Question bank
AWS Certified Cloud Practitioner
41 AWS Certified Cloud Practitioner questions with the correct answer and a written explanation, organised across 4 exam domains.
- 41 questions
- 4 domains
- Foundation level
certilumQuestion index
Jump straight to any question. Answers and explanations are inline.
Billing, Pricing, and Support
5 questions in this domain
- Question 1Single Choice
What is a key characteristic of AWS On-Demand pricing?
- ANo long-term commitment requiredCorrect answer
- BRequires a 1-year commitment
- COffers up to 90% discount
- DOnly applies to EC2 instances
Why this is the answer
On-Demand pricing charges per hour/second with no upfront commitment, offering maximum flexibility at the highest cost.
- Question 2Multiple Select
Which AWS resources are used for cost management? (Select three.)
- ACost ExplorerCorrect answer
- BAWS BudgetsCorrect answer
- CAWS Config
- DConsolidated BillingCorrect answer
Why this is the answer
Cost Explorer, AWS Budgets, and Consolidated Billing are core cost management tools. AWS Config is for resource inventory and compliance.
- Question 3Interactive
Given the following support case details, which AWS Support plan provides this response time?
- ABusiness
- BEnterprise On-RampCorrect answer
- CEnterprise
- DDeveloper
Why this is the answer
Enterprise On-Ramp offers <30 minute critical response time. Enterprise is <15 minutes, Business <1 hour, Developer not supported.
- Question 4Single Choice
How long do AWS 12-month Free Tier offers last?
- A6 months
- B12 monthsCorrect answer
- C24 months
- DNever expire
Why this is the answer
12-month Free Tier offers are available for 12 months starting from the account creation date, not from first use.
- Question 5Multiple Select
Which AWS pricing models require a 1- or 3-year commitment? (Select two.)
- AOn-Demand
- BReserved InstancesCorrect answer
- CSavings PlansCorrect answer
- DSpot Instances
Why this is the answer
Reserved Instances and Savings Plans require 1- or 3-year commitments. On-Demand and Spot have no long-term commitment.
Cloud Concepts
10 questions in this domain
- Question 6Single Choice
Which of the following best describes the AWS Cloud's pay-as-you-go pricing model?
- AIt requires a large upfront capital investment and then charges monthly fees.
- BIt converts capital expenditure (CapEx) into variable operational expenditure (OpEx).Correct answer
- CIt offers a fixed monthly rate for unlimited usage of all services.
- DIt charges a flat annual fee regardless of resource consumption.
Why this is the answer
Pay-as-you-go pricing allows customers to pay only for the resources they consume, without upfront commitments. This shifts IT spending from CapEx (buying hardware) to OpEx (variable usage costs), improving cash flow and financial flexibility.
- Question 7Multiple Select
Which of the following are key benefits of AWS Cloud elasticity? (Select TWO.)
- AEliminates the need for capacity planning
- BAutomatically scales resources to match real-time demandCorrect answer
- CEnsures a fixed amount of compute capacity at all times
- DReduces waste by avoiding over-provisioningCorrect answer
Why this is the answer
Elasticity allows resources to automatically increase or decrease in response to demand, preventing both under-provisioning (performance issues) and over-provisioning (wasted cost). It does not eliminate capacity planning entirely (you still set scaling policies), and it does not fix capacity—it adjusts dynamically.
- Question 8Interactive
Analyze the following AWS CLI command. What does it primarily demonstrate about cloud computing?
- AMulti-tenancy
- BBroad network access
- CRapid elasticity
- DSelf-service provisioningCorrect answer
Why this is the answer
The command 'aws ec2 run-instances' allows a user to provision a virtual server directly from the CLI without any human interaction with AWS staff. This demonstrates self-service provisioning, a key attribute of cloud computing where users can obtain and configure resources on demand.
- Question 9Single Choice
Which concept explains why AWS can offer lower prices for compute and storage compared to a single organization running its own data center?
- AReserved Instances
- BPay-as-you-go pricing
- CEconomies of scaleCorrect answer
- DMulti-region deployment
Why this is the answer
AWS aggregates usage from millions of customers, achieving massive economies of scale. This allows AWS to purchase hardware, bandwidth, and power at volume discounts, passing the savings to customers through lower prices. Reserved Instances and pay-as-you-go are pricing models, not the root cause of lower costs.
- Question 10Multiple Select
Which of the following are characteristics of the AWS Shared Responsibility Model? (Select TWO.)
- AAWS is responsible for securing the physical infrastructure of data centers.Correct answer
- BCustomers are responsible for patching the operating system on their Amazon RDS databases.
- CAWS is responsible for all security aspects, including customer data.
- DCustomers are responsible for managing Identity and Access Management (IAM) policies.Correct answer
Why this is the answer
Under the shared responsibility model, AWS secures the cloud (physical data centers, hardware, hypervisor) while customers secure what they put in the cloud (data, IAM, OS patches on EC2, network configuration). RDS is a managed service where AWS handles OS patching; customers manage IAM and data encryption.
- Question 11Interactive
The following snippet is from an AWS CloudFormation template. What Well-Architected Framework design principle does this represent?
- APerform operations as codeCorrect answer
- BStop guessing capacity
- CImplement a strong identity foundation
- DEnable traceability
Why this is the answer
Using Infrastructure as Code (like CloudFormation) to define and provision infrastructure is a key design principle of the Operational Excellence pillar. It enables repeatable, version-controlled deployments and reduces manual error. The other options are valid principles but are not directly illustrated by the code snippet.
- Question 12Single Choice
A company runs a web application on a single EC2 instance. Which AWS Cloud benefit would be most directly achieved by deploying the application across two Availability Zones?
- AElasticity
- BCost savings
- CHigh availabilityCorrect answer
- DSecurity
Why this is the answer
Deploying across multiple Availability Zones provides high availability by allowing the application to survive a failure in one AZ. Elasticity is about scaling based on demand, not geographic redundancy. Cost savings and security are not the direct benefits of multi-AZ deployment, though they may be secondary effects.
- Question 13Multiple Select
Which of the following are examples of AWS managed services that reduce undifferentiated heavy lifting? (Select TWO.)
- AAmazon EC2
- BAmazon RDSCorrect answer
- CAWS LambdaCorrect answer
- DAmazon S3 (with static website hosting)
Why this is the answer
Amazon RDS is a managed database service that handles patching, backups, and failover. AWS Lambda is a serverless compute service that manages the runtime and scaling. EC2 is an unmanaged service (customer patches and maintains the OS). S3 static website hosting is managed but does not involve OS management; it's object storage.
- Question 14Interactive
The following IAM policy allows access to a specific S3 bucket. Which Well-Architected pillar does this policy primarily support?
- ACost Optimization
- BSecurityCorrect answer
- CPerformance Efficiency
- DOperational Excellence
Why this is the answer
This policy implements a strong identity foundation by granting least privilege access to a specific S3 bucket. It aligns with the Security pillar's design principle of implementing least privilege through IAM policies. The other pillars are not directly addressed by this policy.
- Question 15Single Choice
A startup needs to launch a new application in an unpredictable market. Which AWS Cloud value proposition is most relevant for this scenario?
- AStrong security compliance
- BElasticity and pay-as-you-go pricingCorrect answer
- CGlobal infrastructure only
- DReserved Instances for cost savings
Why this is the answer
For an unpredictable market, elasticity allows the application to scale up during traffic spikes and down during lulls, while pay-as-you-go ensures the startup only pays for resources used, avoiding wasted capacity. Reserved Instances require commitment and are not suitable for uncertain demand.
Cloud Technology and Services
14 questions in this domain
- Question 16Single Choice
Which AWS deployment method provides a web-based graphical interface for manual resource creation?
- AAWS Management ConsoleCorrect answer
- BAWS CLI
- CAWS CloudFormation
- DAWS Elastic Beanstalk
Why this is the answer
The AWS Management Console is a GUI for manual resource creation, ideal for one-off tasks and learning.
- Question 17Multiple Select
Which two benefits does AWS CloudFormation provide over the AWS Management Console?
- ARepeatable and consistent deploymentsCorrect answer
- BVersion-controlled infrastructure templatesCorrect answer
- CLower total cost for small environments
- DFaster learning curve for new users
Why this is the answer
CloudFormation templates enable repeatable, version-controlled deployments, while the console is manual and not scalable.
- Question 18Interactive
Review the AWS CloudFormation code below. Which AWS resource is being defined?
- AAmazon EC2 instanceCorrect answer
- BAmazon S3 bucket
- CAWS IAM role
- DAmazon VPC
Why this is the answer
The template defines an AWS::EC2::Instance resource, creating a virtual machine.
- Question 19Single Choice
Which AWS compute service is fully managed and runs code without provisioning servers?
- AAWS LambdaCorrect answer
- BAmazon EC2
- CAWS Elastic Beanstalk
- DAmazon ECS
Why this is the answer
AWS Lambda is a serverless compute service that runs code in response to events without provisioning servers.
- Question 20Multiple Select
Which two AWS storage services are designed for object storage?
- AAmazon S3Correct answer
- BAmazon EBS
- CAmazon S3 GlacierCorrect answer
- DAmazon EFS
Why this is the answer
Amazon S3 and Amazon S3 Glacier (S3's archival class) are object storage services. EBS and EFS are block and file storage respectively.
- Question 21Interactive
Examine the AWS CLI command below. Which service does it interact with?
- AAmazon S3Correct answer
- BAmazon EC2
- CAmazon RDS
- DAWS Lambda
Why this is the answer
The 'aws s3 cp' command copies files to/from Amazon S3, indicating interaction with the S3 service.
- Question 22Single Choice
Which AWS database service is a fully managed NoSQL key-value and document database?
- AAmazon DynamoDBCorrect answer
- BAmazon RDS
- CAmazon Aurora
- DAmazon Redshift
Why this is the answer
Amazon DynamoDB is a fully managed NoSQL database delivering single-digit millisecond performance, ideal for key-value and document workloads.
- Question 23Multiple Select
Which two AWS networking services operate at the global level?
- AAmazon Route 53Correct answer
- BAmazon CloudFrontCorrect answer
- CAmazon VPC
- DAWS Direct Connect
Why this is the answer
Route 53 (DNS) and CloudFront (CDN) are global services. VPC and Direct Connect are regional or point-to-point.
- Question 24Interactive
Refer to the AWS SDK code snippet. Which AWS service is the code accessing?
- AAmazon S3Correct answer
- BAmazon DynamoDB
- CAmazon SQS
- DAmazon EC2
Why this is the answer
The 'put_object' method is part of the boto3 S3 client, indicating interaction with Amazon S3.
- Question 25Single Choice
Which AWS service is used to decouple application components via message queuing?
- AAmazon SQSCorrect answer
- BAmazon SNS
- CAmazon API Gateway
- DAWS Step Functions
Why this is the answer
Amazon SQS is a fully managed message queuing service that decouples application components.
- Question 26Multiple Select
Which two AWS services can publish messages to Amazon SNS topics?
- AAmazon CloudWatch AlarmsCorrect answer
- BAWS LambdaCorrect answer
- CAmazon SQS FIFO queues
- DAmazon Route 53
Why this is the answer
CloudWatch Alarms and Lambda can publish to SNS topics. SQS is a subscriber, not a publisher, and Route 53 does not publish to SNS.
- Question 27Interactive
Examine the architectural diagram script. What AWS service is acting as the entry point in this serverless architecture?
- AAmazon API GatewayCorrect answer
- BAWS Lambda
- CAmazon S3
- DAmazon CloudFront
Why this is the answer
API Gateway is the entry point that exposes REST APIs and triggers Lambda functions in serverless architectures.
- Question 28Single Choice
Which AWS service provides a detailed audit trail of API calls made in your account?
- AAWS CloudTrailCorrect answer
- BAmazon CloudWatch
- CAWS Trusted Advisor
- DAWS Well-Architected Tool
Why this is the answer
AWS CloudTrail records API calls (management events) for audit and compliance purposes.
- Question 29Multiple Select
Which two categories does AWS Trusted Advisor automatically check?
- ACost optimizationCorrect answer
- BSecurityCorrect answer
- CApplication integration
- DDatabase performance tuning
Why this is the answer
Trusted Advisor checks cost optimization, security, performance, fault tolerance, and service limits.
Security and Compliance
12 questions in this domain
- Question 30Single Choice
Under the AWS Shared Responsibility Model, which of the following is a customer responsibility?
- APhysical security of data centers
- BPatching the guest operating system on EC2 instancesCorrect answer
- CSecurity of the hypervisor
- DGlobal network infrastructure
Why this is the answer
The customer is responsible for security in the cloud, including patching the guest OS on EC2 instances. AWS handles physical security, hypervisor security, and global network infrastructure.
- Question 31Multiple Select
Which two AWS services help customers demonstrate compliance with regulatory requirements? (Choose two.)
- AAWS ArtifactCorrect answer
- BAmazon GuardDuty
- CAmazon Inspector
- DAWS ConfigCorrect answer
Why this is the answer
AWS Artifact provides on-demand access to compliance reports and agreements. AWS Config evaluates resource configurations against desired rules to help maintain compliance. GuardDuty and Inspector focus on threat detection and vulnerability scanning, not compliance documentation or auditing.
- Question 32Interactive
Refer to the IAM policy below. What action does this policy allow on the specified S3 bucket?
- As3:ListBucket
- Bs3:PutObject
- Cs3:GetObjectCorrect answer
- Ds3:DeleteObject
Why this is the answer
The policy allows the s3:GetObject action on the bucket named 'my-bucket'. The Resource specifies the bucket and all objects within it, and the Action lists s3:GetObject.
- Question 33Single Choice
Which AWS service provides temporary, rotating credentials for accessing AWS resources?
- AIAM user with access keys
- BIAM role attached to an instance profileCorrect answer
- CAWS Organizations service control policy
- DAWS CloudTrail log
Why this is the answer
An IAM role attached to an instance profile provides temporary credentials via AWS STS. IAM users have long-term keys, SCPs set boundaries, and CloudTrail logs are not for credentials.
- Question 34Multiple Select
Which two statements about the AWS Shared Responsibility Model are accurate? (Choose two.)
- AAWS is responsible for physical security of data centers.Correct answer
- BThe customer is responsible for patching the hypervisor on EC2 hosts.
- CThe customer is always responsible for managing their data.Correct answer
- DAWS is responsible for configuring customer IAM policies.
Why this is the answer
AWS handles physical security, and the customer is always responsible for their data. AWS does not patch hypervisors (that is AWS's job) nor configure customer IAM policies.
- Question 35Interactive
Review the sample GuardDuty finding JSON. What type of activity is being reported?
- AA vulnerability in an EC2 instance
- BA port scan from a known malicious IPCorrect answer
- CAn unauthorized IAM user creation
- DAn S3 bucket policy change
Why this is the answer
The GuardDuty finding indicates a port scan activity from an IP address associated with malicious activity. GuardDuty detects threats like port scans, not vulnerabilities (Inspector) or IAM changes (CloudTrail).
- Question 36Single Choice
Which AWS service can be used to automatically evaluate whether EC2 instances are configured with a specific security group?
- AAmazon Inspector
- BAWS CloudTrail
- CAWS ConfigCorrect answer
- DAWS Artifact
Why this is the answer
AWS Config records configuration changes and evaluates resources against rules (e.g., required security group). Inspector scans for vulnerabilities, CloudTrail logs API calls, and Artifact provides compliance reports.
- Question 37Multiple Select
Which two statements are true about IAM roles? (Choose two.)
- ARoles provide long-term access keys.
- BRoles use temporary credentials from AWS STS.Correct answer
- CRoles can be assumed by trusted entities such as AWS services.Correct answer
- DRoles are attached directly to IAM users by default.
Why this is the answer
IAM roles provide temporary credentials via STS and can be assumed by services like EC2, or by users from other accounts. Roles do not have long-term keys and are not attached directly to users; users assume roles.
- Question 38Interactive
Examine the service control policy (SCP) JSON. What effect does this SCP have on member accounts?
- AAllows launching EC2 instances only in the specified regions.
- BDenies the ability to launch EC2 instances outside of us-east-1 and eu-west-1.Correct answer
- CGrants permission to use any AWS service.
- DPrevents creation of IAM roles.
Why this is the answer
The SCP uses a Deny effect to block ec2:RunInstances unless the region is us-east-1 or eu-west-1. SCPs set maximum permissions boundaries and cannot grant permissions; they only allow or deny actions.
- Question 39Single Choice
Which AWS service is designed to identify software vulnerabilities and network exposure in EC2 instances?
- AAmazon GuardDuty
- BAmazon InspectorCorrect answer
- CAWS Config
- DAWS Security Hub
Why this is the answer
Amazon Inspector automates vulnerability assessments and network exposure analysis for EC2 instances, container images, and Lambda functions. GuardDuty detects threats, Config records configurations, and Security Hub aggregates findings.
- Question 40Multiple Select
Which two of the following are true regarding the shared responsibility model for managed services like Amazon RDS? (Choose two.)
- AAWS patches the database engine.Correct answer
- BThe customer is responsible for managing the underlying OS.
- CThe customer must configure database access and encryption.Correct answer
- DAWS automatically backs up all customer data by default.
Why this is the answer
For RDS, AWS patches the DB engine, and the customer manages data access, encryption, and parameter groups. The customer does not manage the OS (AWS does). Automated backups are optional and customer-configured.
- Question 41Interactive
Review the CloudTrail log entry snippet. What action was taken and what service was affected?
- AAn S3 bucket was created.
- BAn S3 bucket policy was modified.Correct answer
- CAn EC2 instance was terminated.
- DAn IAM user was deleted.
Why this is the answer
The CloudTrail event shows the PutBucketPolicy API call was made on an S3 bucket, meaning the bucket policy was modified. CloudTrail records API activity; this entry is from S3 service.
Frequently asked questions
Everything about the AWS Certified Cloud Practitioner question bank and how to use it.