AWS Certified Cloud Practitioner (CLF-C02) #10: Full-Scale Mock Exam — 50 Questions with Explanations
19 min read
This is the checkpoint that verifies whether everything from #1 through #9 is actually in your head. The 50 questions below match the domain weights of the real exam.
How to take it #
- Work through it in 60–75 minutes (the real exam is 65 questions in 90 minutes; this mock is sized for 50)
- Answer one question at a time without peeking at the explanation; grade everything at the end
- 36+ correct (72%) puts you in safe passing territory
- If a domain stands out as weak, loop back to that post and review
Domain distribution #
| Domain | Questions | Range |
|---|---|---|
| Domain 1 — Cloud Concepts (24%) | 12 | Q1 – Q12 |
| Domain 2 — Security and Compliance (30%) | 15 | Q13 – Q27 |
| Domain 3 — Cloud Technology (34%) | 17 | Q28 – Q44 |
| Domain 4 — Billing and Support (12%) | 6 | Q45 – Q50 |
Domain 1 — Cloud Concepts #
Q1. A company wants to stop operating its own data center and pay only for what it uses. Which cloud value proposition does this match?
Explanation
The core value is moving from buying servers (CapEx, Capital Expenditure) to usage-based operating expense (OpEx, Operational Expenditure).
Q2. What is the biggest reason AWS has been able to lower prices year over year?
Explanation
AWS is one of the largest infrastructure buyers in the world, so its unit costs drop, and part of that flows through to customer pricing.
Q3. Which of the following is NOT one of the six pillars of the Well-Architected Framework?
Explanation
The six pillars are Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability. Portability is not on the list.
Q4. A company is planning a cloud skills development program for its employees. Which AWS Cloud Adoption Framework perspective does this fall under?
Explanation
The People perspective covers workforce skills development and organizational change management.
Q5. Why does an EC2 instance only show up in the region where it was created?
Explanation
Most services, EC2 included, are regional, and regions are isolated from each other. An AZ (Availability Zone) is a set of isolated data centers within a single region, not the boundary that governs instance visibility.
Q6. Which part of the AWS global infrastructure should you use to deliver video to users worldwide quickly?
Explanation
A CDN (Content Delivery Network) like CloudFront uses Edge Locations to serve content from a point close to the user. Regions and AZs are the core compute footprint, and Outposts places AWS infrastructure on-premises.
Q7. Which of the following is an example of IaaS?
Explanation
EC2 provides virtual machines and is IaaS (Infrastructure as a Service). RDS is PaaS (Platform as a Service), Lambda is FaaS (Function as a Service, serverless), and WorkMail is SaaS (Software as a Service).
Q8. Which deployment model keeps part of a data center on-premises and runs the rest on AWS?
Explanation
Running the two environments together is the Hybrid model.
Q9. What do you call the property where Auto Scaling automatically grows and shrinks resources to match demand?
Explanation
Automatically growing and shrinking is Elasticity; the ability to scale up itself is Scalability.
Q10. Which of the following is NOT one of the four criteria for selecting a region?
Explanation
The four criteria are compliance, latency, price, and service availability.
Q11. Which option is closest to a best practice for the Operational Excellence pillar?
Explanation
The Operational Excellence pillar emphasizes “operations as code” (IaC, Infrastructure as Code). CloudFormation is the canonical tool.
Q12. Among the six benefits of AWS Cloud, which is closest in meaning to “Stop guessing capacity”?
Explanation
The ability to grow and shrink instantly with Auto Scaling and similar tools, without forecasting capacity.
Domain 2 — Security and Compliance #
Q13. Which of the following is AWS’s responsibility?
Explanation
Physical security of the data center is AWS’s responsibility (Security of the Cloud). The rest are customer responsibilities.
Q14. Code running on an EC2 instance needs to access S3. What is the recommended way to manage credentials?
Explanation
Attaching an IAM Role to EC2 automatically issues short-lived credentials, which is the secure pattern.
Q15. Which of the following is a best practice for the AWS root user?
Explanation
The principle for root is: MFA required + no daily use + no access keys.
Q16. Which service do you use to track who called which API and when?
Explanation
CloudTrail records API call audit logs. CloudWatch monitors metrics and logs, Config tracks resource configuration changes, and Trusted Advisor checks best practices.
Q17. How do you automatically check that an S3 bucket always has public access blocked?
Explanation
AWS Config rules continuously evaluate resource configuration. CloudTrail is the audit log of who made calls, and Inspector does vulnerability scanning, neither of which is configuration-compliance checking.
Q18. Where do you download AWS’s SOC 2 compliance reports?
