AWS CCP (CLF-C02) Practice Exam.
Free practice test — 32 verified questions, instant feedback.

Answer: A
Trading capital expense (CapEx) for variable/operational expense is a core cloud value proposition: instead of buying hardware up front, you pay only for consumption. B is wrong because cloud reduces fixed costs rather than increasing them. C is wrong because you still pay operating costs for what you use. D describes a traditional on-premises commitment, the opposite of the pay-as-you-go model.

Answer: A
Because AWS aggregates demand from hundreds of thousands of customers, it achieves higher purchasing power and lower per-unit costs, which it can pass on as lower prices. B is wrong because customers benefit from AWS's aggregate scale, not individual negotiation. C is wrong because economies of scale apply broadly across services. D is wrong because a single organization rarely matches hyperscaler purchasing power.

Answer: A
Operational Excellence is one of the pillars of the AWS Well-Architected Framework (alongside Security, Reliability, Performance Efficiency, Cost Optimization, and Sustainability). B, C, and D are not pillars; vendor lock-in and capital expenditure are concerns the cloud helps reduce, and physical security is part of AWS's responsibility rather than a design pillar.

Answer: A
The AWS Cloud Adoption Framework organizes migration guidance into perspectives spanning business, people, governance, platform, security, and operations. B is a service that inspects deployed resources for best practices, not a migration-readiness framework. C analyzes historical spend, and D monitors resource metrics; neither structures organizational cloud adoption.

Answer: A
Elasticity is the ability to scale resources up and down automatically to match demand, avoiding over-provisioning. B (colocation) refers to housing hardware in a shared facility, an on-premises concept. C (depreciation) is an accounting treatment of owned assets. D (data residency) concerns where data is physically stored, not scaling.

Answer: A
Rightsizing means matching instance type and size to actual utilization, often downsizing over-provisioned resources to cut cost without hurting performance. B increases waste rather than reducing it. C removes visibility you need to rightsize. D is unrelated to optimizing existing cloud resources.

Answer: A
AWS is responsible for security 'of' the cloud, which includes physical data center security, hardware, and the global infrastructure. B, C, and D are all 'in the cloud' responsibilities that belong to the customer: configuring firewalls, managing identities, and protecting their own data.

Answer: A
IAM lets you create users, groups, and roles and attach policies that grant only the permissions needed, supporting least privilege. B is a DNS service, C is a data-transfer appliance, and D is a streaming-data service; none manage access permissions.

Answer: A
MFA adds a second factor so a stolen password alone is not enough to sign in, which is strongly recommended for the highly privileged root user. B increases exposure, C violates the guidance to avoid daily root use, and D removes an audit trail rather than improving authentication security.

Answer: A
CloudTrail records account activity and API calls, providing an audit trail of user and service actions. B is a content delivery network, C is a serverless compute service, and D is block storage; none provide the account-wide API auditing that CloudTrail does.

Answer: A
AWS Artifact is the self-service portal for on-demand access to AWS compliance reports and agreements such as SOC and ISO. B tracks resource configuration changes, C assesses workloads for vulnerabilities, and D provides DDoS protection; none deliver downloadable compliance documentation.

Answer: A
AWS Shield provides managed protection against DDoS attacks. B stores and rotates secrets, C discovers and protects sensitive data in S3, and D manages encryption keys; none are purpose-built DDoS mitigation services.

Answer: A
Amazon Macie uses machine learning to discover, classify, and protect sensitive data like PII in S3. B manages user sign-up and sign-in for apps, C provides a dedicated network connection, and D is a business-intelligence dashboard service; none perform sensitive-data discovery.

Answer: A
AWS Secrets Manager securely stores secrets such as database credentials and can rotate them automatically, removing the need to hardcode them. B collects log data, C is a data-integration/ETL service, and D queries data in S3 with SQL; none manage secret rotation.

Answer: A
Data protection is a customer responsibility; customers decide encryption settings and can use AWS KMS to manage keys. B is false and dangerous, C is false because S3 supports server-side encryption, and D is false because customer-managed keys are supported in KMS.

Answer: A
AWS Organizations lets you group accounts and apply service control policies (SCPs) as guardrails across the organization, plus consolidate billing. B routes events, C orchestrates workflows, and D is a natural-language-processing service; none provide multi-account governance.

Answer: A
Amazon EC2 provides resizable virtual servers where you control the OS and installed software, ideal for long-running, customizable workloads. B is serverless and abstracts the OS with short execution limits, C is object storage, and D is DNS; none provide managed virtual machines.

Answer: A
AWS Lambda is a serverless compute service that runs code in response to events and bills only for execution time, with no servers to manage. B requires managing EC2 instances, C is a managed relational database, and D is a networking connection; none are event-driven serverless compute.

Answer: A
Amazon S3 is object storage built for scalable storage and retrieval of objects over the web. B is block storage attached to a single EC2 instance, C is compute, and D is a virtual network; none are internet-scale object stores.

Answer: A
Amazon RDS is a managed relational database service that handles patching, backups, and OS maintenance for engines like MySQL and PostgreSQL. B is a NoSQL key-value database, C is a data warehouse for analytics, and D is archival storage; none are managed relational transactional databases in this scenario.

Answer: A
Amazon DynamoDB is a fully managed, serverless NoSQL database offering consistent low-latency performance at scale. B (Aurora) is a relational database, C (EMR) is a big-data processing platform, and D (Fargate) is a serverless container compute engine; none are NoSQL key-value databases.

Answer: A
Amazon CloudFront is a CDN that caches content at global edge locations to lower latency for end users. B is a message queue, C provisions infrastructure as code, and D deploys and manages applications; none are content delivery networks.

Answer: A
Availability Zones are isolated locations within a Region; spreading resources across multiple AZs protects against the failure of any one AZ. B creates a single point of failure, C confuses AZs with Regions, and D confuses edge locations (used by CDNs) with compute high availability.

Answer: A
Amazon VPC provides a logically isolated virtual network where you control IP ranges, subnets, route tables, and gateways. B monitors metrics and logs, C gives best-practice recommendations, and D publishes notifications; none define an isolated network.

Answer: A
Elastic Beanstalk is a platform-as-a-service that deploys and manages applications, handling provisioning, load balancing, scaling, and monitoring while you retain control of the underlying resources. B is a graph database, C is an ETL service, and D delivers streaming data; none are application deployment platforms.

Answer: A
AWS Fargate is a serverless compute engine for containers that removes the need to provision and manage servers. B offers simplified virtual private servers, C is a discounted way to buy EC2 capacity you still manage, and D brings AWS infrastructure on-premises; none are serverless container runtimes.

Answer: A
AWS Trusted Advisor inspects your account and gives recommendations across categories such as cost optimization, security, performance, fault tolerance, and service limits. B is a threat-detection service, C automates data transfer, and D is a managed message broker; none deliver broad best-practice advisory checks.

Answer: A
Consolidated billing combines usage from all member accounts into one bill and can unlock volume pricing tiers because usage is aggregated. B is false, C is false because compute is never unlimited or free, and D is false because each account still requires its own security configuration.

Answer: A
AWS Cost Explorer provides an interface to visualize, understand, and forecast AWS costs and usage over time. B logs API activity, C assesses security vulnerabilities, and D tracks configuration changes; none are cost-analysis tools.

Answer: A
AWS Budgets lets you set custom cost or usage thresholds and receive alerts when actual or forecasted spend exceeds them. B estimates costs for planning before deployment, C is a managed search service, and D improves network performance; none send spend-threshold alerts.

Answer: A
For steady, predictable, long-running workloads, committing to Reserved Instances or Savings Plans yields significant discounts versus On-Demand. B is flexible but the most expensive per hour for steady use, C risks interruption and is unsuitable for always-on databases, and D without commitment does not maximize savings for this pattern.

Answer: A
A designated Technical Account Manager is a feature of Enterprise Support, not Business Support, which is a key differentiator. B is false because Business Support includes 24x7 technical support, C is false because paid plans allow technical cases, and D is false because Business Support is intended for production workloads.