AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 976–1050

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because converting logs to Parquet format with AWS Glue improves compression and query performance, but it does not address the need to quickly query recent logs without scanning all historical data; partitioning is still required for cost-effective pruning. Option B is wrong because transitioning logs to S3 Glacier after 7 days makes them inaccessible to Athena, as Athena cannot query data stored in Glacier or Glacier Deep Archive storage classes. Option D is wrong because Athena federated query is designed to query data in external databases (e.g., RDS, DynamoDB) or on-premises sources, not to scan logs directly from S3 buckets in other accounts; cross-account S3 access is handled via bucket policies, not federated query.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because route table entries are managed by the VPC owner, not by the workload account, and within the same VPC the default route table already enables communication between subnets; no additional route entry is required. Option C is wrong because a VPC peering connection is used to connect two different VPCs, but the EC2 instance and the RDS database reside in the same VPC (the shared VPC), so peering is unnecessary and would add complexity. Option D is wrong because an AWS Transit Gateway is designed to interconnect multiple VPCs or on-premises networks, but here both resources are already in the same VPC, making Transit Gateway redundant and incorrect.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SCPs cannot enforce a specific password policy or require MFA; they can only deny or allow actions, not set configurations or enable features. Option B is wrong because AWS Config rules can detect non-compliance but cannot automatically set a password policy or enable MFA for users; they only evaluate and report. Option D is wrong because AWS CloudTrail only logs API calls and does not provide enforcement or remediation; automatic remediation would require additional services like AWS Config with auto-remediation or Lambda, not CloudTrail alone.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive and require per-account setup; they detect and remediate after a violation occurs, not prevent it, and incur ongoing costs. Option B is wrong because CloudFormation StackSets deploy resources but cannot prevent users from modifying bucket policies; they also require per-account execution and maintenance. Option C is wrong because IAM roles cannot restrict root users or actions taken via the S3 console that bypass IAM; they also fail to prevent cross-account access or direct API calls from other services.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because S3 One Zone-Infrequent Access is designed for data that is accessed infrequently but requires rapid retrieval (milliseconds), and it stores data in a single Availability Zone, which does not provide the durability needed for a 7-year retention period; its cost is higher than Glacier Deep Archive for long-term archival. Option B is wrong because S3 Intelligent-Tiering automatically moves data between access tiers based on usage patterns, but it is not optimized for purely archival data that will almost never be accessed; it incurs monitoring and automation fees that make it less cost-effective than Glacier Deep Archive for data that will be stored for 7 years with infrequent access. Option D is wrong because S3 Standard is designed for frequently accessed data with millisecond retrieval and is the most expensive storage class, making it unsuitable for cost-effective long-term archival of infrequently accessed logs.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Glue with streaming ETL is designed for processing streaming data from sources like Amazon Kinesis or Kafka, not for capturing changes directly from an RDS database; it lacks native CDC capabilities to read database transaction logs. Option B is wrong because AWS Lambda with database polling requires custom code to repeatedly query the database for changes, which introduces latency, increased load on the database, and is not a real-time streaming solution; it also does not capture deletes or changes efficiently without additional logic. Option C is wrong because Amazon Kinesis Data Streams with a custom producer requires you to build and manage your own application to poll the RDS database and push changes to Kinesis, adding operational overhead and complexity; it does not provide native CDC integration with database transaction logs.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because 'aws:SecureTransport' is correctly spelled with a capital 'T' in the condition key; the spelling in the template is accurate. Option C is wrong because the bucket policy already has an explicit 'Deny' effect for requests without 'aws:SecureTransport', so adding an 'Allow' statement for HTTPS is unnecessary and would not fix the issue of HTTP uploads being allowed. Option D is wrong because the resource ARN 'arn:aws:s3:::my-unique-bucket-123/*' is correct for covering object-level actions like PutObject; omitting '/*' would only cover bucket-level actions, not object uploads.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse optimized for structured, frequently queried data, not for storing large volumes of raw log data over long periods; using data sharing does not provide a cost-effective archival tier like S3 Glacier Deep Archive, and retaining logs for 5 years in Redshift would be prohibitively expensive. Option C is wrong because Amazon OpenSearch Service with UltraWarm storage is designed for near-real-time search and analytics on log data, but it does not support SQL-based queries natively (it uses its own query DSL) and UltraWarm is not a long-term archival tier; it also lacks the cost efficiency of S3 Glacier Deep Archive for 5-year retention. Option D is wrong because Amazon RDS for PostgreSQL is a relational database service intended for transactional workloads, not for storing and analyzing large volumes of log data; automated backups are for point-in-time recovery, not for long-term archival, and storing logs for 5 years in RDS would incur high storage costs and performance issues.

