Practice Exam 1

This practice exam mirrors the real CLF-C02 exam: 65 questions, mixed across the four domains in roughly the official proportions (about 16 questions from Cloud Concepts, 20 from Security and Compliance, 22 from Cloud Technology and Services, and 7 from Billing, Pricing, and Support). Set a timer for 90 minutes, work without notes, and record your answers on a separate sheet. Questions marked “Choose two” need exactly two answers to earn the point. The answers, with an explanation and the domain for each question, follow the last question.

Questions

• 1. A European retailer must keep customer records inside Germany to comply with national law. How should the company make sure its data stays in Germany when it uses AWS?

• A. Enable Amazon S3 Transfer Acceleration on the bucket. B. Store the data in an AWS Region located in Germany.
• C. Select any Availability Zone, because AZs are not tied to

a country.

• D. Serve the data through Amazon CloudFront edge

locations in Germany.

• 2. Under the AWS shared responsibility model, which of the following is AWS responsible for when a customer runs workloads on Amazon EC2?

• A. Configuring security group rules B. Patching the guest operating system
• C. Choosing whether to encrypt data on EBS volumes D. Physical security of the data centers

• 3. An online toy store used to buy extra servers every summer to handle holiday traffic, and many of them sat idle for the rest of the year. After moving to AWS, the store adds capacity only when traffic actually rises. Which advantage of cloud computing does this describe?

• A. Stop guessing capacity B. Trade variable expense for fixed expense
• C. Benefit from massive economies of scale D. Go global in minutes

• 4. A company will run a set of EC2 workloads continuously for the next three years. It wants a large discount but expects to change instance families and possibly move some workloads to AWS Fargate. Which pricing option fits best?

• A. Spot Instances B. Dedicated Hosts billed On-Demand
• C. On-Demand Instances D. Compute Savings Plans

• 5. Which of the following are benefits of the AWS Cloud as described in AWS’s advantages of cloud computing? (Choose two.)

• A. Stop spending money running and maintaining data

centers

• B. Guarantee 100% uptime for every application
• C. Eliminate all customer security responsibilities D. Require long-term contracts for every service
• E. Trade fixed expense for variable expense

• 6. An application running on an Amazon EC2 instance needs to read objects from an Amazon S3 bucket. What is the MOST secure way to give the application access?

• A. Attach an IAM role to the EC2 instance with permission

to read the bucket.

• B. Use the root user’s access keys so the application never

loses access.

• C. Make the bucket public so no credentials are needed. D. Store an IAM user’s access keys in the application’s configuration file.

• 7. A development team wants to run Docker containers without provisioning, patching, or scaling any EC2 instances. Which AWS service should they use?

• A. AWS Fargate B. AWS Outposts
• C. Amazon Lightsail D. Amazon EC2 Auto Scaling

• 8. Which pillar of the AWS Well-Architected Framework focuses on a workload’s ability to recover from disruptions and to acquire resources to meet demand?

• A. Performance Efficiency B. Sustainability
• C. Reliability D. Operational Excellence

• 9. A security team wants to be alerted if any EC2 instance starts communicating with known malicious IP addresses or shows signs of cryptocurrency mining. Which service provides this with the least setup?

• A. AWS Artifact B. Amazon GuardDuty
• C. Amazon Inspector D. Amazon Macie

• 10. A company stores medical images that are accessed about once per quarter. When a doctor requests an image, it must be returned in milliseconds. Which Amazon S3 storage class is the MOST cost-effective?

• A. S3 Glacier Deep Archive B. S3 Standard
• C. S3 Glacier Instant Retrieval D. S3 Glacier Flexible Retrieval

• 11. A solutions architect wants to estimate the monthly cost of a new three-tier application before anything is deployed. Which AWS tool should be used?

• A. AWS Cost Explorer B. AWS Budgets
• C. AWS Cost and Usage Report D. AWS Pricing Calculator

• 12. Which perspective of the AWS Cloud Adoption Framework (AWS CAF) focuses on culture, organizational structure, leadership, and workforce training?

• A. Operations B. People
• C. Governance D. Platform

• 13. An auditor asks a company for the AWS PCI DSS Attestation of Compliance. Where can the company obtain this document?

• A. AWS Audit Manager B. AWS Artifact
• C. AWS Trusted Advisor D. AWS Config

• 14. Which AWS service provides domain name registration and DNS routing?

