AWS Cloud Practitioner — All Questions

Which statement best describes the primary financial benefit of moving from an on-premises data center to the AWS Cloud?

• a.It trades large upfront capital expenses for variable operating expenses that scale with usage✓
• b.It guarantees that monthly bills will never change month to month
• c.It eliminates all costs associated with running applications
• d.It removes the need to monitor how many resources you consume

Cloud computing lets organizations avoid large upfront investments in hardware (CapEx) and instead pay only for the resources they actually use (OpEx). This variable cost model scales up or down with demand. Costs are not eliminated, and usage should still be monitored.

A company can provision hundreds of servers in minutes and release them just as quickly when demand drops. Which cloud benefit does this describe?

• a.Fixed capacity planning
• b.Manual hardware procurement
• c.Agility and elasticity✓
• d.Long-term data-center leasing

Elasticity is the ability to acquire resources as you need them and release them when you no longer need them, in minutes rather than weeks. Combined with agility, this lets teams experiment and innovate faster than with traditional infrastructure.

Because AWS aggregates usage from hundreds of thousands of customers, it can pass lower per-unit prices on to each customer. What is this advantage called?

• a.Elastic load balancing
• b.Economies of scale✓
• c.Fault tolerance
• d.High availability

Massive aggregated usage lets AWS achieve higher economies of scale, which translates into lower pay-as-you-go pricing for customers. Individual organizations could not achieve the same purchasing power on their own.

Which of the following is a pillar of the AWS Well-Architected Framework?

• a.Vendor lock-in
• b.Operational excellence✓
• c.Marketing effectiveness
• d.Headcount reduction

The Well-Architected Framework has six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, and sustainability. Operational excellence focuses on running and monitoring systems to deliver business value.

Which Well-Architected pillar focuses on using computing resources efficiently and avoiding unnecessary spending?

• a.Operational excellence
• b.Security
• c.Reliability
• d.Cost optimization✓

The cost optimization pillar helps you run systems that deliver business value at the lowest price point, such as by choosing the right pricing model and eliminating idle resources. Reliability and security address different concerns.

A newer pillar of the AWS Well-Architected Framework addresses the long-term environmental impact of cloud workloads. Which pillar is this?

• a.Sustainability✓
• b.Compatibility
• c.Portability
• d.Scalability

Sustainability is the sixth pillar, added to help customers understand and minimize the environmental impacts of running cloud workloads. It encourages maximizing utilization and reducing the resources required.

What does the term 'high availability' mean for a system running in the cloud?

• a.The system remains operational and accessible for a very high percentage of time✓
• b.The system can only be accessed by administrators
• c.The system uses the cheapest possible resources
• d.The system stores data in a single location

High availability means a system is designed to stay up and reachable with minimal downtime, often by removing single points of failure. On AWS this is commonly achieved by spreading resources across multiple Availability Zones.

Which deployment model describes running some workloads on-premises while integrating with services in the AWS Cloud?

• a.Pure public cloud
• b.Serverless deployment
• c.Hybrid cloud✓
• d.Multi-region deployment

A hybrid deployment connects cloud resources with on-premises infrastructure, often used when data must remain local or during a gradual migration. A pure cloud model runs everything in the cloud.

Which of the following best defines scalability in the context of cloud computing?

• a.The ability of a system to handle increased load by adding resources✓
• b.The ability to restrict user permissions
• c.The ability to encrypt data at rest
• d.The ability to generate monthly invoices

Scalability is a system's capacity to grow to meet increased demand, either by adding more resources (horizontal) or larger resources (vertical). Elasticity extends this by automatically scaling in and out with demand.

A startup wants to launch a product globally without building data centers in each country. How does the AWS global infrastructure help?

• a.It lets the company deploy applications close to users in many geographic Regions✓
• b.It forces all traffic through one physical building
• c.It removes the ability to choose where data is stored
• d.It requires the company to pick a single country for all users

AWS operates Regions around the world, so companies can deploy applications near their users to reduce latency and meet local requirements. Customers choose which Regions to use for their workloads.

