Exam Simulation A: Full-Length Practice Set + Strategy

Fourteen lessons gave you the content. This one gives you the container: how a CLF-C02 item is actually built, how the 90-minute clock behaves, how AWS writes a distractor, and then Set A: twenty exam-style items you sit under time and grade honestly. Everything before this lesson was domain knowledge; everything here is test craft, and on a compensatory 100 to 1,000 scale with 700 to pass, test craft is worth as much as another hour of revision.

By the end of this lesson you will be able to:

• restate every published logistics number (65 / 50 / 15, 90 minutes, 700/1,000, 100 USD, 3 years, 14 days) without notes;
• run the 83-second pacing math and defend a two-pass plan that never leaves an item blank;
• apply the flag-and-sweep technique in under a minute per item;
• read a superlative stem, most cost-effective, least operationally intensive, MINIMUM, first MUST, and know which option the qualifier is buying;
• decode the seven distractor families AWS reuses across all four domains;
• sit Set A, grade it by domain rather than by total, and route each miss to the right lesson;
• defend the comparative verdict on self-study versus bootcamp versus AWS training.

---

1. Strategy: the four techniques that decide Set A

1.1 The logistics you must not re-derive on exam day

Every number below is published by AWS and was retrieved in October 2026. You are allowed to forget service trivia; you are not allowed to re-derive these under a running clock.

• 📚 Did you know? The 15 unscored items look exactly like the 50 scored ones: AWS states they "are not identified on the exam". The rational response is symmetry: a badly answered pretest item costs you nothing, a skipped scored item costs the full marks, so the incentive never once points toward "leave it blank and come back". Flag, guess, move.

The interface you will be given. Knowing the controls before test day is free marks, because the exam gives you no orientation tour:

1.2 The pacing plan: 65 items, 90 minutes

AWS publishes no per-question budget: the only official pacing inputs are the 90-minute duration, the on-screen 5-minute warning, and a 2021 AWS blog suggesting you flag rather than linger. Everything else below is arithmetic on published numbers, labelled as such.

Worked example 1: the ceiling.

$$\frac{90 \times 60}{65} = \frac{5{,}400}{65} \approx 83.1\ \text{s per item} \quad (\text{about } 1\text{ min } 23\text{ s})$$

Worked example 2, the two-pass split. Run pass one at 70 s per item: $65 \times 70 = 4{,}550$ s $= 75.8$ minutes. That leaves $90 - 75.8 = 14.2$ minutes, which is 850 seconds, and $850 \div 71 \approx 12$ flagged items re-read at 71 seconds each. Twelve flags is the budget. Not twenty.

Worked example 3, what over-flagging costs. Twenty flags at the same 71 s each is $20 \times 71 = 1{,}420$ s $= 23.7$ minutes, on top of 75.8 minutes of first pass, 99.5 minutes total, roughly 9.5 minutes past the 90-minute limit. Flagging is not free: a flag is a scheduled second attempt, and the schedule has a fixed number of slots.

Worked example 4, Set A's own clock. Set A has 20 items, so the same two rules scale down: a first pass at 60 s per item is $20 \times 60 = 1{,}200$ s $= \mathbf{20}$ minutes, and the 83-second ceiling would give you $20 \times 83 = 1{,}660$ s $= 27.7$ minutes. Sit Set A on 20 minutes flat, it trains the rhythm you will use for 65, not just the twenty in front of you.

Worked example 5: the scored-only illusion. Against scored items only, the budget looks like $5{,}400 \div 50 = 108$ s. You cannot tell which 50 are scored, so 83 s is the number you plan with and 108 s is a trap you must never budget against.

The two formats cost different minutes. CLF-C02 publishes exactly two question types; there is no ordering, matching or case-study item on this exam, so do not budget for them. Everything below the structure row is this lesson's planning arithmetic, not an AWS figure:

• 📚 Did you know? Because multiple-response items take roughly half again as long, they are the items most likely to push you past the 60-second flag threshold, and they are the ones candidates least want to flag, because re-reading five or six options feels productive. Flag them anyway. A flagged multiple-response item you return to with a fresh stem read beats an unflagged one you keep mining in place.

1.3 Flag-and-sweep: the technique, item by item

AWS's own exam-prep walkthrough teaches a five-step sequence, and the fifth step is the one candidates skip. Trained until it is automatic, it looks like this:

The sweep is the other half of the name. At the review screen you are not re-answering; you are checking three things and nothing else:

1. Blanks. Zero. An unanswered item is scored incorrect and there is no penalty for a wrong guess, so blank is strictly dominated by any guess at all.
2. The asked question. Re-read the stem and confirm you answered it: the classic loss is answering the adjacent, more familiar question.
3. Order of operations. Change an option only if you can state the reason in one clause. "It felt wrong" is not a clause.

