AWS CERTIFIED CLOUD PRACTITIONER (CLF-
C02) CERTIFICATION FINAL EXAM WITH
CORRECT ANSWERS (VERIFIED ANSWERS)
PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF
A company wants to establish a private network connection between AWS and its
corporate network.Which AWS service or feature will meet this requirement?
A. Amazon Connect
B. Amazon Route 53
C. AWS Direct Connect
D. VPC peering -CORRECT ANSWER C. AWS Direct Connect.
Here's why:
AWS Direct Connect is a service that allows you to establish a dedicated network
connection from your premises (such as your corporate data center) to AWS. This
connection bypasses the public internet and provides a more consistent network
experience, lower latency, and potentially higher throughput compared to internet-based
connections.
Key features of AWS Direct Connect include:
Private Connectivity: It enables you to establish private connectivity between AWS and
your data center, office, or colocation environment.
Dedicated Connection: You can provision a dedicated network connection between
AWS and your network, which can be used to access AWS services within a specific
AWS region.
Reduced Network Costs: By using AWS Direct Connect, you can reduce network costs,
increase bandwidth throughput, and provide a more consistent network experience
compared to internet-based connections.
In contrast, the other options:
Amazon Connect (A): This is a cloud-based contact center service and not related to
establishing private network connections.
Amazon Route 53 (B): This is a scalable Domain Name System (DNS) web service and
does not provide direct private network connectivity.
VPC peering (D): This allows you to connect Virtual Private Clouds (VPCs) within the
same AWS region securely using private IP addresses. It does not extend connectivity
to an external corporate network; it only connects AWS VPCs.
A company plans to use an Amazon Snowball Edge device to transfer files to the AWS
Cloud.Which activities related to a Snowball Edge device are available to the company
at no cost?
A. Use of the Snowball Edge appliance for a 10-day period
B. The transfer of data out of Amazon S3 and to the Snowball Edge appliance
C. The transfer of data from the Snowball Edge appliance into Amazon S3
,D. Daily use of the Snowball Edge appliance after 10 days -CORRECT ANSWER C. The
transfer of data from the Snowball Edge appliance into Amazon S3
When you use a Snowball Edge device to transfer data into Amazon S3, there's no
additional cost associated with that data transfer. However, there are charges for
importing data into the Snowball Edge device and for the device itself, but transferring
data from the Snowball Edge appliance into Amazon S3 is typically free of charge.
A company has deployed applications on Amazon EC2 instances. The company needs
to assess application vulnerabilities and must identify infrastructure deployments that do
not meet best practices. Which AWS service can the company use to meet these
requirements?
A. AWS Trusted Advisor
B. Amazon Inspector
C. AWS Config
D. Amazon GuardDuty -CORRECT ANSWER B. Amazon Inspector
Amazon Inspector is the AWS service designed specifically to assess the security and
compliance of applications deployed on Amazon EC2 instances. It helps identify
vulnerabilities and deviations from best practices. It analyzes the network, file system,
and process activities of your EC2 instances to identify potential security issues.
Therefore, it's the most suitable option for the scenario described.
===========================================================
A. AWS Trusted Advisor: is a service that provides real-time guidance to help you
provision your resources following AWS best practices. It analyzes your AWS
environment and provides recommendations in areas such as cost optimization,
security, performance, and fault tolerance. Trusted Advisor checks can help you
improve security by identifying security vulnerabilities, such as exposed access keys or
security groups with overly permissive rules.
C. AWS Config: is a service that provides a detailed inventory of your AWS resources
and captures configuration changes over time. It continuously monitors resource
configurations and relationships, allowing you to assess the impact of changes,
troubleshoot configuration issues, and maintain compliance with organizational policies.
AWS Config can help improve security by providing visibility into resource
configurations and detecting unauthorized changes.
D. Amazon GuardDuty: is a threat detection service that continuously monitors your
AWS environment for malicious activity and unauthorized behavior. It analyzes logs
from AWS CloudTrail, VPC Flow Logs, and DNS logs to detect threats such as
compromised EC2 instances, unauthorized access attempts, and unusual network
activity. GuardDuty helps improve security by providing real-time threat detection and
automated response capabilities.
A company has a centralized group of users with large file storage requirements that
have exceeded the space available on premises. The company wants to extend its file
storage capabilities for this group while retaining the performance benefit of sharing
content locally. What is the MOST operationally efficient AWS solution for this scenario?
A. Create an Amazon S3 bucket for each user. Mount each bucket by using an S3 file
system mounting utility.
,B. Configure and deploy an AWS Storage Gateway file gateway. Connect each user's
workstation to the file gateway.
C. Move each user's working environment to Amazon WorkSpaces. Set up an Amazon
WorkDocs account for each user.