Which statement correctly contrasts vertical scaling with horizontal scaling?

• a.Both terms mean the same thing
• b.Vertical scaling increases the size of a single resource; horizontal scaling adds more resources✓
• c.Horizontal scaling only applies to databases
• d.Vertical scaling adds more instances; horizontal scaling makes an instance smaller

Vertical scaling (scaling up) increases the capacity of an individual resource, such as moving to a larger instance type. Horizontal scaling (scaling out) adds more resources, such as more instances behind a load balancer.

Which characteristic of cloud computing allows a developer to obtain compute and storage resources without human interaction with the provider?

• a.On-demand self-service✓
• b.Measured billing
• c.Resource pooling
• d.Broad network access

On-demand self-service means users can provision resources automatically through a console or API whenever needed, without contacting the provider. This is a defining feature of cloud computing.

How does the cloud improve an organization's ability to experiment and innovate?

• a.Low-cost, fast provisioning lowers the risk and cost of trying new ideas✓
• b.It mandates that every experiment run in a physical lab
• c.It prevents teams from deleting resources
• d.It requires a multi-year commitment before any test can begin

Because resources can be spun up quickly and released when done, the cost of failure is low. Teams can test ideas rapidly and shut them down without wasted hardware, encouraging innovation.

Which Well-Architected pillar is primarily concerned with a workload's ability to recover from failures and meet demand?

• a.Performance efficiency
• b.Reliability✓
• c.Cost optimization
• d.Sustainability

The reliability pillar focuses on ensuring a workload performs its intended function correctly and consistently, including recovering from disruptions and dynamically acquiring resources to meet demand.

A company no longer wants to spend time racking, stacking, and powering servers so it can focus on its customers. Which cloud value proposition does this reflect?

• a.Stop spending money running and maintaining data centers✓
• b.Paying more for less capacity
• c.Increasing time spent on undifferentiated tasks
• d.Guaranteeing zero latency worldwide

A key benefit of cloud is to stop spending money on the undifferentiated heavy lifting of running data centers and instead focus on projects that differentiate the business, such as serving customers.

Which cloud computing service model provides virtualized computing resources such as servers, storage, and networking that the customer manages?

• a.Infrastructure as a Service (IaaS)✓
• b.Software as a Service (SaaS)
• c.Platform as a Service (PaaS)
• d.Function as a Service

IaaS provides the fundamental building blocks of cloud IT (compute, storage, networking) and gives the customer the most control over the resources. SaaS delivers a finished application, while PaaS manages the underlying infrastructure for you.

Which of the following is an example of the Software as a Service (SaaS) model?

• a.A raw block storage volume
• b.A bare virtual machine you must configure yourself
• c.A physical network switch
• d.A ready-to-use, web-based email application✓

SaaS delivers a complete, managed application that the customer simply uses, such as web-based email. The provider handles the underlying infrastructure, platform, and application maintenance.

What is meant by 'loose coupling' as an architectural best practice in the cloud?

• a.Designing components so a failure in one has limited impact on others✓
• b.Making every component depend directly on every other component
• c.Running all code on a single large server
• d.Avoiding the use of any managed services

Loosely coupled architectures reduce interdependencies so that a change or failure in one component does not cascade to others. Services like queues and load balancers help decouple components and improve resilience.

Which benefit describes AWS's ability to go global in minutes by deploying an application in multiple Regions?

• a.Mandatory single-Region hosting
• b.Increased speed and reach for a global user base✓
• c.Reduced encryption strength
• d.Elimination of all networking costs

Deploying across multiple Regions lets you place workloads closer to users worldwide, lowering latency and improving experience. This global reach can be achieved quickly without building physical infrastructure.

Which Well-Architected design principle encourages testing systems at production scale and automating to make experimentation easier?

• a.Keeping one large monolith
• b.Avoiding failure testing
• c.Automate to make architectural experimentation easier✓
• d.Manually provisioning all infrastructure

Well-Architected design principles include automating with infrastructure as code, testing at production scale, and designing for failure. Automation makes it low-cost to create and replicate environments for experimentation.

