Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 676–750

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 9

Page 10 of 23

Page 11
676
MCQhard

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

A.Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function
B.Enable DynamoDB Accelerator (DAX) for the Lambda function
C.Provisioned Concurrency on the Lambda function
D.Increase the SQS queue visibility timeout and retention period
AnswerA

Reserved concurrency prevents throttling, and SQS acts as a buffer.

Why this answer

Using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Exam trap

The trap here is that candidates confuse Provisioned Concurrency (which reduces cold starts) with reserved concurrency (which guarantees processing capacity), and overlook that SQS alone cannot prevent message loss if Lambda is throttled.

How to eliminate wrong answers

Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that improves read performance, but it does not prevent message loss or handle Lambda throttling. Option C is wrong because Provisioned Concurrency keeps a set number of Lambda instances warm to reduce cold starts, but it does not protect against throttling during extreme spikes; reserved concurrency is needed to guarantee capacity. Option D is wrong because increasing the SQS queue visibility timeout and retention period only delays message reprocessing and extends storage time, but does not address the root cause of message loss due to Lambda throttling.

Full explanation →
677
MCQhard

A company is migrating a large-scale, stateful application to AWS. The application maintains session state in memory on the current on-premises servers. The company needs a solution that preserves session state during migration and minimizes latency for users worldwide. Which strategy should the company use?

A.Use AWS Global Accelerator to gradually shift traffic, and use Amazon ElastiCache for Redis to centralize session state
B.Use Amazon Route 53 weighted routing to shift traffic to new EC2 instances, and store session state in Amazon S3
C.Use AWS CloudFront to cache static content, and use Amazon DynamoDB for session state
D.Use AWS Global Accelerator to shift traffic, and deploy AWS WAF to protect the application
AnswerA

Global Accelerator provides anycast IP and traffic shifting; ElastiCache provides low-latency state sharing.

Why this answer

AWS Global Accelerator allows you to gradually shift traffic from on-premises to AWS using endpoint weights, minimizing disruption during migration. Amazon ElastiCache for Redis provides a centralized, in-memory session store that preserves session state across the migration, ensuring low-latency access for users worldwide by leveraging Global Accelerator's anycast IP and AWS edge locations.

Exam trap

The trap here is that candidates often confuse Route 53 weighted routing with Global Accelerator's traffic-shifting capabilities, overlooking that Global Accelerator provides both performance optimization and gradual traffic migration, while Route 53 alone lacks the anycast edge network and fine-grained endpoint weight management needed for low-latency stateful migration.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is not designed for low-latency session state storage; its eventual consistency and higher latency make it unsuitable for real-time session management, and Route 53 weighted routing lacks the traffic-shifting granularity and performance optimization of Global Accelerator. Option C is wrong because CloudFront caching static content does not address session state preservation; DynamoDB can store session state but introduces higher latency compared to in-memory solutions like ElastiCache for Redis, and CloudFront does not provide traffic shifting for migration. Option D is wrong because AWS WAF is a web application firewall that protects against web exploits, not a mechanism for preserving session state or shifting traffic; Global Accelerator alone without a centralized session store does not solve the stateful migration requirement.

Full explanation →
678
MCQeasy

A company needs to provide temporary, limited-privilege credentials to mobile app users to access AWS resources. Which AWS service should the architect recommend?

A.Create IAM users for each mobile user and distribute access keys.
B.Use AWS Security Token Service (STS) directly from the mobile app.
C.Create an IAM role and have the mobile app assume it directly.
D.Use Amazon Cognito with an identity pool to issue temporary credentials.
AnswerD

Cognito Identity Pools are designed for this purpose.

Why this answer

Amazon Cognito identity pools are designed to provide temporary, limited-privilege AWS credentials to mobile app users. The service authenticates users through a public identity provider (e.g., Amazon, Facebook, Google, or a custom OIDC provider) and then exchanges the resulting identity token for temporary AWS credentials via the AWS Security Token Service (STS). This approach avoids embedding long-term credentials in the mobile app and enforces least-privilege access through IAM roles associated with the identity pool.

Exam trap

The trap here is that candidates confuse the ability to call STS directly with the need for pre-existing credentials; STS cannot issue temporary credentials without first authenticating the caller, so a mobile app without embedded credentials must use a service like Cognito to broker the token exchange.

How to eliminate wrong answers

Option A is wrong because creating IAM users for each mobile user and distributing access keys is not scalable, introduces long-term static credentials that are insecure when stored on mobile devices, and violates the principle of least privilege for temporary access. Option B is wrong because using AWS Security Token Service (STS) directly from the mobile app would require the app to have long-term AWS credentials (access key and secret key) to call STS, which defeats the purpose of temporary credentials and creates a security risk. Option C is wrong because having the mobile app assume an IAM role directly is not possible without first obtaining temporary credentials; the AssumeRole API call itself requires valid AWS credentials (either long-term or temporary) to invoke, so a mobile app without pre-provisioned credentials cannot assume a role directly.

Full explanation →
679
MCQeasy

A company is designing a new application that will store sensitive user data in an Amazon RDS for PostgreSQL database. The data must be encrypted at rest and in transit. The company also requires automated backups with a retention period of 35 days. What is the MOST secure and cost-effective configuration?

A.Enable RDS encryption at rest using AWS KMS, and use client-side encryption for data in transit.
B.Use an AWS KMS key to encrypt the RDS instance, and configure the DB instance to use SSL/TLS for connections.
C.Store the data in Amazon S3 with server-side encryption, and use an RDS database for metadata only.
D.Enable encryption at rest for the RDS instance, and enforce SSL/TLS connections by setting the rds.force_ssl parameter to 1.
AnswerD

RDS encryption at rest is enabled with a single checkbox; SSL/TLS is enforced via parameter group. Automated backups are enabled by default with 35-day retention.

Why this answer

It uses AWS KMS to encrypt the RDS for PostgreSQL instance at rest and enforces encryption in transit by setting the `rds.force_ssl` parameter to 1, which requires all connections to use SSL/TLS. This satisfies both encryption requirements while leveraging RDS automated backups (retention up to 35 days) at no additional cost beyond standard backup storage, making it the most secure and cost-effective configuration.

Exam trap

The trap here is that candidates often assume simply enabling SSL/TLS on the RDS instance (Option B) is sufficient for in-transit encryption, but they overlook the need to enforce it via the `rds.force_ssl` parameter to prevent unencrypted connections from being accepted.

How to eliminate wrong answers

Option A is wrong because client-side encryption for data in transit is not a standard RDS feature and would require custom application logic, adding complexity and potential security gaps; RDS natively supports SSL/TLS for in-transit encryption, which is simpler and more reliable. Option B is wrong because while it correctly uses AWS KMS for encryption at rest and SSL/TLS for connections, it does not enforce SSL/TLS—without setting `rds.force_ssl=1`, clients can still connect without encryption, leaving data in transit vulnerable. Option C is wrong because storing sensitive user data in Amazon S3 with server-side encryption does not meet the requirement for an RDS for PostgreSQL database; using RDS only for metadata violates the stated need to store sensitive user data in the database itself, and S3 lacks the relational query capabilities required by the application.

Full explanation →
680
Multi-Selecthard

A company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional timeouts during peak hours. After reviewing AWS X-Ray traces, the team finds that DynamoDB queries are slow. Which THREE actions should the team take to improve performance and continuously optimize the solution?

Select 3 answers
A.Optimize DynamoDB queries by using global secondary indexes and reducing the number of separate queries.
B.Configure DynamoDB auto scaling to adjust read and write capacity based on demand.
C.Use Amazon ElastiCache for Redis to cache DynamoDB query results.
D.Implement Lambda function warmers to keep containers initialized and reduce cold starts.
E.Enable Amazon DynamoDB Accelerator (DAX) for read-heavy workloads.
AnswersA, B, E

Optimize DynamoDB queries by using global secondary indexes and reducing the number of separate queries. This reduces query latency and the number of round trips.

Why this answer

To improve performance and optimize the serverless application, the team should take the following actions: Optimize DynamoDB queries by using global secondary indexes and reducing the number of separate queries (Option A). This reduces query latency and the number of round trips. Configure DynamoDB auto scaling (Option B) to adjust read and write capacity based on demand, ensuring sufficient throughput during peak hours without over-provisioning.

Enable Amazon DynamoDB Accelerator (DAX) for read-heavy workloads (Option E) to provide in-memory caching for DynamoDB, significantly reducing read latency. Using Amazon ElastiCache for Redis (Option C) is an external caching solution that adds operational complexity and is not directly optimized for DynamoDB integration; DAX is the recommended DynamoDB caching service. Implementing Lambda function warmers (Option D) addresses cold starts but does not improve DynamoDB query performance.

Full explanation →
681
MCQhard

A multinational corporation is migrating to AWS and needs to manage permissions across multiple accounts using AWS IAM Identity Center (successor to AWS SSO). The company has a central identity source in Microsoft Active Directory. They need to grant different levels of access to users based on their job function. Which combination of AWS services will provide the most scalable and maintainable solution?

A.Create a permission set in IAM Identity Center for each job function and assign to appropriate groups.
B.Use AWS Organizations to attach SCPs that grant permissions based on user tags.
C.Use attribute-based access control (ABAC) with IAM Identity Center and session tags from Active Directory.
D.Use IAM roles directly in each account and manage trust policies centrally.
AnswerC

ABAC with session tags allows permissions to be based on user attributes, simplifying management.

Why this answer

It uses attribute-based access control (ABAC) with IAM Identity Center, which allows permissions to be dynamically granted based on user attributes (e.g., job function) passed as session tags from Active Directory. This approach scales seamlessly as users and accounts grow, since policies reference tags rather than individual users or groups, and it centralizes identity management without requiring per-account role updates.

Exam trap

The trap here is that candidates often choose Option A (permission sets per job function) because it seems straightforward, but they overlook the scalability and maintenance benefits of ABAC, which AWS explicitly recommends for large, dynamic environments with a central identity source.

How to eliminate wrong answers

Option A is wrong because creating a permission set per job function and assigning to groups still requires manual updates when job functions change or new accounts are added, leading to maintenance overhead and reduced scalability. Option B is wrong because AWS Organizations SCPs cannot grant permissions based on user tags; SCPs only provide coarse-grained guardrails (allow/deny) at the account level and cannot evaluate user-specific attributes like tags from Active Directory. Option D is wrong because managing IAM roles directly in each account with centralized trust policies becomes unmanageable as the number of accounts grows, requiring cross-account trust updates and increasing the risk of misconfiguration.

Full explanation →
682
MCQhard

A company has a multi-account AWS environment with a shared services account that hosts Active Directory for authentication. Developers need to launch EC2 instances in development accounts and join them to the domain. What is the most secure way to allow this?

A.Establish VPC peering between the shared services VPC and each developer VPC
B.Create a shared secret for the domain and store it in AWS Secrets Manager in each developer account
C.Use AWS Systems Manager to automate domain join with a custom document
D.Use AWS Managed Microsoft AD in the shared services account and set up a trust relationship with each developer account
AnswerD

Trust relationships allow domain join across accounts securely.

Why this answer

AWS Managed Microsoft AD in the shared services account can establish a one-way or two-way forest trust with a separate AWS Managed Microsoft AD directory in each developer account. This allows EC2 instances in the developer VPCs to authenticate against the shared Active Directory without exposing the directory directly across accounts, maintaining security boundaries while enabling seamless domain join.

Exam trap

The trap here is that candidates often assume VPC peering (Option A) is sufficient for cross-account domain join, but they overlook the need for a trust relationship between Active Directory domains and the complexities of DNS resolution across accounts.

How to eliminate wrong answers

Option A is wrong because VPC peering alone does not enable domain join; it only provides network connectivity between VPCs. The developer EC2 instances would still need to resolve and reach the Active Directory domain controller, and without proper DNS resolution and security group rules, domain join would fail. Option B is wrong because storing a shared secret (e.g., domain admin password) in Secrets Manager in each developer account violates the principle of least privilege and creates a security risk; it also does not automate the domain join process or handle the necessary DNS and network configuration.

Option C is wrong because AWS Systems Manager can automate domain join using a custom document, but it still requires the EC2 instances to have network access to the Active Directory domain controller and proper DNS resolution; it does not solve the cross-account authentication and trust challenge.

Full explanation →
683
MCQmedium

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

A.Amazon Kinesis Data Firehose
B.Amazon Kinesis Data Streams
C.Amazon Kinesis Data Analytics
D.Amazon EMR
AnswerC

Kinesis Data Analytics processes streaming data in real time.

Why this answer

Amazon Kinesis Data Analytics is the most appropriate service for real-time stream processing because it allows you to process streaming data in real time using SQL or Apache Flink. Option A (Amazon Kinesis Data Firehose) is designed for loading streaming data into data stores like S3, not for real-time processing. Option B (Amazon Kinesis Data Streams) is a data ingestion service that captures and stores data streams, but does not provide built-in processing capabilities.

Option D (Amazon EMR) is primarily used for batch processing of large data sets using frameworks like Hadoop and Spark, and is not optimized for real-time stream processing.

Full explanation →
684
MCQmedium

A company has a central IT team that manages AWS Organizations. The development team needs to create and manage their own AWS accounts for new projects. What is the BEST way to automate account creation while maintaining governance?

A.Create an AWS Service Catalog product that uses AWS Organizations APIs to create a new account, applies a baseline CloudFormation template, and moves the account to the correct OU.
B.Use AWS CloudFormation StackSets to create accounts in bulk.
C.Use the AWS Organizations console to manually create accounts and assign them to the appropriate OU.
D.Give the development team the credentials to the management account and let them create accounts directly.
AnswerA

Service Catalog provides a self-service portal for end users with governance controls.

Why this answer

It uses AWS Service Catalog to provide a self-service portal for the development team, while the central IT team retains governance by embedding AWS Organizations API calls to create accounts, apply a baseline CloudFormation template for security and compliance, and automatically move the account to the correct Organizational Unit (OU). This approach enforces guardrails without granting direct management account access.

Exam trap

The trap here is that candidates often confuse CloudFormation StackSets with account creation, but StackSets only operate on existing accounts, not create new ones.

How to eliminate wrong answers

Option B is wrong because AWS CloudFormation StackSets deploy resources across existing accounts and regions; they cannot create new AWS accounts. Option C is wrong because manual creation via the AWS Organizations console is not automated and does not scale for new projects, violating the requirement for automation. Option D is wrong because giving development team credentials to the management account violates the principle of least privilege and central governance, exposing the organization to security risks and accidental changes.

Full explanation →
685
MCQhard

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

A.The Lambda@Edge function is not triggered for viewer request events.
B.The CloudFront behavior for older videos does not include the Lambda function association.
C.The S3 bucket policy denies access to the Lambda function.
D.The videos are cached in CloudFront and the function runs only on cache misses.
AnswerB

If the distribution has multiple behaviors (e.g., based on path pattern), the function may only be associated with the behavior for newer videos.

Why this answer

Lambda@Edge functions are associated with specific CloudFront behaviors. If the function is only associated with certain behaviors (e.g., based on path pattern or cache behavior), older videos served under a different behavior that does not include the Lambda function association will not have the copyright headers added. Option B correctly identifies this as the most likely reason.

Option A is incorrect because the function could be triggered for viewer request events but still not apply to all videos if not associated with all behaviors. Option C is irrelevant because S3 bucket policies do not affect Lambda@Edge execution. Option D is incorrect because the function runs on every request regardless of cache hit/miss; caching does not prevent the function from executing.

Full explanation →
686
MCQhard

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

A.Create a VPN connection between each VPC and the on-premises AD, then use DNS forwarders.
B.Use Amazon Route 53 private hosted zones and associate them with all VPCs.
C.Deploy the directory in each VPC and use AWS Managed Microsoft AD multi-region replication.
D.Deploy the directory in a shared services VPC in the management account. Use AWS Transit Gateway to connect all VPCs and configure the directory's DNS as a forwarder via Amazon Route 53 Resolver.
AnswerD

Transit Gateway provides scalable connectivity, and Route 53 Resolver can forward DNS to the directory.

Why this answer

It centralizes the AWS Managed Microsoft AD in a shared services VPC, which is the most scalable and secure approach for cross-account and cross-VPC authentication and DNS resolution. AWS Transit Gateway provides a scalable hub-and-spoke network connectivity model, while Amazon Route 53 Resolver outbound endpoints forward DNS queries from all connected VPCs to the directory's DNS servers, ensuring consistent name resolution without exposing the directory to the internet or requiring per-VPC deployments.

Exam trap

The trap here is that candidates often assume Route 53 private hosted zones alone can resolve Active Directory DNS names, but they cannot forward queries to an external DNS server without Route 53 Resolver outbound endpoints, making Option B a common distractor.

How to eliminate wrong answers

Option A is wrong because it requires a VPN connection from each VPC to on-premises AD, which is not scalable for multiple VPCs and does not leverage the AWS Managed Microsoft AD service; it also introduces unnecessary latency and management overhead. Option B is wrong because Route 53 private hosted zones are used for custom domain name resolution, not for forwarding DNS queries to an Active Directory DNS server; they cannot resolve DNS names from the directory unless the directory's DNS is integrated via Route 53 Resolver. Option C is wrong because deploying the directory in each VPC is not scalable and incurs high cost and administrative burden; AWS Managed Microsoft AD multi-region replication is for multi-region scenarios, not for multiple VPCs in the same region, and it does not address cross-account DNS resolution.

Full explanation →
687
Multi-Selecthard

A company is migrating a legacy application to AWS. The application runs on Windows Server and uses a shared file system for storage. The company wants to modernize the application by using a managed file storage service that is POSIX-compliant and can be accessed by multiple EC2 instances concurrently. Which TWO AWS services meet these requirements? (Choose TWO.)

Select 2 answers
A.Amazon EBS
B.Amazon FSx for Lustre
C.Amazon S3
D.Amazon S3 Glacier
E.Amazon EFS
AnswersB, E

FSx for Lustre is POSIX-compliant and supports concurrent access.

Why this answer

Amazon EFS (Option E) and Amazon FSx for Lustre (Option B) are both POSIX-compliant file systems that can be accessed concurrently by multiple EC2 instances. Option A (Amazon EBS) is block storage that can be attached to only one instance at a time (unless using multi-attach, which has limitations). Option C (Amazon S3) is object storage, not POSIX-compliant.

Option D (Amazon S3 Glacier) is archival storage and not suitable for shared file system access.

Full explanation →
688
MCQhard

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

A.Use Route 53 failover routing instead of latency-based routing.
B.Configure Route 53 latency-based routing without health checks.
C.Use Route 53 weighted routing with weights set to 50 for each region.
D.Configure Route 53 latency-based routing with health checks attached to each ALB endpoint.
AnswerD

Health checks allow Route 53 to automatically route traffic away from unhealthy endpoints.

Why this answer

Route 53 latency-based routing with health checks ensures that traffic is directed to the region with the lowest latency, and if an ALB endpoint fails its health check, Route 53 automatically removes it from DNS responses, routing traffic to the healthy region. This provides the required active-active multi-region failover with minimal disruption.

Exam trap

The trap here is that candidates often assume failover routing is the only way to handle regional failures, but for active-active architectures, latency-based routing with health checks provides automatic failover while maintaining low-latency routing to both regions.

How to eliminate wrong answers

Option A is wrong because failover routing is designed for active-passive setups, not active-active; it would route all traffic to a primary region and only fail over to a secondary region when the primary fails, which does not meet the requirement for both regions to be active simultaneously. Option B is wrong because latency-based routing without health checks cannot detect regional failures; if an ALB becomes unavailable, Route 53 would continue to return its IP, causing connection failures for clients. Option C is wrong because weighted routing with equal weights distributes traffic based on weight ratios, not latency, and without health checks it cannot automatically fail over if a region becomes unavailable.

Full explanation →
689
MCQmedium

A company is migrating its application stack from on-premises to AWS using a rehost strategy. The stack includes a web server, an application server, and a MySQL database. The company wants to automate the migration using AWS Application Migration Service (MGN). After configuring MGN, the web server test instance fails to start because the boot volume is missing the boot sector. What is the most likely cause?

A.The EBS volume size is smaller than the source volume.
B.The source volume was not shut down cleanly before replication.
C.The source web server uses an unsupported instance type.
D.The source OS is not supported by MGN.
AnswerB

Dirty shutdown can corrupt boot sector.

Why this answer

If the source volume is not shut down cleanly before replication, the replicated volume may be in an inconsistent state, leading to a missing boot sector. AWS Application Migration Service requires consistent volumes to ensure successful boot. Option A is incorrect because the EBS volume size does not affect the boot sector; a smaller volume would likely cause a different error.

Option C is incorrect because the instance type does not impact the boot sector; MGN supports various instance types. Option D is incorrect because an unsupported OS would typically result in an incompatibility error, not a missing boot sector.

Full explanation →
690
MCQeasy

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

A.Use Amazon ElastiCache for Memcached as the primary database.
B.Deploy Amazon RDS in a Multi-AZ configuration without read replicas.
C.Deploy Amazon RDS in a single Availability Zone with a large instance size.
D.Deploy Amazon RDS in a Multi-AZ configuration and use read replicas to offload read traffic.
AnswerD

Multi-AZ provides failover, and read replicas improve read performance.

Why this answer

It combines Multi-AZ deployment for high availability with read replicas to offload read traffic, addressing both the read-heavy workload and sudden traffic spikes. Multi-AZ ensures automatic failover to a standby instance in a different Availability Zone if the primary fails, while read replicas distribute read queries across multiple copies, reducing load on the primary database and improving performance under spike conditions.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming Multi-AZ alone provides read scaling, but Multi-AZ only provides failover redundancy—the standby instance cannot serve reads, so read replicas are required to offload read traffic.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Memcached is an in-memory caching layer, not a relational database; it cannot serve as the primary database for a web application requiring persistent, relational storage with ACID transactions. Option B is wrong because Multi-AZ without read replicas provides high availability but does not offload read traffic, so the single primary instance becomes a bottleneck under sudden read spikes, leading to performance degradation. Option C is wrong because deploying in a single Availability Zone with a large instance size lacks high availability—if the AZ fails, the database becomes unavailable—and scaling vertically with a larger instance does not efficiently handle sudden read spikes compared to horizontal scaling with read replicas.

Full explanation →
691
Multi-Selecthard

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Select 2 answers
A.Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.
B.Enable S3 Block Public Access at the account level.
C.Configure AWS Network Firewall in the central security account to inspect traffic to the S3 endpoints and allow only encrypted traffic.
D.Use AWS Certificate Manager to issue certificates for S3 bucket access.
E.Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.
AnswersA, C

Correct: Restricts access to specific endpoints.

Why this answer

The `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to traffic originating from specific VPC endpoints (interface or gateway endpoints). This ensures that only requests coming through approved VPC endpoints can access the data lake, directly enforcing the mandate that access must originate from approved VPCs.

Exam trap

The trap here is that candidates often confuse `aws:SourceVpc` with `aws:SourceVpce`, not realizing that `aws:SourceVpc` does not work when traffic goes through a VPC endpoint, and they may overlook the need for a separate encryption-in-transit control like Network Firewall because S3 supports HTTPS by default but does not enforce it without a bucket policy or inspection.

Full explanation →
692
MCQhard

A company is designing a new multi-region disaster recovery solution for a critical database. The database runs on Amazon RDS for MySQL in us-east-1. The recovery point objective (RPO) is 1 second, and the recovery time objective (RTO) is 1 minute. Which strategy meets these requirements?

A.Single-AZ RDS instance with cross-Region snapshot copy
B.Multi-AZ RDS instance in us-east-1
C.Multi-AZ RDS instance with a cross-Region read replica in us-west-2
D.Amazon Aurora Global Database
AnswerC

Synchronous replication within region, asynchronous to replica, fast failover.

Why this answer

A Multi-AZ RDS instance with a cross-Region read replica in us-west-2 can achieve an RPO of 1 second and an RTO of 1 minute. The cross-Region read replica uses asynchronous replication with a typical lag of less than 1 second, meeting the RPO. For RTO, you can promote the read replica to a standalone instance in under a minute, and the Multi-AZ configuration in the primary region ensures high availability during the promotion process.

Exam trap

The trap here is that candidates often assume Amazon Aurora Global Database is the best choice for low RPO/RTO, but for RDS for MySQL, the cross-Region read replica is the correct service, and Aurora Global Database has a slightly higher RTO due to the failover process, making it unsuitable for a 1-minute RTO.

How to eliminate wrong answers

Option A is wrong because cross-Region snapshot copies are asynchronous and typically have an RPO of minutes to hours, far exceeding the 1-second requirement, and restoring from a snapshot takes minutes to hours, failing the 1-minute RTO. Option B is wrong because a Multi-AZ RDS instance in us-east-1 only provides high availability within a single region, not cross-Region disaster recovery, so it cannot meet the multi-region requirement. Option D is wrong because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of less than 1 second, but its RTO for a failover is often 1-2 minutes or more, which does not meet the strict 1-minute RTO; additionally, the question specifies RDS for MySQL, not Aurora, so this option is not applicable.

Full explanation →
693
MCQmedium

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

A.Enable Multi-AZ deployment with a DB cluster.
B.Use automated backups with 5-minute retention.
C.Take manual snapshots every 5 minutes and copy to another region.
D.Create a cross-region read replica in us-west-2.
AnswerA

Synchronous replication and automatic failover meet RTO/RPO.

Why this answer

A Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides high availability within a region) with cross-region replication (which is asynchronous and cannot meet tight RPO/RPO), or they assume automated backups or snapshots can achieve sub-15-minute RTO, ignoring the restore time overhead.

How to eliminate wrong answers

Option B is wrong because automated backups with 5-minute retention only provide point-in-time recovery within the retention period, but the RTO for restoring from a backup is significantly longer than 15 minutes (often 30+ minutes for a large database), and the RPO is limited to the backup interval, not the 5-minute requirement. Option C is wrong because manual snapshots taken every 5 minutes cannot be copied to another region quickly enough to meet the 15-minute RTO; snapshot copy times are unpredictable and often exceed 15 minutes, and the RPO would be compromised by the copy delay. Option D is wrong because a cross-region read replica in us-west-2 is asynchronous, meaning replication lag can exceed 5 minutes, and promoting a read replica to a primary instance typically takes several minutes, failing the 15-minute RTO; additionally, cross-region failover introduces latency and potential data loss beyond the 5-minute RPO.

Full explanation →
694
MCQhard

A company uses a cross-account IAM role 'LogDelivery' in account 111122223333 to write logs to an S3 bucket 'my-company-logs' in a logging account. The bucket policy is shown above. Logs are not being delivered. What is the MOST likely issue?

A.The bucket policy lacks s3:GetObject permission.
B.The bucket policy restricts access to a specific account only.
C.The IAM role is not trusted by the bucket policy.
D.The bucket policy has an explicit deny that overrides the allow.
AnswerB

The resource pattern includes account 111122223333, so logs from other accounts would be denied.

Why this answer

The bucket policy restricts access to a specific AWS account (e.g., `"AWS": "111122223333"`), which only grants access to the account's root user, not to IAM roles. For the cross-account IAM role 'LogDelivery' to write logs, the bucket policy must explicitly allow the role's ARN or use `"AWS": "arn:aws:iam::111122223333:root"` to include all IAM principals in the account. Since the policy only allows the account root, the role is denied, causing the delivery failure.

Option B is correct because the policy's account-only restriction does not cover the role.

Exam trap

The trap here is that candidates assume the bucket policy's `Principal` element with an account ID automatically grants access to all IAM roles in that account, but in reality, the bucket policy must explicitly list the role ARN or use `"AWS": "arn:aws:iam::111122223333:root"` to allow all principals in the account, and even then, the role must be assumed by a trusted service.

How to eliminate wrong answers

Option A is wrong because `s3:GetObject` is not required for writing logs; the role needs `s3:PutObject` to upload objects, and the bucket policy must grant that action. Option C is wrong because the IAM role does not need to be 'trusted' by the bucket policy; instead, the bucket policy must grant the role (or its account) permission to write, and the role's trust policy must allow the logging service to assume it. Option D is wrong because there is no explicit deny in the bucket policy shown; the issue is a missing allow or a restrictive condition, not an explicit deny override.

Full explanation →
695
MCQhard

A company has a legacy application that runs on an EC2 instance with a large attached EBS volume. The application writes log files to the volume, and the volume is frequently full, causing application errors. The Solutions Architect needs to implement a solution to automatically manage disk space without application changes. Which solution meets these requirements?

A.Configure an S3 Lifecycle policy to transition log files to Amazon S3 Glacier after 30 days.
B.Increase the EBS volume size and enable auto-scaling.
C.Use a script with Amazon Data Lifecycle Manager to snapshot the volume and delete old snapshots.
D.Install the CloudWatch Logs agent and stream logs to CloudWatch Logs, then delete local logs.
AnswerD

The CloudWatch Logs agent can stream logs to CloudWatch Logs and then delete local log files, freeing disk space without application changes. This meets the requirement.

Why this answer

The CloudWatch Logs agent can be installed to stream existing log files to CloudWatch Logs without modifying the application. After streaming, the agent can be configured to delete local log files to free disk space. This directly addresses the requirement to automatically manage disk space without application changes.

Option C is incorrect because Amazon Data Lifecycle Manager (DLM) automates the creation and deletion of EBS snapshots, not the management of disk space within the volume. It does not delete log files or otherwise free in-volume space.

Full explanation →
696
MCQmedium

A company uses AWS CloudFormation to deploy a stack that includes an Amazon RDS MySQL instance. The stack template defines the DBInstanceClass as db.t3.medium. After deployment, the database performance is insufficient for the workload. The company wants to change the instance class to db.r5.large without recreating the database. What should they do?

A.Create a new stack with the new instance class and migrate the data.
B.Use AWS Database Migration Service to perform a blue/green deployment.
C.Delete the stack and create a new one with the new instance class.
D.Update the CloudFormation stack with the new instance class and apply the change.
AnswerD

CloudFormation will modify the DB instance in-place with minimal downtime.

Why this answer

You can update the CloudFormation stack with a new DBInstanceClass value, and CloudFormation will modify the RDS instance to the new class. RDS supports modifying the DB instance class without recreating the database, although a brief downtime may occur. Option A is wrong because creating a new stack and migrating data is unnecessary.

Option B is wrong because AWS DMS is typically used for migrations, not for simple instance class changes; blue/green deployment is not required. Option C is wrong because deleting the stack would destroy the database.

Full explanation →
697
MCQmedium

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

A.The subnet does not have auto-assign public IP enabled.
B.No security group or network ACL allows inbound traffic.
C.The VPC does not have an internet gateway attached.
D.The route table does not have a route to the internet gateway.
AnswerB

Inbound traffic is blocked by default.

Why this answer

The template does not configure a security group or network ACL to allow inbound traffic. The route table and internet gateway are correctly set up for outbound traffic. Option A is wrong because the subnet has MapPublicIpOnLaunch: true.

C is wrong because the route exists. D is wrong because the VPC is not missing an internet gateway.

Full explanation →
698
MCQeasy

Refer to the exhibit. A company configured an Amazon Route 53 alias record for a domain name pointing to an Application Load Balancer (ALB). Users report that occasionally they are directed to an unhealthy ALB node. Which change should the company make to improve availability?

A.Change the record type to CNAME.
B.Configure the ALB health check to mark unhealthy nodes.
C.Use weighted routing policy.
D.Use multi-value answer routing.
AnswerB

Proper health checks ensure unhealthy nodes are not used.

Why this answer

The issue is that the ALB health check is not properly configured to mark unhealthy nodes. Although the Route 53 alias record has EvaluateTargetHealth set to true, Route 53 relies on the ALB's health check status to determine which targets are healthy. If the ALB health check is misconfigured (e.g., incorrect path, interval, or thresholds), it may not correctly report unhealthy nodes, causing Route 53 to occasionally route traffic to unhealthy nodes.

Therefore, configuring the ALB health check to accurately mark unhealthy nodes (option B) is the direct solution. Option A (CNAME) is unsuitable for apex domains and doesn't provide health checking. Option C (weighted routing) distributes traffic proportionally but doesn't address health.

Option D (multi-value answer routing) is for non-alias records and doesn't improve health checking beyond what alias records with EvaluateTargetHealth already offer.

Full explanation →
699
MCQeasy

A company has a centralized IT team that manages AWS accounts for multiple departments. They need to grant the team permissions to create and manage IAM roles in all accounts, but without giving them full administrator access. What should they use?

A.Use AWS Single Sign-On with permission sets.
B.Create an IAM user in each account with AdministratorAccess.
C.Use AWS Organizations with a delegated administrator for IAM.
D.Use cross-account roles with a policy that allows iam:CreateRole.
AnswerC

Delegated administrator can manage IAM across accounts.

Why this answer

AWS Organizations allows you to centrally manage multiple accounts and designate a delegated administrator for IAM. This enables the centralized IT team to create and manage IAM roles across all member accounts without granting full administrator access, as the delegated administrator can perform IAM actions within the scope defined by service control policies (SCPs) and IAM permissions.

Exam trap

The trap here is that candidates often confuse cross-account roles (Option D) as a scalable solution for centralized management, but they require per-account trust policy setup and do not provide a single point of control like a delegated administrator does.

How to eliminate wrong answers

Option A is wrong because AWS Single Sign-On (now AWS IAM Identity Center) manages user access to multiple accounts via permission sets, but it does not grant the ability to create and manage IAM roles across accounts; it is focused on assigning pre-existing permissions to users. Option B is wrong because creating an IAM user with AdministratorAccess in each account grants full administrative privileges, which violates the requirement to avoid giving the team full administrator access. Option D is wrong because cross-account roles with iam:CreateRole only allow role creation in a single target account, not across all accounts, and managing roles across multiple accounts would require setting up individual trust policies and roles for each account, which is not scalable or centralized.

Full explanation →
700
MCQeasy

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

A.Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.
B.AWS Lambda@Edge for both static content and API.
C.Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.
D.Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.
AnswerC

CloudFront provides CDN, API Gateway manages APIs, Lambda runs code serverlessly.

Why this answer

It combines Amazon CloudFront for global low-latency delivery of static content, Amazon API Gateway to create and manage the REST API with built-in caching and throttling, and AWS Lambda for serverless compute. This architecture provides high availability, automatic scaling, and global edge caching, meeting the startup's requirements without managing servers.

Exam trap

The trap here is that candidates may confuse Lambda@Edge as a full compute solution for APIs, overlooking its severe execution limits, or assume that an ALB provides global low latency when it is inherently regional and requires additional services like Global Accelerator for global performance.

How to eliminate wrong answers

Option A is wrong because using an Application Load Balancer (ALB) for the API introduces a regional, not global, endpoint and requires managing EC2 instances or Lambda targets behind it, adding complexity and latency compared to API Gateway's global edge-optimized endpoints. Option B is wrong because Lambda@Edge is designed for lightweight, short-duration operations (e.g., header manipulation, URL rewrites) at CloudFront edge locations, not for running full REST API backends with DynamoDB interactions; it has a 5-second execution timeout and limited memory, making it unsuitable for typical API workloads. Option D is wrong because S3 Transfer Acceleration only speeds up uploads to S3 via optimized network paths, but does not provide a REST API gateway, authentication, or request throttling, and it lacks the global edge caching and API management features needed for a low-latency, globally available API.

Full explanation →
701
MCQmedium

A company runs a production web application on EC2 instances in an Auto Scaling group behind an ALB. The application logs are stored on an EBS volume attached to each instance. The operations team notices that the logs are not being sent to a central location. What is the MOST efficient way to centralize log collection with minimal code changes?

A.Modify the application to use the AWS SDK to send logs to CloudWatch Logs via PutLogEvents API.
B.Use Amazon Kinesis Agent to send logs to Kinesis Data Firehose and then to S3.
C.Set up an S3 bucket with a lifecycle policy to transition logs to Glacier.
D.Install the CloudWatch Logs agent on each EC2 instance and configure it to stream the log files to CloudWatch Logs.
AnswerD

CloudWatch Logs agent streams logs directly from EC2 to CloudWatch without code changes.

Why this answer

Installing the CloudWatch Logs agent on each EC2 instance and configuring it to stream log files to CloudWatch Logs centralizes log collection without requiring any changes to the application code. Option A is incorrect because modifying the application to use the AWS SDK to send logs via PutLogEvents API would require code changes. Option B is incorrect because while Amazon Kinesis Agent could be used to send logs to Kinesis Data Firehose and then to S3, this approach is more complex and not the most efficient for simple log centralization from EC2 instances; the CloudWatch Logs agent is purpose-built for this task.

Option C is incorrect because setting up an S3 bucket with a lifecycle policy to transition logs to Glacier does not collect logs; it only manages log storage after they are already in S3, and logs would need to be sent to S3 first.

Full explanation →
702
MCQmedium

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

A.Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.
B.Deploy the monolith as a single task in ECS and update the task definition with new container versions.
C.Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.
D.Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.
AnswerD

CodeDeploy with ECS supports blue/green deployments for minimal downtime.

Why this answer

A blue/green deployment with ECS minimizes downtime by switching traffic gradually. Option A is wrong because migrating all at once risks downtime. Option B is wrong because launching a separate ECS cluster adds complexity.

Option C is wrong because CodeStar is not a deployment strategy.

Full explanation →
703
MCQhard

A company is migrating a 3-tier web application from on-premises to AWS. The application consists of a Linux Apache HTTP server, a Java application server (Tomcat), and a MySQL database. The company wants to use AWS managed services to reduce operational overhead. The migration plan includes using AWS Elastic Beanstalk for the web and application tiers, and Amazon RDS for MySQL for the database. During a test migration, the team notices that the application is experiencing intermittent connection timeouts when the web tier attempts to connect to the application tier. The web and application tiers are deployed in separate Elastic Beanstalk environments, both in the same VPC, same region, and same Availability Zone. The security groups allow traffic from the web tier to the application tier on port 8080. What is the MOST likely cause of the connection timeouts?

A.The application tier is configured with an internal Application Load Balancer, but the web tier is unable to resolve the DNS name of the load balancer.
B.The web tier and application tier are in different Availability Zones, causing increased latency and timeouts.
C.The web tier is trying to connect directly to the application tier instances, but the application tier's security group does not allow inbound traffic from the web tier's security group.
D.The Elastic Beanstalk environment's health check URL is misconfigured, causing the instances to be marked as unhealthy and removed from the load balancer.
AnswerC

The web tier should connect to the application tier's load balancer, but the security group of the load balancer must allow traffic from the web tier.

Why this answer

The most likely cause is that the web tier is configured to connect directly to the application tier instances rather than to the application tier's load balancer. In Elastic Beanstalk, each environment typically includes an Auto Scaling group and a load balancer. For the web tier to communicate with the application tier, it should connect to the application tier's load balancer DNS name.

If the web tier attempts to connect directly to the application tier instances, the application tier's security group must allow inbound traffic from the web tier's security group. If that rule is missing or misconfigured, connections will time out. Option A is incorrect because DNS resolution for an internal ALB generally works within the same VPC.

Option B is incorrect because both environments are in the same Availability Zone. Option D is incorrect because health check misconfiguration would affect the load balancer's routing, not cause direct connection timeouts between tiers.

Full explanation →
704
MCQeasy

A company is migrating its on-premises file server to Amazon FSx for Windows File Server. The company has 2 TB of data and a 100 Mbps internet connection. The migration must be completed within 5 days. What should the company do?

A.Order a new AWS Direct Connect connection.
B.Use AWS Snowcone to physically ship the data.
C.Use AWS DataSync over the internet to transfer data.
D.Use AWS Snowball Edge to transfer data.
AnswerB

Fast and cost-effective for 2 TB.

Why this answer

Snowcone is designed for small data volumes (up to 8 TB) and can be shipped to AWS within days, meeting the 5-day deadline. Option A is wrong because provisioning a new Direct Connect connection typically takes weeks, which exceeds the 5-day deadline. Option C is wrong because DataSync over the internet with a 100 Mbps connection would take approximately 48 hours or more, and the process may introduce delays or reliability issues; AWS recommends physical devices for smaller datasets under tight timelines.

Option D is wrong because Snowball Edge is intended for larger data volumes (up to 80 TB) and is oversized for 2 TB; Snowcone is a more appropriate and cost-effective choice.

Full explanation →
705
MCQmedium

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

A.Amazon EKS with managed node groups
B.Amazon ECS with Fargate launch type
C.Amazon ECS with EC2 launch type and Auto Scaling groups
D.Amazon Lightsail containers
AnswerB

Fargate is serverless, no infrastructure management.

Why this answer

Amazon ECS with the Fargate launch type is the correct choice because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. This directly meets the requirement to minimize operational overhead while allowing each microservice to scale independently, as Fargate automatically handles the infrastructure and scaling based on the task definitions.

Exam trap

The trap here is that candidates often confuse 'managed node groups' (EKS) with 'serverless' (Fargate), assuming that managed node groups eliminate all operational overhead, when in fact they still require you to manage the EC2 instances, just with some automation for provisioning and updates.

How to eliminate wrong answers

Option A is wrong because Amazon EKS with managed node groups still requires you to manage and pay for the underlying EC2 instances (the node groups), and you are responsible for patching, scaling, and maintaining the worker nodes, which adds operational overhead. Option C is wrong because Amazon ECS with the EC2 launch type and Auto Scaling groups requires you to manage the EC2 instances, including capacity planning, patching, and cluster optimization, which contradicts the goal of minimizing operational overhead. Option D is wrong because Amazon Lightsail containers are designed for simpler, less complex workloads and do not offer the same level of granular scaling, integration with AWS services (e.g., VPC, IAM, CloudWatch), or the ability to handle production-grade microservices architectures with independent scaling requirements.

Full explanation →
706
MCQmedium

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

A.Deploy a second ECS cluster and ALB in the secondary region with no tasks. Use cross-Region replication for ElastiCache. Use Route 53 to fail over after scaling up tasks.
B.Deploy a second ECS cluster and ALB in the secondary region with a scaled-down number of tasks. Use ElastiCache Global Datastore for Redis to replicate session data. Use Route 53 health checks to fail over.
C.Use a multi-region ECS service with Service Connect and Route 53 latency-based routing. Keep equal capacity in both regions.
D.Use pilot light by replicating ECS task definitions and copying AMIs to the secondary region. Use ElastiCache snapshot and restore. Fail over with Route 53.
AnswerB

Correct: Warm standby with Global Datastore meets RPO and RTO.

Why this answer

It uses ElastiCache Global Datastore for Redis, which provides cross-Region replication with sub-minute RPO, meeting the 15-minute RPO requirement. The scaled-down ECS tasks in the secondary region can be quickly scaled up to achieve the 30-minute RTO, and Route 53 health checks enable automated failover. This design minimizes cost by running only minimal capacity in the secondary region until failover occurs.

Exam trap

The trap here is that candidates often assume cross-Region replication for ElastiCache requires manual snapshot/restore or custom replication, but ElastiCache Global Datastore provides managed, low-latency replication that meets strict RPOs, and running zero tasks in the secondary region (Option A) prevents failover from working because the ALB has no healthy targets.

How to eliminate wrong answers

Option A is wrong because deploying a second ECS cluster with no tasks means the ALB in the secondary region has no healthy targets, causing Route 53 health checks to fail and preventing failover; also, cross-Region replication for ElastiCache (using snapshots or manual replication) cannot achieve sub-minute RPO and may exceed the 15-minute RPO. Option C is wrong because multi-region ECS Service Connect does not natively handle cross-Region failover or session data replication, and latency-based routing does not provide health-check-driven failover; keeping equal capacity in both regions is not cost-effective and does not meet the RTO/RPO requirements. Option D is wrong because using ElastiCache snapshot and restore can take longer than 15 minutes to restore, exceeding the RPO, and copying AMIs is irrelevant for ECS Fargate (which uses container images, not AMIs); pilot light with manual restore cannot achieve the 30-minute RTO.

Full explanation →
707
MCQhard

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

A.AWS Lambda
B.Amazon ECS
C.Amazon EKS
D.AWS Fargate
AnswerC

EKS is a managed Kubernetes service.

Why this answer

Amazon EKS (Elastic Kubernetes Service) is the correct choice because the company is migrating a legacy monolithic application to microservices and requires container orchestration. EKS provides a managed Kubernetes control plane, which is the industry-standard platform for automating deployment, scaling, and management of containerized applications, making it ideal for refactoring into microservices.

Exam trap

The trap here is that candidates often confuse Amazon ECS with EKS, assuming both are equivalent for microservices, but EKS is specifically required when the organization needs Kubernetes-based orchestration for portability and ecosystem compatibility.

How to eliminate wrong answers

Option A is wrong because AWS Lambda is a serverless compute service for running code in response to events, not designed for managing containers or container orchestration. Option B is wrong because Amazon ECS is a container orchestration service, but it uses AWS's proprietary scheduling and does not provide the Kubernetes API, which is often required for microservices architectures that need portability across environments. Option D is wrong because AWS Fargate is a compute engine for running containers without managing servers, but it is not an orchestration service itself; it runs containers under ECS or EKS.

Full explanation →
708
MCQeasy

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

A.Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.
B.Configure S3 event notifications on the bucket to send events to SNS.
C.Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.
D.Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.
AnswerA

Config rules evaluate resource compliance and can invoke Lambda for remediation or notification.

Why this answer

AWS Config rules can trigger custom Lambda functions to evaluate the S3 bucket policy and publish a notification to SNS if the policy allows public access. Option B is incorrect because S3 event notifications are triggered by object-level events (e.g., PUT, POST), not by policy changes. Option C is incorrect because AWS Config rules cannot directly publish to SNS; they require a Lambda function or other action to send notifications.

Option D is incorrect because CloudTrail logs API calls but does not provide real-time compliance evaluation or direct notification.

Full explanation →
709
Multi-Selecthard

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Select 3 answers
A.Encrypt traffic between VPCs using VPN or AWS PrivateLink.
B.Use VPC endpoints to keep traffic within the AWS network.
C.Implement network segmentation using subnets and security groups.
D.Use a single Availability Zone to reduce complexity.
E.Enable VPC Flow Logs to capture network traffic metadata.
AnswersA, C, E

Encryption of cardholder data in transit is required.

Why this answer

PCI DSS Requirement 4.1 mandates that cardholder data transmitted across open, public networks must be encrypted. Using VPN (IPsec) or AWS PrivateLink ensures that traffic between VPCs is encrypted in transit, meeting this compliance requirement. This approach also avoids exposing data to the public internet.

Exam trap

The trap here is that candidates often assume VPC endpoints alone satisfy encryption requirements, but PCI DSS demands encryption in transit (e.g., TLS or IPsec), not just network isolation.

Full explanation →
710
MCQhard

A company has a multi-account AWS environment with a centralized security account. The security team wants to ensure that any IAM role created in any account with a trust policy allowing access from another AWS account must be approved by the security team. Which approach should be used?

