AWS Cloud Practitioner (CLF-C02) — Free Sample Questions
Test your foundational AWS knowledge with 30 free sample questions drawn from the NestedCerts Cloud Practitioner question bank. Each question includes a detailed explanation of the correct answer and why each distractor is wrong.
What These Questions Cover
The AWS Certified Cloud Practitioner exam (CLF-C02) tests four domains:
- Cloud Concepts (24%) — value proposition of the AWS Cloud, design principles, migration strategies
- Security and Compliance (30%) — shared responsibility model, IAM, encryption, compliance programs
- Cloud Technology and Services (34%) — compute, storage, database, networking, and managed services
- Billing, Pricing, and Support (12%) — pricing models, cost management tools, support plans
Sample Question Format
Each question mirrors the real exam format: a scenario followed by four answer options. Questions are scenario-based — you must interpret a real-world situation, not simply recall a definition.
How to Use These Sample Questions
- Attempt each question without looking at the explanation first
- Read the detailed explanation regardless of whether you got it right
- Note the domain tag — if you miss several in the same domain, focus your study there
- After the free samples, continue with 600 questions across 30 quizzes and 2 full-length exams
Ready for More?
The full Cloud Practitioner path includes 30 daily quizzes (20 questions each) and 2 full-length practice exams (65 questions each) — 600 questions total with detailed explanations for every answer.
All 30 Free Sample Questions
Question 1 — Cloud Concepts (24%)
A global company needs to serve dynamic web content to users in Asia, Europe, and North America with low latency. Which AWS capability best addresses this requirement?
- Vertical scaling
- Global infrastructure with multiple Regions — Correct answer
- Horizontal scaling
- Multi-AZ deployment
Explanation:
- Why correct: AWS global infrastructure with multiple Regions allows the company to deploy the application closer to users in each geography, reducing latency.
- Why A is wrong: Vertical scaling increases the size of a server but does not reduce latency caused by geographic distance.
- Why C is wrong: Horizontal scaling increases capacity by adding more instances, typically within the same Region, and does not by itself address global latency.
- Why D is wrong: Multi-AZ deployment improves availability within a single Region but does not address serving users across continents with low latency.
Question 2 — Cloud Concepts (24%)
A company implements multi-factor authentication (MFA) for all user accounts and encrypts data at rest. Which Well-Architected Framework pillar do these practices support?
- Operational Excellence
- Performance Efficiency
- Security — Correct answer
- Reliability
Explanation:
- Why correct: The Security pillar encompasses protecting information, systems, and assets. MFA strengthens identity and access management, while encryption at rest protects data—both are core security practices.
- Why A is wrong: Operational Excellence focuses on running and monitoring systems, not on access controls and data protection.
- Why B is wrong: Performance Efficiency focuses on efficient use of computing resources, not on security controls.
- Why D is wrong: Reliability focuses on recovery from failures and meeting demand, not on security controls.
Question 3 — Cloud Concepts (24%)
A company wants to move to a SaaS-based CRM system instead of migrating their current on-premises CRM to AWS. Which migration strategy is this?
- Replatform
- Refactor
- Repurchase — Correct answer
- Rehost
Explanation:
- Why correct: Repurchase (also known as "drop and shop") involves moving to a different product, typically a SaaS solution. Moving from an on-premises CRM to a SaaS-based CRM is a repurchase strategy.
- Why A is wrong: Replatform involves making some optimizations while migrating the existing application, not replacing it with a different product.
- Why B is wrong: Refactor involves re-architecting the existing application, not replacing it with a SaaS solution.
- Why D is wrong: Rehost is lift-and-shift of the existing application, not replacing it with a different product.
Question 4 — Cloud Concepts (24%)
A company manually provisions and configures servers, which frequently leads to misconfigurations that take hours to troubleshoot. The company wants to use AWS to reduce these costs. How does automation in AWS help?
- By eliminating the need for any IT staff
- By reducing manual labor, errors, and deployment time — Correct answer
- By eliminating the need for application testing
- By converting variable costs into fixed monthly charges
Explanation:
- Why correct: Automation through AWS services such as CloudFormation, CodePipeline, and Auto Scaling reduces manual configuration work, minimizes costly human errors like misconfigurations, and accelerates deployments—all of which lower operational costs.
