Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 826–900

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 11

Page 12 of 23

Page 13
826
Multi-Selecthard

A company is migrating a legacy application that uses hard-coded IP addresses for database connections. The company wants to refactor the application to use a more resilient architecture in AWS. Which THREE steps should the company take to modernize the database connectivity? (Choose THREE.)

Select 3 answers
A.Enable Multi-AZ deployment for the RDS instance to automatically failover.
B.Use Amazon RDS read replicas to offload read traffic and improve resilience.
C.Assign an Elastic IP address to the RDS instance for consistent connectivity.
D.Migrate the database to Amazon RDS and use the RDS endpoint (DNS name) in the connection string.
E.Modify the application to read the database endpoint from an environment variable or configuration file.
AnswersB, D, E

Read replicas provide scalability and resilience for read-heavy workloads.

Why this answer

Read replicas can offload read traffic and enhance resilience, but note that read replicas are primarily for read scaling, not automatic failover. Option D is correct because using the RDS endpoint (DNS name) in the connection string allows the application to automatically reconnect to a new primary instance during failover, removing the hard-coded IP address. Option E is correct because storing the database endpoint in an environment variable or configuration file decouples the application from the infrastructure, enabling easier updates and failover handling.

Option A is incorrect because Multi-AZ deployment provides high availability with automatic failover, but it does not directly address the issue of hard-coded IP addresses; the application still needs to use the DNS endpoint. Option C is incorrect because Elastic IP addresses are not suitable for RDS; RDS uses DNS endpoints for connectivity, and Elastic IPs are associated with EC2 instances, not RDS.

Full explanation →
827
MCQeasy

A company is using AWS Application Migration Service (MGN) to migrate hundreds of on-premises servers to AWS. After the migration, some servers fail a health check. What is the most efficient way to remediate the failed servers?

A.Launch test instances from MGN, diagnose the issues, then update the source servers and perform a final cutover.
B.Rerun the MGN replication and perform a new cutover.
C.Restore the servers from the latest AMI and re-run the health check.
D.Use AWS CloudEndure Migration to re-migrate the servers.
AnswerA

Test instances enable safe troubleshooting before final cutover.

Why this answer

It follows the recommended MGN workflow for remediation: launch test instances to identify issues, fix them on the source server, and then perform a final cutover. Option B is inefficient as it restarts the entire replication and cutover process without testing. Option C is incorrect because restoring from a backup AMI is not part of the MGN migration process and does not allow iterative fixes.

Option D is wrong because CloudEndure Migration is the former name of MGN and is not a separate service for re-migration.

Full explanation →
828
MCQhard

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

A.Elastic Fabric Adapter (EFA)
B.Enhanced Networking (ENA)
C.VPC Peering
D.AWS Direct Connect
AnswerA

EFA provides low-latency, high-throughput inter-node communication for HPC.

Why this answer

Elastic Fabric Adapter (EFA) is a network interface that enables HPC and machine learning applications to achieve low-latency inter-node communication by bypassing the operating system kernel and providing OS-bypass capabilities via the Libfabric library. This is essential for tightly coupled HPC workloads like genomics research, where MPI (Message Passing Interface) jobs require microsecond-level latency and high throughput between compute nodes.

Exam trap

The trap here is that candidates confuse Enhanced Networking (ENA) with Elastic Fabric Adapter (EFA), assuming both provide similar low-latency benefits, but only EFA offers OS-bypass for HPC inter-node communication, while ENA still relies on kernel processing.

How to eliminate wrong answers

Option B (Enhanced Networking with ENA) is wrong because while it provides higher bandwidth and lower jitter than standard networking, it still operates through the kernel network stack and does not support OS-bypass, so it cannot achieve the ultra-low latency required for tightly coupled HPC inter-node communication. Option C (VPC Peering) is wrong because it is a logical connection between VPCs used for routing traffic, not a physical network adapter or interface; it does not reduce latency or provide OS-bypass for compute nodes within the same cluster. Option D (AWS Direct Connect) is wrong because it establishes a dedicated network connection from on-premises to AWS, not between compute nodes within a VPC; it is irrelevant to inter-node communication latency inside an HPC cluster.

Full explanation →
829
Multi-Selectmedium

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Select 3 answers
A.Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.
B.Configure a Multi-AZ deployment for the RDS database in the primary Region.
C.Deploy the application on Amazon Aurora Global Database.
D.Create an Amazon Machine Image (AMI) of the EC2 instances and copy it to the secondary Region. Use an Auto Scaling group to launch instances from the AMI.
E.Create a cross-Region read replica of the RDS MySQL database in the secondary Region.
AnswersA, D, E

Route 53 health checks and failover route traffic to the secondary Region when the primary fails.

Why this answer

Route 53 health checks can monitor the primary application's endpoint, and DNS failover to a secondary Region enables automatic traffic redirection within minutes, aligning with the 1-hour RTO. This approach provides a simple, stateless failover mechanism without requiring complex routing changes.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments (which provide high availability within a Region) with cross-Region disaster recovery, failing to recognize that Multi-AZ does not protect against a full Region outage.

Full explanation →
830
MCQmedium

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

A.Manual scaling by operations team
B.Simple scaling with a cooldown period
C.Scheduled scaling based on historical data
D.Target tracking scaling policy
AnswerD

Target tracking dynamically adjusts capacity to maintain a metric target.

Why this answer

Target tracking scaling policy is the correct choice because it automatically adjusts the number of EC2 instances to maintain a specified target metric (e.g., average CPU utilization or request count per target) without manual intervention. This policy uses a built-in metric and dynamically calculates the required capacity to handle sudden traffic spikes, aligning with the requirement for automatic scaling under unpredictable load.

Exam trap

The trap here is that candidates often confuse 'scheduled scaling' (which works for predictable patterns) with 'dynamic scaling' (which handles unpredictable spikes), and may overlook that target tracking is the only fully automated policy that continuously adjusts capacity based on a real-time metric without manual cooldown tuning.

How to eliminate wrong answers

Option A is wrong because manual scaling requires human intervention to add or remove instances, which cannot respond to sudden spikes in real time. Option B is wrong because simple scaling with a cooldown period uses a single step adjustment and then locks scaling actions during the cooldown, which can delay response to rapid traffic changes and cause under- or over-provisioning. Option C is wrong because scheduled scaling relies on predictable patterns from historical data and cannot react to unexpected spikes that deviate from the schedule.

Full explanation →
831
MCQeasy

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

A.S3 Object Lock in compliance mode.
B.S3 Versioning with a lifecycle policy.
C.S3 bucket policy denying s3:DeleteObject.
D.S3 MFA Delete.
AnswerA

Compliance mode prevents any user from deleting objects.

Why this answer

S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Exam trap

The trap here is that candidates often choose a bucket policy denying s3:DeleteObject, not realizing that the root user can bypass bucket policies by modifying them, whereas S3 Object Lock in compliance mode provides a true immutability guarantee that even the root user cannot override.

How to eliminate wrong answers

Option B is wrong because S3 Versioning alone does not prevent deletion; it only preserves previous versions of objects, and a user with sufficient permissions can still delete the current version or the entire object. Option C is wrong because a bucket policy denying s3:DeleteObject can be overridden by a user with administrative privileges (including the root user) who can modify or remove the policy itself. Option D is wrong because MFA Delete only adds an extra authentication factor for delete operations but does not prevent deletion by the root user if they have the MFA device; it also does not prevent overwrites or modifications.

Full explanation →
832
MCQmedium

Refer to the exhibit. A company is deploying a CloudFormation stack for a web application. The stack creation fails with the error 'The parameter DBPassword is not defined'. What is the most likely cause?

A.The DBPassword parameter is misspelled in the template
B.The DBPassword parameter is defined but used in a condition
C.The DBPassword parameter is not defined in the Parameters section
D.The DBPassword parameter is defined but the value is too short
AnswerC

Correct: The template lacks a Parameters section with DBPassword.

Why this answer

The template uses !Ref DBPassword, but DBPassword is not defined in the Parameters section of the template. CloudFormation requires parameters to be declared before they can be referenced. The other options are not indicated by the error message.

Full explanation →
833
MCQeasy

A company is designing a multi-account strategy for its development, testing, and production environments. The security team requires that all accounts share a centralized logging solution. Which approach meets this requirement with the LEAST administrative overhead?

A.Configure each account to write logs to its own S3 bucket and use AWS Glue to copy them to a central bucket.
B.Use AWS CloudTrail to deliver logs to a central S3 bucket in the logging account.
C.Use Amazon CloudWatch Logs in each account and view logs from a central account via cross-account access.
D.Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon OpenSearch Service.
AnswerB

CloudTrail can deliver to a single bucket across accounts via trail with organization-level settings.

Why this answer

AWS CloudTrail can be configured to deliver logs from multiple accounts to a single central S3 bucket in a logging account by setting up a CloudTrail trail in each account that points to the same bucket. This approach requires minimal administrative overhead as it leverages native AWS cross-account logging capabilities without additional data movement or transformation services.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing options that involve additional services (Glue, Kinesis, OpenSearch) or partial centralization (CloudWatch cross-account access), missing the simplicity and native support of CloudTrail's direct cross-account S3 delivery.

How to eliminate wrong answers

Option A is wrong because it introduces unnecessary complexity and administrative overhead by requiring each account to write logs to its own S3 bucket and then using AWS Glue to copy them to a central bucket; Glue is a serverless ETL service not designed for simple log replication, and this adds cost and management burden. Option C is wrong because while cross-account CloudWatch Logs access is possible, it requires setting up IAM roles and resource policies for each account and log group, and viewing logs from a central account does not centralize the logs themselves—logs remain in source accounts, increasing management overhead and potential access issues. Option D is wrong because using Kinesis Data Firehose in each account to stream logs to a central OpenSearch Service adds significant complexity, cost, and administrative overhead compared to a simple S3 bucket delivery, and OpenSearch Service is not a centralized logging solution by default—it requires additional configuration for log indexing and retention.

Full explanation →
834
Multi-Selectmedium

A company is using AWS Organizations and wants to delegate administration of Amazon GuardDuty to a member account. Which of the following are required? (Choose TWO.)

Select 2 answers
A.The delegated administrator must be the management account.
B.Register the member account as a delegated administrator for GuardDuty.
C.Enable GuardDuty in the management account.
D.Create an SCP that allows GuardDuty actions in the member account.
E.Enable GuardDuty in all member accounts.
AnswersB, C

Delegation is done via the management account.

Why this answer

AWS Organizations allows you to designate a member account as a delegated administrator for GuardDuty, which enables that account to manage GuardDuty across the organization without needing to use the management account. Option C is correct because GuardDuty must be enabled in the management account first to establish the service as the organization-level administrator before you can delegate administration to a member account.

Exam trap

The trap here is that candidates often assume the management account must always be the administrator for all services, but AWS allows delegating administration to a member account for services like GuardDuty, Security Hub, and Macie to follow the principle of least privilege.

Full explanation →
835
MCQeasy

A company is designing a new application that will process streaming data from IoT devices. The data must be ingested in real-time and stored in Amazon S3 for long-term analytics. Which AWS service should be used to ingest the streaming data?

A.Amazon Simple Notification Service (SNS)
B.Amazon Simple Queue Service (SQS)
C.AWS Database Migration Service (DMS)
D.Amazon Kinesis Data Streams
AnswerD

Amazon Kinesis Data Streams is purpose-built for real-time data streaming and can directly integrate with Amazon S3 for storage.

