AWS Cloud Practitioner Practice Test

Sample practice questions

A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.

1. 1. Cloud Concepts

   Which statement best describes the primary financial benefit of moving from an on-premises data center to the AWS Cloud?

   • a.It trades large upfront capital expenses for variable operating expenses that scale with usage
   • b.It guarantees that monthly bills will never change month to month
   • c.It eliminates all costs associated with running applications
   • d.It removes the need to monitor how many resources you consume

   Answer: a

   Explanation: Cloud computing lets organizations avoid large upfront investments in hardware (CapEx) and instead pay only for the resources they actually use (OpEx). This variable cost model scales up or down with demand. Costs are not eliminated, and usage should still be monitored.

2. 2. Security & Compliance

   In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

   • a.Network access control list (NACL)
   • b.Route table
   • c.Security group
   • d.Internet gateway

   Answer: c

   Explanation: A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

3. 3. Cloud Technology & Services

   Which statement correctly describes edge locations in the AWS global infrastructure?

   • a.They replace Availability Zones
   • b.They are where the root user signs in
   • c.They are sites used to cache content closer to users, primarily for services like CloudFront
   • d.They are used only for storing relational databases

   Answer: c

   Explanation: Edge locations are part of the content delivery network and cache content closer to end users to reduce latency. They are distinct from Regions and Availability Zones, which host the core compute and storage infrastructure.

4. 4. Cloud Concepts

   Which Well-Architected best practice improves reliability by assuming components will fail?

   • a.Design for failure with automated recovery
   • b.Avoid redundancy entirely to minimize monthly cost
   • c.Manually restart the system after every component fault
   • d.Consolidate everything onto one large server for simplicity

   Answer: a

   Explanation: Anticipating failure with redundancy and automated recovery lets systems withstand component failures, a key reliability practice.

5. 5. Cloud Concepts

   Which design increases the risk to reliability?

   • a.Automating detection and recovery from failures
   • b.Using a load balancer in front of several healthy targets
   • c.Relying on one server with no redundancy
   • d.Distributing the workload across multiple Availability Zones

   Answer: c

   Explanation: A single point of failure with no redundancy undermines reliability; distributing across AZs and automating recovery are the recommended alternatives.

6. 6. Security & Compliance

   Which service would help detect an EC2 instance communicating with a known malicious IP address?

   • a.Amazon Macie
   • b.AWS Certificate Manager
   • c.AWS Artifact
   • d.Amazon GuardDuty

   Answer: d

   Explanation: GuardDuty analyzes logs and threat intelligence to flag activity like communication with known-malicious IPs, without deploying agents.

7. 7. Security & Compliance

   Which statement correctly contrasts security groups with network ACLs?

   • a.NACLs are stateful and attach to instances
   • b.Security groups work only at the subnet level
   • c.Security groups are stateful at the instance level; NACLs are stateless at the subnet level
   • d.Both are stateless and behave identically

   Answer: c

   Explanation: Security groups are stateful instance-level firewalls (return traffic auto-allowed); NACLs are stateless subnet-level filters needing explicit rules both ways.

8. 8. Cloud Technology & Services

   What does a route table in a VPC control?

   • a.Where network traffic from a subnet is directed
   • b.The encryption keys used for data at rest
   • c.The number of instances in an Auto Scaling group
   • d.The billing alerts for the account

   Answer: a

   Explanation: A route table contains rules (routes) that determine where network traffic from a subnet or gateway is directed, such as to an internet gateway or NAT gateway. Each subnet is associated with a route table.

9. 9. Cloud Technology & Services

   What is an Elastic IP address in AWS?

   • a.A DNS record automatically created for every bucket
   • b.A billing identifier used for consolidated billing
   • c.A static public IPv4 address you can allocate and associate with instances in your account
   • d.A private, internal-only IP address that can never be reached from the public internet at all

   Answer: c

   Explanation: An Elastic IP is a static, public IPv4 address allocated to your account that you can associate with an instance and remap as needed. It provides a stable address even if the underlying instance changes.

10. 10. Billing & Pricing

    Which service lets you set a custom threshold and receive an alert when your actual or forecasted AWS spending exceeds it?

    • a.Amazon Inspector
    • b.AWS Budgets
    • c.AWS Artifact
    • d.AWS CloudFormation

    Answer: b

    Explanation: AWS Budgets lets you create custom cost and usage budgets and sends alerts when actual or forecasted amounts breach your thresholds. This supports proactive cost control.