The short answer
CLF-C02 is 65 questions in 90 minutes with a 700/1000 passing score, and it is the broadest of the AWS exams - it tests the whole cloud vocabulary rather than deep configuration. The questions below come from our 981-question CLF-C02 bank, covering all four domains, with the answer and an explanation for each.
CLF-C02 exam facts
| Questions | 65 (multiple choice and multiple response) |
| Time limit | 90 minutes |
| Passing score | 700 / 1000 |
| Cost | $100 USD |
| Delivery | Pearson VUE test centre or online proctored |
| Prerequisites | None - this is the entry-level AWS certification |
What the exam covers, domain by domain
| Domain |
Weight |
What it tests |
| Domain 1 - Cloud Concepts | 24% | Cloud value proposition, the AWS Well-Architected Framework, migration and economics. |
| Domain 2 - Security and Compliance | 30% | The shared responsibility model, IAM, security services, compliance and governance. |
| Domain 3 - Cloud Technology and Services | 34% | The largest domain: compute, storage, database, networking and analytics services. |
| Domain 4 - Billing, Pricing and Support | 12% | Pricing models, cost tools, support plans and the billing console. |
20 free CLF-C02 exam questions with answers
Real questions from our 981-question CLF-C02 bank, spread across every domain. The correct
answer is marked and every question carries an explanation, so you can check the reasoning and not just the result.
The interactive mocks serve the full bank, timed and scaled-scored.
Question 1
Domain 1: Cloud Concepts
Choose 2
A company wants to build a resilient application on AWS. Which TWO actions align with the design principle of 'design for failure'? (Select TWO.)
-
○ Deploy instances in a single Availability Zone
-
✓ Use Amazon S3 for durable storage
-
✓ Implement health checks and auto-recovery
-
○ Rely on manual intervention for failures
-
○ Use synchronous communication between all services
Answer:
B. Use Amazon S3 for durable storage | C. Implement health checks and auto-recovery
Amazon S3 provides durable storage with high availability, and health checks with auto-recovery (e.g., using Amazon EC2 Auto Scaling) handle failures automatically. Deploying in a single AZ reduces resilience, manual intervention is not automated, and synchronous communication can increase failure risk.
Question 2
Domain 2: Security and Compliance
Choose 2
Which of the following are characteristics of the AWS shared responsibility model? (Select TWO.)
-
✓ AWS is responsible for security of the cloud.
-
○ The customer is responsible for physical security of data centers.
-
✓ The customer is responsible for security in the cloud.
-
○ AWS is responsible for customer data.
-
○ Responsibility is split based on the service type (e.g., IaaS, PaaS).
Answer:
A. AWS is responsible for security of the cloud. | C. The customer is responsible for security in the cloud.
The core principle is AWS is responsible for security *of* the cloud (infrastructure), and the customer is responsible for security *in* the cloud (their data, applications, and configurations). Physical data center security is always AWS's responsibility. Customer data responsibility is shared; AWS provides tools, but the customer must use them. The split of responsibility varies by service type, but the fundamental principle (of vs. in) is constant.
Question 3
Domain 3: Cloud Technology and Services
An application running on EC2 instances needs a persistent block storage volume that can be detached and attached to another instance in the same Availability Zone. Which storage service should be used?
-
✓ Amazon EBS
-
○ Amazon S3
-
○ Amazon EFS
-
○ Instance store
Answer:
A. Amazon EBS
Amazon Elastic Block Store (EBS) provides persistent block storage volumes that can be attached to EC2 instances within the same Availability Zone. S3 is object storage. EFS is a shared file system. Instance store is ephemeral block storage attached to the host, which is lost when the instance stops.
Question 4
Domain 4: Billing, Pricing, and Support
Under the AWS shared responsibility model, which of the following is the customer's responsibility regarding billing?
-
○ Ensuring the underlying infrastructure is secure
-
✓ Monitoring resource usage and costs
-
○ Generating monthly invoices
-
○ Applying volume discounts automatically
Answer:
B. Monitoring resource usage and costs
Under the shared responsibility model, AWS is responsible for the security of the cloud (infrastructure), while the customer is responsible for security in the cloud (their data, configurations, etc.). For billing, the customer is responsible for monitoring their resource usage and associated costs. AWS generates invoices (C) and applies discounts (D). Infrastructure security (A) is AWS's responsibility.
