AWS Cloud Practitioner Practice Test 2026

About the AWS Cloud Practitioner exam

The AWS Certified Cloud Practitioner (AWS Cloud Practitioner) is a it certifications examination administered in International 🌍. It is designed to assess candidates' knowledge and proficiency across 4 key subject areas including Cloud Concepts, Security & Compliance, Technology, Billing & Pricing. This exam is widely recognized as an essential benchmark for IT professionals.

Use short AWS Cloud Practitioner practice sets to identify topics to revisit. Choose a subject and difficulty, answer questions, then review the explanations. New accounts get 30 question credits; further new questions use paid credits. Retaking previously seen questions is free.

Whether you're a first-time candidate or retaking the AWS Cloud Practitioner to improve your score, InfinityMock helps you identify your strengths and weaknesses through detailed performance analytics. Our platform covers Cloud Concepts, Security & Compliance, Technology, Billing & Pricing, with questions available at Easy, Medium, and Hard difficulty levels. Track your progress, review detailed explanations, and build the confidence you need to pass on exam day.

AWS Cloud Practitioner — quick answers

AWS Cloud Practitioner at a glance

8 free AWS Cloud Practitioner practice questions (2026)

Answer these first — no signup, no card. Every answer is explained. For more practice, sign up for 30 free question credits and choose a subject above.

1. According to the AWS Shared Responsibility Model, which of the following is a responsibility of the customer?

   • Managing physical security of the data center facilities
   • Patching the underlying virtualization infrastructure hypervisors
   • Configuring security groups and network access control lists (NACLs)
   • Disposing of decommissioned storage devices safely
   Show answer & explanation

   Answer: C. Configuring security groups and network access control lists (NACLs)

   Under the AWS Shared Responsibility Model, the customer is responsible for security 'in' the cloud, which includes configuring firewalls, security groups, and network access control lists. AWS is responsible for security 'of' the cloud, including physical security, infrastructure, and hardware disposal.

   Topic: Security & Compliance · easy

2. A company needs to secure its AWS account using Multi-Factor Authentication (MFA). What is the AWS-recommended best practice for the root user account?

   • Share the root credentials with all system administrators but enable SMS MFA
   • Enable MFA on the root user and secure the MFA device, using IAM users for daily operations
   • Disable the root user account completely and use an IAM role to manage billing
   • Do not enable MFA on the root user to prevent accidental lockouts
   Show answer & explanation

   Answer: B. Enable MFA on the root user and secure the MFA device, using IAM users for daily operations

   AWS strongly recommends enabling Multi-Factor Authentication (MFA) on the root user account, storing the MFA device securely, and using IAM users/roles for daily tasks to reduce the risk of compromised master credentials.

   Topic: Security & Compliance · easy

3. Which AWS service is designed to inspect EC2 instances for software vulnerabilities and deviations from security best practices?

   • Amazon GuardDuty
   • AWS WAF
   • Amazon Inspector
   • AWS Shield
   Show answer & explanation

   Answer: C. Amazon Inspector

   Amazon Inspector is an automated vulnerability management service that continually scans AWS workloads (such as EC2 instances, container images, and AWS Lambda functions) for software vulnerabilities and unintended network exposure.

   Topic: Security & Compliance · medium

4. Under the Shared Responsibility Model, who is responsible for patching the guest operating system of an Amazon EC2 instance?

   • The customer
   • AWS
   • Both AWS and the customer share this task equally
   • The OS vendor (e.g., Microsoft or Red Hat)
   Show answer & explanation

   Answer: A. The customer

   Because EC2 is an Infrastructure as a Service (IaaS) offering, the customer retains full control over the guest operating system, which includes the responsibility for applying patches and software updates.

   Topic: Security & Compliance · easy

5. A financial company needs to download compliance reports, such as SOC 2 or PCI DSS, to verify AWS infrastructure compliance. Which AWS service provides on-demand access to these reports?

   • AWS Artifact
   • AWS Config
   • Amazon GuardDuty
   • AWS Security Hub
   Show answer & explanation

   Answer: A. AWS Artifact

   AWS Artifact is a self-service portal that provides on-demand access to AWS's security and compliance reports (such as ISO, PCI, and SOC) and online agreements.

   Topic: Security & Compliance · easy

6. Which of the following is the most secure way to allow an application running on an Amazon EC2 instance to read data from an Amazon S3 bucket?

   • Hardcode the AWS Root account access keys into the application code
   • Create an IAM user, generate access keys, and save them in a configuration file on the EC2 instance
   • Associate an IAM role with the EC2 instance using an instance profile
   • Configure the S3 bucket to be entirely public so the application doesn't need credentials
   Show answer & explanation

   Answer: C. Associate an IAM role with the EC2 instance using an instance profile

   Associating an IAM role with an EC2 instance provides temporary security credentials to applications running on the instance. This eliminates the need to distribute or rotate static credentials.

   Topic: Security & Compliance · medium

7. Which AWS security service uses machine learning to automatically discover, classify, and protect sensitive data (such as personally identifiable information) in Amazon S3?

   • Amazon Inspector
   • Amazon Macie
   • AWS Secrets Manager
   • Amazon GuardDuty
   Show answer & explanation

   Answer: B. Amazon Macie

   Amazon Macie is a fully managed data security and data privacy service that uses machine learning and pattern matching to discover, monitor, and protect sensitive data in Amazon S3.

   Topic: Security & Compliance · medium

8. What is a primary difference between a Security Group and a Network Access Control List (NACL)?

   • Security Groups are stateless, while NACLs are stateful
   • Security Groups operate at the subnet level, while NACLs operate at the instance level
   • Security Groups are stateful, while NACLs are stateless
   • Security Groups support explicit 'deny' rules, while NACLs only support 'allow' rules
   Show answer & explanation

   Answer: C. Security Groups are stateful, while NACLs are stateless

   Security Groups are stateful (inbound traffic that is allowed is automatically allowed outbound, regardless of outbound rules). NACLs are stateless (responses to allowed inbound traffic must be explicitly allowed by an outbound rule).

   Topic: Security & Compliance · hard

Why Practice with InfinityMock's AWS Cloud Practitioner Mock Test?

• Fresh practice questions — Use credits for new questions; retake seen questions free
• Instant Results & Explanations — Learn from every question with detailed answer explanations
• Performance Analytics — Track your progress with grade reports, difficulty breakdowns, and time analysis
• Independent practice — Use alongside current official AWS Cloud Practitioner materials
• Multiple Difficulty Levels — Practice Easy, Medium, or Hard AWS Cloud Practitioner questions

AWS Cloud Practitioner Exam Subjects

Available practice subjects: Cloud Concepts, Security & Compliance, Technology, Billing & Pricing. Select a subject for focused preparation. Coverage is not a guarantee of the complete official syllabus.

📖 AWS Cloud Practitioner Study Guide

Read our comprehensive How to Pass the AWS Cloud Practitioner in 2026 — Complete Study Guide for expert preparation tips, study plans, and strategies.

🔗 Related Exams

Students preparing for AWS Cloud Practitioner also practice for:

Frequently Asked Questions

📚 Browse All 275+ Exams →