From Alarms to Automation Your CloudOps Prep Starts Now

Take on 25 practice questions across five CloudOps Engineer domains.
Start Free Practice
No Credit Card Required
HOW TO PREPARE

Everything You Need to Know First

Warm-up topics before the test.
  • Core AWS Services: Hands-on familiarity with EC2, S3, VPC, IAM, and CloudWatch.
  • Linux and Networking Basics: Comfort with the command line, DNS, subnets, and routing.
  • Infrastructure as Code Awareness: General understanding of CloudFormation or CDK for repeatable deployments.
PRACTICE TEST

Put Your Knowledge to the Test

25 multiple-choice questions, including ones built around command output
Static assets in a private S3 bucket must be served to website visitors only through Amazon CloudFront. Anonymous requests made directly to S3 object URLs must fail. What should the operator configure?
Public read access on the bucket with CloudFront in front of it
An S3 website endpoint that only serves requests carrying a custom Referer header
Origin access control with a distribution-only bucket policy
A presigned URL for every object in the bucket
C
Origin access control lets CloudFront sign requests to S3, and the bucket policy allows the CloudFront service principal only for that distribution, so anonymous direct requests fail. This does not remove access for IAM principals that have their own S3 permissions. Public access and Referer checks can be bypassed, and presigned URLs do not route users through CloudFront.
Networking and Content Delivery
25
Select One
A company runs UDP-based game servers in two Regions. Players need two static anycast IP addresses and fast regional failover without relying on DNS caching. Which service fits?
Amazon CloudFront with an origin group
Route 53 latency-based routing with health checks
An Application Load Balancer with cross-zone load balancing
AWS Global Accelerator
D
Global Accelerator provides two static anycast IP addresses, supports TCP and UDP, and fails over between Regional endpoints without DNS changes. CloudFront does not proxy arbitrary UDP traffic, and Route 53 failover depends on DNS caching.
Networking and Content Delivery
24
Select One
An operator must confirm whether traffic from a specific IP address is being accepted or rejected at an instance's network interface. Which data source shows this?
VPC Flow Logs for the network interface
CloudTrail management events for the VPC
Route 53 Resolver query logs
Application Load Balancer access logs
A
Flow log records include the source, destination, ports, and an ACCEPT or REJECT action for traffic at the interface. CloudTrail records API calls, Resolver query logs record DNS queries, and ALB logs only cover load balancer requests.
Networking and Content Delivery
23
Select One
An instance's security group allows inbound TCP 443. Its subnet's custom network ACL allows inbound TCP 443 and outbound TCP 443 only. Clients on the internet time out. What should the operator change?
Add an outbound rule for TCP 443 to the security group
Add an outbound NACL rule for TCP 1024-65535
Add an inbound network ACL rule allowing TCP ports 1024-65535 from the clients
Attach an Elastic IP address to the instance
B
Network ACLs are stateless, so responses to clients leave on the clients' ephemeral ports and need an outbound rule. Security groups are stateful and already allow the return traffic, and the inbound direction is not the problem.
Networking and Content Delivery
22
Select One
EC2 instances in a private subnet need outbound IPv4 internet access for software updates and must not be reachable from the internet. The design uses a zonal public NAT gateway. Which configuration fits?
An egress-only internet gateway with a 0.0.0.0/0 route from the private subnet
A NAT gateway placed in the private subnet itself
A public-subnet NAT gateway with a 0.0.0.0/0 route to it
An internet gateway route in the private subnet's route table
C
A zonal public NAT gateway uses an Elastic IP address and sits in a public subnet with an internet gateway route, and private subnets route outbound IPv4 traffic to it. AWS also offers a regional NAT gateway mode that does not need a public subnet, which is why the question specifies zonal. An egress-only internet gateway works only for IPv6, and an internet gateway route would make the subnet public.
Networking and Content Delivery
21
Select One
The security team wants to identify S3 buckets, IAM roles, and KMS keys that grant access to principals outside the organization. Which service provides these findings?
AWS Trusted Advisor
Amazon Macie
Amazon GuardDuty
IAM Access Analyzer
D
Access Analyzer uses the organization or account as a zone of trust and reports resources shared with external principals. Macie finds sensitive data, GuardDuty detects threats, and Trusted Advisor gives general checks.
Security and Compliance
20
Select One
A role in Account B must decrypt S3 objects encrypted with a customer managed KMS key that lives in Account A. Which two changes are required?
Re-encrypt the objects with the AWS managed key aws/s3
Update the key policy in Account A to allow Account B to use the key
Enable automatic key rotation on the key
Attach an IAM policy in Account B that allows kms:Decrypt on the key ARN
B
Cross-account KMS use requires both the key policy in the owning account and an IAM policy in the external account. AWS managed keys cannot be shared across accounts, and rotation and bucket ACLs do not grant key use.
Security and Compliance
19
Select Two
D
An application stores its Amazon RDS database credentials in AWS Secrets Manager. The security team wants the password changed every 30 days without redeploying the application. What should the operator configure?
Secrets Manager automatic rotation, read at runtime
A Parameter Store String parameter with an expiration notification policy
An RDS read replica that uses a different master password
A new IAM access key for the application every 30 days
A
Secrets Manager rotation updates both the database password and the secret on a schedule. Because the application reads the secret at runtime, no redeployment is needed. Parameter Store does not rotate RDS credentials itself.
