,AWS Certified Cloud Practitioner CLF-C02 Exam
Prep 2026/2027 — Practice Questions,
Answers & Study Guide
QUESTION 1
A company is migrating its on-premises data center to AWS. The CIO asks the cloud team:
"Under the AWS shared responsibility model, which of the following is ALWAYS the customer's
responsibility, regardless of whether we use EC2, RDS, or Lambda?" Which answer is CORRECT?
A. Patching the guest operating system
B. Managing the physical security of data centers
C. Encrypting customer data
D. Maintaining the hypervisor layer
Correct Answer: C. Encrypting customer data
Rationale: Under the AWS shared responsibility model, the customer is always responsible for
the security of the cloud — including their data, encryption of that data, and access
management. AWS is responsible for security of the cloud (physical security, hypervisor,
managed service infrastructure). Patching the guest OS (A) is the customer's responsibility for
IaaS (EC2) but shifts to AWS for managed services like RDS and Lambda. Physical security (B) and
the hypervisor (D) are always AWS responsibilities. Key Takeaway: Customer = security IN the
cloud (data, access, encryption); AWS = security OF the cloud (infrastructure, hypervisor,
physical).
QUESTION 2
,A startup is deploying a web application on AWS. The application must automatically scale
compute capacity based on traffic demand, and the company wants to pay only for what it uses.
Which AWS service should the company use to achieve automatic scaling?
A. AWS Lambda
B. Amazon EC2 Auto Scaling
C. AWS Elastic Beanstalk
D. Amazon Lightsail
Correct Answer: B. Amazon EC2 Auto Scaling
Rationale: Amazon EC2 Auto Scaling automatically adjusts the number of EC2 instances based
on demand, ensuring elasticity and cost efficiency. AWS Lambda (A) is serverless and scales
automatically, but the question specifies compute capacity that the company manages. Elastic
Beanstalk (C) is a PaaS that handles deployment but does not directly provide the scaling
control described. Lightsail (D) is a simplified VPS with fixed pricing, not auto-scaling. Key
Takeaway: Auto Scaling = elastic EC2 capacity; Lambda = serverless, event-driven compute.
QUESTION 3
A security engineer is configuring access for a new application running on an EC2 instance. The
application needs to read objects from an S3 bucket. The engineer wants to avoid storing long-
term credentials on the instance. Which approach is MOST secure?
A. Create an IAM user and embed the access key in the application code
B. Create an IAM role and attach it to the EC2 instance
, C. Store the credentials in an environment variable on the instance
D. Use the root account access key
Correct Answer: B. Create an IAM role and attach it to the EC2 instance
Rationale: IAM roles provide temporary credentials to EC2 instances, eliminating the need to
store long-term access keys. Embedding access keys in code (A) or environment variables (C)
risks credential leakage. Using the root account (D) violates least privilege and is highly insecure.
Key Takeaway: EC2 → AWS service access = IAM role (temporary credentials); never embed
access keys.
QUESTION 4
A company wants to store infrequently accessed data at the lowest possible cost. The data must
be retrievable within minutes when needed. Which S3 storage class is MOST appropriate?
A. S3 Standard
B. S3 Intelligent-Tiering
C. S3 Standard-Infrequent Access (S3 Standard-IA)
D. S3 Glacier Deep Archive
Correct Answer: C. S3 Standard-Infrequent Access (S3 Standard-IA)
Rationale: S3 Standard-IA is designed for infrequently accessed data that still requires rapid
retrieval (milliseconds). It offers lower storage costs than S3 Standard (A) but charges a retrieval
fee. S3 Intelligent-Tiering (B) automatically moves data between tiers but is not the lowest-cost
option for known infrequent access. S3 Glacier Deep Archive (D) is for long-term archival with
Prep 2026/2027 — Practice Questions,
Answers & Study Guide
QUESTION 1
A company is migrating its on-premises data center to AWS. The CIO asks the cloud team:
"Under the AWS shared responsibility model, which of the following is ALWAYS the customer's
responsibility, regardless of whether we use EC2, RDS, or Lambda?" Which answer is CORRECT?
A. Patching the guest operating system
B. Managing the physical security of data centers
C. Encrypting customer data
D. Maintaining the hypervisor layer
Correct Answer: C. Encrypting customer data
Rationale: Under the AWS shared responsibility model, the customer is always responsible for
the security of the cloud — including their data, encryption of that data, and access
management. AWS is responsible for security of the cloud (physical security, hypervisor,
managed service infrastructure). Patching the guest OS (A) is the customer's responsibility for
IaaS (EC2) but shifts to AWS for managed services like RDS and Lambda. Physical security (B) and
the hypervisor (D) are always AWS responsibilities. Key Takeaway: Customer = security IN the
cloud (data, access, encryption); AWS = security OF the cloud (infrastructure, hypervisor,
physical).
QUESTION 2
,A startup is deploying a web application on AWS. The application must automatically scale
compute capacity based on traffic demand, and the company wants to pay only for what it uses.
Which AWS service should the company use to achieve automatic scaling?
A. AWS Lambda
B. Amazon EC2 Auto Scaling
C. AWS Elastic Beanstalk
D. Amazon Lightsail
Correct Answer: B. Amazon EC2 Auto Scaling
Rationale: Amazon EC2 Auto Scaling automatically adjusts the number of EC2 instances based
on demand, ensuring elasticity and cost efficiency. AWS Lambda (A) is serverless and scales
automatically, but the question specifies compute capacity that the company manages. Elastic
Beanstalk (C) is a PaaS that handles deployment but does not directly provide the scaling
control described. Lightsail (D) is a simplified VPS with fixed pricing, not auto-scaling. Key
Takeaway: Auto Scaling = elastic EC2 capacity; Lambda = serverless, event-driven compute.
QUESTION 3
A security engineer is configuring access for a new application running on an EC2 instance. The
application needs to read objects from an S3 bucket. The engineer wants to avoid storing long-
term credentials on the instance. Which approach is MOST secure?
A. Create an IAM user and embed the access key in the application code
B. Create an IAM role and attach it to the EC2 instance
, C. Store the credentials in an environment variable on the instance
D. Use the root account access key
Correct Answer: B. Create an IAM role and attach it to the EC2 instance
Rationale: IAM roles provide temporary credentials to EC2 instances, eliminating the need to
store long-term access keys. Embedding access keys in code (A) or environment variables (C)
risks credential leakage. Using the root account (D) violates least privilege and is highly insecure.
Key Takeaway: EC2 → AWS service access = IAM role (temporary credentials); never embed
access keys.
QUESTION 4
A company wants to store infrequently accessed data at the lowest possible cost. The data must
be retrievable within minutes when needed. Which S3 storage class is MOST appropriate?
A. S3 Standard
B. S3 Intelligent-Tiering
C. S3 Standard-Infrequent Access (S3 Standard-IA)
D. S3 Glacier Deep Archive
Correct Answer: C. S3 Standard-Infrequent Access (S3 Standard-IA)
Rationale: S3 Standard-IA is designed for infrequently accessed data that still requires rapid
retrieval (milliseconds). It offers lower storage costs than S3 Standard (A) but charges a retrieval
fee. S3 Intelligent-Tiering (B) automatically moves data between tiers but is not the lowest-cost
option for known infrequent access. S3 Glacier Deep Archive (D) is for long-term archival with
