AWS Cloud Practitioner — All Questions

Which statement best distinguishes an IAM user from an IAM role?

• a.A role always has a permanent password, while a user never does
• b.Roles can only be used by AWS employees
• c.Users cannot be assigned any permissions
• d.A user represents a specific identity with long-term credentials, while a role is assumed temporarily by trusted entities✓

An IAM user is a persistent identity with its own long-term credentials, whereas an IAM role is assumed temporarily and provides short-term credentials to whoever or whatever assumes it. Roles are ideal for granting access to applications, services, or federated users.

According to the shared responsibility model, who is responsible for classifying data and configuring access controls on it?

• a.No one is responsible
• b.The customer✓
• c.AWS alone
• d.The internet service provider

Customers are always responsible for their own data, including classifying it and configuring appropriate access controls and encryption. AWS secures the underlying infrastructure but does not manage the customer's data classification.

Which service would you use to get automated recommendations that include security checks such as identifying publicly accessible resources or missing MFA on the root account?

• a.AWS Trusted Advisor✓
• b.AWS Lambda
• c.Amazon EC2 Auto Scaling
• d.Amazon S3

AWS Trusted Advisor inspects your environment and provides recommendations across categories including security, such as flagging open ports, exposed access keys, or a root account without MFA. It helps improve security posture and follow best practices.

What is the benefit of using temporary security credentials provided by IAM roles instead of long-term access keys?

• a.They never expire, so they are easier to manage
• b.They grant full administrative access by default
• c.They are stored permanently in application code
• d.They automatically expire, reducing the risk if they are exposed✓

Temporary credentials from roles expire automatically after a short period, limiting the window of exposure if they are leaked. This is more secure than long-term keys, which remain valid until manually rotated or deleted.

Which AWS service provides resizable virtual servers in the cloud on which you can run applications?

• a.Amazon RDS
• b.Amazon EC2✓
• c.Amazon S3
• d.AWS Lambda

Amazon EC2 (Elastic Compute Cloud) provides resizable virtual servers, called instances, where you control the operating system and software. S3 is object storage, RDS is a managed database, and Lambda runs code without provisioning servers.

Which AWS service provides highly durable object storage designed for 11 nines of durability?

• a.Amazon S3✓
• b.Amazon EC2
• c.Amazon VPC
• d.AWS IAM

Amazon S3 (Simple Storage Service) is object storage designed for 99.999999999% (11 nines) durability by redundantly storing data across multiple facilities. It is commonly used for backups, static websites, data lakes, and media.

Which service lets you run code without provisioning or managing servers, charging only for the compute time consumed?

• a.Amazon EBS
• b.Amazon RDS
• c.AWS Lambda✓
• d.Amazon EC2

AWS Lambda is a serverless compute service that runs your code in response to events and automatically manages the underlying compute. You pay only for the requests and the compute time your code uses.

Which service is a managed relational database that supports engines such as MySQL, PostgreSQL, and SQL Server?

• a.Amazon S3
• b.Amazon DynamoDB
• c.Amazon RDS✓
• d.Amazon ElastiCache

Amazon RDS (Relational Database Service) is a managed service for relational databases, handling tasks like patching, backups, and failover for engines such as MySQL, PostgreSQL, MariaDB, Oracle, and SQL Server. DynamoDB, by contrast, is a NoSQL database.

Which AWS service is a fully managed NoSQL key-value and document database that delivers single-digit millisecond performance at scale?

• a.Amazon Aurora
• b.Amazon Redshift
• c.Amazon RDS
• d.Amazon DynamoDB✓

Amazon DynamoDB is a fully managed NoSQL database offering fast, consistent performance at any scale with no servers to manage. It is well suited for high-traffic applications needing flexible schemas.

What is an AWS Region?

• a.A physical geographic area containing multiple, isolated Availability Zones✓
• b.A billing category for support plans
• c.A single building that houses one server rack
• d.A content delivery cache at the network edge

An AWS Region is a separate geographic area, each containing multiple Availability Zones. Customers choose Regions based on factors such as latency, data-residency requirements, and service availability.