AWS's 2021 question-breakdown blog compresses the same habit into three questions you ask every option, in this order, and the order matters, because an option can be true and still irrelevant:

1. What requirement does the question put in place?: name the constraint the stem imposes in one clause.
2. What is the condition?: the situation, the workload shape, the risk that must be removed.
3. What is the best solution per AWS best practice?: only now compare the surviving options.

1.4 Reading the stem: superlatives, negations and ordering words

Most CLF-C02 losses are reading losses. The stem's qualifier, not the service name, decides the key, so the first move is always the same: find the qualifier, write down what it demands, then read the options.

Worked example 6: reading a superlative end to end. Take a stem that never appears in Set A: "A production workload runs 24/7 for three years, cannot be interrupted, and will stay in one instance family in one Region. Which option gives the largest discount ceiling?"

1. Underline the qualifiers before looking at any option: 24/7 · three years · cannot be interrupted · one instance family · one Region.
2. Let the hardest qualifier eliminate. "Cannot be interrupted" kills Spot Instances on the spot: even though Spot carries the biggest headline number, up to 90 % off (as of Oct 2026), because Spot capacity can be reclaimed with about two minutes' notice.
3. Match the horizon. Three years of runtime invites a three-year commitment: 3-year EC2 Instance Savings Plans / Standard Reserved Instances, up to 72 % (as of Oct 2026).
4. Take the largest ceiling that survived step 2. A 1-year Compute Savings Plan tops out at up to 66 % (as of Oct 2026) and commits for one year while the workload runs three; On-Demand is the undiscounted baseline.
5. Say the trap out loud: two traps fired at once: the biggest percentage was disqualified by a constraint, and the cheaper-percentage option was more flexible rather than more suitable. Verify every ceiling on the current pricing page before you rely on it.

• 📚 Did you know? AWS's exam-prep tip number five is literally "pick your best guess and flag the question for later review": the flag is an official technique, not a hack. The exam interface gives you a Flag for Review control and a review screen that can show all, incomplete, or flagged questions, so a flag costs you one click and buys a scheduled second read.

1.5 The seven distractor families

AWS states that distractors are "generally plausible responses that match the content area". They are not random; the same seven shapes recur, and each one punishes a specific confusion. They are labelled T1, T7 here so they are never confused with the domain labels D1, D4.

1.6 Domain weights and the Set A blueprint

Only domain percentages are published. The item counts are arithmetic on 50 scored items: a planning aid, never an AWS figure.

Worked example 7, weights to items. $50 \times 0.24 = 12$, $50 \times 0.30 = 15$, $50 \times 0.34 = 17$, $50 \times 0.12 = 6$; $12 + 15 + 17 + 6 = 50$. Domains 2 and 3 together are 64 % of scored content, that is why Set A gives them 13 of its 20 items.

• 📚 Did you know? 700 is not 70 %. The scale runs from 100 to 1,000, so the usable range is 900 points and the passing mark sits $\frac{700 - 100}{1{,}000 - 100} = \frac{600}{900} \approx \mathbf{66.7\,\%}$ of the way up from the floor. AWS does not publish how many correct answers equal 700, exam forms are equated, so any "35 of 50 = pass" claim you meet online is unsourced. Plan for ≥ 80 % on mixed practice with zero blanks and let the scaled score take care of itself.

1.7 What this lesson deliberately does not assert

These points are flagged rather than taught, because a digest marked (G) is never a fact:

1. Partial credit on multiple response. The CLF-C02 guide says "two or more correct responses out of five or more response options" but never writes "select all correct responses" or "partial credit". AWS's published all-or-nothing sentence, "You must select all the correct responses to receive credit for the question", comes from AWS's AI Practitioner guide and a 2024 AWS blog post. Teach yourself all-or-nothing, zero partial credit; do not claim CLF-C02 publishes it.
2. How many multiple-response items the live exam carries, and whether every stem states the count: unpublished.
3. Per-question pacing. 83 seconds is arithmetic on 90 minutes ÷ 65; AWS publishes no pacing guidance, and the 45 to 60 second reading cap in a 2021 AWS blog is one author's practice.
4. Pass rates. AWS publishes none. Any "first-time pass rate" figure is community estimate.
5. Scratch paper. The retrieved rules list notes, pens and phones as prohibited for online proctoring but do not settle test-centre practice. Never claim it is provided, or banned.
6. On-screen pass/fail. Official text is only that the exit screen "provides information on exam results", while results take up to five business days.
7. Raw-to-scaled conversion, and per-objective weights. Only domain percentages exist; objectives carry no published weight.
8. Support-plan rendering. AWS's 2023 walkthrough keyed the phone-support answer to "Business"; the current exam guide lists Basic, AWS Business Support+, AWS Enterprise Support, AWS Unified Operations. Teach the 2026 names, date-stamped (see Q19).

