Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1051–1125

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 14

Page 15 of 23

Page 16
1051
MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate. The application must be able to read and write files to a shared file system that is accessible from multiple tasks simultaneously. The file system must be durable and support NFS protocol. Which storage solution should be used?

A.Amazon EBS with Multi-Attach
B.Amazon EFS
C.Amazon S3
D.Amazon FSx for Lustre
AnswerB

Amazon EFS is a fully managed NFS file system that can be mounted by multiple ECS tasks across multiple AZs, providing a shared file system.

Why this answer

Amazon EFS is the correct choice because it provides a fully managed, durable, NFS-based (Network File System) shared file system that can be mounted concurrently by multiple Amazon ECS tasks running on Fargate. EFS supports the NFSv4.1 and NFSv4.0 protocols, ensuring simultaneous read/write access across tasks, and its data is replicated across multiple Availability Zones for durability.

Exam trap

The trap here is that candidates often confuse Amazon EBS Multi-Attach with a shared file system, but EBS Multi-Attach is block-level storage limited to a single AZ and incompatible with Fargate, whereas EFS is a fully managed NFS file system designed for multi-task, multi-AZ access.

How to eliminate wrong answers

Option A (Amazon EBS with Multi-Attach) is wrong because EBS Multi-Attach only supports a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, and it does not support Fargate tasks, which are serverless and cannot attach EBS volumes directly. Option C (Amazon S3) is wrong because S3 is an object storage service that does not support the NFS protocol; it uses RESTful APIs (HTTP/HTTPS) and is not a POSIX-compliant file system mountable via NFS. Option D (Amazon FSx for Lustre) is wrong because FSx for Lustre is designed for high-performance computing (HPC) workloads with a POSIX-compliant file system but does not natively support the NFS protocol; it uses the Lustre client protocol instead.

Full explanation →
1052
Matchingmedium

Match each storage class to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Frequently accessed data, low latency, high throughput

Auto-cost optimization for unknown access patterns

Lowest cost for long-term archival, retrieval in 12 hours

Infrequent access, stored in a single AZ

Archival data with retrieval minutes to hours

Why these pairings

S3 storage classes cater to different access patterns. Standard for frequent access, Intelligent-Tiering for automatic cost optimization, Standard-IA for infrequent but rapid access, One Zone-IA for lower durability infrequent access, Glacier and Deep Archive for archival with longer retrieval times.

Full explanation →
1053
Multi-Selectmedium

A company is designing a new application that will be deployed on Amazon EKS. The application must meet PCI DSS compliance requirements. Which TWO steps should the solutions architect take to secure the cluster?

Select 2 answers
A.Enable AWS CloudTrail logging for the EKS cluster.
B.Install Calico for network policy enforcement.
C.Configure IAM roles and RBAC policies to limit access.
D.Use Bottlerocket as the node operating system.
E.Enable secret encryption using AWS KMS.
AnswersC, E

Access control is required for PCI DSS.

Why this answer

PCI DSS Requirement 7 mandates strict access controls. In Amazon EKS, combining IAM roles for cluster-level authentication with Kubernetes RBAC for namespace-level authorization ensures least-privilege access, which is a core compliance requirement. This dual-layer approach prevents unauthorized API calls and pod-level actions.

Exam trap

The trap here is that candidates often confuse auditing (CloudTrail) with security enforcement, or assume that network policies (Calico) or OS hardening (Bottlerocket) are PCI DSS requirements, when the exam specifically tests the two mandatory controls: access management (IAM + RBAC) and encryption at rest (KMS).

Full explanation →
1054
Multi-Selecthard

A company is designing a new serverless application using AWS Lambda. The function needs to access an Amazon RDS database. Which THREE practices should be followed to avoid connection exhaustion?

Select 3 answers
A.Store the database connection in a global variable to reuse across invocations
B.Assign a static IP address to the Lambda function
C.Use Amazon RDS Proxy to pool connections
D.Open the database connection only when needed and close it after each invocation
E.Increase the maximum number of database connections in the RDS parameter group
AnswersC, D, E

RDS Proxy manages connection pooling for Lambda.

Why this answer

Amazon RDS Proxy sits between Lambda and the database, managing a pool of established connections. It reduces the overhead of opening and closing connections per invocation and prevents Lambda from exhausting database connections during concurrent executions. This is the recommended pattern for serverless applications with relational databases.

Exam trap

The trap here is that candidates often assume storing a connection in a global variable is sufficient to reuse it across invocations, but they overlook that concurrent invocations run in separate execution environments, each with its own global scope, leading to multiple connections and potential exhaustion.

Full explanation →
1055
MCQhard

A company uses Amazon DynamoDB with on-demand capacity. They notice that a specific table frequently exceeds the write throughput limit and experiences throttling. The table has a partition key with high cardinality. What is the MOST likely cause of throttling?

A.A sudden spike in write traffic exceeds the table's burst capacity
B.The table is using DynamoDB Accelerator (DAX) for writes
C.The write workload exceeds the table's provisioned write capacity
D.The table has auto scaling disabled
AnswerA

On-demand tables have a throughput limit based on previous traffic; spikes beyond that cause throttling.

Why this answer

On-demand DynamoDB tables can handle traffic spikes up to double the previous peak. If write traffic exceeds that threshold, throttling occurs. The table's burst capacity is limited to the previous peak for on-demand, so a sudden spike exceeding that will cause throttling.

Option B is incorrect because DAX is a caching layer for reads, not writes, and does not affect write throughput. Option C is incorrect because the table is using on-demand capacity, not provisioned; on-demand does not have provisioned write capacity. Option D is incorrect because auto scaling is not applicable for on-demand tables; on-demand automatically scales, but still has a limit based on previous peak.

Full explanation →
1056
MCQhard

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

A.Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.
B.Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.
C.Create an AWS Config rule in each account to remediate non-compliant buckets.
D.Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.
AnswerB

SCPs can enforce policies across all accounts in the organization.

Why this answer

Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account.

Option C is reactive. Option D is not scalable across accounts.

Full explanation →
1057
MCQhard

A company is designing a disaster recovery solution that must recover an application in a different AWS Region within 15 minutes of a failure. The application uses an Amazon Aurora MySQL DB cluster. Which combination of strategies will meet the recovery time objective (RTO) while minimizing costs?

A.Deploy a standby Aurora cluster in the DR Region and use synchronous replication.
B.Use Aurora Global Database with a secondary cluster in the DR Region.
C.Configure an Aurora cross-Region replica in the DR Region. Use Amazon Route 53 to fail over DNS.
D.Take daily snapshots and restore them in the DR Region using cross-Region snapshot copy.
AnswerC

Cross-Region replicas provide fast failover (typically <1 minute) and are cost-effective as they only replicate data.

Why this answer

An Aurora cross-Region replica asynchronously replicates data to a DR Region with minimal performance impact, and you can promote it to a standalone cluster within minutes. Combined with Amazon Route 53 DNS failover, this achieves an RTO under 15 minutes while keeping costs low, as you only pay for the replica storage and minimal compute until failover.

Exam trap

The trap here is that candidates often confuse Aurora Global Database (which is designed for low RTO but higher cost) with a simple cross-Region replica (which offers a slightly higher RTO but significantly lower cost), and they overlook the 15-minute RTO requirement that both can meet, making cost the deciding factor.

How to eliminate wrong answers

Option A is wrong because synchronous replication across AWS Regions would introduce high latency and is not supported by Aurora; Aurora's synchronous replication is limited to within a single Region. Option B is wrong because Aurora Global Database uses asynchronous replication with a typical RTO of 1 minute or less, but it requires a secondary cluster that incurs ongoing compute and storage costs, making it more expensive than a cross-Region replica. Option D is wrong because daily snapshots with cross-Region copy have an RTO that can exceed 15 minutes due to the time required to copy and restore the snapshot, and they also risk data loss of up to 24 hours.

Full explanation →
1058
MCQmedium

A company is designing a data lake on Amazon S3. Data is ingested from various sources, including IoT devices, and must be stored in a cost-effective manner. The data access patterns are unpredictable; some data is accessed frequently for a few days, then rarely accessed. The company wants to minimize storage costs while ensuring data is available within minutes when accessed. Which storage class should they use for the data?

A.S3 Standard
B.S3 Intelligent-Tiering
C.S3 Glacier Deep Archive
D.S3 One Zone-Infrequent Access
AnswerB

Automatically optimizes costs for unknown or changing access patterns, with millisecond retrieval.

Why this answer

S3 Intelligent-Tiering is the correct choice because it automatically moves data between two access tiers (frequent and infrequent access) based on changing access patterns, with no retrieval fees. This matches the unpredictable access pattern described—data accessed frequently for a few days then rarely—while ensuring data is available within minutes (milliseconds latency). It minimizes storage costs by charging lower rates for infrequently accessed data without requiring manual lifecycle management.

Exam trap

The trap here is that candidates often choose S3 Standard for its low latency and availability, overlooking the cost savings of Intelligent-Tiering for unpredictable access patterns, or mistakenly select S3 Glacier Deep Archive thinking it is the cheapest option without considering the retrieval time requirement of 'within minutes'.

How to eliminate wrong answers

Option A is wrong because S3 Standard is designed for frequently accessed data and would be cost-inefficient for data that becomes rarely accessed after a few days, as it charges the same rate regardless of access frequency. Option C is wrong because S3 Glacier Deep Archive has retrieval times of 12 hours or more (not minutes) and is intended for archival data that is accessed at most once or twice per year, making it unsuitable for data that needs availability within minutes. Option D is wrong because S3 One Zone-Infrequent Access stores data in a single Availability Zone, which risks data loss if that zone fails, and it does not automatically adapt to changing access patterns, requiring manual lifecycle transitions to avoid higher costs when data becomes rarely accessed.

Full explanation →
1059
Multi-Selectmedium

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

Select 3 answers
A.SSE-C
B.Client-side encryption
C.SSE-S3
D.SSE-KMS
E.AWS IAM
AnswersA, C, D

Server-side encryption with customer-provided keys.

Why this answer

SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows you to encrypt data at rest in S3 using your own encryption keys, which you manage outside of AWS. You provide the encryption key as part of your PUT request, and S3 uses it to encrypt the object before writing it to disk, then discards the key from memory. This method gives you full control over the key lifecycle while still leveraging S3's server-side encryption infrastructure.

Exam trap

The trap here is that candidates may confuse client-side encryption (which happens before data reaches S3) with server-side encryption at rest, or incorrectly assume that IAM provides encryption capabilities when it only controls access permissions.

Full explanation →
1060
MCQmedium

A company uses AWS Organizations with several OUs. The security team wants to restrict the use of specific instance types (e.g., all instances except t2.micro) across all accounts. Which SCP should be applied?

A.An IAM policy applied to each account's admin role to restrict instance types.
B.An SCP that allows ec2:RunInstances only for t2.micro.
C.An SCP that denies ec2:RunInstances when the instance type is not t2.micro.
D.An AWS Config rule to terminate non-compliant instances.
AnswerC

Deny SCPs block non-compliant actions.

Why this answer

An SCP that denies ec2:RunInstances when the instance type is not t2.micro will prevent launching any instance type other than t2.micro. SCPs are centralized and can be applied to OUs. Option A is incorrect because IAM policies are per-account and not centralized.

Option B is incorrect because an allow SCP by itself would only allow t2.micro but would not prevent other instance types unless the default is to deny all, which is not the case. Option D is incorrect because AWS Config rules are reactive and do not prevent actions; they only detect and can remediate after the fact.

Full explanation →
1061
Multi-Selectmedium

A company is migrating a legacy application to AWS. The application requires a relational database with read replicas for reporting. The company wants to minimize operational overhead. Which TWO database services meet these requirements?

Select 2 answers
A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon Aurora
D.Amazon RDS for MySQL
E.Amazon ElastiCache
AnswersC, D

Managed relational with up to 15 read replicas.

Why this answer

Amazon Aurora is a MySQL- and PostgreSQL-compatible relational database built for the cloud, combining the performance and availability of high-end commercial databases with the simplicity and cost-effectiveness of open-source databases. It supports up to 15 low-latency read replicas, which can be used for reporting workloads, and it automates time-consuming tasks such as hardware provisioning, database setup, patching, and backups, thereby minimizing operational overhead.

Exam trap

The trap here is that candidates may confuse Amazon RDS for MySQL (Option D) as the only correct relational database with read replicas, but Amazon Aurora is also correct because it is a fully managed relational database that natively supports read replicas with lower operational overhead than standard RDS.

Full explanation →
1062
MCQmedium

A company has a multi-account environment with a centralized network account that hosts a transit gateway. Application accounts need to connect to the transit gateway. The network team wants to ensure that only authorized accounts can create attachments. Which method should be used?

A.Use AWS Direct Connect to connect each application account to the transit gateway.
B.Establish VPC peering connections between each application account and the network account.
C.Use AWS Resource Access Manager (RAM) to share the transit gateway with authorized accounts.
D.Create an SCP that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account.
AnswerC

RAM allows sharing of transit gateways with specific accounts.

Why this answer

AWS Resource Access Manager (RAM) allows the network account to share the transit gateway with specific application accounts, enabling them to create attachments without granting them ownership or management of the transit gateway itself. This approach ensures that only authorized accounts can create VPC attachments to the shared transit gateway, as the sharing is controlled at the resource level and can be revoked at any time.

Exam trap

The trap here is that candidates may confuse service control policies (SCPs) with resource-based policies or RAM, thinking that an SCP can selectively allow specific accounts to create attachments, when in fact SCPs only deny or allow permissions at the account level and cannot grant permissions that the account does not already have via IAM or RAM.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a mechanism to authorize or control which accounts can create transit gateway attachments; it does not address account-level authorization. Option B is wrong because VPC peering connections are point-to-point connections between two VPCs and do not integrate with a transit gateway; they also do not provide a centralized way to authorize multiple accounts to attach to a shared transit gateway. Option D is wrong because a service control policy (SCP) that denies ec2:CreateTransitGatewayVpcAttachment for all accounts except the network account would prevent application accounts from creating any transit gateway attachments, even if they are authorized via RAM; SCPs are used to set permission boundaries, not to selectively grant attachment permissions to specific accounts.

Full explanation →
1063
MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must support sticky sessions. What should they do?

A.Configure an Amazon CloudFront distribution with session affinity.
B.Store session data in Amazon ElastiCache and use a cookie to reference it.
C.Enable sticky sessions on the ALB using duration-based cookies.
D.Use a Network Load Balancer (NLB) with cross-zone load balancing.
AnswerC

ALB supports sticky sessions via cookies.

Why this answer

Application Load Balancers natively support sticky sessions (session affinity) using duration-based cookies. The ALB generates a cookie (AWSALB) that binds a user's session to a specific target instance for the duration of the cookie's lifetime, ensuring consistent user experience without external dependencies.

Exam trap

The trap here is that candidates often confuse stateless session management (e.g., ElastiCache) with ALB sticky sessions, or incorrectly assume that CloudFront or NLB can provide HTTP-level session affinity, when only ALB duration-based cookies directly satisfy the requirement for sticky sessions on the load balancer.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront session affinity (using the CloudFront-Viewer-Address header or cookies) is designed for content delivery and does not integrate with ALB sticky sessions; it would not ensure the ALB routes requests to the same EC2 instance. Option B is wrong because storing session data in ElastiCache with a cookie reference is a valid stateless architecture pattern, but the question explicitly requires sticky sessions on the ALB, not external session storage. Option D is wrong because Network Load Balancers do not support sticky sessions at Layer 4; they operate at the transport layer (TCP/UDP) and cannot inspect or manage HTTP cookies for session affinity.

Full explanation →
1064
Multi-Selecteasy

A company is migrating an on-premises data center to AWS. The company has a large amount of data (50 TB) that needs to be transferred quickly. The internet connection is limited to 100 Mbps. Which TWO methods should the solutions architect consider for the initial data transfer? (Select TWO.)

Select 2 answers
A.Use a VPN connection and rsync
B.Use AWS Snowball Edge devices to ship the data
C.Set up an AWS Direct Connect connection
D.Use AWS DataSync to transfer data over the internet
E.Use Amazon S3 Transfer Acceleration
AnswersB, C

Correct. Snowball Edge provides offline physical shipping, bypassing network constraints and enabling fast, large-scale data transfer.

Why this answer

AWS Snowball Edge is a physical device for offline data transfer, ideal for large datasets (50 TB) over slow networks (100 Mbps). AWS Direct Connect provides a dedicated, high-bandwidth connection that can be provisioned relatively quickly (within days) and offers consistent speeds, making it suitable for the initial transfer. Option D (AWS DataSync over the internet) is not appropriate because it would take approximately 46 days to transfer 50 TB at 100 Mbps, which is not 'quick'.

VPN and rsync (A) are also limited by internet bandwidth, and S3 Transfer Acceleration (E) improves performance but does not bypass bandwidth constraints.

Full explanation →
1065
MCQhard

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

A.Use AWS Lake Formation to define column-level permissions and masking policies.
B.Create separate S3 buckets for each masking policy and copy data accordingly.
C.Use AWS Glue ETL jobs to mask data based on user role at query time.
D.Store masked data in separate prefixes in the same bucket and use S3 bucket policies.
AnswerA

Lake Formation provides fine-grained access control without data duplication.

Why this answer

AWS Lake Formation provides native column-level security and dynamic masking policies that can be applied per user or role without duplicating data. This approach minimizes storage costs because the data remains in a single location, and masking is applied at query time based on the requesting principal's permissions, satisfying the requirement for different masking policies per user.

Exam trap

The trap here is that candidates often confuse S3 bucket policies or Glue ETL jobs with the ability to perform dynamic, per-user column masking at query time, when in fact only Lake Formation provides this capability without data duplication or batch processing.

How to eliminate wrong answers

Option B is wrong because creating separate S3 buckets for each masking policy would multiply storage costs and require complex data synchronization, violating the cost minimization requirement. Option C is wrong because AWS Glue ETL jobs process data in batch, not at query time; masking at query time requires a service like Lake Formation or a query engine that supports dynamic data masking. Option D is wrong because S3 bucket policies cannot apply column-level masking or differentiate masking rules per user; they control access at the object or prefix level, not at the column or row level within a file.

Full explanation →
1066
MCQeasy

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

A.OK
B.ALARM
C.INSUFFICIENT_DATA
D.ERROR
AnswerB

2 consecutive periods of breaching threshold.

Why this answer

The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Exam trap

The trap here is that candidates may confuse the alarm state with the metric value itself, assuming that a high metric value automatically means ALARM, but they must verify that the threshold and evaluation periods are met; however, in this case, the CLI explicitly shows the state as ALARM, so the answer is straightforward.

How to eliminate wrong answers

Option A is wrong because OK state would indicate that the metric is within the threshold (e.g., CPU utilization below 80%), but 85% exceeds it. Option C is wrong because INSUFFICIENT_DATA means there is not enough data to determine the alarm state (e.g., missing metric data points), but the CLI shows data is present and the alarm has evaluated to ALARM. Option D is wrong because ERROR is not a valid CloudWatch alarm state; the valid states are OK, ALARM, and INSUFFICIENT_DATA.

Full explanation →
1067
Multi-Selectmedium

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

Select 2 answers
A.Enable S3 Versioning on the bucket.
B.Enable S3 Block Public Access settings at the account or bucket level.
C.Enable default encryption using SSE-S3.
D.Enable S3 server access logging for the bucket.
E.Configure a bucket policy that denies access unless the request originates from a specific VPC or IP range.
AnswersB, E

Block Public Access prevents any public access, improving security.

Why this answer

S3 Block Public Access settings provide a centralized, account- or bucket-level control that overrides any bucket policies or object ACLs that would grant public access, effectively preventing data exposure. Option E is correct because a bucket policy condition that restricts access to requests originating from a specific VPC or IP range limits the attack surface by ensuring only authorized network paths can reach the bucket, which is a key security best practice for sensitive data.

Exam trap

The trap here is that candidates often confuse data protection features like Versioning and encryption with access control mechanisms, leading them to select options that protect data integrity or confidentiality at rest but do not prevent unauthorized access or exposure.

Full explanation →
1068
MCQhard

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

A.Create VPC peering connections between all VPCs and use security groups for inspection
B.Configure a VPN between each VPC and a central virtual appliance
C.Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC
D.Use AWS Direct Connect to connect all VPCs to a common router
AnswerC

Transit Gateway provides transitive routing and central inspection.

Why this answer

AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Exam trap

The trap here is that candidates often confuse VPC peering (which is simple but unscalable and lacks central inspection) with Transit Gateway, or they incorrectly assume that Direct Connect or VPNs are designed for inter-VPC connectivity rather than hybrid connectivity to on-premises.