Why this answer

How to eliminate wrong answers

Option A is wrong because simply allowing `s3:GetObject` to the SIEM's IAM role does not restrict access to a specific VPCE; the SIEM could use that role from any network location, violating the requirement. Option B is wrong because an S3 access point with a network origin policy can restrict access based on the VPC or internet, but it does not support a condition key like `aws:SourceVpce` to enforce a specific VPCE ID; it only allows blocking or allowing traffic from an entire VPC, not a single endpoint. Option D is wrong because allowing `s3:GetObject` to the SIEM's AWS account ID would grant access to any principal in that account, regardless of network path, and does not enforce the VPCE restriction.

Why this answer

How to eliminate wrong answers

Option A is wrong because `ec2:DescribeSnapshots` is a read-only action and is not required before creating a snapshot; the failure is due to missing resource-level permissions, not a missing read action. Option B is wrong because the policy does not include any condition keys, but the absence of a condition key is not the root cause—the core issue is the missing volume resource in the `ec2:CreateSnapshot` action. Option D is wrong because the policy does include `ec2:CreateTags` on the snapshot resource (`arn:aws:ec2:*::snapshot/*`), and the error is about creating the snapshot itself, not tagging it.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect non-compliant users and send alerts; they cannot proactively deny access or enforce MFA at the time of login. Option B is wrong because CloudTrail is a logging service that records API calls after they occur; it cannot intercept or block a console login session in real time, and automatic remediation would be reactive, not preventive. Option C is wrong because creating an IAM policy in each account requires manual per-account configuration and does not scale efficiently across many accounts; additionally, IAM policies in individual accounts cannot be enforced from a central point and may be overridden by local administrators.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because SAML 2.0 federation between AWS SSO and on-premises AD would require an external identity provider (IdP) like ADFS to broker the trust, not a direct integration; AWS SSO cannot directly federate with on-premises AD via SAML without an IdP. Option B is wrong because IAM Identity Center with an external IdP that supports SCIM is used for provisioning users and groups from an external IdP (e.g., Azure AD, Okta), not for connecting to an on-premises AD directly; SCIM does not handle authentication against on-premises AD. Option D is wrong because AWS SSO does not support direct LDAP connections to on-premises Active Directory; it requires a directory service such as AWS Managed Microsoft AD or AD Connector to bridge the connection.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because the policy does not include a `Deny` effect; it uses an `Allow` effect with a condition, which does not explicitly deny access from other IPs—it simply does not grant permission for those IPs, and an explicit deny would be needed to block them. Option C is wrong because the `Resource` is specific enough: it targets `arn:aws:s3:::example-bucket/*`, which precisely identifies objects within the named bucket, and IAM policies require an ARN format that is valid and specific. Option D is wrong because the policy only allows `s3:GetObject` (not all S3 actions) and only on `example-bucket` (not all buckets), as clearly specified in the `Action` and `Resource` fields.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy grants access to the root user of account 123456789012, not an IAM role, and the root user can delegate permissions to services within the account; the write is not denied on that basis. Option C is wrong because the policy explicitly includes `s3:PutObject` in the `Action` list (the exhibit shows `s3:PutObject` as part of the allowed actions), so the write is not denied due to missing PutObject permission. Option D is wrong because the policy uses a wildcard `AWSLogs/123456789012/*` which allows any object key under that prefix, not an exact match to `AWSLogs/123456789012/`.