Security and Compliance
18
Select One
An IAM policy in a member account allows ec2:TerminateInstances, but a service control policy (SCP) attached to the account's OU explicitly denies it. What happens when a user calls the API?
The call succeeds because the identity policy grants the permission
The call is denied because the SCP's explicit deny applies
The call succeeds only if the member account's root user makes it
The call succeeds if a permissions boundary also allows it
B
SCPs set the maximum available permissions, and an explicit deny in an applicable SCP overrides any allow. SCPs also apply to the member account's root user, and a permissions boundary cannot override them.
Security and Compliance
17
Select One
An operator must patch 500 EC2 instances every month during an approved window and report patch compliance. Which solution fits?
User data scripts that run a full package update each time an instance launches
Manual creation of new AMIs each month by the operations team
Amazon Inspector with automatic patching enabled
Patch Manager with a patch baseline and maintenance window
D
Patch Manager applies approved patches from a baseline during maintenance windows and reports compliance. Launch-time scripts do not patch running instances, and Inspector finds vulnerabilities but does not install patches.
Deployment Provisioning and Automation
16
Select One
New task definitions for an Amazon ECS service sometimes fail health checks, and the rolling deployment never stabilizes. The team wants failed deployments to roll back to the last working version automatically. What should the operator enable?
Fargate Spot capacity providers for the service
A higher desired task count during deployments
The ECS deployment circuit breaker with rollback
A larger task memory limit in the task definition
C
The circuit breaker detects a rolling deployment that cannot reach a steady state and, with rollback enabled, returns the service to the last completed deployment. Capacity and sizing changes do not detect failed deployments.
Deployment Provisioning and Automation
15
Select One
A team defines its infrastructure in TypeScript with the AWS CDK. Before deploying, an operator wants to compare the app with the stack that is currently deployed. Which command should the operator run?
cdk synth
cdk diff
cdk bootstrap
cdk deploy --force
B
cdk diff compares the synthesized app with the deployed stack and shows the differences. cdk synth only produces the template, cdk bootstrap prepares an environment for deployments, and cdk deploy makes the changes.
Deployment Provisioning and Automation
14
Select One
A baseline CloudFormation template must be deployed to every account in an organizational unit, including accounts that are added to the OU later. What should the operator configure?
Service-managed StackSets with automatic deployment
A separate CloudFormation stack created manually in each new account by its owner
An AWS Config conformance pack in the management account
A CDK app that each account owner deploys locally
A
Service-managed StackSets integrate with AWS Organizations, and automatic deployment adds stack instances when accounts join the target OU. The other options require manual steps in each account or do not deploy templates.
Deployment Provisioning and Automation
13
Select One
Before updating a production CloudFormation stack, an operator wants to preview the proposed changes, including resources that might be replaced. What should the operator do?
Run drift detection on the stack
Apply a stack policy that denies all updates
Update the stack with rollback on failure disabled
Create a change set and review it before executing
D
A change set lists the proposed additions, modifications, and deletions before anything is applied, and reports whether each modification requires replacement: true, false, or conditional. A change set does not guarantee that execution will succeed. Drift detection compares live resources with the current template, not with a proposed update.
Deployment Provisioning and Automation
12
Select One
New instances in an Auto Scaling group must download configuration and pass local tests before they receive traffic. Bootstrap can take up to 8 minutes and occasionally fails. Which feature lets the launch wait until bootstrap succeeds?
A longer health check grace period with no other changes
A launch lifecycle hook completed by the bootstrap script
A scheduled scaling action that adds capacity an hour before peak traffic hours
A larger instance type so that bootstrap finishes faster
B
A lifecycle hook holds the instance in a wait state until the script signals completion, and the hook's timeout and default result handle failures. A grace period only delays health checks; it does not stop traffic before bootstrap finishes.
Reliability and Business Continuity
11
Select One
A company must back up EBS volumes, RDS databases, and DynamoDB tables from one central policy and keep a copy of every backup in a second Region. What should the operator use?
Amazon Data Lifecycle Manager policies configured separately for each resource type
S3 Cross-Region Replication on the backup bucket
An AWS Backup plan with a cross-Region copy rule
RDS automated backups with an extended retention period
C
AWS Backup centrally protects supported services and can copy recovery points to a vault in another Region. Data Lifecycle Manager covers EBS only, and S3 replication does not apply to RDS or DynamoDB backups.
Reliability and Business Continuity
10
Select One
A company runs a primary web endpoint and a standby endpoint in another Region. DNS should send traffic to the primary while it is healthy and switch to the standby only if it fails. Which Route 53 configuration fits?
Failover records with a health check on the primary
Weighted routing records with equal weights
Latency-based routing records without health checks
Geolocation routing records that map each continent to one endpoint
A
Failover routing answers with the primary record while its health check passes and switches to the secondary when it fails. Weighted and latency routing spread traffic to both endpoints, and geolocation routes by user location.
Reliability and Business Continuity
9
Select One
Nightly reporting queries overload an Amazon RDS for MySQL primary instance. The reports can tolerate a few seconds of replication lag and can use a different endpoint. What should the operator do?
Route the reports to the standby of the Multi-AZ DB instance deployment
Increase the automated backup retention period
Enable Performance Insights and leave the workload unchanged
Create a read replica and point the reporting tool at its endpoint
D
A read replica serves read traffic through its own endpoint using asynchronous replication, which the reports can tolerate. The standby in a Multi-AZ DB instance deployment does not accept reads, and backups and monitoring do not reduce load.
Reliability and Business Continuity
8
Select One
A web application runs in an Auto Scaling group behind an Application Load Balancer, but all instances are in one Availability Zone. What change best improves tolerance of a zonal outage?
Add a second Auto Scaling group in the same Availability Zone
Use subnets in multiple AZs for the group and load balancer
Move the instances into a cluster placement group
Increase the instance size so that each remaining instance can handle more load
B
Spreading instances and load balancer nodes across zones removes the single-zone dependency. More capacity in the same zone, larger instances, and cluster placement groups all keep everything in one zone.
Reliability and Business Continuity
7
Select One
Security groups that allow SSH from 0.0.0.0/0 must be detected and corrected automatically across an account. Which solution meets this requirement with the least custom code?
A CloudTrail trail that delivers security group API calls to S3
A Trusted Advisor check that emails a report to the security team every week
An AWS Config rule with Automation runbook remediation
An Amazon Inspector scan that runs against every instance
C
A Config rule such as the managed restricted-ssh rule detects the violation, and an associated Automation runbook fixes it automatically. CloudTrail records events, Trusted Advisor only reports, and Inspector scans instance software.
Monitoring Logging Analysis Remediation and Performance Optimization
6
Select One
A 100 GiB gp2 EBS volume is hitting its IOPS limit. The application needs 6,000 IOPS, and the volume must stay at 100 GiB. The instance supports the required EBS performance. What is the most cost-effective change?
Modify the volume to gp3 and provision 6,000 IOPS
Modify the volume to the st1 throughput-optimized HDD volume type
Restore a snapshot into a 2,000 GiB gp2 volume
Enable EBS optimization on a larger instance type
A
gp3 lets IOPS be provisioned independently of size, so a 100 GiB volume can deliver 6,000 IOPS. gp2 provides 3 IOPS per GiB, so it would need 2,000 GiB, and st1 is not designed for random IOPS. gp3 bills IOPS above its 3,000 baseline separately, so the new volume can cost more than the current gp2 volume, but far less than a 2,000 GiB gp2 volume.
Monitoring Logging Analysis Remediation and Performance Optimization
5
Select One
An EC2 instance occasionally becomes unreachable because of an underlying host hardware problem. The operator wants the instance recovered automatically with the same instance ID, private IP address, and EBS volumes. What should the operator configure?
A Route 53 health check that sends an SNS notification
An AWS Health event subscription that notifies an email distribution list
A scheduled Lambda function that reboots the instance every hour
A StatusCheckFailed_System alarm with the recover action
D
The recover action moves the instance to healthy hardware and keeps its instance ID, private IPs, and EBS volumes. Supported instance types may also recover automatically by default. Notifications and scheduled reboots do not fix a host failure.
Monitoring Logging Analysis Remediation and Performance Optimization
4
Select One
An application writes logs to a CloudWatch Logs log group. The operations team must be alerted when more than 50 lines containing "ERROR" appear in any 5-minute period. What should the operator configure?
A subscription filter that streams the log group to Amazon Data Firehose
CloudTrail Insights on the account's management events
A log group metric filter with a CloudWatch alarm
EC2 detailed monitoring on the instances that write to the log group
C
A metric filter turns matching log lines into a CloudWatch metric, and an alarm can then evaluate a sum over 5 minutes. A subscription filter only streams logs, and CloudTrail Insights analyzes API call rates.
Monitoring Logging Analysis Remediation and Performance Optimization
3
Select One
A team runs services on Amazon ECS and Amazon EKS. It needs CPU, memory, and network metrics aggregated at the cluster, service, task, and pod levels, plus related performance logs. Which feature should the operator enable?
CloudWatch Container Insights
AWS X-Ray tracing on each service
VPC Flow Logs on each cluster subnet
CloudTrail Lake event data stores
A
Container Insights collects and aggregates metrics and logs for ECS and EKS at cluster, service, task, and pod levels. X-Ray traces requests, Flow Logs record network traffic, and CloudTrail Lake stores API events.
Monitoring Logging Analysis Remediation and Performance Optimization
2
Select One
An operator needs to alarm on memory utilization for a fleet of Linux EC2 instances, but no memory metric appears in CloudWatch. What should the operator do?
Enable detailed monitoring on each instance
Install and configure the CloudWatch agent
Create a CloudTrail trail that records EC2 data events for the fleet
Enable AWS Compute Optimizer for the account
B
Memory is measured inside the guest operating system, so it requires the CloudWatch agent. Detailed monitoring only increases the frequency of hypervisor-level metrics, and CloudTrail and Compute Optimizer do not publish guest memory.
Monitoring Logging Analysis Remediation and Performance Optimization
1
Select One
DOMAIN Question 01/00

0 of 0 answered

A Course Built Around Your Needs

AWS Certified CloudOps Engineer - Associate

Beginner
Associate
Professional
22.33
Hours
Play icon
Ace AWS Certified CloudOps Engineer – Associate exam with monitoring, reliability, security, cost optimization, and hands-on labs.
Michael Forrester
Details
WHY HANDS-ON PRACTICE

Knowledge, Earned by Doing

The CloudOps Engineer exam rewards operational judgment, not memorized runbooks.

Build Real Exam Speed

The exam gives you 130 minutes for 65 questions, an average of 120 seconds each. Repeated practice trains you to diagnose an issue fast, so you're not re-reading scenarios under time pressure.

Know Your Weak Domains‍

Review every question you missed and spot the topics that need more work. Better to find them here than on exam day.

Realistic Scenario Questions‍

Exam-style questions, that are a mix of monitoring, reliability, and automation scenarios.

Reduce Exam-Day Anxiety‍

Familiarity with multiple-choice format removes surprises, so nerves don't cost you marks.

Reinforce Through Repetition‍

Spaced repetition on frequently tested concepts, like CloudWatch alarms, backups, and Systems Manager, moves them from look it up to just know it.

Benchmark Against a Passing Score‍

Compare your score with AWS's 720/1000 passing threshold and identify topics to review before exam-day.

HEAR FROM OUR LEARNERS

Real Learners. Real Results

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

Alhamdulillah 🙏! Thrilled to announce that I am now officially a Certified Kubernetes Administrator (CKA)! While Kubernetes, cluster orchestration, and container security are already central to my daily DevSecOps work, earning this certification is a great validation of those hands-on skills.Thanks to Mumshad Mannambeth and the KodeKloud team—their course and hands-on labs helped me a lot in preparing for this exam.The learning never stops! 🚀

Read Full Post
Imtiaz Ali
DevOps | SRE | Multi-Cloud | DevSecOps

Freshly certified: Certified Kubernetes Administrator (CKA)! 🚀Passing this hands-on, live-terminal exam was a great challenge. Paired with my AWS Certified DevOps Engineer – Professional, it reinforces my focus on bridging enterprise multi-account cloud governance with production-grade Kubernetes runtime operations.A special shoutout and big thank you to Mumshad Mannambeth, the KodeKloud team, and the Cloud Native Computing Foundation (CNCF) and Kubernetes (Official) community. The Certified Kubernetes Administrator (CKA) course was hands-down the best preparation for the live terminal environment! 🛠️Next stop: continuing to build resilient, developer-first platform foundations!

Read Full Post
Gaurav Dubey
Cloud Architect | Platform Engineer | AWS DevOps Pro | CKA

Cherishing one of my dreams - CKS Certified! ✨Last year, in October, when I cracked my CKA, my colleagues asked, “When is CKS?” 😂And I was like… bro. 😅Because it felt so much bigger. I also knew it wasn’t just Kubernetes anymore, but Kubernetes with a special layer of security - yeah, tightened Kubernetes.Back then, I used to look up to CKS like a child gazing at one of the stars in the sky.⭐Now, fast forward to today - I cleared it last week and officially became a Certified Kubernetes Security Specialist (CKS), thanks to the Cloud Native Computing Foundation (CNCF), The Linux Foundation and my company Aivar Innovations. 🎉That moment felt so special, and I’m incredibly grateful to all my colleagues, friends, and family for all the support. ❤️A mention of the resources I used: KodeKloud by Mumshad Mannambeth and Kim Wüstkamp’s CKS courses. I also had my colleagues supporting me with my doubts and anxieties before the exam. 😂Looking forward to applying everything I’ve learned in my work and continuing to grow in the Cloud Native and Kubernetes space. 🚀So, cheers to everyone who dreams, aspires, and inspires. Keep going and keep up the good work! 🥂And as I always say - God, keep it coming!! ✨

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast

I've successfully passed CKA certification. Shout-out to Mumshad Mannambeth for his great CKA course and labs and to Omkar Shelke Killercoda CKA scenarios. Links: - https://lnkd.in/eZPVHJeR- https://lnkd.in/eEVyZdaZ

Read Full Post
Gabriel Rodríguez
DevSecOps Engineer

🎉 The Kubernetes journey continues… and this time, happy to say I’m officially a Kubestronaut! 🧑🚀🚀🎖️ 1 out of 242 in France and 1 out of 4217 worldwide!⏳✈️ It’s been quite a journey. From my early days working with Kubernetes, thanks to the opportunity Prof. Timur Friedman gave me to contribute to the EdgeNet project, to securing my internship as a DevOps Engineer at Sonos, Inc. — and fast-forward five years, here I am today, a Senior DevOps Engineer at Sonos, Inc. working extensively with Kubernetes everyday.💌 A special thank you to Jose Alfredo Alvarez Aldana for your support, guidance, and for everything you taught me along the way. I was really lucky to have the opportunity to work alongside you early in my journey. 🙏💯 A big thank you to Mumshad Mannambeth for building KodeKloud! The platform has been incredibly helpful throughout this journey, both for learning and preparing for the exams.And of course, shout out to all the people who supported, challenged, and inspired me along the way. ❤️Never give up 💪Keep smiling 😃

Read Full Post
Rima Sidique
DevOps Engineer | AI & DevOps Enthusiast
FAQs

Frequently Asked Questions

Is this practice test free ? 

Yes! This practice test is completely free. You can take it as many times as you like to practice and assess your knowledge.

Do I need to install anything ? 

No. You don’t need to install anything. The practice test is completely browser-based, so you can start practicing directly online. 

What if I'm new to this domain?

That's completely fine , mock tests aren't just for the final week before your exam. Taking one early gives you a baseline: you'll see which topics you already grasp, which ones you've never encountered, and how the real exam frames its questions. Every attempt comes with detailed explanations for each answer, so even the questions you get wrong become a study guide. We'd suggest starting with one full mock test, reviewing the explanations carefully, then working through the linked learning material before attempting the next one. 

How closely does this mock test match the real exam?

The question style and pattern closely mirror the real certification exam, the way scenarios are framed, the answer options, and the level of reasoning required are all modelled on it. The main difference is length: this mock has 25 sample questions, while the actual exam typically presents 50-60 questions of this type. So treat this as a representative sample rather than a full-length simulation. The style will feel familiar on exam day; the stamina and time pressure of a longer paper is something you'll want to prepare for separately.