- Why A is wrong: Automation reduces the volume of routine manual tasks, but IT staff are still needed for architecture decisions, monitoring, incident response, and optimization.
- Why C is wrong: Automation can streamline testing workflows, but it does not replace the need for application testing. Testing remains essential to ensure quality and reliability.
- Why D is wrong: AWS automation supports a pay-as-you-go (variable cost) model. It does not convert variable costs into fixed charges—the cloud model does the opposite by shifting from fixed to variable spending.
Question 5 — Cloud Concepts (24%)
A company decides to replace an on-premises application with a SaaS product rather than moving the existing application to AWS. Which migration strategy is this?
- Rehost
- Replatform
- Repurchase — Correct answer
- Refactor
Explanation:
- Why correct: Repurchase (drop and shop) involves moving to a different product, typically a SaaS solution, instead of migrating the existing application to AWS infrastructure.
- Why A is wrong: Rehost is lift-and-shift of the existing application.
- Why B is wrong: Replatform optimizes the existing application during migration.
- Why D is wrong: Refactor re-architects the existing application, not replacing it with SaaS.
Question 6 — Security and Compliance (30%)
Which responsibilities are shared between AWS and the customer? (Select TWO)
- Physical security of data centers
- Application code security
- Configuration management — Correct answer
- Patch management — Correct answer
- Hardware disposal
Explanation:
- Why correct: **Configuration management** and **patch management** are shared responsibilities. AWS manages configuration and patching for the AWS infrastructure and for managed service components, while customers manage configuration and patching for the resources they control (for example, guest OS and applications on Amazon EC2).
- Why A is wrong: **Physical security of data centers** is AWS's responsibility (security *of* the cloud).
- Why B is wrong: **Application code security** is the customer's responsibility (security *in* the cloud).
- Why E is wrong: **Hardware disposal** is AWS's responsibility as part of operating AWS data centers.
Question 7 — Security and Compliance (30%)
A company needs to encrypt data at rest in Amazon S3 using keys that it can create and control. Which AWS service manages these encryption keys?
- AWS Secrets Manager
- AWS Certificate Manager (ACM)
- AWS CloudHSM
- AWS Key Management Service (KMS) — Correct answer
Explanation:
- Why correct: AWS Key Management Service (KMS) is a managed service that creates and controls encryption keys used to encrypt data. It integrates with Amazon S3 for encryption at rest (for example, SSE-KMS).
- Why A is wrong: AWS Secrets Manager stores and rotates secrets like database passwords and API keys. It is not the standard service for managing S3 data encryption keys.
- Why B is wrong: AWS Certificate Manager (ACM) manages SSL/TLS certificates for encryption in transit, not encryption keys for data at rest.
- Why C is wrong: AWS CloudHSM provides dedicated hardware security modules for specialized key management requirements, but KMS is the standard managed key service for most S3 encryption use cases.
Question 8 — Security and Compliance (30%)
A new AWS account is being set up for a small team. Which IAM best practices should be followed? (Select TWO)
- Enable MFA for privileged users — Correct answer
- Share root user credentials with the team
- Grant least privilege permissions — Correct answer
- Use the root user for daily tasks
- Store access keys in application code
Explanation:
- Why correct: The best practices are to use MFA for privileged access and to grant only the permissions required (least privilege). This reduces the likelihood and impact of unauthorized access.
- Why A is correct: Enabling MFA for privileged users adds a second authentication factor, which helps protect high-privilege accounts.
- Why B is wrong: Root user credentials should never be shared with a team.
- Why C is correct: Granting least privilege permissions limits access to only what users need to do their jobs.
- Why D is wrong: The root user should not be used for daily tasks; use IAM users or roles instead.
- Why E is wrong: Access keys should not be stored in application code; use IAM roles or a secure credential store instead.
Question 9 — Security and Compliance (30%)
A company runs a public web application and wants to block common web exploits such as SQL injection and cross-site scripting at the application layer. Which AWS service should they use?
- Amazon Inspector
- Amazon GuardDuty
- AWS WAF — Correct answer
- AWS Shield
Explanation:
- Why correct: AWS WAF helps protect web applications by filtering and blocking common web exploits such as SQL injection and cross-site scripting (XSS) using managed rules and custom rules.
- Why A is wrong: Amazon Inspector assesses workloads for vulnerabilities and unintended network exposure; it does not filter or block web requests in real time.
- Why B is wrong: Amazon GuardDuty detects suspicious activity by analyzing logs and events; it does not sit in-line to block web exploits.
- Why D is wrong: AWS Shield is focused on DDoS protection and does not provide application-layer request inspection for SQL injection or XSS.
Question 10 — Security and Compliance (30%)
A company hosts a public web application behind an Application Load Balancer and needs to block common Layer 7 attacks such as SQL injection and cross-site scripting. Which AWS service should they use?
- AWS WAF — Correct answer
- Amazon GuardDuty
- AWS Shield
- AWS Firewall Manager
Explanation:
- Why correct: AWS WAF filters web requests using rules that can block common application-layer exploits such as SQL injection and cross-site scripting.
- Why Amazon GuardDuty is wrong: GuardDuty is a threat detection service that analyzes logs and events; it does not block web requests.
- Why AWS Shield is wrong: Shield provides DDoS protection, but it is not designed to inspect or block application-layer exploits like SQL injection.
- Why AWS Firewall Manager is wrong: Firewall Manager helps centrally manage firewall rules (including WAF) across accounts, but AWS WAF is the service that directly blocks these web attacks.
Question 11 — Cloud Technology and Services (34%)
A developer wants to write a Python script to automate EC2 instance management. What should they use?
- AWS Outposts
- AWS SDK for Python (Boto3) — Correct answer
- AWS Management Console
- AWS CloudFormation
Explanation:
- Why correct: AWS SDK for Python (Boto3) provides Python libraries to interact with AWS services programmatically. It's the appropriate tool for writing Python scripts to manage AWS resources.
- Why A is wrong: AWS Outposts is for running AWS infrastructure on-premises in a hybrid deployment, not for Python scripting.
- Why C is wrong: The AWS Management Console is a web interface for interactive management, not for running Python automation.
- Why D is wrong: AWS CloudFormation provisions infrastructure from templates; it is not used by writing Python scripts to directly manage resources.
Question 12 — Cloud Technology and Services (34%)
What is the primary benefit of deploying an application across multiple Availability Zones?
- Lower costs
- High availability and fault tolerance — Correct answer
- Faster application performance
- Simplified management
Explanation:
- Why correct: Multi-AZ deployment provides high availability and fault tolerance by ensuring the application continues running even if one AZ experiences an outage. This is the primary benefit of multi-AZ architecture.
- Why A is wrong: Multi-AZ deployment typically increases costs due to resource duplication.
- Why C is wrong: While multi-AZ can improve availability, it doesn't necessarily make applications faster.
- Why D is wrong: Multi-AZ deployment adds complexity rather than simplifying management.
Question 13 — Cloud Technology and Services (34%)
A developer needs to run code in response to events without provisioning or managing servers. Which compute service should they use?
- Amazon S3
- AWS Lambda — Correct answer
- Amazon EC2
- Amazon RDS
Explanation:
- Why correct: AWS Lambda is a serverless compute service that runs code in response to events without requiring you to provision or manage servers.
- Why A is wrong: Amazon S3 is an object storage service, not a compute service.
- Why C is wrong: Amazon EC2 requires provisioning and managing virtual servers.
- Why D is wrong: Amazon RDS is a managed database service, not a compute service.
Question 14 — Cloud Technology and Services (34%)
Which AWS database services are fully managed? (Select TWO)
- A MySQL database installed and managed by the customer on Amazon EC2
- An Oracle database hosted on a company-owned on-premises server
- A MongoDB database deployed and maintained by the customer in Docker containers
- Amazon DynamoDB — Correct answer
- Amazon RDS — Correct answer
Explanation:
- Why correct: Amazon DynamoDB and Amazon RDS are fully managed database services where AWS handles the underlying infrastructure, patching, backups, and common operational tasks.
- Why "A MySQL database installed and managed by the customer on Amazon EC2" is wrong: Running a database on EC2 is self-managed; the customer is responsible for OS patching, database installation, backups, and all operational maintenance.
- Why "An Oracle database hosted on a company-owned on-premises server" is wrong: An on-premises database is entirely customer-managed with no AWS operational support for the database layer.
- Why "A MongoDB database deployed and maintained by the customer in Docker containers" is wrong: A containerized database managed by the customer is still self-managed; the customer handles deployments, patching, backups, and scaling.
- Why "Amazon DynamoDB" is correct: DynamoDB is a fully managed NoSQL database service.
- Why "Amazon RDS" is correct: RDS is a fully managed relational database service.
Question 15 — Cloud Technology and Services (34%)
A company wants its Amazon EC2 instances in a private subnet to access Amazon S3 without sending traffic through a NAT Gateway or the public internet. Which VPC feature enables direct, private connectivity to Amazon S3?
- NAT Gateway
- VPC gateway endpoint — Correct answer
- Internet Gateway
- VPC peering connection
Explanation:
- Why correct: A VPC gateway endpoint provides a private connection between your VPC and supported AWS services such as Amazon S3 and DynamoDB. Traffic stays on the AWS network and does not traverse the public internet, eliminating the need for a NAT Gateway and reducing data transfer costs.
- Why NAT Gateway is wrong: A NAT Gateway does allow private subnet instances to reach S3, but traffic exits through the internet. The scenario specifically requires connectivity without a NAT Gateway or the public internet.
- Why Internet Gateway is wrong: An Internet Gateway enables communication between a VPC and the public internet. Using it for S3 access would route traffic over the internet, which contradicts the requirement.
- Why VPC peering connection is wrong: VPC peering connects two VPCs for private communication between them. It does not provide connectivity to AWS services like Amazon S3.
Question 16 — Cloud Technology and Services (34%)
A research team runs high-performance computing (HPC) workloads that require a high-throughput, low-latency shared file system on AWS. Which Amazon FSx file system is optimized for this use case?
- FSx for Windows File Server
- FSx for OpenZFS
- FSx for Lustre — Correct answer
- FSx for NetApp ONTAP
Explanation:
- Why correct: Amazon FSx for Lustre is optimized for high-performance computing (HPC), machine learning, and media processing workloads, providing high throughput and low latencies.
- Why A is wrong: FSx for Windows File Server is optimized for Windows workloads using SMB and Active Directory integration.
- Why B is wrong: FSx for OpenZFS is a managed file system for ZFS-compatible workloads, not specifically optimized for HPC.
- Why D is wrong: FSx for NetApp ONTAP is designed for enterprise NAS use cases and feature-rich data management, not primarily for HPC performance.
Question 17 — Cloud Technology and Services (34%)
An analytics team needs a fully managed service to discover datasets, create metadata, and run ETL jobs to transform raw data into analytics-ready formats. Which AWS service should they use?
- AWS Glue — Correct answer
- Amazon S3
- Amazon VPC
- Amazon EC2
Explanation:
- Why correct: AWS Glue is a fully managed ETL service that can catalog data, run transformations, and load data for analytics.
- Why Amazon S3 is wrong: Amazon S3 stores data but does not provide a managed ETL engine.
- Why Amazon VPC is wrong: Amazon VPC is for networking and isolation, not ETL.
- Why Amazon EC2 is wrong: You can run custom ETL on EC2, but EC2 requires you to manage servers; AWS Glue is the managed ETL service.
Question 18 — Cloud Technology and Services (34%)
An e-commerce company wants to notify its mobile app users, email subscribers, and an HTTP webhook endpoint simultaneously whenever a flash sale begins. Which AWS service allows the company to push this notification to all subscribers at once?
- Amazon Connect
- Amazon SNS — Correct answer
- Amazon SQS
- Amazon SES
Explanation:
- Why correct: Amazon SNS (Simple Notification Service) is a pub/sub messaging service that pushes notifications to multiple subscribers simultaneously via protocols such as email, SMS, HTTP/HTTPS, and mobile push.
- Why A is wrong: Amazon Connect is a cloud-based contact center service for handling customer calls and chats, not a notification delivery service.
- Why C is wrong: Amazon SQS is a message queue where consumers poll for messages one at a time. It does not push notifications to multiple subscribers simultaneously.