---

Real-World Case Drills

AWS never prints a customer's name on a CLF-C02 item, but the shapes of its published case studies leak into stems constantly: one sentence from a case study becomes the stem's condition, and the four options become the four ways candidates mis-read it. The two drills below convert real AWS case studies into short scenario analyses to run before Set A: each one ends with which domain this tests and what the exam would ask.

Two rules govern everything in this section:

1. A customer result is never an AWS guarantee. "Zendesk reduced costs by up to 42 %" is Zendesk's reported outcome on an AWS page; AWS commits to no percentage. Any option phrased "AWS guarantees…" is wrong on sight.
2. The domain is chosen by the qualifier, not by the story. The same Capital One narrative seeds a Domain 1 stem (agility), a Domain 3 stem (services) or a Domain 4 stem (cost) depending on which clause the exam underlines: exactly the section 1.4 reflex.

Case Drill 1, Capital One "all in on AWS": which domain does an agility story test?

The story as AWS publishes it (AWS customer case-study pages, accessed Oct 2026):

Which domain does this test? Primarily D1 Cloud Concepts (24 %): business value, agility, the 6 Rs, economics. Secondary hooks: D3 Cloud Technology and Services (34 %) if the stem names the services, D4 Billing, Pricing and Support (12 %) if it names the cost lever (weights as of Oct 2026).

What would the exam ask? Three stem shapes, all built from the table above:

1. "…reduced the average time needed to build a development environment from 3 months to only minutes." Which AWS Cloud benefit does this illustrate? → Increase speed and agility. The qualifier is provisioning lead time. The losing options are all genuine AWS benefits: economies of scale (unit price), go global in minutes (Regions and latency), trade fixed expense for variable expense (billing shape). That is trap family T7, true-but-irrelevant: an option can be true and still answer a different question.
2. "The company built 80 % of its applications from the ground up." Which of the 6 Rs? → Refactor / re-architect, decided by the clause "from the ground up". Swap that clause and the key moves: "copied the virtual-machine images across unchanged" → Rehost; "moved the database to a managed service, code untouched" → Replatform. One story, three keys, all selected by the qualifier you underlined first.
3. "Which statement about the reported savings is correct?" → they are customer results published on an AWS page, never AWS commitments. An option phrased "AWS guarantees…" or "AWS delivers up to X % savings to every customer" fails before you even check the number.

The trap to say out loud: Capital One sits on two different AWS pages with two different number sets: the migration page carries "3 months → minutes" and −70 % DR test time, while the resilience page carries −80 % to −90 % critical-severity events and hours → minutes recovery. A stem that quotes one page's number inside the other page's story is a distractor by construction.

• 📚 Did you know? Amazon S3 launched on 14 March 2006 at 15 cents per gigabyte on roughly 1 petabyte spread across about 400 storage nodes, and AWS's own 20-year retrospective (AWS News Blog, posted 2026-03-13) puts the current price at "slightly over 2 cents per gigabyte", roughly an 85 % reduction, while noting that code written for S3 in 2006 still works unchanged. Date-stamp both points: they are AWS's published figures as of Oct 2026, and current pricing should be verified before you rely on it.

Case Drill 2, Box: reading a $2.23 M saving as four exam levers

The story as AWS publishes it (AWS customer case study, accessed Oct 2026): Box, an enterprise SaaS provider, applied the AWS Well-Architected Framework and Solutions Architect reviews to cut spend without degrading security, reliability or performance, and published $2.23 million in savings split across four levers. In the customer's own words: "Our use of AWS best practices led to savings of over 2 million dollars": Box's director of FinOps and SRE, customer voice rather than an AWS claim.

Worked example 10: the waterfall adds up.

