AWS CLF-C02 Advanced Exam Questions
2026–2027 | Difficult Cloud Practitioner
Scenarios with Answers & Expert
Explanations
1. A company hosts a customer-facing application on Amazon EC2 instances in
a single Availability Zone. The application must remain available if that
Availability Zone fails. Which architecture provides the MOST appropriate
improvement?
A. Increase the instance size in the existing Availability Zone
B. Deploy additional EC2 instances across multiple Availability Zones behind an
Application Load Balancer
C. Store application logs in Amazon S3
D. Purchase Reserved Instances for the existing EC2 instances
Answer: Deploy additional EC2 instances across multiple Availability Zones
behind an Application Load Balancer
Rationale: Distributing EC2 instances across multiple Availability Zones removes
the single-AZ failure point. An Application Load Balancer can distribute traffic
,across healthy instances and improve application availability and fault
tolerance.
2. A company wants to reduce Amazon EC2 costs for a workload that runs
continuously and has predictable resource requirements for three years.
Which purchasing option is generally MOST appropriate?
A. On-Demand Instances
B. Spot Instances
C. Reserved Instances
D. Dedicated Hosts
Answer: Reserved Instances
Rationale: Reserved Instances can provide significant discounts compared with
On-Demand pricing when workloads have predictable usage. Spot Instances are
better suited to interruptible workloads, while Dedicated Hosts address specific
tenancy and licensing requirements.
3. A developer needs to run a batch-processing workload that can tolerate
interruptions and can restart automatically. Which EC2 purchasing option is
MOST cost-effective?
A. Dedicated Instances
B. Spot Instances
C. On-Demand Instances
D. Reserved Instances
Answer: Spot Instances
Rationale: Spot Instances use spare Amazon EC2 capacity at potentially
substantial discounts. They are appropriate when workloads can tolerate
interruptions, making them well suited for fault-tolerant batch processing.
4. A company needs a database service with automated backups, automated
software patching, and managed database infrastructure. Which AWS
service should it consider?
,A. Amazon EC2
B. Amazon RDS
C. Amazon S3
D. Amazon EBS
Answer: Amazon RDS
Rationale: Amazon RDS is a managed relational database service that handles
many operational tasks, including automated backups, patching, and
infrastructure provisioning, reducing administrative overhead.
5. An organization wants to automatically adjust compute capacity based on
application demand. Which AWS capability is MOST directly designed for
this requirement?
A. AWS Auto Scaling
B. AWS Artifact
C. AWS Organizations
D. AWS CloudTrail
Answer: AWS Auto Scaling
Rationale: AWS Auto Scaling can automatically add or remove resources based
on demand and configured policies, helping applications maintain performance
while controlling costs.
6. A company wants to prevent unauthorized access to an Amazon S3 bucket
while allowing a specific IAM role to access objects. Which approach BEST
follows AWS security principles?
A. Make the bucket public
B. Use an IAM policy and appropriate S3 bucket policy
C. Store the access key in application source code
D. Disable all S3 logging
Answer: Use an IAM policy and appropriate S3 bucket policy
, Rationale: IAM policies and S3 bucket policies can define precise permissions.
This supports least privilege by granting only the access required by the
designated role or principals.
7. An organization wants to identify which IAM user or role made a specific
API call that modified an AWS resource. Which service should it use?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Trusted Advisor
D. AWS Config
Answer: AWS CloudTrail
Rationale: AWS CloudTrail records AWS API activity and can help determine who
performed an action, what action occurred, and when it occurred.
8. A company needs to monitor CPU utilization of EC2 instances and configure
alarms when utilization exceeds a threshold. Which service is MOST
appropriate?
A. AWS CloudTrail
B. Amazon CloudWatch
C. AWS Artifact
D. AWS IAM
Answer: Amazon CloudWatch
Rationale: Amazon CloudWatch monitors AWS resources and applications and
can create alarms based on metrics such as EC2 CPU utilization.
9. A company wants to deploy an application without managing servers,
operating systems, or infrastructure capacity. Which AWS service is MOST
appropriate for running code in response to events?