Why this answer

How to eliminate wrong answers

Option B (Amazon EKS managed node groups) is wrong because, while it reduces some operational burden by automating node provisioning and updates, it still requires you to manage EC2 instances (e.g., instance types, scaling policies, and patching), which adds operational overhead compared to Fargate. Option C (Amazon EC2 instances) is wrong because it requires full manual management of the underlying virtual machines, including OS patching, security updates, and scaling, which contradicts the goal of minimizing operational overhead. Option D (Self-managed EC2 nodes) is wrong because it places the entire burden of node lifecycle management (provisioning, patching, scaling, and troubleshooting) on the development team, resulting in the highest operational overhead.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because querying the entire dataset without partitions would scan all objects in the S3 bucket, leading to high costs and poor performance, especially as log volume grows. Option B is wrong because while Glue Crawler can automatically create partitions based on date prefixes, this approach does not include partitions for account ID and region, which are essential for filtering logs from specific accounts or regions; without these, queries would still scan unnecessary data. Option D is wrong because partitioning by log type and date alone ignores account ID and region, which are critical for security analysts who need to isolate logs from specific member accounts or regions; this would result in scanning more data than necessary.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because IAM policies cannot condition on tags of resources that are not the resource being acted upon (e.g., a VPC tag) in a way that prevents the ECS task from launching in a different VPC; IAM conditions like 'ecs:VpcId' do not exist, and tagging the VPC does not enforce the constraint at the API call level. Option B is wrong because IAM policies attached to ECS task roles control what the task can do after it runs, not whether the task can be launched in a particular VPC; the task role is assumed by the task, not by the caller that creates or runs the task. Option D is wrong because AWS Config rules are detective controls, not preventive controls; they can detect non-compliant tasks and trigger remediation, but they do not prevent the task from running in the first place, which is the requirement for a preventive control.

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because tag policies are used to enforce consistent tagging on resources, not to create or deploy IAM roles or AWS Config rules. Option C is wrong because SCPs (Service Control Policies) are used to restrict permissions and actions at the account level, not to create resources; they cannot create IAM roles or Config rules. Option D is wrong because using a periodic Lambda function to scan for new accounts and deploy resources requires ongoing maintenance, introduces potential latency, and is less reliable than the native, event-driven deployment provided by StackSets.

Why this answer

How to eliminate wrong answers

Option A (VPC peering connection) is wrong because VPC peering connects entire VPCs at the network layer using private IP addresses, but it does not allow you to share a subnet; it only enables routing between VPCs, and each account still needs its own subnet. Option C (AWS PrivateLink) is wrong because PrivateLink provides private connectivity to services via interface VPC endpoints powered by AWS PrivateLink, not for sharing subnets or VPC resources across accounts. Option D (Service control policy) is wrong because SCPs are used to manage permissions and enforce guardrails across accounts in AWS Organizations, not for sharing infrastructure resources like subnets.

Why this answer

Why this answer

How to eliminate wrong answers

Option B is wrong because Amazon Route 53 is designed for static DNS resolution and does not natively support dynamic service registration and health checking for ephemeral ECS tasks, making it unsuitable for dynamic service discovery in a microservices architecture; additionally, an Application Load Balancer is an ingress point for incoming traffic, not an egress point for outbound traffic to external services. Option C is wrong because while AWS Cloud Map is correct for service discovery, an Internet Gateway is used for bidirectional communication between a VPC and the internet, not as a single egress point—it would allow direct outbound access from all resources, bypassing centralized security and monitoring. Option D is wrong because Amazon Route 53 is not designed for dynamic service discovery in ECS, and VPC endpoints are used for private connectivity to AWS services, not for routing traffic to external SaaS applications over the internet.

Why this answer

How to eliminate wrong answers

Option B is wrong because SNS triggers Lambda synchronously via a push mechanism, which would cause the S3 event to be lost if the Lambda function times out or fails, and SNS does not provide a buffer for retries or backpressure. Option C is wrong because S3 synchronous invocation of Lambda has a 15-minute timeout limit that matches the requirement, but synchronous invocation would block the S3 event and could lead to throttling or failures if the processing takes the full 15 minutes; moreover, S3 synchronous invocation is not designed for long-running asynchronous tasks. Option D is wrong because EventBridge can capture S3 events and trigger Step Functions, but Step Functions itself does not directly handle the 15-minute processing; it would still need to invoke a Lambda function or another service, and the question asks for the service to trigger the processing, not orchestrate it.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because daily automated snapshots cannot achieve a 15-minute RPO; the RPO would be up to 24 hours, and restoring from a snapshot in the DR Region takes longer than 2 hours for RTO. Option B is wrong because Amazon Aurora Global Database is more expensive than a cross-Region read replica for RDS MySQL, and the question specifies RDS for MySQL, not Aurora; using Aurora would require migrating the database, adding cost and complexity. Option C is wrong because AWS Backup copying backups to the DR Region still relies on snapshot schedules (typically daily), failing the 15-minute RPO, and EC2 Image Builder addresses application recovery but not the database RPO/RTO requirements.

Why this answer

How to eliminate wrong answers

Option A is wrong because the policy only allows s3:PutObject, not all actions on the bucket. Option C is wrong because there is no second statement; the policy has a single statement with an Allow effect, and GetObject is not included. Option D is wrong because the IP address matches the condition (10.0.1.5), so the Allow effect applies, not a Deny.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by directing traffic to the optimal endpoint based on health and geography, but it does not distribute traffic across EC2 instances within a region; it uses anycast IPs and routes to Application Load Balancers or Network Load Balancers. Option C is wrong because AWS Direct Connect establishes a dedicated network connection from on-premises to AWS, not for distributing traffic across EC2 instances in multiple AZs. Option D is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses and can route traffic to multiple endpoints using policies like weighted or latency routing, but it does not perform load balancing at the application layer or distribute traffic across instances in real time.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides a hardware security module for key generation and storage, but it does not integrate with KMS for automatic key rotation; managing rotation manually would be complex and error-prone, and the question specifically requires a KMS-based solution. Option B is wrong because an AWS managed key for S3 cannot be used with EC2 instances directly (it is tied to S3), and the key is managed by AWS, not the customer, violating the customer-managed key requirement. Option D is wrong because generating a new key every 90 days and re-encrypting all data is unnecessary overhead; KMS automatic rotation (every 365 days) already preserves old backing keys for decryption, and manual rotation with re-encryption violates the principle of least effort and could introduce data availability risks.

Why this answer

How to eliminate wrong answers

Option A is wrong because increasing the task-level CPU limit to 2048 units (2 vCPU) does not address the scaling responsiveness issue; it only allows each task to use more CPU, which may not help if tasks are already CPU-bound and scaling is slow. Option B is wrong because decreasing the target tracking value to 50% average CPU would cause the service to scale out at a lower threshold, but it does not improve the speed of scaling; target tracking still uses a gradual, proportional approach that may not keep up with rapid demand spikes. Option D is wrong because decreasing the scale-in cooldown period to 60 seconds affects scale-in behavior (reducing tasks), not scale-out responsiveness; it could even cause thrashing if tasks are scaled in too quickly after a spike.

Why this answer

Why this answer

How to eliminate wrong answers

Option A is wrong because a Lambda function monitoring for new VPCs would require custom code and event handling, and does not inherently enforce that only approved VPCs can attach; it also lacks the built-in approval mechanism. Option B is wrong because an SCP cannot require tags on VPCs (SCPs restrict actions, not enforce tagging), and AWS Config can detect non-compliance but cannot automatically create transit gateway attachments. Option D is wrong because it requires manual approval by the networking team, which does not meet the requirement for automatic approval.

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

Why this answer

How to eliminate wrong answers

Option B (AWS Secrets Manager) is wrong because it is designed to securely store and rotate secrets such as database credentials or API keys, not to manage user authentication or issue JWTs. Option C (AWS Identity and Access Management) is wrong because IAM is used for managing AWS resource permissions via policies and roles, not for authenticating end users or issuing JWTs; it cannot issue tokens for external user identities. Option D (AWS Security Token Service) is wrong because STS issues temporary AWS credentials (access keys, session tokens) for IAM roles or federated users, not JWTs for application-level authentication.

Why this answer

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog is a governance tool for creating and managing a catalog of approved IT services (e.g., pre-configured CloudFormation templates), not a service discovery mechanism. Option B is wrong because Amazon Route 53 private hosted zones provide DNS resolution within a VPC but require manual registration of records and do not support dynamic registration or health-based filtering of service instances without additional automation. Option C is wrong because AWS Systems Manager Parameter Store is a secure hierarchical store for configuration data and secrets, not a service discovery service; it lacks native DNS or API-based endpoint resolution and health checking for dynamic service instances.