Question 5
Security and Compliance
Choose 2
Which of the following are examples of security controls that are the customer's responsibility under the AWS shared responsibility model? (Select TWO.)
-
○ Environmental safeguards (e.g., fire suppression) in AWS data centers.
-
✓ Configuring security groups and network access control lists (NACLs).
-
○ Maintaining the firmware on AWS network devices.
-
✓ Enabling multi-factor authentication (MFA) on IAM user accounts.
-
○ Ensuring the physical security of server racks in an Availability Zone.
Answer:
B. Configuring security groups and network access control lists (NACLs). | D. Enabling multi-factor authentication (MFA) on IAM user accounts.
Configuring security groups and NACLs (B) is a customer responsibility for controlling traffic to their resources (security in the cloud). Enabling MFA on IAM user accounts (D) is a customer's identity and access management responsibility. Environmental safeguards (A), maintaining network device firmware (C), and physical rack security (E) are all part of the infrastructure security managed by AWS (security of the cloud).
Question 6
Domain 1: Cloud Concepts
Which AWS Cloud benefit is a direct result of AWS's aggregated purchasing power and operational efficiencies, leading to lower pay-as-you-go prices for customers?
-
○ Stop guessing capacity
-
✓ Benefit from massive economies of scale
-
○ Increase speed and agility
-
○ Stop spending money on running data centers
Answer:
B. Benefit from massive economies of scale
'Benefit from massive economies of scale' (B) directly refers to the cost advantages AWS achieves due to its large scale, which are then passed on to customers in the form of lower, variable pricing. 'Stop guessing capacity' (A) is about elasticity. 'Increase speed and agility' (C) is about deployment speed. 'Stop spending money on running data centers' (D) is about shifting operational burden.
Question 7
Domain 2: Security and Compliance
Choose 3
A company is designing a multi-account AWS environment for better security isolation. Which THREE are benefits of using multiple AWS accounts within an organization? (Select THREE.)
-
✓ Isolate workloads and environments (e.g., production, development).
-
✓ Apply different security policies per account using Service Control Policies (SCPs).
-
○ Simplify IAM management by using the same IAM users across all accounts.
-
✓ Implement separate billing and cost tracking per account or department.
-
○ Increase the service quotas (limits) for each service automatically.
-
○ Share security credentials easily between accounts for operational efficiency.
Answer:
A. Isolate workloads and environments (e.g., production, development). | B. Apply different security policies per account using Service Control Policies (SCPs). | D. Implement separate billing and cost tracking per account or department.
Using multiple accounts provides workload isolation (A), allows for centralized policy control with SCPs (B), and enables separate cost tracking (D). Using the same IAM users across accounts (C) is possible with IAM Identity Center but is not a simplification; it's a feature of centralized identity. Service quotas are generally per account, not increased automatically (E). Sharing credentials (F) is a security anti-pattern.
Question 8
Domain 3: Cloud Technology and Services
Which AWS service provides a fully managed, MySQL and PostgreSQL-compatible relational database built for the cloud, with performance and availability comparable to commercial databases at a lower cost?
-
○ Amazon RDS for MySQL
-
✓ Amazon Aurora
-
○ Amazon Redshift
-
○ Amazon DynamoDB
Answer:
B. Amazon Aurora
Amazon Aurora is a MySQL and PostgreSQL-compatible relational database built for the cloud. It combines the performance and availability of high-end commercial databases with the simplicity and cost-effectiveness of open-source databases. RDS for MySQL is a managed MySQL service, but Aurora is a separate engine optimized for cloud performance. Redshift is a data warehouse, and DynamoDB is NoSQL.
Question 9
Domain 4: Billing, Pricing, and Support
Choose 2
Which AWS resources are available for learning and skill development? (Select TWO)
-
✓ AWS Training and Certification
-
○ AWS Knowledge Center
-
○ AWS Forums
-
✓ AWS Whitepapers
-
○ AWS Support Plans
Answer:
A. AWS Training and Certification | D. AWS Whitepapers
AWS Training and Certification offers courses and certifications to build AWS skills, and AWS Whitepapers provide in-depth technical and architectural insights. Knowledge Center is for troubleshooting, Forums for community, and Support Plans for technical assistance.