A. Amazon EC2
B. AWS Lambda
2026–2027 | Difficult Cloud Practitioner
Scenarios with Answers & Expert
Explanations
1. A company hosts a customer-facing application on Amazon EC2 instances in
a single Availability Zone. The application must remain available if that
Availability Zone fails. Which architecture provides the MOST appropriate
improvement?
A. Increase the instance size in the existing Availability Zone
B. Deploy additional EC2 instances across multiple Availability Zones behind an
Application Load Balancer
C. Store application logs in Amazon S3
D. Purchase Reserved Instances for the existing EC2 instances
Answer: Deploy additional EC2 instances across multiple Availability Zones
behind an Application Load Balancer
Rationale: Distributing EC2 instances across multiple Availability Zones removes
the single-AZ failure point. An Application Load Balancer can distribute traffic
,across healthy instances and improve application availability and fault
tolerance.
2. A company wants to reduce Amazon EC2 costs for a workload that runs
continuously and has predictable resource requirements for three years.
Which purchasing option is generally MOST appropriate?
A. On-Demand Instances
B. Spot Instances
C. Reserved Instances
D. Dedicated Hosts
Answer: Reserved Instances
Rationale: Reserved Instances can provide significant discounts compared with
On-Demand pricing when workloads have predictable usage. Spot Instances are
better suited to interruptible workloads, while Dedicated Hosts address specific
tenancy and licensing requirements.
3. A developer needs to run a batch-processing workload that can tolerate
interruptions and can restart automatically. Which EC2 purchasing option is
MOST cost-effective?
A. Dedicated Instances
B. Spot Instances
C. On-Demand Instances
D. Reserved Instances
Answer: Spot Instances
Rationale: Spot Instances use spare Amazon EC2 capacity at potentially
substantial discounts. They are appropriate when workloads can tolerate
interruptions, making them well suited for fault-tolerant batch processing.
4. A company needs a database service with automated backups, automated
software patching, and managed database infrastructure. Which AWS
service should it consider?
,A. Amazon EC2
B. Amazon RDS
C. Amazon S3
D. Amazon EBS
Answer: Amazon RDS
Rationale: Amazon RDS is a managed relational database service that handles
many operational tasks, including automated backups, patching, and
infrastructure provisioning, reducing administrative overhead.
5. An organization wants to automatically adjust compute capacity based on
application demand. Which AWS capability is MOST directly designed for
this requirement?
A. AWS Auto Scaling
B. AWS Artifact
C. AWS Organizations
D. AWS CloudTrail
Answer: AWS Auto Scaling
Rationale: AWS Auto Scaling can automatically add or remove resources based
on demand and configured policies, helping applications maintain performance
while controlling costs.
6. A company wants to prevent unauthorized access to an Amazon S3 bucket
while allowing a specific IAM role to access objects. Which approach BEST
follows AWS security principles?
A. Make the bucket public
B. Use an IAM policy and appropriate S3 bucket policy
C. Store the access key in application source code
D. Disable all S3 logging
Answer: Use an IAM policy and appropriate S3 bucket policy
, Rationale: IAM policies and S3 bucket policies can define precise permissions.
This supports least privilege by granting only the access required by the
designated role or principals.
7. An organization wants to identify which IAM user or role made a specific
API call that modified an AWS resource. Which service should it use?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Trusted Advisor
D. AWS Config
Answer: AWS CloudTrail
Rationale: AWS CloudTrail records AWS API activity and can help determine who
performed an action, what action occurred, and when it occurred.
8. A company needs to monitor CPU utilization of EC2 instances and configure
alarms when utilization exceeds a threshold. Which service is MOST
appropriate?
A. AWS CloudTrail
B. Amazon CloudWatch
C. AWS Artifact
D. AWS IAM
Answer: Amazon CloudWatch
Rationale: Amazon CloudWatch monitors AWS resources and applications and
can create alarms based on metrics such as EC2 CPU utilization.
9. A company wants to deploy an application without managing servers,
operating systems, or infrastructure capacity. Which AWS service is MOST
appropriate for running code in response to events?
A. Amazon EC2
B. AWS Lambda
