Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1201–1275

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 16

Page 17 of 23

Page 18
1201
MCQhard

A company has a centralized logging account and multiple application accounts. Each application account sends CloudWatch Logs to a cross-account log group in the logging account. The security team wants to ensure that logs are encrypted at rest using a KMS key that only the logging account can manage. Which configuration is required?

A.Use S3 replication with SSE-KMS to copy logs from source accounts to the logging account.
B.Create a cross-account destination in the logging account, configure subscription filters in source accounts, and attach a KMS key policy that allows CloudWatch Logs in source accounts to use the key.
C.Create a cross-account destination in each source account and attach a resource policy that grants the logging account permission to write.
D.Use the default AWS-managed KMS key for CloudWatch Logs in each source account.
AnswerB

This enables cross-account log delivery with customer-managed KMS encryption.

Why this answer

It uses a cross-account destination in the logging account with subscription filters in the source accounts, which is the standard pattern for streaming CloudWatch Logs across accounts. The KMS key policy must grant the CloudWatch Logs service in the source accounts permission to use the key (via kms:Encrypt and kms:Decrypt) so that logs can be encrypted at rest in the logging account while only the logging account manages the key.

Exam trap

The trap here is that candidates confuse cross-account destinations (which require the destination to be in the logging account) with cross-account resource policies (which are placed in the source account), leading them to choose Option C.

How to eliminate wrong answers

Option A is wrong because S3 replication with SSE-KMS copies logs from S3, not directly from CloudWatch Logs, and introduces an unnecessary intermediate service; the requirement is for CloudWatch Logs encryption at rest, not S3 replication. Option C is wrong because a cross-account destination must be created in the logging account (the destination account), not in each source account, and the resource policy should allow the source accounts to write to the destination, not the other way around. Option D is wrong because using the default AWS-managed KMS key means the key is managed by AWS and not by the logging account, violating the requirement that only the logging account can manage the key.

Full explanation →
1202
Drag & Dropmedium

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

Start with security groups, then network ACLs, then public IP, then system status, and finally console output.

Full explanation →
1203
MCQhard

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

A.The function is invoked via two different triggers
B.The function is configured with two different reserved concurrency settings
C.The function has two versions: $LATEST and version 1
D.The function is deployed in two different regions
AnswerC

Each version has its own metric.

Why this answer

The CLI output shows two metrics for the Errors metric because the function has two versions: $LATEST (the unpublished, mutable version) and version 1 (the published, immutable version). The alias 'prod' points to version 1, but CloudWatch metrics are emitted per version, so both $LATEST and version 1 generate separate error metric streams. This is why two distinct data points appear for the same metric name.

Exam trap

The trap here is that candidates assume the alias 'prod' consolidates all metrics into a single stream, but AWS CloudWatch emits separate metric dimensions for each version, even when an alias points to a specific version, causing two distinct error metric lines.

How to eliminate wrong answers

Option A is wrong because multiple triggers (e.g., S3, API Gateway) would invoke the same function version, not create separate metric streams; CloudWatch aggregates errors per version, not per trigger. Option B is wrong because reserved concurrency settings affect throttling behavior, not the number of metric streams; they do not create separate error metrics. Option D is wrong because the function is deployed in a single region (implied by the CLI output), and cross-region deployments would require separate function ARNs and would not appear as two metrics under the same function name in a single region's CloudWatch console.

Full explanation →
1204
Multi-Selectmedium

A company is designing a new event-driven architecture using AWS services. The system must process events from multiple sources, filter and route events to different consumers, and ensure that events are processed exactly once. Which THREE services should be used to build this architecture? (Choose three.)

Select 3 answers
A.Amazon Kinesis Data Firehose to deliver events to destinations.
B.AWS Lambda functions to consume events from queues and process them.
C.AWS AppSync to provide real-time subscriptions for events.
D.Amazon SQS FIFO queues to ensure exactly-once processing.
E.Amazon EventBridge to ingest events and route them based on rules.
AnswersB, D, E

Lambda can poll SQS queues and process events.

Why this answer

AWS Lambda functions are correct because they can be triggered by Amazon SQS FIFO queues to process messages one at a time, preserving the order and enabling idempotent processing. Lambda integrates natively with SQS, automatically scaling the number of concurrent executions based on the queue depth, which supports the exactly-once processing requirement when combined with FIFO queues.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose with Amazon Kinesis Data Streams, assuming Firehose supports exactly-once processing, but Firehose only provides at-least-once delivery and lacks the FIFO ordering and deduplication capabilities required for this use case.

Full explanation →
1205
Multi-Selectmedium

A company is designing a disaster recovery (DR) strategy for a critical application. The application runs on EC2 instances in a single AWS Region. The company needs a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which TWO strategies meet these requirements? (Choose TWO.)

Select 1 answer
A.Use S3 Cross-Region Replication for application data and launch EC2 instances from AMIs copied to the secondary Region
B.Take hourly snapshots of EBS volumes and copy them to another Region; use AWS CloudFormation to launch instances from the snapshots
C.Use Amazon Aurora Global Database for the database and deploy EC2 instances with an Application Load Balancer that has cross-Region load balancing enabled
D.Use Amazon DynamoDB global tables for the database and deploy EC2 instances in a warm standby configuration in another Region
E.Configure an Active-Passive failover using Route 53 with health checks within the same Region
AnswersD

Amazon DynamoDB global tables replicate data across Regions with an RPO of seconds, meeting the 15-minute RPO. A warm standby setup with EC2 instances in the secondary Region, combined with Route 53 DNS failover, can achieve the 2-hour RTO. This strategy is correct.

Why this answer

Amazon DynamoDB global tables provide automatic, asynchronous replication across multiple AWS Regions with an RPO of typically less than 1 second, easily meeting the 15-minute RPO. Combined with a warm standby configuration of EC2 instances in the secondary Region, you can quickly fail over within the 2-hour RTO using Route 53 or other DNS mechanisms. Option C is incorrect because Application Load Balancers (ALBs) are regional in scope and do not support cross-Region load balancing.

ALB cannot directly route traffic to targets in another Region, so the described architecture would not achieve cross-Region failover as intended. Options A and B involve replication mechanisms (S3 CRR and EBS snapshots) that cannot guarantee the 15-minute RPO due to asynchronous delays and manual recovery steps. Option E describes an Active-Passive configuration within the same Region, which does not provide disaster recovery across Regions.

Exam trap

The trap is that candidates may assume Application Load Balancers can perform cross-Region load balancing, but ALBs are regional services and cannot forward traffic to targets in a different Region. For cross-Region failover, you must use DNS-based routing (e.g., Route 53) or a global load balancer like Global Accelerator. While managed databases like Aurora Global Database and DynamoDB global tables offer low RPO replication, the network tier must be designed correctly to achieve the required RTO and RPO.

Full explanation →
1206
Multi-Selecthard

A company runs a containerized microservices application on Amazon EKS. The operations team notices that some pods are frequently being evicted due to resource constraints. The team wants to improve resource utilization and reduce evictions. Which TWO actions should the team take? (Choose two.)

Select 2 answers
A.Configure Horizontal Pod Autoscaler based on CPU and memory utilization.
B.Increase the resource requests for all pods to ensure they have enough resources.
C.Set resource quotas per namespace to limit resource consumption.
D.Enable Cluster Autoscaler to add more worker nodes.
E.Use Vertical Pod Autoscaler to automatically adjust pod resource requests.
AnswersA, C

Scales pods to handle load.

Why this answer

Options A and C are correct. Horizontal Pod Autoscaler (HPA) dynamically scales the number of pod replicas based on CPU or memory utilization, helping to meet demand without over-provisioning. Resource quotas limit the total resources a namespace can consume, preventing any single team or application from starving others.

Option B is incorrect because increasing resource requests for all pods can lead to over-provisioning and wasted resources, potentially worsening the eviction problem. Option D is incorrect because Cluster Autoscaler adds more worker nodes, which addresses cluster-level capacity but does not directly reduce pod evictions caused by node-level resource contention. Option E is incorrect because Vertical Pod Autoscaler (VPA) adjusts resource requests and limits automatically, but it often requires pod restarts and may not immediately prevent evictions if the underlying node is already overcommitted.

Full explanation →
1207
MCQmedium

A company is deploying a new microservices application on Amazon ECS using Fargate. The application consists of several services that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. Additionally, the company needs to ensure that traffic between services is encrypted in transit. The security team requires that all inter-service traffic uses TLS. Which combination of services should be used to meet these requirements?

A.Use AWS Cloud Map for service discovery and an Application Load Balancer for inter-service communication with TLS termination.
B.Use the built-in service discovery in Amazon ECS and encrypt traffic using AWS Certificate Manager (ACM) certificates.
C.Use an Application Load Balancer with target groups for each service and enable TLS on the load balancer.
D.Use AWS Cloud Map for service discovery and AWS App Mesh with TLS enforcement for inter-service communication.
AnswerD

Cloud Map provides DNS-based service discovery; App Mesh enables mTLS between services.

Why this answer

AWS Cloud Map provides service discovery, allowing ECS services to find each other by name. AWS App Mesh can enforce TLS encryption for inter-service traffic, meeting the security requirement. Option A is incorrect because an Application Load Balancer is used for external traffic and does not provide service discovery for internal service-to-service communication.

Option B is incorrect because ECS built-in service discovery (which relies on Cloud Map) does not automatically encrypt traffic; ACM certificates alone do not enforce TLS for all inter-service traffic. Option C is incorrect because an ALB is designed for load balancing external traffic, not for internal service discovery and mTLS.

Full explanation →
1208
MCQmedium

A company is running a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the instance. The company wants to make the application highly available and fault-tolerant without rewriting the application code. What should the solutions architect do?

A.Replace the ALB with a Network Load Balancer (NLB) and enable cross-zone load balancing.
B.Move session state to Amazon ElastiCache and configure the ALB to use sticky sessions.
C.Configure the ALB with sticky sessions (session affinity) and use a custom cookie.
D.Use an Auto Scaling group to add more instances and distribute load.
AnswerC

Sticky sessions bind a user to a specific instance, preserving local state without code changes.

Why this answer

Configuring the ALB with sticky sessions (session affinity) using a custom cookie allows the ALB to consistently route requests from a user's session to the same EC2 instance, preserving the locally stored session state without requiring any application code changes. This approach leverages the ALB's built-in session affinity feature, which is transparent to the application and ensures high availability by distributing traffic across healthy instances while maintaining session continuity.

Exam trap

The trap here is that candidates often assume moving session state to an external store like ElastiCache is the only way to achieve fault tolerance, but the question explicitly prohibits rewriting application code, making sticky sessions the correct choice despite its limitations (e.g., uneven load distribution).

How to eliminate wrong answers

Option A is wrong because replacing the ALB with a Network Load Balancer (NLB) does not solve the session state problem; NLB operates at Layer 4 and does not support sticky sessions or cookie-based affinity, so it would not preserve session state stored locally on instances. Option B is wrong because moving session state to Amazon ElastiCache would require rewriting the application code to read/write session data from an external cache, which violates the requirement of not rewriting the application code. Option D is wrong because simply using an Auto Scaling group to add more instances and distribute load does not address the session affinity issue; without sticky sessions, subsequent requests from the same user may be routed to different instances, causing session data loss.

Full explanation →
1209
Multi-Selectmedium

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Select 2 answers
A.Amazon Macie
B.Amazon GuardDuty
C.AWS KMS
D.AWS Config
E.AWS CloudTrail
AnswersC, E

Manages encryption keys for S3.

Why this answer

AWS KMS provides encryption keys for data at rest in S3, and AWS CloudTrail logs API calls for auditing purposes. Option A (Amazon Macie) is for sensitive data discovery, Option B (Amazon GuardDuty) is for threat detection, and Option D (AWS Config) is for resource configuration tracking.

Full explanation →
1210
MCQmedium

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

A.Export the logs to S3 and delete the log group.
B.Use the put-retention-policy command to set retentionInDays to 7.
C.Configure an S3 Lifecycle policy on the log group's underlying storage.
D.Create a CloudTrail trail to capture log events and expire them after 7 days.
AnswerB

This command directly sets the log group's retention period.

Why this answer

The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct.

Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Full explanation →
1211
MCQmedium

A company uses AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required to set this up?

A.Use the management account to designate the member account as a delegated administrator for IAM Identity Center.
B.Enable AWS Organizations and create an admin role in the member account.
C.Create a new OU for the delegated administrator account.
D.Attach an SCP to allow IAM Identity Center actions in the member account.
AnswerA

This is the standard AWS procedure.

Why this answer

To delegate administration of IAM Identity Center to a member account, you must use the AWS Organizations management account to register that member account as a delegated administrator for IAM Identity Center. This is done via the AWS Organizations console or API (RegisterDelegatedAdministrator), which grants the member account the necessary permissions to manage IAM Identity Center settings, users, and groups without requiring full management account access. Only the management account can designate delegated administrators, and this action is specific to IAM Identity Center within AWS Organizations.

Exam trap

The trap here is that candidates often confuse generic cross-account role delegation (like creating an IAM role in a member account) with the specific AWS Organizations delegated administrator feature, which requires explicit registration from the management account and is not achieved by simply creating roles or policies.

How to eliminate wrong answers

Option B is wrong because enabling AWS Organizations and creating an admin role in the member account is a generic step for cross-account access, but it does not specifically delegate IAM Identity Center administration; delegated administration requires explicit registration via the management account, not just role creation. Option C is wrong because creating a new OU for the delegated administrator account is not required; delegated administrators can be any member account in any OU, and OUs are for organizational structure and policy application, not for enabling delegation. Option D is wrong because attaching an SCP to allow IAM Identity Center actions in the member account is unnecessary and incorrect; SCPs are used to restrict permissions, not to grant them, and delegation is controlled by the management account's registration, not by SCPs.

Full explanation →
1212
MCQhard

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and has a dependency on a local file system. The company wants to minimize code changes. Which combination of services should be used?

A.Amazon EC2 Windows instances with Amazon EFS
B.AWS Elastic Beanstalk with Amazon EFS
C.Amazon Lightsail with local instance storage
D.Amazon EC2 Windows instances with Amazon FSx for Windows File Server
AnswerD

Provides native Windows environment and SMB file sharing with minimal changes.

Why this answer

Amazon EC2 Windows instances provide a native Windows environment, and Amazon FSx for Windows File Server offers fully managed Windows file shares that support SMB protocol, Windows authentication, and NTFS file system. This combination minimizes code changes by preserving the existing Windows authentication and local file system dependencies. Option A is incorrect because Amazon EFS uses NFS and does not natively support Windows SMB.

Option B is incorrect because AWS Elastic Beanstalk for Windows may complicate Windows authentication and lacks the flexibility for direct file system access. Option C is incorrect because Amazon Lightsail with local instance storage does not provide shared file storage and may not scale as needed.

Full explanation →
1213
MCQhard

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

A.Configure ElastiCache Auto Scaling to automatically add nodes when CPU utilization exceeds 75%.
B.Enable cluster mode for the Redis cluster and add more shards.
C.Enable Multi-AZ replication for the Redis cluster.
D.Increase the instance size of the Redis cluster to a larger node type.
AnswerB

Cluster mode distributes data and load across multiple shards, increasing CPU and memory capacity.

Why this answer

Enabling cluster mode for the Redis cluster and adding more shards horizontally partitions the data across multiple nodes, distributing both CPU and memory load. This directly addresses the 100% CPU and high memory utilization during traffic spikes, allowing the cluster to handle more concurrent requests without performance degradation. Cluster mode also provides linear scalability, which is essential for a critical web application experiencing variable traffic.

Exam trap

The trap here is that candidates often confuse vertical scaling (increasing instance size) with horizontal scaling (adding shards), and fail to recognize that cluster mode is the only option that distributes both CPU and memory load across multiple nodes, which is necessary when a single node reaches 100% CPU utilization.

How to eliminate wrong answers

Option A is wrong because ElastiCache Auto Scaling is not a native feature; it requires custom automation using CloudWatch alarms and Lambda, and even then it adds nodes reactively, not proactively preventing the latency and 5xx errors during spikes. Option C is wrong because Multi-AZ replication provides high availability and failover, but it does not distribute read/write load or reduce CPU/memory pressure on the primary node. Option D is wrong because increasing the instance size (vertical scaling) has a hard limit based on the largest available node type and can still be overwhelmed during extreme spikes, whereas horizontal scaling with cluster mode offers near-unlimited scalability.

Full explanation →
1214
Multi-Selecthard

A company is building a serverless application using AWS Lambda and Amazon DynamoDB. They need to ensure that the application can handle a sudden increase in traffic without losing any data or causing errors. Which THREE strategies should they implement?

Select 3 answers
A.Use DynamoDB on-demand capacity mode.
B.Decouple the application with Amazon SQS.
C.Enable DynamoDB auto scaling.
D.Use DynamoDB Accelerator (DAX) for caching.
E.Configure Lambda reserved concurrency.
AnswersA, C, E

On-demand handles unpredictable traffic without capacity planning.

Why this answer

To handle sudden traffic spikes without data loss or errors, the company should: Option A (DynamoDB on-demand capacity) automatically scales to handle unpredictable throughput; Option C (DynamoDB auto scaling) adjusts provisioned capacity based on demand; Option E (Lambda reserved concurrency) ensures a baseline of concurrent executions to prevent throttling. Option B (SQS) adds decoupling but is not strictly necessary for this requirement and can introduce latency; Option D (DAX) improves read performance but does not address write scaling or throughput spikes for write-intensive loads.

Full explanation →
1215
MCQeasy

A company wants to centralize management of Amazon EC2 instances across multiple accounts using AWS Systems Manager. The company uses AWS Organizations. What is the simplest way to enable Systems Manager to manage instances in all accounts?

A.Use AWS Config to aggregate configuration data
B.Use Systems Manager Automation runbooks in each account
C.Use Systems Manager Explorer with multi-account management
D.Use CloudFormation StackSets to deploy Systems Manager agents
AnswerC

Explorer provides a single pane of glass for all accounts in the organization.

Why this answer

Systems Manager Explorer provides a built-in, multi-account view that aggregates operational data (e.g., patch compliance, inventory) from all member accounts in AWS Organizations without requiring custom scripts or manual setup. It leverages AWS Organizations to automatically discover and manage instances across accounts, making it the simplest centralized management solution.

Exam trap

The trap here is that candidates often confuse the provisioning of resources (StackSets) with the centralized management and visibility of existing resources (Explorer), leading them to choose Option D because they think deploying the SSM Agent is the key requirement, when in fact the agent is already present and the real need is cross-account operational visibility.

How to eliminate wrong answers

Option A is wrong because AWS Config aggregates configuration data and compliance history, but it does not provide Systems Manager's operational management capabilities (e.g., Run Command, Session Manager, Patch Manager) for EC2 instances. Option B is wrong because Systems Manager Automation runbooks are used for automated remediation or maintenance tasks within a single account; they do not natively provide centralized multi-account management or instance discovery across Organizations. Option D is wrong because CloudFormation StackSets can deploy the SSM Agent and other resources across accounts, but the agent is already installed by default on most modern AMIs, and StackSets do not enable the centralized management console (Explorer) or cross-account operational features; they only handle resource provisioning, not ongoing management.

Full explanation →
1216
MCQmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

A.Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.
B.Stop all instances, launch new instances with the new version, and update the target group.
C.Update the existing target group's instances to the new version, one at a time.
D.Create a new ALB and update DNS to point to the new ALB.
AnswerA

This is the standard blue/green deployment with ALB.

Why this answer

Blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Exam trap

The trap here is confusing blue/green deployment with rolling updates or assuming that a new ALB and DNS change are required, when in fact ALB listener rule modifications provide immediate traffic switching without DNS propagation delays.

How to eliminate wrong answers

Option B is wrong because stopping all instances causes complete downtime, violating the requirement for minimal impact on users. Option C is wrong because updating instances one at a time in the existing target group is a rolling update strategy, not a blue/green deployment; it does not maintain two separate environments for instant switchover. Option D is wrong because creating a new ALB and updating DNS introduces DNS propagation delays and potential disruption, whereas blue/green with ALB should leverage listener rule changes for immediate traffic shift.

Full explanation →
1217
MCQhard

A company has a global AWS environment with multiple VPCs in different regions. The company uses AWS Transit Gateway to connect VPCs in the same region, but they need to interconnect VPCs across regions. The network team wants a solution that provides transitive routing across regions with minimal latency and operational overhead. Which solution should be implemented?

A.Set up a VPN connection between Transit Gateways in different regions.
B.Use AWS Direct Connect to connect the Transit Gateways in different regions.
C.Create VPC peering connections between all VPCs in different regions.
D.Use Transit Gateway peering attachments between Transit Gateways in different regions.
AnswerD

Transit Gateway peering provides transitive routing across regions with low latency.

Why this answer

Transit Gateway peering attachments enable transitive routing between Transit Gateways in different AWS regions, providing low-latency connectivity over the AWS global network without requiring VPN or Direct Connect. This solution minimizes operational overhead because AWS manages the peering connection and route propagation automatically, allowing VPCs attached to different Transit Gateways to communicate across regions.

Exam trap

The trap here is that candidates may confuse Transit Gateway peering with VPN or Direct Connect, assuming that cross-region connectivity requires a VPN or dedicated line, but AWS provides a native, managed peering feature that is simpler and more performant for inter-region Transit Gateway connectivity.

How to eliminate wrong answers

Option A is wrong because setting up a VPN connection between Transit Gateways introduces additional latency, complexity, and operational overhead due to managing VPN tunnels and encryption endpoints, and it does not leverage the AWS global backbone for optimal performance. Option B is wrong because AWS Direct Connect is a dedicated on-premises connection and cannot be used to directly interconnect Transit Gateways across regions; it would require additional routing and does not provide transitive routing between regions. Option C is wrong because VPC peering does not support transitive routing—each peering connection is a one-to-one relationship, so to connect all VPCs across regions you would need a full mesh of peering connections, which is not scalable and incurs high operational overhead.

Full explanation →
1218
Multi-Selectmedium

A company is designing a new cloud-native application that will run on Amazon ECS with Fargate. The application must store logs centrally for analysis. Which TWO services can be used to collect and analyze logs from ECS Fargate tasks?

Select 2 answers
A.Amazon CloudWatch Logs
B.AWS FireLens (Fluent Bit)
C.Amazon S3
D.AWS CloudTrail
E.Amazon Kinesis Data Analytics
AnswersA, B

ECS can send logs to CloudWatch Logs using the awslogs log driver.

Why this answer

Amazon CloudWatch Logs is the native log management service for AWS, and ECS Fargate tasks can be configured to send stdout/stderr logs directly to CloudWatch Logs using the 'awslogs' log driver. This provides centralized log collection, storage, and analysis with features like metric filters and log insights, making it a correct choice for collecting and analyzing logs from Fargate tasks.

Exam trap

The trap here is that candidates often confuse AWS CloudTrail (which logs AWS API calls) with application-level logging, or they assume Amazon S3 alone can serve as a real-time log analysis solution, when in fact it lacks native query and analysis capabilities without additional services like Athena.

Full explanation →
1219
MCQmedium

A company runs a web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application writes logs to local instance storage. The company wants to centralize log collection and ensure logs are retained even if instances are terminated. The current solution uses Amazon CloudWatch Logs agent, but log streams are frequently missing when instances are replaced. What should the company do to ensure complete log collection?

A.Configure the CloudWatch agent to use a persistent buffer on an EBS volume.
B.Configure an S3 Lifecycle policy to transition logs to S3 Glacier.
C.Use the CloudWatch agent to send logs directly to Amazon S3.
D.Attach an EBS volume to each instance and store logs there.
AnswerA

Correct. Configuring the CloudWatch agent to use a persistent buffer on an EBS volume ensures log data is not lost during instance termination because the buffer is stored on a durable EBS volume that persists independently of the instance.

Why this answer

The CloudWatch agent can be configured with a persistent buffer on an EBS volume. This buffer stores log data temporarily until it is successfully sent to CloudWatch Logs. Even if an EC2 instance is terminated, the buffered logs on the EBS volume are retained and will be sent when the agent is configured to use that volume.

This ensures no log data is lost during instance replacement. Option B is incorrect because S3 Lifecycle policies manage object transitions in Amazon S3, not CloudWatch logs. Option C is incorrect because the CloudWatch agent does not send logs directly to S3; it sends to CloudWatch Logs.

Option D is incorrect because simply storing logs on an EBS volume without the agent's persistent buffer does not ensure automatic log collection and forwarding; the logs would only reside on the volume and not be centrally collected.

Full explanation →
1220
Multi-Selectmedium

A company is setting up a new AWS Organization and wants to implement a data perimeter to ensure that data can only be accessed from approved network locations. Which TWO actions should the company take?

Select 2 answers
A.Implement an S3 bucket policy that restricts access based on the aws:SourceVpce condition key.
B.Create an IAM policy in each account that denies access unless the request comes from the approved IP range.
C.Use AWS PrivateLink to access all AWS services from within the VPC.
D.Create a service control policy (SCP) that denies access to resources unless the request originates from the approved IP address range.
E.Use AWS Resource Access Manager to share resources with approved accounts only.
AnswersA, D

Restricts access to requests from specific VPC endpoints.

Why this answer

An S3 bucket policy with the `aws:SourceVpce` condition key restricts access to only requests originating from a specific VPC endpoint, ensuring data can only be accessed from approved network locations within the VPC. Option D is correct because a service control policy (SCP) that denies access unless the request originates from an approved IP address range enforces a data perimeter across all accounts in the AWS Organization, preventing access from unapproved networks.

Exam trap

The trap here is that candidates often confuse IAM policies with SCPs, thinking that IAM policies can enforce organization-wide network restrictions, but SCPs are the only way to apply a deny across all accounts in an AWS Organization, and IAM policies are account-specific and can be overridden by resource-based policies.

Full explanation →
1221
Multi-Selecthard

A company is migrating a monolithic application to a microservices architecture on Amazon ECS. The application uses a shared MySQL database. Which THREE strategies should the company use to modernize the data layer?

Select 3 answers
A.Migrate all data to Amazon DynamoDB.
B.Use database per service pattern.
C.Keep a single RDS instance with multiple schemas.
D.Use Amazon RDS read replicas to offload read queries.
E.Implement CQRS and event sourcing.
AnswersB, D, E

Each microservice gets its own database.

Why this answer

(database per service pattern) is correct because it aligns with microservices principles by giving each service its own database, enabling independent scaling and deployment. Option D (read replicas) is correct for offloading read queries from the primary database, improving performance for read-heavy workloads. Option E (CQRS and event sourcing) is correct for separating read and write operations and maintaining an event log, which helps in decomposing the monolith and ensuring eventual consistency.

Option A is wrong because Amazon DynamoDB may not be suitable for all relational data and migrating all data to NoSQL is not always appropriate. Option C is wrong because keeping a single RDS instance with multiple schemas does not fully decouple the data layer and still creates a single point of failure and coupling.

Full explanation →
1222
MCQhard

A company is migrating a critical 3-tier application to AWS. The application consists of a web tier, an application tier, and a PostgreSQL database. The web and application tiers are stateless and run on Linux. The company has deployed the web tier on EC2 instances behind an Application Load Balancer (ALB) across two Availability Zones. The application tier is deployed on EC2 instances in an Auto Scaling group across two Availability Zones. The PostgreSQL database is migrated to Amazon RDS for PostgreSQL with Multi-AZ deployment. The application uses sticky sessions (session affinity) to maintain user sessions on the web tier. After migration, users report that they are frequently logged out and lose session data. The web tier logs show that requests are being routed to different web instances. What is the MOST likely cause of this issue?

A.The target group for the web tier does not have sticky sessions (session affinity) enabled
B.The ALB is configured to disable cross-zone load balancing, causing uneven traffic distribution
C.The idle timeout of the ALB is set too low, causing sessions to expire
D.The web tier should use a Network Load Balancer (NLB) instead of an ALB for sticky sessions
AnswerA

Sticky sessions ensure requests from a user are routed to the same instance; without it, subsequent requests may go to different instances, losing session data.

Why this answer

The issue is that users are losing session data because requests are being routed to different web instances. Sticky sessions (session affinity) must be enabled on the target group of the ALB to ensure that all requests from a user's session are sent to the same web instance. Without sticky sessions, the ALB distributes requests across all healthy targets, causing session data to be lost if not shared.

Option A is correct because the target group needs sticky sessions enabled. Option B (disable cross-zone load balancing) would not cause this issue; it would affect traffic distribution across AZs but not session persistence. Option C (idle timeout) would cause sessions to expire after a period of inactivity, not immediate logout.

Option D (using NLB) is not necessary as ALB supports sticky sessions natively.

Full explanation →
1223
MCQhard

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

A.ECS tasks are being replaced by the service scheduler during deployments or health checks.
B.The security group for the ECS tasks is blocking inbound traffic from the ALB.
C.The ECS service is configured to scale out, causing new tasks to be created without existing session data.
D.The Application Load Balancer is not configured with sticky sessions.
AnswerA

Fargate tasks are ephemeral; replacement causes loss of local session data.

Why this answer

ECS tasks using Fargate are ephemeral; when the service scheduler replaces tasks during deployments or due to health check failures, any session data stored in the local file system is lost, causing users to be logged out. Option B is incorrect because security group misconfiguration would prevent traffic entirely, not cause intermittent session loss. Option C is incorrect because scaling out creates additional tasks but does not by itself cause existing tasks to lose their local data; the issue is replacement, not scaling.

Option D is incorrect because sticky sessions only route a user to the same target, but if the target container is replaced, the local session data is still lost regardless of stickiness.

Full explanation →
1224
MCQeasy

A company wants to decouple a microservices architecture where one service (producer) sends events to another service (consumer). The producer can generate bursts of events, and the consumer processes them in batches. The solution must be serverless and handle potential consumer failures without losing events. Which AWS service should be used as the message broker?

A.Amazon SNS
B.Amazon Kinesis Data Streams
C.Amazon EventBridge
D.Amazon SQS
AnswerD

SQS provides a durable, serverless queue that decouples producers and consumers, supports batch processing, and can retain messages on failure.

Why this answer

Amazon SQS is a serverless message queue that can buffer bursts and retain messages until the consumer processes them, with dead-letter queues for failures. Option A is wrong because Amazon SNS pushes messages to subscribers and does not support polling or batch processing. Option B is wrong because Kinesis Data Streams is for real-time streaming, not simple decoupling with batch processing.

Option C is wrong because EventBridge is for event routing, not a message queue.

Full explanation →
1225
MCQhard

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

A.Increase the number of tasks (desired count) to distribute the load.
B.Increase the vCPU to 2 while keeping 2 GB memory.
C.Increase both memory and vCPU to 4 GB and 2 vCPUs.
D.Increase the memory to 4 GB while keeping 1 vCPU.
AnswerC

Balanced increase addresses both CPU and memory constraints.

Why this answer

Increasing both vCPU and memory improves performance for CPU-bound tasks and prevents memory contention. Option A is wrong because increasing the number of tasks (horizontal scaling) does not reduce latency for a single request if the task itself is underpowered; it distributes load but does not address high CPU on each task. Option B is wrong because increasing only vCPU might alleviate CPU pressure but could still be limited by memory if the application is also memory-intensive; however, increasing both ensures no bottleneck.

Option D is wrong because increasing memory alone does not address the high CPU utilization.

Full explanation →
1226
Multi-Selectmedium

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

Select 2 answers
A.Set Lambda reserved concurrency to 5 for each function.
B.Configure provisioned concurrency for all Lambda functions.
C.Enable API Gateway caching with a TTL of 60 seconds.
D.Increase the Lambda function timeout to 30 seconds.
E.Enable DynamoDB auto scaling for the table.
AnswersC, E

Caching reduces the number of requests reaching Lambda and DynamoDB, improving latency and reducing load.

Why this answer

Enabling API Gateway caching reduces load on Lambda and DynamoDB for repeated requests, improving latency and reducing errors. Option E: Enabling DynamoDB auto scaling adjusts capacity based on traffic patterns, reducing throttling-related 5xx errors. Option A (Lambda reserved concurrency) limits concurrency and could worsen throttling.

Option B (provisioned concurrency) helps with cold starts but does not address DynamoDB throttling. Option D (increasing Lambda timeout) may mask underlying issues without resolving root causes.

Full explanation →
1227
MCQeasy

A company is planning a hybrid cloud migration and needs to establish a dedicated network connection between its on-premises data center and AWS with consistent low latency. Which AWS service should be used?

A.AWS Direct Connect
B.AWS Client VPN
C.AWS Transit Gateway
D.AWS Site-to-Site VPN
AnswerA

Dedicated, low-latency connection.

Why this answer

AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering consistent low latency. Option A is correct for this reason. Option B (AWS Client VPN) is incorrect because it is designed for individual remote clients, not a dedicated connection.

Option C (AWS Transit Gateway) is incorrect as it is a hub for connecting networks, not a direct connection method. Option D (AWS Site-to-Site VPN) is incorrect because it uses the public internet and does not provide dedicated bandwidth or consistent low latency.

Full explanation →
1228
Multi-Selecthard

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Select 3 answers
A.Design each microservice with its own database.
B.Use a single shared database with separate schemas for each service.
C.Use AWS Database Migration Service (DMS) for ongoing replication.
D.Implement the Strangler Fig pattern to gradually migrate functionality.
E.Deploy all microservices on a single large EC2 instance.
AnswersA, C, D

Database per service is a microservices best practice.

Why this answer

Designing each microservice with its own database enforces the database-per-service pattern, which is essential for loose coupling and independent deployability. This approach prevents tight coupling at the data layer, allowing each microservice to choose the most appropriate database technology and schema without impacting other services. It directly supports the migration goal of breaking the monolithic application into autonomous components.

Exam trap

The trap here is that candidates often think a shared database with separate schemas is sufficient for microservices isolation, but it still creates tight coupling at the schema and transaction level, violating the database-per-service principle required for true decoupling.

Full explanation →
1229
MCQmedium

A company is designing a serverless application using AWS Lambda and Amazon API Gateway. The application must handle sudden spikes in traffic and ensure that no requests are lost. Which of the following design choices will BEST meet these requirements?

A.Use Lambda provisioned concurrency to pre-warm the function and reduce cold starts.
B.Configure API Gateway with a usage plan and throttling, and set Lambda reserved concurrency to limit the function's maximum capacity.
C.Use AWS Step Functions to orchestrate the Lambda invocations and implement retry logic.
D.Use Amazon SQS to buffer requests and have Lambda poll the queue at a fixed rate.
AnswerB

Usage plans and throttling control the request rate, while reserved concurrency ensures the Lambda function has dedicated capacity to handle the allowed traffic without being throttled by other functions.

Why this answer

Configuring API Gateway with usage plans and throttling prevents overwhelming the backend, while Lambda reserved concurrency ensures a minimum capacity for the function. Option A is wrong because Lambda provisioned concurrency adds cost and is for reducing cold starts, not for handling spikes without loss. Option C is wrong because Step Functions add orchestration overhead and complexity, and while they can implement retry logic, they do not directly prevent request loss during sudden traffic spikes.

Option D is wrong because SQS buffers requests but does not prevent loss if the Lambda function fails to scale and process messages fast enough; it relies on the Lambda scaling and may still result in throttling if the queue grows too large.

Full explanation →
1230
MCQmedium

A company is migrating a .NET application from Windows Server to AWS. The application uses Microsoft SQL Server. The company wants to reduce licensing costs and minimize operational overhead. Which migration strategy should be recommended?

A.Replatform to Amazon RDS for SQL Server
B.Refactor the application to .NET Core on Amazon Linux
C.Replatform to Amazon RDS for PostgreSQL
D.Rehost to Amazon EC2 with SQL Server on Windows
AnswerC

PostgreSQL is open-source, eliminating SQL Server licensing costs, and RDS reduces operational overhead.

Why this answer

(Replatform to Amazon RDS for PostgreSQL) is the best choice because it replaces SQL Server with PostgreSQL, which is open-source, thus eliminating SQL Server licensing costs. RDS also reduces operational overhead by managing the database. Option A (Replatform to Amazon RDS for SQL Server) reduces overhead but still incurs SQL Server licensing costs.

Option B (Refactor to .NET Core on Amazon Linux) would require significant application changes and does not directly address database licensing. Option D (Rehost to Amazon EC2 with SQL Server on Windows) maintains high licensing costs and operational overhead.

Full explanation →
1231
MCQmedium

A company is migrating an on-premises application to AWS. The application requires persistent shared storage that can be accessed by multiple EC2 instances simultaneously with strong consistency. Which AWS storage solution should the company use?

A.Amazon S3 with S3 File Gateway.
B.Amazon S3 Glacier Deep Archive.
C.Amazon EBS with Multi-Attach enabled.
D.Amazon EFS
AnswerD

Amazon EFS is a fully managed NFS file system that can be mounted by many EC2 instances with strong consistency, making it the correct choice.

Why this answer

Amazon EFS is a fully managed NFS file system that can be mounted by multiple EC2 instances and provides strong consistency. Option A is incorrect because Amazon S3 with S3 File Gateway provides file access to S3 but S3 is eventually consistent for overwrites, not strongly consistent. Option B is incorrect because Amazon S3 Glacier Deep Archive is designed for long-term archival storage with retrieval times of hours, not for active shared storage.

Option C is incorrect because Amazon EBS with Multi-Attach enabled allows a single EBS volume to be attached to multiple instances, but it is block storage and requires a cluster-aware file system; it is not a fully managed shared file system.

Full explanation →
1232
Multi-Selecthard

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team observes that some services are experiencing high latency during peak hours. The team wants to identify the root cause. Which THREE approaches should the team use? (Choose THREE.)

Select 3 answers
A.Use AWS X-Ray to trace requests through the microservices
B.Enable AWS CloudTrail to log API calls
C.Enable VPC Flow Logs to analyze network traffic
D.Use Amazon CloudWatch ServiceLens to correlate metrics, logs, and traces
E.Enable Container Insights for Amazon ECS
AnswersA, D, E

Identifies bottlenecks in the application flow.

Why this answer

(AWS X-Ray) traces requests through microservices to pinpoint latency sources. Option D (Amazon CloudWatch ServiceLens) correlates metrics, logs, and traces for comprehensive analysis. Option E (Container Insights for Amazon ECS) provides resource metrics (e.g., CPU, memory, network) to identify bottlenecks.

Option B (AWS CloudTrail) logs API calls, not application performance. Option C (VPC Flow Logs) analyzes network traffic, not application-level latency.

Full explanation →
1233
MCQmedium

A multinational corporation is deploying a multi-account AWS environment using AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with a specific AWS KMS key managed by the security account. Which solution should the company implement to enforce this policy across the organization?

A.Create IAM policies in each account to enforce encryption
B.Attach a service control policy (SCP) to the root that denies S3 actions unless encryption conditions are met
C.Use AWS Config rules with auto-remediation in each account
D.Deploy a CloudFormation StackSet that creates S3 buckets with encryption
AnswerB

SCPs can centrally deny operations that do not meet encryption requirements across all accounts in the organization.

Why this answer

A service control policy (SCP) attached to the root of the AWS Organizations hierarchy can deny S3 PutObject or CreateBucket actions unless the request includes the specific KMS key ID (via the s3:x-amz-server-side-encryption-aws-kms-key-id condition key). This enforces encryption centrally across all accounts, as SCPs are inherited by all member accounts and cannot be overridden by IAM policies within those accounts.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option C) thinking they provide preventive enforcement, but Config rules are detective and reactive, not preventive, whereas SCPs proactively block non-compliant API calls before the resource is created.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be modified or bypassed by account administrators, and they do not provide centralized enforcement across the organization. Option C is wrong because AWS Config rules with auto-remediation are reactive (detect and fix non-compliant resources after creation) and do not prevent the initial creation of unencrypted buckets, plus they require per-account setup. Option D is wrong because a CloudFormation StackSet only creates buckets with encryption at deployment time but does not prevent users from creating unencrypted buckets outside of the StackSet, nor does it enforce encryption on existing or future buckets.

Full explanation →
1234
MCQeasy

A company is using Amazon CloudFront to deliver content to users worldwide. The origin is an S3 bucket. Users in some regions experience high latency. What is the most effective way to reduce latency?

A.Add more CloudFront edge locations in the affected regions.
B.Enable CloudFront's SSL/TLS certificate using SNI only.
C.Use an origin shield to reduce the number of requests to the S3 bucket.
D.Enable S3 Transfer Acceleration on the bucket.
AnswerC

Origin shield increases cache hit ratio and reduces origin load.

Why this answer

Using an origin shield reduces the number of requests directly to the S3 bucket by serving cached content from a central location, which reduces latency for users. Option A is wrong because CloudFront automatically uses a global network of edge locations; you cannot manually add more. Option B is wrong because SSL/TLS certificates do not affect latency.

Option D is wrong because S3 Transfer Acceleration improves upload speeds, not download speeds to end users.

Full explanation →
1235
MCQeasy

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

A.Use CloudWatch cross-account dashboards with a monitoring account.
B.Use AWS Config aggregator to view resources.
C.Use Amazon QuickSight with data sources from each account.
D.Use AWS CloudFormation StackSets to deploy dashboards in each account.
AnswerA

Native cross-account dashboard feature.

Why this answer

CloudWatch cross-account dashboards allow you to create a single dashboard in a central monitoring account that displays metrics from multiple source accounts. This is the native AWS solution for centralized observability, requiring no additional data movement or custom code. The monitoring account uses the CloudWatch cross-account functionality to query metrics across accounts via IAM roles and the CloudWatch API.

Exam trap

The trap here is that candidates confuse AWS Config aggregator (which aggregates configuration data) with CloudWatch cross-account dashboards (which aggregate metric data), or assume CloudFormation StackSets provide a central view when they only replicate resources per account.

How to eliminate wrong answers

Option B is wrong because AWS Config aggregator is designed to aggregate resource configuration and compliance data, not CloudWatch metrics or dashboards; it cannot display time-series metric graphs. Option C is wrong because Amazon QuickSight is a business intelligence service for interactive dashboards and analytics, not a native CloudWatch dashboard viewer; it would require custom data pipelines to extract CloudWatch metrics into SPICE or S3, adding unnecessary complexity. Option D is wrong because AWS CloudFormation StackSets can deploy dashboard definitions across accounts, but each dashboard remains isolated in its own account; there is no central view or cross-account query capability, defeating the purpose of centralized management.

Full explanation →
1236
MCQmedium

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

A.Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.
B.Place the Lambda function in a VPC with 1,024 MB memory for faster processing.
C.Set reserved concurrency to 1,000 and function memory to 256 MB.
D.Set function memory to 128 MB and leave concurrency at the account default of 1,000.
AnswerD

128 MB is sufficient for small files; default concurrency handles bursts.

Why this answer

The default account-level concurrency limit is 1,000 concurrent executions, which meets the burst requirement without additional cost. With files under 1 MB and a 10-second timeout, 128 MB memory is sufficient for lightweight processing, and provisioned or reserved concurrency would incur unnecessary charges since the workload is sporadic and does not require pre-warmed instances.

Exam trap

The trap here is that candidates often assume reserved or provisioned concurrency is required for high concurrency, but the default account limit already supports 1,000 concurrent executions, and paying extra for guaranteed capacity is wasteful for a sporadic burst workload.