• A. Elastic Load Balancing B. Amazon Route 53
• C. AWS Direct Connect D. Amazon CloudFront

• 15. Which of the following AWS services are serverless? (Choose two.)

• A. Amazon RDS for MySQL with provisioned DB

instances

• B. Amazon EC2
• C. Amazon EMR on EC2 clusters D. Amazon DynamoDB
• E. AWS Lambda

• 16. An administrator needs to block all traffic from a specific IP address range to every instance in a subnet. Which feature should be used?

• A. An IAM policy attached to the instances B. A route in the subnet’s route table
• C. A deny rule in a network ACL D. A deny rule in a security group

• 17. A company’s data center lease ends in four months. It wants to move its applications to AWS as quickly as possible without changing them. Which migration strategy is this?

• A. Rehost B. Refactor
• C. Retire D. Repurchase

• 18. An analyst wants to run standard SQL queries directly against CSV files stored in Amazon S3 without loading them into a database, paying only for the queries run. Which service fits?

• A. Amazon RDS B. AWS Glue DataBrew
• C. Amazon Redshift D. Amazon Athena

• 19. Which is an AWS-recommended practice for the AWS account root user?

• A. Enable MFA on the root user and use it only for tasks

that require it.

• B. Delete the root user after creating an IAM administrator.
• C. Share the root user credentials with every administrator. D. Create access keys for the root user for use in scripts.

• 20. A company needs 24/7 phone and chat access to cloud support engineers and access to the full set of AWS Trusted Advisor checks. It wants the lowest-cost plan that meets these needs. Which AWS Support plan should it choose?

• A. Enterprise On-Ramp B. Developer
• C. Enterprise D. Business

• 21. The web front end of an ordering system must keep accepting orders even if the back-end processing service is down for maintenance. Orders must be held until they are processed. Which service should sit between the two components?

• A. Amazon SQS B. Amazon SNS
• C. AWS Step Functions D. Amazon CloudWatch

• 22. A company wants to create and control the encryption keys used to protect data in Amazon S3 and Amazon EBS, and wants every use of those keys logged in AWS CloudTrail. Which service should it use?

• A. Amazon Macie B. AWS Certificate Manager
• C. AWS Key Management Service (AWS KMS) D. AWS Secrets Manager

• 23. Which scenario is the best example of elasticity?

• A. An administrator manually upgrades an instance to a

larger size once a year.

• B. A company signs a three-year contract to reserve a fixed

number of servers.

• C. An application automatically adds instances during a

traffic spike and removes them when traffic falls.

• D. A database is copied to a second Region for disaster

recovery.

• 24. Users in Asia and Europe complain that product images and videos load slowly. The files are stored in an S3 bucket in the us-east-1 Region. Which service will MOST improve load times?

• A. Amazon EBS B. Amazon Route 53
• C. AWS Direct Connect D. Amazon CloudFront

• 25. A security team wants one place to see aggregated findings from Amazon GuardDuty, Amazon Inspector, and Amazon Macie, and to check accounts against security standards such as the CIS AWS Foundations Benchmark. Which service should it use?

• A. Amazon Detective B. AWS Security Hub
• C. AWS Shield Advanced D. AWS Config

• 26. A company needs a private, dedicated network connection from its data center to AWS with more consistent performance than an internet connection. Which service meets this need?

• A. Amazon CloudFront B. AWS Client VPN
• C. AWS Direct Connect D. AWS Site-to-Site VPN

• 27. A software company wants to offer its application to customers in South America with low latency. It does not want to build or lease a data center there. Which advantage of cloud computing does this illustrate?

• A. Go global in minutes B. Benefit from massive economies of scale
• C. Trade fixed expense for variable expense D. Stop guessing capacity

• 28. Which tasks are the customer’s responsibility when storing data in Amazon S3? (Choose two.)

• A. Choosing which encryption keys protect sensitive

objects

• B. Maintaining the storage hardware
• C. Replicating data across devices to achieve the S3

durability design

• D. Configuring bucket policies and access permissions
• E. Patching the servers that run the S3 service

• 29. An application requires a block storage volume that keeps its data when the EC2 instance is stopped and can be detached and attached to another instance in the same Availability Zone. Which storage should be used?

