Amazon Web Services AWS Certified Cloud Practitioner CLF-C02 Exam Dumps: Updated Questions & Answers (August 2026)

Using multiple Availability Zones within the same AWS Region meets the requirements for having instances in different locations with independent power and networking. Availability Zones are distinct physical locations within a region, each with separate power sources and networking. Edge locations are used for content delivery, and Amazon Connect and AWS Artifact locations are not relevant to EC2 deployment and infrastructure.

The customer is responsible for configuring the logical networking resources inside its Amazon VPC. This includes creating and associating route tables and defining routes that determine where subnet traffic is directed. A subnet is considered public when its associated route table contains a route to an internet gateway and the relevant resources have suitable public addressing and security configuration. Therefore, configuring a route table to direct internet-bound traffic to an internet gateway is the company’s responsibility, making option C correct. AWS is responsible for the physical routers, backbone networks, data centers, and networking infrastructure that provide communication within and between AWS Regions. Customers do not maintain or physically secure that equipment. AWS also provides infrastructure-level protection for traffic across its global network, while customers remain responsible for application-level encryption where required by their security policies. The shared responsibility model distinguishes between AWS securing the physical infrastructureofthe cloud and customers securely configuring their networksinthe cloud. Route tables, subnet associations, gateways, network ACLs, and security groups are customer-controlled VPC configurations, even though AWS operates the underlying network infrastructure.

Customers are responsible for configuring access to their Amazon S3 buckets and objects. An S3 bucket policy is a resource-based policy that defines which principals can perform specified actions on the bucket and its objects, subject to the complete AWS authorization process. Because the customer determines who should access its data, configuring bucket policies is a customer responsibility, making option C correct. AWS is responsible for operating and protecting the physical storage equipment, data center facilities, underlying networking infrastructure, operating systems, and service platform that run Amazon S3. AWS also patches and maintains the managed S3 platform. Those tasks are part of securityofthe cloud and are not performed by individual customers. Customers retain responsibility for their content, including data classification, access permissions, encryption choices, public-access settings, versioning, lifecycle policies, and other service configurations. AWS provides secure S3 capabilities, but customers must configure those capabilities according to their business and compliance requirements. The fundamental exam distinction is that AWS secures the infrastructure that provides S3, while customers secure their S3 data and control how that data can be accessed.

In the AWS Cloud Adoption Framework (AWS CAF), theGovernanceperspective focuses on aligning IT strategy and goals with business processes, which includes managing data assets, setting up an inventory of data products, and ensuring that data cataloging and metadata management are in place. This perspective is crucial for organizing data products and services, which aligns with building a comprehensive data catalog. Other perspectives like Operations, Business, and Platform do not specifically address the management of a data catalog.

Amazon Athena Overview:

Amazon Athena is a serverless query service that allows users to analyze data in S3 using standard SQL.

It is commonly used to query AWS Cost and Usage Reports stored in S3.

How It Works for Cost Reports:

Cost and Usage Reports are delivered in a structured format to an S3 bucket.

Athena can query these reports without requiring additional ETL processes.

Why Other Options Are Incorrect:

A. Amazon OpenSearch Service:Designed for search and log analytics, not querying structured data.

C. Amazon Aurora:A relational database service, unsuitable for querying S3 data directly.

D. AWS Glue:Used for ETL tasks but not directly for querying.

AWS Organizations Overview:

AWS Organizations allows a company to manage multiple AWS accounts under a single organization.

Through the feature of consolidated billing, a company can receive a single bill for all linked accounts.

Key Features of Consolidated Billing in AWS Organizations:

Aggregates usage across accounts to take advantage of volume pricing discounts.

Provides detailed cost reports for individual linked accounts.

Simplifies payment processing by centralizing billing.

Why Other Options Are Incorrect:

A. AWS Billing and Cost Management console:Used for managing budgets and payments but does not set up consolidated billing.

C. AWS Cost and Usage Report:Provides detailed cost and usage reports but does not set up consolidated billing.

D. AWS Systems Manager:Focuses on operational management, not billing.

DynamoDB global tables provide a fully managed, multi-Region, multi-active database capability. Global tables automatically replicate DynamoDB table data across the AWS Regions selected by the customer. Applications can perform local reads and writes against replica tables, and DynamoDB propagates changes to the other replicas without requiring the customer to build a separate cross-Region replication system. Therefore, option A is correct. DynamoDB Accelerator is an in-memory cache designed to reduce DynamoDB response times for read-intensive workloads. It does not synchronize complete tables across Regions. A global secondary index provides an alternative partition key and optional sort key for querying data within a DynamoDB table; despite the word “global,” it is not a cross-Region replication feature. A service-linked IAM role allows DynamoDB to perform specified actions on behalf of a customer but does not independently replicate table data. Global tables are designed for globally distributed applications, business continuity, high availability, and low-latency access by users in different geographic locations. The direct exam association is DynamoDB global tables for automatic multi-Region table synchronization and replication.

According to theAWS Shared Responsibility Model, AWS is responsible for thesecurity of the cloud, while customers are responsible for thesecurity in the cloud. AWS responsibilities include protecting the physical infrastructure that supports AWS services, such as data centers, hardware, networking, and global infrastructure.

Specifically, AWS is responsible forthe compute infrastructure, which includes servers, storage devices, networking equipment, and virtualization layers. AWS is also responsible forAvailability Zones, ensuring they are physically separate, fault-isolated, and highly available.

Client-side data encryption, Amazon EC2 guest operating systems, and customer data are explicitly defined ascustomer responsibilities. Customers must manage operating system patching, encryption methods, access controls, and data protection within their AWS environments.

AWS documentation consistently emphasizes that customers retain ownership and control of their data, while AWS ensures the resilience, availability, and security of the underlying cloud infrastructure. Therefore, the correct answers areC and D.

An Amazon EC2 Dedicated Host is a physical server with EC2 instance capacity dedicated entirely to one customer’s use. It provides visibility and control over how instances are placed on the physical server and supports eligible Bring Your Own License arrangements. AWS specifically documents that Dedicated Hosts can support existing per-socket, per-core, or per-virtual-machine software licenses, subject to the applicable licensing terms. This directly satisfies both requirements, making option C correct. Dedicated Instances also run on hardware dedicated to one customer, but they do not provide the same host-level visibility, socket information, core information, or targeted instance placement needed for many server-bound licensing models. Reserved Instances are primarily a billing discount applied to matching EC2 usage; they do not provide dedicated physical hardware. On-Demand Instances provide flexible compute capacity without a long-term commitment but normally run on shared tenancy unless another tenancy option is selected. The decisive exam clue is the combination of hardware that is not shared and licenses tied to physical sockets or cores. Dedicated Hosts are specifically designed to address both isolation and eligible host-based software licensing requirements.

S3 Intelligent-Tiering is cost-effective for data with unpredictable access patterns. It automatically moves data between two access tiers (frequent and infrequent) based on access patterns, which is suitable for data accessed daily or infrequently. S3 Glacier Deep Archive is for archival data accessed infrequently, and S3 One Zone-IA is for infrequent access data stored in a single availability zone, which may not be ideal for data accessed daily.

Amazon Kendra is an intelligent enterprise search service that uses machine learning and natural language processing to help users find relevant information across organizational content. It can index unstructured documents from multiple repositories and return relevant answers, passages, and documents in response to natural-language questions. AWS describes Kendra as providing highly accurate enterprise search and retrieval capabilities, making option C correct. Amazon Augmented AI, abbreviated Amazon A2I, supports human review workflows for machine-learning predictions when human validation is required. It is not an enterprise search engine. Amazon Rekognition analyzes images and videos to identify objects, text, people, activities, and other visual information. Amazon Polly converts written text into lifelike speech. Neither service searches enterprise document repositories. The important exam association is that Kendra is used when an organization needs intelligent, natural-language search across sources such as document management systems, knowledge repositories, websites, and file collections. Kendra uses machine-learning techniques to understand the context and intent of a question instead of relying only on simple keyword matching.

AWS Storage Gateway provides on-premises applications with low-latency access to data stored in AWS by caching frequently accessed data locally. It seamlessly integrates on-premises environments with cloud storage, enabling hybrid storage solutions. AWS DataSync is for data transfer, CloudFront is a content delivery network, and AWS Backup is for backup management, not low-latency access.