D. Deploy an Amazon EC2 instance and attach an Amazon Elastic Block Store
(Amazon EBS) Provisioned IOPS volume. Share the EBS volume directly with the
users. -CORRECT ANSWER B. Configure and deploy an AWS Storage Gateway file
gateway. Connect each user's workstation to the file gateway.
By using an AWS Storage Gateway file gateway, the company can extend its file
storage capabilities while retaining the performance benefits of sharing content locally.
The file gateway provides on-premises applications with file-based, cached access to
virtually unlimited cloud storage. Users can continue to access files as if they were
stored locally while the data is seamlessly transferred to and from Amazon S3. This
solution eliminates the need for managing individual S3 buckets per user (option A) or
deploying and managing additional infrastructure like EC2 instances (option D). Options
C doesn't address the need for large file storage requirements directly.
According to security best practices, how should an Amazon EC2 instance be given
access to an Amazon S3 bucket?
A. Hard code an IAM user's secret key and access key directly in the application, and
upload the file.
B. Store the IAM user's secret key and access key in a text file on the EC2 instance,
read the keys, then upload the file.
C. Have the EC2 instance assume a role to obtain the privileges to upload the file.
D. Modify the S3 bucket policy so that any service can upload to it at any time. -
CORRECT ANSWER C. Have the EC2 instance assume a role to obtain the privileges to
upload the file.
Using IAM roles is the recommended approach for granting permissions to AWS
resources like EC2 instances to access other AWS services like S3 securely. By
assigning an IAM role to the EC2 instance with the necessary permissions to access the
S3 bucket, you can avoid hard coding access keys or storing them in files on the
instance, which could lead to security vulnerabilities. This method follows the principle
of least privilege and helps maintain better security posture.
Which option is a customer responsibility when using Amazon DynamoDB under the
AWS Shared Responsibility Model?
A. Physical security of DynamoDB
B. Patching of DynamoDB
C. Access to DynamoDB tables
D. Encryption of data at rest in DynamoDB -CORRECT ANSWER C. Access to
DynamoDB tables
Under the AWS Shared Responsibility Model, Amazon DynamoDB is a fully managed
service. This means that AWS is responsible for the security of the cloud infrastructure
that runs DynamoDB, including the physical security of the servers, patching the
underlying infrastructure, and ensuring encryption of data at rest.
, However, customers are responsible for managing access to their DynamoDB tables.
This includes setting up appropriate IAM policies, controlling who can access the tables,
and managing permissions for users and applications.
Which option is a perspective that includes foundational capabilities of the AWS Cloud
Adoption Framework (AWS CAF)?
A. Sustainability
B. Performance efficiency
C. Governance
D. Reliability -CORRECT ANSWER C. Governance
The AWS Cloud Adoption Framework (AWS CAF) provides guidance for organizations
to structure their cloud adoption journey. It includes several perspectives or areas of
focus, one of which is governance. Governance encompasses establishing policies,
roles, and responsibilities to ensure that cloud resources are used efficiently, securely,
and in compliance with organizational requirements and standards.
==========================================================
A. Sustainability: This term refers to the environmental impact of cloud computing.
Cloud providers like AWS are increasingly investing in sustainable practices to minimize
energy consumption, reduce carbon emissions, and promote renewable energy usage
in their data centers.
B. Performance efficiency: Performance efficiency in cloud computing refers to the
ability of a system to provide adequate performance while optimizing resource
utilization. It involves designing systems to scale efficiently, handle variable workloads,
and minimize latency to deliver a high level of performance to users.
D. Reliability: Reliability in cloud computing refers to the ability of a system to
consistently perform its intended functions without failure or downtime. It involves
designing systems with fault tolerance, redundancy, and automated recovery
mechanisms to ensure high availability and minimize service disruptions for users.
A company is running and managing its own Docker environment on Amazon EC2
instances. The company wants an alternative to help manage cluster size, scheduling,
and environment maintenance. Which AWS service meets these requirements?
A. AWS Lambda
B. Amazon RDS
C. AWS Fargate
D. Amazon Athena -CORRECT ANSWER C. AWS Fargate.
AWS Fargate is a compute engine for Amazon ECS (Elastic Container Service) that
allows you to run containers without having to manage the underlying infrastructure. It
abstracts away the management of EC2 instances, thus handling tasks like cluster size,
scheduling, and environment maintenance automatically. This can help simplify
container management, making it an ideal solution for companies looking to offload the
operational overhead associated with managing Docker environments on EC2
instances.
