Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1126–1200

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 15

Page 16 of 23

Page 17
1126
Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Select 2 answers
A.Use AWS Trusted Advisor to alert when CloudTrail is disabled.
B.Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.
C.Use AWS Shield Advanced to protect CloudTrail.
D.Use AWS Config rules with auto-remediation to re-enable CloudTrail if disabled.
E.Use IAM permissions boundaries to restrict user permissions.
AnswersB, D

SCPs can prevent disabling actions at the organizational level.

Why this answer

A Service Control Policy (SCP) is a centralized policy in AWS Organizations that can deny specific actions across all accounts in the organization. By attaching an SCP that denies the `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `cloudtrail:UpdateTrail` actions, you can prevent any user or role, including the root user, from disabling or deleting CloudTrail, ensuring compliance with the multi-account strategy.

Exam trap

The trap here is that candidates often confuse IAM permissions boundaries or Trusted Advisor alerts as preventive controls, but only SCPs provide a true preventive guardrail that cannot be overridden by account administrators.

Full explanation →
1127
MCQmedium

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

A.Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key
B.Use AWS Trusted Advisor to check bucket encryption
C.Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users
D.Use AWS Config rules to detect non-compliant buckets and send alerts
AnswerA

SCPs enforce across all accounts in the organization.

Why this answer

A service control policy (SCP) can deny the s3:PutBucketEncryption action unless the encryption setting specifies the required KMS key. This centrally enforces the encryption requirement across all accounts in the AWS Organization, preventing any account from creating or modifying a bucket with non-compliant encryption, regardless of IAM permissions within that account.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config, Trusted Advisor) with preventive controls (SCP), or they mistakenly think IAM policies attached to users can enforce encryption at the bucket level across all accounts and principals.

How to eliminate wrong answers

Option B is wrong because AWS Trusted Advisor only provides reactive checks and alerts; it cannot enforce or prevent non-compliant actions, so buckets could be created without the required encryption before any alert is acted upon. Option C is wrong because an IAM policy attached to users does not apply to roles or service principals (e.g., AWS services, cross-account roles), and it only controls s3:PutObject, not the bucket-level encryption configuration set via s3:PutBucketEncryption. Option D is wrong because AWS Config rules are detective, not preventive; they can detect non-compliant buckets and trigger remediation, but they cannot block the initial creation or modification of a bucket with non-compliant encryption.

Full explanation →
1128
MCQhard

A healthcare company is designing a new system on AWS to store and analyze patient health records. The system must comply with HIPAA regulations. Data includes structured lab results and unstructured clinical notes. The company needs to run complex SQL queries on the structured data and perform natural language processing (NLP) on the unstructured data. The solution should be cost-effective and minimize administrative overhead. Which solution should a Solutions Architect recommend?

A.Store structured data in Amazon RDS for PostgreSQL, store unstructured data in S3, and use AWS Glue to run NLP jobs.
B.Store all data in S3, use Amazon Athena for SQL queries and Amazon Textract for NLP.
C.Store structured data in DynamoDB, store unstructured data in S3, use Amazon SageMaker to build custom NLP models.
D.Store structured data in Amazon Redshift, store unstructured data in S3, and use Amazon Comprehend Medical for NLP.
AnswerD

Redshift is for analytics; Comprehend Medical is HIPAA-eligible and designed for medical NLP.

Why this answer

Amazon Redshift is a fully managed, petabyte-scale data warehouse service that is ideal for running complex SQL queries on structured data, and it supports HIPAA compliance. Amazon Comprehend Medical is a HIPAA-eligible natural language processing (NLP) service specifically designed to extract medical information from unstructured clinical text. Storing unstructured data in Amazon S3 is cost-effective and scalable.

This combination minimizes administrative overhead with managed services. Option A is incorrect because Amazon RDS for PostgreSQL is not optimized for complex analytics at scale and may require additional setup for performance. Option B is incorrect because Amazon Athena is best for ad-hoc queries and not ideal for frequent, complex SQL workloads; moreover, Amazon Textract is for document extraction (e.g., OCR), not NLP.

Option C is incorrect because Amazon DynamoDB is a NoSQL database not suited for complex SQL queries, and Amazon SageMaker would require custom model building, increasing overhead compared to using a managed NLP service like Comprehend Medical.

Full explanation →
1129
MCQmedium

A company is designing a new application on AWS that processes real-time IoT sensor data from thousands of devices. The data must be ingested, processed, and stored for analysis. The company wants to use a serverless architecture to reduce operational overhead. The processing includes filtering, aggregation, and transformation. Which solution should a Solutions Architect recommend?

A.Use Amazon Kinesis Data Streams to ingest data, use Kinesis Data Firehose to deliver data to S3, and use Athena for queries.
B.Use Amazon Kinesis Data Streams to ingest data, trigger a Lambda function for processing, and store results in DynamoDB.
C.Use Amazon SQS to ingest sensor data, trigger a Lambda function for processing, and store results in DynamoDB.
D.Use AWS IoT Core to ingest data, use IoT rules to route data to Kinesis Data Analytics for real-time processing, and store results in S3.
AnswerD

IoT Core is designed for IoT; Kinesis Data Analytics provides real-time SQL processing; S3 is cost-effective storage.

Why this answer

AWS IoT Core is purpose-built for ingesting data from IoT devices, its rules engine can route data to Kinesis Data Analytics for real-time processing using SQL, and results can be stored in S3 for analysis. Option A is incorrect because Kinesis Data Firehose delivers data in batches, not real-time processing as required. Option B is incorrect because while Lambda can process, it may have concurrency limits and is less optimal for high-throughput streaming compared to Kinesis Data Analytics.

Option C is incorrect because SQS is not designed for real-time streaming ingestion from IoT devices; it's a message queue, not a streaming service.

Full explanation →
1130
MCQhard

A company is using AWS Migration Hub to track a server migration. The migration task has failed with the error shown in the exhibit. Which action should the solutions architect take to resolve the issue?

A.Change the migration port from 443 to 80.
B.Retry the migration using AWS CloudEndure instead of AWS MGN.
C.Increase the timeout value for the migration task.
D.Ensure the source server's SSL certificate is signed by a trusted Certificate Authority (CA).
AnswerD

The error explicitly states the certificate is not trusted; replacing it with a valid certificate resolves the issue.

Why this answer

The error indicates that the SSL certificate of the source server is not trusted by the AWS Migration Hub or the migration tool (e.g., AWS MGN, CloudEndure). The solution is to ensure the source server has a valid SSL certificate from a trusted CA, or configure the migration tool to ignore certificate validation if appropriate. Increasing timeout or retrying will not fix the certificate issue.

Changing port is not relevant. Using a different tool may bypass but does not address the root cause.

Full explanation →
1131
Multi-Selecthard

A company is using AWS Organizations with a centralized networking account that hosts a transit gateway. The company wants to ensure that all traffic between VPCs in different accounts flows through the transit gateway. Which THREE steps are required to implement this architecture?

Select 3 answers
A.Attach the VPCs in member accounts to the transit gateway.
B.Update the route tables of the VPCs to point to the transit gateway for inter-VPC traffic.
C.Create VPC endpoints for the transit gateway in each VPC.
D.Create VPC peering connections between each VPC and the networking VPC.
E.Share the transit gateway with the member accounts using AWS Resource Access Manager.
AnswersA, B, E

VPCs must be attached to the transit gateway to route traffic through it.

Why this answer

Attaching the VPCs in member accounts to the transit gateway is a fundamental step to establish connectivity. The transit gateway acts as a central hub, and each VPC must be explicitly attached to it to route traffic through the gateway. Without attachment, the transit gateway cannot forward traffic to or from those VPCs.

Exam trap

The trap here is that candidates often confuse VPC endpoints (used for AWS service access) with transit gateway attachments, or mistakenly think VPC peering is required when the transit gateway already provides the necessary connectivity.

Full explanation →
1132
MCQmedium

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

A.Amazon Kinesis Data Firehose for ingestion and delivery to Amazon S3, then use AWS Glue for ETL into Amazon Redshift.
B.Amazon DynamoDB Streams for ingestion, AWS Lambda for processing, and Amazon Redshift for storage.
C.Amazon SQS for ingestion, AWS Lambda for processing, and Amazon DynamoDB for storage.
D.Amazon Kinesis Data Streams for ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon S3 as a staging area before loading into Amazon Redshift.
AnswerD

Kinesis Data Streams handles high throughput, Data Analytics processes in real-time, and S3 integrates with Redshift.

Why this answer

Amazon Kinesis Data Streams can ingest millions of events per second with durable, ordered shards, while Kinesis Data Analytics provides real-time SQL or Apache Flink processing on the stream. Amazon S3 acts as a staging layer before loading into Amazon Redshift via COPY or Redshift Spectrum, enabling scalable analytics without throttling the ingestion pipeline.

Exam trap

The SAP-C02 exam often tests the distinction between Kinesis Data Streams (real-time, sub-second) and Kinesis Data Firehose (near-real-time, minutes of latency), leading candidates to choose Firehose for real-time requirements.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a near-real-time delivery service with a minimum buffer interval of 60 seconds, which cannot meet the sub-second real-time processing requirement for millions of events per second. Option B is wrong because DynamoDB Streams are designed for change data capture from a DynamoDB table, not for direct ingestion of high-throughput streaming data from IoT devices, and DynamoDB Streams have a limited retention period (24 hours) and throughput constraints. Option C is wrong because Amazon SQS is a message queue with at-least-once delivery and no native ordering guarantees (unless using FIFO, which limits throughput to 300 TPS), making it unsuitable for high-velocity, ordered streaming data; DynamoDB is not a data warehouse optimized for complex analytics queries.

Full explanation →
1133
MCQmedium

A company has a serverless application using AWS Lambda and Amazon API Gateway. The application experiences cold starts that cause latency spikes. Which solution would reduce the impact of cold starts?

A.Configure Provisioned Concurrency for the Lambda function.
B.Increase the Lambda function memory allocation.
C.Decrease the Lambda function timeout.
D.Use a VPC and enable Lambda to access resources in the VPC.
AnswerA

Ensures a set number of environments are initialized and ready.

Why this answer

Provisioned Concurrency keeps a specified number of execution environments initialized and ready to respond immediately, eliminating cold starts for the configured concurrency level. Option B (increasing memory) can reduce cold start duration but does not eliminate it. Option C (decreasing timeout) does not affect cold starts.

Option D (enabling VPC access) typically adds network latency and may worsen cold starts due to ENI creation.

Full explanation →
1134
Multi-Selecthard

A company is deploying a containerized application on Amazon EKS. The application requires persistent storage that can be shared across multiple pods in different Availability Zones. Which TWO storage solutions meet this requirement? (Choose TWO.)

Select 2 answers
A.Amazon EBS with io2 volumes
B.Amazon S3
C.Amazon EC2 Instance Store
D.Amazon FSx for Lustre
E.Amazon EFS
AnswersD, E

FSx for Lustre is a high-performance file system that can be shared across multiple clients in different AZs.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple Amazon EKS pods across different Availability Zones, making it suitable for shared persistent storage. Amazon FSx for Lustre is a high-performance file system optimized for workloads like machine learning and HPC, and it supports concurrent access from multiple clients across AZs, meeting the requirement for shared storage.

Exam trap

The trap here is that candidates often assume EBS volumes can be shared across pods because they are persistent, but EBS is a block device with a single-attach limitation, making it unsuitable for multi-pod shared access across AZs.