$438{,}000 + 1{,}100{,}000 + 500{,}000 + 192{,}000 = 2{,}230{,}000$

$438 K inter-AZ + $1.1 M egress + >$500 K storage + $192 K logging = $2.23 M, and every bar is an examinable billing concept:

Which domain does this test? D4 Billing, Pricing and Support (12 %) first, data-transfer charges, storage economics, the four cost tools, with D3 (34 %) hooks (storage classes) and D1 (24 %) hooks (total cost of ownership, the cost pillar of Well-Architected).

What would the exam ask? Three stem shapes:

1. "A company's bill is dominated by traffic flowing between Availability Zones. Which change MOST reduces it?" → fix the architecture: keep a tier's components inside a single Availability Zone. The distractors each answer a neighbouring question: Reserved Instances change the compute rate, MFA is a security control, and "move to a cheaper Region" leaves the cross-AZ pattern untouched.
2. "Which AWS service could estimate this architecture's monthly cost before any resources exist?" → AWS Pricing Calculator: free, and usable with no AWS account. Cost Explorer needs actual usage, AWS Budgets watches a target, and the Cost and Usage Report exports bills already incurred (Set A's Q20 teardown).
3. "Which AWS framework produced these recommendations?" → the AWS Well-Architected Framework / Well-Architected Review: free best-practice guidance. It is not Trusted Advisor (which checks your account's configuration), not an AWS Support plan, and not a certification.

The trap to say out loud: the free lever in this story is architecture, a Well-Architected review costs nothing, while every dollar and percentage on the page is Box's result. An option that promises you the same $2.23 M, calls the review a "certification", or files it under Trusted Advisor is wrong on wording alone.

2026 Updates (as of October 2026)

Six 2025-2026 changes decide whether your notes are right or wrong on exam day. Every bullet is sourced to an AWS first-party page retrieved in October 2026; where a claim could not be verified it is labelled as such and must never be memorised as fact.

• 📚 Did you know? AWS announced the AWS Well-Architected Agent (preview, 2026-10-01) and describes it as "the next-gen evolution of AWS Trusted Advisor and the AWS Well-Architected Tool", while Database Savings Plans arrived on 2025-12-02, yet neither name appears in the exam guide, which still lists AWS Well-Architected Tool and AWS Savings Plans. The meta-skill for 2026: a service can be real, recent and still not examinable. The guide's in-scope list is the only arbiter.

---

2. Practice Questions, Set A: 20 items in published weight order

Set A mirrors the live exam's dominant format, one correct response, three distractors, while also drilling five multiple-response items. Items run in domain-weight order: D1 five, D2 six, D3 seven, D4 two.

2.0 How to sit Set A

Pre-flight check: run this in the 60 seconds before you start the timer:

1. Timer set to 20 minutes, notifications off, phone in another room.
2. A blank sheet for the qualifier words (MINIMUM, most, first, NOT, Select TWO): writing the qualifier is the whole technique.
3. Answer sheet or tally ready, so grading takes 30 seconds afterwards.
4. Agreement with yourself: no blanks, and no option change without a one-clause reason.
5. Agreement with yourself: at 60 seconds the item gets flagged and a guess, whatever your instincts say.
6. Teardowns hidden. If you can see them, you are measuring your reading comprehension, not your recall.

2.1 Domain 1: Cloud Concepts (24 %) · items 1 to 5

Teardown, Q1 · fixed → variable. Why it is right: variable, metered spend means you never buy capacity for a two-week peak, that is the fixed-to-variable shift. Why the traps lose: A is the aggregation argument (hundreds of thousands of customers lower the unit price), not a peak-sizing argument; C is Regions, latency and data residency; D is time-to-market. Trap: "economies of scale" is the most economic-sounding phrase in the option list, but the stem's keyword is peak two weeks a year. Source: question-bank seed Q01 · cloud-concepts digest §B (AWS's six advantages of cloud computing).

Teardown, Q2 · two of the six advantages. Why it is right: both halves are on the published list: fixed → variable, and stop guessing capacity. Why the traps lose: B offers two statements that are false, the shared responsibility model always applies, and AWS supplies resilient primitives while availability is a shared responsibility, so no blanket guarantee exists; C is the opposite of "go global in minutes" plus an odd data-sovereignty twist; D smuggles the false "eliminate shared responsibility" half into an otherwise valid pair. Trap: candidates reward prudence (single Region, keep data close) instead of checking the published list. Live-exam form: you would tick two separate checkboxes; AWS's published rule for this type is all-or-nothing. Source: seed Q05 · cloud-concepts digest §B · shared-responsibility digest §B.