A.Use service control policies (SCPs) to deny role creation unless the trust policy meets conditions
B.Use IAM policies to restrict who can create roles
C.Use AWS Lambda to automatically delete non-compliant roles
D.Use AWS Config rules to detect and alert on risky trust policies
AnswerA

SCPs can deny IAM role creation if the trust policy includes a principal that is not part of the organization, effectively requiring approval.

Why this answer

Service Control Policies (SCPs) can be applied at the organizational unit (OU) or account level to deny the creation of roles with trust policies that allow access from another AWS account unless the trust policy meets specific conditions (e.g., requiring approval or restricting to accounts within the organization). Option B is wrong because IAM policies are account-level and cannot prevent role creation across accounts; they can only control who within an account can create roles, not the content of the trust policy. Option C is wrong because AWS Lambda can automatically delete non-compliant roles after creation, but it cannot prevent the initial creation, which is the requirement.

Option D is wrong because AWS Config rules can detect and alert on risky trust policies, but they cannot deny or prevent role creation; they are detective, not preventive.

Full explanation →
711
Multi-Selecteasy

A company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled and block public access. Which TWO actions should be taken to enforce these requirements centrally?

Select 2 answers
A.Use AWS Service Catalog to enforce S3 bucket encryption and public access settings.
B.Define a tag policy that requires encryption and public access tags on all S3 buckets.
C.Create an SCP to deny PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that do not meet the requirements.
D.Use IAM policies in the management account to restrict S3 permissions for all users.
E.Enable AWS Config and create rules to detect and automatically remediate non-compliant S3 buckets.
AnswersC, E

SCPs can centrally deny actions across all accounts.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally deny API actions that do not meet security requirements across all member accounts. By denying PutBucketAcl, PutBucketPolicy, and PutBucketPublicAccessBlock actions that would disable encryption or public access blocks, you enforce compliance at the API level, preventing any non-compliant bucket creation or modification regardless of the account or IAM permissions.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking IAM policies in the management account can control member accounts, but SCPs are the only mechanism that can centrally deny actions across all accounts in an organization.

Full explanation →
712
MCQeasy

A company uses AWS Organizations and has a requirement that all Amazon S3 buckets must have versioning enabled. The company wants to automatically enable versioning on any bucket that is created without it. Which solution should be implemented?

A.Use AWS Config with a managed rule s3-bucket-versioning-enabled and configure auto-remediation using an AWS Systems Manager Automation document to enable versioning.
B.Use an SCP to deny s3:CreateBucket unless versioning is enabled.
C.Use AWS Config to detect buckets without versioning and send an SNS notification.
D.Use AWS CloudFormation StackSets to deploy a bucket with versioning enabled in each account.
AnswerA

Config rule detects and auto-remediates by enabling versioning.

Why this answer

AWS Config can detect S3 buckets without versioning using the managed rule `s3-bucket-versioning-enabled`, and then automatically remediate the noncompliant resource by invoking an AWS Systems Manager Automation document that enables versioning on the bucket. This provides a fully automated, event-driven solution that meets the requirement without manual intervention or blocking bucket creation.

Exam trap

The trap here is that candidates often choose Option B (SCP) because they assume SCPs can enforce API-level conditions like versioning, but SCPs cannot evaluate request parameters that are not supported as condition keys in the IAM policy context.

How to eliminate wrong answers

Option B is wrong because SCPs cannot conditionally deny `s3:CreateBucket` based on whether versioning is enabled at creation time; the `s3:CreateBucket` API call does not support a condition key for versioning, so the SCP would either block all bucket creation or be ineffective. Option C is wrong because sending an SNS notification only alerts administrators but does not automatically enable versioning, failing the requirement to 'automatically enable versioning'. Option D is wrong because AWS CloudFormation StackSets can only deploy resources in accounts where they are explicitly applied; they cannot retroactively fix buckets created outside the StackSet or in accounts not included in the stack instance, leaving gaps in coverage.

Full explanation →
713
Multi-Selecthard

A company is migrating a legacy application to AWS. The application uses a custom authentication mechanism that relies on LDAP. The company wants to minimize changes to the application. Which THREE services should the company consider for integrating LDAP authentication? (Choose THREE.)

Select 3 answers
A.AWS Directory Service Simple AD
B.AWS Directory Service AD Connector
C.AWS Directory Service for Microsoft Active Directory
D.Amazon Cognito user pools
E.AWS Identity and Access Management (IAM)
AnswersA, B, C

Simple AD is a low-cost LDAP directory.

Why this answer

A, B, and C are correct because AWS Directory Service Simple AD (A) provides a low-cost LDAP-compatible directory, AD Connector (B) relays LDAP requests to an on-premises Active Directory, and AWS Directory Service for Microsoft Active Directory (C) supports LDAP natively. D (Amazon Cognito user pools) is incorrect because it is designed for external identity providers (e.g., social or enterprise federation) and does not support direct LDAP integration. E (AWS Identity and Access Management) is incorrect because IAM manages permissions for AWS resources but does not provide LDAP authentication services.

Full explanation →
714
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. The operations team notices that stack updates frequently fail because of updates to resources that are not supported for updates. What is the BEST way to handle this?

A.Use AWS Config rules to prevent updates.
B.Delete the stack and create a new one for each update.
C.Use AWS Service Catalog to enforce version control.
D.Use a change set to review the proposed changes before executing the update.
AnswerD

Change sets allow you to see what changes will be made and if any resources will be replaced.

Why this answer

The best practice is to use a change set to preview changes and identify unsupported updates before executing the update.

Full explanation →
715
MCQeasy

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

A.Create multiple Lambda functions each processing a subset of the queue.
B.Decrease the reserved concurrency to force the function to process messages more efficiently.
C.Increase the reserved concurrency for the Lambda function.
D.Increase the batch size of the SQS event source mapping.
AnswerC

This allows more concurrent executions, reducing throttling.

Why this answer

Increasing the reserved concurrency from 5 to a higher value allows the Lambda function to handle more concurrent invocations, directly reducing throttling errors. Option A is incorrect because each Lambda function has its own concurrency limit; adding more functions does not increase the concurrency of a single function. Option B is incorrect because decreasing reserved concurrency would worsen throttling.

Option D is incorrect because increasing the batch size increases the number of messages processed per invocation but does not increase the number of concurrent invocations, so it does not address throttling caused by concurrency limits.

Full explanation →
716
MCQhard

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

A.The route table does not have a default route (0.0.0.0/0).
B.The VPC does not have a local route.
C.The route table is not associated with the subnet.
D.The NAT gateway is not in a public subnet with an internet gateway.
AnswerD

NAT gateway requires a public subnet and internet gateway to function.

Why this answer

For an EC2 instance in a private subnet to access the internet via a NAT gateway, the NAT gateway must be deployed in a public subnet (with a route to an internet gateway). Option D correctly identifies that the NAT gateway is not in a public subnet with an internet gateway. Option A is incorrect because the route table does have a default route (0.0.0.0/0) pointing to the NAT gateway.

Option B is incorrect because the VPC has a local route for internal traffic. Option C is incorrect because the route table is associated with the subnet (the exhibit shows the subnet ID). Therefore, the most likely cause is that the NAT gateway itself is in a private subnet, preventing it from reaching the internet.

Full explanation →
717
MCQeasy

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

A.Enable slow query logging and use an RDS event subscription to send logs to an SQS queue for processing.
B.Enable slow query logging and store logs in an S3 bucket with lifecycle policy to delete after 30 days.
C.Enable slow query logging and store logs on the RDS instance's EBS volume, then take daily snapshots.
D.Enable slow query logging and stream logs to Amazon CloudWatch Logs with a retention policy of 30 days.
AnswerD

RDS can publish logs to CloudWatch Logs, where retention is configurable.

Why this answer

The most cost-effective because Amazon RDS for MySQL can natively publish slow query logs to Amazon CloudWatch Logs with minimal setup. By setting a retention policy of 30 days in CloudWatch Logs, you avoid additional storage costs and complex configurations. Option B is not directly supported; exporting logs to S3 requires extra steps (e.g., via CloudWatch Logs export) and incurs added cost.

Option A adds unnecessary complexity and cost with SQS. Option C is not feasible as RDS does not write slow query logs to EBS by default and snapshotting is not a log management solution.

Full explanation →
718
Multi-Selectmedium

A company is planning to migrate a legacy application to AWS. The application runs on a single server with a monolithic architecture and uses an Oracle database. The migration team wants to reduce licensing costs and improve scalability. Which TWO strategies should the team consider?

Select 2 answers
A.Replatform the application to use AWS Elastic Beanstalk and Amazon RDS for PostgreSQL.
B.Refactor the application into microservices and use Amazon DynamoDB for data storage.
C.Replatform the database to Amazon RDS for PostgreSQL and refactor the application to use it.
D.Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with license-included.
E.Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with BYOL.
AnswersA, C

Reduces operational overhead and licensing costs.

Why this answer

Replatforming the application to AWS Elastic Beanstalk reduces operational overhead by automating capacity provisioning, load balancing, and scaling, while migrating from Oracle to Amazon RDS for PostgreSQL eliminates Oracle licensing costs and provides a managed database service with built-in high availability and scalability. This approach directly addresses the company's goals of reducing licensing costs and improving scalability without requiring a full application rewrite.

Exam trap

The trap here is that candidates may confuse 'replatforming' (option A and C) with 'refactoring' (option B) or assume that rehosting with Oracle BYOL (option E) reduces costs, when in fact BYOL still requires existing licenses and does not eliminate licensing expenses.

Full explanation →
719
MCQmedium

A company is deploying a containerized application on Amazon EKS. The application needs to access an Amazon RDS database. The security team requires that database credentials be rotated automatically and never stored in plaintext. Which solution should the architect use?

A.Use AWS Secrets Manager to store and rotate credentials, and grant the EKS pod access via an IAM role
B.Use IAM database authentication for RDS and assign an IAM role to the pod
C.Hardcode the credentials in the container image and rotate the image regularly
D.Store credentials in AWS Systems Manager Parameter Store and grant the EKS pod access via an IAM role
AnswerA

Secrets Manager rotates credentials automatically and integrates with IAM for access.

Why this answer

AWS Secrets Manager is the correct choice because it natively supports automatic rotation of RDS database credentials via a built-in Lambda rotation function, and it integrates with IAM roles to grant EKS pods secure access without storing secrets in plaintext. By using an IAM role for the pod (via IRSA), the application can retrieve credentials at runtime from Secrets Manager, ensuring compliance with the security team's requirements.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager, assuming Parameter Store supports automatic rotation, but Parameter Store lacks native rotation capabilities for RDS credentials, making Secrets Manager the only correct choice for automated rotation.

How to eliminate wrong answers

Option B is wrong because IAM database authentication for RDS does not support automatic credential rotation; it relies on IAM roles and tokens, but the security team specifically requires rotating database credentials, not just authentication. Option C is wrong because hardcoding credentials in a container image violates the requirement to never store credentials in plaintext and does not provide automated rotation. Option D is wrong because AWS Systems Manager Parameter Store does not natively support automatic rotation of RDS credentials; it can store secrets but lacks the built-in rotation capability that Secrets Manager provides.

Full explanation →
720
MCQeasy

A company is designing a centralized logging solution for multiple AWS accounts. They need to aggregate VPC Flow Logs, CloudTrail logs, and DNS logs from all accounts into a single S3 bucket. Which AWS service should be used to centralize the log collection?

A.Amazon S3 cross-region replication
B.Amazon Kinesis Data Firehose
C.AWS CloudTrail
D.AWS Config
AnswerC

CloudTrail organization trail can deliver logs from all accounts to a single S3 bucket.

Why this answer

AWS CloudTrail can be configured to deliver logs from multiple accounts to a single S3 bucket by setting up a trail in the management account and using CloudTrail's organization trail feature. This automatically aggregates VPC Flow Logs, CloudTrail logs, and DNS logs from all member accounts into the designated centralized S3 bucket without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse CloudTrail's log aggregation capability with other services like Kinesis Data Firehose or S3 replication, but CloudTrail is the only service that natively supports centralized log collection from multiple accounts via organization trails.

How to eliminate wrong answers

Option A is wrong because S3 cross-region replication replicates objects between buckets in different regions but does not collect or aggregate logs from multiple AWS accounts; it only copies existing objects. Option B is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service that can ingest and transform data, but it is not designed to natively aggregate logs from multiple accounts into a single S3 bucket without custom cross-account IAM roles and additional configuration. Option D is wrong because AWS Config records resource configuration changes and compliance, not log aggregation; it cannot centralize VPC Flow Logs, CloudTrail logs, or DNS logs into a single S3 bucket.

Full explanation →
721
MCQmedium

A large enterprise with multiple business units (BUs) uses AWS Organizations with a shared services account and BU-specific accounts. Each BU account has a VPC with multiple subnets. The shared services account hosts a central NAT gateway that provides outbound internet access to all BU private subnets via VPC peering. Recently, the network team noticed that traffic from one BU's private subnet is being blocked by the security group in the shared services account. They verified that the route tables are correctly configured. What is the most likely cause and solution?

A.The BU account's route table does not have a route to the NAT gateway's private IP. Add a route via the VPC peering connection.
B.The security group attached to the NAT gateway's ENI does not allow incoming traffic from the BU private subnet. Update the security group to allow inbound traffic from the BU subnet CIDR.
C.The VPC peering connection is not in the 'active' state. Recreate the VPC peering connection.
D.The NAT gateway's Elastic IP is not attached. Attach an Elastic IP to the NAT gateway.
AnswerC

This is correct. If the VPC peering connection is not active (e.g., pending acceptance, expired, or deleted), traffic from the BU's VPC to the shared services VPC will be blocked, affecting only that BU's outbound internet access via the central NAT gateway.

Why this answer

VPC peering connections must be in the 'active' state to route traffic between VPCs. If the peering connection for a specific BU's VPC is not active (e.g., pending acceptance, expired, or deleted), traffic from that BU's private subnet to the shared services VPC will be blocked. Since route tables and the NAT gateway's configuration are correct, the most likely cause is an inactive VPC peering connection.

Option B is incorrect because NAT gateways do not support user-modifiable security groups; AWS manages the security group on the NAT gateway's ENI and it cannot be updated by customers. Option A contradicts the verified route tables. Option D would affect all BUs, not just one.

Full explanation →
722
MCQeasy

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

A.AWS Budgets with tag-based filters.
B.AWS Trusted Advisor cost optimization checks.
C.AWS Cost Explorer with tag-based filtering.
D.AWS Cost Explorer with cost allocation tags.
AnswerD

Cost allocation tags (user-defined) can be applied to resources and used in Cost Explorer to break down costs by department.

Why this answer

Cost allocation tags in AWS allow you to tag resources (e.g., EC2 instances, S3 buckets) with department IDs and then use AWS Cost Explorer to view cost breakdowns by those tags. This directly meets the requirement to track costs per department account within AWS Organizations with consolidated billing.

Exam trap

The trap here is confusing 'tag-based filtering' (which is not a native Cost Explorer feature) with 'cost allocation tags' (the correct mechanism), leading candidates to pick Option C instead of D.

How to eliminate wrong answers

Option A is wrong because AWS Budgets can use tag-based filters to create budget alerts, but it does not provide a historical cost breakdown view by tag; it only monitors against a threshold. Option B is wrong because AWS Trusted Advisor cost optimization checks provide recommendations to reduce costs (e.g., idle resources), but it cannot tag resources or break down costs by department tags. Option C is wrong because AWS Cost Explorer with tag-based filtering is not a feature; Cost Explorer supports filtering by tags only after they are activated as cost allocation tags, and the phrase 'tag-based filtering' is misleading—Cost Explorer uses cost allocation tags, not arbitrary tag-based filtering.

Full explanation →
723
MCQhard

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

A.Fn::ImportValue
B.Fn::GetAtt
C.Fn::Sub
D.Fn::Ref
AnswerA

ImportValue imports exported output values from other stacks.

Why this answer

A is correct because Fn::ImportValue is the only intrinsic function that can reference a cross-stack output value exported via the Export field in a CloudFormation stack. Since the SQS queue URL is an output from one stack and needs to be used in another stack, Fn::ImportValue is required to import the exported value by name.

Exam trap

The trap here is that candidates often confuse Fn::GetAtt or Fn::Ref with cross-stack references, but those functions only work within the same stack, while Fn::ImportValue is specifically designed for cross-stack value sharing.

How to eliminate wrong answers

Option B (Fn::GetAtt) is wrong because it retrieves an attribute from a resource within the same stack, not from another stack's output. Option C (Fn::Sub) is wrong because it substitutes variables in a string template, but cannot reference cross-stack exports directly. Option D (Fn::Ref) is wrong because it returns the value of a parameter or resource within the same stack, not an exported output from another stack.

Full explanation →
724
Multi-Selectmedium

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances must use a specific AMI ID that is approved by the security team. Which two actions should the team take to achieve this? (Choose two.)

Select 2 answers
A.Create an SCP that denies ec2:RunInstances unless the ami id matches an approved list.
B.Use AWS Resource Access Manager to share the approved AMI with all accounts.
C.Use AWS Config rules to detect instances launched with non-approved AMIs and trigger remediation.
D.Use AWS CloudTrail to monitor instance launches and send alerts.
E.Attach an IAM policy to each account's IAM roles that allows only approved AMIs.
AnswersA, C

SCPs can deny actions based on conditions.

Why this answer

An SCP in AWS Organizations can deny the ec2:RunInstances action unless the request includes an approved AMI ID, using a condition key like ec2:ImageId. This enforces the policy across all accounts in the organization, preventing any non-approved AMI from being used even by administrators. Option C is correct because AWS Config rules can detect non-compliant instances (e.g., those launched with unapproved AMIs) and trigger an automatic remediation action, such as terminating the instance or sending notifications, providing a detective and corrective control.

Exam trap

The trap here is that candidates confuse SCPs with IAM policies, thinking IAM policies can enforce organization-wide restrictions, but SCPs are the only mechanism that can deny actions across all accounts in AWS Organizations, including to the root user.

Full explanation →
725
MCQmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences occasional read replica lag of up to 5 seconds. The application requires read-after-write consistency. Which action should the company take to improve the solution?

A.Modify the application to always read from the primary instance.
B.Increase the number of read replicas to distribute the load.
C.Implement Amazon ElastiCache to cache read results.
D.Use Amazon RDS Proxy to route read queries to the read replica.
AnswerA

Primary instance provides strong consistency.

Why this answer

Reading from the primary instance ensures read-after-write consistency. Since the application requires strong consistency, all reads must be directed to the primary, as read replicas may have lag. Option B is incorrect because increasing the number of read replicas does not reduce replication lag.

Option C is incorrect because Amazon ElastiCache is a caching layer, not a solution for consistency. Option D is incorrect because Amazon RDS Proxy helps manage connections but does not eliminate read replica lag.

Full explanation →
726
MCQhard

A company runs a global application on AWS spanning multiple regions. They need to enforce that IAM users in specific accounts can only launch EC2 instances in approved regions. The company uses AWS Organizations. What is the most effective way to enforce this?

A.Use AWS Config rules to detect EC2 instances in non-approved regions and trigger automatic termination.
B.Create IAM policies in each account that deny EC2 actions outside approved regions.
C.Use VPC endpoints to restrict API calls to approved regions.
D.Create a Service Control Policy (SCP) that denies EC2:RunInstances in non-approved regions.
AnswerD

SCPs are applied at the OU or account level and prevent actions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that denies EC2:RunInstances in non-approved regions, you enforce a guardrail that applies to all IAM users and roles in the member accounts, regardless of their individual IAM policies. This is the most effective approach because SCPs are evaluated before IAM policies and cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, thinking that account-level IAM policies are sufficient for centralized enforcement, but they fail to recognize that SCPs are the only mechanism that can restrict even the root user and cannot be overridden by account administrators.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they detect non-compliant resources after launch and can trigger remediation, but they do not prevent the EC2 instance from being created in the first place, which violates the requirement to enforce the restriction. Option B is wrong because IAM policies in each account can be modified or removed by account administrators with full administrative privileges, making them unreliable for centralized enforcement across multiple accounts in an organization. Option C is wrong because VPC endpoints are used to privately connect to AWS services within a VPC and do not restrict API calls based on region; they control network connectivity, not the authorization of API actions like EC2:RunInstances.

Full explanation →
727
MCQmedium

A company is building a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. Each file can be up to 500 MB, and processing takes up to 10 minutes. The Lambda function must be triggered as soon as a file is uploaded. Which configuration should they use?

A.Use S3 event notification to send an SQS message, which triggers Lambda.
B.Configure S3 event notification to invoke the Lambda function directly.
C.Increase the Lambda function timeout to 15 minutes and memory to 3 GB.
D.Use AWS Step Functions to poll S3 and invoke Lambda.
AnswerB

S3 can directly invoke Lambda for each object creation event.

Why this answer

S3 event notifications can directly invoke a Lambda function when an object is created, which meets the requirement of triggering the function as soon as a file is uploaded. Lambda supports a maximum timeout of 15 minutes and up to 10 GB of memory, so the 10-minute processing time and 500 MB file size are within limits. Option A is incorrect because using SQS between S3 and Lambda adds unnecessary complexity and latency, and is not needed when the direct trigger works.

Option C is incorrect because increasing timeout and memory addresses resource limits but does not affect triggering; moreover, the default timeout can be set to 10 minutes without issue. Option D is incorrect because Step Functions add unnecessary orchestration complexity when a simple event trigger suffices.

Full explanation →
728
Multi-Selectmedium

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Select 2 answers
A.Use S3 replication to copy logs from member account buckets to the central bucket.
B.Create an IAM role in each member account that allows CloudTrail to write to the central bucket.
C.Enable AWS Config in each member account to forward logs to the central bucket.
D.Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.
E.Configure the S3 bucket policy to grant the CloudTrail service principal write access from all accounts.
AnswersD, E

This allows CloudTrail to deliver logs from all accounts to the management account's bucket.

Why this answer

The 'Enable for all accounts in my organization' option in CloudTrail automatically creates a trail that applies to all accounts in the AWS Organization, delivering logs from every account to the specified S3 bucket in the management account without requiring per-account configuration. Option E is correct because the S3 bucket policy must explicitly grant the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects from any AWS account in the organization, ensuring cross-account delivery succeeds.

Exam trap

The trap here is that candidates often assume cross-account access requires IAM roles (Option B) or replication (Option A), but CloudTrail's organization trail uses S3 bucket policies with the CloudTrail service principal, not IAM roles, to enable direct log delivery from all member accounts.

Full explanation →
729
MCQmedium

A company is using AWS Organizations to manage multiple accounts. The security team requires that all newly created member accounts automatically have an AWS Config rule enabled that checks whether S3 buckets have default encryption enabled. Which solution should be used?

A.Use an SCP in the root to require encryption on S3 buckets.
B.Use AWS CloudFormation StackSets with automatic deployment to deploy the AWS Config rule across all accounts in the organization.
C.Create an AWS Config rule in the management account and delegate an admin account to apply it to all member accounts.
D.Configure AWS CloudTrail to automatically enable the AWS Config rule in new accounts.
AnswerB

StackSets with automatic deployment apply templates to new accounts as they join the organization.

Why this answer

AWS CloudFormation StackSets with automatic deployment can deploy the AWS Config rule across all accounts in an AWS Organization, including newly created member accounts, by targeting the root organizational unit (OU). This ensures that the Config rule is automatically enabled in new accounts as they are created, meeting the security team's requirement without manual intervention.

Exam trap

The trap here is that candidates often confuse SCPs (which only deny or allow actions) with actual configuration enforcement, or they assume CloudTrail can perform configuration actions, when in reality only automated deployment tools like CloudFormation StackSets can proactively enable Config rules in new accounts.

How to eliminate wrong answers

Option A is wrong because a Service Control Policy (SCP) can deny actions that disable encryption but cannot directly enable an AWS Config rule or enforce default encryption on existing S3 buckets; SCPs are permission boundaries, not configuration enforcement tools. Option C is wrong because while you can delegate an admin account for AWS Config, the management account cannot directly apply a Config rule to all member accounts automatically for new accounts; Config rules must be deployed via StackSets or similar automation to target new accounts. Option D is wrong because AWS CloudTrail does not have the capability to enable AWS Config rules; CloudTrail is for logging API activity, not for deploying or managing Config rules.

Full explanation →
730
MCQeasy

A small business wants to host a simple static website on AWS. The website consists of HTML, CSS, JavaScript, and images. The company expects low traffic and wants to minimize costs. The website must be highly available and load quickly for users globally. Which solution should a Solutions Architect recommend?

A.Store the website files in an S3 bucket configured for static website hosting, and use Amazon CloudFront as a CDN.
B.Host the website on Amazon Lightsail with a load balancer and two instances.
C.Host the website on a single EC2 instance running Apache web server, with an Elastic IP address.
D.Deploy the website on AWS Elastic Beanstalk with a single EC2 instance.
AnswerA

S3 static hosting is very low cost, highly available, and CloudFront provides global performance.

Why this answer

S3 static website hosting with CloudFront provides low cost, high availability, and global low latency. Option B is wrong because Lightsail with a load balancer and two instances is more expensive and overkill for a simple static site. Option C is wrong because a single EC2 instance is not highly available and costs more than S3.

Option D is wrong because Elastic Beanstalk is designed for dynamic web apps, not static sites, and a single EC2 instance lacks high availability.

Full explanation →
731
MCQmedium

A company is designing a new solution to securely store and manage secrets for applications running on AWS. The secrets include database credentials, API keys, and OAuth tokens. The solution must automatically rotate secrets and integrate with AWS services like Amazon RDS. Which AWS service should be used?

A.Store secrets in AWS Systems Manager Parameter Store with a SecureString parameter type.
B.Use AWS CloudHSM to store secrets as keys.
C.Use AWS Key Management Service (KMS) to store secrets as encrypted data keys.
D.Use AWS Secrets Manager to store secrets and configure automatic rotation.
AnswerD

Secrets Manager is purpose-built for secrets with rotation and native RDS integration.

Why this answer

AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials, API keys, and OAuth tokens. It provides native integration with Amazon RDS, enabling automatic rotation of RDS credentials without custom code, which directly meets the requirements for automatic rotation and AWS service integration.

Exam trap

The trap here is that candidates confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with AWS Secrets Manager (which is designed specifically for automatic secret rotation and deep AWS service integration), leading them to choose Parameter Store for its lower cost and familiarity.

How to eliminate wrong answers

Option A is wrong because AWS Systems Manager Parameter Store with SecureString does not support automatic rotation of secrets; it requires custom AWS Lambda functions or external processes to rotate secrets. Option B is wrong because AWS CloudHSM is a hardware security module for generating and storing cryptographic keys, not for managing application secrets like database credentials or API keys, and it lacks native rotation and RDS integration. Option C is wrong because AWS KMS is a key management service for creating and controlling encryption keys, not for storing secrets; it can encrypt data keys but does not provide secret storage, rotation, or direct RDS integration.

Full explanation →
732
Multi-Selecteasy

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Select 2 answers
A.Enable Multi-AZ on the RDS instance to allow failover during updates.
B.Update the CloudFormation stack directly without creating a new database.
C.Use AWS CloudFormation with a blue/green deployment strategy for the database.
D.Use a read replica to serve traffic during the update.
E.Use a database snapshot to restore the database if the update fails.
AnswersC, E

Blue/green allows you to create a new database and switch traffic.

Why this answer

CloudFormation can use a blue/green deployment strategy, which creates a new database environment (green) alongside the existing one (blue). Traffic is switched after the new environment is ready, minimizing downtime. Option E is correct because taking a database snapshot before updates provides a rollback mechanism in case the update fails.

Option A is wrong: Multi-AZ provides high availability and automatic failover but does not eliminate downtime during updates—it simply recovers quickly after an outage. Option B is wrong: Directly updating the CloudFormation stack without creating a new database may cause downtime if the database must be replaced or modified in place. Option D is wrong: A read replica serves only read traffic; it cannot handle write traffic during database updates, so it does not prevent downtime for write operations.

Full explanation →
733
MCQmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

A.Use sticky sessions (session affinity) on the ALB with a session cookie.
B.Use Amazon ElastiCache for Memcached to store session data.
C.Store session data in Amazon DynamoDB tables.
D.Use Amazon ElastiCache for Redis to store session data externally.
AnswerD

Redis provides a scalable, highly available session store.

Why this answer

Amazon ElastiCache for Redis provides a highly scalable, low-latency, and durable external session store that decouples session state from EC2 instances. This allows the Auto Scaling group to add or remove instances freely without losing session data, and Redis supports replication and persistence for reliability. Compared to DynamoDB, Redis offers lower latency for session access, and compared to Memcached, it provides data structures and persistence that are beneficial for session management.

Exam trap

The trap here is that candidates often choose sticky sessions (Option A) because it seems simple and directly supported by ALB, but they overlook the fundamental scalability and resilience issues it introduces in an Auto Scaling environment.

How to eliminate wrong answers

Option A is wrong because sticky sessions (session affinity) tie a user to a specific EC2 instance, which prevents the Auto Scaling group from scaling in or out effectively and can cause session loss if that instance fails or is terminated. Option B is wrong because Amazon ElastiCache for Memcached is a pure caching solution without persistence or replication, so session data would be lost on node failure, making it unsuitable for maintaining session state reliably. Option C is wrong because while DynamoDB can store session data, it introduces higher latency per request compared to in-memory caches like Redis, and its cost for frequent read/write operations can be higher than ElastiCache for steady traffic with occasional spikes.

Full explanation →
734
Multi-Selecteasy

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

Select 2 answers
A.AWS Resource Access Manager
B.AWS WAF
C.AWS IAM Identity Center (SSO)
D.AWS Config
E.AWS Organizations Service Control Policies (SCPs)
AnswersD, E

Can evaluate bucket policies and auto-remediate non-compliant buckets.

Why this answer

AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies.

Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.

Full explanation →
735
MCQhard

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

A.Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.
B.Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.
C.Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.
D.Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.
AnswerB

Customer-managed key meets requirement; CloudTrail audits access.

Why this answer

It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Exam trap

The trap here is that candidates often confuse S3 server access logs (which are log files delivered to an S3 bucket) with CloudTrail data events, or assume SSE-S3 meets the 'customer-managed keys' requirement because it is a form of server-side encryption, but SSE-S3 uses AWS-owned keys, not customer-managed ones.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses AWS-managed keys, not customer-managed keys, and S3 server access logs are best-effort (delivered asynchronously) and do not capture KMS key usage, failing both the encryption and audit requirements. Option C is wrong because SSE-S3 again uses AWS-managed keys, and Amazon CloudWatch Logs for S3 access logging is not a native S3 feature; S3 access logs are delivered to S3, not directly to CloudWatch Logs, and they lack KMS audit trails. Option D is wrong because client-side encryption requires the customer to manage encryption/decryption in their application, which adds complexity and does not leverage S3's native encryption at rest; also, CloudWatch Logs for S3 access logs is not a standard S3 audit mechanism and does not capture KMS data events.

Full explanation →
736
MCQmedium

A company is migrating a multi-tier web application to AWS. The application uses sticky sessions (session affinity). The company wants to use an Application Load Balancer (ALB). How should the architect configure the ALB to support sticky sessions?

A.Configure the ALB listener to use a custom header for session affinity.
B.Enable stickiness on the target group and set a cookie expiration duration.
C.Use a Network Load Balancer (NLB) and enable proxy protocol.
D.Place an Amazon ElastiCache cluster in front of the ALB to store session data.
AnswerB

ALB supports sticky sessions via a cookie; configuration is on the target group.

Why this answer

ALB supports sticky sessions by enabling stickiness on the target group and setting a cookie expiration duration. Option A is wrong because ALB uses cookies for session affinity, not a custom header. Option C is wrong because the question specifies using an ALB, not an NLB, and proxy protocol is for preserving client IP, not sticky sessions.

Option D is wrong because placing ElastiCache in front of the ALB is not a load balancer configuration; it is an external solution for storing session data.

Exam trap

Candidates often confuse the location where stickiness is configured: it's on the target group, not the listener or load balancer.

Full explanation →
737
MCQhard

A company is migrating a legacy .NET application to AWS. The application currently uses Windows Authentication and a SQL Server database. The company wants to reduce licensing costs and use managed services where possible. The migration should minimize code changes. Which combination of services meets these requirements?

A.Amazon EC2 instances with SQL Server installed and AWS Directory Service for AD
B.AWS Lambda for the application logic and Amazon DynamoDB for the database
C.Amazon ECS with Windows containers, Amazon RDS for SQL Server, and AWS SSO
D.AWS Elastic Beanstalk for the .NET application, Amazon RDS for SQL Server, and AWS Managed Microsoft AD
AnswerD

Elastic Beanstalk supports .NET, RDS for SQL Server is managed, and Managed AD provides Windows Authentication.

Why this answer

AWS Managed Microsoft AD provides Windows Authentication compatibility. Amazon RDS for SQL Server is a managed database service that reduces operational overhead and licensing costs compared to self-managed SQL Server. AWS Elastic Beanstalk supports .NET applications.

This combination minimizes code changes. Lambda does not support .NET Windows Authentication natively; DynamoDB is not compatible; EC2 does not reduce licensing costs.

Full explanation →
738
Multi-Selecteasy

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Select 2 answers
A.Disable public access to all S3 buckets and restrict cross-account access.
B.Use AWS Resource Access Manager to share resources only with trusted accounts.
C.Use SCPs to deny access to external AWS accounts unless explicitly allowed.
D.Use VPC endpoints for all AWS services and ensure they are private.
E.Use security groups to restrict outbound traffic to known IP addresses.
AnswersB, C

RAM allows fine-grained control over resource sharing within the organization.

Why this answer

AWS Resource Access Manager (RAM) enables you to share resources such as subnets, transit gateways, and License Manager configurations only with specific AWS accounts or organizational units, which directly supports a data perimeter by preventing unintended cross-account access. Option C is correct because Service Control Policies (SCPs) can be applied at the organization root, OU, or account level to deny access to external AWS accounts unless explicitly allowed, effectively creating a boundary that prevents data exfiltration to unauthorized accounts.

Exam trap

The trap here is that candidates often confuse network-level controls (like VPC endpoints or security groups) with identity and resource-based perimeter controls, leading them to choose options D or E, which only address network paths and not the authorization boundaries needed to prevent data exfiltration across accounts.

Full explanation →
739
MCQeasy

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

A.Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.
B.Use a VPC endpoint and route logs through a central VPC.
C.Attach an SCP to allow CloudTrail to write to the central bucket.
D.Create an IAM role in each member account and allow the central account to assume it.
AnswerA

A bucket policy with a condition for AWS:SourceOrgID allows all accounts in the organization.

Why this answer

CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Exam trap

The trap here is that candidates often confuse SCPs with resource-based policies, thinking an SCP can grant cross-account write access to an S3 bucket, when in reality only the bucket policy (or a combination of bucket policy and IAM) can authorize CloudTrail's service principal from another account.

How to eliminate wrong answers

Option B is wrong because VPC endpoints (Gateway or Interface endpoints) are used for private connectivity to AWS services within a VPC, not for cross-account log delivery from CloudTrail; CloudTrail delivers logs directly to S3 over the public internet or via an interface endpoint, but routing through a central VPC does not solve the multi-account authorization requirement. Option C is wrong because Service Control Policies (SCPs) are used to restrict permissions across accounts in an organization, not to grant permissions; an SCP cannot allow CloudTrail to write to a bucket—it can only deny or allow actions, and the actual write permission must come from the bucket policy or IAM. Option D is wrong because CloudTrail does not use IAM roles for cross-account log delivery; instead, it relies on the bucket policy to grant the CloudTrail service principal from each account the necessary write access, making IAM role assumption unnecessary and architecturally incorrect.

Full explanation →
740
MCQhard

A company is designing a multi-region active-active application using Amazon Route 53, Application Load Balancers, and Auto Scaling groups. They need to route users to the closest region with the lowest latency. Which routing policy should they use?

A.Latency routing
B.Weighted routing
C.Failover routing
D.Geolocation routing
AnswerA

Routes to the region with the lowest latency.

Why this answer

(Latency routing) is correct because it routes users to the AWS region that provides the lowest latency, based on real-time latency measurements. This is ideal for multi-region active-active applications where users should be directed to the closest region. Option B (Weighted routing) distributes traffic based on assigned weights, not latency.

Option C (Failover routing) is used for active-passive disaster recovery. Option D (Geolocation routing) routes based on the geographic location of the user, not on actual network latency.

Full explanation →
741
MCQmedium

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

A.Replace the Lambda function with AWS Elemental MediaConvert job triggered by S3 events.
B.Increase the Lambda function memory to the maximum to improve performance and reduce processing time.
C.Use AWS Step Functions to call multiple Lambda functions in parallel to process chunks of the video.
D.Use a Lambda function with a larger ephemeral storage to handle the video file.
AnswerA

MediaConvert supports long-running jobs and is designed for video processing.

Why this answer

AWS Elemental MediaConvert is a managed service designed for video transcoding. It can handle large files and long-running jobs. The pipeline can be modified to trigger a MediaConvert job instead of a Lambda function.

Option B is incorrect because Lambda functions have a maximum execution time of 15 minutes; increasing memory does not extend timeout. Option C is incorrect because using a larger Lambda function still has the 15-minute limit. Option D is incorrect because Step Functions orchestrate Lambda functions but do not extend the individual Lambda timeout.

Full explanation →
742
MCQhard

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

A.S3 Standard
B.S3 Glacier Deep Archive
C.S3 One Zone-IA
D.S3 Intelligent-Tiering
AnswerD

Intelligent-Tiering optimizes cost automatically.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Exam trap

The SAP-C02 exam often tests the misconception that S3 Intelligent-Tiering is only for unpredictable access patterns, but the trap here is that candidates overlook its ability to maintain immediate query performance for Athena and Redshift Spectrum by keeping frequently accessed data in low-latency tiers, while still minimizing costs for cold data, making it superior to static storage classes for a large data lake with evolving access patterns.

How to eliminate wrong answers

Option A (S3 Standard) is wrong because it is designed for frequently accessed data and would be cost-prohibitive for petabytes of data that may become less active over time, leading to unnecessary high storage costs. Option B (S3 Glacier Deep Archive) is wrong because it has a retrieval time of 12 hours or more, which would prevent immediate query performance required by Athena and Redshift Spectrum. Option C (S3 One Zone-IA) is wrong because it stores data in a single Availability Zone, which risks data loss if that AZ fails, and it is not suitable for a durable data lake; also, it incurs retrieval costs that can accumulate with frequent queries, negating cost benefits.

Full explanation →
743
MCQeasy

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

A.Enable termination protection on the stack.
B.Use AWS CloudFormation change sets before updating the stack.
C.Use AWS CloudFormation nested stacks.
D.Use stack policies to protect critical resources.
AnswerB

Change sets allow you to review proposed changes and identify conflicts before execution.

Why this answer

Change sets allow you to preview the changes before execution, helping to identify potential conflicts. Option A is wrong because termination protection prevents accidental deletion but does not address resource conflicts during updates. Option C is wrong because nested stacks are for organizing stacks, not for previewing changes.

Option D is wrong because stack policies protect specific resources from updates, but they don't preview changes or prevent conflicts.

Full explanation →
744
Multi-Selecteasy

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

Select 2 answers
A.Amazon Inspector.
B.AWS CloudTrail.
C.AWS Config.
D.VPC Reachability Analyzer.
E.VPC Flow Logs.
AnswersD, E

Tests network paths between resources.

Why this answer

Options D and E are correct. D: VPC Reachability Analyzer helps diagnose network connectivity issues by checking network paths between resources. E: VPC Flow Logs capture IP traffic information for analysis.

A is incorrect because Amazon Inspector is a vulnerability assessment tool, not for network connectivity monitoring. B is incorrect because AWS CloudTrail records API activity, not network traffic. C is incorrect because AWS Config tracks resource configuration changes, not real-time connectivity.

Full explanation →
745
MCQmedium

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

A.AWS PrivateLink to route traffic through a centralized security appliance in a single account.
B.VPC Peering connections between all VPCs and use security groups to control traffic.
C.AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.
D.AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.
AnswerC

This provides centralized policy management and automatic deployment across accounts with minimal operational effort.

Why this answer

AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Exam trap

The trap here is that candidates often assume AWS Transit Gateway with a Gateway Load Balancer is the most operationally efficient because it provides centralized inspection, but they overlook the automated policy management and cross-account deployment capabilities of AWS Firewall Manager, which reduces operational overhead significantly for multi-account environments.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is designed for private connectivity to services (e.g., VPC endpoints) and does not provide traffic inspection or routing capabilities; it cannot inspect or block traffic between VPCs. Option B is wrong because VPC Peering creates point-to-point connections without a central inspection point, requiring security groups to be managed per VPC, which is not scalable for cross-account traffic inspection and does not support centralized policy enforcement. Option D is wrong because while AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer can inspect traffic, it requires significant manual setup (e.g., route tables, GWLB endpoints) and does not offer the same level of automated policy deployment and management across accounts as Firewall Manager, making it less operationally efficient.

Full explanation →
746
Multi-Selecthard

A company is migrating a large-scale application to AWS. The application uses a message queue for decoupling components. The current on-premises solution uses RabbitMQ. The company wants a managed service that supports message durability and at-least-once delivery. Which THREE AWS services meet these requirements? (Choose THREE.)

Select 3 answers
A.Amazon Simple Notification Service (SNS) topic.
B.Amazon MQ (managed RabbitMQ broker).
C.Amazon SQS FIFO queue.
D.Amazon Kinesis Data Streams.
E.Amazon Simple Queue Service (SQS) standard queue.
AnswersB, C, E

Managed RabbitMQ service, supports durability.

Why this answer

Options B, C, and E are correct. Amazon MQ is a managed message broker service that supports RabbitMQ, providing message durability and at-least-once delivery. Amazon SQS FIFO queues guarantee exactly-once processing while also offering at-least-once delivery and durability.

Amazon SQS standard queues provide at-least-once delivery and durability. Option A is incorrect because Amazon SNS is a pub/sub messaging service, not a queue, and does not support the same durability and delivery semantics as a message queue. Option D is incorrect because Amazon Kinesis Data Streams is designed for real-time streaming data ingestion, not as a traditional message queue, and does not guarantee at-least-once delivery in the same way.

Full explanation →
747
Multi-Selecteasy

A company runs a web application on EC2 instances behind an ALB. They want to improve the security posture by implementing defense in depth. Which TWO measures should they implement? (Choose TWO.)

Select 2 answers
A.Store static assets in a public S3 bucket.
B.Place EC2 instances in public subnets for easier management.
C.Allow direct internet access to the EC2 instances.
D.Configure security groups to restrict traffic to only necessary ports.
E.Use AWS WAF to filter common web exploits.
AnswersD, E

Security groups act as a firewall for EC2 instances.

Why this answer

Defense in depth involves multiple layers of security. Option D (security groups) acts as a virtual firewall at the instance level, restricting traffic to only necessary ports. Option E (AWS WAF) helps filter common web exploits at the application layer.

Option A (public S3) does not improve security. Option B (public subnets) increases exposure. Option C (direct internet access) bypasses the ALB and security layers.

Full explanation →
748
Multi-Selectmedium

A company is migrating a batch processing workload to AWS. The workload reads input files from an on-premises NFS server, processes them, and writes output files. The company wants to use AWS managed services and minimize operational overhead. Which TWO AWS services should the company use to replace the on-premises NFS server? (Choose TWO.)

Select 2 answers
A.Amazon S3 with S3 File Gateway.
B.AWS DataSync to transfer files from on-premises to Amazon EFS.
C.AWS Storage Gateway File Gateway.
D.Amazon EBS with a shared snapshot.
E.Amazon EFS (Elastic File System).
AnswersB, E

DataSync automates data transfer to AWS.

Why this answer

Options B and E are correct. AWS DataSync efficiently transfers data from the on-premises NFS server to Amazon EFS, and Amazon EFS provides a fully managed NFS file system that the batch processing workload can use directly. Option A (S3 with S3 File Gateway) is not ideal because S3 File Gateway presents S3 as a file share but adds complexity.

Option C (Storage Gateway File Gateway) can provide an NFS mount, but DataSync is specifically for data transfer, and for ongoing access, EFS is better. Option D (EBS with shared snapshot) is wrong because EBS is block storage, not file, and shared snapshots do not provide a writable file system.

Full explanation →
749
MCQmedium

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

A.Share the portfolio with the target accounts from the Service Catalog console
B.Use AWS CloudFormation StackSets to deploy products to each account
C.Use SCPs to allow specific accounts to use Service Catalog
D.Create IAM roles in the central account that developers can assume
AnswerA

Portfolio sharing enables cross-account access to products.

Why this answer

AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Exam trap

The trap here is that candidates often confuse AWS Service Catalog portfolio sharing with other cross-account mechanisms like CloudFormation StackSets or IAM roles, failing to recognize that Service Catalog's native sharing via RAM is the correct way to control product availability for self-service provisioning.

How to eliminate wrong answers

Option B is wrong because AWS CloudFormation StackSets are used to deploy infrastructure across multiple accounts and regions, but they do not provide a self-service catalog for end users to provision products on demand; they are an automation tool, not a governance mechanism for product availability. Option C is wrong because Service Control Policies (SCPs) are used to restrict permissions at the AWS Organizations level, but they cannot control which specific Service Catalog products are available to an account; SCPs only allow or deny actions on the Service Catalog API, not portfolio-level sharing. Option D is wrong because creating IAM roles in the central account for developers to assume does not directly control which Service Catalog products are available in target accounts; it only grants cross-account access, but the portfolio must still be shared with the target account for the products to appear in that account's Service Catalog.

Full explanation →
750
MCQmedium

A company runs a batch processing job on Amazon EMR every night. The job processes data from an S3 bucket and writes results to another S3 bucket. The job currently takes 6 hours to complete. The company wants to reduce the runtime to under 2 hours to meet a new SLA. The data volume is expected to grow by 20% each month. The EMR cluster uses a single master node and 10 core nodes of type m5.xlarge. The job is CPU-bound. What should they do?

A.Change the core node instance type to m5.4xlarge.
B.Use spot instances for the core nodes to reduce costs.
C.Add task nodes with spot instances to the cluster.
D.Increase the number of core nodes in the EMR cluster.
AnswerD

Adding more nodes increases parallelism for CPU-bound tasks, reducing runtime.

Why this answer

Increasing the number of core nodes (horizontal scaling) distributes the CPU workload across more nodes, directly reducing runtime for CPU-bound jobs. With 20% monthly data growth, scaling out provides more headroom than scaling up. Option A (changing to m5.4xlarge) might help but is less cost-effective and may not keep up with growth.

Option B (using spot instances for core nodes) reduces cost but does not address runtime and risks interruptions. Option C (adding task nodes with spot instances) adds compute capacity but spot interruptions can degrade performance, and task nodes lack HDFS storage which might be needed for intermediate data.

Full explanation →
Page 9

Page 10 of 23

Page 11

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →