Home Certifications Pricing FAQ Partners Blog

·EN·DE·FR·ES·PT

AWS · CLF-C02 · Beginner

AWS Cloud Practitioner (CLF-C02) — Practice Questions and Mock Exam

The AWS Certified Cloud Practitioner is Amazon Web Services' foundational credential, validating a broad understanding of AWS Cloud concepts, services, security, architecture, pricing, and support.

Practice for free Try a practice question first

Try a practice question first Practice for free

Start practicing CLF-C02 free Buy CLF-C02 access for $29.99

65Questions per Pass-IT mock exam

90minPass-IT mock exam time limit

Official CLF-C02 exam: 700 out of 1000 points to pass.

Checked against AWS · September 2026 · Current exam version

Try Pass-IT

See what learning with Pass-IT is like.

Answer a CLF-C02 sample question and read the explanation with its source. Right here, with no sign-up.

Security and Compliance1 / 5

Which type of IAM policy is attached directly to an IAM user, group, or role?

AlexFull explanation from Alex

Identity-based policies are JSON permissions documents attached directly to an IAM user, group, or role, defining what actions that identity can perform. They come in two forms: managed policies (standalone, reusable, versioned) and inline policies (embedded in a single identity). Resource-based policies attach to resources like S3 buckets or SQS queues and specify who can access them. Service control policies (SCPs) are Organization-level guardrails applied to accounts, not IAM identities. Access control lists (ACLs) are legacy mechanisms on resources like S3 and VPCs. The key distinction: identity-based = who can do what; resource-based = who can access this resource.

Sourcedocs.aws.amazon.com

Cloud Concepts2 / 5

Which type of cloud computing model provides the most control over the underlying infrastructure?

AlexFull explanation from Alex

IaaS provides maximum control over cloud infrastructure: virtual machines, networking, and storage. You manage the OS, middleware, runtime, and applications. PaaS abstracts infrastructure management, providing a platform for deploying applications without managing servers. SaaS delivers complete applications with no infrastructure control. FaaS (serverless) abstracts everything except your code, executing functions on demand. The control spectrum runs: IaaS (most) → PaaS → FaaS → SaaS (least). More control means more operational responsibility — IaaS requires patching, scaling, and security configuration. AWS examples: EC2 (IaaS), Elastic Beanstalk (PaaS), Lambda (FaaS), WorkMail (SaaS).

Sourceaws.amazon.com

Billing, Pricing, and Support3 / 5

Which AWS service provides recommendations to help reduce costs, improve performance, and address security gaps across an AWS account?

AlexFull explanation from Alex

Trusted Advisor is the AWS service for account-level best-practice recommendations across cost, performance, security, fault tolerance, service limits, and operational excellence. Cost Explorer analyzes cost and usage trends, Budgets alerts on spending or usage thresholds, and Pricing Calculator estimates costs for planned workloads. Those services do not provide the same broad operational recommendation coverage as Trusted Advisor.

Sourcedocs.aws.amazon.com

Security and Compliance4 / 5

A company wants to protect its web application from common exploits such as SQL injection and cross-site scripting (XSS). Which AWS service should they use?

AlexFull explanation from Alex

AWS WAF is a web application firewall that monitors HTTP/HTTPS requests to protected resources including CloudFront, ALB, API Gateway, AppSync, and Cognito. It blocks SQL injection and cross-site scripting (XSS) through configurable rules and AWS Managed Rule Groups covering OWASP Top 10 threats. Why not other options? Shield protects against DDoS attacks at layers 3/4/7 — not application-layer exploits like SQLi/XSS. GuardDuty analyzes CloudTrail, VPC Flow Logs, and DNS logs for threat detection, not real-time request filtering. Macie discovers and protects sensitive data in S3, unrelated to web exploit prevention. WAF operates at Layer 7, inspecting request content for malicious patterns.

Sourcedocs.aws.amazon.com

Cloud Concepts5 / 5

Which concept describes the ability of an AWS environment to automatically adjust resources to handle increases and decreases in demand?