What is an Availability Zone (AZ)?

• a.A type of EC2 instance
• b.A global DNS service
• c.One or more discrete data centers with redundant power and networking within a Region✓
• d.A billing report

An Availability Zone consists of one or more discrete data centers with independent power, cooling, and networking, isolated from failures in other AZs. Deploying across multiple AZs increases availability and fault tolerance.

Why should a highly available application be deployed across multiple Availability Zones?

• a.So the application can continue running if one AZ experiences a failure✓
• b.To reduce the AWS bill to zero
• c.Because a single AZ cannot run any instances
• d.To avoid using load balancers

Spreading resources across multiple AZs means that if one zone fails, the application can continue serving traffic from the others. AZs are physically isolated, so this design improves availability and fault tolerance.

Which service is a content delivery network (CDN) that caches content at edge locations to reduce latency for users?

• a.AWS Lambda
• b.Amazon CloudFront✓
• c.Amazon EBS
• d.Amazon RDS

Amazon CloudFront is a CDN that caches copies of content at edge locations around the world, delivering it to users from the nearest location to reduce latency. It integrates with services like S3 and load balancers as origins.

Which service automatically distributes incoming application traffic across multiple targets such as EC2 instances?

• a.Amazon S3
• b.Elastic Load Balancing (ELB)✓
• c.Amazon Route 53
• d.AWS Lambda

Elastic Load Balancing automatically spreads incoming traffic across multiple healthy targets, such as EC2 instances in different AZs. This improves fault tolerance and helps applications scale.

Which service automatically adjusts the number of EC2 instances to match demand based on defined policies?

• a.Amazon EC2 Auto Scaling✓
• b.AWS IAM
• c.Amazon S3
• d.Amazon CloudFront

EC2 Auto Scaling adds or removes instances automatically according to demand and your scaling policies, helping maintain performance while controlling cost. Combined with a load balancer, it supports elastic, resilient architectures.

Which storage service provides persistent block-level volumes that can be attached to EC2 instances?

• a.Amazon CloudFront
• b.Amazon EBS✓
• c.Amazon S3
• d.Amazon Route 53

Amazon EBS (Elastic Block Store) provides durable block storage volumes for use with EC2 instances, similar to a virtual hard disk. Volumes persist independently of the instance lifecycle and can be snapshotted to S3.

Which service provides scalable, shared file storage that multiple Linux EC2 instances can mount simultaneously?

• a.Amazon EFS✓
• b.Amazon S3 Glacier
• c.Amazon DynamoDB
• d.Amazon EBS

Amazon EFS (Elastic File System) is a managed, elastic NFS file system that many EC2 instances can mount concurrently. Unlike EBS, which attaches to a single instance at a time, EFS supports shared access.

Which AWS service is a scalable Domain Name System (DNS) web service used to route users to applications?

• a.Amazon CloudFront
• b.Amazon VPC
• c.Amazon Route 53✓
• d.AWS Direct Connect

Amazon Route 53 is a highly available and scalable DNS service that routes end users to applications by translating domain names into IP addresses. It also supports domain registration and health checks.

Which service lets you provision a logically isolated section of the AWS Cloud where you define your own IP ranges, subnets, and routing?

• a.AWS Lambda
• b.Amazon CloudWatch
• c.Amazon S3
• d.Amazon VPC✓

Amazon VPC (Virtual Private Cloud) lets you create an isolated virtual network in AWS where you control IP address ranges, subnets, route tables, and gateways. It gives you networking control similar to a traditional data center.

Which service provides monitoring and observability, collecting metrics, logs, and alarms for AWS resources and applications?

• a.Amazon CloudWatch✓
• b.Amazon Route 53
• c.Amazon Cognito
• d.AWS Artifact

Amazon CloudWatch collects metrics, logs, and events, and can trigger alarms and actions based on thresholds. It is the primary monitoring service for gaining operational visibility into AWS resources and applications.

Which service lets you model and provision AWS infrastructure as code using templates?

• a.Amazon CloudWatch
• b.AWS Shield
• c.Amazon Inspector
• d.AWS CloudFormation✓

AWS CloudFormation lets you define infrastructure in templates and provision it automatically and repeatably as 'stacks.' This infrastructure-as-code approach makes environments consistent and easy to replicate.

A developer wants to deploy a web application without manually configuring the underlying compute, load balancing, and scaling. Which service handles this?

• a.Amazon VPC
• b.Amazon S3
• c.AWS Elastic Beanstalk✓
• d.Amazon EC2

AWS Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, automatically handling capacity provisioning, load balancing, scaling, and health monitoring. Developers simply upload code while retaining control of the resources.

Which fully managed message queuing service decouples components by letting them send and receive messages asynchronously?

• a.Amazon CloudFront
• b.Amazon EFS
• c.Amazon SQS✓
• d.Amazon RDS

Amazon SQS (Simple Queue Service) is a managed message queue that lets application components communicate asynchronously, improving decoupling and resilience. Producers send messages to a queue and consumers process them independently.

Which service is a fully managed publish/subscribe messaging service used to send notifications to subscribers or other services?

• a.Amazon Redshift
• b.Amazon EBS
• c.Amazon Route 53
• d.Amazon SNS✓

Amazon SNS (Simple Notification Service) is a pub/sub messaging service that delivers messages to multiple subscribers such as email, SMS, or other AWS services. It is often used for fan-out notifications and event-driven architectures.

Which service is a fully managed data warehouse designed for running complex analytic queries over large datasets?

• a.Amazon SQS
• b.Amazon Redshift✓
• c.Amazon EFS
• d.Amazon DynamoDB

Amazon Redshift is a managed, petabyte-scale data warehouse optimized for analytical queries using columnar storage and parallel processing. It is designed for business intelligence workloads rather than transactional processing.

A company needs a dedicated, private network connection from its on-premises data center to AWS that bypasses the public internet. Which service should it use?

• a.Amazon CloudFront
• b.Amazon SNS
• c.AWS Direct Connect✓
• d.Amazon Route 53

AWS Direct Connect establishes a dedicated private network connection between on-premises and AWS, providing more consistent network performance than the public internet. It is often used for large data transfers and hybrid architectures.

Which option lets you create an encrypted connection over the public internet between your on-premises network and your VPC?

• a.An Elastic IP address
• b.Amazon CloudFront distribution
• c.AWS Site-to-Site VPN✓
• d.S3 Transfer Acceleration

AWS Site-to-Site VPN creates an encrypted tunnel over the internet between your network and your VPC. Unlike Direct Connect, it uses the public internet but is quick to set up and encrypted.

Which purchasing option is best for a fault-tolerant, flexible workload that can handle interruptions and wants the lowest EC2 price?

• a.Reserved Instances with no flexibility
• b.Dedicated Hosts
• c.On-Demand Instances
• d.Spot Instances✓

Spot Instances let you use spare EC2 capacity at steep discounts but can be reclaimed by AWS with short notice. They are ideal for fault-tolerant, flexible workloads such as batch processing.

Which AWS database service is MySQL- and PostgreSQL-compatible and offers higher performance and availability as part of RDS?

• a.Amazon ElastiCache
• b.Amazon DynamoDB
• c.Amazon Neptune
• d.Amazon Aurora✓

Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, offering greater throughput and built-in high availability compared to standard engines. It is part of the Amazon RDS family.

Which service provides in-memory caching to improve the performance of read-heavy applications, supporting engines like Redis and Memcached?

• a.Amazon ElastiCache✓
• b.Amazon EFS
• c.Amazon RDS
• d.Amazon Redshift

Amazon ElastiCache provides managed in-memory data stores using Redis or Memcached to reduce latency and offload databases. It is commonly used to cache frequently accessed data for faster reads.

Which S3 storage class is designed for long-term archival where retrieval times of minutes to hours are acceptable at very low cost?

• a.S3 Intelligent-Tiering
• b.S3 Standard
• c.S3 Standard-Infrequent Access
• d.S3 Glacier✓

The S3 Glacier storage classes are designed for low-cost, long-term archival where data is accessed rarely and some retrieval delay is acceptable. S3 Standard, by contrast, is for frequently accessed data with immediate retrieval.

Which S3 feature automatically moves objects between access tiers based on changing access patterns to optimize cost?

• a.S3 Intelligent-Tiering✓
• b.S3 Versioning
• c.S3 Cross-Region Replication
• d.S3 Transfer Acceleration

S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing storage costs without performance impact or operational overhead. It is useful when access patterns are unknown or changing.

A team wants to run Docker containers on AWS without managing the underlying EC2 servers. Which combination is most appropriate?

• a.Amazon ECS or EKS with AWS Fargate✓
• b.Amazon RDS with EBS
• c.Amazon Route 53 with CloudFront
• d.Amazon SNS with SQS

AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS, removing the need to provision or manage EC2 instances. It lets teams run containers while AWS handles the underlying infrastructure.

Which service can migrate large amounts of data into AWS by shipping a physical, ruggedized storage device when network transfer would be too slow?

• a.Amazon S3 Transfer Acceleration
• b.Amazon CloudFront
• c.AWS Direct Connect
• d.AWS Snowball✓

AWS Snowball is a physical data transport device used to move large datasets into or out of AWS when transferring over the network would take too long or be too costly. AWS ships the device, you load data, and return it for import.

Which statement correctly describes edge locations in the AWS global infrastructure?

• a.They replace Availability Zones
• b.They are where the root user signs in
• c.They are sites used to cache content closer to users, primarily for services like CloudFront✓
• d.They are used only for storing relational databases

Edge locations are part of the content delivery network and cache content closer to end users to reduce latency. They are distinct from Regions and Availability Zones, which host the core compute and storage infrastructure.

Which service allows you to register domain names and configure routing policies such as latency-based or weighted routing?

• a.Amazon EBS
• b.AWS CloudFormation
• c.Amazon Route 53✓
• d.Amazon VPC

Amazon Route 53 supports domain registration and advanced DNS routing policies, including latency-based, weighted, geolocation, and failover routing. This helps direct users to the best endpoint for their needs.

What is the main advantage of a serverless architecture using services like Lambda and DynamoDB?

• a.You focus on code and data while AWS manages provisioning and scaling of the infrastructure✓
• b.You pay a fixed monthly fee regardless of usage
• c.You must manually patch and scale servers
• d.You cannot integrate with other AWS services

Serverless services remove the need to provision, patch, and scale servers, letting developers focus on application logic while AWS handles the underlying infrastructure. Billing is typically based on actual usage rather than pre-provisioned capacity.

Which compute option provides physically dedicated servers for a customer, often used to meet licensing or compliance requirements?

• a.Amazon EC2 Dedicated Hosts✓
• b.Amazon S3
• c.Spot Instances
• d.AWS Lambda

Amazon EC2 Dedicated Hosts provide physical servers dedicated to a single customer, which can help address software licensing that is tied to physical cores or specific compliance needs. They give visibility and control over the underlying hardware.

Which support plan is the minimum required to get a designated Technical Account Manager (TAM) and concierge support?

• a.Business
• b.Enterprise✓
• c.Basic
• d.Developer

The Enterprise Support plan includes a designated Technical Account Manager and access to the concierge support team, along with the fastest response times. The Business plan offers 24/7 technical support but not a dedicated TAM.

Which AWS pricing model lets you pay for compute or database capacity by the hour or second with no long-term commitment?

• a.On-Demand pricing✓
• b.Spot pricing only
• c.Reserved Instance pricing
• d.Savings Plans only

On-Demand pricing charges for capacity by the hour or second with no upfront payment or long-term commitment, making it ideal for short-term or unpredictable workloads. Reserved Instances and Savings Plans trade commitment for lower prices.

Which purchasing option offers significant discounts in exchange for a one- or three-year commitment to a consistent amount of compute usage?

• a.Spot Instances
• b.Savings Plans✓
• c.Dedicated Hosts billed hourly
• d.On-Demand Instances

Savings Plans offer lower prices in return for committing to a consistent amount of compute usage (measured in dollars per hour) over a one- or three-year term. Reserved Instances offer a similar trade-off tied to specific instance attributes.

Which tool provides a free estimate of the cost of an AWS architecture before you deploy it?

• a.AWS Pricing Calculator✓
• b.AWS Cost and Usage Report
• c.AWS Cost Explorer
• d.AWS Budgets

The AWS Pricing Calculator lets you model a proposed architecture and estimate its monthly cost before deploying. Cost Explorer and the Cost and Usage Report, by contrast, analyze actual historical spend.

Which feature of AWS Organizations combines the usage of multiple accounts so they can share volume pricing discounts and receive a single bill?

• a.Consolidated billing✓
• b.Elastic Load Balancing
• c.Cross-Region replication
• d.Service control policies

Consolidated billing in AWS Organizations aggregates usage across member accounts into one bill and can qualify the group for volume discounts. It simplifies payment while still allowing per-account cost tracking.

Which service lets you set custom cost or usage thresholds and receive alerts when spending is forecast to exceed them?

• a.AWS CloudFormation
• b.AWS Budgets✓
• c.Amazon Inspector
• d.AWS Artifact

AWS Budgets lets you define custom budgets for cost or usage and receive alerts when actual or forecasted amounts exceed your thresholds. This helps teams proactively control spending.

Which tool helps you visualize, understand, and analyze your AWS costs and usage over time with graphs and filtering?

• a.AWS Trusted Advisor
• b.AWS Pricing Calculator
• c.AWS Config
• d.AWS Cost Explorer✓

AWS Cost Explorer provides an interface to visualize and analyze historical and forecasted costs and usage, with filtering and grouping. It helps identify spending trends and cost drivers.

Which statement about the AWS Free Tier is correct?

• a.It only applies to enterprise customers
• b.It offers some services free within limits, including 12-month, always-free, and short-term trial offers✓
• c.It makes all AWS services free forever
• d.It requires an Enterprise Support plan

The AWS Free Tier includes three types of offers: 12-month free tiers for new accounts, always-free offers, and short-term trials. Usage beyond the specified limits is billed at standard rates.

Which support plan provides 24/7 access to cloud support engineers by phone, chat, and email, and is often the minimum recommended for production workloads?

• a.Free Tier
• b.Basic
• c.Business✓
• d.Developer

The Business Support plan offers 24/7 access to support engineers via phone, chat, and email, plus full access to Trusted Advisor checks, making it suitable for production workloads. The Developer plan offers only business-hours email access to support.

Which detailed billing artifact provides the most comprehensive, line-item data about your AWS usage and can be delivered to an S3 bucket for analysis?

• a.AWS Pricing Calculator
• b.AWS Trusted Advisor
• c.AWS Artifact
• d.AWS Cost and Usage Report (CUR)✓

The AWS Cost and Usage Report provides the most detailed, comprehensive line-item billing data available and can be delivered to Amazon S3 for analysis. It is used for deep cost analysis and chargeback reporting.

How does tagging AWS resources help with billing and cost management?

• a.Tags automatically reduce the cost of resources
• b.Tags are required before any resource can be launched
• c.Tags let you categorize resources so costs can be tracked and allocated by project, team, or environment✓
• d.Tags encrypt billing data

Cost allocation tags let you label resources so their costs can be grouped and analyzed by dimensions such as project, department, or environment. This improves visibility and enables chargeback or showback.

In which support plans is the full set of AWS Trusted Advisor checks available?

• a.No support plan includes Trusted Advisor
• b.The Business and Enterprise plans✓
• c.Only the Basic plan
• d.Only the Developer plan

The full set of Trusted Advisor checks, covering cost optimization, security, fault tolerance, performance, and service limits, is available with Business and Enterprise Support. Basic and Developer plans include only a limited subset of checks.