Question 10
Security and Compliance
A company uses AWS Organizations with multiple member accounts. Which feature of AWS Organizations can be used to prevent users in member accounts from disabling AWS CloudTrail logging?
-
○ Consolidated billing
-
○ Tag policies
-
✓ Service control policies (SCPs)
-
○ AWS IAM Identity Center
Answer:
C. Service control policies (SCPs)
Service control policies (SCPs) are a feature of AWS Organizations that offer central control over the maximum available permissions for all accounts in an organization. An SCP can explicitly deny permissions for actions like `cloudtrail:StopLogging` or `cloudtrail:DeleteTrail`, effectively creating a guardrail that prevents member accounts from turning off critical security logging. Consolidated billing is for cost management. Tag policies enforce tagging standards. IAM Identity Center is for access management.
Question 11
Domain 1: Cloud Concepts
A developer can use AWS Cloud9 to write, run, and debug code directly from a web browser without setting up a local development environment. This is an example of which cloud benefit?
-
○ High availability
-
○ Elasticity
-
✓ Agility
-
○ Durability
Answer:
C. Agility
Agility includes the ability to quickly access tools and services (like Cloud9) to accelerate development and innovation, reducing the time to set up and configure environments.
Question 12
Domain 2: Security and Compliance
Which AWS service can be used to create and manage users, groups, and permissions within an AWS account?
-
○ AWS Organizations
-
○ AWS Directory Service
-
✓ AWS IAM
-
○ AWS Single Sign-On
Answer:
C. AWS IAM
AWS Identity and Access Management (IAM) is the service for creating and managing AWS users, groups, and permissions within a single AWS account. AWS Organizations manages multiple accounts. Directory Service and Single Sign-On are for identity federation and centralized access.
Question 13
Domain 3: Cloud Technology and Services
Which service provides intelligent search for enterprise documents?
-
○ Amazon Lex
-
✓ Amazon Kendra
-
○ Amazon Comprehend
-
○ Amazon Rekognition
Answer:
B. Amazon Kendra
Amazon Kendra is an intelligent search service that uses natural language processing to search enterprise documents. Lex is for chatbots, Comprehend for NLP, and Rekognition for image/video analysis.
Question 14
Domain 4: Billing, Pricing, and Support
Choose 2
What are the primary uses of AWS Cost and Usage Reports? (Select TWO)
-
○ To set monthly spending limits
-
✓ To integrate with third-party billing systems
-
○ To visualize costs with pie charts
-
✓ To perform detailed cost analysis with raw data
-
○ To receive daily email summaries
Answer:
B. To integrate with third-party billing systems | D. To perform detailed cost analysis with raw data
AWS Cost and Usage Reports provide detailed, line-item data that can be downloaded and used for deep analysis or integrated with external tools for billing and accounting. Setting limits is done with Budgets, visualization with Cost Explorer, and email summaries are not a standard feature.
Question 15
Security and Compliance
What is the purpose of the AWS root user of an account?
-
○ It is the default IAM user with full permissions.
-
✓ It is the identity used to initially create the AWS account and has complete, unrestricted access.
-
○ It is a special role used for billing inquiries only.
-
○ It is an automated system user that manages AWS background processes.
Answer:
B. It is the identity used to initially create the AWS account and has complete, unrestricted access.
The root user is the email address and password used to create the AWS account. It has complete, unrestricted access to all AWS services and resources in the account, including the ability to close the account. It is not an IAM user. For day-to-day operations, the root user should not be used; instead, IAM users/roles with appropriate permissions should be created. Its primary uses are for account-level tasks like changing the support plan or restoring IAM permissions.
Question 16
Domain 1: Cloud Concepts
What is a primary advantage of the AWS global infrastructure for a business expanding into new countries?
-
○ It automatically translates application content into local languages.
-
○ It provides local business partnerships and sales teams.
-
✓ It allows deployment in Regions close to new customers to reduce latency.
-
○ It ensures compliance with all local regulations automatically.
Answer:
C. It allows deployment in Regions close to new customers to reduce latency.
A key advantage of AWS's global infrastructure (Regions and Availability Zones) is the ability to deploy applications in geographic locations close to end-users. This reduces network latency, improving performance for customers in new countries. AWS does not automatically handle content translation, provide business partnerships, or guarantee regulatory compliance; these remain the customer's responsibility.