Explanation
AWS Artifact is the self-service portal for downloading certification reports and agreements (BAA, Business Associate Addendum; DPA, Data Processing Addendum). Trusted Advisor checks best practices, Config evaluates configuration, and Inspector does vulnerability scanning, none of which provide compliance documents.
Q19. Which service automatically scans the OS and applications on an EC2 instance for known CVE vulnerabilities?
Explanation
Inspector scans for known CVE (Common Vulnerabilities and Exposures) vulnerabilities, GuardDuty detects threat activity, Macie identifies sensitive data in S3, and Shield defends against DDoS.
Q20. Which service automatically identifies sensitive data such as PII or credit card numbers in data stored in S3?
Explanation
Macie uses machine learning to classify sensitive data such as PII (Personally Identifiable Information) in S3. GuardDuty does threat detection, Inspector does vulnerability scanning, and Security Hub is the dashboard that aggregates security findings.
Q21. Which service protects web applications against L7 attacks such as SQL injection and XSS?
Explanation
WAF (Web Application Firewall) filters L7 (HTTP/HTTPS) requests with rules. Shield defends against L3/L4 DDoS (Distributed Denial of Service), GuardDuty does threat detection, and a NACL (Network Access Control List) filters IPs and ports at the subnet level, none of which defend against L7 attacks.
Q22. Which AWS service includes DDoS protection at no additional charge by default?
Explanation
Shield Standard provides DDoS (Distributed Denial of Service) protection for all AWS customers at no charge. Advanced is paid ($3,000/month), WAF defends against L7 attacks for a separate charge, and Inspector does vulnerability scanning.
Q23. Which service consolidates billing across multiple AWS accounts and lets you manage permissions in one place?
Explanation
Organizations provides account grouping, consolidated billing, and SCP (Service Control Policy) guardrails. Control Tower sets up a best-practice landing zone on top of Organizations, and IAM Identity Center handles SSO login, neither of which is billing consolidation itself.
Q24. How do you prevent every account in a specific OU from using the EC2 service?
Explanation
SCPs (Service Control Policies) set a permission ceiling (guardrail) on OUs (Organizational Units) and accounts within Organizations. An IAM Policy only grants permissions to individual users and roles and cannot block a service organization-wide, while NACLs and Security Groups control network traffic and have nothing to do with banning service usage.
Q25. Which is the standard AWS service for managing the keys used to encrypt data at rest?
Explanation
KMS (Key Management Service) is the standard for encryption key management. CloudHSM is only for cases that require a dedicated HSM (Hardware Security Module). Secrets Manager stores and rotates passwords and API keys, and ACM (AWS Certificate Manager) manages TLS certificates, neither of which is encryption key management.
Q26. Which AWS service supports automatic rotation of database passwords?
Explanation
Only Secrets Manager supports automatic rotation (integrated with RDS, Redshift, and more). Parameter Store stores configuration values and secrets but has no built-in automatic rotation, which makes it the most confusing distractor here.
Q27. Which of the following are always the customer’s responsibility? (Choose TWO)
Explanation
Data and IAM are always the customer’s responsibility regardless of service. Hypervisor and data center power are AWS’s responsibility.
Domain 3 — Cloud Technology and Services #
Q28. What is the most suitable compute service for automatically generating a thumbnail every time an image is uploaded to an S3 bucket?
Explanation
Event-driven short-running code points straight at Lambda with an S3 event trigger. EC2, ECS, and Elastic Beanstalk all require an always-on server, which is overkill for intermittent event processing.
Q29. You want to use Lambda for a data processing job that runs for 3 hours. Is that possible?
Explanation
Lambda’s execution time limit is 15 minutes, so a 3-hour job belongs on EC2, ECS, or Batch.
Q30. Multiple Linux EC2 instances need concurrent read/write access to the same files. Which storage should you use?
Explanation
EFS lets multiple Linux EC2 instances mount it concurrently over NFS (Network File System). EBS and Instance Store are block storage that attach to a single instance, making them unsuitable for concurrent sharing, and S3 is object storage that is hard to mount like a file system.
Q31. What is the cheapest S3 class for storing data subject to a 7-year legal retention requirement?
Explanation
For long-term archival that is almost never accessed, Deep Archive is the cheapest (up to 12-hour retrieval). Standard-IA is for occasionally accessed data, and Glacier Instant Retrieval offers immediate retrieval but costs more than Deep Archive, so it doesn’t fit cheapest long-term storage.
Q32. How do you apply automatic cost optimization to data with irregular and unpredictable access patterns?
Explanation
Intelligent-Tiering analyzes access patterns and moves objects between tiers automatically. One Zone-IA stores low-access data in a single AZ, and Glacier Flexible Retrieval is an archive tier; neither moves objects between tiers automatically.
Q33. Which firewall controls inbound traffic at the level of an individual EC2 instance?
Explanation
Security Groups (SGs) are per-instance and stateful. NACLs (Network Access Control Lists) are per-subnet and stateless. WAF defends against L7 web attacks and Shield against DDoS, both at a different layer than a per-instance firewall.
Q34. Which load balancer routes HTTP traffic to different backends by path?
Explanation
ALB (Application Load Balancer) operates at L7 (HTTP/HTTPS) and supports path- and host-based routing. NLB (Network Load Balancer) is for high-performance L4 (TCP/UDP), GLB (Gateway Load Balancer) is for connecting third-party security appliances, and Classic is the legacy model.
Q35. How do you connect an on-premises data center to AWS with consistent bandwidth and low latency without going over the internet?
Explanation
Direct Connect provides consistent performance over a dedicated circuit. Site-to-Site VPN is an encrypted tunnel over the internet, so its latency is variable; Transit Gateway is a hub that ties multiple networks together; and CloudFront is a CDN, none of which is a dedicated-circuit connection.
Q36. Which service lets you manage domain registration and DNS in one place and also supports health checks and failover?
Explanation
Route 53 provides domain registration plus DNS (Domain Name System), health checks, and a range of routing policies. CloudFront is a CDN, ELB does load balancing, and Global Accelerator accelerates the global network, none of which offer domain registration or DNS management.
Q37. You need a serverless NoSQL database with single-digit millisecond response times. Which service?
Explanation
DynamoDB is serverless NoSQL with single-digit ms response times and effectively unlimited scale. RDS for MySQL and Aurora are relational (SQL) databases, and Redshift is an analytics data warehouse, none of which fit a NoSQL requirement.
Q38. Which database is best for loading years of sales data and running large-scale analytics with a BI tool?
Explanation
Redshift is a petabyte-scale OLAP (Online Analytical Processing) data warehouse that pairs well with BI (Business Intelligence) tools. DynamoDB and RDS are for transactions (OLTP), and ElastiCache is an in-memory cache, none of which suit large-scale analytics.
Q39. How do you cache frequently queried data in memory to take load off the database?
Explanation
ElastiCache (Redis/Memcached) is the standard for in-memory caching. An RDS Read Replica spreads read load but is still a disk-based database, so it isn’t as fast as an in-memory cache, and S3 and EFS are storage rather than caches.
Q40. How do you use standard Kubernetes while offloading the management overhead to AWS?
Explanation
EKS (Elastic Kubernetes Service) is managed Kubernetes. ECS is AWS’s own container orchestration, Fargate is the engine that runs containers without server management (on top of ECS or EKS), and Lightsail is simple small-scale hosting, none of which is standard Kubernetes.
Q41. How do you serve static images, CSS, and JS quickly to users worldwide with caching?
Explanation
CloudFront is a CDN (Content Delivery Network) that caches content at 600+ Edge Locations. Route 53 is DNS, ELB does load balancing, and Global Accelerator accelerates the network path (without caching), none of which is for caching static content.
Q42. How do you connect dozens of VPCs and on-premises networks together through a hub?
Explanation
Transit Gateway connects multiple VPCs and on-premises networks in a hub-and-spoke topology. VPC Peering is 1:1, so management explodes as you scale to dozens; Direct Connect is a dedicated on-premises circuit; and PrivateLink is for private access to a specific service, none of which is a many-to-many hub.
Q43. Which service automatically provisions EC2, ELB, and Auto Scaling when you upload your code as a zip file?
Explanation
Elastic Beanstalk provisions infrastructure automatically as a PaaS (Platform as a Service) when you just upload your code. CloudFormation is IaC (Infrastructure as Code) where you define resources yourself, Systems Manager is for operations management, and OpsWorks is Chef/Puppet-based configuration management, all of which work differently.
Q44. How do you consolidate the findings from multiple security services (GuardDuty, Inspector, Macie) onto a single dashboard?
Explanation
Security Hub is the dashboard that aggregates findings from multiple security services. Trusted Advisor checks cost, performance, and security best practices; Config evaluates resource configuration; and the Health Dashboard surfaces AWS service status and maintenance alerts, none of which aggregate security findings.
Domain 4 — Billing, Pricing, and Support #
Q45. You plan to run EC2 steadily for 3 years and want the maximum discount. Which pricing model is best?
Explanation
A 3-year All Upfront RI (Reserved Instance) gives the deepest discount. Spot is unsuitable for steady operation due to interruption risk, On-Demand offers no discount, and Dedicated Host is an expensive option used only when you need a physical server for licensing and similar reasons.
Q46. What is the cheapest EC2 pricing model for a batch workload that tolerates interruption?
Explanation
Spot offers up to 90% off but can be reclaimed with a 2-minute notice, so it only suits workloads that can absorb interruption. On-Demand offers no discount, and RI (Reserved Instance) and Savings Plans are commitment-based discounts but not as cheap as Spot.
Q47. You need a 15-minute response time for production-down incidents and a dedicated TAM. Which Support Plan?
Explanation
A 15-minute response time and a dedicated TAM (Technical Account Manager) are only available with Enterprise. Business is 1-hour response for production-down incidents and has no TAM, and Basic and Developer are lower tiers.
Q48. How do you estimate the projected cost of the next 12 months before adopting AWS?
Explanation
Pricing Calculator is for upfront cost estimation. Cost Explorer visualizes trends after actual use, Budgets alerts on budget overruns, and the CUR (Cost and Usage Report) exports detailed billing data, all of which deal with usage after the fact.
Q49. How do you split the bill by department when multiple teams use the same AWS account?
Explanation
Tag resources by department and Cost Explorer and the CUR (Cost and Usage Report) can split costs by tag. Consolidated Billing merges multiple accounts’ bills into one, which is the opposite of splitting by department; Budgets is for budget alerts; and Trusted Advisor checks best practices, none of which is tag-based cost allocation.
Q50. What is the cheapest Support Plan that gives you access to the full set of Trusted Advisor checks?
Explanation
Basic and Developer only get the 6 core checks. Business and above unlock the full check set.
Scoring #
Total Score
Correct 0 / 0
Answered 0 / 0
| Score range | Verdict | Next step |
|---|---|---|
| 45+ (90%+) | Very stable. Head to the test center | Book the exam |
| 36–44 (72–88%) | Passing zone. One more loop on weak domains | Re-read weak-domain posts #2–#8 |
| 28–35 (56–70%) | Not there yet. Focused study on weak domains | Two weak domains plus another mock |
| 27 or fewer | Need another full loop | Re-read the entire series |
Per-domain score analysis #
Count correct answers per domain to find your weak spots.
| Domain | Questions | Target (72%) | Review if short |
|---|---|---|---|
| Domain 1 (Q1–Q12) | 12 | 9+ | #2 , #3 |
| Domain 2 (Q13–Q27) | 15 | 11+ | #4 , #5 |
| Domain 3 (Q28–Q44) | 17 | 13+ | #6 , #7 |
| Domain 4 (Q45–Q50) | 6 | 5+ | #8 |
If you didn’t clear the passing line #
- Look at the per-domain score and start with the weakest domain
- Re-read that post in the series, focusing on tables, mappings, and the trap sections
- Try external mocks from Tutorials Dojo or AWS Skill Builder to see different question patterns
- Retake this mock about a week later to check progress
If you cleared the passing line #
- Skim the #9 compressed checklist one last time
- Register for the exam (AWS Certification portal)
- Pick an exam date within the next 1–2 weeks while study momentum is still high
- Right before the exam, walk through the “30-minute pre-exam checklist” in #9
After CLF-C02 #
Tracks that flow naturally on from CLF-C02:
| Certification | Format | Notes |
|---|---|---|
| SAA-C03 (Solutions Architect Associate) | 130 min / 65 questions | The most popular. Architecture design |
| DVA-C02 (Developer Associate) | 130 min / 65 questions | Developer angle (Lambda, DynamoDB, API Gateway) |
| SOA-C02 (SysOps Administrator Associate) | 180 min / includes lab | Operator angle |
The vocabulary from CLF-C02 is the foundation for all three Associate exams. If you want to add another track, the natural ordering is dev background → DVA-C02, architecture/infra → SAA-C03, ops/SRE → SOA-C02.
Series wrap-up #
The 10 posts of the CLF-C02 series are done. What this series built:
- #1 — Exam structure and study strategy
- #2 — Domain 1 cloud concepts
- #3 — Domain 1 Well-Architected 6 Pillars
- #4 — Domain 2 shared responsibility model and IAM
- #5 — Domain 2 compliance and encryption
- #6 — Domain 3 compute and storage
- #7 — Domain 3 networking and databases
- #8 — Domain 4 billing and support
- #9 — Exam tips and checklists
- #10 — 50-question mock exam ← this post
If the 27-post AWS Basics track was the feel on top of the console, this series was the work of layering on the vocabulary that turns that feel into exam answers. After passing, the next step is the SAA-C03 (architecture) or DVA-C02 (developer) track — each will be a standalone series.
Good luck with the exam.