==========================================================
A. AWS Lambda: AWS Lambda is a serverless compute service provided by Amazon
Web Services. It allows you to run code without provisioning or managing servers. With
C02) CERTIFICATION FINAL EXAM WITH
CORRECT ANSWERS (VERIFIED ANSWERS)
PLUS RATIONALES 2026 Q&A | INSTANT
DOWNLOAD PDF
A company wants to establish a private network connection between AWS and its
corporate network.Which AWS service or feature will meet this requirement?
A. Amazon Connect
B. Amazon Route 53
C. AWS Direct Connect
D. VPC peering -CORRECT ANSWER C. AWS Direct Connect.
Here's why:
AWS Direct Connect is a service that allows you to establish a dedicated network
connection from your premises (such as your corporate data center) to AWS. This
connection bypasses the public internet and provides a more consistent network
experience, lower latency, and potentially higher throughput compared to internet-based
connections.
Key features of AWS Direct Connect include:
Private Connectivity: It enables you to establish private connectivity between AWS and
your data center, office, or colocation environment.
Dedicated Connection: You can provision a dedicated network connection between
AWS and your network, which can be used to access AWS services within a specific
AWS region.
Reduced Network Costs: By using AWS Direct Connect, you can reduce network costs,
increase bandwidth throughput, and provide a more consistent network experience
compared to internet-based connections.
In contrast, the other options:
Amazon Connect (A): This is a cloud-based contact center service and not related to
establishing private network connections.
Amazon Route 53 (B): This is a scalable Domain Name System (DNS) web service and
does not provide direct private network connectivity.
VPC peering (D): This allows you to connect Virtual Private Clouds (VPCs) within the
same AWS region securely using private IP addresses. It does not extend connectivity
to an external corporate network; it only connects AWS VPCs.
A company plans to use an Amazon Snowball Edge device to transfer files to the AWS
Cloud.Which activities related to a Snowball Edge device are available to the company
at no cost?
A. Use of the Snowball Edge appliance for a 10-day period
B. The transfer of data out of Amazon S3 and to the Snowball Edge appliance
C. The transfer of data from the Snowball Edge appliance into Amazon S3
,D. Daily use of the Snowball Edge appliance after 10 days -CORRECT ANSWER C. The
transfer of data from the Snowball Edge appliance into Amazon S3
When you use a Snowball Edge device to transfer data into Amazon S3, there's no
additional cost associated with that data transfer. However, there are charges for
importing data into the Snowball Edge device and for the device itself, but transferring
data from the Snowball Edge appliance into Amazon S3 is typically free of charge.
A company has deployed applications on Amazon EC2 instances. The company needs
to assess application vulnerabilities and must identify infrastructure deployments that do
not meet best practices. Which AWS service can the company use to meet these
requirements?
A. AWS Trusted Advisor
B. Amazon Inspector
C. AWS Config
D. Amazon GuardDuty -CORRECT ANSWER B. Amazon Inspector
Amazon Inspector is the AWS service designed specifically to assess the security and
compliance of applications deployed on Amazon EC2 instances. It helps identify
vulnerabilities and deviations from best practices. It analyzes the network, file system,
and process activities of your EC2 instances to identify potential security issues.
Therefore, it's the most suitable option for the scenario described.
===========================================================
A. AWS Trusted Advisor: is a service that provides real-time guidance to help you
provision your resources following AWS best practices. It analyzes your AWS
environment and provides recommendations in areas such as cost optimization,
security, performance, and fault tolerance. Trusted Advisor checks can help you
improve security by identifying security vulnerabilities, such as exposed access keys or
security groups with overly permissive rules.
C. AWS Config: is a service that provides a detailed inventory of your AWS resources
and captures configuration changes over time. It continuously monitors resource
configurations and relationships, allowing you to assess the impact of changes,
troubleshoot configuration issues, and maintain compliance with organizational policies.
AWS Config can help improve security by providing visibility into resource
configurations and detecting unauthorized changes.
D. Amazon GuardDuty: is a threat detection service that continuously monitors your
AWS environment for malicious activity and unauthorized behavior. It analyzes logs
from AWS CloudTrail, VPC Flow Logs, and DNS logs to detect threats such as
compromised EC2 instances, unauthorized access attempts, and unusual network
activity. GuardDuty helps improve security by providing real-time threat detection and
automated response capabilities.
A company has a centralized group of users with large file storage requirements that
have exceeded the space available on premises. The company wants to extend its file
storage capabilities for this group while retaining the performance benefit of sharing
content locally. What is the MOST operationally efficient AWS solution for this scenario?
A. Create an Amazon S3 bucket for each user. Mount each bucket by using an S3 file
system mounting utility.
,B. Configure and deploy an AWS Storage Gateway file gateway. Connect each user's
workstation to the file gateway.
C. Move each user's working environment to Amazon WorkSpaces. Set up an Amazon
WorkDocs account for each user.
D. Deploy an Amazon EC2 instance and attach an Amazon Elastic Block Store
(Amazon EBS) Provisioned IOPS volume. Share the EBS volume directly with the
users. -CORRECT ANSWER B. Configure and deploy an AWS Storage Gateway file
gateway. Connect each user's workstation to the file gateway.
By using an AWS Storage Gateway file gateway, the company can extend its file
storage capabilities while retaining the performance benefits of sharing content locally.
The file gateway provides on-premises applications with file-based, cached access to
virtually unlimited cloud storage. Users can continue to access files as if they were
stored locally while the data is seamlessly transferred to and from Amazon S3. This
solution eliminates the need for managing individual S3 buckets per user (option A) or
deploying and managing additional infrastructure like EC2 instances (option D). Options
C doesn't address the need for large file storage requirements directly.
According to security best practices, how should an Amazon EC2 instance be given
access to an Amazon S3 bucket?
A. Hard code an IAM user's secret key and access key directly in the application, and
upload the file.
B. Store the IAM user's secret key and access key in a text file on the EC2 instance,
read the keys, then upload the file.
C. Have the EC2 instance assume a role to obtain the privileges to upload the file.
D. Modify the S3 bucket policy so that any service can upload to it at any time. -
CORRECT ANSWER C. Have the EC2 instance assume a role to obtain the privileges to
upload the file.
Using IAM roles is the recommended approach for granting permissions to AWS
resources like EC2 instances to access other AWS services like S3 securely. By
assigning an IAM role to the EC2 instance with the necessary permissions to access the
S3 bucket, you can avoid hard coding access keys or storing them in files on the
instance, which could lead to security vulnerabilities. This method follows the principle
of least privilege and helps maintain better security posture.
Which option is a customer responsibility when using Amazon DynamoDB under the
AWS Shared Responsibility Model?
A. Physical security of DynamoDB
B. Patching of DynamoDB
C. Access to DynamoDB tables
D. Encryption of data at rest in DynamoDB -CORRECT ANSWER C. Access to
DynamoDB tables
Under the AWS Shared Responsibility Model, Amazon DynamoDB is a fully managed
service. This means that AWS is responsible for the security of the cloud infrastructure
that runs DynamoDB, including the physical security of the servers, patching the
underlying infrastructure, and ensuring encryption of data at rest.
, However, customers are responsible for managing access to their DynamoDB tables.
This includes setting up appropriate IAM policies, controlling who can access the tables,
and managing permissions for users and applications.
Which option is a perspective that includes foundational capabilities of the AWS Cloud
Adoption Framework (AWS CAF)?
A. Sustainability
B. Performance efficiency
C. Governance
D. Reliability -CORRECT ANSWER C. Governance
The AWS Cloud Adoption Framework (AWS CAF) provides guidance for organizations
to structure their cloud adoption journey. It includes several perspectives or areas of
focus, one of which is governance. Governance encompasses establishing policies,
roles, and responsibilities to ensure that cloud resources are used efficiently, securely,
and in compliance with organizational requirements and standards.
==========================================================
A. Sustainability: This term refers to the environmental impact of cloud computing.
Cloud providers like AWS are increasingly investing in sustainable practices to minimize
energy consumption, reduce carbon emissions, and promote renewable energy usage
in their data centers.
B. Performance efficiency: Performance efficiency in cloud computing refers to the
ability of a system to provide adequate performance while optimizing resource
utilization. It involves designing systems to scale efficiently, handle variable workloads,
and minimize latency to deliver a high level of performance to users.
D. Reliability: Reliability in cloud computing refers to the ability of a system to
consistently perform its intended functions without failure or downtime. It involves
designing systems with fault tolerance, redundancy, and automated recovery
mechanisms to ensure high availability and minimize service disruptions for users.
A company is running and managing its own Docker environment on Amazon EC2
instances. The company wants an alternative to help manage cluster size, scheduling,
and environment maintenance. Which AWS service meets these requirements?
A. AWS Lambda
B. Amazon RDS
C. AWS Fargate
D. Amazon Athena -CORRECT ANSWER C. AWS Fargate.
AWS Fargate is a compute engine for Amazon ECS (Elastic Container Service) that
allows you to run containers without having to manage the underlying infrastructure. It
abstracts away the management of EC2 instances, thus handling tasks like cluster size,
scheduling, and environment maintenance automatically. This can help simplify
container management, making it an ideal solution for companies looking to offload the
operational overhead associated with managing Docker environments on EC2
instances.
==========================================================
A. AWS Lambda: AWS Lambda is a serverless compute service provided by Amazon
Web Services. It allows you to run code without provisioning or managing servers. With