Full explanation →
1135
MCQhard

A company is migrating a legacy e-commerce application to AWS. The application includes a web tier, an application tier, and a MySQL database. The company wants to improve scalability and reduce operational overhead. The architect plans to use Amazon RDS for MySQL and refactor the application to use Auto Scaling for the web and application tiers. However, the application currently stores session state locally on the web servers. What should the architect do to address session state management in the new architecture?

A.Store session state in Amazon S3
B.Store session state in Amazon RDS for MySQL
C.Configure an Application Load Balancer with sticky sessions
D.Use Amazon ElastiCache for Redis to store session state
AnswerD

ElastiCache provides a fast, scalable, and centralized session store.

Why this answer

Using ElastiCache for Redis provides a centralized, scalable session store that works with Auto Scaling. Using sticky sessions (ELB session stickiness) is a workaround but less scalable and not recommended for Auto Scaling. Storing sessions in RDS would add database load.

Storing in S3 is not suitable for low-latency session access.

Full explanation →
1136
MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

A.Create RDS read replicas for the DB instance and route read queries from the application to the replicas.
B.Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.
C.Increase the instance size of the RDS DB instance to a larger instance type.
D.Enable Multi-AZ for the RDS instance to distribute the load across two instances.
AnswerA

Read replicas offload read traffic, reducing CPU on the primary.

Why this answer

Creating RDS read replicas offloads read queries from the primary DB instance, reducing CPU contention from read-heavy workloads. Since the application reads and writes to the same database, directing read traffic to replicas decreases the primary instance's CPU utilization, directly addressing the 100% CPU spike observed during the load test. This improves database scalability by distributing read operations horizontally without altering write capacity.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, thinking Multi-AZ distributes read traffic, when in fact Multi-AZ only provides a standby replica for failover and does not serve read requests.

How to eliminate wrong answers

Option B is wrong because while an in-memory cache like ElastiCache reduces read load on the database, it does not address CPU contention from write operations or provide the same level of scalability as read replicas for read-heavy workloads; it is a complementary solution, not the best improvement for database scalability in this scenario. Option C is wrong because scaling vertically (increasing instance size) provides only a temporary fix and does not improve scalability; it increases cost without addressing the root cause of read contention, and the CPU spike could recur under higher load. Option D is wrong because enabling Multi-AZ provides high availability and failover support, not load distribution; the standby instance in a Multi-AZ deployment is not active for reads or writes, so it does not reduce CPU contention on the primary instance.

Full explanation →
1137
MCQeasy

A company has a management account in AWS Organizations. It wants to delegate administration of AWS IAM Identity Center to a member account for user management. What is the correct way to achieve this?

A.Use AWS Resource Access Manager to share the IAM Identity Center instance with the member account.
B.Use the IAM Identity Center console to add the member account as a delegated administrator.
C.Use a service control policy to allow the member account to manage IAM Identity Center.
D.Create an IAM role in the management account and allow the member account to assume it.
AnswerB

This is the native mechanism for delegation.

Why this answer

AWS IAM Identity Center allows you to designate a member account as a delegated administrator directly from the IAM Identity Center console in the management account. This grants the member account the necessary permissions to manage users, groups, and permission sets without requiring cross-account roles or resource sharing.

Exam trap

The trap here is that candidates often confuse delegation with resource sharing via RAM or assume that SCPs can grant permissions, when in fact delegation is a specific AWS Organizations feature that must be configured through the IAM Identity Center console or API for that service.

How to eliminate wrong answers

Option A is wrong because AWS Resource Access Manager (RAM) is used to share resources like subnets or license configurations, not to delegate administrative control of IAM Identity Center; IAM Identity Center instances are not shareable via RAM. Option C is wrong because service control policies (SCPs) are used to restrict permissions across accounts in an organization, not to grant or delegate administrative capabilities; SCPs cannot enable a member account to manage IAM Identity Center. Option D is wrong because creating an IAM role in the management account for the member account to assume would provide access to the management account's IAM Identity Center configuration, but it does not delegate administration; the member account would still operate under the management account's context, not as a delegated administrator with its own management scope.

Full explanation →
1138
MCQmedium

A company is migrating a legacy application that uses a network file system (NFS) for shared storage. The application runs on Windows servers. Which AWS storage service should be used for the migration?

A.Amazon FSx for Windows File Server
B.Amazon EFS
C.Amazon EBS
D.Amazon S3
AnswerA

Provides native SMB file storage for Windows applications.

Why this answer

Amazon FSx for Windows File Server provides native SMB support, making it the ideal choice for Windows-based applications requiring shared file storage. Amazon EFS is POSIX-based and not fully compatible with Windows. Amazon EBS volumes cannot be easily shared across multiple instances.

Amazon S3 is object storage, not a file system.

Full explanation →
1139
Multi-Selectmedium

A company is migrating a legacy application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to minimize changes and use a managed service. Which TWO options should the company consider? (Choose TWO.)

Select 2 answers
A.Use Amazon RDS with a custom engine.
B.Migrate the database to Amazon S3 and use S3 Select for queries.
C.Run the database on Amazon EC2 with Amazon EBS volumes.
D.Convert the database to Amazon DynamoDB.
E.Use an AWS Marketplace third-party solution that provides a managed service for the database.
AnswersC, E

EC2 allows you to install any database, providing flexibility with managed infrastructure.

Why this answer

Options C and E are correct. Option C allows running the database on EC2 with EBS, providing full control and compatibility with any database engine, minimizing changes. Option E uses an AWS Marketplace third-party solution that offers a managed service for the specific database.

Option A is incorrect because Amazon RDS does not support custom engines; it only supports specific database engines. Option B is incorrect because Amazon S3 is object storage, not a database, and S3 Select is for querying objects, not suitable as a database replacement. Option D is incorrect because DynamoDB is a NoSQL database that would require significant application changes.

Full explanation →
1140
MCQmedium

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

A.Use Amazon Kinesis Data Streams and an AWS Lambda function
B.Use an SQS queue and an EC2 Auto Scaling group to poll and process messages
C.Use an SQS queue as an event source for an AWS Lambda function
D.Use SQS to send messages to Amazon SNS, which triggers a Lambda function
AnswerC

Lambda scales automatically with the SQS queue and charges per execution, minimizing cost and overhead.

Why this answer

Using an SQS queue as an event source for AWS Lambda enables real-time, low-latency processing of messages without any polling infrastructure to manage. Lambda automatically scales to handle variable processing times (100 ms to 5 seconds) and charges only for compute time used, minimizing both cost and operational overhead. This serverless approach eliminates the need for EC2 instances or Auto Scaling groups, aligning perfectly with the requirements for minimal latency and reduced management effort.

Exam trap

The trap here is that candidates often assume EC2 Auto Scaling is required for variable processing times, overlooking Lambda's native ability to scale instantly and cost-effectively for SQS-triggered workloads, or they mistakenly add unnecessary services like SNS or Kinesis that increase latency and cost without benefit.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams is designed for streaming large volumes of data with shard-level throughput limits, not for individual message processing with variable latency, and it introduces higher cost and operational complexity compared to SQS-Lambda integration. Option B is wrong because using an EC2 Auto Scaling group to poll SQS adds significant operational overhead for managing instances, scaling policies, and polling logic, and it cannot match the sub-second scaling and cost efficiency of Lambda for variable processing times. Option D is wrong because adding Amazon SNS between SQS and Lambda introduces unnecessary latency and complexity; SQS can directly trigger Lambda without SNS, and SNS is typically used for fan-out to multiple subscribers, not for simple message processing.

Full explanation →
1141
Multi-Selecthard

A company is designing a new application on AWS that requires a highly available and durable NoSQL database. The database must be able to scale horizontally for both reads and writes. Which TWO AWS services meet these requirements? (Choose two.)

Select 2 answers
A.Amazon Neptune
B.Amazon DynamoDB
C.Amazon RDS for MySQL with Multi-AZ
D.Amazon DocumentDB (with MongoDB compatibility)
E.Amazon ElastiCache for Memcached
AnswersB, D

DynamoDB is a fully managed NoSQL database with horizontal scaling and high durability.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides high availability and durability by automatically replicating data across multiple Availability Zones in an AWS Region. It supports horizontal scaling for both reads and writes through its partitioning mechanism and on-demand or provisioned capacity modes, making it ideal for applications requiring consistent performance at any scale.

Exam trap

The trap here is that candidates may confuse Amazon DocumentDB with a self-managed MongoDB deployment or assume that any database with 'Document' in the name lacks horizontal scaling, while in reality DocumentDB provides automatic replication and read scaling similar to DynamoDB.

Full explanation →
1142
MCQhard

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

A.Add a second RDS read replica to distribute read traffic.
B.Upgrade the RDS instance to a larger instance type with more vCPUs.
C.Implement an ElastiCache for Redis cluster to cache frequently accessed data.
D.Enable RDS Proxy to manage database connections.
AnswerD

RDS Proxy improves connection management but does not reduce CPU load from queries.

Why this answer

RDS Proxy is a database proxy that manages connection pooling, reducing the CPU overhead associated with opening and closing many database connections. It requires only a change in the database endpoint configuration, not application code changes, making it the most effective solution that satisfies the requirement of no code changes. Option A (read replica) would require application changes to direct read traffic to the replica.

Option B (upgrading instance type) vertically scales the database but does not reduce the load; it only provides more capacity to handle the same load. Option C (ElastiCache for Redis) reduces database read load by caching frequent queries, but implementing it typically requires application code modifications to integrate the caching logic, which conflicts with the stem's requirement.

Full explanation →
1143
MCQhard

A company is migrating a legacy CRM application from a colocation facility to AWS. The application uses a client-server architecture with a thick client installed on employee desktops. The company wants to reduce desktop administration and provide remote access. Which migration approach should the architect recommend?

A.Deploy the thick client on Amazon WorkSpaces and provide access to employees
B.Refactor the application into a web application using AWS App Runner
C.Rehost the application on Amazon EC2 and provide VPN access to employees
D.Retire the application and use a SaaS alternative
AnswerA

WorkSpaces provides a managed virtual desktop where the thick client can run, reducing desktop administration.

Why this answer

Using Amazon WorkSpaces allows the thick client to run in a virtual desktop, providing remote access and reducing desktop management. Rehosting the application on EC2 and using a VPN does not address the thick client issue. Refactoring to a web application would require significant development.

Retiring the application is not desired.

Full explanation →
1144
MCQhard

A gaming company uses Amazon DynamoDB as the database for a leaderboard feature. The table has a partition key of 'game_id' and a sort key of 'score'. The table uses on-demand capacity mode. During a new game launch, write traffic to a few popular game_id partitions becomes very hot, causing throttling. The company wants to improve performance for these hot partitions without changing the application code. What should they do?

A.Add a global secondary index with a different partition key.
B.Enable DynamoDB Accelerator (DAX) for the table to cache frequently accessed data.
C.Switch to provisioned capacity and increase read/write capacity units for the table.
D.Implement an Amazon SQS queue to buffer write requests.
AnswerD

Amazon SQS buffers write requests, allowing them to be processed at a steady rate, reducing the likelihood of throttling on hot partitions.

Why this answer

Amazon SQS can buffer write requests to DynamoDB, smoothing out traffic spikes and reducing throttling on hot partitions. The SQS queue decouples the application from DynamoDB, allowing writes to be processed at a manageable pace. Option A is incorrect because adding a GSI does not reduce write load on the base table's partitions.

