AWS Certified Solutions Architect Professional SAP-C02 practice test

Read the full NAT/PAT explanation →

Match each AWS compute service to its use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Serverless compute for event-driven applications

Run Docker containers without managing servers

Managed Kubernetes for container orchestration

Serverless compute for containers

Virtual servers for full control over the environment

Question 2mediummultiple choice

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

Trap 1: Amazon ECS Service Discovery

ECS Service Discovery is built on AWS Cloud Map; Cloud Map is the recommended service for this use case.

Trap 2: Application Load Balancer (ALB)

ALB distributes traffic but does not provide service discovery for multiple service types.

Trap 3: Amazon Route 53 private hosted zones

Route 53 private hosted zones provide DNS resolution but not automatic service registration or health-based deregistration.

A
Amazon ECS Service Discovery
Why wrong: ECS Service Discovery is built on AWS Cloud Map; Cloud Map is the recommended service for this use case.
B
Application Load Balancer (ALB)
Why wrong: ALB distributes traffic but does not provide service discovery for multiple service types.
C
AWS Cloud Map
Cloud Map is a service discovery service that allows resources to register and discover each other, with health checks.
D
Amazon Route 53 private hosted zones
Why wrong: Route 53 private hosted zones provide DNS resolution but not automatic service registration or health-based deregistration.

Question 3mediummultiple choice

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Trap 1: Convert the logs to Parquet format using AWS Glue and store them in…

Parquet is good but partitioning is more impactful for recent data.

Trap 2: Use S3 lifecycle policies to transition logs to S3 Glacier after 7…

Glacier is not directly queryable by Athena.

Trap 3: Use Athena with federated query to scan logs directly from the…

Cross-account queries add complexity and latency.

A
Convert the logs to Parquet format using AWS Glue and store them in the same bucket.
Why wrong: Parquet is good but partitioning is more impactful for recent data.
B
Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.
Why wrong: Glacier is not directly queryable by Athena.
C
Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.
Correct: Partitioning reduces data scanned.
D
Use Athena with federated query to scan logs directly from the application accounts.
Why wrong: Cross-account queries add complexity and latency.

Question 4mediummulti select

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Trap 1: Use AWS CloudTrail to monitor IAM role creation and alert when…

This is detective, not preventive.

Trap 2: Use AWS IAM Roles Anywhere to manage temporary credentials for…

This is for external workloads, not least privilege.

Trap 3: Enable AWS Resource Access Manager to share resources only with…

RAM is for resource sharing, not IAM roles.

A
Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.
SCPs enforce preventive controls at the organization level.
B
Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.
Why wrong: This is detective, not preventive.
C
Enable IAM Access Analyzer to review and identify IAM roles that grant permissions to external principals or have unused permissions.
Access Analyzer helps identify overly permissive roles.
D
Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.
Why wrong: This is for external workloads, not least privilege.
E
Enable AWS Resource Access Manager to share resources only with trusted accounts.
Why wrong: RAM is for resource sharing, not IAM roles.

Review the full routing breakdown →

Question 5mediummultiple choice

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Trap 1: Use AWS PrivateLink to connect each VPC to the security VPC via…

PrivateLink is for services, not for routing all traffic.

Trap 2: Set up AWS Direct Connect gateway and route all traffic through the…

Direct Connect is for on-premises, not inter-VPC.

Trap 3: Create VPC peering connections between each VPC and the security…

Complex and scalable poorly.

A
Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.
Why wrong: PrivateLink is for services, not for routing all traffic.
B
Set up AWS Direct Connect gateway and route all traffic through the security account.
Why wrong: Direct Connect is for on-premises, not inter-VPC.
C
Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.
Why wrong: Complex and scalable poorly.
D
Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.
Correct: Centrally managed and scales well.

Question 6mediummulti select

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Trap 1: The management account must have an AWS Organizations SCP that…

SCPs are not required for StackSets; the necessary permissions are handled by IAM.

Trap 2: Each member account must have a self-managed IAM role named…

Self-managed roles are not required; StackSets can use service-managed permissions with automatic role creation.

A
The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.
This is the admin role that assumes the execution role in member accounts.
B
The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.
Why wrong: SCPs are not required for StackSets; the necessary permissions are handled by IAM.
C
The execution role in member accounts must have permissions to create the resources defined in the CloudFormation template (e.g., VPC, subnets).
The execution role needs permissions to actually create the resources.
D
Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.
Why wrong: Self-managed roles are not required; StackSets can use service-managed permissions with automatic role creation.
E
The management account must have permission to assume the execution role in member accounts (via IAM trust policy).
The admin role must be trusted by the execution role.