How to eliminate wrong answers

Option A is wrong because VPC peering creates a full-mesh topology that does not scale beyond a few VPCs, and security groups cannot inspect traffic between VPCs (they are stateful firewalls at the instance/ENI level, not a central inspection point). Option B is wrong because configuring a VPN between each VPC and a central virtual appliance introduces bandwidth limitations, latency from encryption overhead, and operational complexity for routing and failover; it also does not leverage native AWS networking constructs for high availability. Option D is wrong because AWS Direct Connect provides dedicated physical connectivity to on-premises networks, not private connectivity between VPCs; it would require additional routing and does not inherently provide centralized traffic inspection.

Full explanation →
1069
Multi-Selecthard

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Select 3 answers
A.Implement an Amazon ElastiCache cluster to cache frequently accessed data.
B.Deploy a Multi-AZ RDS instance for automatic failover.
C.Create one or more read replicas of the RDS instance and configure the application to use the reader endpoint.
D.Implement database sharding by splitting the data across multiple RDS instances.
E.Use Amazon RDS Proxy to manage database connections and reduce load.
AnswersA, C, E

Caching reduces database read load, and the application can be modified to read from cache without major changes if using a caching layer.

Why this answer

Options A, C, and E are correct. Amazon ElastiCache reduces database load by caching frequently accessed data. Read replicas offload read traffic from the primary database.

RDS Proxy helps manage database connections and reduce load on the database. Option B (Multi-AZ) provides high availability and automatic failover but does not improve read scalability. Option D (database sharding) requires application modifications and is not the recommended approach for read scalability without modifying the application.

Full explanation →
1070
Multi-Selecthard

A company has multiple AWS accounts in an organization. The security team needs to centrally manage Amazon GuardDuty findings from all accounts. Which THREE steps should the team take to meet this requirement? (Choose THREE.)

Select 3 answers
A.Configure GuardDuty to send findings to Amazon CloudWatch Logs in a central logging account.
B.Create a new S3 bucket in each account to store GuardDuty findings.
C.Designate a delegated administrator account for GuardDuty in AWS Organizations.
D.Enable Amazon GuardDuty in each member account.
E.Use the delegated administrator account to view findings from all accounts in the GuardDuty console.
AnswersC, D, E

The delegated admin can manage GuardDuty across accounts.

Why this answer

Designating a delegated administrator account for GuardDuty in AWS Organizations centralizes management of findings across all member accounts. This allows the security team to view, manage, and respond to findings from a single account without needing to log into each individual account.

Exam trap

The trap here is that candidates might think sending findings to CloudWatch Logs or S3 is the correct way to centralize management, but AWS's native multi-account architecture for GuardDuty relies on the delegated administrator and member account model, not log aggregation.

Full explanation →
1071
MCQhard

A gaming company is designing a new real-time multiplayer game backend on AWS. The game requires low-latency communication between players (< 50 ms) and the ability to handle up to 100,000 concurrent players. The backend must manage game state, player matchmaking, and chat. The company wants to use managed AWS services to reduce operational overhead. Which solution should a Solutions Architect recommend?

A.Use Amazon DynamoDB for game state, AWS Lambda for game logic, and API Gateway for client communication.
B.Use Amazon GameLift for session-based game server hosting, with its built-in matchmaking and fleet management.
C.Deploy game servers on EC2 instances behind a Network Load Balancer. Use ElastiCache for Redis for game state and SQS for chat messages.
D.Use Amazon ECS with Fargate to run game server containers, and use Application Auto Scaling to handle load.
AnswerB

GameLift is purpose-built for multiplayer games, handles scaling, matchmaking, and low-latency.

Why this answer

Amazon GameLift is purpose-built for session-based multiplayer game hosting, providing integrated matchmaking, fleet management, and auto-scaling to handle up to 100,000 concurrent players with low latency. Option A is incorrect because although DynamoDB can store game state, AWS Lambda is not ideal for real-time game logic due to cold start latency and limited execution duration, and API Gateway adds latency overhead, making it unsuitable for sub-50 ms requirements. Option C is incorrect because deploying game servers on EC2 instances requires manual management of scaling, patching, and fleet health, increasing operational overhead, and while ElastiCache Redis can handle game state and SQS can handle chat, the overall solution lacks a managed game server hosting service.

Option D is incorrect because Amazon ECS with Fargate abstracts infrastructure management but does not provide built-in session management, matchmaking, or low-latency optimization for gaming workloads, and containers may introduce latency overhead.

Full explanation →
1072
MCQhard

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

A.Amazon Kinesis Data Streams + AWS Lambda
B.Amazon S3 + AWS Lambda
C.Amazon Kinesis Data Firehose + Amazon Redshift
D.Amazon SQS + AWS Lambda
AnswerA

Kinesis Data Streams provides low-latency ingestion with replay capability; Lambda processes records in real time.

Why this answer

Amazon Kinesis Data Streams can ingest and buffer millions of events per second with sub-100 ms latency, and AWS Lambda can process each record in near real-time as it arrives in the stream. This combination meets the low-latency requirement and allows events to be replayed from the stream's retention window (up to 365 days with extended retention).

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (which is near-real-time with batching) with Kinesis Data Streams (which is true real-time), or assume SQS can handle high-throughput streaming with replay, but SQS lacks ordered delivery and long-term retention for replay.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service with eventual consistency and no built-in real-time streaming capability, making it unsuitable for sub-100 ms event processing. Option C is wrong because Amazon Kinesis Data Firehose delivers data in batches (typically 60 seconds or 1 MB) and Amazon Redshift is a data warehouse optimized for analytical queries, not real-time per-event processing under 100 ms. Option D is wrong because Amazon SQS is a message queue with at least once delivery and typical latencies in the tens to hundreds of milliseconds, but it lacks the ordered replay and high-throughput streaming capabilities required for millions of events per second.

Full explanation →
1073
Multi-Selecteasy

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to ensure that all future stack updates follow best practices for change management. Which THREE actions should the team implement?

Select 3 answers
A.Enable drift detection to identify resources that have changed outside of CloudFormation.
B.Use IAM policies to restrict who can update stacks and require approval.
C.Use nested stacks to reuse templates across multiple environments.
D.Apply a stack policy to protect critical resources from accidental updates.
E.Require change sets to be created and reviewed before executing stack updates.
AnswersB, D, E

IAM policies control who can perform stack updates.

Why this answer

Options B, D, and E are correct. IAM policies enforce least privilege and require approval for updates (B), stack policies protect critical resources from accidental changes (D), and change sets allow review and approval before execution (E). Option A (drift detection) is a monitoring tool, not a change management control.

Option C (nested stacks) promotes template reuse but does not enforce change management processes.

Full explanation →
1074
Multi-Selecteasy

A company is migrating a legacy batch processing system to AWS. The batch jobs run on a schedule and process files from an FTP server. The company wants a serverless solution. Which THREE AWS services should be combined to implement the solution?

Select 3 answers
A.Amazon EventBridge (CloudWatch Events)
B.Amazon EC2 with Auto Scaling
C.AWS Lambda
D.Amazon S3
E.Amazon Simple Workflow Service (SWF)
AnswersA, C, D

Amazon EventBridge can schedule events to trigger a serverless workflow, such as invoking a Lambda function at specified times.

Why this answer

Options A, C, and D are correct. Amazon EventBridge (formerly CloudWatch Events) can schedule events to trigger AWS Lambda functions. Lambda can process the batch files.

Amazon S3 can store the files. Option B (EC2 with Auto Scaling) is not serverless. Option E (Simple Workflow Service) is an older workflow service not optimized for this serverless batch processing scenario.

Full explanation →
1075
MCQmedium

A company is migrating its data warehouse from on-premises to Amazon Redshift. The current on-premises data warehouse runs on a proprietary MPP system. The company wants to minimize downtime and ensure data consistency. The company has a large volume of historical data (30 TB) and daily incremental updates of 10 GB. Which migration approach should the company use?

A.Use AWS Snowball to transfer the historical data to Amazon S3, then use AWS DMS with ongoing CDC to replicate incremental changes until cutover
B.Use an ETL tool to extract data from the source and load directly into Amazon Redshift during a maintenance window
C.Perform a full export of the on-premises database to flat files, transfer them over the network, and load into Amazon Redshift
D.Use AWS DMS with full load only, then schedule a downtime window for the final sync
AnswerA

Correct. Snowball handles large historical data transfer efficiently, and DMS CDC keeps the target updated with minimal downtime.

Why this answer

Using AWS DMS with CDC for incremental data allows zero-downtime migration by keeping the target in sync. A bulk export/import approach requires downtime for the final load. Using Snowball for historical data and DMS for incremental updates is efficient for large datasets.

Full explanation →
1076
MCQeasy

A company is using AWS CloudFormation to manage infrastructure. The operations team wants to be notified when a stack operation fails. Which approach is the MOST efficient?

A.Create a scheduled CloudWatch Events rule that calls the DescribeStacks API and sends an alert if status is FAILED
B.Configure an SNS topic as a notification option in the CloudFormation stack
C.Use a Lambda function that is invoked by CloudFormation via custom resource
D.Use Amazon EventBridge to monitor CloudFormation API calls and trigger a Lambda function
AnswerB

CloudFormation sends real-time notifications on stack events.

Why this answer

CloudFormation can directly publish to SNS topics on stack events, including failures. Option A is inefficient because it requires polling. Option C is not native.

Option D is expensive and complex.

Full explanation →
1077
MCQmedium

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

A.Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.
B.Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.
C.Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.
D.Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.
AnswerA

Reserved concurrency ensures the function can scale, and SQS event source mapping provides at-least-once processing.

Why this answer

Configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Exam trap

The trap here is that candidates often assume increasing the batch size or using a dead-letter queue alone prevents message loss, but they overlook the critical need for reserved concurrency to guarantee scaling capacity during sudden spikes.

How to eliminate wrong answers

Option B is wrong because SQS cannot invoke Lambda asynchronously; Lambda must be configured as an event source mapping that synchronously pulls messages from the queue, and setting a 5-minute timeout does not address scaling or message loss. Option C is wrong because a 30-second visibility timeout is too short for Lambda processing, risking messages becoming visible again before processing completes, leading to duplicate processing; while a dead-letter queue captures failures, it does not prevent message loss during scaling. Option D is wrong because using a FIFO queue with a reserved concurrency of 1 severely limits throughput and prevents scaling to handle a sudden increase in messages, as FIFO queues process messages in order with limited concurrency.

