AWS Cloud Practitioner Exam Questions: Worked Examples

Start by naming the service and the layer being managed. Consider this original question: a company runs its application on Amazon EC2 instances. Which task is the customer's responsibility under the AWS shared responsibility model? A: replacing failed physical disks in an AWS data centre. B: patching the guest operating system on its EC2 instances. C: maintaining the physical network equipment supporting AWS infrastructure. D: controlling physical access to AWS data centres. Before choosing, separate physical infrastructure from the software and configuration the customer controls. The reference to EC2 matters because responsibilities change with the service being used.

The correct answer is B. For EC2, the customer is responsible for managing the guest operating system, including updates and security patches, alongside its applications and relevant security configuration. A, C and D describe responsibilities AWS retains for the underlying infrastructure and facilities. The distractors are plausible security tasks, but they belong to the wrong party. Do not turn this into a universal rule that customers patch every operating system behind every AWS service. With more abstracted services, AWS manages more of the underlying stack. Always connect the responsibility to the specific service in the scenario.

Security questions often contain several answers that would technically allow an action, but only one follows the requested security principle. Try this scenario: an application running on Amazon EC2 needs to read objects from one specific Amazon S3 bucket. Which approach best follows AWS security recommendations? A: embed an IAM user's long-term access keys in the application. B: make the bucket publicly readable. C: attach an IAM role to the instance through an instance profile, granting only the required S3 read permissions. D: store AWS account root user access keys on the instance. Focus on both credential handling and permission scope.

The correct answer is C. An IAM role lets the application obtain temporary credentials without embedding long-term keys, while a narrowly scoped permissions policy supports least privilege. A introduces long-term credentials that require protection and rotation; it is not the recommended approach for this EC2 workload. B unnecessarily exposes the data rather than authenticating the application. D uses highly privileged root credentials for a routine workload, contrary to AWS guidance. The key technique is to test every answer against every requirement. An option that provides access but fails the security requirement is still incorrect.

When two services sound similar, describe the required output before evaluating their names. Consider this multiple-response example: an operations team needs an alarm when an EC2 instance's CPU utilisation stays above a threshold. It also needs a record showing which identity made a security group configuration change. Which TWO services most directly address these requirements? A: Amazon CloudWatch. B: AWS CloudTrail. C: AWS Artifact. D: Amazon Inspector. The scenario asks for two distinct outputs: a metric-based alarm and an account activity record. Treat those as separate matches rather than searching for one service that appears broadly related to security.

The correct answers are A and B. CloudWatch provides metrics and alarms, including alarms based on EC2 CPU utilisation. CloudTrail records AWS account activity, including relevant API calls and identity information associated with configuration changes. AWS Artifact, option C, provides access to AWS compliance reports and certain agreements; it is not an operational audit trail of your team's changes. Amazon Inspector, option D, is a vulnerability management service, not the primary service for either requested output. Notice how the distractors share a security or governance theme. Broad relevance is insufficient: the service must produce the evidence or behaviour the question requests.

Pricing questions become easier when you underline the workload's duration, predictability and tolerance for disruption. Try this example: a company runs flexible batch-processing jobs on EC2. The jobs can save progress, resume later and tolerate interruptions. The company wants to use discounted spare EC2 capacity without making a long-term usage commitment. Which purchasing option best fits? A: On-Demand Instances. B: Spot Instances. C: EC2 Instance Savings Plans. D: Dedicated Hosts. The strongest clue is not simply that the company wants lower costs. It is the combination of spare capacity, interruption tolerance and no long-term commitment.

The correct answer is B. EC2 Spot Instances use spare capacity at discounted rates, but AWS can interrupt them when that capacity is needed elsewhere. Applications must therefore handle interruption and capacity availability appropriately. A offers flexible usage without a long-term commitment, but does not describe the discounted spare-capacity model. C provides discounts in exchange for a one- or three-year commitment to a consistent amount of eligible usage, measured in dollars per hour. D provides dedicated physical servers and may address licensing or placement requirements, neither of which appears here. Avoid treating one purchasing option as universally cheapest: suitability depends on workload constraints.

Storage questions usually test a trade-off, not whether one class is inherently better than another. Consider this scenario: a company stores rarely accessed compliance archives in Amazon S3. It does not require immediate access, can wait up to 48 hours for retrieval and wants a storage class designed for very low-cost long-term archiving. Assume storage-duration and retrieval charges have been considered. Which class best fits? A: S3 Standard. B: S3 Standard-IA. C: S3 Glacier Instant Retrieval. D: S3 Glacier Deep Archive. The crucial clue is the acceptable retrieval delay, which allows an archival option that would be unsuitable for immediate access.

The correct answer is D. S3 Glacier Deep Archive is designed for long-term archival storage and requires objects to be restored before access; retrieval can take hours, with bulk retrieval typically completing within 48 hours. A is intended for frequently accessed data and does not match the archival cost objective. B supports infrequently accessed data with immediate access, but is not the best match for this delay-tolerant archive. C also provides immediate retrieval, a capability the scenario does not require. In real deployments, compare storage, request, retrieval and minimum-duration charges. A low storage rate alone does not establish the lowest total cost.