Teardown: Q3 · which pillar. Why it is right: multi-AZ removes single points of failure, which is precisely the reliability definition. Why the traps lose: A is about the lowest price for business value: a second AZ costs more, so this option moves opposite to the change; B is about using resources efficiently as demand or technology change; D protects data and systems: necessary everywhere, but not what a second AZ specifically buys. Trap: "multiple Zones" tempts performance (more capacity) and cost (it looks like waste). Memorise the six pillars: operational excellence, security, reliability, performance efficiency, cost optimization, sustainability. Source: seed Q02 · monitoring/support digest F.9 · AWS Well-Architected Framework.

Teardown: Q4 · which of the 6 Rs. Why it is right: "no application edits" is the definition of rehost. Why the traps lose: A is "lift, tinker, shift": a small optimisation such as moving a database to a managed service, which the stem rules out; B means rewriting cloud-native, the opposite of "unchanged"; D means switching to a SaaS product. Trap: "no edits" also tempts Retain (keep it on premises), but the images are moved, so Retain is wrong; and if the stem ever says "moved to a managed database", the key flips to Replatform. Source: seed Q04 · cloud-economics/migration digest §B.4 and F.1 (the 6 Rs: Retire, Retain, Rehost, Relocate, Repurchase, Replatform, Refactor).

Teardown: Q5 · FIRST. Why it is right: FIRST asks for the prerequisite step, and measured under-utilisation is only fixed by resizing before anything else. Why the traps lose: B commits dollars to the wrong shape for three years; C changes the interruption profile without fixing size; D changes the hourly rate, not the waste, and may break latency or data-residency requirements. Trap: "biggest discount" pulls you to Reserved or Spot, but the exam's economics rule is right-size first, then choose a discount model. Source: seed Q07 · cloud-economics/migration digest F.8 · pricing digest §C (commitment ceilings, as of Oct 2026).

2.2 Domain 2: Security and Compliance (30 %) · items 6 to 11

Teardown, Q6 · whose job is it? Why it is right: the service is AWS's; the rules you write are yours, security of the cloud versus security in the cloud. Why the traps lose: A and D sit on the hardware and host layer AWS owns; B is impossible for customers, data centres are not open to visitors. Trap: "it's AWS's firewall, so AWS configures it" is trap family T5, responsibility flip, the single most reliable wrong answer on this domain. Source: seed Q11 · shared-responsibility digest F.2 · AWS shared responsibility model.

Teardown, Q7 · where the line shifts. Why it is right: this is exactly the "responsibilities shift depending on the service" skill in task 2.1, EC2, RDS and Lambda are the three named examples. Why the traps lose: A is false, AWS patches only the hypervisor for EC2; C is false, Lambda has no customer-managed operating system; D is false on every service: encryption, classification and access to data never transfer. Trap: candidates over-correct into "managed = AWS does everything", which is the mirror image of Q6's error. Source: seed Q12 · shared-responsibility digest F.2 · exam-guide digest §B.2 task 2.1 (verbatim: EC2, RDS, Lambda).

Teardown, Q8 · DENY + subnet. Why it is right: two qualifiers do all the work, subnet (NACLs are subnet-level, security groups are instance-level) and DENY (NACLs support deny, security groups do not). Why the traps lose: B is the reflex firewall answer but cannot express deny at all and is scoped to an elastic network interface; C governs API actions, not packet flow; D governs bucket access, not subnet traffic. Trap: the option that "sounds like the firewall" is wrong here, the qualifiers, not the noun, decide the key. Source: seed Q13 · security/IAM digest F.4, F.6 · networking digest F.3, F.5.

Teardown, Q9 · serverless still has customer duties. Why it is right: both halves stay yours, your code, and the IAM policy you attach to the role Lambda assumes. Why the traps lose: A is a 50/50 pair (your code, AWS's Region) so it fails the "both" test; B is 100 % AWS-owned, Lambda has no customer-patched host and hardware replacement is AWS's; C is also 50/50 (your role permissions, AWS's hardware). Trap: "Lambda = no customer duties" is the most common serverless misconception, managed infrastructure never moves IAM or data duties. Live-exam form: two checkboxes, all-or-nothing. Source: seed Q15 · deployment/operations digest §B.5 · shared-responsibility digest F.2.

Teardown, Q10 · protect root. Why it is right: MFA plus zero root access keys is the published root-protection baseline, because root can perform every task in the account. Why the traps lose: A directly contradicts the no-root-access-keys rule; C spreads the most powerful credential to a second team; D uses root for work an IAM user or role can do. Trap: "automation needs a root key", automation uses an IAM role or IAM user, never root. Source: seed Q16 · security/IAM digest §B (root protection: MFA, no root access keys).

• 📚 Did you know? As of October 2026, AWS has retired SMS-based multi-factor authentication and steers root and IAM protection toward passkeys, FIDO security keys and hardware or virtual TOTP devices. Older study material and older practice tests still recommend "SMS MFA": date-stamp every MFA answer to the year you sit the exam.

Teardown: Q11 · SQLi and XSS. Why it is right: injection attacks against web requests are layer-7 problems, and WAF is the layer-7 control you attach. Why the traps lose: A is DDoS protection at layers 3/4, and Shield Standard is automatic and free, so there is nothing to "attach"; B detects threats from logs and never filters requests; D administers WAF, Shield and security-group policies across an Organization; it does not do the filtering itself. Trap: "the firewall" pulls you to Shield; the stem's verb (block SQL-injection) is what matters. Source: seed Q20 · security/IAM digest §B.5 · exam-guide digest §B.2 task 2.4 (WAF, Firewall Manager, Shield, GuardDuty named verbatim).

2.3 Domain 3: Cloud Technology and Services (34 %) · items 12 to 18

Teardown: Q12 · most cost-effective for this shape. Why it is right: the stem supplies both required qualifiers: can be paused and restarted (interruptions acceptable) and cost matters more than continuity; which is the textbook Spot profile. Why the traps lose: B never interrupts but is full price, the opposite of the stem's priority; C never interrupts but locks a 1- or 3-year commitment for a job that runs nightly only; D exists for licensing and compliance isolation, not discount. Trap: "up to 90 % off" looks attractive for any workload, but the biggest percentage is disqualified the moment the workload cannot be interrupted. Source: seed Q24 · compute/storage digest F.4 · pricing digest C1, C2 (Spot up to 90 %, ~2-minute notice, as of Oct 2026: verify current before use).

Teardown: Q13 · the qualifier is retrieval speed. Why it is right: two constraints decide it: about once a quarter (archive) and milliseconds (no restore step), which is the exact design point of Glacier Instant Retrieval. Why the traps lose: A stores at a higher price with no latency benefit at this access rate; B and C require a restore that takes minutes to hours before any read, breaking the millisecond requirement. Trap: all three "Glacier" options sound like archives: the discriminator is Instant. Note the minimum durations (Standard-IA 30 days; Glacier Instant and Flexible 90 days; Deep Archive 180 days: verify current before use). Source: seed Q25 · compute/storage digest §B.5: B.7, C6.

Teardown, Q14 · read scale, not availability. Why it is right: the stem asks for read scale-out; replicas deliver it asynchronously and leave failover alone. Why the traps lose: A, a Multi-AZ standby cannot serve read traffic and is billed as a second instance purely for high availability; B is a vertical resize, which adds capacity but not read concurrency, and it disturbs the very instance the writer depends on; D is ephemeral and local to one AZ, so it cannot be the reporting layer. Trap: "Multi-AZ" is the HA answer candidates know best; both features can coexist, but only one solves this problem. Source: seed Q29 · database-services digest §B.4 (Multi-AZ synchronous HA vs asynchronous read replicas).

Teardown: Q15 · consistent and private. Why it is right: consistent and private are the qualifiers; a dedicated link delivers both deterministically. Why the traps lose: B is encrypted but runs over the shared public internet, so it cannot promise consistency; C connects individual laptops and clients, not a whole data centre; D is a cloud contact centre: a pure sibling-service distractor. Trap: VPN is the reflex word for "private connection": encrypted is not private. Site-to-Site VPN always encrypts; Direct Connect is private by default. Source: seed Q31 · deployment/operations digest §B.9 · AWS re:Invent exam-prep walkthrough 3.1.

Teardown, Q16 · the arithmetic and the letters. Why it is right: $12{:}00 - 09{:}00 = 3$ h of data at risk (RPO), and $14{:}00 - 12{:}00 = 2$ h of outage (RTO). Why the traps lose: A computes both gaps correctly and then swaps the two definitions; C adds the intervals together, which is neither metric; D measures the outage from the backup rather than from the failure. Trap: you will compute both numbers correctly and still lose the item, memorise RPO = data, RTO = time and the arithmetic follows. Source: seed Q32 · global-infrastructure digest §H.5 worked example and REL13-BP02 recovery bands.

Teardown, Q17 · "immediately" is the whole question. Why it is right: both strategies in D hold a running copy, one at reduced capacity, one at full. Why the traps lose: A fails on both halves: backup and restore needs a rebuild, and a pilot light "cannot process requests without additional action taken first"; B fails for the same reason plus a snapshot-copy step; C is the near-miss, warm standby qualifies but backup and restore does not, so the pair fails the "both" test. Trap: pilot light is the most-selected wrong answer because it keeps data replicated, replication is not serving capability. Cost and complexity rise backup → pilot light → warm standby → active-active as RTO and RPO improve. Source: seed Q35 · global-infrastructure digest §B and REL13-BP02 (verbatim recovery bands).

Teardown: Q18 · pull, push, orchestrate. Why it is right: all three move application work: SQS buffers and decouples, SNS fans out notifications, Step Functions sequences multi-step processes. Why the traps lose: B contains one correct service and two that do not move messages (Route 53 is DNS, Direct Connect is a network link); C mixes a correct notifier with a DDoS service and an interactive-query service; D pairs the orchestrator with DNS and BI. Trap: every failing option is partly right; that is trap family T7, true-but-irrelevant: a single correct name in a triple does not make the triple correct. Also hold SQS and SNS apart: SQS pulls (one consumer per message), SNS pushes (fan-out to many subscribers), and the classic combination is SNS → many SQS queues. Source: seed Q34 · integration/analytics/serverless digest §B.2 decision table.

2.4 Domain 4: Billing, Pricing, and Support (12 %) · items 19 to 20

Teardown, Q19 · the MINIMUM. Why it is right: in the 2026 lineup (Basic · Business Support+ · Enterprise · Unified Operations, as of Oct 2026), Business Support+ is the lowest plan with technical phone support. Why the traps lose: A covers account, billing and quota questions but cannot open technical support cases; B is the top tier with a $50,000-per-month minimum, correct capability, wrong superlative; D does not exist as a product. Trap: two errors at once, answering Enterprise because it "definitely has phone support" (over-answering the MINIMUM, family T4), and answering Developer, which stopped accepting new subscriptions on 2 December 2025. Date-stamp: AWS's own 2023 walkthrough keyed this to "Business"; whether the live exam renders "Business Support" or "Business Support+" is unconfirmed, so teach the 2026 name and re-check the support page before you sit. Source: seed Q38 · AWS re:Invent TNC108 walkthrough 4.3 · monitoring/support digest §A, C3, C6.

Teardown, Q20 · four tools, four jobs. Why it is right: the calculator estimates before anything exists and needs no account; Budgets monitoring and notifications are free (as of Oct 2026, the first two action-enabled budgets are free, then roughly $0.10 per day each). Why the traps lose: A is wrong twice, the Cost Explorer console UI is free (only API calls are charged, at $0.01 per paginated request), and a Budgets alert is a notification, not a cap: stopping spend requires an explicit budget action; C is wrong twice, the calculator is free, and Cost Explorer's default history is 13 months, not five years; D repeats the notification-equals-cap error, and the Cost and Usage Report is a raw line-item export of bills already incurred, not a forecast. Trap: the four-way split is the whole domain in one line, Calculator = estimate before you build · Cost Explorer = explore and forecast actuals · Budgets = alert and act on a target · Cost and Usage Report = raw line-item export. Source: seed Q39 · pricing digest C12 · billing/organizations digest F.8, F.9 (all figures as of Oct 2026).

• 📚 Did you know? The Official Practice Question Set that AWS offers for CLF-C02 contains exactly 20 questions, the same count as Set A here, is free, can be retaken, and reshuffles the same items on each attempt. It is the first thing AWS's own four-step prep plan asks you to take, and its per-option feedback cites recommended resources. If Set A felt long, that is useful information about your pacing; if it felt short, take the official 20 next.

2.5 Case-drill and 2026-update items · 21 to 22 (outside the 20-minute clock)

These two items sit outside Set A's timed twenty: they test the case drills and the 2026 updates you just read, so time them separately at about 90 seconds each or fold them into your 72-hour re-sit. Your Set A score stays out of 20.

Teardown, Q21 · three months to minutes. Why it is right: the qualifier is provisioning lead time, a working development environment appearing in minutes instead of months is the agility and time-to-market benefit. Why the traps lose: A is the aggregation argument that lowers unit price and never mentions build time; C is the billing shift (fixed → variable) and the stem says nothing about how the infrastructure is paid for; D is Regions, latency and data residency, "minutes" here is a build time, not a deployment geography. Trap: every option is a genuine AWS benefit, so this is family T7, true-but-irrelevant, test each option against the stem's pain, never against general goodness. Source: Capital One customer case study (AWS, accessed Oct 2026) · cloud-concepts digest §B (six advantages of cloud computing) · case-studies digest C2. Customer result, not an AWS guarantee.

Teardown, Q22 · two Free Tiers, one stem date. Why it is right: the account date, 1 August 2025, is the qualifier, and it falls on or after the 2025-07-15 change, so the new 6-month, credit-based shape applies with the new eligible instance list (t3.micro, t3.small, t4g.micro, t4g.small, c7i-flex.large, m7i-flex.large). Why the traps lose: A is the legacy rule for accounts created before 2025-07-15, true AWS behaviour, wrong stem; C confuses the Free Tier with always-free services, since no instance family is unbounded free; D has no basis anywhere, Free Tier requires no Support plan at all. Trap: candidates memorise one sentence ("Free Tier = 12 months of t2.micro") and never read the stem's date; both rules are correct AWS behaviour and the date decides between them, the same qualifier reflex as Q1, Q20. Date-stamp: as of Oct 2026; verify current before use. Source: AWS News Blog 2025-07-15 · EC2 User Guide "before and after July 15, 2025" table · aws-updates-2026 digest C14, C16.

---

3. Grading Set A, and routing your next 72 hours

3.1 The rubric

Worked example 8, 700 again, in raw terms. $700 - 100 = 600$ usable points above the floor, out of a range of $1{,}000 - 100 = 900$, so the cut is $600 \div 900 \approx \mathbf{66.7\,\%}$ of the range, not 70 % of the questions, and AWS never publishes the item count behind it.

3.2 Reading your Set A score

Grade by domain block, not by total. A 17/20 that hides three misses in the 12 %-weighted Domain 4 block is more dangerous than a 15/20 spread evenly, because compensatory scoring punishes the dip, not the average. Then classify every miss as either a knowledge gap (you did not know) or a reading error (you knew it and picked the distractor). Knowledge gaps go to the routing table; reading errors go back to section 1.4.

Worked example 9: the dip, not the average. Two candidates sit Set A:

Candidate A has the better total and the worse profile: one entire domain block at zero. Scoring is compensatory, so A does not fail automatically, there is no per-domain pass mark, but A's score report will show a hard zero in Billing, Pricing and Support, which is 12 % of the live exam (≈ 6 scored items by the arithmetic in section 1.6). That is precisely the profile AWS has in mind when it warns candidates to "use caution when you interpret section-level feedback". Fix the dip first, even when the total looks comfortable.

Six symptoms, and what each one actually is:

3.3 The routing table: miss → lesson

3.4 The last 48 hours

The goal of the last 48 hours is not new knowledge; it is retrieval practice on what you already have, so that the four decision rules (qualifier first, eliminate two, most-specific-and-least-absolute tie-break, flag at 60 seconds) fire automatically at item 1.

3.5 What Set A cannot tell you

An honest simulation is only useful if you know what it does not measure. Six limits, stated so you never over-read a practice score:

1. Your scaled score. Set A reports a raw count out of 20. The live exam maps raw performance onto 100 to 1,000 through standard setting and equating across forms, and that mapping is not published. Never convert "17/20" into "that is an 850".
2. Endurance. Twenty items in 20 minutes trains accuracy and rhythm; it does not train 65 items in 90 minutes. Only a full-length timed sitting tests the flag budget, the fatigue in the last third, and whether your 70-second discipline survives an hour.
3. The live form's composition. How many multiple-response items the real exam carries, and whether every stem states its count, is unpublished. Set A's 5-of-20 split is a teaching choice, not an AWS figure.
4. Difficulty calibration. AWS does not publish item difficulty, and the easy/medium/hard tags used anywhere in this course are derived from step count, not from AWS statistics. A hard item here may be unscored on the live exam, and an easy one may be scored.
5. Pass prediction. No practice percentage predicts a pass, because the cut is scaled and the 15 unscored items are hidden. Use the bands in section 3.2 as study signals, never as forecasts.
6. Coverage of the whole blueprint. Set A samples 20 of the guide's 19 task statements' worth of content; a perfect score means you handled these 20 items, not that every objective in Domain 3's eight task statements is secure.

The correct reading of a Set A score is therefore narrow and behavioural: did I finish in time, leave zero blanks, apply the qualifier rule, and lose items to a pattern I can name? If yes, the score is doing its job; it is telling you where to spend the next session, not whether you will pass.