SAP-C02 Flashcards — Free AWS Certified Solutions Architect Professional SAP-C02 Study Cards

Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.

Blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Use target tracking scaling with a schedule to increase minimum capacity during business hours.

Combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Amazon Aurora Global Database

Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.

It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

AWS Cloud Map

AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.

AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Use the AWS CloudTrail setup provided by Control Tower, which automatically enables a trail for all accounts in the organization.

AWS Control Tower provides an integrated CloudTrail setup that automatically creates and manages a central trail for all accounts in the organization. This trail is deployed using AWS CloudFormation StackSets and delivers logs to a centralized S3 bucket, ensuring compliance without manual intervention or custom automation. This is the best approach because it is native, fully managed, and aligns with Control Tower's governance model.

Close the AWS account from the management account.

To remove a member account that was created within AWS Organizations, the management account must first close the account. This is a prerequisite because accounts created via Organizations cannot be removed directly; only invited accounts can be removed without closing. Closing the account suspends it; after closure, the management account can then remove it from the organization. The account remains closed and is not converted into an active standalone account.

Deploy AD in two Regions, attach both VPCs to the transit gateway, and enable cross-Region transit gateway peering. Use route tables to direct AD traffic through the inspection VPC.

It uses cross-Region transit gateway peering, which allows VPCs in different Regions to communicate through their respective transit gateways. By attaching both VPCs to their local transit gateways and peering those gateways, you can configure route tables to force AD traffic through the inspection VPC in one Region, satisfying the firewall inspection requirement. Option D is incorrect because you cannot attach a VPC in a secondary Region to a transit gateway in the primary Region; transit gateway attachments are regional.

AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server

AWS Application Migration Service (MGN) enables lift-and-shift migration of the on-premises server to Amazon EC2 with minimal changes, while AWS DMS can migrate the Microsoft SQL Server database to Amazon RDS for SQL Server, a fully managed service that reduces operational overhead. This combination meets the requirement of minimal application changes and leverages AWS managed services for the database.

AWS App2Container (A2C)

AWS App2Container (A2C) is specifically designed to containerize existing .NET Framework applications running on Windows Server with minimal code changes. It analyzes the application, generates Docker images, and produces CloudFormation templates for deployment on Amazon ECS or EKS, directly meeting the requirement to modernize a .NET Framework 4.7 application to a containerized architecture without significant refactoring.

Increase the instance class of the DMS replication instance

AWS DMS replication instances have finite memory allocated to cache changes during ongoing replication (CDC). When the volume of cached changes exceeds the instance's memory, DMS fails with an insufficient memory error. Increasing the instance class of the DMS replication instance (Option B) provides more memory to handle the cache, resolving the error without disrupting the migration.

Configure a predictive scaling policy using historical traffic patterns.

Predictive scaling uses historical traffic patterns to forecast future demand and proactively adjust capacity before traffic spikes occur, which directly addresses the requirement to anticipate changes. This approach reduces latency by ensuring sufficient resources are available ahead of time, unlike reactive policies that only respond after utilization increases.

Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.

Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Define an IAM task role with S3 access policies and reference it in the ECS task definition.

An IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Implement reportBatchItemFailures in the Lambda function and enable partial batch response for the SQS event source mapping.

Implementing reportBatchItemFailures in the Lambda function and enabling partial batch response for the SQS event source mapping allows the function to signal which specific messages within a batch failed. This prevents the entire batch from being retried or sent to the DLQ, and only the failed messages are retried individually, improving resilience and efficiency.