Full explanation →
1078
MCQeasy

A company plans to migrate 50 on-premises virtual machines (VMs) to AWS. The migration must be completed within 2 weeks. The VMs run various operating systems and have a total data size of 10 TB. The company has a low-bandwidth internet connection (50 Mbps). Which migration approach minimizes the time to transfer the data?

A.Set up an AWS Direct Connect connection to increase bandwidth
B.Create a VPN tunnel to AWS and use rsync to copy the data
C.Use AWS Application Migration Service to replicate the VMs continuously
D.Use AWS Snowball Edge to transfer the VM images physically
AnswerD

Correct: Snowball Edge can transfer 10 TB quickly via physical shipment.

Why this answer

AWS Snowball Edge is a physical device that can handle large data transfers over low-bandwidth connections. AWS Application Migration Service relies on network replication, which would be too slow. Direct Connect would require longer setup time.

VPN is also network-based and slow.

Full explanation →
1079
MCQeasy

A development team deploys a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent 503 errors. A Solutions Architect notices that the errors coincide with high CPU utilization on the EC2 instances. What is the MOST effective way to improve the application's availability?

A.Increase the idle timeout setting on the Application Load Balancer.
B.Decrease the health check interval on the Application Load Balancer.
C.Configure an Auto Scaling group for the EC2 instances with a scaling policy based on average CPU utilization.
D.Use larger EC2 instance types to handle the load.
AnswerC

Auto Scaling dynamically adds/removes instances based on demand, maintaining availability and reducing 503 errors.

Why this answer

An Auto Scaling group with a scaling policy based on average CPU utilization dynamically adds or removes EC2 instances to handle load spikes, reducing 503 errors. Option A is wrong because increasing the idle timeout on the ALB does not address high CPU utilization on the instances. Option B is wrong because decreasing the health check interval may cause premature instance replacement without resolving the underlying capacity issue.

Option D is wrong because using larger instance types may help but does not provide dynamic scaling and may be less cost-effective; it does not automatically adjust to fluctuating demand.

Full explanation →
1080
MCQmedium

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

A.The upload succeeds because the Deny statement has no Principal specified.
B.The upload is denied only if the object is larger than 5 GB.
C.The upload succeeds because the user has an Allow for s3:PutObject.
D.The upload is denied because the Deny statement applies to all uploads.
AnswerD

The Deny is unconditional.

Why this answer

The explicit Deny statement without any condition applies to all uploads, overriding any Allow statements. Option A is incorrect because the Deny statement still applies even without a Principal (since it's attached to the user). Option B is incorrect because there is no size condition; the Deny applies to all uploads regardless of size.

Option C is incorrect because the explicit Deny overrides the Allow for s3:PutObject.

Full explanation →
1081
Multi-Selecthard

A company is designing a multi-account AWS environment using AWS Organizations. The company has several business units that each require their own VPC in shared accounts managed centrally. The company wants to enable VPC sharing to allow business units to create resources in shared subnets while maintaining network isolation. Which combination of steps should the company take to achieve this? (Choose TWO.)

Select 2 answers
A.Create a resource share in AWS Resource Access Manager (RAM) for the shared VPC subnets.
B.Attach a transit gateway to the shared VPC and to each business unit's VPC.
C.Configure VPC endpoints in each business unit VPC to access the shared VPC.
D.Create VPC peering connections between the shared VPC and each business unit's VPC.
E.Use AWS PrivateLink to connect the business unit VPCs to the shared VPC.
AnswersA, B

AWS RAM allows sharing subnets with other accounts in the organization.

Why this answer

AWS Resource Access Manager (RAM) allows you to share subnets from a centrally owned VPC with other AWS accounts within your AWS Organization. This enables business units to launch resources directly into the shared subnets while the VPC and its networking configuration remain managed centrally. Option B is correct because attaching a transit gateway to the shared VPC and to each business unit's VPC provides the necessary network connectivity between the shared VPC and the business unit VPCs, allowing traffic to flow while maintaining isolation through separate route tables and security group boundaries.

Together, these steps enable both resource sharing in the shared subnets and network connectivity with isolation.

Exam trap

The trap here is that candidates might think that VPC peering (option D) or AWS PrivateLink (option E) are required for connectivity, but a transit gateway is more scalable and manageable for connecting multiple VPCs while maintaining network isolation. Additionally, some may mistakenly believe that VPC sharing (via RAM) alone provides connectivity, which it does not; it only allows resource placement in shared subnets.

Full explanation →
1082
Multi-Selectmedium

A company is designing a cross-account backup strategy using AWS Backup. The backup policy must be centrally managed from the management account. Which TWO steps are required to implement this?

Select 2 answers
A.Create IAM roles in each member account to allow AWS Backup to assume them.
B.Create a separate backup policy for each member account.
C.Create a backup vault in the management account and share it with member accounts.
D.Create a backup vault in each member account and aggregate them using AWS Config.
E.Enable AWS Backup as a trusted service within AWS Organizations.
AnswersC, E

Allows member accounts to use the central vault.

Why this answer

Options C and E are correct. Option A is incorrect because IAM roles are not created automatically for AWS Backup; instead, the backup policy is applied via AWS Organizations. Option B is incorrect because a single backup policy can be applied to the entire organization or specific organizational units, not per account.

Option D is incorrect because the backup vault should be in the management account, not in each member account. Option E is correct because enabling AWS Backup as a trusted service within AWS Organizations allows the management account to centrally manage backup policies across member accounts. Option C is correct because sharing the backup vault from the management account allows member accounts to store backups in the central vault.

Full explanation →
1083
MCQhard

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

A.Remove the condition from the bucket policy.
B.Add an IAM policy that allows s3:PutObject to the role.
C.Include the x-amz-server-side-encryption header with value aws:kms in the upload request.
D.Grant the role permission to use the KMS key.
AnswerC

The condition requires that header.

Why this answer

The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Exam trap

The trap here is that candidates often assume the failure is due to missing KMS key permissions (Option D) or missing IAM permissions (Option B), but the actual cause is the bucket policy condition requiring the encryption header, which is a common S3 security pattern tested on the SAP-C02 exam.

How to eliminate wrong answers

Option A is wrong because removing the condition would weaken security by allowing unencrypted uploads, but the question asks what users must do to successfully upload, not how to change the policy. Option B is wrong because the role already has an IAM policy allowing `s3:PutObject`; the failure is due to the bucket policy condition, not a lack of IAM permissions. Option D is wrong because the bucket policy condition only requires the encryption header to be set to `aws:kms`; it does not require the role to have KMS key permissions, and the upload fails at the S3 condition check before any KMS authorization is evaluated.

Full explanation →
1084
Multi-Selecteasy

A company is using AWS CloudFormation to deploy infrastructure. They want to ensure that updates to a stack do not cause downtime for a critical web application. Which THREE strategies should they consider? (Choose THREE.)

Select 3 answers
A.Use the DeletionPolicy attribute to retain resources.
B.Apply a stack policy to protect critical resources.
C.Use a rolling update strategy with an appropriate batch size.
D.Use Change Sets to preview stack updates.
E.Use nested stacks to isolate components.
AnswersB, C, D

Stack policies prevent accidental updates to protected resources.

Why this answer

The correct answers are B, C, D. Option B: Apply a stack policy to protect critical resources. A stack policy is an IAM resource-based policy that controls which stack resources can be updated or deleted.

By setting a stack policy with a Deny for updates on critical resources, you prevent accidental modification during stack updates, thus reducing downtime risk. Option C: Use a rolling update strategy with an appropriate batch size. When updating an Auto Scaling group or other resources that support rolling updates, you can configure the update policy to update instances in batches.

This minimizes downtime by ensuring that only a portion of the instances are replaced at a time, keeping the application available. Option D: Use Change Sets to preview stack updates. Change sets allow you to review the changes that will be made to your stack before executing them.

This helps identify potential issues or unintended modifications that could cause downtime, giving you a chance to reject the changes. Option A is incorrect because the DeletionPolicy attribute is used to preserve or back up resources when a stack is deleted, not during updates. It does not prevent downtime during updates.

Option E is incorrect because nested stacks help organize resources into reusable components but do not inherently prevent downtime during updates; they are a management and modularity tool, not a downtime prevention strategy.

Full explanation →
1085
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

A.Rerun the stack update with the --disable-rollback flag and then describe the stack events.
B.Delete the stack and review the CloudFormation logs.
C.Create a change set to preview the updates.
D.Use the AWS CLI describe-stack-resources command to see the status of each resource.
AnswerA

Rerunning with --disable-rollback prevents rollback and allows you to describe stack events to find the specific error reason.

Why this answer

Using the --disable-rollback flag when rerunning the update prevents the stack from rolling back on failure, allowing the team to describe stack events and investigate the specific error without losing the failed state. Option B is incorrect because deleting the stack would remove the failure logs and prevent investigation. Option C is incorrect because a change set is used to preview updates before execution, not to troubleshoot a failure that has already occurred.

Option D is incorrect because describe-stack-resources only shows resource status (e.g., CREATE_FAILED) but does not provide the detailed error reason; you need stack events to see the specific error message.

Full explanation →
1086
MCQeasy

A company is migrating an application that uses a commercial database to Amazon RDS. The database size is 500 GB. Which migration approach minimizes downtime?

A.Use native database tools to export and import data.
B.Use AWS Snowball Edge to transfer the database files.
C.Use AWS Database Migration Service (AWS DMS) with ongoing replication (change data capture).
D.Copy database files to Amazon S3 and restore to RDS.
AnswerC

DMS with CDC allows near-zero downtime.

Why this answer

AWS Database Migration Service (AWS DMS) with ongoing replication (change data capture) allows the source database to remain fully operational during migration, with only a brief downtime during the final cutover. This minimizes overall downtime. Option A is incorrect because using native database tools for export and import requires taking the source database offline for the duration of the export and import.

Option B is incorrect because AWS Snowball Edge is an offline data transfer device; it requires copying database files to the device and shipping it, which does not support ongoing replication and results in significant downtime. Option D is incorrect because copying database files to Amazon S3 and restoring to RDS involves creating a backup of the database, which can cause downtime, and the restore process also takes time.

Full explanation →
1087
MCQmedium

A company is migrating a large-scale batch processing system from on-premises to AWS. The system processes hundreds of thousands of files daily, each file being a few MB in size. The files are received via SFTP and need to be processed within 4 hours. The company wants to use AWS services to build a fully managed, scalable, and cost-effective solution. The current on-premises system uses a single server with a scheduled task that processes files sequentially. The migration should improve throughput and reduce processing time. Which architecture should the company implement?

A.Use AWS Transfer Family for SFTP, store files in Amazon S3, and use AWS Batch with Fargate launch type to process files in parallel.
B.Use AWS Transfer Family for SFTP, store files in Amazon S3, and use AWS Lambda functions triggered by S3 events to process each file.
C.Use AWS Transfer Family for SFTP, store files in Amazon S3, and configure a single EC2 instance to poll S3 for new files and process them sequentially.
D.Use AWS Transfer Family for SFTP, store files in Amazon S3, configure an S3 event notification to publish messages to an Amazon SQS queue, and use an Auto Scaling group of EC2 instances to process messages from the queue.
AnswerD

SQS decouples and scales processing; Auto Scaling based on queue depth improves throughput.

Why this answer

It uses AWS Transfer Family for managed SFTP, stores files in S3, and then leverages S3 event notifications to send messages to an SQS queue. An Auto Scaling group of EC2 instances can then process messages from the queue, scaling based on queue depth (e.g., using CloudWatch alarms). This provides scalable, parallel processing, improving throughput over the on-premises sequential system.

Option A is incorrect because AWS Batch with Fargate may incur higher costs for long-running jobs and is subject to concurrency limits. Option B is incorrect because AWS Lambda has a 15-minute timeout and is not suitable for files that may take longer to process, and also may not be cost-effective for high-volume processing. Option C is incorrect because a single EC2 instance processes sequentially, similar to on-premises, and does not improve throughput.

Full explanation →
1088
MCQeasy

A company is migrating a virtualized workload to AWS. The current environment uses VMware vSphere. The company wants to migrate the virtual machines (VMs) to AWS with minimal changes. Which AWS service should the company use?

A.VMware Cloud on AWS
B.AWS Migration Hub
C.AWS Application Discovery Service
D.AWS VM Import/Export
AnswerD

VM Import/Export enables importing VMs from on-premises to AWS as EC2 instances.

Why this answer

AWS VM Import/Export allows you to import virtual machines from on-premises environments, including VMware vSphere, into Amazon EC2 as AMIs, enabling migration with minimal changes. Option A is wrong because VMware Cloud on AWS is a managed service that runs VMware SDDC on AWS, but it does not directly migrate existing VMs to EC2; it requires the VMs to be moved into the SDDC. Option B is wrong because AWS Application Discovery Service is used for discovery and assessment, not for actual migration.

Option C is wrong because AWS Migration Hub provides a central tracking dashboard for migrations but does not perform the migration itself.

Full explanation →
1089
MCQmedium

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

A.Create a separate VPC in each account and connect them with VPC peering.
B.Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.
C.Set up an AWS Transit Gateway and attach the VPCs from each account.
D.Create VPC peering connections between the networking account and each workload account.
AnswerB

RAM enables subnet sharing with minimal overhead.

Why this answer

AWS Resource Access Manager (RAM) allows you to share a subnet from a central VPC in the networking account with other AWS accounts without creating separate VPCs or complex networking. This enables workload accounts to launch resources directly into the shared subnet, achieving low latency by keeping them in the same VPC and Availability Zone. RAM handles the cross-account sharing with minimal operational overhead, as it does not require additional network appliances or routing configuration.

Exam trap

The trap here is that candidates often overcomplicate the solution by choosing Transit Gateway or VPC peering, thinking they need to interconnect VPCs, when the simplest and most cost-effective approach is to share the existing subnet directly using AWS RAM.

How to eliminate wrong answers

Option A is wrong because creating separate VPCs in each account and connecting them with VPC peering introduces additional complexity, does not share a single subnet, and VPC peering is not transitive, requiring full mesh connectivity for multiple accounts. Option C is wrong because AWS Transit Gateway adds operational overhead for managing attachments, route tables, and potentially higher costs, while the requirement is simply to share a subnet, not to interconnect multiple VPCs. Option D is wrong because VPC peering connections between the networking account and each workload account would require managing multiple peering connections and routing updates, and does not allow direct sharing of a subnet; resources would still be in separate VPCs, potentially increasing latency.

Full explanation →
1090
MCQeasy

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

A.Use AWS Lambda to re-enable GuardDuty if it is disabled.
B.Create an AWS Config rule to detect disabled GuardDuty and send alerts.
C.Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.
D.Attach an IAM policy to each user that denies guardduty:Disable* actions.
AnswerC

SCPs prevent the actions across all accounts in the OU, regardless of user permissions.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Exam trap

The trap here is that candidates often choose a detective or reactive solution (like AWS Config or Lambda) because they overlook the requirement to *prevent* the action, or they mistakenly believe IAM policies attached to users are sufficient to block all principals, including the root user and cross-account roles.

How to eliminate wrong answers

Option A is wrong because using AWS Lambda to re-enable GuardDuty is a reactive, non-preventive approach; it does not block the disable action itself, and there is a window of vulnerability between the disable event and the Lambda execution. Option B is wrong because an AWS Config rule can only detect and alert on a non-compliant state (e.g., GuardDuty disabled), but it cannot prevent the disable action from occurring. Option D is wrong because IAM policies attached to individual users do not prevent the root user or other principals (such as roles or services) from disabling GuardDuty, and they are not enforceable across all accounts in the OU without manual, error-prone replication.

Full explanation →
1091
Drag & Dropmedium

Drag and drop the steps to configure an Application Load Balancer with HTTPS listeners in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First get the certificate, then create the target group, then the ALB with HTTPS, register targets, and update DNS.

Full explanation →
1092
MCQmedium

A company is migrating a web application to AWS and wants to use Amazon ECS with Fargate. The application needs to store session state. Which AWS service should the company use for session state management?

A.Amazon ElastiCache for Redis
B.Amazon S3
C.Amazon DynamoDB
D.Amazon RDS
AnswerA

ElastiCache for Redis is ideal for session state management.

Why this answer

Amazon ElastiCache for Redis is a fully managed, in-memory caching service that provides low-latency access to session data, making it ideal for session state management in containerized applications on ECS Fargate. Option B (Amazon S3) is wrong because S3 is object storage with higher latency and is not designed for frequent, low-latency read/write operations required for session state. Option C (Amazon DynamoDB) is wrong because while it can be used, it is not the most common or recommended choice for session state due to higher latency compared to in-memory caching; ElastiCache is typically preferred.

Option D (Amazon RDS) is wrong because RDS is a relational database service for persistent storage, not for transient session state with low-latency requirements.

Full explanation →
1093
MCQmedium

A company is designing a new application that requires a relational database with high read capacity. The application is read-heavy and requires low latency. Which database configuration should be used?

A.Amazon RDS with read replicas
B.Amazon DynamoDB with DAX
C.Amazon RDS with Multi-AZ deployment
D.Amazon ElastiCache for Redis
AnswerA

Read replicas scale read capacity.

Why this answer

Amazon RDS with read replicas is the correct choice because the application is read-heavy and requires low latency. Read replicas offload read traffic from the primary database instance, scaling read capacity and reducing latency for read operations by distributing the load across multiple copies of the data.

Exam trap

The trap here is that candidates often confuse Multi-AZ deployments with read replicas, assuming Multi-AZ also improves read performance, but Multi-AZ only provides failover redundancy and does not offload read traffic.

How to eliminate wrong answers

Option B is wrong because Amazon DynamoDB with DAX is a NoSQL key-value and document database, not a relational database, and the question explicitly requires a relational database. Option C is wrong because Amazon RDS with Multi-AZ deployment provides high availability and failover support, but does not increase read capacity or reduce read latency; it only maintains a standby replica for disaster recovery. Option D is wrong because Amazon ElastiCache for Redis is an in-memory data store, not a relational database, and while it can cache data to improve read performance, it does not serve as the primary relational database itself.

Full explanation →
1094
MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

A.Decrease the CPU utilization threshold for scale-out.
B.Increase the cooldown period for the Auto Scaling group.
C.Implement scheduled scaling actions to add capacity before known peak times.
D.Change the scaling policy to step scaling with a higher step adjustment.
AnswerC

Scheduled scaling proactively adds capacity based on expected traffic.

Why this answer

Scheduled scaling can proactively add capacity before known peak times, preventing slow response times during traffic spikes. Option A is incorrect because decreasing the CPU utilization threshold would cause the Auto Scaling group to scale out sooner, which could help with responsiveness but may lead to over-provisioning and increased costs; however, it does not address the slow response times during a spike that has already started. Option B is incorrect because increasing the cooldown period delays subsequent scaling actions, making the system less responsive during a spike.

Option D is incorrect because step scaling with a higher step adjustment is still a reactive measure; it does not add capacity before the spike and may cause abrupt scaling that could overshoot.

Full explanation →
1095
MCQmedium

A company is migrating a critical application to AWS. The application requires consistent performance and low latency. The company has selected an instance type that meets the performance requirements. However, during testing, the application experiences variable performance due to CPU stealing from other instances on the same physical host. What should the company do to mitigate this issue?

A.Use Amazon EC2 Dedicated Hosts for the instances
B.Launch instances in a cluster placement group
C.Use T2 or T3 instances with the unlimited credit option
D.Switch to a compute-optimized instance type such as C5
AnswerA

Dedicated Hosts provide physical isolation, eliminating CPU stealing.

Why this answer

Dedicated Hosts provide dedicated physical servers, eliminating CPU stealing. Option B (placement group) helps with network performance, not CPU isolation. Option C (T2/T3 unlimited) is for burstable instances, not dedicated.

Option D (C5 instance) does not prevent CPU stealing.

Full explanation →
1096
MCQeasy

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

A.Add a lifecycle policy to transition objects to SSE-KMS.
B.Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.
C.Change the bucket's default encryption configuration to SSE-KMS.
D.Use a bucket policy to deny uploads without SSE-KMS.
AnswerC

Default encryption applies automatically to all new objects; existing objects remain with SSE-S3.

Why this answer

Changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys.

Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Full explanation →
1097
MCQmedium

An S3 bucket is created using the above CloudFormation template. What happens to objects in the bucket after 30 days?

A.Objects are transitioned to Glacier
B.The lifecycle rule is not applied because no prefix is specified
C.Objects are archived to S3 Standard-IA
D.Objects are permanently deleted
AnswerD

ExpirationInDays causes deletion after 30 days.

Why this answer

The CloudFormation template defines a lifecycle rule with an expiration action that deletes objects after 30 days. Since no prefix is specified, the rule applies to all objects in the bucket. After 30 days, objects are permanently deleted, not transitioned to another storage class.

Exam trap

The trap here is that candidates often confuse expiration (deletion) with transition (moving to another storage class) and may incorrectly assume a prefix is mandatory for lifecycle rules to apply.

How to eliminate wrong answers

Option A is wrong because the lifecycle rule specifies an 'Expiration' action, not a 'Transition' action, so objects are deleted, not moved to Glacier. Option B is wrong because a lifecycle rule without a prefix applies to the entire bucket; a prefix is optional and not required for the rule to be effective. Option C is wrong because the rule does not include a transition to S3 Standard-IA; it only has an expiration action that deletes objects.

Full explanation →
1098
MCQmedium

A company uses AWS Organizations with multiple OUs. The finance team needs visibility into costs across all accounts. They want to tag resources with a 'CostCenter' tag. What is the BEST way to enforce tag propagation?

A.Use AWS Service Catalog to enforce tagging on provisioned products.
B.Run a Lambda function that tags resources after creation based on the creator's cost center.
C.Use AWS Config rules to mark non-compliant resources and auto-remediate.
D.Apply an SCP that denies ec2:RunInstances unless the request includes the CostCenter tag.
AnswerD

SCP can enforce tag requirements at creation time.

Why this answer

An SCP that denies ec2:RunInstances unless the request includes the CostCenter tag enforces tag propagation at the point of resource creation. This is a preventive control that blocks non-compliant actions before they happen, ensuring all EC2 instances are tagged from the start. It leverages AWS Organizations to apply the policy across all accounts in the specified OUs, providing centralized enforcement without relying on post-creation remediation.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config auto-remediation (Option C) because they are familiar with it, but the question asks for the 'BEST' way to enforce tag propagation, which requires a preventive control (SCP) to stop untagged resources from being created in the first place.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog only enforces tagging on provisioned products created through the catalog, not on resources created directly via APIs or other services, leaving gaps in coverage. Option B is wrong because a Lambda function that tags resources after creation is a detective/reactive approach that cannot prevent untagged resources from being created, and it may fail if the creator's cost center cannot be reliably determined. Option C is wrong because AWS Config rules are detective and auto-remediation is reactive—non-compliant resources can exist temporarily, incurring costs without proper tagging, and auto-remediation may not cover all resource types or may have execution delays.

Full explanation →
1099
MCQhard

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

A.Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries
B.Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries
C.Store data in Amazon EMR on EC2 and query with Hive
D.Store data in Amazon Redshift and query with Redshift Spectrum
AnswerA

S3 provides cost-effective storage with lifecycle management, and Athena can query data directly.

Why this answer

Amazon S3 lifecycle policies allow automatic transition of objects between storage classes (e.g., S3 Standard to S3 Standard-IA to S3 Glacier Deep Archive) based on age, optimizing cost for varying access patterns. Amazon Athena enables serverless SQL querying directly on data stored in S3, making it ideal for a petabyte-scale data lake without managing infrastructure.

Exam trap

The trap here is that candidates may confuse S3 Select with Athena, not realizing S3 Select is limited to single-object filtering and cannot perform joins or aggregations across multiple files, which is required for SQL queries on a data lake.

How to eliminate wrong answers

Option B is wrong because S3 Select is designed for simple filtering of single objects (e.g., retrieving a subset of rows/columns from a CSV file), not for running complex SQL queries across multiple objects or petabytes of data. Option C is wrong because storing data in Amazon EMR on EC2 requires provisioning and managing clusters, which is less cost-effective and more operationally complex than a serverless approach for a data lake. Option D is wrong because Amazon Redshift is a data warehouse optimized for structured, aggregated data, not a cost-effective storage layer for raw, diverse data at petabyte scale; Redshift Spectrum can query S3 but still requires a Redshift cluster, incurring additional costs.

Full explanation →
1100
MCQeasy

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

A.The read replica in a different region is now serving traffic.
B.The Multi-AZ configuration was disabled during the failover.
C.A pending modification to the DB instance was applied during failover.
D.The DB parameter group was changed to a less efficient configuration.
AnswerC

Pending modifications are applied during failover, which can cause latency.

Why this answer

The most likely cause because during a failover, any pending modifications (e.g., scaling, instance type changes) that were scheduled are applied to the new primary, which can cause a brief performance impact. This is a known behavior in AWS RDS. Option A is incorrect because read replicas in a different region do not affect latency of the primary after failover; Multi-AZ does not use read replicas.

Option B is incorrect because Multi-AZ configuration is not disabled during failover; it remains enabled. Option D is incorrect because DB parameter group changes require a manual reboot, not a failover event.

Full explanation →
1101
Multi-Selecteasy

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

Select 2 answers
A.Amazon Simple Notification Service (SNS)
B.AWS Direct Connect
C.Amazon Route 53
D.Amazon Simple Queue Service (SQS)
E.Amazon ElastiCache
AnswersA, D

SNS is a pub/sub service for decoupling.

Why this answer

Amazon Simple Notification Service (SNS) is a fully managed pub/sub messaging service that enables microservices to communicate asynchronously. One service can publish a message to an SNS topic, and multiple subscriber services (e.g., Lambda, SQS, HTTP endpoints) can receive and process that message independently, decoupling the producer from the consumers.

Exam trap

The trap here is that candidates often confuse caching services (ElastiCache) or network services (Direct Connect, Route 53) with messaging services, failing to recognize that decoupling requires asynchronous communication via queues or pub/sub topics.

Full explanation →
1102
Multi-Selectmedium

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Select 2 answers
A.Modify the CloudFormation template to use a different instance type.
B.Create a new IAM service role for CloudFormation and assign it to the stack.
C.Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.
D.Grant the user additional IAM permissions to create EC2 instances.
E.Execute a stack update with the corrected IAM role.
AnswersC, E

The CloudFormation service needs permission to create the EC2 instance.

Why this answer

Options C and E are correct. The error indicates that the IAM role used by CloudFormation to create the EC2 instance lacks the ec2:RunInstances permission. Therefore, updating the IAM role to include this permission (C) and then executing a stack update (E) will resolve the issue.

Option A is incorrect because the instance type is not related to the IAM permissions error. Option B is incorrect because creating a new role is unnecessary; updating the existing role suffices. Option D is incorrect because granting permissions to the user does not affect the CloudFormation service role's permissions.

Full explanation →
1103
MCQhard

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

A.No, because the source identity does not match.
B.Yes, because the role in account 222222222222 is allowed by the principal.
C.No, because cross-account role assumption is not allowed.
D.Yes, because the source identity condition is optional.
AnswerA

The condition requires source identity 'central-admin', but it is 'admin'.

Why this answer

The assumption fails because the trust policy on AuditRole includes a `sts:SourceIdentity` condition that requires the source identity to match a specific value (e.g., 'auditor'), but the session is launched with source identity 'admin'. Since the condition is not satisfied, AWS STS denies the AssumeRole API call, even though the principal (the Admin role in account 222222222222) is allowed by the `Principal` element. The `sts:SourceIdentity` condition key is evaluated at request time and must match exactly for the policy to grant access.

Exam trap

The trap here is that candidates assume a trust policy only needs a matching principal and action to succeed, overlooking that condition keys like `sts:SourceIdentity` can independently deny the request even when the principal is valid.

How to eliminate wrong answers

Option B is wrong because while the principal is allowed, the trust policy also includes an `sts:SourceIdentity` condition that must be satisfied; the condition fails due to mismatched source identity, so the assumption is denied. Option C is wrong because cross-account role assumption is explicitly allowed when the trust policy grants access to a principal from another account, which is the case here. Option D is wrong because the `sts:SourceIdentity` condition is not optional—it is a required condition in the policy statement, and if it is present, it must be satisfied for the request to succeed.

Full explanation →
1104
Multi-Selectmedium

A company is migrating a legacy application to AWS. The application requires a relational database. The company wants to minimize operational overhead. Which TWO options should the company consider? (Choose two.)

Select 2 answers
A.AWS Database Migration Service
B.Amazon Aurora
C.Amazon S3
D.Amazon RDS
E.Amazon EC2 with self-managed database
AnswersB, D

Managed relational database with MySQL/PostgreSQL compatibility.

Why this answer

Amazon Aurora (option B) and Amazon RDS (option D) are both fully managed relational database services that minimize operational overhead. AWS Database Migration Service (option A) is a migration tool, not a database service. Amazon S3 (option C) is object storage, not a relational database.

Amazon EC2 with self-managed database (option E) requires manual administration, increasing overhead.

Full explanation →
1105
Multi-Selectmedium

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Select 2 answers
A.Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.
B.Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.
C.Enable IAM Access Analyzer to review and identify IAM roles that grant permissions to external principals or have unused permissions.
D.Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.
E.Enable AWS Resource Access Manager to share resources only with trusted accounts.
AnswersA, C

SCPs enforce preventive controls at the organization level.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Exam trap

The trap here is that candidates often confuse detective controls (like CloudTrail alerts) with preventive controls (like SCPs), assuming monitoring alone is sufficient to enforce least privilege, but the question explicitly asks for actions that 'ensure' compliance, which requires proactive denial, not just detection.

Full explanation →
1106
MCQmedium

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

A.Use Amazon API Gateway in front of each service to throttle requests and protect against traffic spikes.
B.Implement retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code.
C.Convert all inter-service communication to asynchronous messaging using Amazon SQS or SNS.
D.Deploy multiple instances of each service across multiple Availability Zones and use an Application Load Balancer.
AnswerB

Circuit breakers and retries isolate failures and prevent cascading, a standard resilience pattern.

Why this answer

Implementing retry logic with exponential backoff, circuit breakers, and timeouts is the standard pattern to handle transient faults and prevent cascading failures in synchronous microservices communication. Circuit breakers stop calls to a failing service, allowing it to recover, while retries with backoff avoid overwhelming the service. Option A is wrong because API Gateway throttling only protects API Gateway itself, not cascading failures between internal services.

Option C is wrong because converting to asynchronous messaging is an architectural change that may not be suitable for synchronous REST APIs and does not directly address failure cascading without additional patterns. Option D is wrong because deploying multiple instances across AZs improves availability but does not protect against failures within a single service instance; it does not prevent cascading failures.

Full explanation →
1107
MCQmedium

A company wants to migrate a legacy monolithic application to AWS with minimal changes. The application currently runs on a single on-premises server with a Microsoft SQL Server database. The company wants to use AWS managed services to reduce operational overhead. Which combination of services should the company use to meet these requirements?

A.AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon DynamoDB
B.AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server
C.AWS Server Migration Service (SMS) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server
D.AWS CloudFormation to provision EC2 instances, and AWS DMS to Amazon RDS for SQL Server
AnswerB

MGN minimizes changes for server migration, DMS migrates the database to managed RDS.

Why this answer

AWS Application Migration Service (MGN) enables lift-and-shift migration of the on-premises server to Amazon EC2 with minimal changes, while AWS DMS can migrate the Microsoft SQL Server database to Amazon RDS for SQL Server, a fully managed service that reduces operational overhead. This combination meets the requirement of minimal application changes and leverages AWS managed services for the database.

Exam trap

The trap here is that candidates might choose Option A thinking DynamoDB is a managed database service, but they overlook the requirement for minimal changes, which is broken by switching from a relational to a NoSQL database, or they might pick Option C not realizing SMS is deprecated and lacks the continuous replication capabilities of MGN.

How to eliminate wrong answers

Option A is wrong because AWS DMS cannot migrate a SQL Server database to Amazon DynamoDB (a NoSQL database) without significant application changes to adapt to a different data model and query language, violating the 'minimal changes' requirement. Option C is wrong because AWS Server Migration Service (SMS) is deprecated and replaced by AWS Application Migration Service (MGN); using SMS would not be a current best practice and may lack support. Option D is wrong because AWS CloudFormation is an infrastructure-as-code provisioning tool, not a migration service; it does not directly migrate the application or database, and using it alone would not reduce operational overhead for the migration itself.

Full explanation →
1108
MCQeasy

A company is designing a network architecture for a multi-account AWS environment. They need to establish a central inspection VPC through which all traffic between VPCs in different accounts must pass. Which AWS service should be used to route traffic between VPCs through the inspection VPC?

A.AWS Direct Connect gateway
B.VPC peering with full mesh connectivity
C.Elastic Load Balancer
D.AWS Transit Gateway
AnswerD

Transit Gateway supports transitive routing and central inspection VPC architectures.

Why this answer

AWS Transit Gateway (D) is the correct service because it acts as a central hub that can route traffic between multiple VPCs across different accounts, and it supports route tables that can force all inter-VPC traffic through a dedicated inspection VPC (e.g., using a blackhole route or a network appliance). This enables transitive routing without requiring full mesh peering, and it integrates with AWS Resource Access Manager (RAM) for cross-account sharing.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, assuming that a full mesh of peering connections can achieve the same centralized inspection as Transit Gateway, but VPC peering explicitly does not support transitive routing (per AWS documentation), making it impossible to force all traffic through a single inspection VPC without additional, unsupported workarounds.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect gateway is used to connect on-premises networks to AWS via Direct Connect, not for routing traffic between VPCs in different accounts. Option B is wrong because VPC peering with full mesh connectivity does not support transitive routing—each peering connection is a one-to-one relationship, so traffic cannot be forced through a central inspection VPC without complex, non-scalable configurations. Option C is wrong because Elastic Load Balancer is a traffic distribution service for applications, not a routing service for inter-VPC traffic; it cannot route packets between VPCs or enforce inspection paths.

Full explanation →
1109
MCQeasy

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

A.Amazon ElastiCache for Redis
B.Amazon Redshift
C.Amazon RDS for PostgreSQL
D.Amazon DynamoDB
AnswerD

DynamoDB is fully managed, serverless, and scales automatically, ideal for microservices.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Exam trap

The trap here is that candidates often choose Amazon RDS for PostgreSQL because they assume relational databases are required for structured data, but the question emphasizes minimizing operational overhead, and DynamoDB's serverless, fully managed nature eliminates the need for schema management, scaling, and patching that RDS still requires.

How to eliminate wrong answers

Option A is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable primary data store; it is designed for caching, session management, and real-time analytics, not for persistent storage of microservice data. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for complex analytical queries on large datasets, not for transactional or operational data storage required by individual microservices. Option C is wrong because Amazon RDS for PostgreSQL, while a fully managed relational database, introduces operational overhead for schema management, connection pooling, and scaling that contradicts the goal of minimizing operational overhead for microservices, and its relational model is less flexible for the independent data persistence patterns of microservices.

Full explanation →
1110
Multi-Selecteasy

A company is migrating a web application to AWS and wants to use a content delivery network (CDN) to improve performance. Which TWO AWS services can be used together to achieve this? (Choose TWO.)

Select 2 answers
A.Amazon CloudFront
B.Amazon Route 53
C.Amazon S3
D.AWS WAF
E.Application Load Balancer
AnswersA, E

CloudFront is a CDN service.

Why this answer

(Amazon CloudFront) is a content delivery network (CDN) that distributes content globally. Option E (Application Load Balancer) can be used as an origin for CloudFront to distribute traffic across multiple EC2 instances or containers. Option B (Amazon Route 53) is a DNS service, not a CDN.

Option C (Amazon S3) is an object storage service that can serve as an origin for CloudFront but is not a CDN itself. Option D (AWS WAF) is a web application firewall, not a CDN.

Full explanation →
1111
MCQmedium

A solutions architect is trying to export an EC2 instance as a VM using AWS VM Import/Export. The CLI command fails with the error shown in the exhibit. What is the most likely cause?

A.The specified S3 bucket is in a different region.
B.The instance is not an EBS-backed instance.
C.The IAM role used does not have permission to export instances.
D.The instance is based on an instance store-backed AMI.
AnswerB, D

Correct. The error stems from the instance not having an EBS root volume, which is required for export.

Why this answer

The error message indicates that the instance does not have an attached root volume, which is characteristic of an instance store-backed instance. AWS VM Import/Export only supports EBS-backed instances. Since an instance store-backed AMI means the instance is not EBS-backed, both options B (the instance is not an EBS-backed instance) and D (the instance is based on an instance store-backed AMI) accurately describe the cause.

Option A is incorrect because a region mismatch would produce a different error. Option C is incorrect because the error does not mention permissions.

Full explanation →
1112
MCQhard

A company is designing a new data lake on AWS. The data lake will store structured and unstructured data from various sources. The company needs a solution that can automatically catalog the data and make it searchable. Data will be stored in Amazon S3. Which AWS service should be used to catalog and enable search across the data lake?

A.Amazon Athena
B.Amazon EMR
C.Amazon Redshift Spectrum
D.AWS Glue Data Catalog
AnswerD

Glue Data Catalog automatically crawls data sources and stores metadata.

Why this answer

AWS Glue Data Catalog automatically discovers and catalogs metadata from data stored in Amazon S3, making it searchable. Option A, Amazon Athena, is a serverless query service that uses the Glue Data Catalog but does not itself catalog data. Option B, Amazon EMR, is a big data processing service using frameworks like Spark and Hadoop, not a catalog.

Option C, Amazon Redshift Spectrum, allows querying data in S3 from Redshift but does not provide a catalog.

Full explanation →
1113
MCQhard

A company is migrating to AWS and wants to set up a multi-account structure using AWS Organizations. The security team requires that all accounts be part of an organization and that any attempt to leave the organization be blocked. Additionally, the company wants to prevent the use of the root user in member accounts for daily operations. What should they do?

A.Apply an SCP to the root OU that denies the organizations:LeaveOrganization action and denies the root user's ability to perform actions.
B.Create an IAM policy that denies the organizations:LeaveOrganization action and attach it to all IAM users.
C.Use AWS Config rules to detect when an account leaves the organization and automatically rejoin it.
D.Use AWS CloudTrail to monitor and alert on root user activity and organizations:LeaveOrganization.
AnswerA

SCPs apply to root user and all IAM entities; can block leave and restrict root.

Why this answer

An SCP attached to the root OU can deny the organizations:LeaveOrganization action for all accounts in the organization, preventing any account from leaving. Additionally, an SCP can deny all actions for the root user in member accounts by using a condition key such as "aws:PrincipalType": "Root", which effectively blocks root user operations without affecting IAM users or roles. This approach enforces both requirements centrally without requiring per-account configuration.

Exam trap

The trap here is that candidates often assume IAM policies can control root user behavior, but root user is not subject to IAM policies; only SCPs (or a strong password policy with MFA) can restrict root user actions, and SCPs are the only way to block the LeaveOrganization action across all accounts.

How to eliminate wrong answers

Option B is wrong because an IAM policy attached to IAM users does not apply to the root user, so it cannot prevent the root user from performing actions or leaving the organization; the root user is not bound by IAM policies. Option C is wrong because AWS Config rules cannot rejoin an account to an organization after it has left; they can only detect and report compliance, not execute remediation actions that modify Organizations membership. Option D is wrong because monitoring and alerting with CloudTrail only provides visibility after the fact; it does not proactively block the LeaveOrganization action or restrict root user operations.

Full explanation →
1114
MCQeasy

A company is designing a new application to store and retrieve user profile pictures. The images will be accessed frequently and must be served with low latency. Which storage solution should they use?

A.Amazon EBS
B.Amazon S3
C.Amazon EFS
D.Amazon RDS
AnswerB

S3 is object storage optimized for high availability and low latency.

Why this answer

Amazon S3 is ideal for storing and serving static content like images with low latency. Option A (Amazon EBS) is block storage for EC2, Option C (Amazon EFS) is file storage, and Option D (Amazon RDS) is a relational database.

Full explanation →
1115
MCQeasy

A company is designing a web application that must handle sudden spikes in traffic. The application runs in a VPC and uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances. The solution must be cost-effective for variable traffic patterns. Which scaling strategy should be used?

A.Simple scaling with step adjustments
B.Target tracking scaling policy based on average CPU utilization
C.Scheduled scaling
D.Manual scaling
AnswerB

Automatically adjusts capacity to maintain a target metric, cost-effective.

Why this answer

Target tracking scaling policy is the correct choice because it automatically adjusts the desired capacity of the Auto Scaling group to maintain a target metric (e.g., average CPU utilization at 50%) without requiring manual thresholds or step adjustments. This policy is ideal for variable traffic patterns as it dynamically scales in response to real-time demand, optimizing cost by adding or removing instances only as needed.

Exam trap

The trap here is that candidates often confuse simple scaling with step adjustments as being more granular, but target tracking is actually more responsive and cost-effective for variable traffic because it continuously adjusts capacity based on a single target value rather than fixed thresholds.

How to eliminate wrong answers

Option A is wrong because simple scaling with step adjustments requires predefined thresholds and step adjustments, which can lead to over-provisioning or under-provisioning during sudden traffic spikes due to lack of dynamic responsiveness. Option C is wrong because scheduled scaling is designed for predictable traffic patterns (e.g., time-of-day peaks) and cannot handle sudden, unpredictable spikes. Option D is wrong because manual scaling requires human intervention to adjust capacity, which is not cost-effective or responsive for variable traffic patterns.

