dc dotCreds
AWS Certified Cloud Practitioner

AWS Cloud Practitioner Practice Test

Start today's 10-question AWS Cloud Practitioner set with source-backed explanations, local progress, and a fresh rotation every morning.

10 Free Daily Questions Source-backed Explanations 150 Verified Questions

Questions updated at Jul 18, 2026, 1:30 PM CDT

Start Daily Practice Open Dashboard
Go Pro - One Time Unlock

Unlock the full CLF-C02 bank

150 verified questions Exam Mode Practice Mode Detailed explanations Weak-area review No subscription - one-time unlock

Get the complete source-backed bank with Interview Questions, the full Study Guide, full Course Notes, detailed explanations, weak-area review, and exam-style practice.

Interview Questions Full Study Guide Full Course Notes Exam Mode Practice Mode Guided Course Detailed explanations Weak-area review No subscription
$2.99 One-time payment
See bundle and PDF options

We will confirm your site email in one quick checkout step.

Why DotCreds?

Practice with explanations that teach.

Source links for every answer Every wrong answer explained Guided Course included Practice and Exam Mode Weak-area tracking Same verified bank across web practice

What you get with free practice

10 Free Questions Daily Fresh set every day from the live bank
Detailed Explanations Learn with clear source-backed answers
Track Your Progress Daily history and performance insights
Upgrade Anytime Unlock the full bank when you are ready
Today's 10 AWS Cloud Practitioner questions

Use this AWS Cloud Practitioner practice test to review AWS Certified Cloud Practitioner. Questions rotate daily and each explanation links to the source used to validate the answer.

Today’s Set
10 questions
Rotates at 10:00 AM local time
Progress
0/10
Answered on this page
Accuracy
0%
Loading countdown…

150 verified questions are in the live bank. Free daily questions are selected from a rotating sample set. Unlock Pro to access the full question bank.

Preparing today’s free questions... Ordering the final locked-bank set before showing the practice cards.
Question 1 of 10
Objective 2.9 Security and Compliance

Which task in AWS Secrets Manager is designed to manage database credentials securely by automatically rotating them over time?

Concept tested:
Source:What is AWS Secrets Manager
Question 2 of 10
Objective 2.14 Security and Compliance

A user attempts to access a resource protected by an IAM policy. What AWS service is responsible for issuing the temporary security credentials required for this access?

Concept tested:
Question 3 of 10
Objective 3.5 Cloud Technology and Services

Which AWS service provides a managed Kubernetes environment for running containers, offering robust security features but requiring more operational overhead compared to serverless options?

Concept tested:
Question 4 of 10
Objective 3.9 Cloud Technology and Services

Which AWS service can be used to manage a distributed in-memory data store that supports Redis as an engine?

Concept tested:
Question 5 of 10
Objective 4.5 Billing, Pricing, and Support

A cloud engineer needs to estimate the cost of running a new application that will experience significant traffic spikes during peak hours. Which AWS tool is best suited for generating a detailed cost estimate based on anticipated resource consumption?

Concept tested:
Question 6 of 10
Objective 3.11 Cloud Technology and Services

In Amazon VPC, which component is used to manage public IPv4 addresses for EC2 instances?

Concept tested:
Question 7 of 10
Objective 1.1 Cloud Concepts

How does AWS Cloud's global infrastructure benefit businesses in terms of deployment speed?

Concept tested:
Question 8 of 10
Objective 1.5 Cloud Concepts

Which strategy is recommended for reducing business risk during a cloud migration journey?

Concept tested:
Question 9 of 10
Objective 4.7 Billing, Pricing, and Support

Which storage option is best suited for frequently accessed data that requires high durability and performance?

Concept tested:
Question 10 of 10
Objective 2.1 Security and Compliance

A development team is using AWS EC2 instances to build and test a new application. According to the AWS shared responsibility model, what security control is the team primarily responsible for implementing?

Concept tested:
Locked preview

You are viewing today’s free 10. Unlock 140 more questions.

Unlock full bank
Daily sample Rotating practice Free daily questions are selected from a rotating sample set.
Pro bank Full access Unlock Pro to access the full question bank, Exam Mode, Practice Mode, and random tests.
CLF-C02 Pro $2.99 one-time

50 Exam Practice Test $1.99 one-time

A 50-question CLF-C02 PDF for short review sessions. Questions come first, then the answer review and explanations later in the file.

AWS Cloud Bundle $9.99 one-time

Unlock all 6 active AWS Cloud Bundle practice banks in one permanent purchase.

What’s includedAWS Cloud Practitioner, AWS SAA-C03, AWS Developer Associate, AWS CloudOps Associate, AWS Data Engineer Associate, AWS DevOps Professional
All Access $6.99/month

Unlock every active practice exam, bundle and path experience, Pro course and study content, and included downloads.

What’s includedEvery current and future active practice exam, All active bundle and career-path practice content, Pro course lessons, study content, and supported paid downloads

Choose an unlock option to continue. We will confirm your site email in one quick checkout step.

Secure checkout powered by Stripe. Source-backed questions. Not brain dumps. Checkout stays on this page and unlocks the same Pro builder on this practice page.
Already Pro? Open dashboard

Purchase options

Unlock the full CLF-C02 bank.

Get the full bank, Exam Mode, Practice Mode, question sets, random tests, readiness tracking, saved box scores, and review tools for this exam.

The PDF versions keep questions first and move the answer review, explanations, and distractor notes to the back of the file.

150 verified exam-style questions Every choice explained Exam Mode and Practice Mode Question sets and random tests Readiness score and trends Previous test box scores

You've answered 0/10 questions in today's set.

Locked: 140 more questions in the full bank.

Locked: exam simulation mode, practice mode, readiness tracking, and saved review history.

Checkout stays on this page, so you can keep practicing, unlock the full bank, and start Exam Mode or Practice Mode when you are ready.

Cheat Sheets

7-day score keeper

Answer questions today and this will become a rolling 7-day scorecard.

Local history
Optional progress sync

Keep today’s practice moving

Guest progress saves automatically on this device. Add an email later when you want a magic link that keeps your daily CLF-C02 practice in sync across browsers.

Guest progress saves on this device automatically

Guest progress is available without an account.

Official exam resources

Use these official AWS resources alongside the daily practice set. They cover the provider's own exam page, study guide, or prep material.

Certification AWS Certified Cloud Practitioner Exam guide AWS Certified Cloud Practitioner exam guide

Need adjacent AWS practice pages too? AWS practice hub.

Source-backed answer review

The free daily AWS Cloud Practitioner set includes crawlable question text, answer choices, correct answer labels, objective mapping, and source links. Only the first SEO card includes answer explanations and any extra learning features. Pro-only bank questions stay locked; this section mirrors only the 10 free daily questions already shown on this page.

Question 1 Which task in AWS Secrets Manager is designed to manage database credentials securely by automatically rotating them over time?

Answer choices

  1. A. Set up single user rotation for AWS Secrets Manager
  2. B. Move hardcoded secrets to AWS Secrets Manager
  3. C. Monitor secrets for compliance
  4. D. Create secrets in AWS CloudFormation

Correct answer

Set up single user rotation for AWS Secrets Manager

Single user rotation is a Secrets Manager task for configuring database credential rotation for one user. The other choices cover migration, compliance monitoring, or CloudFormation creation rather than the rotation task.

Wrong-answer review

  • B. Move hardcoded secrets to AWS Secrets Manager: Moving hardcoded secrets imports credentials into Secrets Manager. It does not provide single-user database credential rotation.
  • C. Monitor secrets for compliance: Compliance monitoring checks secret posture; it does not set up database credential rotation unless the question asks for monitoring.
  • D. Create secrets in AWS CloudFormation: Creating a secret with CloudFormation provisions a resource; it does not monitor compliance.

Extra learning features

Why candidates miss this

Moving hardcoded secrets to AWS Secrets Manager only centralizes storage; it doesn't automate the rotation of database credentials. Single user rotation, the correct answer, is the specific Secrets Manager feature designed to automatically rotate credentials based on a schedule, preventing stale or compromised information. The misconception here is that simply storing secrets is sufficient for security, neglecting the crucial aspect of regular rotation. Likely wrong answer: Move hardcoded secrets to AWS Secrets Manager Review focus: What is AWS Secrets Manager

Interview question

Q: Let's say your team is migrating a legacy application to AWS, and it relies heavily on database credentials. The current process involves storing these credentials directly in the application code. How would you approach securing these credentials and automating their rotation to minimize risk and operational overhead? Strong answer: The first thing I'd do is move those credentials out of the application code and into a centralized secrets management solution like AWS Secrets Manager. This immediately reduces the risk of accidental exposure. Then, I'd configure single-user rotation for those credentials. This automates the process of changing passwords periodically, reducing the window of opportunity for compromise. I'd also ensure that access to Secrets Manager is tightly controlled using IAM roles with the principle of least privilege. Finally, I'd set up CloudTrail logging to monitor access to Secrets Manager and alert on any unusual activity.

  • Understanding of secrets management principles
  • Automated credential rotation
  • Least privilege IAM
  • CloudTrail logging for auditing
  • Proactive security posture

Caution: Simply stating 'use AWS Secrets Manager' without explaining the rotation and access control aspects. Focusing solely on storage and ignoring the rotation aspect is a common mistake.

Why this matters

On the exam, this checks whether you know how to set up single user rotation for AWS Secrets Manager. On the job, that matters because cloud teams need to configure secure credential management practices.

Objective/domain: Security and Compliance

Source: What is AWS Secrets Manager

Question 2 A user attempts to access a resource protected by an IAM policy. What AWS service is responsible for issuing the temporary security credentials required for this access?

Answer choices

  1. A. AWS Security Token Service (AWS STS)
  2. B. Amazon Relational Database Service (Amazon RDS)
  3. C. Amazon Simple Storage Service (Amazon S3)
  4. D. AWS CloudTrail

Correct answer

AWS Security Token Service (AWS STS)

Objective/domain: Security and Compliance

Source: AWS Identity and Access Management introduction

Question 3 Which AWS service provides a managed Kubernetes environment for running containers, offering robust security features but requiring more operational overhead compared to serverless options?

Answer choices

  1. A. Amazon ECS
  2. B. AWS AppSync
  3. C. AWS Fargate
  4. D. Amazon EKS

Correct answer

Amazon EKS

Objective/domain: Cloud Technology and Services

Source: CLF-C02 Domain 3: Cloud Technology and Services

Question 4 Which AWS service can be used to manage a distributed in-memory data store that supports Redis as an engine?

Answer choices

  1. A. AWS Lambda
  2. B. Amazon ElastiCache
  3. C. Amazon S3
  4. D. Amazon RDS

Correct answer

Amazon ElastiCache

Objective/domain: Cloud Technology and Services

Source: What is Amazon ElastiCache

Question 5 A cloud engineer needs to estimate the cost of running a new application that will experience significant traffic spikes during peak hours. Which AWS tool is best suited for generating a detailed cost estimate based on anticipated resource consumption?

Answer choices

  1. A. AWS Cost Explorer
  2. B. AWS Budgets
  3. C. AWS Trusted Advisor
  4. D. AWS Pricing Calculator

Correct answer

AWS Pricing Calculator

Objective/domain: Billing, Pricing, and Support

Source: What is AWS Pricing Calculator

Question 6 In Amazon VPC, which component is used to manage public IPv4 addresses for EC2 instances?

Answer choices

  1. A. Route tables
  2. B. Network Load Balancers
  3. C. NAT gateways
  4. D. IP Address Manager

Correct answer

IP Address Manager

Objective/domain: Cloud Technology and Services

Source: What is Amazon VPC

Question 7 How does AWS Cloud's global infrastructure benefit businesses in terms of deployment speed?

Answer choices

  1. A. It requires longer setup times for new regions.
  2. B. It enables rapid deployment across multiple geographic locations.
  3. C. It limits the availability to a single region only.
  4. D. It increases dependency on local data centers.

Correct answer

It enables rapid deployment across multiple geographic locations.

Objective/domain: Cloud Concepts

Source: CLF-C02 Domain 1: Cloud Concepts

Question 8 Which strategy is recommended for reducing business risk during a cloud migration journey?

Answer choices

  1. A. Using AWS Snowball for large-scale data transfer
  2. B. Implementing database replication to ensure data consistency
  3. C. Creating a detailed budget plan for cost optimization
  4. D. Deploying on-premises storage solutions

Correct answer

Implementing database replication to ensure data consistency

Objective/domain: Cloud Concepts

Source: CLF-C02 Domain 1: Cloud Concepts

Question 9 Which storage option is best suited for frequently accessed data that requires high durability and performance?

Answer choices

  1. A. Amazon EFS
  2. B. Amazon S3 Standard
  3. C. Amazon Glacier
  4. D. AWS Snowball

Correct answer

Amazon S3 Standard

Objective/domain: Billing, Pricing, and Support

Source: Amazon S3 storage classes

Question 10 A development team is using AWS EC2 instances to build and test a new application. According to the AWS shared responsibility model, what security control is the team primarily responsible for implementing?

Answer choices

  1. A. AWS
  2. B. Customer
  3. C. Both AWS and Customer
  4. D. Third-party vendors

Correct answer

Customer

Objective/domain: Security and Compliance

Source: AWS shared responsibility model

Where to go after the daily web set

How are AWS Cloud Practitioner questions generated?

dotCreds builds AWS Cloud Practitioner practice questions from public exam objectives and AWS certification and documentation references. The questions are written for realistic study practice, not copied from exam dumps.

How are explanations sourced?

Each question includes an explanation and, when available, a source link back to the provider documentation or reference used to validate the answer. That keeps the practice tied to study material you can actually review.

What score do I get?

The page tracks today's answered count and accuracy for the 10-question daily set, then saves a 7-day score history on this device so you can see your recent practice trend.

Why use this site?

The site is the fastest way to start AWS Cloud Practitioner practice without installing anything. It is built for daily recall, quick weak-topic discovery, and source-backed explanations you can review immediately.

More AWS practice tests

If you're studying adjacent AWS certs, these pages use the same daily-question format with source-backed explanations.

AWS AI Practitioner Practice Test AWS SAA-C03 Practice Test AWS CloudOps Engineer Associate Practice Test AWS Solutions Architect Professional Practice Test