Why this answer

Amazon Kinesis Data Streams is designed for real-time data ingestion and can stream data directly to Amazon S3. Option A is wrong because SNS is a pub/sub messaging service, not intended for real-time data ingestion. Option B is wrong because SQS is a message queue service, not optimized for streaming ingestion.

Option C is wrong because AWS DMS is used for database migration, not for ingesting streaming data.

Full explanation →
836
MCQhard

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

A.Use Amazon Kinesis Data Streams to ingest data, AWS Lambda to process, and store in S3
B.Use Amazon Kinesis Data Firehose to ingest data, transform with Lambda, and store in S3
C.Use AWS Database Migration Service (DMS) to ingest data into Amazon S3
D.Use Amazon SQS to buffer data, and an EC2 Auto Scaling group to process and store in S3
AnswerA

Kinesis Data Streams provides sub-second ingestion, Lambda can process in real-time, and data retention allows reprocessing.

Why this answer

Amazon Kinesis Data Streams provides sub-second ingestion latency, which meets the under-1-second processing requirement. AWS Lambda can process each record with low latency and store the results directly in Amazon S3. Kinesis Data Streams also supports data replay for up to 365 days (default 24 hours), enabling reprocessing in case of errors.

Exam trap

The trap here is that candidates confuse Kinesis Data Firehose (which has higher latency due to buffering) with Kinesis Data Streams (which offers sub-second latency), leading them to choose Firehose for low-latency requirements.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose has a minimum buffering interval of 60 seconds, which cannot achieve the required sub-second latency. Option C is wrong because AWS Database Migration Service (DMS) is designed for database migration and change data capture, not for real-time streaming ingestion from IoT devices. Option D is wrong because Amazon SQS does not support sub-second latency for streaming data and requires polling, which adds overhead; EC2 Auto Scaling adds management complexity and cannot guarantee the same low-latency processing as Lambda.

Full explanation →
837
MCQeasy

A company wants to provide temporary, limited-privilege credentials to its application running on an EC2 instance so that the application can access an S3 bucket. What is the BEST practice for achieving this?

A.Use an S3 bucket policy to allow access from the EC2 instance's public IP
B.Create an IAM user and store the credentials in the EC2 instance user data
C.Store AWS access keys in the application code
D.Create an IAM role with the necessary permissions and attach it to the EC2 instance
AnswerD

An IAM role provides temporary credentials that are automatically rotated, which is secure and best practice.

Why this answer

The best practice is to use an IAM role, which provides temporary security credentials via the EC2 instance metadata service (IMDS). The application automatically retrieves these credentials without hardcoding secrets, and the credentials are rotated automatically by AWS. This approach follows the principle of least privilege and eliminates the security risks of long-term access keys.

Exam trap

The trap here is that candidates may think storing credentials in user data or code is acceptable for automation, but AWS explicitly prohibits this in favor of IAM roles for EC2 to avoid long-term credential exposure.

How to eliminate wrong answers

Option A is wrong because restricting access by EC2 instance public IP is not secure (IPs can change, and other AWS services or instances could share the same IP) and does not provide temporary credentials. Option B is wrong because storing IAM user credentials in EC2 user data exposes long-term access keys, which can be compromised and require manual rotation. Option C is wrong because hardcoding AWS access keys in application code is a severe security risk, as the keys are static, can be exposed in version control, and violate the principle of least privilege.

Full explanation →
838
MCQmedium

A company is implementing a multi-account strategy using AWS Organizations. They need to centralize logging of all API calls across accounts. Which solution meets this requirement with the least operational overhead?

A.Enable CloudWatch Logs in each account and stream to a central log group.
B.Create a CloudTrail trail in each account and aggregate logs to a central S3 bucket.
C.Create an organization trail in the management account with CloudTrail.
D.Enable S3 server access logs on all accounts and send to a central bucket.
AnswerC

Organization trail automatically logs all accounts, minimizing overhead.

Why this answer

AWS Organizations supports creating an organization trail in the management account that automatically logs API calls for all member accounts without requiring per-account configuration. This centralizes logging with minimal operational overhead, as CloudTrail handles the aggregation across the organization.

Exam trap

The trap here is that candidates often think they need to configure CloudTrail in each account individually (Option B) or use CloudWatch Logs streaming (Option A), missing the organization trail feature that automatically centralizes logging with zero per-account effort.

How to eliminate wrong answers

Option A is wrong because streaming CloudWatch Logs from each account to a central log group requires per-account setup and additional log delivery infrastructure, increasing operational overhead. Option B is wrong because creating individual CloudTrail trails per account and aggregating to a central S3 bucket still requires manual configuration in each account and does not leverage the automatic organization-wide trail feature. Option D is wrong because S3 server access logs capture only S3-specific requests, not all API calls across services, and they require per-bucket configuration, failing to meet the requirement of centralizing all API calls.

Full explanation →
839
Multi-Selectmedium

A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)

Select 2 answers
A.Use server-side encryption with S3 managed keys (SSE-S3)
B.Use client-side encryption with an AWS KMS managed key
C.Use server-side encryption with customer-provided keys (SSE-C)
D.Use client-side encryption with a master key stored in AWS Secrets Manager
E.Use server-side encryption with AWS KMS managed keys (SSE-KMS)
AnswersB, E

Client-side encryption with KMS also provides audit trail and key rotation.

Why this answer

Client-side encryption with an AWS KMS managed key allows the application to encrypt data before uploading to S3, providing full control over key usage and an audit trail via AWS CloudTrail for every KMS API call (e.g., Encrypt, Decrypt). Option E is correct because SSE-KMS uses AWS KMS to manage the encryption keys, automatically rotates them annually (when using a KMS key with automatic rotation enabled), and logs all key usage in CloudTrail, meeting the audit trail requirement.

Exam trap

The trap here is that candidates often assume SSE-S3 (Option A) provides an audit trail because it encrypts data at rest, but they overlook that SSE-S3 does not log key usage in CloudTrail, making it unsuitable for the audit requirement, while SSE-KMS (Option E) is the only server-side option that meets both audit and rotation needs.

Full explanation →
840
MCQeasy

A company uses AWS Organizations with multiple accounts. The central IT team wants to restrict the use of specific EC2 instance types across all accounts to control costs. Which approach should the team use?

A.Use AWS Budgets to send alerts when costs exceed a threshold.
B.Configure Amazon CloudWatch Events to detect launches and terminate instances.
C.Attach an IAM policy to each account's root user to deny the ec2:RunInstances action for certain instance types.
D.Create a service control policy (SCP) that denies the ec2:RunInstances action for prohibited instance types and apply it to the organization.
AnswerD

SCPs apply to all accounts in the organization.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts in an AWS Organization. By creating an SCP that denies the ec2:RunInstances action for specific instance types and applying it to the organization (or relevant OUs), the central IT team can enforce this restriction globally, preventing any IAM principal in any account from launching prohibited instance types, regardless of their IAM permissions.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, thinking that attaching a deny policy to the root user or individual IAM users is sufficient, but SCPs are the only mechanism that can enforce restrictions across all principals in an AWS Organization account, including the root user.

How to eliminate wrong answers

Option A is wrong because AWS Budgets only sends cost alerts and does not enforce restrictions on resource creation; it cannot prevent the launch of specific instance types. Option B is wrong because Amazon CloudWatch Events can detect instance launches and trigger a Lambda function to terminate them, but this is a reactive, non-deterministic approach that incurs cost and latency, and instances may run briefly before termination. Option C is wrong because attaching an IAM policy to each account's root user does not prevent other IAM users or roles in the account from launching instances, and it is not scalable across many accounts; SCPs are the only way to apply a deny across all principals in an account.

Full explanation →
841
MCQeasy

A company is migrating an on-premises application to AWS. The application requires dedicated hardware for licensing compliance. Which AWS service should the company use to meet this requirement?

A.Amazon EC2 Dedicated Hosts
B.AWS Elastic Beanstalk
C.Amazon EC2 Reserved Instances
D.Amazon Virtual Private Cloud (VPC)
AnswerA

Dedicated Hosts provide physical servers dedicated for your use, meeting licensing needs.

Why this answer

Amazon EC2 Dedicated Hosts provide physical servers fully dedicated to your use, enabling you to use existing server-bound software licenses that require dedicated hardware. Option A is correct. Option B (Elastic Beanstalk) is a PaaS service and does not provide dedicated hardware.

Option C (Reserved Instances) offers a billing discount but does not guarantee dedicated physical servers. Option D (VPC) is a virtual network service and does not provide dedicated hardware.

Full explanation →
842
Multi-Selecteasy

A company is planning to migrate its on-premises Oracle database to Amazon RDS for Oracle. Which actions should the company take to minimize downtime during the migration? (Choose TWO.)

Select 2 answers
A.Take a full backup of the on-premises database and restore it to RDS during a maintenance window.
B.Use AWS Direct Connect to establish a dedicated network connection for faster data transfer.
C.Increase the allocated storage on the target RDS instance to improve write performance.
D.Use AWS Schema Conversion Tool (SCT) to convert the schema and optimize for RDS.
E.Use AWS Database Migration Service (DMS) with ongoing replication to keep the target in sync.
AnswersD, E

SCT helps convert schema and identify potential issues, reducing downtime.

Why this answer

Options D and E are correct. AWS Schema Conversion Tool (SCT) converts the schema to be compatible with Amazon RDS for Oracle, reducing compatibility issues. AWS Database Migration Service (DMS) with ongoing replication allows continuous sync from the source to target, minimizing downtime during migration.

Option A (full backup and restore) requires downtime during the restore. Option B (Direct Connect) improves transfer speed but does not directly minimize downtime; it's a network enhancement. Option C (increased storage) improves write performance but does not minimize migration downtime.

Full explanation →
843
MCQhard

A company runs a critical e-commerce platform on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances running a web server. The web servers store session data locally on the instance's ephemeral storage. The Auto Scaling group is configured with a min of 2, max of 10, and desired of 2. Recently, during a flash sale, traffic surged and the Auto Scaling group scaled out to 10 instances. However, many users reported that their shopping carts were lost and they were logged out during the event. The Cognito user pool was used for authentication, and the application uses cookies to maintain session state. The ALB's stickiness is enabled. The team observed that the ALB's RequestCountPerTarget metric was well below the instance's capacity, but the error rate increased. The CloudWatch logs show that the web server returned 503 errors for a subset of requests. After the flash sale ended, the Auto Scaling group scaled back to 2 instances, and the issue disappeared. The team wants to prevent this from happening in future events. Which solution should the Solutions Architect recommend?

A.Increase the minimum size of the Auto Scaling group to 10 to handle the surge without scaling down.
B.Disable stickiness on the ALB so that any instance can handle any request.
C.Modify the application to store session data in an Amazon ElastiCache for Redis cluster instead of local ephemeral storage.
D.Increase the health check interval on the ALB to prevent instances from being marked unhealthy too quickly.
AnswerC

This decouples sessions from instances, making them persistent across scaling events and instance replacements.

Why this answer

The root cause is that session data stored on ephemeral storage is lost when instances are terminated or replaced. Even with ALB stickiness, if an instance is terminated (e.g., due to scaling in or health check failure), the session data is gone. Option C solves this by storing sessions externally in ElastiCache, which persists independently of EC2 instances, ensuring sessions survive scaling events.

Option A would prevent scaling in but does not address data loss if instances become unhealthy or replaced. Option B would make the problem worse because without stickiness, requests could go to different instances, causing session loss even without termination. Option D only delays health checks and does not solve data loss.

Full explanation →
844
MCQeasy

A company is migrating a legacy application that uses an Oracle database to AWS. The application is critical and requires high availability with automatic failover. The company wants to use Amazon RDS for Oracle. The database size is 200 GB. The company needs a solution that provides automatic failover to a standby instance in a different Availability Zone with minimal downtime. Which RDS deployment option should the company use?

A.Multi-Region deployment with Read Replicas
B.Single-AZ deployment with Oracle Data Guard
C.Single-AZ deployment with automatic backups
D.Multi-AZ deployment
AnswerD

Multi-AZ provides automatic failover with a standby in a different AZ.

Why this answer

Multi-AZ deployment. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, resulting in minimal downtime.

Option A is incorrect because Multi-Region with Read Replicas is designed for read scaling and disaster recovery, not automatic failover with minimal downtime. Option B is incorrect because Single-AZ with Oracle Data Guard requires manual setup and management, and does not provide the same level of automated failover as Multi-AZ. Option C is incorrect because Single-AZ deployment lacks a standby instance; automatic backups do not provide failover capability.

Full explanation →
845
MCQeasy

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

A.Set up VPC Flow Logs at the VPC level and CloudTrail at the account level, then use Lambda to copy logs to the central bucket.
B.Use AWS Config rules to detect when logs are not being sent and automatically re-enable logging.
C.Create an organization trail in CloudTrail and store logs in the central bucket. Attach an SCP to the root that denies s3:PutBucketPolicy for the central bucket.
D.Create individual trails per account and use S3 cross-region replication to copy logs to the central bucket.
AnswerC

Organization trail automatically applies to all accounts; SCP prevents disabling logging by blocking bucket policy changes.

Why this answer

AWS Organizations allows you to create service control policies (SCPs) that can deny actions across accounts. Using an SCP to deny the s3:PutBucketPolicy action on the central bucket ensures that no account can change the bucket policy to block log delivery. Additionally, enabling CloudTrail for all regions and all accounts with an organization trail ensures automatic log delivery.

Option C meets both requirements.

Full explanation →
846
Multi-Selectmedium

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. They need to store session state for the application. Which TWO services can they use for this purpose?

Select 2 answers
A.Amazon EFS
B.Amazon RDS
C.Amazon S3
D.Amazon ElastiCache for Redis
E.Amazon DynamoDB
AnswersD, E

Redis is commonly used for session state.

Why this answer

Amazon ElastiCache for Redis (option D) is commonly used for session state due to its low latency and in-memory data store capabilities. Amazon DynamoDB (option E) is also suitable for session state as it provides low-latency, scalable, and fully managed NoSQL database. Option A (Amazon EFS) is a file storage service, not ideal for session state.

Option B (Amazon RDS) is a relational database, which can be used but is not optimal for high-performance session state. Option C (Amazon S3) is an object store with higher latency, making it unsuitable for real-time session management.

Full explanation →
847
MCQeasy

A DevOps team wants to automatically enforce tagging standards on all AWS resources created in an account. If a resource is created without the required tags, the team wants to prevent the creation or remediate it. Which AWS service should the team use?

A.AWS Config
B.AWS Organizations
C.AWS Identity and Access Management (IAM)
D.AWS Resource Groups & Tag Editor
AnswerA

Can evaluate resource compliance and trigger remediation actions.

Why this answer

AWS Config can evaluate resource compliance using managed rules (e.g., required-tags) and automatically remediate non-compliant resources via AWS Config remediation actions or AWS Systems Manager Automation. Option B is incorrect because AWS Organizations manages organizational units and service control policies, not resource-level tag enforcement. Option C is incorrect because IAM controls permissions, not tagging standards.

Option D is incorrect because AWS Resource Groups & Tag Editor helps manage tags but does not prevent or auto-remediate non-compliant resource creation.

Full explanation →
848
MCQmedium

A company is designing a new web application that requires a scalable, low-latency key-value store for session state. The application runs on EC2 instances in an Auto Scaling group. Which solution is the MOST cost-effective and scalable?

A.Store session state on the local instance store of each EC2 instance.
B.Use Amazon ElastiCache for Redis.
C.Store session state in Amazon DynamoDB.
D.Store session state in Amazon RDS for MySQL.
AnswerB

ElastiCache Redis is optimized for low-latency key-value storage and is cost-effective.

Why this answer

Amazon ElastiCache for Redis provides a fully managed, in-memory key-value store that delivers ultra-low latency (sub-millisecond) for session state access. It is highly scalable, supports replication and clustering, and is more cost-effective than DynamoDB for high-throughput session workloads because it avoids per-request read/write costs and provides automatic failover for high availability.

Exam trap

The trap here is that candidates often choose DynamoDB (Option C) because it is serverless and scalable, but they overlook that for session state, an in-memory cache like Redis is more cost-effective and provides lower latency, while DynamoDB's per-request costs and higher latency make it less optimal for this specific use case.

How to eliminate wrong answers

Option A is wrong because storing session state on the local instance store of each EC2 instance is not scalable (state is lost on instance termination or replacement) and cannot be shared across instances in an Auto Scaling group, leading to session loss during scaling events. Option C is wrong because Amazon DynamoDB, while scalable and durable, is not the most cost-effective for session state due to its per-request pricing and higher latency compared to an in-memory cache like Redis, especially for high-frequency read/write workloads. Option D is wrong because Amazon RDS for MySQL is a relational database with higher latency and cost for key-value session storage, and it lacks the in-memory performance and simple key-value access patterns needed for low-latency session state.

Full explanation →
849
MCQhard

A company is designing a new cloud-native application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application handles user authentication using Amazon Cognito User Pools. During a stress test, the team notices that some requests are failing with HTTP 503 (Service Unavailable) errors. The CloudWatch logs show that Lambda functions are being throttled, and the DynamoDB table is experiencing high write throttling. The team needs to resolve these issues while maintaining low latency. Which solution is the MOST effective?

A.Set Lambda reserved concurrency to a value that covers peak load and enable DynamoDB auto scaling with a target utilization of 70%.
B.Use Amazon SQS to buffer requests to Lambda and configure a DynamoDB Accelerator (DAX) cluster for caching.
C.Increase the DynamoDB write capacity units to the maximum expected peak and configure Lambda provisioned concurrency.
D.Replace AWS Lambda with Amazon ECS on Fargate and use an Application Auto Scaling target tracking policy.
AnswerA

Reserved concurrency guarantees Lambda capacity; DynamoDB auto scaling adjusts capacity automatically.

Why this answer

Setting Lambda reserved concurrency ensures that the function always has capacity available to handle peak load without being throttled by the account-level concurrency limit, while DynamoDB auto scaling with a target utilization of 70% dynamically adjusts write capacity to match traffic patterns, preventing write throttling. This combination directly addresses both throttling issues without introducing additional latency from buffering or caching layers.

Exam trap

The trap here is that candidates often assume buffering with SQS or caching with DAX will solve throttling, but these add latency or only address reads, not writes, while the correct solution directly manages concurrency and write capacity scaling.

How to eliminate wrong answers

Option B is wrong because using Amazon SQS to buffer requests to Lambda introduces additional latency and does not resolve the root cause of Lambda throttling or DynamoDB write throttling; DAX caches reads, not writes, so it does not help with write throttling. Option C is wrong because increasing DynamoDB write capacity units to the maximum expected peak is cost-inefficient and does not adapt to variable traffic, while Lambda provisioned concurrency is a valid approach but the option lacks the complementary DynamoDB scaling strategy needed for write throttling. Option D is wrong because replacing Lambda with Amazon ECS on Fargate adds operational complexity and does not directly address the throttling issues; Application Auto Scaling for ECS does not solve DynamoDB write throttling, and the migration is unnecessary for a serverless application.

Full explanation →
850
MCQhard

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

A.Use Amazon SQS to buffer write requests to the database.
B.Use DynamoDB Accelerator (DAX) as a caching layer.
C.Use Amazon RDS Proxy to pool and share database connections.
D.Increase the max_connections parameter in the RDS parameter group.
AnswerC

RDS Proxy manages connection pooling, reducing connection exhaustion from Lambda.

Why this answer

Amazon RDS Proxy sits between the Lambda function and the RDS database, managing a pool of database connections and reusing them across multiple invocations. This prevents the Lambda function from exhausting the database connection pool during traffic spikes, as each Lambda instance does not need to open its own connection. RDS Proxy also handles connection multiplexing and reduces the overhead of establishing new connections.

Exam trap

The trap here is that candidates often think increasing max_connections or using a queue (SQS) is sufficient, but they overlook that Lambda's concurrent execution model requires connection pooling at the database layer, which RDS Proxy uniquely provides.

How to eliminate wrong answers

Option A is wrong because Amazon SQS buffers write requests but does not address the root cause of connection exhaustion; it only decouples the write path, leaving read operations and other direct database interactions still vulnerable to connection pool exhaustion. Option B is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB, not for Amazon RDS for PostgreSQL, and it cannot pool or manage database connections. Option D is wrong because increasing the max_connections parameter only raises the limit, but does not prevent Lambda from opening too many connections; it can lead to resource contention and still exhaust database resources under high concurrency.

Full explanation →
851
Multi-Selectmedium

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

Select 3 answers
A.Configure cross-region replication for the RDS instance using a read replica.
B.Use AWS Database Migration Service (DMS) for continuous replication.
C.Create AMIs of the EC2 instances every hour.
D.Enable automated backups for the RDS instance with a retention period of 1 hour.
E.Schedule EBS snapshots every hour and replicate them to another region.
AnswersA, D, E

Provides a standby in another region with low RPO.

Why this answer

To achieve RTO of 2 hours and RPO of 1 hour, the company should combine RDS cross-region read replicas (option A) for near-real-time replication, RDS automated backups (option D) for point-in-time recovery, and EBS snapshots every hour with cross-region replication (option E) for EC2 instances. Option A provides asynchronous replication to another region. Option D allows restoring to any point within the retention period.

Option E ensures EBS volumes can be recovered in another region. Option B (AWS DMS) is typically used for database migrations, not as a primary DR replication method. Option C is incorrect because creating AMIs every hour is inefficient and does not provide the required RPO for data; EBS snapshots are more appropriate.

Full explanation →
852
MCQeasy

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

A.Place the Lambda function outside the VPC and use a NAT gateway to reach the database
B.Place the Lambda function inside the VPC with a security group allowing access to the database
C.Use Amazon RDS Proxy to manage connections and keep Lambda outside the VPC
D.Use an Amazon VPC interface endpoint for Lambda and keep the function outside the VPC
AnswerD

Interface endpoints allow VPC access without placing Lambda in the VPC, reducing cold starts.

Why this answer

Using an Amazon VPC interface endpoint for Lambda allows the function to remain outside the VPC while securely accessing resources inside the VPC via AWS PrivateLink. This avoids the cold start latency penalty (often 10+ seconds) incurred when attaching a Lambda function to a VPC, which requires Elastic Network Interface (ENI) creation. The function can directly invoke the database through the interface endpoint without traversing the public internet or needing a NAT gateway.

Exam trap

The trap here is that candidates assume Lambda must be placed inside the VPC to access VPC resources, overlooking that VPC interface endpoints (PrivateLink) allow secure, low-latency access without the cold start penalty of VPC attachment.

How to eliminate wrong answers

Option A is wrong because placing the Lambda function outside the VPC and using a NAT gateway would still require the function to traverse the internet to reach the database, introducing latency and security risks; moreover, NAT gateways are not designed for Lambda-to-VPC database access without VPC attachment. Option B is wrong because placing the Lambda function inside the VPC introduces significant cold start latency (often 10–30 seconds) due to the need to create and attach an ENI to the function's execution environment, which is especially problematic for a 5-minute timeout workload. Option C is wrong because Amazon RDS Proxy manages database connections but does not eliminate the need for the Lambda function to be inside the VPC or use a VPC endpoint; keeping Lambda outside the VPC without a VPC endpoint would still require public internet access or a NAT gateway, defeating the purpose of RDS Proxy's connection pooling.

Full explanation →
853
MCQhard

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

A.Increase the read capacity units for the table.
B.Add a DynamoDB Accelerator (DAX) cluster in front of the table.
C.Switch the table to DynamoDB On-Demand capacity mode.
D.Enable DynamoDB Auto Scaling for write capacity.
AnswerD

Auto Scaling dynamically adjusts write capacity to handle peak loads.

Why this answer

DynamoDB Auto Scaling adjusts write capacity based on actual usage, reducing throttling without manual intervention. Option A is wrong because increasing read capacity does not help with write throttling. Option B is wrong because DAX is a cache for read operations, not writes.

Option C is wrong because while switching to On-Demand mode can eliminate throttling, it may be more expensive than Auto Scaling if the workload is predictable; Auto Scaling is the more cost-effective solution for this scenario.

Full explanation →
854
MCQmedium

A company plans to migrate a relational database to Amazon RDS for MySQL. They need to minimize downtime during the migration. The source database is running on-premises. Which strategy should they use?

A.Use AWS Database Migration Service (DMS) with ongoing replication.
B.Use AWS Snowball to transfer the data.
C.Use mysqldump to export the database and import into RDS.
D.Create a read replica of the on-premises database in RDS.
AnswerA

DMS supports continuous replication with minimal downtime.

Why this answer

AWS DMS with ongoing replication allows the source database to remain operational during migration, minimizing downtime. Option B is incorrect because AWS Snowball is designed for large-scale offline data transfer, not for ongoing replication to minimize downtime. Option C is incorrect because mysqldump requires taking a backup which causes downtime during the export/import process.

Option D is incorrect because a read replica can only be created from a source that is already in RDS, not from an on-premises database.

Full explanation →
855
Multi-Selecteasy

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

Select 2 answers
A.Increase the Lambda function's reserved concurrency.
B.Increase the memory allocation for the Lambda function.
C.Modify the function to stream the file from S3 instead of downloading it entirely.
D.Increase the Lambda function timeout.
E.Increase the /tmp storage limit for the Lambda function.
AnswersC, D

Streaming reduces the time spent on I/O and eliminates the need to store the entire file in /tmp.

Why this answer

The correct answers are C and D. Option C (streaming the file from S3) reduces download time and eliminates the need to store the entire file in /tmp, directly improving performance by lowering I/O latency. Option D (increasing the Lambda timeout) provides more time for the function to complete processing, preventing timeouts.

Option B (increasing memory) does not directly address the root cause of the timeout (slow file download), and its CPU benefit is secondary. Option A (reserved concurrency) affects scaling, not individual execution time. Option E (/tmp storage) is ephemeral and does not impact performance.

Full explanation →
856
MCQhard

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

A.Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket
B.Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts
C.Create VPC endpoints in each account to connect to the central S3 bucket
D.Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group
AnswerB

VPC Flow Logs support cross-account delivery to S3 with appropriate bucket policy.

Why this answer

VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Exam trap

The trap here is that candidates assume cross-account S3 delivery requires a VPC endpoint or a streaming service like Firehose, but AWS natively supports direct cross-account S3 delivery for VPC Flow Logs via bucket policies.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose adds unnecessary complexity and cost; VPC Flow Logs can natively deliver to S3 without requiring Firehose. Option C is wrong because VPC endpoints provide private connectivity to S3 but do not enable cross-account log delivery; the bucket policy is the mechanism for cross-account access. Option D is wrong because publishing to a central CloudWatch Logs group does not place logs in the central S3 bucket as required, and CloudWatch Logs is not the target specified in the question.

Full explanation →
857
MCQmedium

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a specific member account. What must be done?

A.Create an IAM role in the member account with permissions to manage Identity Center
B.Use the AWS Organizations console to register the member account as a delegated administrator for IAM Identity Center
C.Attach an SCP to the member account allowing Identity Center actions
D.Create a new user in the management account with admin privileges
AnswerB

This grants the member account admin rights over Identity Center.

Why this answer

To delegate administration of IAM Identity Center to a specific member account in AWS Organizations, you must register that account as a delegated administrator using the AWS Organizations console or API. This grants the member account the necessary permissions to manage Identity Center settings, users, and groups without requiring the management account to perform all tasks. Option B is correct because it follows the official AWS mechanism for delegating administrative control of Identity Center to a member account.

Exam trap

The trap here is that candidates often confuse delegating administration with simply granting IAM permissions via roles or SCPs, not realizing that AWS requires a specific registration process through Organizations to enable delegated administration for Identity Center.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in the member account with permissions to manage Identity Center does not establish the required delegation relationship; Identity Center delegation must be registered at the Organizations level, not via a local IAM role. Option C is wrong because attaching a service control policy (SCP) to the member account only restricts or allows actions at the account level but does not delegate administrative authority for Identity Center; SCPs are for permission boundaries, not delegation. Option D is wrong because creating a new user in the management account with admin privileges does not delegate administration to a member account; it keeps all control in the management account and does not enable the member account to manage Identity Center independently.

Full explanation →
858
Multi-Selecteasy

A company is migrating an on-premises application to AWS. The application stores files on a Windows file server. The company wants to replace the file server with a managed AWS service that supports SMB protocol and integrates with Active Directory. Which TWO AWS services should the company consider? (Choose TWO.)

Select 2 answers
A.Amazon Elastic Block Store (EBS).
B.Amazon Elastic File System (EFS).
C.Amazon S3 with S3 File Gateway.
D.Amazon FSx for Windows File Server.
E.AWS Storage Gateway File Gateway.
AnswersD, E

Fully managed Windows file server with SMB and AD support.

Why this answer

The correct options are D and E. Amazon FSx for Windows File Server (D) is a fully managed Windows file server that supports the SMB protocol and integrates with Active Directory. AWS Storage Gateway File Gateway (E) provides on-premises access to cloud storage via SMB and can integrate with Active Directory.

Option A (EBS) is block storage, not a file server. Option B (EFS) uses NFS, not SMB. Option C (S3 with S3 File Gateway) does not support SMB natively; S3 File Gateway only presents objects as files via NFS or SMB, but it is not a managed SMB file server like FSx.

Full explanation →
859
MCQeasy

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

A.Create a scheduled scaling action to add instances at peak times.
B.Create a simple scaling policy that adds one instance when CPU exceeds 50%.
C.Create a step scaling policy based on a CloudWatch alarm for CPU utilization.
D.Configure the ALB health check to mark instances unhealthy if CPU is high.
AnswerC

Step scaling adjusts capacity based on alarm thresholds.

Why this answer

A step scaling policy allows the Auto Scaling group to adjust capacity in increments based on the severity of a CloudWatch alarm, such as one monitoring CPU utilization. This provides more granular and responsive scaling than simple policies, as it can add or remove instances in steps (e.g., add 2 instances when CPU > 70%, add 1 when CPU > 50%) and supports cooldown and warm-up logic to avoid thrashing.

Exam trap

The trap here is that candidates often confuse simple scaling policies with step scaling policies, assuming any policy based on a CloudWatch alarm is sufficient, but simple scaling lacks the multi-step responsiveness needed for dynamic CPU-based scaling and can lead to under-provisioning during rapid load changes.

How to eliminate wrong answers

Option A is wrong because scheduled scaling actions are time-based and do not respond to real-time CPU utilization; they are used for predictable traffic patterns, not dynamic scaling. Option B is wrong because a simple scaling policy can only perform a single adjustment (e.g., add one instance) when a CloudWatch alarm triggers, and it requires waiting for the entire cooldown period before responding to another alarm, making it less responsive and prone to oscillation. Option D is wrong because ALB health checks are designed to determine instance health based on application-level responses (e.g., HTTP 200), not CPU utilization; marking instances unhealthy based on CPU would cause the ALB to stop routing traffic, potentially dropping valid requests, and is not a supported mechanism for Auto Scaling.

Full explanation →
860
MCQmedium

A company is using Amazon CloudFront to serve content from an S3 origin. The content is updated infrequently. Users in some regions report seeing stale content. The company wants to ensure that users always see the latest version without waiting for TTL expiration. What is the MOST cost-effective solution?

A.Use file versioning in the URL (e.g., appending a query string or using a unique object key).
B.Set a very short TTL (e.g., 0 seconds) for the CloudFront distribution.
C.Use an origin shield to reduce the number of requests to S3.
D.Create a CloudFront invalidation request for the changed files after each update.
AnswerA

Unique URLs force CloudFront to fetch new content from origin.

Why this answer

File versioning (changing the URL or appending a query string) is the most cost-effective solution because it guarantees that users always fetch the latest version from the origin without waiting for TTL expiration. This approach avoids the costs associated with CloudFront invalidations (Option D) and does not increase load on the origin as a very short TTL would (Option B). Option C (origin shield) helps reduce requests to the origin but does not force existing cached content to be refreshed.

Therefore, file versioning is the best practice for infrequently updated content.

Full explanation →
861
MCQhard

A company is migrating a large-scale Apache Kafka cluster to Amazon MSK. The cluster has 100 topics with high throughput. The team wants to minimize operational overhead and ensure high availability. Which configuration should be used?

A.Use Amazon Kinesis Data Streams with enhanced fan-out.
B.Use Amazon SQS FIFO queues with message deduplication.
C.Deploy Apache Kafka on Amazon EC2 with Spot Instances and EBS volumes.
D.Provision an Amazon MSK cluster with 3 brokers per AZ across 3 AZs.
AnswerD

MSK is a managed Kafka service; multi-AZ provides high availability.

Why this answer

Amazon MSK is a fully managed service for Apache Kafka that reduces operational overhead. Deploying an MSK cluster with 3 brokers per AZ across 3 AZs provides high availability and fault tolerance, as data is replicated across AZs. Option A is wrong because Kinesis Data Streams is a different streaming service with different semantics and not a drop-in replacement for Kafka.

Option B is wrong because SQS FIFO queues are not designed for high-throughput pub/sub streaming like Kafka. Option C is wrong because self-managing Kafka on EC2 increases operational overhead, which the team wants to minimize.

Full explanation →
862
Multi-Selectmedium

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

Select 3 answers
A.Migrate the database to Amazon RDS with Multi-AZ deployment.
B.Use an EBS volume with higher IOPS to improve performance.
C.Store data on the instance store instead of EBS to reduce latency.
D.Place the EC2 instance in an Auto Scaling group that spans multiple Availability Zones.
E.Place the EC2 instances behind an Application Load Balancer.
AnswersA, D, E

Multi-AZ provides automatic failover for the database.

Why this answer

Amazon RDS with Multi-AZ deployment provides automatic failover and high availability for the database. Option D is correct because placing the EC2 instance in an Auto Scaling group that spans multiple Availability Zones ensures compute resources are available even if one AZ fails. Option E is correct because an Application Load Balancer distributes traffic across healthy instances and supports health checks, improving application availability.

Option B is incorrect because higher IOPS improves performance but not availability. Option C is incorrect because instance store is ephemeral and data is lost on instance failure, reducing durability and availability.

Full explanation →
863
MCQeasy

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

A.Amazon S3
B.Amazon EC2
C.Amazon Route 53
D.Amazon CloudFront
AnswerD

CloudFront is a CDN for low-latency delivery.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches content at edge locations worldwide, reducing latency by serving data from the nearest edge to the user. It integrates with origins like S3, EC2, or on-premises servers and supports both static and dynamic content acceleration, making it the correct choice for low-latency global delivery.

Exam trap

The trap here is that candidates often confuse Amazon S3's static website hosting or Route 53's latency-based routing with actual content delivery, but neither provides the edge caching and global distribution that CloudFront offers for low-latency delivery.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service, not a content delivery network; it stores data in a single region and does not provide global edge caching or low-latency distribution on its own. Option B is wrong because Amazon EC2 is a compute service that runs virtual servers in specific regions; it lacks built-in global edge caching and would require manual scaling and additional services to achieve low-latency delivery worldwide. Option C is wrong because Amazon Route 53 is a DNS and traffic management service; it resolves domain names to IP addresses but does not cache or deliver content, so it cannot reduce latency for content delivery.

Full explanation →
864
MCQhard

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

A.Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.
B.Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.
C.Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.
D.Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.
AnswerA

EC2 Image Builder automates AMI creation and replication, meeting RPO with scheduled builds and RTO by launching instances from the replicated AMI.

Why this answer

EC2 Image Builder automates weekly AMI creation and replication to another Region, ensuring a recent AMI is available for quick instance launch (meeting the 4-hour RTO). For the 15-minute RPO, the DR strategy relies on complementary data replication mechanisms (e.g., database or storage replication) which are more cost-effective than full server replication. Option A is the most efficient approach for the AMI component, while Options C and B are either unnecessarily costly or misaligned, and Option D is manual and error-prone.

Full explanation →
865
MCQeasy

A company hosts a static website on Amazon S3 with public read access. The website uses a custom domain name (www.example.com). The company wants to improve performance for global users and also add HTTPS support. They have already set up a CloudFront distribution with the S3 bucket as the origin. However, users still cannot access the website via HTTPS. What should they do?

A.Request an SSL certificate from AWS Certificate Manager (ACM) and import it into CloudFront.
B.Enable static website hosting on the S3 bucket and configure the bucket policy to allow HTTPS.
C.Place an Application Load Balancer in front of the S3 bucket and attach an SSL certificate.
D.Configure the CloudFront distribution to use a custom SSL certificate and set the alternate domain name (CNAME) to www.example.com.
AnswerD

It involves configuring the CloudFront distribution to use a custom SSL certificate from ACM and setting the alternate domain name to www.example.com, which enables HTTPS access.

Why this answer

To serve HTTPS, CloudFront needs an SSL/TLS certificate associated with it, and the custom domain (www.example.com) must be set as an alternate domain name (CNAME) in the distribution settings. The certificate can be obtained from ACM (must be in the US East (N. Virginia) region) and then associated with the CloudFront distribution.

Option A is incorrect because ACM certificates are not imported into CloudFront; they are associated with the distribution. Option B is incorrect because enabling static website hosting on S3 is not required when using CloudFront as a CDN, and bucket policies cannot enforce HTTPS at the S3 level; HTTPS is terminated at CloudFront. Option C is incorrect because placing an Application Load Balancer in front of S3 is unnecessary, as CloudFront already provides HTTPS termination and caching for better performance.

Full explanation →
866
MCQmedium

A company is migrating 50 on-premises web applications to AWS. Each application has a different OS and middleware. The migration must minimize downtime and use a pay-as-you-go model. Which AWS service should the company use to standardize the deployment of these applications?

A.AWS CloudFormation
B.AWS Application Migration Service
C.AWS Server Migration Service
D.AWS Database Migration Service
AnswerB

Application Migration Service automates lift-and-shift for applications.

Why this answer

AWS Application Migration Service automates lift-and-shift migration of applications from on-premises to AWS, minimizing downtime and supporting heterogeneous environments with a pay-as-you-go model. Option A is wrong because AWS CloudFormation is for infrastructure as code, not for migrating applications. Option C is wrong because AWS Server Migration Service is deprecated and lacks the features of Application Migration Service.

Option D is wrong because AWS Database Migration Service is specifically for databases, not general applications.

Full explanation →
867
MCQhard

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

A.A policy that denies all IAM and organization actions except for viewing.
B.A policy that allows all IAM actions and denies organizations:CreateAccount and organizations:UpdateOrganizationalUnit.
C.A policy that allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization.
D.A policy that allows iam:* and denies organizations:CreateAccount, organizations:CreateOrganizationalUnit, organizations:UpdateOrganizationalUnit, and organizations:DeleteOrganizationalUnit.
AnswerD

This allows IAM management while denying organization structure changes.

Why this answer

It grants the OU administrators full IAM permissions (iam:*) to manage roles and policies within their own OUs, while explicitly denying the specific Organizations API actions that could alter the OU structure (CreateOrganizationalUnit, UpdateOrganizationalUnit, DeleteOrganizationalUnit) or create new accounts (CreateAccount). This policy ensures administrators can perform their required tasks without being able to modify the organizational hierarchy or provision new accounts, aligning with the principle of least privilege.

Exam trap

The trap here is that candidates often confuse IAM policies with Service Control Policies (SCPs) or forget to deny all relevant OU-modifying actions (CreateOrganizationalUnit, UpdateOrganizationalUnit, DeleteOrganizationalUnit) in addition to CreateAccount, leading them to choose an incomplete policy like Option B.

How to eliminate wrong answers

Option A is wrong because denying all IAM and organization actions except for viewing would prevent OU administrators from managing IAM roles and policies, which is the core requirement. Option B is wrong because it allows all IAM actions but only denies CreateAccount and UpdateOrganizationalUnit; it does not deny CreateOrganizationalUnit or DeleteOrganizationalUnit, leaving the OU structure vulnerable to modification. Option C is wrong because it allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization, which is overly permissive—it permits creating new accounts and modifying OUs, violating the requirement to prevent such changes.

Full explanation →
868
MCQeasy

A company is running a stateless web application on Amazon EC2 instances in an Auto Scaling group. The application stores session data in an Amazon ElastiCache Redis cluster. After a recent deployment, users are being logged out frequently. What is the most likely cause?

A.The Auto Scaling group's min size is too small.
B.The Elastic Load Balancer's health check is too aggressive.
C.The application is not using the ElastiCache cluster for session storage.
D.The ElastiCache cluster's security group is blocking traffic from the ALB.
AnswerC

If sessions are stored locally on EC2 instances, they are lost when instances are terminated or scaled, causing logouts.

Why this answer

The most likely cause is that the application is not using the ElastiCache cluster for session storage. If the application fails to properly store session data in Redis, sessions will not persist across instances. This becomes evident after a deployment if the configuration or code change inadvertently disables Redis session handling.

Option A is incorrect because a small Auto Scaling group min size does not cause logouts; it affects capacity. Option B is incorrect because an aggressive health check might cause instance replacement, but if sessions are stored in Redis, users should not be logged out. Option D is incorrect because the ALB does not directly interact with ElastiCache; security group issues would cause connection failures, not intermittent logouts.

Full explanation →
869
MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

A.Use the RDS Multi-AZ DNS name (CNAME) that automatically updates after failover.
B.Assign an Elastic IP address to the RDS instance.
C.Create a read replica in another Region and promote it during failover manually.
D.Configure a Network Load Balancer in front of the RDS instance.
AnswerA

The Multi-AZ DNS name automatically points to the new primary after failover.

Why this answer

The RDS Multi-AZ deployment automatically provides a CNAME (DNS name) that always points to the current primary instance. After a failover, this CNAME is updated to point to the new primary, so the application using this DNS name will experience minimal downtime. Option B is incorrect because Elastic IP addresses are not supported for RDS instances; they are used for EC2 instances.

Option C is incorrect because a read replica in another Region is designed for disaster recovery and read scaling, not for automatic failover within the same region; manual promotion would cause significant downtime. Option D is incorrect because a Network Load Balancer adds unnecessary complexity and latency; RDS Multi-AZ already provides automatic failover with DNS update.

Full explanation →
870
Multi-Selecteasy

A company is designing a disaster recovery solution for an Amazon Aurora MySQL database. The database is currently in a single AWS Region. The company needs an RPO of less than 1 minute and an RTO of less than 5 minutes. Which TWO steps should the company take? (Choose TWO.)

Select 2 answers
A.Configure an Aurora Global Database with a secondary cluster in another Region.
B.Create a read replica in another Region.
C.Use Amazon RDS Proxy to reduce failover time.
D.Enable Aurora Serverless auto scaling.
E.Enable Multi-AZ for the Aurora cluster.
AnswersA, C

Global Database provides cross-Region replication with low RPO.

Why this answer

Options A and C are correct. A: An Aurora Global Database with a secondary cluster in another Region provides replication with sub-minute RPO. C: Amazon RDS Proxy helps reduce failover time by managing database connections and routing traffic to the new primary during a failover, thus improving RTO.

Option B is incorrect because cross-Region read replicas in Aurora typically have higher replication lag, which does not meet the sub-minute RPO requirement; Aurora Global Database is the appropriate approach. Option D is incorrect because Aurora Serverless auto scaling does not address cross-Region disaster recovery. Option E is incorrect because Multi-AZ provides high availability within a single Region, but does not meet the cross-Region DR requirement with sub-minute RPO and sub-5-minute RTO.

Full explanation →
871
Multi-Selectmedium

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Select 2 answers
A.Create a PrivateLink endpoint for IPAM.
B.Enable VPC sharing in each member account.
C.Share the IPAM pool using AWS Resource Access Manager (RAM).
D.Set up AWS Direct Connect between accounts.
E.Delegate an administrator account for IPAM.
AnswersC, E

RAM enables sharing IPAM pools across accounts.

Why this answer

AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Exam trap

The trap here is that candidates confuse IPAM pool sharing (which uses RAM) with VPC sharing or network connectivity services like Direct Connect, leading them to select irrelevant options that address different aspects of multi-account networking.

Full explanation →
872
MCQmedium

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

A.Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.
B.Use a single AWS Direct Connect connection with a backup VPN over the internet.
C.Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.
D.Order two AWS Direct Connect connections from different providers and configure them in a LAG.
AnswerD

Multiple Direct Connect connections provide high availability and 10 Gbps throughput.

Why this answer

The requirement for 10 Gbps throughput and high availability mandates using two AWS Direct Connect connections from different providers, configured as a Link Aggregation Group (LAG). LAG aggregates multiple connections into a single logical interface, providing both increased bandwidth and redundancy. A single Direct Connect connection with a backup VPN (Option B) would not meet the 10 Gbps throughput requirement, as VPNs are typically limited to lower bandwidth and introduce latency.

Option A and C rely on VPNs, which cannot guarantee 10 Gbps throughput and may suffer from internet-based variability.

Exam trap

The trap here is that candidates often assume a single Direct Connect connection with a VPN backup is sufficient for high availability, but the VPN backup cannot match the 10 Gbps throughput and introduces latency, failing the throughput requirement.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway with a single VPN does not provide the required 10 Gbps throughput; VPN throughput is limited by the VPN endpoint and internet conditions, typically maxing out at 1.25 Gbps per tunnel. Option B is wrong because a single Direct Connect connection with a backup VPN does not meet the high availability requirement; the VPN backup introduces failover latency and cannot sustain 10 Gbps throughput during failover. Option C is wrong because multiple Site-to-Site VPN connections from the data center to the VPC cannot aggregate to 10 Gbps reliably; VPN throughput is per-tunnel limited (e.g., 1.25 Gbps per tunnel with ECMP), and internet-based VPNs are subject to jitter and packet loss.

Full explanation →
873
Multi-Selecteasy

A company uses AWS CloudFormation to deploy infrastructure. They need to ensure that updates to a stack do not cause downtime for a critical database. Which TWO strategies should they use?

Select 2 answers
A.Create a new stack and migrate data.
B.Use an UpdatePolicy attribute for rolling updates.
C.Disable rollback on stack update failures.
D.Use a service role for CloudFormation.
E.Use a DeletionPolicy attribute of Retain on the database resource.
AnswersB, E

Rolling updates minimize downtime.

Why this answer

Correct answers are B and E. Option B: Using an UpdatePolicy attribute allows you to control how updates are applied, such as rolling updates across instances, which minimizes downtime. Option E: Setting a DeletionPolicy of Retain on the database resource ensures that the database is not deleted during stack updates or deletions, preventing accidental data loss and downtime.

Option A is incorrect because creating a new stack would require data migration, which can cause downtime. Option C is incorrect because disabling rollback does not prevent downtime; it can leave the stack in a failed state. Option D is incorrect because a service role controls permissions, not update behavior.

Full explanation →
874
Multi-Selecthard

A company is migrating a web application to AWS. The application consists of a stateless web tier, a stateful application tier, and a MySQL database. The company wants to use AWS managed services to improve scalability and reduce operational overhead. Which THREE services should the company use? (Choose THREE.)

Select 3 answers
A.Amazon EC2 Auto Scaling
B.Amazon S3
C.Application Load Balancer
D.Amazon ElastiCache for Redis
E.Amazon RDS for MySQL
AnswersC, D, E

Correct. Application Load Balancer is a managed service that distributes traffic to the web tier, improving scalability and availability.

Why this answer

The correct choices are C, D, and E. For the stateless web tier, an Application Load Balancer (ALB) distributes traffic and integrates with Auto Scaling for scalability, but EC2 Auto Scaling itself is not a managed service for the database or stateful tier. The stateful application tier requires a managed in-memory caching service; Amazon ElastiCache for Redis is ideal for session state storage.

The MySQL database should be migrated to Amazon RDS for MySQL, a managed relational database service that reduces operational overhead. Option A (EC2 Auto Scaling) is incorrect because it is an infrastructure-level scaling service, not a managed service for the database or stateful tier. Option B (S3) is incorrect because it is object storage, not suitable for stateful application data or session state.

Exam trap

Candidates may mistakenly choose EC2 Auto Scaling for the stateless web tier, but the question asks for managed services to improve scalability and reduce operational overhead for the application tier and database, not just the web tier. ElastiCache is the correct managed service for the stateful tier.

Full explanation →
875
MCQmedium

A company plans to migrate a legacy on-premises web application to AWS using the 7 Rs (Rehost, Replatform, etc.). The application has tightly coupled components and unpredictable traffic. The team wants to minimize migration risk and time. Which migration strategy should they use?

A.Replatform
B.Rehost (lift-and-shift)
C.Repurchase
D.Retire
AnswerB

Rehost migrates without changes, minimizing risk and time.

Why this answer

Rehost (lift-and-shift) is the fastest and lowest-risk migration strategy because it does not require code changes. It allows the company to move the application as-is to EC2, then refactor later. Option A (Replatform) involves some modifications.

Option C (Retire) is for decommissioning. Option D (Repurchase) means replacing with SaaS.

Full explanation →
876
MCQeasy

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

A.Add subnets from other Availability Zones to the VPC configuration.
B.Remove the VPC configuration to allow the function to access the internet.
C.Increase the function's memory size to 1024 MB.
D.Update the security group to allow all outbound traffic.
AnswerA

Multiple subnets improve availability and connectivity.

Why this answer

The Lambda function is timing out because it is configured with only one subnet, but the RDS database is in a VPC with subnets across multiple Availability Zones (AZs). Lambda requires at least one subnet per AZ used by the target resource to ensure network path availability; if the single subnet's AZ becomes unavailable or the RDS instance is in a different AZ, the connection fails. Adding subnets from other AZs provides redundant network paths, resolving the timeout.

Exam trap

The trap here is that candidates often assume increasing memory or removing VPC configuration will fix connectivity issues, but the real problem is the lack of subnet redundancy across Availability Zones, which is a common misconfiguration in multi-AZ VPC designs.

How to eliminate wrong answers

Option B is wrong because removing the VPC configuration would disconnect the Lambda from the VPC entirely, preventing any access to the RDS database (which is inside the VPC), and would not resolve the timeout. Option C is wrong because increasing memory to 1024 MB improves CPU and network throughput but does not fix the fundamental network connectivity issue caused by missing subnets; the timeout is due to network path failure, not resource constraints. Option D is wrong because security group rules control inbound/outbound traffic, but the default security group already allows all outbound traffic; the issue is subnet misconfiguration, not firewall rules.

Full explanation →
877
Multi-Selectmedium

A company is migrating a critical application to AWS using a rehost (lift-and-shift) approach. The application consists of a web tier and a database tier. The company wants to ensure high availability and disaster recovery. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers
A.Configure Amazon EC2 Auto Scaling to launch instances across multiple AWS Regions.
B.Deploy the web tier across multiple Availability Zones.
C.Use Amazon RDS Multi-AZ for the database tier.
D.Use Amazon RDS read replicas to offload read traffic.
E.Use a single Availability Zone for the database to reduce latency.
AnswersB, C

Provides high availability for the web tier.

Why this answer

The correct answers are B and C. Deploying the web tier across multiple Availability Zones provides high availability within a region. Using Amazon RDS Multi-AZ provides automatic failover for the database, ensuring high availability.

Option A is incorrect because Auto Scaling across multiple regions is not typical for a lift-and-shift migration and adds unnecessary complexity; cross-region deployment is more suited for disaster recovery, not high availability within a rehost. Option D is incorrect because RDS read replicas are for scaling read traffic, not for high availability or automatic failover. Option E is incorrect because using a single Availability Zone for the database creates a single point of failure and does not provide high availability.

Full explanation →
878
MCQeasy

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

A.VPC Flow Logs
B.Amazon CloudWatch Logs
C.AWS Config
D.AWS CloudTrail
AnswerD

CloudTrail logs all S3 data plane and control plane operations.

Why this answer

AWS CloudTrail logs all API calls made to S3, including requests to decrypt KMS keys. This enables auditing of all access requests to the bucket. AWS Config (C) records resource configuration changes, not access requests.

VPC Flow Logs (A) capture network traffic, not API calls. CloudWatch Logs (B) can store and monitor logs but does not generate logs from S3 access by itself.

Full explanation →
879
Matchingmedium

Match each AWS cost management tool to its use.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Visualize and explore cost and usage data

Set custom cost and usage budgets with alerts

Recommendations for cost optimization, performance, security

Flexible pricing model for compute savings

Recommend optimal compute resources based on usage

Why these pairings

Correct matches: Cost Explorer visualizes costs, Budgets set alerts, Trusted Advisor recommends optimizations, and CUR provides detailed data. Common confusions involve mixing tool capabilities.

Full explanation →
880
MCQhard

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs to ensure that all accounts use a specific set of IAM roles for cross-account access. What is the most scalable way to enforce this?

A.Use AWS Config rules to detect non-compliant roles and send alerts.
B.Deploy the IAM roles using AWS CloudFormation StackSets.
C.Request each business unit to create the required IAM roles manually.
D.Apply an SCP that denies iam:CreateRole unless the role has the required trust policy.
AnswerD

SCPs can enforce conditions on role creation centrally.

Why this answer

An SCP (Service Control Policy) that denies `iam:CreateRole` unless the role has the required trust policy is the most scalable enforcement mechanism. SCPs are applied at the organizational unit (OU) or account level in AWS Organizations, allowing the central security team to centrally prevent the creation of non-compliant IAM roles across all business unit accounts without requiring per-account configuration or manual intervention. This approach enforces compliance proactively (preventive control) rather than reactively (detective control), and it scales automatically as new accounts are added to the organization.

Exam trap

The trap here is that candidates often choose AWS Config (Option A) because it is a common compliance tool, but they fail to recognize that Config is detective, not preventive, and the question specifically asks for 'enforce,' which requires a preventive control like an SCP.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective controls that only detect and alert on non-compliant roles after they are created; they do not prevent the creation of non-compliant roles, so they are not an enforcement mechanism and require additional remediation automation to be effective. Option B is wrong because CloudFormation StackSets can deploy IAM roles consistently, but they cannot prevent business units from manually creating or modifying roles outside of the StackSet deployment, leaving the environment vulnerable to non-compliant roles. Option C is wrong because relying on manual creation by each business unit is not scalable, introduces human error, and provides no centralized enforcement or audit trail, making it impossible for the central security team to guarantee compliance across all accounts.

Full explanation →
881
Multi-Selecthard

A company is migrating a legacy application to AWS. The application consists of several components that communicate via TCP. The solutions architect must design a solution that minimizes operational overhead and provides high availability. Which TWO strategies should be used?

Select 2 answers
A.Use instance store volumes for data persistence.
B.Use managed services like Amazon RDS and Amazon ElastiCache to reduce operational overhead.
C.Use Spot Instances for all compute resources.
D.Use VPC Peering to connect components.
E.Use an Application Load Balancer to distribute traffic across multiple EC2 instances.
AnswersB, E

Managed services reduce overhead and provide HA out-of-the-box.

Why this answer

Using managed services like Amazon RDS and Amazon ElastiCache offloads administrative tasks such as patching, backups, and replication setup, significantly reducing operational overhead. Option E is correct because an Application Load Balancer (ALB) distributes incoming TCP traffic across multiple EC2 instances in different Availability Zones, providing high availability and fault tolerance for the application components.

Exam trap

The trap here is that candidates may confuse high availability with data persistence, incorrectly choosing instance store volumes (Option A) for persistence, or assume that Spot Instances (Option C) can be used for all compute resources despite their interruption risk, overlooking the need for reliable TCP communication in a production migration.

Full explanation →
882
Multi-Selectmedium

A company is migrating a legacy application that uses Oracle stored procedures to Amazon Aurora PostgreSQL. Which TWO strategies minimize code changes and migration effort?

Select 2 answers
A.Use the PostgreSQL oracle_fdw foreign data wrapper to access Oracle tables from Aurora PostgreSQL.
B.Use Amazon RDS for Oracle with cross-Region replication.
C.Use AWS Database Migration Service (DMS) to replicate data continuously.
D.Migrate the database to Amazon DynamoDB and rewrite all application logic.
E.Use AWS Schema Conversion Tool (SCT) to convert Oracle PL/SQL to PostgreSQL PL/pgSQL.
AnswersA, E

FDW can reduce migration effort by allowing access to Oracle data.

Why this answer

Options A and E are correct. Option A uses the PostgreSQL oracle_fdw foreign data wrapper to access Oracle tables from Aurora PostgreSQL, minimizing code changes by allowing direct access to Oracle data without full migration. Option E uses AWS Schema Conversion Tool (SCT) to convert Oracle PL/SQL stored procedures to PostgreSQL PL/pgSQL, automating schema conversion and reducing manual effort.

Option B is incorrect because Amazon RDS for Oracle with cross-Region replication does not migrate to PostgreSQL. Option C is incorrect because AWS DMS replicates data but does not convert stored procedures. Option D is incorrect because migrating to DynamoDB (NoSQL) would require significant application rewrite.

Full explanation →
883
Multi-Selecteasy

A company is migrating its on-premises VMware VMs to AWS using AWS MGN. They need to ensure that the migration minimizes downtime and automates cutover. Which TWO steps are required? (Select TWO.)

Select 2 answers
A.Use AWS Server Migration Service (SMS) to replicate the VMs
B.Use AWS CloudEndure Migration to configure the replication
C.Launch a test instance to validate the migration before cutover
D.Install the AWS MGN agent on each source VM
E.Use AWS DMS to migrate the data from the VMs
AnswersC, D

Testing is a best practice to ensure the migrated instance works correctly.

Why this answer

AWS MGN requires installing the MGN agent on each source VM (option D) and then launching a test instance to verify the migration before cutover (option C). Option A (AWS SMS) is a different migration service. Option B (AWS CloudEndure Migration) is the former name of MGN, not a specific step.

Option E (AWS DMS) is for database migrations.

Full explanation →
884
MCQhard

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

A.Add Amazon ElastiCache to cache database queries.
B.Use Spot Instances to reduce costs and scale horizontally.
C.Increase the EC2 instance size to handle peak loads.
D.Configure an Auto Scaling group with a target tracking scaling policy based on average CPU utilization.
AnswerD

This dynamically adjusts capacity to maintain target utilization, optimizing cost and performance.

Why this answer

A target tracking scaling policy based on average CPU utilization automatically adjusts the number of EC2 instances in the Auto Scaling group to maintain a target CPU utilization level. This directly addresses the latency spikes caused by high CPU utilization during peak hours by scaling out horizontally, while scaling in during low traffic to avoid over-provisioning, making it both cost-effective and scalable.

Exam trap

The trap here is that candidates may confuse addressing the symptom (high CPU) with vertical scaling (Option C) or cost-saving measures (Option B), rather than recognizing that horizontal auto-scaling with a target tracking policy is the most cost-effective and scalable solution for handling intermittent latency spikes caused by CPU utilization.

How to eliminate wrong answers

Option A is wrong because caching database queries with ElastiCache reduces database load and query latency, but does not directly address high CPU utilization on the EC2 instances themselves, which is the root cause of the latency spikes. Option B is wrong because Spot Instances are cost-effective but can be interrupted with a two-minute warning, making them unsuitable for a high-traffic web application that requires consistent availability and low latency during peak hours. Option C is wrong because increasing the EC2 instance size (vertical scaling) is less cost-effective and scalable than horizontal scaling, as it leads to over-provisioning during off-peak hours and has a hard limit on instance size, failing to handle unpredictable traffic spikes efficiently.

Full explanation →
885
MCQmedium

A company is designing a serverless application using AWS Lambda. The function needs to process files uploaded to an S3 bucket and store metadata in DynamoDB. The solution must handle up to 1,000 concurrent invocations. Which configuration should be used to avoid throttling?

A.Request a concurrency limit increase from AWS Support
B.Enable provisioned concurrency
C.Use a dead-letter queue (DLQ) to retry throttled requests
D.Set reserved concurrency to 1,000
AnswerD

Setting reserved concurrency to 1,000 guarantees that the Lambda function has its own dedicated concurrency pool of 1,000, preventing throttling as long as the account's regional concurrency limit is at least 1,000 (which it is by default). This ensures capacity for up to 1,000 concurrent invocations.

Why this answer

Setting reserved concurrency to 1,000 ensures that the Lambda function has its own dedicated concurrency pool of 1,000, preventing throttling as long as the account's regional concurrency limit is at least 1,000. Option A is unnecessary since the default limit is already 1,000. Option B (provisioned concurrency) addresses cold starts, not throttling.

Option C (DLQ) handles failures after invocation, not prevention of throttling.

Exam trap

Candidates often confuse reserved concurrency with concurrency limits. Reserved concurrency guarantees a specific amount of concurrency for a function, while concurrency limits are account-wide. The question asks to avoid throttling, so reserved concurrency is the correct tool.

Full explanation →
886
MCQhard

A media company is designing a new video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function to start an AWS Elemental MediaConvert job. The MediaConvert job uses a custom job template. The pipeline must handle bursty uploads of up to 50 videos simultaneously. The company has noticed that some uploads are not being processed. The Lambda function is configured with a reserved concurrency of 10. The S3 event notification is configured to send events to the Lambda function. The MediaConvert job template is configured correctly. What is the most likely reason for the missed processing?

A.The MediaConvert job template is not being applied correctly.
B.The S3 event notification is not guaranteed to deliver events.
C.The Lambda function's reserved concurrency of 10 is too low, causing throttling and missed events.
D.The Lambda function is failing due to a timeout.
AnswerC

With 50 concurrent uploads, only 10 can be processed; the rest are throttled and may be lost.

Why this answer

With reserved concurrency set to 10, only 10 Lambda invocations can happen concurrently; if more than 50 uploads occur simultaneously (burst), many events will be throttled and not processed. Option A is incorrect because the job template is configured correctly. Option B is incorrect because S3 event notifications are reliable for Lambda triggers.

Option D is incorrect because there is no evidence of timeout issues.

Full explanation →
887
MCQmedium

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer. Recently, error rates increased due to a misconfiguration. The operations team wants to automatically roll back to the previous working configuration if errors exceed a threshold. Which solution provides the fastest rollback?

A.Manually restore AMI snapshots of the previous deployment.
B.Use AWS Elastic Beanstalk with rolling updates and health checks.
C.Use AWS CloudFormation with a stack policy to prevent updates.
D.Implement AWS CodeDeploy with automatic rollback triggered by CloudWatch alarms.
AnswerD

AWS CodeDeploy supports automatic rollback based on CloudWatch alarm thresholds, providing the fastest rollback by reverting to the previous working deployment revision automatically.

Why this answer

AWS CodeDeploy supports automatic rollback based on CloudWatch alarm thresholds, providing the fastest rollback by reverting to the previous working deployment revision automatically. Option A is incorrect because manually restoring AMI snapshots is slow and error-prone. Option B is incorrect because AWS Elastic Beanstalk with rolling updates and health checks can perform rollbacks, but it is slower and less granular than CodeDeploy’s immediate alarm-based rollback.

Option C is incorrect because AWS CloudFormation stack policies prevent updates and do not facilitate automatic rollback of the application deployment.

Full explanation →
888
Multi-Selecthard

A company is designing a new web application with a global user base. They need to improve latency for static content and protect against DDoS attacks. Which services should they use? (Choose THREE.)

Select 3 answers
A.AWS Shield
B.AWS Global Accelerator
C.Amazon Route 53
D.AWS WAF
E.Amazon CloudFront
AnswersA, D, E

DDoS protection.

Why this answer

AWS Shield (Standard, included by default) provides always-on detection and automatic inline mitigations to protect against common DDoS attacks at Layer 3 and Layer 4. For a global web application, this foundational protection is essential to maintain availability and low latency under attack.

Exam trap

The trap here is that candidates often select AWS Global Accelerator or Route 53 thinking they provide caching or DDoS protection, but Global Accelerator only optimizes network path and Route 53 only handles DNS resolution—neither caches static content nor mitigates application-layer DDoS attacks like CloudFront and WAF do.

Full explanation →
889
MCQeasy

A company wants to allow developers to assume a role in a production account from their development account using AWS IAM. What is needed for this cross-account access?

A.A role in the dev account with permissions to access production resources.
B.An IAM user in the production account with permissions to switch roles.
C.A role in the production account with a trust policy allowing the dev account, and an IAM policy in the dev account allowing sts:AssumeRole.
D.An SCP that allows sts:AssumeRole from the dev account.
AnswerC

This is the standard cross-account role access setup.

Why this answer

Cross-account IAM role access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal, and an IAM policy in the source account that grants the sts:AssumeRole action for that role's ARN. This two-part configuration establishes a secure delegation path where the dev account's users or roles can request temporary credentials from the production account via the AWS Security Token Service (STS).

Exam trap

The trap here is that candidates often confuse the direction of the trust relationship, mistakenly thinking the role must be in the source account (dev) rather than the target account (production), or they overlook that both a trust policy and an IAM permissions policy are required for cross-account access.

How to eliminate wrong answers

Option A is wrong because a role in the dev account cannot directly access production resources; cross-account access requires the role to be in the production account, not the dev account. Option B is wrong because an IAM user in the production account with permissions to switch roles would only allow that user to assume roles within the same account, not from an external dev account; cross-account access requires a trust policy on the production role that authorizes the dev account. Option D is wrong because an SCP (Service Control Policy) is an organization-level policy that can restrict actions but cannot grant permissions; it can only deny or allow actions at the account level, and it does not establish the trust relationship needed for cross-account role assumption.

Full explanation →
890
MCQhard

A company uses AWS Organizations and wants to implement a data perimeter across all accounts to ensure that data can only be accessed from approved networks. Which combination of controls should be used to enforce this perimeter?

A.Use S3 bucket policies with aws:SourceIp condition.
B.Use AWS Config rules to detect and alert on non-compliant access.
C.Use network ACLs in each VPC.
D.Use service control policies with aws:SourceIp and aws:SourceVpc conditions.
AnswerD

SCPs can deny access from unapproved networks across all services.

Why this answer

Service control policies (SCPs) in AWS Organizations can enforce a data perimeter by restricting access based on network origin using the `aws:SourceIp` and `aws:SourceVpc` condition keys. This approach works across all accounts in the organization, ensuring that only requests from approved networks (e.g., specific IP ranges or VPCs) are allowed, regardless of individual account configurations.

Exam trap

The trap here is that candidates often confuse resource-level policies (like S3 bucket policies) with organization-wide controls (SCPs), or they mistake detective controls (AWS Config) for preventive controls, leading them to choose options that only partially address the requirement or are reactive rather than proactive.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies with `aws:SourceIp` only apply to S3 resources and cannot enforce a data perimeter across all accounts or services; they are resource-specific, not organization-wide. Option B is wrong because AWS Config rules are detective controls that alert on non-compliant access after it occurs, not preventive controls that block unauthorized access. Option C is wrong because network ACLs operate at the subnet level within a single VPC and cannot enforce policies across multiple accounts or control access to services outside the VPC (e.g., S3 via public endpoints).

Full explanation →
891
MCQhard

A company uses AWS Organizations with hundreds of accounts. The security team wants to ensure that no account can disable AWS CloudTrail or delete CloudTrail log files. Which preventive control should be implemented?

A.Use AWS Config rules to detect and remediate any changes to CloudTrail configurations.
B.Apply a service control policy (SCP) that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.
C.Create an IAM policy that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail for all IAM users.
D.Apply a resource-based policy to the CloudTrail trail that denies these actions.
AnswerB

Correct. A service control policy (SCP) can deny the cloudtrail:StopLogging and cloudtrail:DeleteTrail actions across all accounts in the organization, providing a preventive control that applies to all principals including the root user.

Why this answer

Service control policies (SCPs) are the only preventive control that can centrally deny actions across all accounts in an AWS Organization. SCPs affect all users and roles, including the root user, and can block the ability to stop CloudTrail logging or delete trails. Option A (AWS Config rules) is detective and can trigger remediation, but it is not preventive; remediation can fail or be bypassed.

Option C (IAM policy) only applies within an account and does not prevent actions by the root user or external roles. Option D (resource-based policy) cannot be applied to CloudTrail trails to deny actions; CloudTrail supports resource-based policies for delivery notifications (SNS) but not to control trail management actions.

Full explanation →
892
MCQmedium

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

A.Attach an Internet Gateway to the VPC
B.Assign the Lambda function to the VPC and configure a security group
C.Set up a VPC peering connection
D.Configure a NAT Gateway in the public subnet
AnswerB

Lambda in VPC requires a security group and VPC configuration.

Why this answer

Lambda functions must be attached to a VPC and assigned a security group to access resources within the VPC, such as an RDS database or an Elasticache cluster. This configuration creates an elastic network interface (ENI) in the VPC, allowing the function to communicate with VPC resources via private IP addresses. The security group acts as a virtual firewall to control inbound and outbound traffic for the Lambda function.

Exam trap

The trap here is that candidates often confuse external connectivity (Internet Gateway, NAT Gateway) with internal VPC access, mistakenly thinking those components are required for a Lambda function to reach resources within the same VPC.

How to eliminate wrong answers

Option A is wrong because an Internet Gateway enables communication between a VPC and the internet, not direct access to VPC resources from a Lambda function; Lambda already uses a VPC-attached ENI for private connectivity. Option C is wrong because VPC peering connects two separate VPCs, but the Lambda function needs to be directly attached to the target VPC, not rely on a peering connection. Option D is wrong because a NAT Gateway allows outbound internet access from private subnets, but it does not enable a Lambda function to access VPC resources; the function must be attached to the VPC with appropriate security group rules.

Full explanation →
893
MCQeasy

A developer is deploying a serverless application using AWS SAM. The deployment fails with a 'ResourceNotReady' error. What is the most likely cause?

A.The SAM template has invalid YAML syntax.
B.The application has too many tags.
C.A resource that the application depends on is not yet created.
D.The Lambda function code has a runtime error.
AnswerC

Dependency not ready causes ResourceNotReady.

Why this answer

'ResourceNotReady' in AWS SAM indicates that a resource the application depends on is not yet created or still in progress. This often happens when a nested stack or a resource with dependencies (e.g., a DynamoDB table) is not fully provisioned before the dependent resource tries to use it. Option A is incorrect: invalid YAML syntax would cause a template validation error, not a 'ResourceNotReady' error.

Option B is incorrect: too many tags would not cause this error; tags are metadata and do not affect resource readiness. Option D is incorrect: a Lambda runtime error would occur during function invocation, not during deployment.

Full explanation →
894
Multi-Selectmedium

A company is planning to migrate its on-premises workload to AWS. The workload consists of a stateful web application that requires a static IP address for whitelisting by third-party services. The company will use a multi-AZ deployment. Which service should be used to meet these requirements?

Select 1 answer
A.Amazon Route 53
B.Amazon CloudFront
C.Network Load Balancer (NLB)
D.Application Load Balancer (ALB)
E.AWS Global Accelerator
AnswersC

Correct. Network Load Balancer (NLB) provides static IP addresses per Availability Zone, which can be whitelisted by third-party services, and supports multi-AZ deployments.

Why this answer

For a stateful web application requiring static IP addresses for third-party whitelisting in a multi-AZ deployment, only a Network Load Balancer (NLB) provides static IPs per Availability Zone. Application Load Balancer (ALB) uses a DNS name with changing IPs and does not offer static IPs. Therefore, NLB alone meets the requirement; ALB is not needed for static IP whitelisting.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator's static IPs with NLB's static IPs, but Global Accelerator is optimized for global traffic and adds unnecessary complexity and cost for a single-region multi-AZ deployment where per-AZ static IPs are sufficient for whitelisting.

Full explanation →
895
MCQmedium

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked with a batch size of 10. Some messages are failing repeatedly, causing the function to retry them up to the maximum retry count and then they are sent to a dead-letter queue (DLQ). The company wants to improve the resilience of the application by handling partial batch failures more efficiently. What should a solutions architect do?

A.Move the messages to a DLQ immediately after the first failure.
B.Implement reportBatchItemFailures in the Lambda function and enable partial batch response for the SQS event source mapping.
C.Decrease the batch size to 1 so that each invocation processes a single message.
D.Increase the batch size to 100 to process more messages per invocation.
AnswerB

This allows Lambda to report individual failures so only those messages are retried.

Why this answer

Implementing reportBatchItemFailures in the Lambda function and enabling partial batch response for the SQS event source mapping allows the function to signal which specific messages within a batch failed. This prevents the entire batch from being retried or sent to the DLQ, and only the failed messages are retried individually, improving resilience and efficiency.

Exam trap

The trap here is that candidates often think decreasing batch size to 1 is the simplest fix, but that ignores the throughput impact and the fact that AWS provides a native partial batch failure mechanism that is more efficient and scalable.

How to eliminate wrong answers

Option A is wrong because moving messages to a DLQ immediately after the first failure defeats the purpose of retries and would cause unnecessary data loss for transient failures. Option C is wrong because decreasing the batch size to 1 reduces throughput and does not address partial batch failures; it simply avoids the problem by processing one message at a time, which is less efficient. Option D is wrong because increasing the batch size to 100 would amplify the impact of partial failures, as the entire batch would be retried or sent to the DLQ if any message fails, making the problem worse.

Full explanation →
896
MCQhard

A company is migrating a legacy database to Amazon RDS. The database currently runs on a single server with a 2 TB volume. The migration must have less than 30 minutes of downtime. Which approach should be used for the initial data load?

A.Use a native database dump and restore during a maintenance window
B.Use AWS Database Migration Service (DMS) with ongoing replication
C.Export the database to Amazon S3 and import into RDS using native tools
D.Create a read replica from the source database to RDS
AnswerB

DMS does a full load and then replicates changes to keep downtime minimal.

Why this answer

AWS Database Migration Service (DMS) can perform a full load of the 2 TB database and then use ongoing replication to keep the target RDS instance synchronized with the source, minimizing downtime to under 30 minutes. Option A (native dump and restore) would require extended downtime for a 2 TB database. Option C (export to S3 and import) cannot provide continuous replication, leading to more downtime.

Option D (creating a read replica) is not feasible from a legacy source to RDS without additional configuration and does not directly address the migration requirement.

Full explanation →
897
MCQeasy

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

A.Use AWS Systems Manager Patch Manager in the management account.
B.Use AWS Systems Manager Quick Setup to configure patching across accounts.
C.Use AWS Systems Manager Automation documents in each account.
D.Use AWS Config rules to trigger patching in each account.
AnswerB

Quick Setup provides centralized configuration across accounts in an organization.

Why this answer

AWS Systems Manager Quick Setup is the most efficient way to centrally configure patching across multiple AWS accounts because it automates the deployment of SSM Patch Manager resources, including patch baselines, maintenance windows, and IAM roles, across accounts in an AWS Organization. It eliminates the need to manually set up patching in each account, providing a single-pane-of-glass management experience from the management account.

Exam trap

The trap here is that candidates often assume Patch Manager in the management account is sufficient for cross-account patching, overlooking the need for centralized orchestration across accounts, which Quick Setup provides.

How to eliminate wrong answers

Option A is wrong because using Patch Manager in the management account alone does not automatically extend patching to other accounts; it only manages instances in the management account unless cross-account roles and manual configurations are set up, which is less efficient than Quick Setup. Option C is wrong because using Automation documents in each account requires manual deployment and maintenance of automation runbooks per account, lacking centralized orchestration and scaling capabilities. Option D is wrong because AWS Config rules can detect non-compliant patches but cannot directly trigger patching actions; they would need to invoke a remediation action via Systems Manager Automation, which adds complexity and is not a direct patching solution.

Full explanation →
898
MCQmedium

A company is using AWS Organizations with consolidated billing. The company has a production account and a development account. The security team needs to ensure that developers cannot create IAM users in the development account. Which option is the MOST effective?

A.Apply an SCP to the development account that denies iam:CreateUser.
B.Create an IAM group for developers with a policy that denies iam:CreateUser.
C.Enable AWS CloudTrail to monitor iam:CreateUser calls.
D.Attach an IAM policy to each developer user that denies iam:CreateUser.
AnswerA

SCPs are effective even for users with full administrative permissions.

Why this answer

Service Control Policies (SCPs) are the most effective way to enforce permissions boundaries across entire accounts in AWS Organizations. An SCP applied to the development account will deny the `iam:CreateUser` action for all principals (including the root user) in that account, regardless of any IAM policies attached to users or roles. This ensures developers cannot create IAM users, even if they have full administrative access within the account.

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-specific and can be overridden) with SCPs (which are organization-wide and cannot be bypassed by account administrators), leading them to choose an IAM-based solution that is less effective for cross-account control.

How to eliminate wrong answers

Option B is wrong because an IAM group policy only applies to users who are members of that group; developers could be added to other groups or have inline policies that grant `iam:CreateUser`, bypassing the restriction. Option C is wrong because AWS CloudTrail only logs API calls for auditing purposes and does not prevent the `iam:CreateUser` action from being executed. Option D is wrong because an IAM policy attached to each developer user is not scalable and can be overridden by other policies (e.g., a full-admin policy) that grant the same action; it also does not prevent a developer from creating a new user with a different set of permissions.

Full explanation →
899
MCQmedium

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

A.Use AWS App Mesh for service-to-service communication with mutual TLS
B.Use VPC peering between the services' VPCs
C.Use an internet-facing Application Load Balancer for each service
D.Use an internal Network Load Balancer for each service
AnswerA

App Mesh provides a service mesh with mTLS, traffic control, and observability, improving security and performance within the mesh.

Why this answer

AWS App Mesh provides a service mesh that enables secure, encrypted service-to-service communication using mutual TLS (mTLS), which authenticates both sides of the connection and encrypts traffic in transit. It also offers observability, traffic control, and retry logic at the application layer, making it the best choice for microservices on ECS Fargate where security and performance are critical.

Exam trap

The trap here is that candidates often assume a network-level solution (like VPC peering or NLB) is sufficient for security, but the exam specifically tests the need for application-layer authentication (mTLS) and observability in a microservices architecture, which only a service mesh like App Mesh provides.

How to eliminate wrong answers

Option B is wrong because VPC peering connects entire VPCs at the network layer, but it does not provide application-layer security (like mTLS), traffic shaping, or observability for microservices; it also adds complexity and does not scale well with many services. Option C is wrong because an internet-facing Application Load Balancer exposes services to the public internet, which is unnecessary and insecure for internal service-to-service communication, and it adds latency and cost. Option D is wrong because an internal Network Load Balancer operates at Layer 4 and cannot perform mTLS, application-layer routing, or provide the fine-grained traffic management needed for microservices; it also lacks built-in observability and retry logic.

Full explanation →
900
Multi-Selecthard

A company has a multi-account AWS environment with hundreds of accounts. They need to enforce that all accounts have AWS CloudTrail enabled and that logs are delivered to a central S3 bucket. Which TWO actions should be taken to ensure compliance across the organization?

Select 2 answers
A.Enable CloudTrail organization trail from the management account.
B.Create an AWS Lambda function in each account to enable CloudTrail.
C.Attach an SCP that requires CloudTrail to be enabled.
D.Create an AWS Config rule to detect accounts without CloudTrail.
E.Use AWS CloudFormation StackSets with service-managed permissions to deploy a CloudTrail trail to all accounts.
AnswersA, E

Organization trails automatically apply to all accounts.

Why this answer

Enabling an organization trail from the management account automatically creates a CloudTrail trail for all accounts in the AWS Organization, including future accounts, without requiring per-account configuration. This ensures centralized logging to a single S3 bucket and enforces compliance across the entire organization.

Exam trap

The trap here is confusing detective controls (like AWS Config rules) with preventive or automated enforcement mechanisms, leading candidates to choose Option D instead of recognizing that organization trails provide native, automatic compliance.

Full explanation →
Page 11

Page 12 of 23

Page 13

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →