Monitoring is mostly one fork: CloudWatch watches how things perform, CloudTrail records who did what. Six questions, 2026 edition.
Here are 6 typical Amazon CloudWatch questions in the exam's own style — free, with the answer explained, no sign-up.
Straight to the 6 free questions ↓Monitoring on the CLF-C02 comes down to keeping three services apart, and mostly to one fork between the first two. CloudWatch watches how your resources are performing. CloudTrail records who did what. Get that straight and the domain’s monitoring questions become quick marks.
Amazon CloudWatch is the monitoring service. It collects metrics (like CPU utilisation), stores logs, raises alarms when a metric crosses a threshold, and shows dashboards. The word to attach to it is performance — CloudWatch tells you how your system is doing, and can act when something goes wrong. A scenario about reacting to high CPU, collecting application logs, or graphing metrics is a CloudWatch scenario.
These two are constantly offered together, and they do different jobs:
The tell is in the question. “Alert me when CPU is high” or “collect these logs” is CloudWatch. “Who deleted that bucket, and when” or “prove what happened for an audit” is CloudTrail. Performance versus identity.
A quieter service completes the set. AWS Config records how your resources are configured over time and can check that configuration against rules — useful for spotting drift and supporting compliance. So the trio splits cleanly by what each one watches: CloudWatch watches performance, CloudTrail records identity and actions, Config records configuration.
Answer each one before opening the explanation, then read past the correct letter to why the other three fail. The distractors are always the neighbouring observability services — CloudTrail where CloudWatch belongs, Config where CloudTrail belongs. Sorting them by what each one watches is the whole skill, and the reasoning below is built to make it automatic.
What is Amazon CloudWatch?
CloudWatch monitors your AWS resources and applications — collecting metrics, storing logs, raising alarms and showing dashboards. Why not the others: recording API calls for auditing is CloudTrail. A web application firewall is AWS WAF. A content delivery network is CloudFront. CloudWatch is about how things are performing, not who did what.
A governance team needs to know which user made a particular API call, and when, for auditing purposes. Which service provides this?
CloudTrail records API activity across the account — who called what, from where, and when — which is exactly an audit trail. Why not the others: CloudWatch watches performance metrics and logs, not the identity behind each API call. Config tracks resource configuration over time. GuardDuty detects threats. 'Who did what' is the CloudTrail signal, and it is the fork the exam tests most.
A team wants to send a notification and trigger scaling automatically when average CPU utilisation goes above 80%. What should it configure?
A CloudWatch alarm watches a metric such as CPU utilisation and acts when it crosses a threshold — sending a notification or triggering an action. Why not the others: a CloudTrail trail records API calls, it does not react to metrics. A Config rule evaluates resource configuration, not live performance. Trusted Advisor gives periodic best-practice checks, not real-time metric alarms.
Where does an application send its logs so they can be collected, stored and searched in AWS?
CloudWatch Logs is the destination for application and system logs, where you can search and set metric filters on them. Why not the others: CloudTrail logs API activity specifically, not general application output. Cost Explorer is a billing tool. Inspector scans for vulnerabilities. General log collection is a CloudWatch job.
What does a CloudWatch dashboard provide?
A CloudWatch dashboard is a customisable set of graphs and widgets showing your metrics in one place. Why not the others: a record of configuration changes over time is AWS Config. A consolidated bill is billing, via AWS Organizations. A private connection to AWS is Direct Connect or a VPN. Dashboards are how CloudWatch presents monitoring data.
Which service records how your AWS resources are configured over time and can evaluate them against rules?
AWS Config records the configuration of your resources and how it changes, and can check that configuration against rules — useful for compliance. Why not the others: CloudWatch watches performance metrics and logs. CloudTrail records the API calls. CloudFront is a content delivery network. Config answers 'what does this resource's configuration look like, and has it drifted'.
That is exactly how every question in the course works — answer, explanation, why-not. The real set continues in the practice player: 10 free questions, no sign-up.
Continue with the 10 free questions →The exam does not test whether you recognise a term — it tests whether you can rule out three plausible answers under time pressure. That is what the explanations above are for, and there are 390 more questions built exactly like them.
Collecting questions yourself
Practising with a system
Straight into the player. No account, no email.
Updated for CLF-C02 (July 2026). The sample questions above are our own work in the style of the exam — not real exam items. The exam itself is set and marked by the certification body.