How does elasticity help a retailer that experiences large traffic spikes during holiday sales?

• a.Capacity automatically scales out during spikes and scales in afterward, matching cost to demand✓
• b.The retailer must manually order servers weeks ahead of each sale
• c.Traffic spikes cause the application to be permanently oversized
• d.Capacity is fixed at the peak level all year, wasting money off-season

Elasticity lets the retailer add capacity during peak periods and remove it when demand falls, so they pay only for what they need. This avoids both over-provisioning year-round and under-provisioning during spikes.

Which statement about the AWS shared model of benefits is correct regarding speed and agility?

• a.Agility means resources can never be released
• b.Agility refers only to how fast invoices are generated
• c.New IT resources are always available only after a multi-week procurement cycle
• d.In the cloud, new IT resources are a click away, reducing the time to make them available to developers✓

Cloud agility means developers can obtain new resources almost instantly instead of waiting weeks for hardware. This dramatically reduces the time and cost of making resources available, accelerating projects.

Which of the following best describes 'fault tolerance' in a cloud architecture?

• a.The system charges customers only for faults
• b.The system stores only a single copy of data
• c.The system requires manual restart after any error
• d.The system continues operating properly even when some components fail✓

Fault tolerance is the ability of a system to keep running correctly despite the failure of one or more of its components, often through redundancy. It is closely related to, but stronger than, high availability.

Which Well-Architected pillar focuses on using computing resources efficiently to meet requirements and maintaining efficiency as demand changes and technologies evolve?

• a.Cost optimization
• b.Security
• c.Performance efficiency✓
• d.Reliability

The performance efficiency pillar is about using computing resources efficiently to meet system requirements and sustaining that efficiency as demand shifts and technologies advance. It encourages selecting the right resource types and reviewing them over time.

Under the AWS shared responsibility model, which of the following is AWS responsible for?

• a.Encrypting the customer's application data at rest
• b.Physical security of the data centers and the hardware running the cloud✓
• c.Managing the customer's IAM user passwords
• d.Configuring security groups on the customer's EC2 instances

AWS is responsible for security 'of' the cloud, which includes the physical facilities, hardware, and the global infrastructure. Customers are responsible for security 'in' the cloud, such as configuring security groups, managing IAM, and protecting their data.

Under the shared responsibility model, which task is the customer responsible for?

• a.Replacing failed physical disks in the data center
• b.Maintaining the hypervisor that isolates instances
• c.Managing operating-system patches on their EC2 instances✓
• d.Securing the physical network cabling

For services like EC2, the customer manages the guest operating system, including patching, along with application software and firewall configuration. AWS handles the underlying physical and virtualization infrastructure.

Which AWS service is used to create users, groups, and roles and to control their permissions to AWS resources?

• a.Amazon Macie
• b.AWS Identity and Access Management (IAM)✓
• c.AWS Shield
• d.Amazon Cognito

IAM lets you manage authentication and authorization for AWS by creating users, groups, and roles and attaching policies that grant or deny access. It is the primary service for controlling who can do what in an account.

What is the AWS best practice for the root user of an AWS account?

• a.Share its credentials with the whole team
• b.Delete it immediately after account creation
• c.Enable MFA on it and avoid using it for everyday tasks✓
• d.Use it for all daily administrative tasks

The root user has unrestricted access, so AWS recommends securing it with multi-factor authentication and using it only for the few tasks that require it. Everyday work should be done with IAM users or roles that follow least privilege.

Which security measure adds a second form of verification, such as a code from a device, when signing in to AWS?

• a.An Elastic IP address
• b.Multi-factor authentication (MFA)✓
• c.A larger instance type
• d.A public S3 bucket policy

MFA requires users to present an additional authentication factor, such as a one-time code from a hardware or virtual device, beyond their password. This significantly reduces the risk of compromised credentials.

An application running on an EC2 instance needs to read objects from an S3 bucket. What is the recommended way to grant this access?

• a.Embed long-term access keys in the application code
• b.Attach an IAM role to the EC2 instance✓
• c.Share the root user credentials with the instance
• d.Make the S3 bucket public

Attaching an IAM role to the EC2 instance provides temporary, automatically rotated credentials to the application, avoiding hard-coded keys. This follows the principle of least privilege and is far more secure than embedding static keys.

Which principle recommends granting users only the permissions they need to perform their tasks and nothing more?

• a.Elastic provisioning
• b.Defense in depth
• c.Separation of billing
• d.Least privilege✓

The principle of least privilege means giving identities only the minimum permissions required for their job. This limits the potential impact if credentials are compromised or misused.

Which AWS service provides a managed distributed denial-of-service (DDoS) protection for applications running on AWS?

• a.AWS Shield✓
• b.Amazon Inspector
• c.AWS Config
• d.Amazon Macie

AWS Shield is a managed DDoS protection service. Shield Standard is automatically included at no extra cost, while Shield Advanced offers enhanced protection and support for an additional fee.

Which service helps protect web applications from common exploits such as SQL injection and cross-site scripting by filtering HTTP requests?

• a.Amazon Route 53
• b.AWS Trusted Advisor
• c.AWS WAF (Web Application Firewall)✓
• d.AWS Budgets

AWS WAF lets you create rules to filter and monitor HTTP and HTTPS requests, blocking common web exploits like SQL injection and cross-site scripting. It can be attached to services such as CloudFront, ALB, and API Gateway.

Which service uses machine learning to automatically discover and classify sensitive data such as personally identifiable information stored in Amazon S3?

• a.AWS Shield
• b.Amazon Macie✓
• c.Amazon GuardDuty
• d.AWS WAF

Amazon Macie uses machine learning and pattern matching to discover and protect sensitive data, such as PII, in S3. It helps organizations understand where sensitive data resides and monitor its security.

Which service continuously monitors for malicious activity and unauthorized behavior using account and network telemetry such as CloudTrail and VPC flow logs?

• a.AWS Certificate Manager
• b.AWS Artifact
• c.Amazon Cognito
• d.Amazon GuardDuty✓

Amazon GuardDuty is a threat detection service that continuously analyzes logs such as CloudTrail, VPC flow logs, and DNS logs to identify suspicious activity. It generates findings without requiring you to deploy or manage sensors.

Which AWS service records API calls and account activity, providing an audit trail of who did what and when?

• a.Amazon CloudFront
• b.AWS CloudTrail✓
• c.AWS Config
• d.Amazon Inspector

AWS CloudTrail logs API calls and account events across your AWS infrastructure, creating an audit trail useful for governance, compliance, and operational troubleshooting. It answers questions about who made a change and when.

Which service continuously assesses your resource configurations and can evaluate them against desired settings for compliance?

• a.AWS Config✓
• b.AWS WAF
• c.Amazon Macie
• d.AWS Shield

AWS Config records the configuration of your AWS resources over time and can evaluate them against rules to check compliance. It is useful for auditing changes and maintaining a desired configuration state.

Which service provides on-demand access to AWS compliance reports and agreements such as SOC and PCI documents?

• a.AWS Config
• b.AWS Artifact✓
• c.Amazon GuardDuty
• d.Amazon Inspector

AWS Artifact is a self-service portal for on-demand access to AWS security and compliance reports, such as SOC reports and PCI documentation, and to agreements like the Business Associate Addendum. It helps customers meet their own audit requirements.

Which service creates, manages, and controls cryptographic keys used to encrypt data across AWS services?

• a.AWS Key Management Service (KMS)✓
• b.Amazon Cognito
• c.AWS CloudHSM only
• d.AWS WAF

AWS KMS lets you create and manage encryption keys and integrates with many AWS services to encrypt data at rest. It centralizes key management and controls who can use keys through IAM and key policies.

Which service securely stores and automatically rotates database credentials, API keys, and other secrets?

• a.AWS Secrets Manager✓
• b.AWS Artifact
• c.Amazon Macie
• d.AWS Config

AWS Secrets Manager helps you store, retrieve, and automatically rotate secrets such as database credentials and API keys. It removes the need to hard-code sensitive values in application code.

Which service scans EC2 instances and container images for software vulnerabilities and unintended network exposure?

• a.AWS Artifact
• b.Amazon Inspector✓
• c.AWS Shield
• d.Amazon Cognito

Amazon Inspector is an automated vulnerability management service that continuously scans workloads such as EC2 instances and container images for software vulnerabilities and network exposure. It prioritizes findings to help teams remediate risks.

Which service provides sign-up, sign-in, and access control for web and mobile application users, including identity federation?

• a.AWS IAM
• b.AWS Shield
• c.Amazon Cognito✓
• d.AWS KMS

Amazon Cognito provides authentication, authorization, and user management for web and mobile apps, including social and enterprise identity federation. IAM, by contrast, manages access for people and services operating on AWS itself.

In a VPC, which stateful virtual firewall controls inbound and outbound traffic at the instance level?

• a.Network access control list (NACL)
• b.Route table
• c.Security group✓
• d.Internet gateway

A security group acts as a stateful firewall at the instance (ENI) level, where return traffic is automatically allowed. NACLs, by contrast, are stateless firewalls that operate at the subnet level.

Which statement about network ACLs (NACLs) is correct?

• a.They are stateful and automatically allow return traffic
• b.They are attached directly to individual instances
• c.They are stateless and operate at the subnet level with allow and deny rules✓
• d.They can only allow traffic and never deny it

NACLs are stateless firewalls that operate at the subnet boundary and support both allow and deny rules, evaluated in order. Because they are stateless, you must explicitly allow both request and response traffic.

A company wants to centrally manage multiple AWS accounts and apply guardrails that restrict which services accounts can use. Which combination helps?

• a.A single shared IAM user across all accounts
• b.AWS Organizations with service control policies (SCPs)✓
• c.Route 53 health checks
• d.Amazon Macie with WAF rules

AWS Organizations lets you centrally manage many accounts, and service control policies set the maximum permissions available to member accounts. This provides guardrails without granting individual permissions.

What does 'encryption in transit' protect?

• a.Data stored on an EBS volume
• b.Data archived in Amazon S3 Glacier
• c.Data printed to a physical report
• d.Data as it moves between a client and a server over the network✓

Encryption in transit protects data while it travels across networks, typically using TLS, so it cannot be read if intercepted. Encryption at rest, by contrast, protects stored data.

Which AWS service can be used to provision and manage SSL/TLS certificates for use with AWS services like load balancers and CloudFront?

• a.AWS Certificate Manager (ACM)✓
• b.AWS Config
• c.AWS Secrets Manager
• d.Amazon Inspector

AWS Certificate Manager provisions, manages, and deploys public and private SSL/TLS certificates, and can handle automatic renewal. This simplifies enabling encryption in transit for supported services.

Which of the following is an IAM best practice?

• a.Disable MFA to simplify sign-in
• b.Use the root account for daily API calls
• c.Attach permissions directly to each individual user
• d.Grant permissions using groups and roles rather than long-term keys where possible✓

IAM best practices include using groups and roles to manage permissions, applying least privilege, enabling MFA, and rotating or avoiding long-term credentials. Managing permissions through groups scales better than per-user policies.

Which service aggregates security findings from services like GuardDuty, Inspector, and Macie into a single dashboard and runs automated best-practice checks?

• a.AWS Security Hub✓
• b.AWS Direct Connect
• c.Amazon CloudFront
• d.AWS Trusted Advisor

AWS Security Hub provides a comprehensive view of security state by aggregating and prioritizing findings from multiple AWS security services and running automated compliance checks. It helps teams manage security posture from one place.

A customer stores objects in Amazon S3 and wants AWS to manage the encryption keys and apply encryption automatically. Which option fits?

• a.Only encrypt data after downloading it locally
• b.Server-side encryption with keys managed by AWS (SSE)✓
• c.Disable encryption entirely
• d.Store keys in the application source code

Server-side encryption lets AWS encrypt object data at rest, with key management handled by S3 or KMS. This provides encryption at rest without the customer having to build their own encryption process.