Full explanation →
1116
Multi-Selecthard

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Select 2 answers
A.Use AWS Config rules to detect users without MFA and send alerts.
B.Enable AWS CloudTrail to log console access without MFA.
C.Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.
D.Use AWS Single Sign-On (SSO) with MFA enabled for all users.
E.Create an IAM policy in each account that denies console access unless aws:MultiFactorAuthPresent is true.
AnswersC, E

SCPs can centrally enforce MFA across all accounts.

Why this answer

A service control policy (SCP) can be applied centrally at the organizational unit or account level to deny all console access unless the `aws:MultiFactorAuthPresent` condition key is `true`. This enforces MFA usage across all member accounts and cannot be overridden by account administrators. Option E is also correct because an IAM policy with the same condition key can be attached to all users or groups within each account, providing an additional layer of enforcement.

Combining both ensures that even if the SCP is bypassed or not applied to a specific account, the IAM policy still enforces MFA. Together, they provide defense in depth.

Exam trap

The trap is that candidates often choose only one of the two preventive controls (SCP or IAM policy) or confuse detective controls (like AWS Config or CloudTrail) with preventive controls. The question requires combining two approaches to enforce MFA across all accounts, and both SCPs and IAM policies are needed for a robust, multi-account strategy. SCPs provide centralized guardrails, while IAM policies provide per-account enforcement that cannot be circumvented by any role that might bypass SCPs.

Full explanation →
1117
MCQmedium

A solutions architect deployed an AWS Lambda function using a deployment package. The function logs the error shown in the exhibit. What is the most likely cause?

A.The deployment package does not include the 'express' npm dependency.
B.The Lambda function has exceeded the maximum memory limit.
C.The Lambda function handler is incorrectly configured.
D.The Lambda execution role does not have permissions to access the module.
AnswerA

The error 'Cannot find module' means the module is missing from the package.

Why this answer

The error indicates that the 'express' module is not found, which means it was not included in the deployment package. Option B is wrong because the function ran, so the handler is correct. Option C is wrong because the Lambda execution role does not affect module availability.

Option D is wrong because the error is a missing module, not a memory issue.

Full explanation →
1118
MCQhard

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The database is 5 TB and has frequent write operations. The migration must have minimal downtime. Which configuration should be used?

A.Use AWS DMS with full load and ongoing replication using CDC
B.Use AWS DataSync for the database files
C.Use AWS SCT to convert schema and then copy data manually
D.Use AWS DMS with full load only
AnswerA

Ongoing replication with CDC keeps the target in sync until cutover, minimizing downtime.

Why this answer

AWS DMS with full load and ongoing replication using CDC allows continuous syncing after the full load, minimizing downtime. Option D (full load only) would cause downtime during migration. Option B (AWS DataSync) is for file-based data, not databases.

Option C (AWS SCT) is for schema conversion only, not data migration.

Full explanation →
1119
MCQhard

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

A.Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.
B.Use AWS Lake Formation to set up the data lake and use its built-in catalog.
C.Use Amazon Athena to create tables and partitions directly from S3.
D.Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.
AnswerA

Glue provides a data catalog and ETL capabilities.

Why this answer

AWS Glue provides a fully managed data catalog that integrates with Amazon Athena and Amazon Redshift Spectrum, making it the central metadata repository for the data lake. It can run ETL jobs for both streaming data (via Glue Streaming ETL) and batch data (via Glue Crawlers and Jobs), satisfying the requirement to catalog and prepare data from Kinesis Data Streams and Snowball. This combination directly meets the need for a unified catalog and query readiness.

Exam trap

The trap here is that candidates often assume Lake Formation (Option B) is the primary catalog service, but it actually uses the Glue Data Catalog as its foundation, and the question requires ETL capabilities that Lake Formation does not natively provide.

How to eliminate wrong answers

Option B is wrong because AWS Lake Formation is a service that simplifies data lake setup and security, but it relies on the AWS Glue Data Catalog as its underlying catalog; it does not provide a separate built-in catalog, and the question specifically asks for cataloging and querying, not just setup. Option C is wrong because Amazon Athena can create tables and partitions directly from S3 using DDL statements, but it lacks the ETL capabilities needed to process and transform streaming data from Kinesis Data Streams and batch data from Snowball; it is a query engine, not an ETL or catalog management service. Option D is wrong because Amazon Kinesis Data Firehose can deliver streaming data to S3, but it cannot catalog the data or handle batch data from Snowball; Athena alone cannot perform ETL or manage a unified catalog for both streaming and batch sources.

Full explanation →
1120
MCQmedium

A company uses AWS Lambda to process incoming messages from an SQS queue. The Lambda function is triggered by SQS and processes messages in batches of 10. Recently, the number of messages has increased significantly, and some messages are being processed multiple times. What should a solutions architect do to ensure exactly-once processing?

A.Use a DynamoDB table to store unique message IDs and check for duplicates before processing.
B.Set the Lambda function's reserved concurrency to a higher value to prevent throttling.
C.Increase the visibility timeout of the SQS queue to 30 minutes.
D.Change the SQS queue to a FIFO queue and enable content-based deduplication.
AnswerD

Correct. Using an SQS FIFO queue with content-based deduplication ensures that duplicate messages are not introduced and each message is processed exactly once. Lambda supports SQS FIFO as an event source.

Why this answer

Exactly-once processing is achieved by using an SQS FIFO queue with content-based deduplication. FIFO queues guarantee that a message is delivered exactly once and consumers receive messages in order. Lambda supports SQS FIFO as an event source, though it has lower throughput limits.

Option A (DynamoDB-based idempotency) also works but adds complexity and cost. Option B (increasing reserved concurrency) only helps with scaling but does not prevent duplicates if a message is processed but the function fails after processing. Option C (increasing visibility timeout) delays reprocessing but does not guarantee exactly-once if the function is throttled or fails.

Full explanation →
1121
MCQeasy

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

A.Manually modify the resource to reduce its capacity and then continue the update.
B.Create a change set that replaces the resource causing the limit error with a smaller instance type.
C.Roll back the stack update and ignore the error.
D.Delete the stack and recreate it with the corrected template.
AnswerB

A change set allows you to review and execute the update with minimal downtime.

Why this answer

Creating a change set that replaces the resource causing the limit error with a smaller instance type allows the update to proceed without manual intervention, minimizing downtime. Option A is wrong because manually modifying the resource can cause stack drift and may not be safe. Option C is wrong because rolling back does not resolve the underlying resource limit issue.

Option D is wrong because deleting and recreating the stack would cause significant downtime.

Full explanation →
1122
MCQeasy

A company wants to modernize a batch processing application that runs on EC2 instances using a cron job. The job processes files from an S3 bucket and takes about 2 hours. They want to reduce operational overhead. Which service should they use?

A.AWS Batch
B.Amazon ECS with Fargate
C.AWS Lambda
D.AWS Step Functions
AnswerA

AWS Batch is purpose-built for batch processing and manages compute resources.

Why this answer

AWS Batch is designed for batch computing and can automatically provision EC2 instances, run the job, and terminate them, reducing overhead. Option A (Lambda) has a 15-minute timeout. Option B (Step Functions) orchestrates but does not run the compute.

Option D (ECS with Fargate) is possible but requires more configuration than AWS Batch for batch jobs.

Full explanation →
1123
MCQeasy

An organization wants to migrate 50 TB of data from an on-premises NAS to Amazon S3 over a slow internet connection. The migration must be completed within two weeks. Which approach is most appropriate?

A.Use AWS DataSync over the internet
B.Use AWS Snowball Edge
C.Use Amazon S3 Transfer Acceleration
D.Set up AWS Direct Connect
AnswerB

Snowball Edge is a physical device that can handle large data volumes offline, bypassing slow internet.

Why this answer

(AWS Snowball Edge) is correct because it can handle large data volumes over slow networks. Option A (AWS DataSync) may be too slow. Option C (Amazon S3 Transfer Acceleration) still uses internet.

Option D (AWS Direct Connect) may take time to set up.

Full explanation →
1124
MCQmedium

A developer ran the AWS CLI command shown in the exhibit. The instance has an attached EBS volume with 'DeleteOnTermination' set to false. The instance will be started again soon. What will happen to the EBS volume when the instance is stopped?

A.The EBS volume is detached but the data is preserved.
B.The EBS volume is deleted.
C.The EBS volume is deleted because the instance is stopped.
D.The EBS volume remains attached to the instance and the data persists.
AnswerD

Stopping an instance does not affect attached EBS volumes; data is preserved.

Why this answer

Stopping an EC2 instance does not affect the attached EBS volumes; they remain attached and their data persists. The 'DeleteOnTermination' attribute only controls behavior when the instance is terminated, not stopped. Since the instance will be started again soon, the volume stays attached with its data intact.

Exam trap

The trap here is that candidates confuse the 'stop' and 'terminate' actions, incorrectly assuming that 'DeleteOnTermination' applies to both, when in fact it only applies to termination.

How to eliminate wrong answers

Option A is wrong because stopping an instance does not detach the EBS volume; the volume remains attached and available when the instance is started again. Option B is wrong because the EBS volume is not deleted when the instance is stopped; deletion only occurs on instance termination if 'DeleteOnTermination' is set to true, which it is not. Option C is wrong because the volume is not deleted due to the instance being stopped; the 'DeleteOnTermination' attribute is irrelevant during a stop operation.

Full explanation →
1125
MCQmedium

A company is migrating an on-premises monolithic application to AWS. The application uses a legacy database that cannot be easily refactored. The company wants to minimize changes to the application code while gaining scalability and high availability. Which migration strategy should the architect recommend?

A.Rehost the application on Amazon EC2 and use Amazon RDS for the database.
B.Replatform the application to use AWS Elastic Beanstalk and Amazon DynamoDB.
C.Refactor the application to use a microservices architecture with Amazon Aurora.
D.Retire the application and replace it with a SaaS solution.
AnswerA

Rehosting moves the application as-is to EC2 and RDS, minimizing code changes while providing scalability and HA.

Why this answer

Rehosting (lift-and-shift) involves moving the application and database to AWS infrastructure (EC2 and RDS) with minimal changes. This preserves the legacy database and allows the company to achieve scalability and HA using AWS features like Multi-AZ and Auto Scaling. Replatforming would require modifying the database engine; refactoring involves significant changes; and retiring removes the application.

Full explanation →
Page 14

Page 15 of 23

Page 16

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →