AWS Cloud Practitioner sample questions

Question 1

A finance-led review proposes paying only for the capacity each team actually consumes, stopping development environments when they are unused, and letting AWS carry the undifferentiated heavy lifting of running data centres.

Which Well-Architected pillar is the proposal most closely aligned with?

Accepted Answer

Cost optimisation. Adopting a consumption model, measuring overall efficiency and stopping spending on undifferentiated heavy lifting are design principles of the cost optimisation pillar. Operational excellence is the tempting choice because managed services reduce operational toil, but paying only for what you consume and attributing expenditure are cost principles.

Question 2

A company owns Windows Server licences that are licensed per physical core and wants to bring them to AWS under its existing licence terms.

Which EC2 purchasing option lets the company use these existing licences?

Accepted Answer

Dedicated Hosts. Dedicated Hosts give you a physical server with visibility of its sockets and physical cores, so you can bring your own per-socket or per-core licences. Dedicated Instances are the tempting option because they also run on single-tenant hardware, but they do not give you visibility or control of the underlying sockets and cores that such licences require.

Question 3

A team with no existing Microsoft SQL Server licences wants to run SQL Server on Amazon RDS and pay for the licence as part of its hourly usage.

Which licensing model on Amazon RDS for SQL Server fits this requirement?

Accepted Answer

License Included. With the License Included model, the SQL Server licence cost is built into the hourly price of the RDS DB instance, so no separately purchased licence is needed. BYOL is the trap: it only applies when the customer already owns eligible licences, which this team does not.

Question 4

Logs show attackers sending HTTP requests containing SQL injection and cross-site scripting payloads to a web application behind an Application Load Balancer.

Which AWS service should be placed in front of the application to block these requests?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that inspects HTTP(S) requests to resources such as CloudFront, Application Load Balancers and API Gateway, with rules that block patterns like SQL injection and cross-site scripting. Shield Standard is the trap: it protects against common network and transport layer DDoS attacks, not application-layer injection attacks.

Question 5

A team sees repeated malicious traffic from one external IP address to every instance in a public subnet and wants to block that address for the whole subnet.

Which control should the team use?

Accepted Answer

A network ACL rule on the subnet that denies traffic from that IP address. Network ACLs operate at the subnet level, are stateless and support both allow and deny rules, so they can block a specific address range. Security groups are the trap: they are stateful and support allow rules only, so you cannot write an explicit deny rule in a security group.

Question 6

A security team uses GuardDuty, Inspector and Macie across many accounts and wants a single view that aggregates their findings and checks resources against security best-practice standards.

Which AWS service provides this?

Accepted Answer

AWS Security Hub. Security Hub aggregates and prioritises security findings from services such as GuardDuty, Inspector and Macie, and runs automated checks against security best-practice standards. Trusted Advisor is tempting because it includes some security checks, but it does not aggregate findings from other security services into one view.

Question 7

A web application must send requests for /api/* to one group of containers and requests for /images/* to another, based on the URL path.

Which load balancer type should the architect choose?

Accepted Answer

Application Load Balancer. An Application Load Balancer operates at layer 7 and can route HTTP and HTTPS requests to different target groups based on content such as the URL path or host header. Network Load Balancer is the trap: it operates at layer 4 and handles very high volumes of TCP and UDP traffic with low latency, but it does not route on URL paths.

Question 8

Processing a loan application involves validating data, running a credit check, waiting for human approval and then sending a contract, with retries if the credit check service fails.

Which AWS service lets the team model this workflow as a state machine with built-in retries and error handling?

Accepted Answer

AWS Step Functions. Step Functions orchestrates multiple AWS services into workflows defined as state machines, with built-in retries, error handling and visual monitoring of each step. EventBridge is tempting because it connects services through events, but it routes events to targets rather than coordinating a sequential multi-step process with state.

Question 9

A company wants to give 500 remote employees a persistent, managed Windows desktop they can access from personal laptops, without shipping company hardware.

Which AWS service provides this?

Accepted Answer

Amazon WorkSpaces. WorkSpaces provides managed, persistent virtual desktops for Windows or Linux that users can reach from many devices. AWS Client VPN is the trap: it gives remote users secure network access to AWS and on-premises resources, but the employees would still need a company-managed computer to work on.

Question 10

A team is running a new application for an eight-week pilot. Usage is unpredictable, the application cannot tolerate interruptions, and the project may be cancelled at any time.

Which EC2 pricing option is most appropriate?

Accepted Answer

On-Demand Instances. On-Demand Instances have no long-term commitment and are billed only while running, which suits short-term, unpredictable workloads that must not be interrupted. Spot Instances are the tempting cheaper option, but they can be interrupted, which is unacceptable for this workload.

AWS Cloud Practitioner sample questions with answers

AWS Cloud Practitioner sample questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

More practice