AlexFull explanation from Alex

Elasticity is one of the key advantages of the AWS Cloud and refers to the ability to automatically acquire resources when you need them and release resources when you no longer need them. For example, Amazon EC2 Auto Scaling can automatically add instances during a traffic spike and remove them when traffic decreases. This is different from agility, which refers to the speed at which you can experiment and innovate. Fault tolerance is the ability to continue operating when a component fails, and high availability is about minimizing downtime. Elasticity directly ties to the cloud economics benefit of paying only for what you use — without elasticity, you would need to provision for peak demand at all times. Exam tip: elasticity = automatic scaling up AND down; high availability = staying online despite failures.

Sourcedocs.aws.amazon.com

Create a free account

How to prepare for CLF-C02 with Pass-IT.

Currently 452 practice questions for CLF-C02, with new ones added regularly. Focus on what you still need to learn.

Get past difficult questions.

Understand why an answer is correct. Alex explains the concepts and answers your follow-up questions so you can apply what you learn to the next task.

Conversation preview · CLF-C02

IAM policy attachment

You
A policy defines what a role can do with AWS resources. Which kind is it?
Alex · AI tutor
That is an identity-based policy.
Read the documentation ↗
You
How does a resource-based policy differ?
Alex · AI tutor
It is attached to the resource, such as an S3 bucket, and identifies who may access it.
Read the documentation ↗

Make your study time count.

Practice at your level.
For new practice sessions, Pass-IT adjusts the difficulty based on your previous answers.

Learn from mistakes.
Incorrect answers automatically become flashcards. When you review them, you rate how confidently you remember; Pass-IT schedules the next review.

See how focused practice works →

Animated feature preview

Turn your mistakes into knowledge you can rely on.

How Pass-IT works

Your review

Answered a question incorrectly?

Pass-IT saves it for your review.

CLF-C02 · Question excerpt

IAM policy attachment

View the full question

Which type of IAM policy is attached directly to an IAM user, group, or role?

Understand the correct answer.

Identity-based policy

An identity-based policy defines the AWS actions a user, group or role may perform.

Read the documentation ↗

How confidently do you remember?

During review, you assess how well you still know the answer.

Correct after hesitating

Pass-IT schedules your next review.

The date depends on your self-assessment and previous reviews.

Simplified demonstration. No learning progress is saved.

Practice for the moment that counts.

Take a full mock exam with a time limit and find out whether you can finish in time.

Your CLF-C02 mock exam

Questions: 65
Minutes: 90

Illustration of an exam session

Start
Answer questions
Finish

Length and time limit of the Pass-IT mock exam.

Go into your exam with more confidence.

Your Readiness Score helps you assess whether you are ready for the exam. Results by exam domain show you where you should keep practicing.

Your money back if you fail despite 80% Readiness.
If your Readiness Score is at least 80% when you take the exam and you still fail, we refund the Pass-IT purchase price for this certification.

For active, paid access. Submit proof of failing within 14 days.

Further guarantee conditions

You need at least 80% Readiness and active, paid access to the certification when you take the exam. Take the exam within your access period and submit official proof of failing within 14 days after the exam.

For purchases through Apple or Google, refunds are handled by the respective store. See the full terms for further details.

Read the guarantee terms →

The Readiness Score describes your practice progress, not a probability of passing.

Guarantee requirement

80%

At least 80% Readiness
when you take the exam

Money back if you fail

Question counts and mock exam settings from the current Pass-IT catalog.

Exam domains

What you practice for CLF-C02.

Exam topics, relevant practice and sources you can check.

Cloud conceptsSee the guide for weighting98 QuestionsPass-IT questions

Understand why organizations use AWS and how cloud design and costs differ from running their own infrastructure.

Explain how global reach, elastic capacity and high availability support changing business needs.
Distinguish the pillars of the AWS Well-Architected Framework and the design concerns each addresses.
Recognize migration approaches and how the AWS Cloud Adoption Framework supports an organization’s move to the cloud.
Compare fixed and variable costs, licensing and rightsizing, including the savings possible through automation and shared scale.

Official certification objectives

Security and complianceSee the guide for weighting120 QuestionsPass-IT questions

Understand how responsibility, access controls and security services fit together in an AWS account.

Explain which responsibilities belong to AWS or the customer and how that division changes with the service.
Recognize encryption, logging, audit evidence and governance services that help meet security and compliance needs.
Explain least-privilege access with AWS Identity and Access Management (IAM), including roles, federation, multifactor authentication and root-account protection.
Identify AWS security tools, third-party options and official resources for preventing or investigating security issues.

Official certification objectives

Cloud services and infrastructureSee the guide for weighting166 QuestionsPass-IT questions

Recognize the main AWS service families and the kinds of work each supports.

Distinguish console, command-line and programmatic access from repeatable infrastructure-as-code deployments, including cloud and hybrid models.
Explain Regions, Availability Zones and edge locations, and recognize VPC networking, name resolution and connectivity options.
Identify when virtual machines, containers or serverless compute fit, and how scaling and load balancing support demand.
Distinguish database and storage types, including managed databases, migration tools, storage lifecycles and backup options.
Recognize services for analytics and AI, application integration, development, business applications, support, virtual desktops, web/mobile applications and connected devices.

Official certification objectives

Pricing, billing and supportSee the guide for weighting68 QuestionsPass-IT questions

Understand how AWS usage becomes a bill and where to find cost information and technical help.

Compare compute purchasing models, storage tiers and data-transfer charges for different usage patterns.
Recognize how pricing estimates, budgets, cost reports and consolidated billing help plan and allocate spending.
Identify suitable AWS Support, documentation, partner and Marketplace resources, including tools for account health and optimization.

Official certification objectives

Question formats you can practice

Multiple Choice: Select one answer.
Multiple Response: Select multiple applicable answers.

These are practice formats in Pass-IT. See the Official certification objectives for the official exam requirements.

How we review questions

Source check: The answer, answer options and explanation are checked against official documentation. We call this canonical validation.

Adversarial review: An additional AI reviewer specifically looks for factual errors, ambiguous answers and weaknesses in the explanation.

Learning objectives: We count specific exam topics with clearly linked exercises. Subheadings are not counted separately.

The figures refer to available questions in each CLF-C02 exam domain. The additional review count includes matching review logs for the current question version, even if errors were found. It is not an error-free rate.

The date shows the latest matching evidence or log entry in each domain. An import or transfer of an existing review result can update this entry. This does not mean the entire question pool has been reviewed again.

Review methods and criteria in detail

Frequently asked questions

Your preparation

How much study time should I plan for CLF-C02?

For planning, Pass-IT estimates roughly 15–40 hours. Relevant experience may put you toward the lower end; starting from scratch may put you toward the higher end. Your needs may fall outside this range. This is not a time requirement from AWS or a promise that you will be exam-ready within that time.

Do you need experience before taking CLF-C02?

No. AWS sets no prerequisite, and the exam is written for people who work around cloud projects rather than inside them. The catalog budget is about 25 hours, the shortest of any AWS exam we cover.

Using Pass-IT

What language are Pass-IT questions in?

Questions in the app are currently in English. Translations of the sample questions on this page apply only to this preview. Check with AWS for the languages available for the official exam.

How long does my CLF-C02 access last?

Access covers this certification for 12 months. You pay once, with no automatic renewal.

When does the money-back guarantee apply?

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days. Guarantee terms

About the CLF-C02 exam

Where can I take the CLF-C02 exam?

Pearson VUE testing center or online proctored exam.

How long is the AWS Certified Cloud Practitioner exam?

The CLF-C02 exam has 65 questions and a 90-minute time limit.

Does CLF-C02 expire?

Yes, after three years. While your certification is active, you can renew it for three years by passing the latest version of this exam, passing any one of the Associate-level AWS Certification exams, passing any one of the Professional-level AWS Certification exams, or completing AWS Cloud Quest: Recertify Cloud Practitioner. The training becomes available when your certification is due to expire within six months.

Your preparation for CLF-C02

$29.99one-time

12 months of access for CLF-C02 · No automatic renewal

Buy CLF-C02 access

Questions in the app are currently in English.

Try 20 questions for freeFree account required. No credit card.

Already have an account? Log in

Prefer a subscription? View subscriptions →

Money back if you fail with at least 80% Readiness, for eligible purchases under the guarantee terms.

Guarantee terms

The guarantee refunds the Pass-IT purchase price for this certification. You need eligible paid access and a Readiness Score of at least 80% from your practice results when you take the exam. This score can only reach 80% after at least 50 answered questions and is not a validated probability of passing. Take the exam during your access period and submit official proof of failing within 14 days.

Full guarantee terms →