• A. Amazon S3 Glacier B. Amazon S3
• C. EC2 instance store D. Amazon EBS

• 30. A company has eight AWS accounts and wants to receive a single bill and benefit from volume pricing across all of them. What should it use?

• A. A separate Enterprise Support plan for each account B. Consolidated billing in AWS Organizations
• C. AWS Budgets D. AWS Cost Explorer

• 31. A team wants to create identical copies of its networking and application infrastructure in several accounts and Regions from a template stored in version control. Which service should it use?

• A. AWS Elastic Beanstalk B. AWS Systems Manager
• C. AWS Config D. AWS CloudFormation

• 32. A company must find and report on any personally identifiable information (PII) stored in its Amazon S3 buckets. Which service automates this?

• A. Amazon GuardDuty B. AWS Shield
• C. Amazon Macie D. Amazon Inspector

• 33. Which practice aligns with the Cost Optimization pillar of the AWS Well-Architected Framework?

• A. Purchase hardware up front to lock in prices. B. Run all workloads on the largest available instance type.
• C. Adopt a consumption model and pay only for the

resources you use.

• D. Provision for peak demand at all times.

• 34. A bank wants to detect fraud rings by analyzing relationships between accounts, devices, and transactions. Which purpose-built database fits this use case?

• A. Amazon ElastiCache B. Amazon Neptune
• C. Amazon Timestream D. Amazon Redshift

• 35. A company has 40 AWS accounts and wants employees to sign in once with their corporate identity provider and then access the accounts they are entitled to. Which service should it use?

• A. AWS IAM Identity Center B. IAM users in each account
• C. Amazon Cognito D. AWS Directory Service only

• 36. Which statements about AWS Availability Zones are correct? (Choose two.)

• A. Each Region contains exactly one Availability Zone. B. Edge locations are another name for Availability Zones.
• C. Availability Zones in a Region are connected with low-latency networking.D. A single Availability Zone spans several Regions.
• E. An Availability Zone consists of one or more discrete

data centers with redundant power and networking.

• 37. A finance team wants an email alert when the forecasted AWS spend for the month is expected to exceed 500 USD. Which service should it use?

• A. AWS Budgets B. AWS Trusted Advisor
• C. AWS Pricing Calculator D. AWS Cost Explorer

• 38. Which statement describes the move from capital expenses (CapEx) to operational expenses (OpEx) when adopting the cloud?

• A. The company signs a fixed five-year contract for data

center space.

• B. The company pays up front for servers and depreciates

them over five years.

• C. The company pays monthly only for the computing

resources it consumes.

• D. The company buys spare hardware in case demand

grows.

• 39. Someone terminated a production EC2 instance last week. The security team needs to know which IAM identity made the request and when. Which service provides this information?

• A. Amazon Inspector B. AWS CloudTrail
• C. Amazon CloudWatch D. AWS Config

• 40. A company wants to build a chat assistant that uses foundation models from several model providers through a single API, without managing any ML infrastructure. Which service should it use?

• A. Amazon Comprehend B. Amazon Bedrock
• C. Amazon SageMaker AI D. Amazon Lex

• 41. An accounts payable team receives thousands of scanned invoices each week and wants to extract text, key-value pairs, and tables from them automatically. Which service fits?

• A. Amazon Polly B. Amazon Rekognition
• C. Amazon Textract D. Amazon Translate

• 42. A company wants to protect its web application from SQL injection attacks and block requests from specific countries. Which service should it use?

• A. Amazon GuardDuty B. AWS Shield Standard
• C. AWS WAF D. Network ACLs

• 43. A company moves its self-managed Oracle database from on-premises servers to Amazon RDS for Oracle so that AWS handles backups and patching. The application code is not changed. Which migration strategy is this?

• A. Refactor B. Replatform
• C. Rehost D. Retain

• 44. Which AWS service provides a managed Kubernetes control plane?

• A. AWS Lambda B. Amazon EKS
• C. AWS Batch D. Amazon ECS

• 45. A company uses AWS Organizations. It must ensure that no one in any member account, including account administrators, can stop AWS CloudTrail logging. What should it use?

• A. An IAM policy attached to each administrator B. An S3 bucket policy
• C. A security group D. A service control policy (SCP)

• 46. Which is an example of a cost a company typically no longer pays directly after moving its on-premises servers to Amazon EC2?

• A. Power and cooling for the data center B. Data transfer out to the internet
• C. Licenses for the company’s own application software D. Salaries of the company’s developers

• 47. A company runs image-rendering batch jobs that can be stopped and restarted at any time without harm. It wants the LOWEST possible compute cost. Which EC2 purchasing option should it use?

• A. Dedicated Hosts B. On-Demand Instances
• C. Spot Instances D. Reserved Instances

• 48. Which action BEST supports the Sustainability pillar of the AWS Well-Architected Framework?

• A. Right-size resources and use managed services to

maximize utilization.

• B. Deploy a full copy of every workload in every AWS

Region.

• C. Continue to use older instance generations to avoid

change.

• D. Keep idle resources running so they respond faster.

• 49. What does the principle of least privilege mean?

• A. Remove all permissions from the root user. B. Allow access only during business hours.
• C. Give every user administrator access to avoid delays. D. Grant only the permissions required to perform a task.

• 50. A Linux application runs on EC2 instances in three Availability Zones. All instances need to read and write the same files, and storage should grow automatically. Which service fits?

• A. Amazon EFS B. Amazon FSx for Windows File Server
• C. EC2 instance store D. Amazon EBS

• 51. A company wants its on-premises backup software to write to AWS cloud storage using standard file or block protocols, with a local cache for recently used data. Which service fits?

• A. AWS DataSync B. AWS Transfer Family
• C. AWS Storage Gateway D. Amazon EFS

• 52. A company wants database passwords to be stored securely and rotated automatically on a schedule. Which service should it use?

• A. AWS Certificate Manager B. Amazon Cognito
• C. AWS Artifact D. AWS Secrets Manager

• 53. A company notices that servers hosted on AWS IP addresses are sending phishing emails to its employees. The servers do not belong to the company. Whom should the company contact to report this abuse?

• A. AWS Marketplace sellers B. AWS Professional Services
• C. AWS Partner Network D. AWS Trust and Safety team

• 54. AWS can offer lower pay-as-you-go prices because the combined usage of many customers lets it buy and operate infrastructure at a very large scale. Which advantage of cloud computing is this?

• A. Benefit from massive economies of scale B. Stop guessing capacity
• C. Increase speed and agility D. Go global in minutes

• 55. A media company needs to ingest clickstream data in real time and let several applications process the same stream at the same time. Which service fits?

• A. AWS Batch B. Amazon Kinesis Data Streams
• C. Amazon S3 Glacier D. Amazon SQS

• 56. A compliance officer wants to know whether any S3 bucket has versioning turned off, and to see how each bucket’s configuration has changed over time. Which service provides this?

• A. AWS Config B. AWS Shield
• C. AWS CloudTrail D. Amazon Inspector

• 57. Which tools let a developer interact with AWS services programmatically? (Choose two.)

• A. AWS Marketplace B. AWS Health Dashboard
• C. AWS Command Line Interface (AWS CLI) D. AWS SDKs
• E. AWS Artifact

• 58. Which control is considered shared between AWS and the customer under the shared responsibility model?

• A. Security of the facilities’ power supply B. Classification of customer data
• C. Patch management D. Physical and environmental controls

• 59. Developers at a company used to wait several weeks for new test servers. After moving to AWS, they can launch servers in minutes and experiment freely. Which advantage of cloud computing does this describe?

• A. Benefit from massive economies of scale B. Increase speed and agility
• C. Trade variable expense for fixed expense D. Go global in minutes

• 60. A team wants to deploy a web application by uploading its code. AWS should handle capacity provisioning, load balancing, scaling, and health monitoring, while the team keeps access to the underlying resources. Which service fits?

• A. Amazon EC2 B. AWS Elastic Beanstalk
• C. AWS CodeDeploy D. AWS CloudFormation

• 61. Which statement describes horizontal scaling?

• A. Moving a workload to a different Region B. Increasing the size of an EBS volume
• C. Adding more instances to share the workload D. Replacing an instance with one that has more CPU and memory

• 62. A company that runs a high-profile website wants protection against large DDoS attacks, 24/7 access to the AWS Shield Response Team, and protection against scaling charges caused by an attack. Which service should it subscribe to?

• A. AWS Shield Standard B. Amazon GuardDuty
• C. AWS WAF only D. AWS Shield Advanced

• 63. A video studio in a large city needs single-digit millisecond latency to AWS compute for rendering, but it does not want to install AWS hardware in its own building. Which AWS infrastructure option fits?

• A. AWS Outposts B. AWS Wavelength Zones
• C. Amazon CloudFront edge locations D. AWS Local Zones

• 64. In which phase of the AWS CAF cloud transformation journey does an organization deliver pilot initiatives in production and demonstrate incremental business value?

• A. Envision B. Align
• C. Launch D. Scale

• 65. A company wants to automatically and continuously scan its EC2 instances and container images in Amazon ECR for software vulnerabilities and unintended network exposure. Which service should it use?

• A. Amazon Inspector B. AWS Artifact
• C. Amazon Macie D. Amazon GuardDuty

Answers and explanations

• 1. B (Domain 3). Data stored in a Region stays in that Region unless you move or replicate it, so choosing a Region in Germany meets the requirement. Edge locations cache copies of content and are not where you choose to store your records, and AZs always belong to a single Region.
• 2. D (Domain 2). AWS secures the physical facilities, hardware, and global infrastructure. The guest OS, security groups, and encryption choices are the customer’s job with EC2.
• 3. A (Domain 1). Adding capacity only when it is needed, instead of buying for a predicted peak, is “stop guessing capacity”. The option that trades variable expense for fixed expense reverses the real benefit.
• 4. D (Domain 4). Compute Savings Plans give a large discount for a one- or three-year commitment and apply across instance families, Regions, Fargate, and Lambda. Spot can be interrupted, On-Demand has no discount, and Dedicated Hosts do not provide this flexibility.
• 5. A and E (Domain 1). Both are among AWS’s six advantages of cloud computing. Customers always keep some security responsibility, AWS does not guarantee 100% uptime, and most services require no long-term contract.
• 6. A (Domain 2). An IAM role gives the instance temporary, automatically rotated credentials. Long-term keys in files, root keys, and public buckets all break security best practices.
• 7. A (Domain 3). Fargate is the serverless compute engine for containers on Amazon ECS and Amazon EKS. Auto Scaling and Lightsail still involve servers, and Outposts is hardware in your own facility.
• 8. C (Domain 1). The Reliability pillar covers recovering from failure and scaling to meet demand. Performance Efficiency is about using resources efficiently, not about recovery.
• 9. B (Domain 2). GuardDuty analyzes data sources such as VPC Flow Logs, DNS logs, and CloudTrail events to detect threats like communication with malicious IPs and crypto mining. Inspector scans for vulnerabilities, and Macie finds sensitive data.
• 10. C (Domain 3). S3 Glacier Instant Retrieval is designed for rarely accessed data (about once a quarter) that still needs millisecond retrieval, at lower storage cost than S3 Standard. Flexible Retrieval and Deep Archive take minutes to hours.
• 11. D (Domain 4). The Pricing Calculator estimates costs before you build. Cost Explorer and the Cost and Usage Report show spend that has already happened, and Budgets tracks spend against a threshold.
• 12. B (Domain 1). The People perspective covers culture, organizational change, leadership, and skills. Governance covers program management and risk, while Platform and Operations are technical perspectives.
• 13. B (Domain 2). AWS Artifact provides on-demand access to AWS’s own compliance reports, such as SOC reports and the PCI DSS AOC. Audit Manager collects evidence about your own workloads, not AWS’s reports.
• 14. B (Domain 3). Route 53 is AWS’s DNS service and domain registrar. CloudFront delivers content, and Elastic Load Balancing distributes traffic but does not resolve domain names.
• 15. D and E (Domain 3). Lambda and DynamoDB require no server management and scale automatically. EC2, provisioned RDS instances, and EMR on EC2 all run on instances you size and pay for while they run.
• 16. C (Domain 2). Network ACLs operate at the subnet level and support explicit deny rules. Security groups support only allow rules, and IAM policies and route tables do not filter traffic by source IP in this way.
• 17. A (Domain 1). Rehost (“lift and shift”) moves applications without changes and is the fastest approach for a deadline. Refactor rewrites the application, Repurchase moves to a different product, and Retire turns the application off.
• 18. D (Domain 3). Athena is a serverless, interactive query service that runs SQL on data in S3 and charges per query (by data scanned). Redshift and RDS require loading data into a database.
• 19. A (Domain 2). AWS recommends protecting the root user with MFA, not creating access keys for it, and using it only for the few tasks that require it. You cannot delete the root user of an account.
• 20. D (Domain 4). Business Support is the lowest tier with 24/7 phone, chat, and email access to cloud support engineers and the full set of Trusted Advisor checks. Developer offers business-hours email only, and the Enterprise plans cost more.
• 21. A (Domain 3). An SQS queue stores messages until the consumer is ready, which decouples the two components. SNS pushes messages to subscribers but does not hold them for a consumer that is down.
• 22. C (Domain 2). AWS KMS creates and manages encryption keys, integrates with S3 and EBS, and logs key usage in CloudTrail. Secrets Manager stores secrets such as passwords, and ACM manages TLS certificates.
• 23. C (Domain 1). Elasticity is the automatic growth and shrinkage of resources to match demand. A fixed reservation, a DR copy, and a yearly manual resize are not elastic.
• 24. D (Domain 3). CloudFront caches content at edge locations close to users, reducing latency for static files and video. Direct Connect links your data center to AWS, and Route 53 resolves names but does not cache content.
• 25. B (Domain 2). Security Hub aggregates findings from AWS security services and runs automated checks against standards such as CIS. Detective is for investigating findings, and Config evaluates resource configurations.
• 26. C (Domain 3). Direct Connect provides a dedicated private connection with consistent performance. A Site-to-Site VPN is encrypted but runs over the public internet.
• 27. A (Domain 1). Deploying in another AWS Region close to new customers, without building a data center, is “go global in minutes”.
• 28. A and D (Domain 2). Customers control access to their data and choose how it is encrypted. AWS maintains the hardware, the redundancy that delivers S3 durability, and the servers that run the service.
• 29. D (Domain 3). EBS volumes are persistent block storage that can be detached and reattached to another instance in the same AZ. Instance store data is lost when the instance stops, and S3 and Glacier are object storage.
• 30. B (Domain 4). Consolidated billing in AWS Organizations gives one bill for all member accounts and combines usage for volume pricing tiers. Budgets and Cost Explorer track costs but do not combine bills.
• 31. D (Domain 3). CloudFormation provisions infrastructure from templates, which makes it repeatable across accounts and Regions (for example with StackSets). Elastic Beanstalk deploys applications, not arbitrary infrastructure.
• 32. C (Domain 2). Macie uses machine learning and pattern matching to discover sensitive data such as PII in S3. GuardDuty detects threats, and Inspector finds software vulnerabilities.
• 33. C (Domain 1). “Adopt a consumption model” is a Cost Optimization design principle. Provisioning for peak, buying up front, and oversizing all waste money.
• 34. B (Domain 3). Neptune is a graph database built for highly connected data such as fraud rings and social networks. Redshift is a data warehouse, ElastiCache is a cache, and Timestream is for time-series data.
• 35. A (Domain 2). IAM Identity Center provides workforce single sign-on to multiple AWS accounts and applications and connects to external identity providers. Cognito is for customer-facing application users.
• 36. C and E (Domain 3). An AZ is one or more discrete data centers, and AZs in a Region are linked by low-latency networks. AZs never span Regions, edge locations are separate sites, and every Region has multiple AZs.
• 37. A (Domain 4). AWS Budgets sends alerts when actual or forecasted costs exceed a threshold you set. Cost Explorer visualizes and forecasts spend but is not the alerting tool.
• 38. C (Domain 1). Paying only for what you consume is an operational expense. Up-front server purchases, long fixed contracts, and spare hardware are capital-expense patterns.
• 39. B (Domain 2). CloudTrail records API calls, including the identity that made the call, the time, and the source IP. CloudWatch focuses on metrics and logs, and Config tracks resource configuration.
• 40. B (Domain 3). Bedrock is a fully managed service that offers foundation models from Amazon and other providers through a single API. SageMaker AI is for building and training your own models with more infrastructure choices.
• 41. C (Domain 3). Textract extracts printed and handwritten text, forms, and tables from documents. Rekognition analyzes images and video for objects and faces.
• 42. C (Domain 2). AWS WAF filters web requests with rules, including SQL injection protection and geographic match conditions. Shield Standard protects against network-layer DDoS attacks, not application-level injection.
• 43. B (Domain 1). Moving to a managed database without changing the application’s core architecture is Replatform (“lift, tinker, and shift”). Rehost would move the database to EC2 unchanged.
• 44. B (Domain 3). Amazon EKS runs the Kubernetes control plane for you. Amazon ECS is AWS’s own container orchestrator, not Kubernetes.
• 45. D (Domain 2). SCPs set the maximum permissions for member accounts and apply even to account administrators. IAM policies can be changed by those same administrators.
• 46. A (Domain 1). In the cloud, AWS pays for data center power, cooling, and facilities, and these costs are built into service prices. The other costs remain the customer’s.
• 47. C (Domain 4). Spot Instances use spare EC2 capacity at up to 90% off and suit interruptible work. Reserved Instances require a commitment and give smaller discounts.
• 48. A (Domain 1). Maximizing utilization, right-sizing, and using managed services are Sustainability design principles. Idle resources and unnecessary copies waste energy.
• 49. D (Domain 2). Least privilege means granting only the permissions needed for a task and nothing more.
• 50. A (Domain 3). EFS is a managed, elastic NFS file system that many Linux instances across AZs can mount at once. EBS volumes are normally attached to one instance in one AZ, and FSx for Windows File Server targets Windows SMB workloads.
• 51. C (Domain 3). Storage Gateway gives on-premises applications access to cloud storage through file, volume, and tape interfaces with local caching. DataSync moves data but does not present a local storage interface.
• 52. D (Domain 2). Secrets Manager stores secrets and can rotate database credentials automatically. ACM is for TLS certificates, and Cognito handles application user sign-in.
• 53. D (Domain 4). The AWS Trust and Safety team handles reports of abuse involving AWS resources, such as spam, phishing, or attacks.
• 54. A (Domain 1). Aggregated customer usage lets AWS achieve economies of scale, which it passes on as lower prices.
• 55. B (Domain 3). Kinesis Data Streams ingests real-time data and lets multiple consumers read the same stream. An SQS message is typically processed and deleted by a single consumer.
• 56. A (Domain 2). AWS Config records resource configurations over time and evaluates them against rules, such as a rule that checks S3 versioning. CloudTrail records API calls, not the resulting configuration state.
• 57. C and D (Domain 3). The CLI and SDKs call AWS APIs from scripts and code. Artifact, Marketplace, and the Health Dashboard are not programmatic access tools.
• 58. C (Domain 2). Patch management is a shared control: AWS patches the infrastructure, and customers patch their guest operating systems and applications. Physical and environmental controls belong to AWS, and data classification belongs to the customer.
• 59. B (Domain 1). Getting resources in minutes instead of weeks increases speed and agility. Trading variable expense for fixed expense is the reverse of a real benefit.
• 60. B (Domain 3). Elastic Beanstalk handles deployment details such as capacity, load balancing, scaling, and health monitoring, and you can still access the underlying resources.
• 61. C (Domain 1). Horizontal scaling (scaling out) adds more instances. Replacing an instance with a bigger one is vertical scaling.
• 62. D (Domain 2). Shield Advanced adds enhanced DDoS protection, access to the Shield Response Team, and cost protection for scaling during an attack. Shield Standard is automatic and free but does not include those extras.
• 63. D (Domain 3). Local Zones place AWS compute close to large population centers for single-digit millisecond latency. Outposts require hardware on your premises, and Wavelength targets 5G mobile networks.
• 64. C (Domain 1). Launch is the phase that delivers pilots in production and shows incremental value. Envision identifies opportunities, Align addresses gaps and dependencies, and Scale expands pilots to production at scale.
• 65. A (Domain 2). Amazon Inspector continuously scans EC2 instances, ECR images, and Lambda functions for vulnerabilities and network exposure. GuardDuty detects threats from activity rather than scanning software.

Scoring guide

Count one point for each correct answer. For “Choose two” questions, award the point only if both choices are correct. Then compare your score with the table below. The real exam uses a scaled score, so this guide is only an approximation. Correct answers Percent What it means

59-65 90-100% Ready. Book the exam.

52-58 80-89% Very likely to pass. Review missed topics.

46-51 70-79% Borderline. Reread weak domains, retake in a week.

Below 46 Under 70% Not ready yet. Restudy weak chapters first.

• To find your weak areas, count your misses by domain tag:
• Domain Questions in this exam Misses to worry about
• 1: Cloud Concepts 16 More than 3
• 2: Security and Compliance 20 More than 4
• 3: Technology and Services 22 More than 4
• 4: Billing, Pricing, and Support 7 More than 1