AWS Cloud Practitioner — All Questions

Which reliability design principle uses monitoring to trigger remediation from failure?

• a.Avoid horizontal scaling
• b.Test only in production without monitoring
• c.Automatically recover from failure✓
• d.Provision infrastructure manually

Reliability best practices include automatically recovering from failure by monitoring key indicators and triggering remediation.

Which performance-efficiency practice involves trying new instance types, storage, or services to find the best fit?

• a.Never change the initial choice
• b.Always buy the largest resource
• c.Experiment more often using on-demand resources✓
• d.Always provision the largest possible instances regardless of the workload

Performance efficiency encourages experimenting with different resource types and configurations to keep matching technology to the workload.

Which of the following is one of the six advantages of cloud computing described by AWS?

• a.Eliminate all customer security responsibilities entirely
• b.Guarantee zero downtime and zero failures forever
• c.Remove the need to write any application code
• d.Benefit from economies of scale✓

The six advantages include economies of scale, trading capital for variable expense, stopping capacity guessing, increasing agility, avoiding data-center spend, and going global in minutes.

Which is a common reason an organization adopts a hybrid cloud model?

• a.To keep some data on-premises for latency or compliance✓
• b.To avoid using any AWS or cloud services whatsoever
• c.To eliminate its corporate network infrastructure completely
• d.To intentionally make all of its data publicly accessible online

Hybrid architectures keep sensitive or latency-critical workloads on-premises while extending to the cloud for scale and new capabilities.

Running an application entirely on AWS with no on-premises components is best described as which deployment model?

• a.Multi-tenant colocation
• b.Hybrid
• c.Cloud (all-in)✓
• d.On-premises

A cloud (or all-in) deployment runs entirely in the cloud, versus hybrid (mixed) or on-premises (private) models.

What is a key benefit of choosing AWS managed services over self-managing the same software?

• a.You must manually patch the underlying operating system yourself
• b.You permanently lose the ability to scale the workload
• c.You must give up all encryption and data-protection options
• d.AWS handles patching, backups, and scaling for you✓

Managed services offload operational heavy lifting so teams focus on business logic instead of infrastructure.

The AWS CAF describes transformation across domains such as technology, process, organization, and what else?

• a.Product✓
• b.Geography
• c.Weather
• d.Currency

The CAF identifies four transformation domains: technology, process, organization, and product.

Turning off non-production environments (like dev and test) outside business hours is an example of what?

• a.A reduction in the security posture of the account
• b.The migration strategy formally known as Retire
• c.Cost optimization by cutting idle-resource spend✓
• d.A deliberate increase in capital expenditure over time

Shutting down idle resources aligns spend with actual need, a core cost-optimization tactic enabled by the cloud's on-demand model.

Which AWS tool lets you review your workloads against Well-Architected best practices and get improvement guidance?

• a.AWS Snowball
• b.AWS Pricing Calculator
• c.AWS Well-Architected Tool✓
• d.Amazon Inspector

The AWS Well-Architected Tool guides you through questions per pillar, identifies risks, and recommends improvements for your workloads.

How does increased agility from the cloud create business value?

• a.By helping teams deliver features and adapt faster✓
• b.By locking every team into fixed annual infrastructure plans
• c.By requiring substantially more upfront hardware capacity planning
• d.By deliberately slowing product releases for extra safety review

Agility lets organizations experiment, iterate, and ship faster, turning IT speed into competitive advantage.

Which statement about the AWS global infrastructure is accurate?

• a.A single Availability Zone spans several different Regions
• b.Each Region is made up of exactly one single data center
• c.Regions each contain multiple Availability Zones✓
• d.Edge locations fully replace Availability Zones for compute

The infrastructure is Regions (geographic areas) containing Availability Zones (isolated data-center clusters), plus a large network of edge locations.

A European company must keep customer data within the EU. What does the AWS global infrastructure let it do?

• a.Store all of its data exclusively at network edge locations
• b.Rely entirely on AWS to choose the Region on their behalf
• c.Automatically relocate data anywhere in the world for speed
• d.Select an EU Region so data resides there✓

Customers control which Region stores their data, so they can meet data-residency and compliance requirements by choosing an in-region location.

Compared with communication between two AWS Regions, communication between Availability Zones in the same Region generally has what?

• a.Higher latency
• b.Identical latency to cross-continent links
• c.Lower latency✓
• d.No connectivity at all

AZs in a Region are linked by high-bandwidth, low-latency networking, so intra-Region AZ traffic is faster than cross-Region traffic.

Choosing a Region powered by renewable energy and consolidating workloads to raise utilization supports which pillar?

• a.Sustainability✓
• b.Cost optimization only
• c.Security
• d.Reliability

The sustainability pillar considers environmental impact, including selecting efficient Regions and maximizing utilization.

The AWS CAF describes a transformation journey with phases such as Envision, Align, Launch, and what?

• a.Refactor
• b.Retire
• c.Scale✓
• d.Rehost

The CAF transformation phases are Envision, Align, Launch, and Scale, moving from identifying opportunities to delivering and then expanding cloud value.

Removing 'undifferentiated heavy lifting' primarily allows an organization to do what?

• a.Substantially increase its data-center operations staffing
• b.Spend considerably more time managing physical server hardware
• c.Focus more on work that differentiates the business✓
• d.Deliberately slow the pace of product development work

Offloading commodity infrastructure work lets teams invest effort in the products and features that set the business apart.

Auto Scaling combined with pay-as-you-go pricing primarily helps a business achieve what?

• a.Fixed spending regardless of demand
• b.Cost that closely follows actual demand✓
• c.Permanent over-provisioning of capacity
• d.Guaranteed lowest price only for reserved terms

Elastic scaling with usage-based pricing means you provision to match demand, so cost rises and falls with real usage rather than a fixed peak.

Which operational-excellence practice reduces risk when improving a system?

• a.Never test any changes before releasing to users
• b.Change every component simultaneously in production
• c.Deploy large, infrequent changes all at once each quarter
• d.Make small, reversible changes often✓

Frequent, small, reversible changes limit blast radius and make it easy to roll back.

Which design increases the risk to reliability?

• a.Automating detection and recovery from failures
• b.Using a load balancer in front of several healthy targets
• c.Relying on one server with no redundancy✓
• d.Distributing the workload across multiple Availability Zones

A single point of failure with no redundancy undermines reliability; distributing across AZs and automating recovery are the recommended alternatives.

Which of the following is NOT a benefit of cloud computing as described by AWS?

• a.The ability to deploy and go global within minutes
• b.Removing the customer's duty to secure their own data✓
• c.Increased overall speed and business agility in delivery
• d.Trading upfront capital expense for variable operating expense

Security is a shared responsibility; customers always remain responsible for securing their data. The others are genuine cloud benefits.

Under the shared responsibility model, AWS is responsible for 'security ___ the cloud,' while the customer is responsible for 'security ___ the cloud.'

• a.around; through
• b.of; of
• c.in; of
• d.of; in✓

AWS secures the cloud infrastructure ('of the cloud'); customers secure what they put in it ('in the cloud'), including data, configuration, and access.

Which of these is always the customer's responsibility regardless of which AWS service is used?

• a.Managing their data, including classification and encryption choices✓
• b.Securing the global network backbone
• c.Maintaining the physical data-center hardware
• d.Maintaining the physical data-center hardware and the underlying hypervisor software

The customer always owns their data and its protection; AWS never assumes responsibility for how customers classify, encrypt, or grant access to data.

For Amazon S3, which security task remains with the customer under the shared responsibility model?

• a.Replacing failed physical storage drives
• b.Configuring bucket policies, access controls, and encryption settings✓
• c.Maintaining the storage facility power
• d.Replacing failed physical storage drives and maintaining the facility power and cooling

With S3, AWS manages the infrastructure and service, but customers must configure access (bucket policies, Block Public Access, IAM) and choose encryption.

Under the shared responsibility model, patching the guest operating system on an EC2 instance is whose responsibility?

• a.AWS's alone
• b.The Region operator's
• c.The customer's✓
• d.No one's; it is fully automatic

For EC2 (IaaS), the customer manages the guest OS, including patches; AWS manages the hypervisor and physical host.

For a fully managed service like AWS Lambda, how does the customer's responsibility differ from EC2?

• a.The customer must patch the underlying servers themselves
• b.The customer must patch the underlying servers, manage the hypervisor, and secure the physical hosts
• c.AWS manages the OS and runtime patching; the customer focuses on code and permissions✓
• d.Responsibility is identical to on-premises hosting

The more managed the service, the more AWS handles; for Lambda, AWS patches the OS and runtime, leaving code, data, and IAM to the customer.

Configuring a security group to restrict inbound traffic to an EC2 instance is whose responsibility?

• a.Shared equally with the ISP
• b.The hardware vendor's
• c.AWS's
• d.The customer's✓

Firewall configuration such as security groups is part of security 'in the cloud,' which the customer controls.

Which task belongs to AWS under the shared responsibility model?

• a.Setting IAM password policies
• b.Encrypting customer application data
• c.Setting IAM password policies and configuring multi-factor authentication for every user
• d.Physical and environmental controls of data centers✓

AWS is responsible for the physical facilities, hardware, and environmental controls; identity and data-protection choices are the customer's.

Who is responsible for the durability of the underlying Amazon S3 infrastructure?

• a.A third-party auditor
• b.The customer
• c.The end user
• d.AWS✓

AWS manages and is responsible for the resilient infrastructure delivering S3's durability; the customer secures what they store and how access is granted.

Which statement about the shared responsibility model is TRUE?

• a.The customer is responsible for everything in all cases
• b.AWS is responsible for everything in all cases
• c.The exact split depends on the specific AWS service being used✓
• d.AWS is responsible for absolutely everything, including the customer's own data and access controls

Responsibility shifts by service type: IaaS puts more on the customer, while managed and serverless services shift more to AWS.

Encrypting sensitive data before storing it and controlling who can access it is an example of which side of the model?

• a.Security of the cloud, which is understood to be entirely AWS's responsibility in every case
• b.Neither party's responsibility
• c.Security in the cloud (customer)✓
• d.The Region's responsibility

Data-protection choices such as encryption and access control are the customer's responsibility, 'in the cloud.'

Who is responsible for decommissioning and physically destroying failed storage media in AWS data centers?

• a.The account's IAM administrator
• b.The customer
• c.The customer's external auditor
• d.AWS✓

AWS handles secure decommissioning and physical destruction of storage media as part of securing the infrastructure.

In the shared responsibility model, which control do customers 'inherit' from AWS?

• a.Customer IAM policy design and the configuration of every security group and network ACL
• b.Customer data classification
• c.Physical and environmental data-center controls✓
• d.Application-level input validation

Customers inherit physical and environmental controls from AWS's audited data centers while retaining responsibility for their own configurations and data.

Why is assuming AWS automatically encrypts all of your data by default in every service a risky assumption?

• a.AWS charges a fee to decrypt customer data
• b.AWS forbids customers from using encryption
• c.Customers must often enable and configure encryption themselves✓
• d.AWS strictly forbids customers from applying any form of encryption to their stored data

While many services make encryption easy, enabling and configuring it is frequently the customer's responsibility; assuming it is automatic can leave data unprotected.

Which is a customer responsibility for identity and access management?

• a.Maintaining the servers that run the IAM service
• b.Creating least-privilege IAM policies and enabling MFA✓
• c.Maintaining the physical servers and networking hardware that run the global IAM service
• d.Patching the AWS Management Console backend

Customers configure IAM (users, groups, roles, policies, MFA) following least privilege; AWS operates the IAM service itself.

Configuring security groups, network ACLs, and encryption in transit for your workloads is classified as what?

• a.Something outside the model
• b.A customer responsibility in the cloud✓
• c.A responsibility that belongs entirely to AWS as part of securing the underlying infrastructure
• d.A responsibility of the DNS provider

Configuring network protection (firewalls, NACLs, TLS) for customer workloads is the customer's job, part of security in the cloud.

What are the three main types of identities you can create and manage in IAM?

• a.Stacks, templates, and drifts
• b.Regions, zones, and edges
• c.Users, groups, and roles✓
• d.Buckets, objects, and keys

IAM manages users (people or apps with long-term credentials), groups (collections of users), and roles (assumed temporarily for short-term credentials).

What is an IAM group?

• a.A collection of IAM users that share the same permissions policies✓
• b.A temporary set of credentials for applications
• c.A billing category for grouping resources
• d.A temporary set of automatically rotating credentials issued to applications and services

An IAM group lets you attach policies once and apply them to all member users; groups cannot be nested and cannot sign in.

Which statement about IAM groups is correct?

