AWS CLF-C02 Exam Questions
Task Statement 3.1: Define methods of deploying and operating in the AWS Cloud
Question 1
A solutions architect needs to quickly provision a single Amazon EC2 instance for a one-time proof-of-concept demonstration. Which method is the MOST appropriate?
A. AWS CloudFormation
B. AWS Management Console
C. AWS CLI with a complex script
D. AWS SDK in a custom application
Click to reveal answer
**Correct Answer: B** **Explanation:** The AWS Management Console is ideal for one-time, manual, or exploratory tasks because it provides a graphical interface that requires no coding. **Exam Tips / Traps:** - Key words: “one-time”, “quickly”, “proof-of-concept” → Console. - CloudFormation / IaC is for repeatable, automated deployments. - CLI and SDK are better for automation or programmatic access.Question 2
A company wants to automate the repeated deployment of a multi-tier web application stack that includes Amazon VPC, EC2, RDS, and load balancers. Which approach should they use?
A. Manually create resources in the AWS Management Console each time
B. Use infrastructure as code (IaC) with AWS CloudFormation
C. Use only the AWS CLI interactively
D. Access services exclusively through the AWS SDKs without templates
Click to reveal answer
**Correct Answer: B** **Explanation:** Infrastructure as Code (IaC) services such as AWS CloudFormation allow you to define resources in templates and deploy them repeatedly in a consistent, version-controlled manner. **Exam Tips / Traps:** - Key words: “repeated”, “automate”, “consistent” → IaC / CloudFormation. - Console is for one-time operations. - CLI/SDK can be scripted but CloudFormation is the dedicated IaC service highlighted in the exam.Question 3
Which of the following are valid ways to access and manage AWS services? (Choose THREE.)
A. AWS Management Console
B. AWS Command Line Interface (CLI)
C. AWS Software Development Kits (SDKs)
D. Direct physical access to AWS data centers
E. Only through third-party tools
Click to reveal answer
**Correct Answer: A, B, C** **Explanation:** AWS provides three primary access methods: - Graphical: AWS Management Console - Command-line: AWS CLI - Programmatic: APIs via SDKs **Exam Tips / Traps:** - You never get physical access to AWS hardware (shared responsibility). - The exam loves listing Console, CLI, and SDKs/APIs together.Question 4
A developer is writing a Python application that needs to create and manage Amazon S3 buckets programmatically. Which tool should the developer use?
A. AWS Management Console
B. AWS CLI only
C. AWS SDK for Python (Boto3)
D. AWS CloudFormation console
Click to reveal answer
**Correct Answer: C** **Explanation:** AWS SDKs (including Boto3 for Python) provide language-specific libraries to call AWS APIs programmatically from application code. **Exam Tips / Traps:** - Key word: “programmatically” + specific language → SDK. - CLI is for command-line scripting, not embedding inside application code. - Console is manual/GUI.Question 5
When would you choose the AWS CLI over the AWS Management Console?
A. When you need a graphical interface for beginners
B. When you want to perform repeatable scripting and automation from a terminal
C. When you need to define infrastructure in JSON/YAML templates
D. When you require the highest level of visual monitoring dashboards
Click to reveal answer
**Correct Answer: B** **Explanation:** The AWS CLI is designed for scripting, automation, and command-line operations, making it superior for repeatable tasks compared with the point-and-click Console. **Exam Tips / Traps:** - Console = visual / one-time / learning. - CLI = scripting / automation / speed for experienced users. - CloudFormation = full IaC templates.Question 6
A company is evaluating whether to perform a one-time configuration change or implement a repeatable process. Which statement is correct?
A. One-time operations should always use CloudFormation
B. Repeatable processes are best handled with infrastructure as code (IaC)
C. The AWS Management Console is ideal for all repeatable production deployments
D. SDKs cannot be used for repeatable processes
Click to reveal answer
**Correct Answer: B** **Explanation:** Repeatable processes benefit from IaC (CloudFormation, etc.) for consistency, version control, and automation. One-time operations are often done via the Console. **Exam Tips / Traps:** - Exam frequently tests “one-time vs repeatable”. - Remember: Console → one-time; IaC/CLI scripts → repeatable.Question 7
Which AWS service is an example of infrastructure as code (IaC)?