- Why D is wrong: Amazon SES (Simple Email Service) sends email only. It cannot deliver notifications via SMS, HTTP, or mobile push.
Question 19 — Cloud Technology and Services (34%)
A business analyst wants to build and share interactive dashboards and visualizations using an AWS-managed business intelligence service. Which service should they use?
- Amazon S3
- Amazon Athena
- Amazon QuickSight — Correct answer
- Amazon EC2
Explanation:
- Why correct: Amazon QuickSight is AWS's managed business intelligence (BI) service for creating dashboards and visualizations.
- Why Amazon S3 is wrong: S3 stores data but does not provide BI dashboards.
- Why Amazon Athena is wrong: Athena is used to query data with SQL, but it is not a BI visualization tool.
- Why Amazon EC2 is wrong: EC2 provides compute instances, not a managed BI service.
Question 20 — Billing, Pricing, and Support (12%)
A company needs the lowest-cost Amazon S3 storage for long-term archives that are rarely accessed and can tolerate retrieval times of 12+ hours. Which S3 storage class has the lowest storage cost per GB?
- S3 Glacier Deep Archive — Correct answer
- S3 Standard
- S3 Intelligent-Tiering
- S3 One Zone-IA
Explanation:
- Why correct: S3 Glacier Deep Archive is designed for long-term archival and has the lowest storage cost per GB among S3 storage classes, with retrieval times of up to 12 hours or more.
- Why 'S3 Standard' is wrong: S3 Standard provides low-latency access for frequently accessed data and has a significantly higher storage cost per GB.
- Why 'S3 Intelligent-Tiering' is wrong: S3 Intelligent-Tiering automatically moves objects between access tiers to reduce costs, but its per-GB storage cost is higher than Glacier Deep Archive.
- Why 'S3 One Zone-IA' is wrong: S3 One Zone-IA is lower cost than S3 Standard for infrequently accessed data, but it is still considerably more expensive per GB than S3 Glacier Deep Archive.
Question 21 — Billing, Pricing, and Support (12%)
A finance team has applied cost allocation tags to all AWS resources by project and team. They need to export detailed line-item billing data that includes these tag values for analysis in their internal accounting system. Which AWS service provides this data?
- AWS Pricing Calculator
- AWS Cost and Usage Report — Correct answer
- AWS Budgets
- AWS Billing Dashboard
Explanation:
- Why correct: The AWS Cost and Usage Report (CUR) is the most granular billing data source AWS provides. Once cost allocation tags are activated in the Billing Console, they appear as columns in the CUR, allowing the finance team to filter, sort, and analyze costs by tagged dimensions such as project or team.
- Why A is wrong: AWS Pricing Calculator estimates costs before deployment based on projected usage; it does not contain actual tagged cost data from running resources.
- Why C is wrong: AWS Budgets tracks spending against thresholds and sends alerts but does not provide detailed line-item exports broken down by tag.
- Why D is wrong: The Billing Dashboard shows high-level summaries of current charges and top services but does not provide downloadable line-item data grouped by cost allocation tags.
Question 22 — Billing, Pricing, and Support (12%)
Which support plan includes access to AWS Trusted Advisor full checks?
- Developer Support
- Basic Support
- No support plan includes Trusted Advisor
- Business Support or higher — Correct answer
Explanation:
- Why correct: Business Support and Enterprise Support plans include access to the full set of AWS Trusted Advisor checks across cost optimization, security, fault tolerance, performance, and service limits. Basic and Developer Support only include 7 core Trusted Advisor checks.
- Why Developer Support is wrong: Developer Support only provides access to the 7 core Trusted Advisor checks, the same limited set available with Basic Support.
- Why Basic Support is wrong: Basic Support only includes the 7 core Trusted Advisor checks (such as S3 bucket permissions and MFA on root account), not the full set of checks.
- Why 'No support plan includes Trusted Advisor' is wrong: All AWS Support plans include some level of Trusted Advisor access. Basic and Developer include 7 core checks, while Business and Enterprise include the full set of checks.
Question 23 — Billing, Pricing, and Support (12%)
A small team is experimenting with AWS for a non-production proof-of-concept and wants email access to Cloud Support Associates during business hours at the lowest possible cost. Which AWS Support plan should they choose?
- Basic Support
- Developer Support — Correct answer
- Business Support
- Enterprise Support
Explanation:
- Why correct: Developer Support is designed for early development and testing environments, providing email access to Cloud Support Associates during business hours with response times of less than 12 hours for system-impaired cases — at the lowest cost among paid plans.
- Why A is wrong: Basic Support does not include access to Cloud Support Associates for technical issues — it only provides documentation, whitepapers, and community forums.
- Why C is wrong: Business Support provides 24/7 phone, email, and chat access and is designed for production workloads, making it more expensive than needed for a non-production proof-of-concept.
- Why D is wrong: Enterprise Support is the highest-tier plan with a designated TAM and the fastest response times, far exceeding what a small team needs for experimentation.
Question 24 — All Domains (Comprehensive Review)
A company notices unusual API calls and potential unauthorized access attempts in their AWS environment. Which service uses machine learning to continuously monitor for malicious activity and unauthorized behavior?
- AWS WAF
- Amazon GuardDuty — Correct answer
- AWS Shield
- AWS Config
Explanation:
- Why correct: Amazon GuardDuty is a threat detection service that continuously monitors AWS accounts and workloads for malicious activity using machine learning, anomaly detection, and integrated threat intelligence. It analyzes CloudTrail logs, VPC Flow Logs, and DNS logs to identify threats such as compromised instances and unauthorized access.
- Why A is wrong: AWS WAF is a web application firewall that filters HTTP/HTTPS traffic to protect web applications from exploits like SQL injection and XSS. It does not detect unauthorized API calls or account-level threats.
- Why C is wrong: AWS Shield provides protection against DDoS attacks at the network and transport layers. It does not detect suspicious API activity or unauthorized account access.
- Why D is wrong: AWS Config tracks resource configuration changes and evaluates compliance rules. It does not use machine learning to detect malicious activity or analyze API call patterns for threats.
Question 25 — Cloud Concepts (24%)
A company needs to migrate its on-premises applications to AWS as quickly as possible with minimal code changes to meet an upcoming data center lease expiration. Which migration strategy best fits this requirement?
- Refactor
- Rehost — Correct answer
- Repurchase
- Retire
Explanation:
- Why correct: Rehost, also known as 'lift and shift,' involves moving applications to the cloud with minimal or no changes. This is the fastest migration strategy and is ideal when time pressure exists, such as an expiring data center lease.
- Why A is wrong: Refactor (re-architect) involves redesigning the application to take full advantage of cloud-native features, which requires significant time and effort — the opposite of a fast migration.
- Why C is wrong: Repurchase involves replacing the current application with a different product, typically a SaaS solution, which does not describe moving existing applications as-is.
- Why D is wrong: Retire means decommissioning applications that are no longer needed, not migrating them to the cloud.
Question 26 — Cloud Technology and Services (34%)
An e-commerce application has a web tier that accepts customer orders and a separate processing tier that handles fulfillment. The team wants to decouple these tiers so that orders are not lost if the processing tier is temporarily unavailable. Which AWS service should they place between the two tiers?
- Amazon SNS
- AWS Lambda
- Amazon SQS — Correct answer
- Amazon API Gateway
Explanation:
- Why correct: Amazon SQS (Simple Queue Service) is a fully managed message queuing service that decouples application components. By placing orders into an SQS queue, the web tier can respond to users immediately while the processing tier pulls and handles orders asynchronously, preventing message loss if the processor is temporarily unavailable.
- Why A is wrong: Amazon SNS is a pub/sub notification service that pushes messages to multiple subscribers simultaneously. It does not retain messages for asynchronous processing the way a queue does, so if the processing service is down, messages could be lost.
- Why B is wrong: AWS Lambda is a serverless compute service that runs code in response to events. While Lambda could process the orders, it is not the decoupling mechanism itself — you would still need a queue or event source to decouple the components.
- Why D is wrong: Amazon API Gateway is a service for creating, publishing, and managing REST and WebSocket APIs. It handles HTTP request routing to backends but does not provide message queuing or buffering between application tiers.
Question 27 — Security and Compliance (30%)
A security team needs to determine who deleted an Amazon S3 bucket in their AWS account last week. Which AWS service records API activity and provides this audit trail?
- Amazon CloudWatch
- AWS CloudTrail — Correct answer
- AWS Config
- Amazon Inspector
Explanation:
- Why correct: AWS CloudTrail records all API calls made in your AWS account, including the identity of the caller, the time of the call, the source IP address, and the action performed. This makes it the right service for determining who performed a specific action such as deleting an S3 bucket.
- Why 'Amazon CloudWatch' is wrong: CloudWatch monitors performance metrics and logs but does not track who made specific AWS API calls.
- Why 'AWS Config' is wrong: AWS Config tracks resource configuration state over time but does not record the identity of who made a specific API call.
- Why 'Amazon Inspector' is wrong: Amazon Inspector is a vulnerability assessment service that scans workloads for software vulnerabilities, not an API audit tool.
Question 28 — Security and Compliance (30%)
A security engineer needs to protect a web application from SQL injection attacks and detect unauthorized API calls within the AWS account. Which TWO services should they use? (Select TWO)
- AWS WAF — Correct answer
- Amazon Inspector
- AWS CloudTrail — Correct answer
- Amazon S3
- AWS Trusted Advisor
Explanation:
- Why correct: AWS WAF (Web Application Firewall) protects web applications from common exploits including SQL injection by filtering HTTP/HTTPS requests. AWS CloudTrail records API calls made within the AWS account, enabling detection of unauthorized activity.
- Why B is wrong: Amazon Inspector assesses EC2 instances and container images for software vulnerabilities and unintended network exposure, but does not filter web application traffic for SQL injection.
- Why D is wrong: Amazon S3 is object storage and does not provide security monitoring or web application protection.
- Why E is wrong: AWS Trusted Advisor provides best-practice recommendations across cost, security, performance, and fault tolerance, but does not actively protect against SQL injection or log individual API calls.
Question 29 — Cloud Technology and Services (34%)
A company runs hundreds of AWS resources across development, staging, and production environments. They need a centralized way to organize these resources by environment and apply bulk operations. Which AWS service should they use?
- AWS Resource Groups and Tag Editor — Correct answer
- AWS CloudFormation
- AWS Config
- Amazon CloudWatch
Explanation:
- Why correct: AWS Resource Groups and Tag Editor lets you organize AWS resources by tags (such as environment, project, or cost center) and perform bulk actions on grouped resources. It provides a centralized view of resources that share common tags across services and Regions.
- Why B is wrong: AWS CloudFormation provisions and manages resources through infrastructure-as-code templates, but it is not designed for organizing and tagging existing resources across your account.
- Why C is wrong: AWS Config tracks configuration changes and evaluates compliance rules, but it does not provide resource grouping or bulk tagging capabilities.
- Why D is wrong: Amazon CloudWatch collects metrics, logs, and alarms for monitoring — it does not provide resource organization or tagging functionality.
Question 30 — Cloud Technology and Services (34%)
A company is migrating to AWS and needs to create an isolated network environment with custom IP address ranges, subnets, and route tables to host its web application and database tiers separately. Which AWS service should they use?
- AWS Direct Connect
- Amazon VPC — Correct answer
- AWS Transit Gateway
- Amazon Route 53
Explanation:
- Why correct: Amazon VPC (Virtual Private Cloud) lets you provision a logically isolated network within AWS. You define your own IP address range, create public and private subnets, and configure route tables — exactly what is needed to separate web and database tiers.
- Why A is wrong: AWS Direct Connect provides a dedicated network connection from on-premises to AWS. It does not create an isolated cloud network with subnets and route tables.
- Why C is wrong: AWS Transit Gateway connects multiple VPCs and on-premises networks together. You still need a VPC first; Transit Gateway is for inter-network routing, not for creating the isolated environment itself.
- Why D is wrong: Amazon Route 53 is a DNS service for domain registration and traffic routing. It does not create network environments with IP ranges and subnets.
JavaScript is required to use this application.
Please enable JavaScript in your browser to access the full NestedCerts platform.
Contact: support@nestedcerts.com