10 AWS Cloud Practitioner Questions Most Candidates Get Wrong
Here are 10 practice questions designed to mirror the style, difficulty, and domain coverage of the AWS Cloud Practitioner exam.
These questions cover core concepts across AWS pricing, global infrastructure, security, and core services. Test your knowledge, and check the explanations at the end of each question to reinforce your understanding. For more on this topic, see our guide on AWS Cloud Practitioner Cut Score Explained: Why the Percentage You See Is Not the One You Need.
Question 1
A company wants to move its on-premises data center to AWS but needs to maintain a private, dedicated connection between its office and the AWS cloud for compliance reasons. Which AWS service should they use?
Answer: B
Explanation: AWS Direct Connect establishes a dedicated, private network connection from an on-premises data center to AWS, bypassing the public internet. Site-to-Site VPN uses the public internet, VPC Peering connects VPCs, and Transit Gateway connects multiple VPCs and on-premises networks via a hub, but Direct Connect is the specific service for a dedicated physical link.
Question 2
A startup is launching a new application and expects unpredictable traffic spikes. They want to avoid the risk of over-provisioning or under-provisioning capacity. Which AWS pricing model is the most suitable for their compute needs?
Answer: A
Explanation: On-Demand pricing allows you to pay for compute capacity by the hour or second with no long-term commitments, making it ideal for unpredictable workloads. Reserved Instances require a 1- or 3-year commitment, Spot Instances are for fault-tolerant, interruptible workloads, and Dedicated Hosts are for meeting server-bound licensing requirements.
Question 3
A solutions architect needs to securely store database credentials, API keys, and other secrets for an application running on Amazon EC2. The solution must automatically rotate the secrets to meet security best practices. Which AWS service should they use?
Answer: B
Explanation: AWS Secrets Manager is specifically designed to manage secrets throughout their lifecycle, including automatic rotation. AWS KMS manages encryption keys, Parameter Store stores configuration data and strings (but lacks native rotation), and IAM manages user permissions and access keys, not application secrets.
Question 4
A company is designing a disaster recovery plan and wants to ensure their data is replicated to a secondary region automatically. They need a storage solution that is highly durable and available across multiple geographic locations. Which Amazon S3 storage class should they use? Want to go further? AWS Cloud Practitioner Difficulty: What Actually Makes People Fail is a good next step.
If you're mapping out your study time, a free AWS Certified Cloud Practitioner study plan can turn your available hours each week into a clear schedule.
Answer: A
Explanation: Amazon S3 Standard provides high durability (99.999999999%) and availability by automatically replicating data across a minimum of three Availability Zones (AZs) within a region. It is the default class for frequently accessed data. One Zone-IA stores data in only one AZ, and Glacier Deep Archive is for long-term archival, neither providing multi-AZ redundancy for active data.
Question 5
A user needs to launch a new Amazon EC2 instance. To ensure the instance is compliant with the company's security policies, they must automatically apply a specific set of firewall rules that control inbound and outbound traffic. What should they attach to the instance?
Answer: A
Explanation: A security group acts as a virtual firewall for an EC2 instance, controlling inbound and outbound traffic at the instance level. A network ACL operates at the subnet level. An IAM role grants permissions to the instance for AWS API calls, and a bucket policy is for S3 bucket access.
Question 6
A company wants to perform a cost analysis to identify which of its many departments is using the most AWS resources. They have tagged all their resources with a "Department" key. Which AWS tool can they use to visualize and analyze this usage data?
Answer: B
Explanation: AWS Cost Explorer provides easy-to-use charts and graphs to visualize, understand, and manage AWS costs and usage over time. It allows you to filter and group data by tags, such as "Department". AWS Budgets sets alerts for spending, Trusted Advisor offers best-practice checks, and Organizations is for centrally managing multiple accounts.
Question 7
A developer is building a serverless application that should execute a piece of code in response to a file being uploaded to an Amazon S3 bucket. Which AWS service is the most appropriate for this task?
Answer: B If you're preparing for this exam, AWS Cloud Practitioner Study Plan: 4 Weeks to Certified is essential reading.
Explanation: AWS Lambda is a serverless compute service that runs code in response to events, such as an S3 upload, without you provisioning or managing servers. EC2 and ECS require managing virtual servers or clusters, and Elastic Beanstalk is a PaaS service for deploying applications, not for event-driven functions.
Question 8
An organization has a compliance requirement that all data stored in a specific Amazon S3 bucket must be encrypted at rest. Which action will ensure this requirement is met?
Answer: B
Explanation: Enabling default encryption on an S3 bucket ensures that all new objects uploaded to that bucket are automatically encrypted at rest, either with SSE-S3, SSE-KMS, or SSE-C. Versioning helps protect against overwrites and deletes, a public bucket policy is a security risk, and Glacier is a storage class for archival, not a method of encryption.
Question 9
A company is launching a new global web application and wants to improve performance for users by serving content from edge locations closer to them. Which AWS service should they use?
Answer: C
Explanation: Amazon CloudFront is a content delivery network (CDN) that caches copies of content (like images, videos, and web pages) at edge locations around the world, reducing latency for end users. Route 53 is a DNS service, Global Accelerator uses edge locations to route traffic to your application but doesn't cache content, and Elastic Load Balancing distributes traffic within a region.
Question 10
A company is subject to strict regulations that require them to maintain full control over the underlying physical servers of their EC2 instances. They also need to use a dedicated, server-bound software license. Which EC2 purchasing option should they choose?
Answer: D
Explanation: A Dedicated Host provides you with a physical server fully dedicated to your use, allowing you to use existing server-bound software licenses and meet compliance requirements. On-Demand and Reserved Instances run on shared hardware (unless you choose Dedicated Instances, but that doesn't give you the same license flexibility), and Spot Instances are for interruptible workloads. --- These questions represent the core concepts tested on the exam. For a deeper dive, focus on understanding the shared responsibility model, the differences between the support plans, and the practical use cases for each of the main services like EC2, S3, RDS, and Lambda. Good luck with your preparation!
Test yourself under real constraints — AWS Certified Cloud Practitioner practice exam questions let you practise with the same time pressure.
Before you take the actual exam, use the free AWS Certified Cloud Practitioner readiness check to quickly see which topic needs the most review.