Option B is incorrect because DAX is a read cache and does not help with write throttling. Option C is incorrect because switching to provisioned capacity does not resolve per-partition throttling limits; hot partitions still have a maximum throughput regardless of table-level capacity.

Full explanation →
1145
MCQmedium

A company is migrating a legacy application that uses SOAP web services to AWS. The application currently runs on a single on-premises server. The company wants to minimize changes and reduce operational overhead. Which approach should the company take?

A.Refactor the SOAP web services to RESTful APIs and deploy on Amazon API Gateway and AWS Lambda.
B.Containerize the application and deploy it on Amazon ECS using Fargate.
C.Rehost the application on Amazon EC2 using AWS Application Migration Service (MGN).
D.Use AWS Database Migration Service (DMS) to migrate the database and redeploy the application manually.
AnswerC

MGN automates lift-and-shift with minimal downtime.

Why this answer

Rehosting the application on Amazon EC2 using AWS Application Migration Service (MGN) minimizes changes by lifting and shifting the entire on-premises server, including the SOAP web services, to AWS with minimal modification. This approach reduces operational overhead by automating server replication and cutover, avoiding the need to refactor or containerize the application, which aligns with the requirement to minimize changes.

Exam trap

The trap here is that candidates may assume modernizing to serverless or containers is always better, but the question explicitly requires minimizing changes, making rehosting the correct choice despite its perceived lack of modernization.

How to eliminate wrong answers

Option A is wrong because refactoring SOAP web services to RESTful APIs and deploying on Amazon API Gateway and AWS Lambda introduces significant changes to the application architecture and code, contradicting the requirement to minimize changes. Option B is wrong because containerizing the application and deploying on Amazon ECS using Fargate requires modifying the application to run in containers, which adds operational complexity and changes the deployment model, increasing rather than reducing overhead. Option D is wrong because using AWS Database Migration Service (DMS) only addresses database migration, not the application itself, and manually redeploying the application does not minimize changes or reduce operational overhead compared to a fully automated rehosting solution.

Full explanation →
1146
Multi-Selecthard

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to ensure that during a patching cycle, the application remains available and no requests are dropped. Which TWO strategies should they implement? (Choose TWO.)

Select 2 answers
A.Increase the desired capacity of the Auto Scaling group before patching.
B.Stop all instances at the same time to apply patches consistently.
C.Perform a rolling update using a batch size of 50% with a pause time.
D.Use an Auto Scaling lifecycle hook to wait for a custom action before terminating instances.
E.Use Amazon Inspector to automatically patch instances.
AnswersC, D

Rolling update ensures that only a portion of instances are replaced at a time.

Why this answer

(rolling update with a batch size of 50% and pause time) is correct because it gradually replaces instances, allowing the application to remain available during patching. Option D (lifecycle hook for custom action before termination) is correct because it can drain connections gracefully before an instance is terminated. Option A is wrong because increasing desired capacity does not guarantee no dropped requests during patching and may cause additional cost.

Option B is wrong because stopping all instances simultaneously causes downtime. Option E is wrong because Amazon Inspector only identifies vulnerabilities but does not apply patches.

Exam trap

Candidates often confuse rolling updates with blue/green deployments or think lifecycle hooks are only for instance launch, not termination.

Full explanation →
1147
Multi-Selecthard

A company is migrating a large on-premises data lake to Amazon S3. They need to transfer petabytes of data over the network securely and efficiently. Which TWO AWS services should they use?

Select 2 answers
A.AWS Direct Connect
B.Amazon Kinesis Data Firehose
C.AWS Snowball Edge
D.AWS DataSync
E.Amazon S3 Transfer Acceleration
AnswersD, E

For online data transfer with optimization.

Why this answer

The correct answers are D (AWS DataSync) and E (Amazon S3 Transfer Acceleration). AWS DataSync is an online data transfer service that simplifies, automates, and accelerates moving data between on-premises storage and Amazon S3. Amazon S3 Transfer Acceleration enables fast, secure transfers of data over long distances by using AWS edge locations.

Option A (AWS Direct Connect) provides a dedicated network connection but is not a data transfer service itself. Option B (Amazon Kinesis Data Firehose) is for streaming data ingestion, not for large-scale batch transfers. Option C (AWS Snowball Edge) is an offline physical device, not for network-based transfer.

Full explanation →
1148
Multi-Selecthard

A company is modernizing a legacy application by breaking it into microservices. The application currently uses a single relational database. The company wants to adopt a microservices architecture with separate databases per service. Which THREE patterns should the company consider? (Choose THREE.)

Select 3 answers
A.API Gateway
B.Shared Database
C.Database per Service
D.Event Sourcing
E.Command Query Responsibility Segregation (CQRS)
AnswersA, C, D

API Gateway provides a single entry point for microservices.

Why this answer

(API Gateway) is correct for routing requests to appropriate microservices. Option C (Database per Service) is correct as it aligns with the requirement for separate databases per service. Option D (Event Sourcing) is correct for maintaining data consistency across services.

Option B (Shared Database) is incorrect because it would create coupling. Option E (CQRS) is incorrect because it is a pattern for read/write separation, not a primary pattern for microservices with separate databases.

Full explanation →
1149
MCQhard

A company is migrating a large-scale Hadoop cluster to Amazon EMR. They want to optimize costs by using transient clusters and storing data in Amazon S3. Which feature should they enable on the EMR cluster to improve performance?

A.Auto Scaling
B.Kerberos authentication
C.EMRFS consistent view
D.EBS-optimized instances
AnswerC

EMRFS provides consistent view and performance tuning for S3.

Why this answer

Amazon EMRFS with consistent view improves performance when using transient clusters and storing data in Amazon S3 by providing consistent metadata and read-after-write consistency. Option A (Auto Scaling) adjusts cluster size for compute needs, not storage performance. Option B (Kerberos authentication) is a security feature.

Option D (EBS-optimized instances) ensures dedicated network bandwidth for EBS volumes, which does not directly enhance S3 I/O performance.

Full explanation →
1150
MCQmedium

A company is designing a microservices architecture on AWS. Each service needs its own DynamoDB table, and services must be fully isolated. Which networking design ensures that services can only communicate through APIs and not directly to each other's databases?

A.Place all services in a single VPC with security groups to control traffic.
B.Use a transit VPC with VPN connections to each service's VPC.
C.Create a separate VPC for each service, with VPC peering only between the API gateway and each service VPC.
D.Use a single VPC with public and private subnets; place databases in private subnets and services in public subnets.
AnswerC

This ensures each service's database is isolated and only accessible via the API.

Why this answer

Creating a separate VPC for each service enforces full network isolation, and using VPC peering only between the API Gateway and each service VPC ensures that services can only communicate through APIs. This design prevents any direct network-level access between service databases, as there is no peering or routing between the service VPCs themselves, aligning with the microservices principle of strict isolation.

Exam trap

The trap here is that candidates often assume a single VPC with security groups or subnets is sufficient for isolation, but they overlook that network-level isolation requires separate VPCs to prevent any direct routing between services, which is a key nuance in the SAP-C02 exam for microservices architectures.

How to eliminate wrong answers

Option A is wrong because placing all services in a single VPC with security groups still allows potential direct network access between services and their databases if security groups are misconfigured, and it does not enforce API-only communication. Option B is wrong because a transit VPC with VPN connections introduces unnecessary complexity and still allows potential routing between service VPCs, which could enable direct database access. Option D is wrong because using a single VPC with public and private subnets places databases in private subnets and services in public subnets, but services in public subnets can still directly access databases in private subnets via internal routing, violating the requirement for API-only communication.

Full explanation →
1151
MCQmedium

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

A.Use AWS Organizations service control policies to deny cross-account access.
B.Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.
C.Use AWS Trusted Advisor to check for unused cross-account roles.
D.Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.
AnswerB

Access Analyzer automatically discovers cross-account access and can be centrally managed.

Why this answer

AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Exam trap

The trap here is that candidates confuse preventive controls (SCPs) with detective/audit controls, or they assume CloudTrail logging alone provides centralized auditing without considering the need for a purpose-built tool like IAM Access Analyzer to identify cross-account access configurations.

How to eliminate wrong answers

Option A is wrong because service control policies (SCPs) can deny or restrict permissions but do not provide auditing or centralized management of existing cross-account roles; they are preventive, not detective. Option C is wrong because AWS Trusted Advisor checks for unused IAM roles but does not specifically audit cross-account access or provide centralized management across multiple accounts. Option D is wrong because while CloudTrail logs AssumeRole events and Athena can query them, this approach requires aggregating logs from all accounts and does not offer a built-in, centralized auditing mechanism for cross-account roles like IAM Access Analyzer does.

Full explanation →
1152
MCQeasy

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

A.Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.
B.Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.
C.Store logs in Amazon S3 Glacier and use S3 Select to query directly.
D.Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.
AnswerB

S3 Standard-IA offers lower cost for infrequent access with retrieval available.

Why this answer

Amazon Kinesis Data Firehose can stream logs directly to Amazon S3, and S3 Lifecycle policies allow automatic transition to S3 Standard-IA after 30 days, which reduces storage costs for infrequently accessed data while still allowing occasional queries. This combination meets the one-year retention requirement cost-effectively, as S3 Standard-IA has lower storage costs than S3 Standard for data accessed less frequently, and the lifecycle transition avoids manual intervention.

Exam trap

The trap here is that candidates often choose CloudWatch Logs (Option D) because it seems like the natural logging service, but they overlook the high cost of storing large volumes of log data for a year in CloudWatch Logs compared to S3 with lifecycle transitions.

How to eliminate wrong answers

Option A is wrong because storing logs on EBS volumes attached to a single EC2 instance is not cost-effective for 3.65 TB of logs (10 GB/day × 365 days) — EBS volumes incur high costs for storage and provisioned IOPS, and the single instance creates a single point of failure and limits query scalability. Option C is wrong because S3 Glacier is designed for archival storage with retrieval times of minutes to hours, and S3 Select cannot query data in Glacier directly — S3 Select only works on objects in S3 Standard, S3 Standard-IA, S3 One Zone-IA, and S3 Glacier Instant Retrieval, not in S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive. Option D is wrong because Amazon CloudWatch Logs is optimized for real-time monitoring and operational analytics, not for long-term cost-effective storage — storing 3.65 TB of logs in CloudWatch Logs for 365 days would be significantly more expensive than S3, and CloudWatch Logs charges per GB ingested and per GB stored, making it less cost-effective for occasional querying.

Full explanation →
1153
Multi-Selecthard

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Select 2 answers
A.Enable S3 Object Lock on the CloudTrail S3 bucket.
B.Enable CloudTrail log file validation.
C.Use server-side encryption with AWS KMS managed keys (SSE-KMS).
D.Enable S3 Transfer Acceleration on the CloudTrail S3 bucket.
E.Set an S3 Lifecycle policy to transition logs to Amazon S3 Glacier.
AnswersA, B

Prevents deletion and overwrites.

Why this answer

S3 Object Lock prevents objects from being deleted or overwritten, ensuring tamper-proof logs. Option B is correct because CloudTrail log file validation creates digest files that allow integrity verification. Option C is incorrect because server-side encryption with KMS protects data at rest but does not prevent tampering or deletion.

Option D is incorrect because S3 Transfer Acceleration speeds up uploads but does not provide security. Option E is incorrect because lifecycle policies transition objects to cheaper storage classes but do not prevent modification or deletion.

Full explanation →
1154
MCQmedium

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

A.The policy is attached to a group, not directly to the user.
B.The user does not have MFA enabled.
C.The policy does not allow 'ec2:StartInstances' on all resources.
D.The 'ec2:StartInstances' action does not support resource-level conditions.
AnswerD

StartInstances only supports instance-level conditions, but the condition is on the resource tag; however, the condition must be on the request, not resource, for such actions.

Why this answer

The policy includes a condition requiring the resource tag 'Environment: production', but the ec2:StartInstances action does not support resource-level condition keys (like ec2:ResourceTag). Therefore, the condition is never evaluated, and the action is denied by default. Option A is incorrect because attaching the policy to a group effectively applies it to all group members.

Option B is incorrect because the policy does not require MFA. Option C is incorrect because the policy does allow ec2:StartInstances on specific resources, but the condition is the issue.

Full explanation →
1155
MCQeasy

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application needs to maintain a fixed number of instances and should automatically replace any unhealthy instance. Which scaling policy should be used?

A.Scheduled scaling policy
B.Simple scaling policy
C.Target tracking scaling policy
D.Manual scaling with health check replacement
AnswerD

Manual scaling sets the desired capacity and health checks replace unhealthy instances.

Why this answer

A manual scaling policy set to maintain a fixed number of instances combined with health checks ensures that unhealthy instances are replaced.

Full explanation →
1156
MCQhard

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

A.Create a VPC endpoint for the internet.
B.Launch a NAT instance in the private subnet.
C.Attach an Internet Gateway directly to the private subnet.
D.Add a NAT Gateway in the public subnet and update the private subnet's route table.
AnswerD

NAT Gateway provides outbound internet access securely.

Why this answer

A NAT Gateway in a public subnet enables instances in a private subnet to initiate outbound internet traffic for tasks like downloading patches, while preventing inbound connections from the internet. Option A is incorrect because a VPC endpoint is used for private connectivity to AWS services, not for general internet access. Option B is incorrect because a NAT instance is less managed and secure than a NAT Gateway, and it must be placed in a public subnet.

Option C is incorrect because an Internet Gateway is attached to the VPC, not directly to a subnet, and attaching it to a private subnet would not function correctly and could expose the instance to inbound traffic.

Full explanation →
1157
Multi-Selectmedium

Which TWO design patterns help ensure data durability in Amazon S3?

Select 2 answers
A.Enable Cross-Region Replication (CRR).
B.Enable S3 Versioning.
C.Enable MFA Delete.
D.Use S3 Standard-IA storage class.
E.Configure lifecycle policies to transition to Glacier.
AnswersA, B

Replicates objects to another region for durability against regional failures.

Why this answer

Options A and B are correct. Versioning protects against accidental deletion or overwrite, ensuring data durability. Cross-Region Replication (CRR) replicates objects to another region, protecting against region-level failures and enhancing durability.

Option C is incorrect because MFA Delete is a security feature that requires multi-factor authentication to delete objects, but it does not increase the number of copies or protect against data loss. Option D is incorrect because S3 Standard-IA is a storage class designed for infrequently accessed data with lower cost, but it has the same durability as S3 Standard (11 nines) and does not provide additional durability. Option E is incorrect because lifecycle policies manage data lifecycle and cost optimization, not durability; transitioning to Glacier does not increase durability.

Full explanation →
1158
MCQhard

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

A.Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.
B.Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.
C.Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.
D.Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.
AnswerB

SCPs can centrally enforce encryption requirements across all accounts.

Why this answer

A service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Exam trap

The trap here is that candidates often choose reactive solutions like AWS Config or default encryption, overlooking that SCPs can proactively deny API actions based on request parameters, which is the only way to enforce encryption without touching individual bucket policies.

How to eliminate wrong answers

Option A is wrong because S3 default encryption only applies to new objects written to a bucket, but it does not prevent users from overriding the encryption setting in a PutObject request or from modifying the bucket policy to disable encryption enforcement. Option C is wrong because AWS Config rules with Lambda remediation are reactive (detect and fix after the fact) and do not prevent non-compliant actions from occurring, which violates the requirement to enforce without modifying bucket policies. Option D is wrong because it requires modifying each account's bucket policy, which contradicts the requirement to apply the policy without modifying individual bucket policies.

Full explanation →
1159
MCQeasy

A company is migrating a web application to AWS and wants to use a blue/green deployment strategy to minimize downtime. The application runs on EC2 instances behind an Application Load Balancer (ALB). Which approach should be used?

A.Stop the old instances, start the new instances, and update the ALB target group.
B.Use an AWS CloudFormation stack update to replace the Auto Scaling group and instances in place.
C.Create a new target group for the green environment, register the new instances, test, and then modify the ALB listener rule to forward traffic to the green target group.
D.Deploy the new instances behind a different ALB and update DNS to point to the new ALB.
AnswerC

Minimal downtime with smooth cutover.

Why this answer

Blue/green deployment involves creating a new target group for the green environment, registering the new instances, testing, and then modifying the ALB listener rule to forward traffic to the green target group. Option A is wrong because stopping old instances before starting new ones would cause downtime. Option B is wrong because an in-place update of the Auto Scaling group would cause downtime.

Option D is wrong because using a different ALB and updating DNS is not a typical blue/green deployment with ALB; it adds unnecessary complexity and may cause delays.

Full explanation →
1160
MCQhard

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

A.Enable detailed ALB metrics and create a CloudWatch dashboard.
B.Migrate the application to AWS Lambda to eliminate EC2 overhead.
C.Replace the ALB with a Network Load Balancer (NLB) for lower latency.
D.Use AWS X-Ray to trace requests from the ALB to the application and downstream services.
E.Add more EC2 instances behind the ALB to distribute the load.
AnswerD

X-Ray provides end-to-end tracing to pinpoint latency sources.

Why this answer

AWS X-Ray provides end-to-end tracing of requests from the ALB to the EC2 instances and downstream services, allowing the team to identify the specific component causing latency spikes. Option A is wrong because detailed ALB metrics only provide aggregate data, not per-request traces. Option B is wrong because migrating to Lambda would not necessarily resolve latency and adds significant architectural change.

Option C is wrong because a Network Load Balancer operates at Layer 4 and does not provide application-level tracing or visibility. Option E is wrong because while adding instances might reduce load, it does not help identify the root cause of intermittent latency spikes.

Full explanation →
1161
Multi-Selecthard

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

Select 2 answers
A.Use Amazon Aurora Global Database for the database tier.
B.Use a cross-region read replica for RDS and promote it during disaster.
C.Use EC2 AMI copy to another region and launch instances from the AMI.
D.Use RDS cross-region snapshots and restore in the DR region.
E.Configure RDS Multi-AZ in the primary region.
AnswersA, B

Aurora Global Database provides low RPO/RTO cross-region.

Why this answer

Amazon Aurora Global Database supports cross-region replication with typical RPO of less than 1 second and RTO of less than 1 minute, easily meeting the 15-minute RTO and 1-hour RPO. The primary region writes are asynchronously replicated to up to five secondary regions, and in a disaster, you can promote a secondary region to full read/write in under a minute.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which can meet the RPO/RTO if properly configured and promoted quickly) with cross-region snapshots (which are too slow), or they mistakenly think Multi-AZ provides cross-region DR when it only protects against AZ failures within a single region.

Full explanation →
1162
MCQmedium

A company has a complex AWS environment with multiple VPCs connected via a transit gateway. The company wants to centrally manage DNS resolution across all VPCs. Currently, each VPC has its own Amazon Route 53 private hosted zone. The company needs a solution that allows resources in any VPC to resolve DNS names from any other VPC's private hosted zone. Which solution should be implemented?

A.Create VPC peering connections between all VPCs and enable the 'Allow DNS resolution from peered VPC' option.
B.Use Route 53 Resolver outbound endpoints and forwarding rules to forward DNS queries to the appropriate private hosted zones.
C.Configure Route 53 Resolver inbound endpoints in each VPC and set up conditional forwarding.
D.Associate each private hosted zone with each VPC using Route 53.
AnswerB

Resolver endpoints and forwarding rules enable cross-VPC DNS resolution.

Why this answer

Route 53 Resolver outbound endpoints allow you to forward DNS queries from your VPCs to custom DNS resolvers or to other private hosted zones. By creating outbound endpoints and forwarding rules, you can centrally route DNS queries from any VPC to the appropriate private hosted zone associated with another VPC, enabling cross-VPC DNS resolution without requiring VPC peering or complex associations.

Exam trap

The trap here is that candidates often confuse VPC peering DNS options with private hosted zone resolution, assuming that enabling 'Allow DNS resolution from peered VPC' automatically resolves private hosted zones across peers, when in fact it only affects the default VPC DNS server (AmazonProvidedDNS) and not custom private hosted zones.

How to eliminate wrong answers

Option A is wrong because VPC peering connections with 'Allow DNS resolution from peered VPC' only enable DNS resolution for the default VPC DNS server (the Amazon-provided DNS), not for private hosted zones associated with the peered VPC; private hosted zones require explicit association or forwarding rules. Option C is wrong because Route 53 Resolver inbound endpoints are used to receive DNS queries from on-premises networks or other resolvers, not to forward queries to private hosted zones within AWS; conditional forwarding is a client-side concept, not a resolver endpoint feature. Option D is wrong because associating each private hosted zone with each VPC is not scalable and does not solve the problem of resolving DNS names from one VPC's private hosted zone when the query originates from another VPC; private hosted zones are only resolvable from VPCs they are explicitly associated with, and this option does not provide a central resolution mechanism.

Full explanation →
1163
MCQeasy

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

A.Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.
B.Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.
C.Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.
D.Have each account purchase its own Reserved Instances based on its usage.
AnswerA

Reserved Instances are shared across all accounts in the consolidated billing family.

Why this answer

AWS Organizations with consolidated billing allows Reserved Instance (RI) discounts to be applied across all accounts in the organization. By purchasing RIs in the management account, the finance team can centrally manage and optimize RI purchases, and the hourly cost and usage benefits are shared across all accounts, maximizing utilization and cost savings.

Exam trap

The trap here is that candidates may think each account must manage its own RIs (Option D) or that AWS Budgets can facilitate cross-account RI sharing (Option B), missing the key concept that consolidated billing enables centralized RI management and discount sharing.

How to eliminate wrong answers

Option B is wrong because AWS Budgets only monitors usage and costs; it does not enable cross-account RI sharing or central management. Option C is wrong because the EC2 Reserved Instance Marketplace is for selling unused RIs to third parties, not for distributing RIs across accounts within an organization. Option D is wrong because having each account purchase its own RIs prevents centralized optimization, leading to potential underutilization and missed savings from aggregated usage across accounts.

Full explanation →
1164
MCQhard

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

A.Use an Application Load Balancer (ALB) with an Elastic IP address.
B.Use Amazon Route 53 with a weighted routing policy.
C.Use a Network Load Balancer (NLB) with an Elastic IP address.
D.Use a Classic Load Balancer (CLB) with an Elastic IP address.
AnswerC

NLB supports Elastic IPs and is highly available across AZs.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Exam trap

The trap here is that candidates often assume an ALB can use Elastic IPs because it is a modern load balancer, but ALBs are DNS-based and cannot be assigned static IPs, making the NLB the only correct choice for fixed IP whitelisting with high availability.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support Elastic IP addresses; it uses a DNS name and its IP addresses can change, making it unsuitable for fixed IP whitelisting. Option B is wrong because Amazon Route 53 with a weighted routing policy distributes traffic across multiple endpoints but does not provide a single fixed IP address for whitelisting; it relies on DNS resolution which can change. Option D is wrong because a Classic Load Balancer (CLB) can be assigned an Elastic IP, but it is a legacy service that does not support multiple Availability Zones natively and lacks the high availability and performance features of an NLB.

Full explanation →
1165
MCQeasy

A company is migrating its on-premises VMware VMs to AWS using AWS MGN. After the test cutover, the migrated EC2 instance fails the health check. The source VM runs Windows Server 2016 with a static IP. What is the most likely cause?

A.The security group does not allow inbound RDP.
B.The EBS volume type is not gp3.
C.The source VM's static IP configuration was not changed to DHCP.
D.The instance type is not compatible with Windows Server 2016.
AnswerC

Static IP causes network issues in AWS.

Why this answer

When migrating a Windows VM with a static IP using AWS MGN, the source VM must be configured to use DHCP before migration, because AWS relies on DHCP for IP assignment. If the static IP configuration persists, the EC2 instance will not obtain an IP address, causing the health check to fail. Option A is incorrect because security groups do not affect DHCP-based IP assignment.

Option B is incorrect because the EBS volume type (e.g., gp3) does not impact health checks. Option D is incorrect because the instance type is not related to DHCP configuration; Windows Server 2016 is compatible with most current instance types.

Full explanation →
1166
MCQhard

A company is migrating a critical application to AWS and must ensure business continuity with a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes. The application runs on a single on-premises server with a 500 GB disk. The current data changes at a rate of 10 MB per minute. Which solution will meet the RTO and RPO requirements with the least operational overhead?

A.Use AWS Application Migration Service (AWS MGN) to replicate the server continuously and automate cutover.
B.Use AWS Database Migration Service (AWS DMS) to replicate the database continuously.
C.Use AWS DataSync to replicate the server every 15 minutes to an EBS volume.
D.Take hourly snapshots of the server using AWS Backup and restore in a new EC2 instance.
AnswerA

AWS MGN provides continuous replication, automated testing, and fast cutover, meeting both RTO and RPO with low overhead.

Why this answer

AWS Application Migration Service (AWS MGN) continuously replicates data with near-zero RPO and supports automated testing and cutover. It can achieve an RTO of less than 1 hour for a single server. AWS DMS is for database migration, not full server.

AWS Backup has a minimum RPO of 1 hour for continuous backups. Manual snapshots cannot achieve 15-minute RPO due to the rate of change and manual intervention.

Full explanation →
1167
MCQmedium

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

A.The policy has no effect because the condition is invalid.
B.The request is denied unless there is another explicit deny.
C.The request is denied.
D.The request is allowed.
AnswerD

The IP matches the condition.

Why this answer

The IAM policy is attached to the IAM user and includes a condition that denies access unless the request originates from a specific IP address range (e.g., 10.0.0.0/16). Since the request comes from IP 10.0.1.5, which falls within that allowed range, the condition is satisfied, and the policy's effect is to allow the s3:GetObject action. Therefore, the download is permitted.

Exam trap

The trap here is that candidates often assume any condition automatically denies access, but conditions only restrict when they are not met; if the condition is satisfied, the allow takes effect.

How to eliminate wrong answers

Option A is wrong because the condition is valid; AWS IAM supports the 'aws:SourceIp' condition key for IP-based restrictions, and the IP 10.0.1.5 matches the allowed range. Option B is wrong because the policy explicitly allows the action under the condition, and there is no explicit deny present; an explicit deny would override an allow, but here the condition is met, so the allow stands. Option C is wrong because the request is not denied; the condition is satisfied, so the policy grants access.

Full explanation →
1168
MCQeasy

A company wants to migrate its on-premises Oracle database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the initial data load and ongoing replication?

A.AWS Schema Conversion Tool (SCT)
B.Amazon S3
C.AWS Direct Connect
D.AWS Database Migration Service (DMS)
AnswerD

Supports ongoing replication with change data capture.

Why this answer

AWS Database Migration Service (DMS) supports both initial data load and ongoing replication from on-premises Oracle to Amazon RDS for MySQL with minimal downtime. Option A (AWS SCT) is used for schema conversion, not data migration. Option B (Amazon S3) is a storage service, not a migration service.

Option C (AWS Direct Connect) provides network connectivity but does not perform data migration.

Full explanation →
1169
MCQmedium

A solutions architect runs the above commands for an EC2 instance. The instance state is 'running' but the system status is 'impaired'. What should the solutions architect do to restore the instance?

A.Start the instance.
B.Stop and start the instance.
C.Modify the instance type.
D.Reboot the instance.
AnswerB

Stop/start migrates the instance to new hardware.

Why this answer

When the system status check fails, it indicates a hardware issue. AWS recommends stopping and starting the instance to move it to new underlying hardware. Option A is incorrect because the instance is already running, so starting it does nothing.

Option C is incorrect because modifying the instance type does not resolve underlying hardware issues. Option D is incorrect because rebooting the instance does not change the underlying hardware and may not resolve the impairment.

Full explanation →
1170
MCQmedium

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

A.The ALB is buffering requests because the backend instances are overwhelmed; increase the number of instances or improve instance performance.
B.The backend instances are failing health checks; review the health check configuration.
C.Clients are sending too many requests; implement API rate limiting.
D.The ALB is experiencing a high number of new connections; increase the idle timeout setting.
AnswerA

SurgeQueueLength indicates request buffering; scaling out the backend will reduce latency.

Why this answer

A high SurgeQueueLength means the ALB is receiving more requests than the healthy instances can handle, causing queuing. Option B is wrong because surge queue is for HTTP requests, not connections. Option C is wrong because it is not a client-side issue.

Option D is wrong because the queue is at the ALB level, not instance level.

Full explanation →
1171
MCQeasy

A solutions architect is designing a disaster recovery plan for a critical application. The application runs on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which approach meets these requirements?

A.Use backup and restore: take hourly snapshots of EBS volumes and copy to us-west-2, then restore EC2 instances from snapshots.
B.Implement a pilot light strategy: replicate data to us-west-2 and keep a minimal stack running.
C.Deploy a multi-site active-active configuration with full capacity in both regions.
D.Use a warm standby: maintain a scaled-down copy of the environment in us-west-2 that can be scaled up within 15 minutes.
AnswerD

Warm standby allows quick scaling to full capacity within RTO.

Why this answer

A warm standby strategy meets the RTO of 15 minutes and RPO of 1 hour by maintaining a scaled-down copy of the environment in us-west-2 that can be rapidly scaled up to full production capacity. This approach ensures data replication (e.g., using Amazon RDS cross-Region replication or EBS snapshots) meets the 1-hour RPO, while the pre-provisioned but smaller infrastructure allows scaling within the 15-minute RTO, unlike a pilot light which requires more time to provision resources.

Exam trap

The trap here is that candidates often confuse pilot light with warm standby, assuming a minimal running stack can be scaled within 15 minutes, but pilot light typically requires provisioning compute and networking resources (e.g., launching EC2 instances, configuring ALB) which takes longer than the RTO, whereas warm standby already has those resources running in a scaled-down state.

How to eliminate wrong answers

Option A is wrong because backup and restore with hourly EBS snapshots copied to us-west-2 cannot achieve a 15-minute RTO, as restoring EC2 instances from snapshots involves launching new instances, attaching volumes, and configuring the ALB, which typically takes longer than 15 minutes. Option B is wrong because a pilot light strategy keeps only core data and minimal services running (e.g., a small database), requiring significant time to provision full EC2 instances, ALB, and scale-out, which exceeds the 15-minute RTO. Option C is wrong because a multi-site active-active configuration with full capacity in both regions is overkill and unnecessarily costly for an RTO of 15 minutes and RPO of 1 hour, and it does not align with the requirement for a disaster recovery plan that can be activated on demand.

Full explanation →
1172
MCQhard

A company runs a customer-facing web application on EC2 instances behind an Application Load Balancer. The application stores session data in an RDS MySQL database. Recently, they have been experiencing increased latency and occasional timeouts during peak hours. The operations team has observed that the RDS instance's CPU utilization is consistently above 80%, and the number of database connections is near the maximum allowed. The application code is not easily modifiable in the short term. The company needs a solution that reduces the load on the database with minimal changes to the application. What should a solutions architect recommend?

A.Increase the RDS instance size to a larger instance type.
B.Create an RDS read replica and offload read traffic to it.
C.Implement an Amazon ElastiCache cluster and modify the application to cache frequent queries.
D.Migrate the database to Amazon Aurora with Multi-AZ.
AnswerC

Caching reduces database load and can be done with minimal code changes if using a caching abstraction.

Why this answer

Implementing an in-memory cache like Amazon ElastiCache can offload frequent read queries from the database, reducing CPU utilization and the number of connections. This can be achieved with minimal code changes if the application uses caching libraries or can be configured to use a caching layer for session data or frequently accessed data. Option A is incorrect: increasing the RDS instance size might temporarily alleviate CPU pressure but does not reduce the number of connections and is not a scalable solution; it also requires downtime for resizing.

Option B is incorrect: creating an RDS read replica offloads read traffic but does not reduce write load or the connection count on the primary instance; session data typically involves both reads and writes, so a read replica would not significantly help with the primary's CPU or connection limit. Option D is incorrect: migrating to Amazon Aurora Multi-AZ provides better performance and high availability, but the migration process is not minimal and does not directly reduce the load on the database; it also does not address the connection limit issue.

Full explanation →
1173
MCQmedium

A company is migrating a web application to AWS. The application uses a three-tier architecture with a web server, application server, and MySQL database. The company wants to ensure high availability by deploying across multiple Availability Zones. The web and application servers are stateless. Which solution provides the HIGHEST availability with the LEAST administrative effort?

A.Deploy web and application servers on EC2 instances in an Auto Scaling group across two AZs with an Application Load Balancer. Use Multi-AZ Amazon RDS for MySQL.
B.Deploy web and application servers on EC2 instances in an Auto Scaling group in one AZ. Use Amazon Route 53 latency-based routing to another region.
C.Deploy web, application, and database on a single large EC2 instance in one AZ. Take snapshots every hour.
D.Deploy web and application servers on EC2 instances in two AZs with Elastic IP addresses. Use Amazon Route 53 with health checks to route traffic.
AnswerA

ALB and Auto Scaling provide automatic scaling and failover; Multi-AZ RDS provides database failover.

Why this answer

Deploying web and application servers on EC2 instances in an Auto Scaling group across two AZs with an Application Load Balancer ensures high availability and automatic scaling. Multi-AZ Amazon RDS for MySQL provides automatic failover for the database, minimizing administrative effort. Option B (deploying in one AZ) does not provide high availability across AZs.

Option C (single large instance) is a single point of failure. Option D (using Elastic IPs and Route 53 health checks) requires manual intervention and is less automated than the ALB solution.

Full explanation →
1174
MCQmedium

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

A.Use Amazon EventBridge cross-account event buses in each target account
B.Publish events to an AWS Lambda function in each target account
C.Use Amazon Kinesis Data Streams with cross-account access
D.Create an Amazon SNS topic in the central account and subscribe SQS queues in each target account
AnswerA

EventBridge natively supports cross-account event routing.

Why this answer

Amazon EventBridge cross-account event buses allow a central account to route events directly to event buses in target accounts using resource-based policies. This approach is serverless, fully managed, and scales horizontally without any intermediate components, making it the most scalable and secure solution. It avoids the complexity and potential bottlenecks of Lambda invocations, Kinesis stream management, or SNS-to-SQS fan-out across accounts.

Exam trap

The trap here is that candidates often default to SNS or SQS for cross-account messaging, but EventBridge's native cross-account event bus feature is specifically designed for this use case and is more scalable and secure because it uses resource-based policies and avoids intermediate services.

How to eliminate wrong answers

Option B is wrong because publishing events to a Lambda function in each target account introduces a single point of failure and scaling bottleneck per function, and requires managing cross-account IAM roles for each invocation, which is less scalable and more complex than native EventBridge cross-account routing. Option C is wrong because Amazon Kinesis Data Streams is designed for real-time data streaming with consumer-based processing, not for event routing to multiple accounts; it would require custom consumers and cross-account access policies, adding operational overhead and latency compared to EventBridge's direct push model. Option D is wrong because creating an SNS topic in the central account and subscribing SQS queues in each target account requires SQS to poll from SNS, which introduces latency and does not support event filtering or schema validation natively; also, SNS does not natively support cross-account subscriptions without additional SQS policy configuration, making it less secure and more complex than EventBridge's resource-based policies.

Full explanation →
1175
MCQmedium

A company has a central S3 bucket for logs (central-logs-bucket) in account 123456789012. The bucket policy is shown in the exhibit. A developer in account 111111111111 tries to access an object in the bucket using the AWS CLI without the --no-sign-request option. The request fails. What is the MOST likely cause?

A.The bucket policy denies access from all accounts except 123456789012.
B.The bucket policy only grants access to the root user of account 123456789012, not to other accounts.
C.The request is not using HTTPS, so it is denied by the aws:SecureTransport condition.
D.The request is not signed, so it is denied by the aws:SecureTransport condition.
AnswerB

The Principal is set to the root user of the bucket owner account.

Why this answer

The bucket policy in the exhibit uses a Principal element of `"AWS": "arn:aws:iam::123456789012:root"`. This grants access only to the root user of account 123456789012, not to any IAM users or roles in that account, and certainly not to any principals in account 111111111111. When the developer from account 111111111111 attempts to access the object with a signed request (no --no-sign-request), the request is signed with credentials from that account, which are not listed in the Principal, so S3 denies the request.

Exam trap

The trap here is that candidates often confuse the `aws:SecureTransport` condition with request signing, or assume that a bucket policy that grants access to one account's root user automatically allows all IAM users in that account, when in fact it only allows the root user itself.

How to eliminate wrong answers

Option A is wrong because the bucket policy does not explicitly deny access from other accounts; it simply grants access only to the root user of account 123456789012, which implicitly denies all others by default. Option C is wrong because the question states the developer uses the AWS CLI without --no-sign-request, meaning the request is signed, and there is no indication that HTTPS is not used; the `aws:SecureTransport` condition would only deny if the request were over HTTP, which is not stated. Option D is wrong because the request is signed (no --no-sign-request), so it is not an unsigned request; the `aws:SecureTransport` condition checks for HTTPS, not for signing, and the failure is due to the Principal restriction, not transport security.

Full explanation →
1176
MCQmedium

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

A.Ensure that the member accounts have enabled AWS Config in the same region as the aggregator.
B.Check if the member accounts have exceeded the AWS Config resource limits.
C.Check if the AWS Config recorder in the member accounts is configured to record all resource types.
D.Verify that the AWS Config aggregator in the security account has the correct authorization to assume a role in each member account.
AnswerD

The aggregator needs cross-account IAM roles to retrieve data; if permissions are missing or incorrect, accounts won't appear.

Why this answer

AWS Config aggregators require cross-account authorization to collect configuration data from member accounts. Even if AWS Config is enabled in member accounts, the aggregator in the security account must have the correct IAM role permissions (via an IAM role in each member account) to assume and retrieve configuration snapshots. Without this authorization, the aggregator cannot access the member accounts' data, causing them to not appear.

Exam trap

The trap here is that candidates assume enabling AWS Config in member accounts is sufficient, overlooking the critical cross-account authorization step required by the aggregator to pull data from those accounts.

How to eliminate wrong answers

Option A is wrong because AWS Config aggregators can collect data from multiple regions, and the issue is about accounts not showing up, not regions; the aggregator can aggregate across regions if configured correctly. Option B is wrong because exceeding AWS Config resource limits would cause errors or throttling, not a complete absence of accounts in the aggregator; the accounts are active and Config is enabled, so limits are not the likely cause. Option C is wrong because the AWS Config recorder configuration (recording all resource types or specific ones) affects what resources are recorded, not whether the account appears in the aggregator; the aggregator shows accounts regardless of the recorder's scope.

Full explanation →
1177
MCQmedium

A company is migrating a critical application from on-premises to AWS. The application uses a shared file system for user uploads and logs. The company wants a highly available, durable, and low-latency solution. Which AWS storage service should the company use?

A.Amazon EFS
B.Amazon EBS
C.Amazon FSx for Windows File Server
D.Amazon S3
AnswerA

EFS provides a scalable, highly available NFS file system.

Why this answer

Amazon EFS provides a shared NFS file system with high availability and durability, making it suitable for user uploads and logs. Option B (Amazon EBS) is block storage and not shared across instances. Option C (Amazon FSx for Windows File Server) is designed for Windows workloads and not ideal for general Linux-based applications.

Option D (Amazon S3) is object storage, not a shared file system.

Full explanation →
1178
MCQmedium

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

A.Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.
B.Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.
C.Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.
D.Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.
AnswerA

This option provides serverless, decoupled, and scalable components ideal for unpredictable spikes.

Why this answer

It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Exam trap

The trap here is that candidates often choose Kinesis Data Streams (Option C) thinking it provides better decoupling, but they overlook that SQS is specifically designed for asynchronous message buffering with per-message visibility timeouts, which is more appropriate for microservices decoupling than Kinesis's shard-based streaming model.

How to eliminate wrong answers

Option B is wrong because it relies on EC2 Auto Scaling and ALB, which have slower scaling response times (minutes) compared to Lambda's sub-second scaling, making it less resilient to sudden spikes. Option C is wrong because Kinesis Data Streams is designed for real-time streaming analytics with shard-level scaling, not for decoupling request-response microservices; it lacks the buffering and visibility timeout features of SQS that are critical for resilient decoupling. Option D is wrong because RDS with read replicas introduces a relational database bottleneck that does not scale horizontally for unpredictable write-heavy spikes, and ECS with Fargate still requires container startup time and task definition management, which is less elastic than Lambda's instant scaling.

Full explanation →
1179
Multi-Selecteasy

A company is designing a new data processing pipeline that must transform data from JSON to Parquet format. The pipeline should run daily and handle data up to 10 GB. Which TWO AWS services can be used to perform this transformation?

Select 2 answers
A.Amazon EMR
B.AWS Lambda
C.AWS Glue
D.Amazon Athena (CTAS queries)
E.Amazon Kinesis Data Firehose
AnswersC, D

Serverless ETL service.

Why this answer

AWS Glue is correct because it provides a fully managed ETL service that can natively read JSON and write Parquet, with built-in transforms and schema inference. Glue jobs run on Apache Spark under the hood, making them suitable for daily batch processing of up to 10 GB without managing any infrastructure.

Exam trap

The trap here is that candidates often choose Lambda for small-to-medium batch jobs without considering the 15-minute timeout and 10 GB memory limit, which makes it impractical for transforming 10 GB of data in a single run.

Full explanation →
1180
MCQmedium

A company has multiple AWS accounts and wants to centralize CloudTrail logs from all accounts into a single S3 bucket in the audit account. Which configuration is required?

A.Configure CloudWatch Events cross-account to forward logs to a central S3 bucket.
B.Create an organization trail in the management account that delivers logs to the central S3 bucket in the audit account, and set the bucket policy to allow CloudTrail from the organization.
C.Use AWS Organizations to automatically create a CloudTrail trail in the management account that logs all accounts.
D.Create a CloudTrail trail in each account that delivers logs to the central S3 bucket, with a bucket policy that grants write access to each account's CloudTrail service.
AnswerB

An organization trail automatically collects logs from all accounts and can deliver to a bucket in a different account if the bucket policy permits.

Why this answer

AWS Organizations allows you to create an organization trail in the management account that automatically applies to all accounts in the organization. By configuring the trail to deliver logs to a central S3 bucket in the audit account, and setting the bucket policy to grant CloudTrail service access from the organization, you centralize logging without needing per-account trails. This approach ensures that new accounts added to the organization are automatically covered.

Exam trap

The trap here is that candidates often assume they must create individual trails per account (Option D) or use CloudWatch Events (Option A), missing the simpler and more robust organization trail feature that automatically covers all accounts in the organization.

How to eliminate wrong answers

Option A is wrong because CloudWatch Events cross-account forwarding is not designed to aggregate CloudTrail logs into S3; it forwards events to targets like Lambda or SQS, not directly to S3, and would require custom processing. Option C is wrong because AWS Organizations does not automatically create a CloudTrail trail; you must explicitly create an organization trail in the management account. Option D is wrong because while it could work technically, it is not the simplest or most scalable solution; it requires configuring a trail in every account and managing individual bucket policies, which does not leverage the organizational trail feature that automatically includes all accounts.

Full explanation →
1181
MCQeasy

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

A.The upload request does not include the required ACL header.
B.The resource ARN is incorrect.
C.The bucket policy denies the request.
D.The user does not have s3:PutObject permission.
AnswerA

The condition enforces the ACL header.

Why this answer

When an IAM user in Account A uploads objects to an S3 bucket in Account B, the bucket policy must explicitly grant the cross-account principal `s3:PutObject` permission. However, if the bucket is configured to require the `bucket-owner-full-control` canned ACL (or a specific ACL header) for uploaded objects, the request must include that ACL header. Without it, S3 denies the upload even if the IAM policy and bucket policy otherwise allow the action.

This is a common requirement when the bucket owner wants to ensure they retain full control of objects uploaded by other accounts.

Exam trap

The trap here is that candidates assume cross-account S3 access failures are always due to missing IAM or bucket policy permissions, but AWS often tests the subtle requirement of including the `bucket-owner-full-control` ACL header to ensure object ownership transfers to the bucket owner.

How to eliminate wrong answers

Option B is wrong because the resource ARN in the IAM policy is used to specify which S3 bucket the policy applies to; if the ARN were incorrect, the policy would not match the bucket and the user would get an implicit deny, but the question states the policy is attached and the bucket is owned by another account, so the ARN is likely correct. Option C is wrong because the bucket policy is the mechanism that grants cross-account access; if the bucket policy denied the request, it would explicitly state a Deny effect, but the most common cause of failure in cross-account uploads is the missing ACL header, not a deny statement. Option D is wrong because the IAM policy attached to the user explicitly grants `s3:PutObject` permission (as implied by the exhibit), so the user does have that permission; the failure is due to the missing ACL requirement, not a lack of permission.

Full explanation →
1182
MCQhard

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

A.Use a NAT gateway to route traffic through the internet as a backup.
B.Configure a Direct Connect gateway and attach a VPN to it, then advertise the same prefixes via BGP with lower priority on the VPN.
C.Create a Site-to-Site VPN connection and update route tables to point all traffic to the VPN.
D.Set up a second Direct Connect connection from a different provider.
AnswerB

Allows automatic failover to VPN if Direct Connect fails.

Why this answer

AWS VPN CloudHub provides a hub-and-spoke model for multiple VPN connections, but for failover, using BGP with Direct Connect and VPN as backup is standard. However, the best answer is to use a Direct Connect gateway with a VPN attachment for failover. Option A is wrong because it adds latency.

Option C is wrong because it bypasses Direct Connect. Option D is wrong because it does not provide automatic failover.

Full explanation →
1183
MCQeasy

A developer runs the above AWS CLI command. What is the expected output?

A.A list of public IP addresses
B.A list of instance IDs for running web-server instances
C.All instance IDs regardless of state
D.An error because the query syntax is incorrect
AnswerB

The command returns InstanceIds of running instances with the specified tag.

Why this answer

The AWS CLI command uses `describe-instances` with a `--filters` parameter to select only instances with a tag `Name=web-server` and a state of `running`. The `--query` parameter then extracts the `InstanceId` values from the result. Therefore, the output is a list of instance IDs for running web-server instances, making option B correct.

Exam trap

The trap here is that candidates may overlook the `--filters` parameter and assume the command returns all instance IDs, or they may misinterpret the JMESPath query as invalid, when in fact it is a standard pattern for extracting nested fields in AWS CLI output.

How to eliminate wrong answers

Option A is wrong because the command does not query for public IP addresses; it filters for instances with a specific tag and state, and the query extracts only InstanceId, not network attributes. Option C is wrong because the filter `Name=instance-state-name,Values=running` explicitly limits the output to running instances, excluding stopped, terminated, or other states. Option D is wrong because the query syntax is valid: `Reservations[*].Instances[*].InstanceId` correctly uses JMESPath to flatten and extract the InstanceId from the nested structure returned by describe-instances.

Full explanation →
1184
Multi-Selecthard

A company is designing a serverless event-driven application using AWS Lambda. The application processes messages from an Amazon SQS queue. The team needs to ensure that messages are processed in order and exactly once. Which THREE steps should be taken?

Select 3 answers
A.Enable Lambda function's batch window to 0.
B.Configure the Lambda event source mapping to use the FIFO queue.
C.Use a standard SQS queue.
D.Set the Lambda function's reserved concurrency to 1.
E.Use a FIFO SQS queue with a message deduplication ID.
AnswersB, D, E

The event source mapping must be configured to read from the FIFO queue.

Why this answer

To achieve message ordering and exactly-once processing with Lambda and SQS, you must use a FIFO queue (option B) because FIFO queues preserve the order of messages. Additionally, enable the queue's content-based deduplication or provide a deduplication ID (option E) to prevent duplicate messages from being processed. Finally, set the Lambda function's reserved concurrency to 1 (option D) to ensure that only one instance of the function processes messages at a time, maintaining the order.

Option A (batch window 0) is incorrect because it would cause Lambda to wait longer, but does not help with ordering. Option C (standard queue) does not guarantee ordering or deduplication.

Full explanation →
1185
MCQeasy

A solutions architect needs to design a network architecture for a multi-account AWS environment using AWS Transit Gateway. The company requires that all traffic between VPCs be inspected by a central security appliance. What is the MOST efficient way to achieve this?

A.Use AWS Direct Connect to connect all VPCs to a central on-premises firewall.
B.Use a Network Load Balancer in each VPC to forward traffic to a firewall instance.
C.Attach all VPCs to a Transit Gateway and route traffic through a central inspection VPC.
D.Create VPC peering connections between all VPCs and route traffic through a security VPC.
AnswerC

Transit Gateway enables transitive routing with a central inspection VPC.

Why this answer

AWS Transit Gateway enables a hub-and-spoke architecture where all VPCs attach to a central Transit Gateway, and a dedicated inspection VPC (with the security appliance) acts as the central inspection point. By configuring route tables in the Transit Gateway to route all inter-VPC traffic through the inspection VPC, you achieve mandatory traffic inspection without complex peering or performance bottlenecks.

Exam trap

The trap here is that candidates may assume VPC peering is simpler or more direct, but they overlook that VPC peering lacks transitive routing, making it impossible to force all inter-VPC traffic through a single inspection point without a full mesh and complex routing.

How to eliminate wrong answers

Option A is wrong because AWS Direct Connect is a dedicated network connection to on-premises, not a mechanism to connect VPCs to each other or to a central firewall; it would introduce unnecessary latency and dependency on on-premises infrastructure for VPC-to-VPC traffic. Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and cannot inspect or forward traffic for security purposes; it is designed for load balancing, not traffic inspection or routing. Option D is wrong because VPC peering does not support transitive routing, so you would need a full mesh of peering connections (which does not scale) and still cannot force all traffic through a central inspection VPC without complex routing and additional appliances.

Full explanation →
1186
MCQmedium

A company is migrating a multi-tier web application to AWS. The application includes an Apache web server and a MySQL database. The operations team needs to scale the web tier based on CPU utilization while maintaining a static IP for the database. Which combination of AWS services should the solutions architect use?

A.Auto Scaling group for web tier with a Network Load Balancer; Amazon RDS for MySQL database with a static Elastic IP
B.Auto Scaling group for web tier with an Application Load Balancer; Amazon EC2 instance for MySQL database with an Elastic IP
C.Auto Scaling group for web tier with an Application Load Balancer; Amazon RDS for MySQL database with a static Elastic IP
D.Auto Scaling group for web tier with a Classic Load Balancer; Amazon EC2 instance for MySQL database with an Elastic IP
AnswerB

Correct: ALB for web scaling, EC2 with Elastic IP for static database IP.

Why this answer

An Auto Scaling group with an Application Load Balancer provides scaling for web servers. An Elastic IP on an EC2 instance provides a static IP for the database. RDS does not support Elastic IP directly.

Full explanation →
1187
MCQhard

A company has a multi-account strategy with a dedicated audit account. The audit account needs to have read-only access to all resources in all other accounts. The security team wants to use IAM roles. What is the MOST scalable way to set up this cross-account access?

A.Use AWS Single Sign-On (SSO) to grant the audit team access to each account.
B.Create an IAM user in the audit account and allow that user to assume a role in each account.
C.Manually create an IAM role in each account and attach a read-only policy.
D.Use AWS CloudFormation StackSets to deploy a stack containing an IAM role with the required trust and permissions.
AnswerD

StackSets can deploy to all accounts in an organization automatically.

Why this answer

AWS CloudFormation StackSets allows you to deploy a consistent IAM role with a read-only policy and a trust policy that grants the audit account access across all target accounts in a single, automated, and scalable operation. This approach eliminates manual effort, ensures consistency, and scales to hundreds of accounts without requiring per-account configuration.

Exam trap

The trap here is that candidates often choose manual role creation (Option C) because it seems straightforward, but they overlook the scalability and automation benefits of StackSets, which is the most efficient solution for managing cross-account roles across many accounts in a multi-account strategy.

How to eliminate wrong answers

Option A is wrong because AWS Single Sign-On (SSO) is designed for federated user access to the AWS Management Console and does not provide a mechanism to grant programmatic cross-account IAM role access for a dedicated audit account; it also does not natively enforce read-only permissions across all resources. Option B is wrong because creating an IAM user in the audit account and allowing that user to assume roles in each account is not scalable—it requires manual creation of roles and trust policies in every account, and IAM users are a security anti-pattern for cross-account access compared to role-based access. Option C is wrong because manually creating an IAM role in each account with a read-only policy is not scalable for a multi-account environment with many accounts; it introduces human error, inconsistency, and operational overhead.

Full explanation →
1188
MCQeasy

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling approach should they use?

A.Manual scaling
B.Scheduled scaling
C.Target tracking scaling policies
D.Simple scaling policies
AnswerC

Target tracking automatically adjusts capacity to maintain a target metric value.

Why this answer

Target tracking scaling policies are the correct choice because they allow Auto Scaling to automatically adjust capacity based on a target value for a specific CloudWatch metric (e.g., average CPU utilization or request count per target). This approach handles sudden traffic spikes without manual intervention by continuously monitoring the metric and adding or removing EC2 instances to maintain the target, making it ideal for unpredictable workloads.

Exam trap

The trap here is that candidates often confuse simple scaling policies with target tracking, assuming any policy based on CloudWatch alarms is sufficient, but simple scaling's cooldown period and single-step adjustment make it inadequate for sudden, sustained spikes that require rapid, continuous scaling.

How to eliminate wrong answers

Option A is wrong because manual scaling requires human intervention to adjust capacity, which cannot handle sudden spikes without delay and defeats the purpose of automation. Option B is wrong because scheduled scaling adjusts capacity at predetermined times, which is ineffective for unexpected traffic spikes that do not follow a predictable pattern. Option D is wrong because simple scaling policies only perform a single scaling adjustment based on a CloudWatch alarm breach and then must wait for a cooldown period, making them slower to react to rapid, sustained spikes compared to target tracking's continuous adjustment.

Full explanation →
1189
Multi-Selectmedium

A company is designing a new microservices architecture that requires service discovery and API management. Which THREE services can be used together to achieve this? (Choose THREE.)

Select 3 answers
A.Amazon Route 53
B.Amazon API Gateway
C.Application Load Balancer
D.Amazon VPC Lattice
E.AWS Cloud Map
AnswersB, C, E

API Gateway creates and manages APIs.

Why this answer

Amazon API Gateway (B) is correct because it provides a fully managed API management layer that handles API creation, publishing, monitoring, and security, enabling microservices to expose RESTful or WebSocket APIs. Application Load Balancer (C) is correct as it can distribute incoming traffic across multiple microservice targets (e.g., ECS tasks, Lambda functions) and supports path-based routing, which is essential for service discovery and traffic management. AWS Cloud Map (E) is correct because it offers a service registry that allows microservices to dynamically discover each other by name, using DNS or HTTP API calls, and integrates with health checks to ensure only healthy endpoints are returned.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's DNS-based service discovery with the full service registry and API management capabilities required, or they mistakenly think VPC Lattice can replace both API Gateway and Cloud Map, when in fact VPC Lattice focuses on network-layer connectivity and does not provide API management features like authentication, throttling, or request transformation.

Full explanation →
1190
MCQmedium

A company is migrating a stateful web application to AWS. The application currently runs on a single on-premises server and uses local storage for session data. The company wants to make the application highly available and scalable. What should the solutions architect do?

A.Store session data in a Multi-AZ Amazon RDS database and use Route 53 with health checks
B.Use an Application Load Balancer with sticky sessions and an Auto Scaling group
C.Use a larger EC2 instance to handle all traffic and take regular snapshots
D.Migrate session data to Amazon ElastiCache or DynamoDB, then use an Auto Scaling group behind an ALB
AnswerD

Correct: Makes the web tier stateless, allowing scaling and high availability.

Why this answer

Moving session state to ElastiCache or DynamoDB makes the application stateless, enabling Auto Scaling. Sticky sessions on an ALB are a workaround but do not provide full statelessness. Using a larger instance does not provide high availability.

Multi-AZ RDS for session data is not ideal for high-frequency session access.

Full explanation →
1191
Multi-Selectmedium

A company is migrating a legacy application to AWS and wants to use a containerized architecture. The application requires persistent storage that can be shared across multiple containers in an Amazon ECS cluster. Which TWO storage solutions should the company consider? (Choose TWO.)

Select 2 answers
A.Amazon Simple Storage Service (S3)
B.Amazon Elastic File System (EFS)
C.Amazon FSx for Lustre
D.Amazon Elastic Block Store (EBS)
E.Amazon Relational Database Service (RDS)
AnswersB, C

EFS is a shared NFS file system that can be mounted by multiple containers.

Why this answer

Amazon EFS provides a fully managed NFS file system that can be mounted by multiple Amazon ECS tasks across multiple availability zones, making it ideal for shared persistent storage. Amazon FSx for Lustre is a high-performance file system optimized for workloads such as machine learning and high-performance computing, and it also supports concurrent access from multiple ECS tasks. In contrast, Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance, so they cannot be shared across multiple containers unless using a cluster-aware file system like EFS.

Amazon S3 is object storage and does not provide a POSIX-compatible file system interface required by many legacy applications. Amazon RDS is a managed database service, not a shared storage solution.

Full explanation →
1192
MCQhard

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

A.The subnet's auto-assign public IP setting is disabled
B.The internet gateway is not attached to the VPC
C.The subnet needs a NAT gateway for internet access
D.The subnet's route table does not have a route to the internet gateway
AnswerA

MapPublicIpOnLaunch is false, so instances lack public IPs.

Why this answer

The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Exam trap

The trap here is that candidates often assume a route to an internet gateway is sufficient for internet access, overlooking the requirement that the instance must have a public IP address for the internet gateway to route traffic correctly.

How to eliminate wrong answers

Option B is wrong because the question explicitly states the VPC has an internet gateway attached, so this is not the issue. Option C is wrong because a NAT gateway is only needed for private subnets to access the internet; this subnet has a route to an internet gateway, indicating it is intended to be a public subnet, and a NAT gateway would not solve the lack of a public IP. Option D is wrong because the question states the route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway, so the route is present.

Full explanation →
1193
MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

A.Create separate AWS accounts for each project and use consolidated billing to view costs.
B.Use AWS Budgets with cost allocation tags to track project costs.
C.Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.
D.Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.
AnswerD

Cost Categories allow grouping by tags, accounts, or services and are managed centrally in the management account.

Why this answer

AWS Cost Categories allow you to group costs based on shared tags, accounts, or other dimensions across multiple accounts in an AWS Organization. This is the most scalable approach for tracking costs by project when resources span multiple accounts, as it centralizes cost allocation without requiring manual tag activation per account.

Exam trap

The trap here is that candidates often confuse cost allocation tags (which require per-account activation) with AWS Cost Categories (which provide centralized grouping), leading them to choose Option C as a simpler but less scalable solution.

How to eliminate wrong answers

Option A is wrong because creating separate accounts per project is not scalable for many projects and does not inherently allocate costs by project—it only provides account-level cost visibility. Option B is wrong because AWS Budgets are for setting spending limits and alerts, not for tracking or allocating costs retroactively by project. Option C is wrong because cost allocation tags must be activated individually in each account's billing console, which is not scalable across many accounts and projects, and Cost Explorer filtering by tag does not centrally group costs across accounts without additional setup.

Full explanation →
1194
MCQeasy

A company plans to modernize an existing .NET Framework 4.7 application running on Windows Server 2012 R2. The company wants to move to a containerized architecture on AWS with minimal code changes. Which service should the company use to meet these requirements?

A.AWS App2Container (A2C)
B.AWS Serverless Application Model (SAM)
C.AWS Copilot
D.AWS Migration Hub
AnswerA

A2C analyzes and containerizes .NET applications with minimal code changes.

Why this answer

AWS App2Container (A2C) is specifically designed to containerize existing .NET Framework applications running on Windows Server with minimal code changes. It analyzes the application, generates Docker images, and produces CloudFormation templates for deployment on Amazon ECS or EKS, directly meeting the requirement to modernize a .NET Framework 4.7 application to a containerized architecture without significant refactoring.

Exam trap

The trap here is that candidates may confuse AWS App2Container with AWS Copilot or SAM, assuming any AWS container tool can handle existing .NET Framework applications, but only A2C provides the automated analysis and containerization of legacy Windows applications with minimal code changes.

How to eliminate wrong answers

Option B (AWS SAM) is wrong because it is a framework for building serverless applications using AWS Lambda and API Gateway, not for containerizing existing .NET Framework applications; it requires rewriting the application into a serverless architecture, which contradicts the 'minimal code changes' requirement. Option C (AWS Copilot) is wrong because it is a CLI tool for deploying containerized applications on Amazon ECS or App Runner, but it assumes the application is already containerized and does not provide analysis or containerization of existing .NET Framework binaries. Option D (AWS Migration Hub) is wrong because it is a tracking and monitoring service for migration progress across multiple tools, not a tool that performs containerization or code transformation.

Full explanation →
1195
MCQhard

A company is using AWS DMS to migrate a SQL Server database to Amazon Redshift. The initial full load completed, but the ongoing replication task failed with the error shown. What is the MOST likely cause?

A.The DMS task is not configured to use a task log for troubleshooting.
B.The source SQL Server transaction log has not been backed up or truncated, causing it to become full.
C.The target Redshift table does not have a primary key defined for the DMS task to apply changes.
D.The DMS task is using a full LOB mode, which is not supported for Redshift targets.
AnswerB

CDC reads the transaction log; if it fills up, DMS cannot continue. Regular log backups or truncation are needed.

Why this answer

The error indicates that AWS DMS cannot read the source SQL Server transaction log to capture ongoing changes. This typically occurs when the transaction log is full because it has not been backed up or truncated, preventing DMS from reading new log records for continuous replication. DMS relies on the source database's transaction log for CDC (Change Data Capture), and a full log blocks this process.

Exam trap

The trap here is that candidates may confuse a target-side issue (like missing primary key or unsupported LOB mode) with a source-side transaction log problem, because the error message explicitly mentions 'transaction log' but test-takers often overlook the source database context.

How to eliminate wrong answers

Option A is wrong because the task log is used for debugging and monitoring, but its absence does not cause the replication task to fail with a transaction log error; the error message specifically points to a log read issue, not a missing log configuration. Option C is wrong because while a primary key is recommended for target tables in DMS tasks to support ongoing replication, its absence would cause a different error (e.g., 'No primary key defined') and not a transaction log failure. Option D is wrong because full LOB mode is supported for Redshift targets in DMS; the error is unrelated to LOB handling and instead points to a source-side transaction log problem.

Full explanation →
1196
Matchingmedium

Match each AWS database service to its characteristic.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

MySQL/PostgreSQL-compatible with high availability

Fully managed NoSQL key-value and document database

Petabyte-scale data warehouse for analytics

In-memory caching with Redis or Memcached

Managed relational database for multiple engines

Why these pairings

Each AWS database service targets specific use cases: RDS for relational workloads, DynamoDB for NoSQL, Redshift for analytics, and ElastiCache for caching. Common confusions include mixing up NoSQL with relational and caching with warehousing.

Full explanation →
1197
MCQmedium

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

A.The ALB's idle timeout is set too low.
B.The security group for the EC2 instances does not allow inbound traffic from the ALB.
C.The EC2 instances are in an Auto Scaling group with insufficient capacity.
D.The health check path is misconfigured and returns HTTP 404.
AnswerD

A 404 response causes the ALB to mark the instance as unhealthy, reducing the healthy host count.

Why this answer

The ALB performs health checks on targets by sending requests to the configured health check path. If the health check path returns an HTTP 404 (or any non-200 status), the ALB marks the target as unhealthy. When all instances have a misconfigured health check path that returns 404, the healthy host count drops to zero, resulting in 503 errors.

Option D is correct because a misconfigured health check path directly causes all instances to be marked unhealthy. Option A (idle timeout) would cause connection timeouts but not affect healthy host count. Option B (security group) would prevent traffic from ALB, but the health check would still succeed if the security group allows ALB traffic, and it would not cause healthy host count to drop to zero periodically if misconfigured.

Option C (insufficient capacity) would cause scaling issues but not zero healthy hosts if the health check is correct. Therefore, D is the most likely cause.

Full explanation →
1198
MCQeasy

A company wants to implement a data lake on AWS with data from multiple sources. They need to store data in its raw format and allow multiple teams to query it using different tools. Which service should be used as the central storage layer?

A.Amazon DynamoDB
B.Amazon Redshift
C.Amazon S3
D.Amazon RDS
AnswerC

S3 is the foundational storage service for data lakes.

Why this answer

Amazon S3 is the correct choice because it provides a highly durable, scalable, and cost-effective object storage service that can store data in its raw, native format (e.g., CSV, JSON, Parquet, images). It supports multiple query engines like Amazon Athena, Amazon Redshift Spectrum, and AWS Glue, allowing diverse teams to query the same data using different tools without data movement.

Exam trap

The trap here is that candidates often confuse a data lake's raw storage layer with a data warehouse (Redshift) or a transactional database (RDS, DynamoDB), failing to recognize that a data lake requires schema-on-read, object storage, and multi-engine query support, which only S3 provides.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database designed for low-latency, transactional workloads, not for storing raw, schema-less data lake files or supporting SQL-based analytics at scale. Option B is wrong because Amazon Redshift is a petabyte-scale data warehouse that requires data to be loaded and transformed into a structured, columnar format; it is not designed to store raw, unprocessed data from multiple sources. Option D is wrong because Amazon RDS is a relational database service that enforces a fixed schema and is optimized for OLTP workloads, making it unsuitable for storing diverse raw data formats and supporting ad-hoc queries from multiple analytics tools.

Full explanation →
1199
MCQmedium

A company is designing a multi-tier web application on AWS. The application must be highly available and scale automatically based on traffic. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier also uses EC2 instances. Which solution meets these requirements with the LEAST operational overhead?

A.Use Amazon ECS with Fargate for both tiers, with an Application Load Balancer.
B.Use AWS Global Accelerator with a single Auto Scaling group for both tiers.
C.Use Network Load Balancer with Auto Scaling groups for both tiers.
D.Use Auto Scaling groups for both web and application tiers, and route traffic through an Application Load Balancer.
AnswerD

Auto Scaling groups provide automatic scaling and health checks, ALB distributes traffic, low overhead.

Why this answer

Using Auto Scaling groups for both web and application tiers with an Application Load Balancer provides automatic scaling and high availability with minimal operational overhead. Auto Scaling groups handle instance health and scaling based on demand, while the ALB distributes HTTP traffic. Option A is incorrect because ECS with Fargate introduces container management complexity, increasing operational overhead compared to EC2 Auto Scaling groups.

Option B is incorrect because AWS Global Accelerator does not provide automatic scaling for instances; it only improves traffic routing and latency. Option C is incorrect because a Network Load Balancer is designed for TCP/UDP traffic and does not natively support HTTP-layer features needed for a web application, and it does not integrate with Auto Scaling for automatic scaling as seamlessly as an ALB.

Full explanation →
1200
MCQmedium

A company is setting up AWS DMS to migrate a database. The trust policy above is attached to the IAM role used by DMS. When testing the connection, DMS reports an authentication error. What is the most likely cause?

A.The trust policy is missing a condition for the DMS replication instance.
B.The service principal should be dms.amazonaws.com, but it is misspelled.
C.The trust policy is missing a region-specific condition.
D.The trust policy is correct, but the permissions policy attached to the role does not allow DMS to perform the necessary actions on the source and target databases.
AnswerD

The trust policy allows DMS to assume the role, but the role's permissions policy must grant access to the databases.

Why this answer

The trust policy is correctly configured to allow the DMS service principal (dms.amazonaws.com) to assume the role, as required. However, an authentication error during connection testing typically indicates that DMS cannot successfully assume the role or that the assumed role lacks the necessary permissions to interact with the source or target databases. Since the trust policy is correct, the most likely cause is that the permissions policy attached to the role does not grant DMS the required actions (e.g., dms:TestConnection, dms:CreateEndpoint) on the database resources.

Option D correctly identifies this as the issue.

Full explanation →
Page 15

Page 16 of 23

Page 17

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →