Practice Cloud Technology & Services questions for the AWS Certified Cloud Practitioner. Every question includes a full explanation of why the correct answer is right and why the tempting distractors are wrong.
75 questions available · medium difficulty · AWS CLF · Free, no registration required
10 example questions with full explanations. Use the interactive practice above to work through the complete set.
Question 1hard
A financial services company must store regulatory documents in Amazon S3. The documents need to be immediately retrievable for the first 30 days, then archived cost-effectively for a mandatory 7-year retention period. Critically, no one — including AWS administrators — must be able to delete or overwrite any document during the 7-year window. Select all that apply.
- A.Configure an S3 Lifecycle policy to transition objects to S3 Glacier Deep Archive after 30 days✓
- B.Enable S3 Versioning on the bucket✓
- C.Enable S3 Object Lock in Compliance mode with a 7-year retention period✓
- D.Enable S3 Cross-Region Replication (CRR) to a secondary bucket to enforce immutability
- E.Use S3 Intelligent-Tiering to automatically archive objects and enforce retention
Correct answer: A, B, C
A Lifecycle policy transitioning objects to S3 Glacier Deep Archive after 30 days satisfies the cost-effective archival requirement (A). S3 Object Lock in Compliance mode enforces immutability so that no user — including root — can delete or overwrite objects during the defined retention window (C). Object Lock requires S3 Versioning to be enabled on the bucket, making (B) a mandatory prerequisite. CRR (D) replicates data to another region for durability or compliance reasons but does not enforce immutability on its own. S3 Intelligent-Tiering (E) optimizes access costs by moving objects between tiers automatically but does not provide write-once read-many (WORM) protection or enforce retention compliance.
Question 2hard
A global enterprise operates dozens of VPCs across multiple AWS Regions and must connect all of them to its on-premises data center. The on-premises connection requires predictable, low-latency throughput for latency-sensitive financial transactions, and the VPC interconnectivity must scale without requiring individual peering connections between every VPC pair. Select all that apply.
- A.Use AWS Direct Connect to establish a dedicated private connection from the on-premises data center to AWS✓
- B.Use AWS Transit Gateway to act as a central hub connecting all VPCs and the on-premises connection✓
- C.Use VPC Peering to interconnect all VPCs so that traffic can route transitively across the mesh
- D.Use an AWS Site-to-Site VPN over the public internet as the primary path for latency-sensitive financial traffic
- E.Attach an Internet Gateway to each VPC to enable cross-VPC routing
Correct answer: A, B
AWS Direct Connect (A) provides a dedicated, private network connection that bypasses the public internet, delivering the consistent low latency required for financial transactions. AWS Transit Gateway (B) acts as a regional hub-and-spoke router that allows all VPCs to communicate through a single gateway, eliminating the O(n²) peering mesh problem. VPC Peering (C) does not support transitive routing — traffic cannot pass from VPC-A through VPC-B to VPC-C — making it unscalable for dozens of VPCs. A Site-to-Site VPN (D) traverses the public internet and therefore cannot guarantee the consistent latency required. An Internet Gateway (E) connects VPCs to the public internet; it has no role in private cross-VPC routing.
Question 3hard
A platform engineering team must run containerized microservices with the following hard requirements: (1) full Kubernetes API compatibility so workloads can be moved to any Kubernetes environment, (2) no EC2 instances for the team to patch or manage, and (3) automatic scaling of container pods. Select all that apply.
- A.Use Amazon EKS to provide a managed Kubernetes control plane✓
- B.Use AWS Fargate as the compute layer so no underlying EC2 instances need to be managed✓
- C.Use Amazon ECS with the EC2 launch type, which provides native Kubernetes API compatibility
- D.Use Amazon ECS with the Fargate launch type to satisfy the Kubernetes portability requirement
- E.Use AWS Elastic Beanstalk with a Docker platform to achieve Kubernetes API compatibility
Correct answer: A, B
Amazon EKS (A) is AWS's managed Kubernetes service and provides full Kubernetes API compatibility, enabling workload portability across any Kubernetes environment. Fargate (B) is a serverless compute engine for containers that removes the need to provision, patch, or manage EC2 instances; when used as the launch type for EKS, it satisfies both the no-EC2-management and auto-scaling requirements. Amazon ECS (C and D) uses its own proprietary orchestration API and is not Kubernetes-compatible, so workloads cannot be directly ported to other Kubernetes environments. Elastic Beanstalk (E) is a PaaS that abstracts infrastructure for web applications; it does not expose a Kubernetes API or provide Kubernetes portability.
Question 4hard
A media company runs a video-rendering workload with three distinct usage patterns: (1) a stable baseline of 20 rendering servers required continuously for the next 3 years, (2) 15 additional servers needed only on weekday business hours for scheduled batch jobs, and (3) large but unpredictable rendering bursts that can tolerate interruption. The company wants to minimize total EC2 costs across all three patterns. Select all that apply.
- A.Purchase 3-year Reserved Instances for the 20 baseline servers to receive the maximum discount over On-Demand pricing✓
- B.Use On-Demand Instances for the 15 weekday batch servers, as they run less than 40% of the month and Reserved Instances would be less cost-effective✓
- C.Use Spot Instances for the large unpredictable burst capacity, accepting that they can be interrupted✓
- D.Use Dedicated Hosts for the 20 baseline servers, as they are the least expensive option for long-running workloads
- E.Use On-Demand Instances for the unpredictable burst capacity to guarantee availability during rendering peaks
Correct answer: A, B, C
3-year Reserved Instances (A) offer the deepest discount (up to ~72% vs On-Demand) for the 20 servers that run 24/7 for three years, making this the most cost-effective choice for stable baseline capacity. The 15 weekday batch servers run roughly 8 hours/day × 5 days/week ≈ 35% utilization, well below the break-even point for Reserved Instances; On-Demand (B) is therefore more cost-effective for this intermittent pattern. Spot Instances (C) can offer up to 90% savings vs On-Demand and are ideal for the interruptible burst workload described. Dedicated Hosts (D) are the most expensive EC2 option and are intended for software licensing compliance or regulatory requirements, not cost savings. On-Demand for burst (E) is correct in terms of availability but is not the cost-minimizing choice — Spot Instances serve that purpose when interruption is acceptable.
Question 5easy
A developer is learning about Amazon S3 storage classes. Which of the following are valid Amazon S3 storage classes? Select all that apply.
- A.S3 Standard✓
- B.S3 Glacier Deep Archive✓
- C.S3 Intelligent-Tiering✓
- D.S3 Provisioned IOPS
- E.S3 Standard-Infrequent Access (S3 Standard-IA)✓
Correct answer: A, B, C, E
S3 Standard, S3 Glacier Deep Archive, S3 Intelligent-Tiering, and S3 Standard-IA are all valid Amazon S3 storage classes designed for different access frequency and cost requirements. S3 Provisioned IOPS is not an S3 storage class — Provisioned IOPS is a feature associated with Amazon EBS (Elastic Block Store) volumes, not S3. Candidates sometimes confuse storage terminology across different AWS storage services.
Question 6easy
A solutions architect is reviewing the capabilities of AWS Lambda. Which of the following statements correctly describe AWS Lambda? Select all that apply.
- A.Lambda automatically scales by running code in response to each trigger.✓
- B.Lambda functions can be triggered by events from services such as S3 and DynamoDB.✓
- C.Lambda requires you to provision and manage the underlying servers.
- D.With Lambda, you pay only for the compute time your code actually runs.✓
Correct answer: A, B, D
Lambda is a fully serverless, event-driven compute service that automatically scales by executing code in response to triggers, charges only for actual compute time consumed (in milliseconds), and integrates natively with many AWS services — including S3 and DynamoDB — as event sources. Option C is incorrect because Lambda is serverless; AWS fully manages the underlying infrastructure, so customers never provision or patch servers. This is one of the primary benefits distinguishing Lambda from EC2.
Question 7easy
A database administrator is evaluating Amazon RDS for a new relational database workload. Which of the following database engines are supported by Amazon RDS? Select all that apply.
- A.MySQL✓
- B.PostgreSQL✓
- C.Microsoft SQL Server✓
- D.MongoDB
- E.MariaDB✓
Correct answer: A, B, C, E
Amazon RDS supports six relational database engines: MySQL, PostgreSQL, Microsoft SQL Server, MariaDB, Oracle, and Amazon Aurora. MongoDB is not supported by RDS because it is a NoSQL document database — for MongoDB workloads on AWS, customers typically use Amazon DocumentDB (which has MongoDB compatibility) or self-manage MongoDB on EC2. Understanding which engines RDS supports helps distinguish it from other AWS database offerings like DynamoDB or DocumentDB.
Question 8easy
A team wants to use Amazon CloudWatch to monitor their AWS environment. Which of the following are capabilities provided by Amazon CloudWatch? Select all that apply.
- A.Collecting and tracking metrics from AWS services such as EC2 CPU utilization✓
- B.Creating alarms that automatically trigger actions when a metric threshold is breached✓
- C.Storing and querying application log data✓
- D.Provisioning AWS infrastructure using reusable templates
Correct answer: A, B, C
Amazon CloudWatch provides three core capabilities tested on the exam: collecting and displaying metrics from AWS resources and applications, creating alarms that notify or trigger automated responses when metrics cross defined thresholds, and ingesting and querying log data through CloudWatch Logs. Option D describes AWS CloudFormation, which uses JSON or YAML templates to provision and manage AWS infrastructure as code — this is an entirely different service with no overlap with CloudWatch's monitoring function.
Question 9easy
An architect is comparing Amazon SNS and Amazon SQS for a new messaging architecture. Which of the following statements accurately describe Amazon SQS? Select all that apply.
- A.SQS is a fully managed message queuing service that decouples application components.✓
- B.SQS messages are stored in the queue until a consumer retrieves and deletes them.✓
- C.SQS pushes messages to multiple subscribers simultaneously using a publish/subscribe model.
- D.SQS offers a FIFO queue type that guarantees messages are processed in order.✓
Correct answer: A, B, D
Amazon SQS is a fully managed pull-based message queue that decouples producers and consumers: messages sit in the queue until a consumer polls and explicitly deletes them, and the FIFO queue type guarantees exactly-once processing in strict order. Option C describes Amazon SNS, not SQS — SNS uses a push-based pub/sub model that fans out messages to multiple subscribers (email, Lambda, SQS, HTTP) simultaneously. Confusing SQS (pull/queue) with SNS (push/pub-sub) is one of the most common errors on this exam.
Question 10medium
A global e-commerce company has application servers deployed in us-east-1, eu-west-1, and ap-southeast-1. They want users to automatically be directed to whichever AWS Region provides the fastest response time based on their network conditions. Which Route 53 routing policy should they configure?
- A.Geolocation routing — directs users based on their geographic location
- B.Latency-based routing — directs users to the region with the lowest network latency for them✓
- C.Weighted routing — distributes traffic across regions according to assigned percentages
- D.Failover routing — sends traffic to a primary region and falls back to a secondary on health check failure
Correct answer: B
Latency-based routing measures the actual network latency between the user and each AWS Region and routes the request to the one with the lowest latency, which directly addresses the goal of fastest response time. Geolocation routing is often confused with latency routing, but it routes based on the user's geographic location (country or continent), not measured network speed — a user in Europe could still have lower latency to a US region depending on network conditions. Weighted routing is for traffic splitting across endpoints, and Failover routing is for active-passive disaster recovery scenarios.