Question 17
Domain 2: Security and Compliance
What is the primary use of AWS CloudTrail?
-
○ To monitor resource performance
-
✓ To track user activity and API usage
-
○ To store application logs
-
○ To manage security groups
Answer:
B. To track user activity and API usage
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account. It logs all API calls and events, providing a history of user activity and API usage.
Question 18
Domain 3: Cloud Technology and Services
A company needs a fully managed service to host a Git repository for version control of their application source code. Which AWS service should they use?
-
✓ AWS CodeCommit
-
○ AWS CodeBuild
-
○ AWS CodeDeploy
-
○ AWS CodePipeline
Answer:
A. AWS CodeCommit
AWS CodeCommit is a fully managed source control service that hosts secure Git-based repositories. It makes it easy for teams to collaborate on code. CodeBuild builds source code, CodeDeploy deploys code, and CodePipeline automates the release pipeline.
Question 19
Domain 4: Billing, Pricing, and Support
Choose 2
Which TWO statements about AWS Free Tier are true? (Select TWO.)
-
○ It is available to all AWS customers indefinitely.
-
✓ It includes a set amount of Amazon S3 storage for 12 months.
-
○ It provides limited access to AWS Support Engineers.
-
✓ It offers free usage of AWS Lambda for 1 million requests per month.
-
○ It requires entering credit card information to activate.
Answer:
B. It includes a set amount of Amazon S3 storage for 12 months. | D. It offers free usage of AWS Lambda for 1 million requests per month.
The AWS Free Tier includes 5 GB of Amazon S3 Standard Storage for 12 months and 1 million free requests per month for AWS Lambda (Always Free). The Free Tier is available to new AWS customers for 12 months, not indefinitely. It does not include access to Support Engineers, and while a credit card may be required for account verification, it is not always required to activate the Free Tier itself.
Question 20
Security and Compliance
Choose 2
A company operates a multi-account AWS environment using AWS Organizations. Which AWS services or features can be used to centrally manage access and permissions across these member accounts? (Select TWO.)
-
○ IAM Roles Anywhere
-
✓ AWS IAM Identity Center
-
○ AWS Resource Access Manager (RAM)
-
✓ Service control policies (SCPs)
-
○ AWS Control Tower
-
○ Amazon Cognito
Answer:
B. AWS IAM Identity Center | D. Service control policies (SCPs)
AWS IAM Identity Center (formerly AWS SSO) provides centralized single sign-on (SSO) access and permission sets to manage user access across multiple AWS accounts. Service control policies (SCPs) are a feature of AWS Organizations that allow you to set permission guardrails (maximum permissions) for what users and roles can do in member accounts. AWS Control Tower is a service that sets up and governs a multi-account environment but SCPs are the specific mechanism for permission guardrails. RAM shares resources, IAM Roles Anywhere is for workloads outside AWS, and Cognito is for customer identity.
How to use these questions
Domain 3 is 34% and it is essentially a service-recognition test. Learn what each core service does - EC2, S3, RDS, Lambda, VPC, CloudFront - and you have a third of the exam covered.
The shared responsibility model appears throughout Domain 2. Learn the split precisely: AWS is responsible for security of the cloud, you are responsible for security in the cloud. Many questions are only testing whether you know which side a given control falls on.
Do not ignore Domain 4. Billing, pricing and support is only 12% but it is the easiest 12% on the exam, and it is the domain most candidates skip.
CLF-C02 uses 'multiple response' questions where more than one answer is correct. The question will tell you how many to select - count them, because partial credit does not exist.
Frequently asked questions
How many questions are on the AWS Cloud Practitioner exam?
65 questions in 90 minutes. There is no penalty for guessing, so never leave a question blank.
What is the passing score for CLF-C02?
700 out of 1000 on a scaled score. AWS does not publish the raw number of correct answers needed, and it varies between exam versions.
Is the AWS Cloud Practitioner exam hard?
It is the easiest AWS certification, but not trivial. Community pass rates sit around 65-70% first time, and the most common cause of failure is under-preparing Domain 3 because the service list is long.
How long is CLF-C02 valid?
Three years. You recertify by passing the current version of the exam or by earning a higher-level AWS certification.
Ready to test yourself under exam conditions?
981 questions across 6 timed mock exams, domain-wise drills, and the same
scaled scoring as the real thing. Free, no signup.
