15 AWS Cloud Practitioner Practice Questions with Explanations (2026)

Explanation

This is the "trade capital expense (CapEx) for variable expense (OpEx)" advantage — instead of investing heavily in data centers before you know how much capacity you need, you pay only for the compute and storage you actually consume. Economies of scale (B) refers to AWS passing down cost savings from aggregating usage across all customers, which is a related but distinct advantage.

Explanation

Reliability covers a workload’s ability to recover from infrastructure or service disruptions, dynamically acquire resources to meet demand, and mitigate disruptions like misconfigurations or transient network issues. Performance efficiency (A) is about using resources efficiently to meet requirements as demand changes and technology evolves — a commonly confused pair on the exam.

Explanation

Configuring security groups, IAM policies, and access permissions is "security in the cloud" — always the customer’s job. Physical data center security, hypervisor patching, and global network infrastructure are all "security of the cloud," which AWS manages. See AWS Shared Responsibility Model Explained for the full breakdown of where the line moves depending on the service model (IaaS vs PaaS vs SaaS).

Explanation

GuardDuty is a threat-detection service that continuously monitors for malicious activity using VPC Flow Logs, DNS logs, and CloudTrail events, using machine learning and threat intelligence. Inspector (B) scans for software vulnerabilities and unintended network exposure on EC2 and container images — vulnerability assessment, not behavioral threat detection. Config (A) tracks resource configuration changes, not security threats.

Explanation

AWS best practice is to secure the root user with MFA and lock the credentials away, then create IAM users (or IAM Identity Center users) with appropriate permissions for daily work. Using the root user routinely (A) or sharing its credentials (C) are both direct violations of AWS security best practices — this is a classic multiple-response trap where two answers sound reasonable but are the opposite of best practice.

Explanation

Lambda is fully serverless — no server management, automatic scaling to match spiky traffic, and you pay only for compute time consumed. EC2 Spot Instances (C) still require managing servers and are priced for interruption-tolerant workloads, not a fit for "avoid managing servers entirely." Reserved Instances (A) suit steady, predictable workloads, the opposite of "spiky."

Explanation

S3 Glacier Flexible Retrieval is built for archival data accessed roughly 1-2 times a year with retrieval in minutes to hours, and it costs less than Standard-Infrequent Access. Glacier Deep Archive (D) is even cheaper but retrieval takes up to 12 hours, better suited to compliance archives accessed maybe once a year, not quarterly.

Explanation

RDS is a managed relational database service — AWS handles patching, backups, and infrastructure for engines like MySQL, PostgreSQL, and SQL Server. DynamoDB (A) is a managed database too, but it is NoSQL, not relational. Option D describes exactly what RDS exists to avoid.

Explanation

CloudFront is AWS’s content delivery network (CDN) — it caches content at edge locations worldwide, cutting latency for geographically distributed users. Route 53 (D) is DNS routing, not content caching. Direct Connect (A) is a dedicated network link from on-premises to AWS, unrelated to global content delivery.

Explanation

Spot Instances offer the deepest discount (up to 90% off On-Demand) in exchange for AWS being able to reclaim the capacity with short notice — ideal for fault-tolerant, interruption-tolerant batch work. Reserved Instances and Savings Plans require a 1- or 3-year commitment and suit steady-state workloads, not variable batch jobs.

Explanation

A dedicated Technical Account Manager is an Enterprise-tier benefit. Business support includes 24/7 access to Cloud Support Engineers by phone, chat, and email but not a named TAM. Developer support is limited to business-hours email access to Cloud Support Associates, and Basic is self-service only.

Explanation

AWS Budgets lets you set custom cost and usage thresholds with alerts when spending exceeds them. Cost Explorer (C) visualizes and analyzes historical and forecasted costs but does not send threshold alerts on its own — the two services are often confused. Organizations (D) enables consolidated billing across accounts but is not itself a budgeting/alerting tool.

Explanation

Regions are separate geographic areas (each containing multiple Availability Zones) that are fully isolated from one another — the right building block for serving distinct geographic user bases with independent infrastructure. Availability Zones (A) are the isolated data centers within a single Region, not separate geographic areas.

Explanation

AWS Artifact is the self-service portal for downloading AWS compliance reports and agreements. Shield (B) is DDoS protection, Config (C) tracks resource configuration compliance against your own rules, and Macie (D) discovers and classifies sensitive data in S3 — none of them are the compliance-documentation portal.

Explanation

Fargate is the serverless launch type for ECS (and EKS) — AWS manages the underlying compute so there is no EC2 instance to provision or patch. The EC2 launch type (A) still requires you to manage the EC2 instances that host your containers, which is exactly what the scenario wants to avoid.