• a.Groups have their own sign-in credentials
• b.Groups can be nested inside other groups to build arbitrarily deep permission hierarchies
• c.A user can belong to multiple groups, but groups cannot contain other groups✓
• d.Groups can be nested inside other groups

Users can be members of many groups, but IAM groups cannot be nested and have no credentials of their own.

What does an IAM policy define?

• a.The physical location of the data center and the specific rack that hosts the resource
• b.The physical location of a data center
• c.The billing plan for an account
• d.Which actions are allowed or denied on which resources✓

IAM policies are JSON documents that grant or deny permissions for specific actions and resources, and are attached to users, groups, or roles.

By default, when a new IAM user is created, what permissions do they have?

• a.Full administrator access across every service and resource in the entire account
• b.None until permissions are explicitly granted✓
• c.Root-equivalent permissions
• d.Read access to all services

IAM follows an implicit deny: new users have no permissions until policies granting access are attached, embodying least privilege.

When an explicit deny and an explicit allow both apply to a request, what happens?

• a.The request is decided at random
• b.The explicit allow always wins
• c.Both are ignored and access errors out
• d.The explicit deny always wins✓

In IAM policy evaluation, an explicit deny overrides any allow; access is granted only if allowed and not explicitly denied.

What is the benefit of using an IAM role for cross-account access instead of sharing credentials?

• a.It disables logging between the accounts
• b.Trusted identities assume the role for temporary access without sharing long-term keys✓
• c.It makes both accounts share one root password
• d.It makes both accounts permanently share a single root password and set of access keys for all users

A role with a trust policy lets identities from another account assume it and receive temporary credentials, avoiding shared long-term keys.

Which IAM mechanism delivers temporary, automatically rotating credentials to an application running on an EC2 instance?

• a.The root user's console password
• b.An instance profile that provides role credentials✓
• c.A hard-coded access key file on disk
• d.A hard-coded, long-term access key file stored directly on the instance's local disk

Attaching a role via an instance profile gives the application temporary credentials from instance metadata, rotated automatically, with no static keys.

Why is multi-factor authentication (MFA) recommended for AWS sign-in?

• a.It completely replaces the need for any password when a user signs in to the account
• b.It grants administrator access faster
• c.It encrypts data at rest automatically
• d.A stolen password alone cannot grant access without the second factor✓

MFA adds a second verification factor (a device code or hardware key), so a compromised password by itself cannot be used to sign in.

Which is an IAM best practice for the AWS account root user?

• a.Create access keys with it for automation
• b.Use it for all daily administrative work
• c.Enable MFA and use it only for the few tasks that require it✓
• d.Use it for all daily administrative work and for routine automation and deployment scripts

The root user should be protected with MFA and used only for the rare tasks that require it; daily work uses least-privilege IAM identities.

Which type of IAM policy is created and maintained by AWS to cover common use cases?

• a.Customer managed policies
• b.Session policies
• c.Inline policies
• d.AWS managed policies✓

AWS managed policies are predefined by AWS for common permission sets; customer managed and inline policies are created by you for finer control.

What is an inline policy in IAM?

• a.A policy embedded directly in a single user, group, or role✓
• b.A policy that only ever affects billing data and cost-allocation reports for the account
• c.A policy shared across all Regions by default
• d.A policy AWS applies to every account automatically

An inline policy is attached to and lives with one specific identity, maintaining a strict one-to-one relationship rather than being reusable.

Which approach best follows least privilege when granting a developer access?

• a.Grant full administrator access for convenience and to avoid any future permission requests
• b.Grant only the specific permissions the developer's tasks require✓
• c.Grant full administrator access for convenience
• d.Give access to every service just in case

Least privilege means granting only the permissions needed for the job, reducing risk if credentials are compromised.

How does AWS IAM Identity Center (successor to AWS SSO) help organizations?

• a.It stores objects for static websites
• b.It removes the need for any encryption
• c.It centrally manages workforce sign-in and access across multiple AWS accounts✓
• d.It stores and serves static website objects and media files from edge locations worldwide

IAM Identity Center provides centralized single sign-on and permission management across many AWS accounts and applications.

What is the recommended alternative to long-term access keys for programmatic access where possible?

• a.Sharing the console password widely
• b.Publishing keys in code repositories
• c.Temporary credentials from IAM roles✓
• d.Using the root user's access keys

Roles provide short-lived credentials that expire automatically, reducing exposure compared with long-term access keys that persist until rotated.