorer analyzes actual spend.

Which AWS service visualizes and analyzes actual cost and usage trends?

Answer: AWS Cost Explorer

AWS Cost Explorer analyzes actual cost and usage with charts; AWS Budgets alerts on budget thresholds.

Which AWS service can alert you when spending is about to exceed a set budget?

Answer: AWS Budgets

AWS Budgets lets you set budgets and notifies you (e.g., by email) when thresholds are projected to be exceeded.

Which top AWS Support plan includes 24/7 phone/chat support and a dedicated Technical Account Manager (TAM)?

Answer: Enterprise Support

Enterprise Support is the top tier with a dedicated TAM and fast response; Basic is free with limited scope.

Which managed AWS service protects applications from DDoS attacks?

Answer: AWS Shield

AWS Shield protects against DDoS attacks; AWS WAF detects and blocks web-application-layer attacks.

Compared with buying and maintaining your own servers, what benefit can cloud migration offer?

Answer: Lower upfront cost and faster provisioning of resources as needed

Cloud lowers upfront cost and provisions resources in minutes, improving agility and cost efficiency.

In the AWS global infrastructure, which sites near users cache content for services like CloudFront?

Answer: Edge locations

Edge locations cache content near users to enable low-latency delivery via services like CloudFront.

Which AWS service provides a fully managed NoSQL database?

Answer: Amazon DynamoDB

Amazon DynamoDB is a fully managed NoSQL database offering high scalability and low latency without server management.

Which AWS service helps centrally manage multiple AWS accounts and apply policies at the organizational level?

Answer: AWS Organizations

AWS Organizations centrally manages multiple accounts, organizational units, service control policies, and consolidated billing.

Which service provides single sign-on access for workforce users to AWS accounts and applications?

Answer: AWS IAM Identity Center

AWS IAM Identity Center provides centralized sign-in and permission assignment for workforce access to AWS accounts and cloud applications.

Which service records AWS resource configuration changes and evaluates compliance against rules?

Answer: AWS Config

AWS Config records resource configuration history and evaluates compliance with Config rules. CloudTrail records API activity.

Which service detects suspicious activity in AWS accounts and workloads using sources such as threat intelligence?

Answer: Amazon GuardDuty

Amazon GuardDuty is a managed threat detection service that analyzes sources such as CloudTrail, VPC Flow Logs, and DNS logs.

Which service provides access to AWS compliance reports and agreement-related documents?

Answer: AWS Artifact

AWS Artifact provides access to audit reports, compliance documents, and agreement-related documents.

Which service distributes traffic across multiple EC2 instances and avoids sending traffic to unhealthy targets?

Answer: Elastic Load Balancing

Elastic Load Balancing distributes traffic across targets and uses health checks to avoid routing to unhealthy targets.

Which feature adjusts the number of EC2 instances as demand rises or falls to balance availability and cost?

Answer: Amazon EC2 Auto Scaling

Amazon EC2 Auto Scaling adjusts EC2 capacity based on demand or metrics, improving availability and cost efficiency.

Which service uses templates to create and update AWS resources together, enabling infrastructure as code?

Answer: AWS CloudFormation

AWS CloudFormation manages AWS resources as stacks from templates, enabling infrastructure configuration as code.

You want to classify AWS costs by project or department. What can be attached to resources and used for cost allocation?

Answer: Cost allocation tags

When activated, cost allocation tags help analyze costs by dimensions such as project or department in Cost Explorer and billing reports.

You want to combine billing from multiple AWS accounts under one paying account. Which feature is used?

Answer: Consolidated billing in AWS Organizations

Consolidated billing in AWS Organizations combines charges from multiple accounts under the management account for payment.

In the AWS Well-Architected Framework, which pillar covers a system's ability to recover from failures and continue functioning as demand changes?

Answer: Reliability

The Reliability pillar focuses on recovering from failures, adapting to demand changes, and designing fault-tolerant distributed systems.

Which AWS framework helps organize organizational transformation for cloud adoption across people, process, technology, and business perspectives?

Answer: AWS Cloud Adoption Framework (AWS CAF)

AWS CAF organizes cloud adoption from an organizational perspective, including business, people, governance, platform, security, and operations perspectives.

Which service provides best-practice recommendations for AWS cost, service limits, security, fault tolerance, and performance?

Answer: AWS Trusted Advisor

AWS Trusted Advisor checks an AWS environment and provides recommendations across cost optimization, security, fault tolerance, performance, and service limits.

Which service is most appropriate when you want to receive alerts before monthly costs exceed a configured amount?

Answer: AWS Budgets

AWS Budgets lets you set thresholds for cost, usage, and RI or Savings Plans utilization and receive alerts based on actual or forecasted values.

Which AWS Support plan is most appropriate for 24/7 technical support for production systems with short response times for business-critical issues?

Answer: Business Support

Business Support provides 24/7 technical support for production workloads and has shorter response targets for business-critical issues.

Which feature automatically moves S3 objects to lower-cost storage classes after a configured period as access becomes less frequent?

Answer: S3 Lifecycle

S3 Lifecycle rules can transition objects to classes such as Standard-IA or Glacier storage after a set number of days, or expire them later.

An application on EC2 needs S3 access without storing long-term access keys on the instance. What is the recommended approach?

Answer: Attach an IAM role with least-privilege permissions to the EC2 instance

An IAM role attached to EC2 supplies temporary credentials. This avoids distributing long-term keys and supports least-privilege permissions.

Which service filters malicious HTTP requests such as SQL injection in front of CloudFront or an Application Load Balancer?

Answer: AWS WAF

AWS WAF inspects and allows or blocks HTTP(S) requests using web ACL rules. Shield primarily provides DDoS protection and serves a different purpose.

Which service continually scans EC2 instances and container images for known software vulnerabilities?

Answer: Amazon Inspector

Amazon Inspector continually assesses supported EC2 workloads and container images and reports known vulnerabilities with risk context.

Which service helps automatically discover sensitive data such as personal information in S3 buckets?

Answer: Amazon Macie

Amazon Macie uses machine learning and pattern matching to help discover sensitive data and assess data-security posture in S3.

Which service securely stores a database password and can automate rotation for supported integrations?

Answer: AWS Secrets Manager

AWS Secrets Manager supports encrypted secret storage, access control, retrieval auditing, and rotation in supported configurations.

Which service decouples order intake from downstream processing and retains messages while consumers are temporarily unavailable?

Answer: Amazon SQS

Amazon SQS is a fully managed message queue that decouples producers from consumers and retains messages until consumers can process them.

Which service fans one message out to multiple subscribers such as email, SQS, and Lambda?

Answer: Amazon SNS

Amazon SNS is a pub/sub messaging service that can fan messages published to a topic out to multiple subscribers.

Which service routes events from AWS services, SaaS sources, and custom applications to targets using rules?

Answer: Amazon EventBridge

Amazon EventBridge uses event buses and rules to filter events and route them to AWS service or application targets.

Which service manages DNS records for a domain and supports health-check-based routing?

Answer: Amazon Route 53

Amazon Route 53 is a scalable DNS service offering domain registration, DNS records, health checks, and multiple routing policies.

Which service provides a dedicated private connection from an on-premises site to AWS rather than an internet VPN?

Answer: AWS Direct Connect

AWS Direct Connect provides a dedicated network connection from a site or data center to AWS, improving bandwidth and path predictability.

Which service family uses physical devices to transfer large data sets from a bandwidth-constrained site to AWS?

Answer: AWS Snow Family

AWS Snow Family provides physical-device data transfer and edge capabilities for migrations where online transfer would take too long.

Which service centrally manages backup policies across multiple AWS services and accounts?

Answer: AWS Backup

AWS Backup centralizes backup plans, retention, and monitoring for supported services and can apply policies across accounts with Organizations.

Which EC2 purchase option can greatly reduce cost for batch jobs that tolerate interruption and restart?

Answer: Spot Instances

Spot Instances use spare EC2 capacity at a discount but may be interrupted, making them suitable for checkpointed or retryable workloads.

Which feature uses machine learning to detect unusual AWS spending increases and notify stakeholders?

Answer: AWS Cost Anomaly Detection

AWS Cost Anomaly Detection monitors spending patterns for anomalies and sends notifications to configured subscribers. AWS Budgets focuses on configured thresholds.

Even when using Amazon RDS, which responsibility remains with the customer under the shared responsibility model?

Answer: Configure database user permissions, data classification, and network exposure appropriately

With RDS, AWS operates the underlying managed service, while the customer remains responsible for data, identities, permissions, encryption choices, and secure network configuration.

An On-Demand EC2 test instance is stopped, but its EBS volumes are retained. Which statement about charges is correct?

Answer: Retained EBS volumes still incur storage charges.

Stopping compute does not remove retained EBS storage charges. Review associated resources rather than assuming the entire environment is free.

A monthly AWS budget has only email notifications configured. What happens when spending exceeds the budget?

Answer: Notifications do not enforce a stop or a billing cap.

Budget notifications provide visibility rather than a hard spending cap. Cost reporting and alerts can be delayed; automated actions require separate configuration and have their own scope.

An SCP allows S3 actions in an Organizations member account. Does that alone grant S3 access to an IAM role in that account?

Answer: An SCP grants no access; separate permissions are needed.

An SCP defines permission guardrails, not an access grant. IAM or resource policies must provide the relevant permission, and applicable explicit denies still block the action.

An IAM user signs in successfully with MFA but has no S3 read permission. How do MFA and permissions relate?

Answer: MFA strengthens authentication; authorization is separate.

MFA strengthens identity verification. Successful authentication does not add permissions; authorization still determines which operations are allowed.

A team claims that S3 Standard's high durability means data is always instantly readable during an outage. Which explanation is appropriate?

Answer: Durability and availability describe different properties.

Durability concerns retaining data; availability concerns access when needed. Data can remain intact during temporary access failures, so the two properties are not interchangeable.

A short EC2 test lasts a few days, must avoid long-term commitments, and cannot tolerate Spot reclamation. Which purchasing approach fits?

Answer: On-Demand usage without a long-term commitment.

On-Demand suits short-lived usage without a long-term commitment or Spot reclamation. It does not eliminate ordinary failures or guarantee capacity availability.

A vulnerability is found in the guest OS of a conventional customer-managed EC2 instance. Who manages applying the patch under shared responsibility?

Answer: The customer manages guest OS patch planning and rollout.

For conventional EC2, AWS manages the underlying infrastructure while the customer manages the guest OS and installed software. Automation helps execute patching but does not remove customer responsibility.

Department tags are attached to EC2 resources but have not been activated for billing. What is the next step toward cost allocation by department?

Answer: Activate the tag for cost allocation in billing settings.

Applying a resource tag and activating it for cost allocation are separate steps. Activate the relevant key and allow for processing time; consistent tagging also matters.

A new system has an internal data-location requirement and a latency target. How should the AWS Region be selected?

Answer: Check data location, latency, and needed services.

Consider required data location, user and data proximity, service availability, and cost together. The cheapest Region is not suitable if it violates the workload's requirements.

EC2 CPU and memory utilization remain low and instances may be oversized. No long-term discount has been purchased. How should cost optimization proceed?

Answer: Validate needs, right-size, then estimate steady usage.

Validate peak load and resource constraints before rightsizing. Base new commitments on the optimized steady usage rather than locking in an oversized footprint.

To handle growing load, a team increases equally sized EC2 instances from two to six and distributes requests across them. What kind of change is this?

Answer: Horizontal scaling: adding more instances to handle load.

Scale-out adds instances to distribute work, whereas scale-up increases resources per instance. Applications and load balancing must support distributed work; adding instances does not guarantee proportional performance gains.

A team wants to run containers with Amazon ECS without managing the underlying EC2 instances or host operating systems. Which execution approach fits?

Answer: Use AWS Fargate to run the team's ECS tasks.

Fargate runs ECS tasks without customer provisioning or management of the underlying servers. Customers still manage application software, task permissions and network configuration. Removing host management does not eliminate all operational responsibility.

Several Linux EC2 instances need to read and write the same files over NFS. Which storage fits without operating a file server?

Answer: Amazon EFS shared file systems

EFS provides shared file storage accessible over NFS by multiple EC2 instances. EBS provides blocks and S3 provides objects instead. EFS still requires appropriate network connectivity and access controls.

A team occasionally aggregates CSV logs stored in Amazon S3 using SQL. Which approach avoids managing analytics servers or clusters?

Answer: Use Amazon Athena to query the logs in S3 with SQL.

Athena queries data in S3 using SQL without customer-managed analytics clusters. Define the data layout and location for the tables. File formats and scanned data volume also affect performance and cost.

A supported on-premises database is moving to Amazon RDS. Which approach copies initial data and captures subsequent changes to reduce cutover downtime?

Answer: Use AWS DMS for initial loading and ongoing change replication.

AWS DMS supports full load and ongoing change replication for supported configurations. Capturing source updates reduces the gap before cutover. Engine support, logging, schema preparation and validation still require planning; zero downtime is not guaranteed.

An office network needs an encrypted link to an Amazon VPC over its existing internet connection. Which approach uses IPsec with a compatible router without installing a dedicated circuit?

Answer: Connect the networks using AWS Site-to-Site VPN.

Site-to-Site VPN uses IPsec tunnels between compatible on-premises equipment and AWS. An internet-based setup uses the existing connection rather than a new dedicated circuit. Internet path variability still affects performance.

An EC2 launch exceeds an applied quota in the selected Region. This quota supports increase requests. What is an appropriate next step?

Answer: Request an increase in Service Quotas and check its approval status.

Service Quotas lets you inspect supported limits and request increases for adjustable quotas. Submission does not guarantee approval or immediate application. Capacity and permissions remain separate launch requirements even after approval.

A team wants AWS-provided maintenance notices and required actions affecting specific resources in its account. Which view should it check first?

Answer: The AWS Health account events view

AWS Health account events provide AWS service issue and scheduled-change information relevant to your account and resources. This differs from application metrics. Check affected resources and required actions rather than relying only on public service status.

Recovery requirements allow at most two hours of downtime and loss of at most the final 15 minutes of updates before an incident. Which pair expresses these stated RTO and RPO objectives?

Answer: RTO: 2 hours; RPO: 15 minutes

RTO limits interruption-to-restoration time, so it is two hours. RPO limits acceptable data loss measured backward from the incident, so it is 15 minutes. These are objectives to implement and test, not guarantees created by documenting them.

Development and production accounts now use AWS Organizations consolidated billing. A developer assumes this grants access to production resources. Which explanation is correct?

Answer: Consolidated billing is separate from authorization; production access needs permission.

Consolidated billing combines costs and payment; it does not merge member-account IAM identities or networks. Cross-account access still requires appropriate roles or policies. Billing administration and resource authorization are separate.