A. Amazon EC2
B. AWS CloudFormation
C. Amazon S3
D. AWS Identity and Access Management (IAM)
Click to reveal answer
**Correct Answer: B** **Explanation:** AWS CloudFormation is the primary AWS IaC service that lets you model and provision resources using templates. **Exam Tips / Traps:** - CloudFormation is the classic IaC example on the Cloud Practitioner exam. - Other tools (CDK, Terraform) exist but CloudFormation is the native AWS answer.Question 8
A company runs all of its applications exclusively on AWS with no on-premises data center. Which cloud deployment model is this?
A. Hybrid cloud
B. Private cloud
C. Public cloud (cloud-native)
D. On-premises
Click to reveal answer
**Correct Answer: C** **Explanation:** Running everything on a public cloud provider such as AWS is a public cloud / cloud-native deployment model. **Exam Tips / Traps:** - Public cloud = resources on AWS (or Azure/GCP) only. - Hybrid = mixture of cloud + on-premises. - Private cloud = dedicated cloud-like environment (e.g., Outposts or on-prem private cloud).Question 9
A company uses AWS for some workloads and keeps other workloads in its own on-premises data center, with applications communicating between both environments. What type of deployment is this?
A. Public cloud only
B. Multi-cloud
C. Hybrid environment / hybrid deployment
D. Private cloud only
Click to reveal answer
**Correct Answer: C** **Explanation:** Using AWS together with an on-premises data center is a hybrid deployment (or hybrid environment). **Exam Tips / Traps:** - Important distinction from the transcript: – Hybrid **environment** = AWS + traditional on-premises. – Hybrid **cloud** = public cloud + private cloud (both meeting cloud characteristics). - Exam may use either term; understand both.Question 10
What is a multi-cloud deployment model?
A. Using only AWS services
B. Using more than one public cloud provider (e.g., AWS + Azure)
C. Using AWS Outposts exclusively
D. Keeping everything on-premises
Click to reveal answer
**Correct Answer: B** **Explanation:** Multi-cloud means using multiple public cloud providers simultaneously (AWS + Azure, AWS + Google Cloud, etc.). **Exam Tips / Traps:** - Multi-cloud ≠ hybrid. - Hybrid involves on-premises or private cloud; multi-cloud involves multiple public clouds.Question 11
Which of the following best describes a private cloud?
A. Resources shared among many customers on AWS
B. A cloud environment with dedicated resources that still meets cloud computing characteristics, often on-premises (e.g., AWS Outposts)
C. Using AWS and Azure together
D. Any on-premises virtualization without cloud characteristics
Click to reveal answer
**Correct Answer: B** **Explanation:** Private cloud provides dedicated resources for one organization while still offering cloud benefits (elasticity, self-service, etc.). AWS Outposts is an example. **Exam Tips / Traps:** - Key point from transcript: private cloud must still meet cloud computing criteria and be dedicated. - Simply having servers on-premises is not automatically a private cloud.Question 12
Which statement correctly differentiates hybrid cloud from a hybrid environment?
A. They are exactly the same
B. Hybrid cloud = public + private cloud; hybrid environment = AWS + traditional on-premises data center
C. Hybrid cloud always includes multi-cloud
D. Hybrid environment requires AWS Outposts
Click to reveal answer
**Correct Answer: B** **Explanation:** Per the official review content: - Hybrid cloud = public cloud + private cloud. - Hybrid environment = AWS + on-premises data center. **Exam Tips / Traps:** - This distinction is frequently tested or used as a trap. - Read questions carefully for “cloud” vs “environment”.Question 13
Amazon S3 is considered which type of AWS service from a networking perspective?
A. Private service
B. Public service
C. Hybrid service
D. On-premises service
Click to reveal answer
**Correct Answer: B** **Explanation:** AWS public services (such as Amazon S3) reside in the AWS public zone and can be accessed over the public internet. **Exam Tips / Traps:** - Public service = reachable via public internet (S3, DynamoDB, etc.). - Private service = lives inside VPC / private zone (EC2, RDS by default).Question 14
By default, an Amazon EC2 instance launched inside a VPC is considered:
A. A public AWS service accessible from the internet
B. A private resource with no direct internet access
C. Automatically connected to AWS Outposts
D. Part of a multi-cloud setup
Click to reveal answer
**Correct Answer: B** **Explanation:** Resources inside the AWS private zone (VPC) are isolated by default and have no direct connection to the public internet unless explicitly configured (e.g., public IP + Internet Gateway). **Exam Tips / Traps:** - Default = private / isolated. - You must add an Internet Gateway, route tables, and public IP to make it public.Question 15
A company wants a dedicated, private network connection from its on-premises data center to AWS that does not traverse the public internet. Which service should they use?
A. Internet Gateway
B. AWS VPN over the public internet
C. AWS Direct Connect
D. NAT Gateway
Click to reveal answer
**Correct Answer: C** **Explanation:** AWS Direct Connect provides a dedicated private connection from on-premises to AWS. “Dedicated” is a key word associated with Direct Connect. **Exam Tips / Traps:** - Key words: “dedicated”, “private connection”, “does not use public internet” → Direct Connect. - Site-to-Site VPN uses the public internet (encrypted). - Internet Gateway is for VPC-to-internet traffic.Question 16
What is required to allow Amazon EC2 instances in a public subnet to communicate with the public internet?
A. NAT Gateway only
B. Internet Gateway
C. AWS Direct Connect
D. Virtual Private Gateway only
Click to reveal answer
**Correct Answer: B** **Explanation:** An Internet Gateway (IGW) is a horizontally scaled, redundant, highly available VPC component that allows communication between instances in your VPC and the internet. **Exam Tips / Traps:** - Public subnet + IGW = outbound/inbound internet access (with public IPs). - NAT Gateway is for private subnets to initiate outbound internet traffic only. - Classic trap: confusing IGW vs NAT Gateway.Question 17
Which connectivity option encrypts traffic over the public internet between an on-premises network and AWS?
A. AWS Direct Connect (without MACsec)
B. AWS Site-to-Site VPN
C. Internet Gateway
D. Public Amazon S3 endpoint
Click to reveal answer
**Correct Answer: B** **Explanation:** AWS Site-to-Site VPN creates an encrypted tunnel over the public internet. Direct Connect is a private dedicated link (can be combined with VPN for encryption). **Exam Tips / Traps:** - VPN = encrypted + uses public internet. - Direct Connect = dedicated private connection (lower latency, consistent performance).Question 18
A company wants to keep sensitive workloads on-premises while still using AWS for less-sensitive scalable applications, with connectivity between both. Which deployment model and connectivity method are MOST appropriate?
A. Public cloud only + Internet Gateway
B. Hybrid deployment + AWS Direct Connect or VPN
C. Multi-cloud + NAT Gateway
D. Private cloud only + no connectivity
Click to reveal answer
**Correct Answer: B** **Explanation:** This is a classic hybrid deployment. Connectivity is typically established via Direct Connect (dedicated) or Site-to-Site VPN. **Exam Tips / Traps:** - Reasons to stay hybrid: data residency, latency, legacy systems, compliance. - Exam loves hybrid use cases.Question 19
Which of the following statements about accessing AWS services is correct?
A. All AWS services can only be accessed via the Management Console
B. Programmatic access via APIs, SDKs, or CLI is available for virtually all AWS services
C. Infrastructure as code cannot be used with the CLI
D. The Console cannot be used for any production workloads
Click to reveal answer
**Correct Answer: B** **Explanation:** Almost every AWS service offers API access, which can be consumed via SDKs, CLI, or other tools. The Console itself also calls the same APIs. **Exam Tips / Traps:** - Everything in AWS is API-driven. - Console, CLI, SDKs, and IaC are just different interfaces to the same APIs.Question 20
A team needs to decide between using the AWS Management Console and AWS CloudFormation for production infrastructure. Which factor should MOST influence the decision toward CloudFormation?
A. The team prefers a graphical point-and-click experience
B. The infrastructure must be deployed repeatedly across multiple accounts and regions with consistency
C. It is a one-time experimental setup
D. No one on the team knows how to write templates
Click to reveal answer
**Correct Answer: B** **Explanation:** CloudFormation (IaC) excels at repeatable, consistent, multi-account/multi-region deployments and supports version control and automation. **Exam Tips / Traps:** - Final reminder of the core skill: – One-time / learning / quick → Console – Repeatable / production / consistent → IaC (CloudFormation) – Scripting / automation → CLI – Application code integration → SDKsEnd of Question Set (20 Questions)
These questions align with the official CLF-C02 Task Statement 3.1 knowledge and skills, the provided video transcript, and typical Cloud Practitioner difficulty. Good luck with your exam preparation!