How to eliminate wrong answers

Option A is wrong because provisioned concurrency incurs costs even when not in use, and for a burst of 1,000 concurrent invocations, it would be overkill and expensive for sporadic workloads. Option B is wrong because placing the Lambda function in a VPC adds complexity and potential cold-start latency, and 1,024 MB memory is excessive for sub-1 MB files, increasing cost without performance benefit. Option C is wrong because reserved concurrency guarantees capacity but does not reduce cost; it can actually lead to throttling of other functions and is unnecessary when the default concurrency limit already supports 1,000 concurrent executions.

Full explanation →
1237
MCQhard

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

A.Use AWS CloudFormation resource import to bring the existing bucket into the stack.
B.Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.
C.Use a custom resource to check if the bucket exists before creation.
D.Manually delete the S3 bucket before each stack update.
AnswerA

AWS CloudFormation resource import allows you to bring existing resources under the management of a CloudFormation stack. Importing the existing S3 bucket means CloudFormation recognizes it and will not try to create it again during future updates, thus avoiding the 'resource already exists' error.

Why this answer

The stack update failed because the S3 bucket already existed, likely due to it being removed from the template and then added back. By using AWS CloudFormation resource import, you can bring the existing bucket into the stack's management, preventing CloudFormation from attempting to create it again. This resolves the immediate error and allows future updates without conflict.

DeletionPolicy Retain only prevents deletion, not creation conflicts.

Full explanation →
1238
MCQhard

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

A.Use AWS Lambda with Provisioned Concurrency for Service B and keep Service C as a Fargate service.
B.Use a step scaling policy for Service B based on CPU utilization and keep Service C as is.
C.Configure Service B with a target tracking scaling policy based on the SQS queue backlog and convert Service C to an AWS Lambda function triggered by DynamoDB Streams.
D.Increase the number of ECS tasks for Service B manually and use a scheduled scaling policy for Service C.
AnswerC

Target tracking scaling based on SQS backlog scales Service B appropriately; Lambda for Service C eliminates idle cost.

Why this answer

It addresses both scaling and cost issues: Service B's scaling is improved by using a target tracking scaling policy based on the SQS queue backlog (ApproximateNumberOfMessagesVisible), which directly correlates to the work demand, ensuring faster and more precise scaling. Converting Service C to a Lambda function triggered by DynamoDB Streams eliminates idle compute costs from a constantly running Fargate service, as Lambda only runs when new data appears in DynamoDB, reducing costs significantly.

Exam trap

The trap here is that candidates often choose CPU-based scaling (Option B) because it is familiar, but they fail to recognize that queue depth is a more direct and responsive metric for scaling message-processing services, and they overlook the cost savings of replacing an idle Fargate service with a Lambda function triggered by DynamoDB Streams.

How to eliminate wrong answers

Option A is wrong because using Lambda with Provisioned Concurrency for Service B would incur costs for pre-warmed instances even when idle, and it does not address the scaling issue with the SQS queue backlog; moreover, Lambda is not ideal for long-running polling tasks. Option B is wrong because a step scaling policy based on CPU utilization is an indirect metric that does not reflect the actual work queue depth, leading to delayed scaling and continued queue growth. Option D is wrong because manually increasing tasks for Service B is not automated or cost-effective for variable traffic, and using a scheduled scaling policy for Service C does not address its idle time—it would still run tasks when not needed, wasting resources.

Full explanation →
1239
MCQmedium

An IAM policy is attached to a role used by AWS DMS for a database migration from an RDS MySQL instance to an S3 bucket. The migration fails with an access denied error when writing to S3. Which missing permission is the most likely cause?

A.kms:Decrypt
B.rds:DescribeDBInstances
C.dms:StartReplicationTask
D.s3:PutObject
AnswerD

DMS needs s3:PutObject to write data to the S3 bucket.

Why this answer

The policy allows s3:GetObject and s3:ListBucket, but not s3:PutObject, which is required for writing data to S3. The error is about writing, not reading. dms:StartReplicationTask is already allowed. rds:DescribeDBInstances is for reading RDS metadata. kms:Decrypt is only needed for encrypted buckets.

Full explanation →
1240
MCQhard

A company has a legacy monolithic application running on a single EC2 instance. The application stores customer data in an attached EBS volume. The company wants to modernize the application to improve scalability and availability. Which approach should a solutions architect recommend?

A.Use a larger EC2 instance with enhanced networking.
B.Configure multiple EC2 instances to share the same EBS volume using Multi-Attach.
C.Replace the EBS volume with an Aurora RDS database.
D.Refactor the application into microservices running on Amazon ECS with data stored in Amazon S3.
AnswerD

Containers and S3 provide scalability, availability, and stateless design.

Why this answer

Migrating to a containerized, stateless application decouples storage and allows scaling. Option A is wrong because a larger instance still has a single point of failure. Option B is wrong because Multi-Attach EBS volumes have limited support and multiple instances writing to the same volume can cause data corruption.

Option C is wrong because RDS is for databases, not for application data stored in files.

Full explanation →
1241
Multi-Selecteasy

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

Select 2 answers
A.Configure the cache behavior to forward all query strings but cache based on a whitelist.
B.Increase the minimum TTL for objects.
C.Configure custom error responses to serve cached content on errors.
D.Decrease the default TTL for objects.
E.Enable automatic compression for compressible objects.
AnswersA, B

This prevents multiple cache entries for different query string orders.

Why this answer

Forwarding all query strings but caching based on a whitelist prevents cache fragmentation from unnecessary query parameters, improving the cache hit ratio. Option B is correct because increasing the minimum TTL ensures objects remain in the cache for a longer duration, increasing the likelihood of cache hits. Option C is incorrect because custom error responses serve alternative content on errors but do not improve the cache hit ratio.

Option D is incorrect because decreasing the default TTL reduces cache duration, leading to more misses. Option E is incorrect because compression improves transfer speed and reduces bandwidth, not the cache hit ratio.

Exam trap

A common trap is thinking that serving stale or cached content on errors improves cache hit ratio, but it only improves availability. Also, shortening TTL reduces cache hits, not improves.

Full explanation →
1242
MCQeasy

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server and uses a local MySQL database. To reduce migration risk, the company wants to minimize application code changes. Which AWS service should the company use to migrate the database with minimal application modification?

A.Amazon RDS for MySQL
B.AWS Database Migration Service (AWS DMS)
C.AWS Snowball
D.Amazon S3
AnswerB

AWS DMS can migrate databases with minimal downtime and supports homogeneous migrations, reducing code changes.

Why this answer

AWS Database Migration Service (AWS DMS) is the correct choice because it supports homogeneous migrations of MySQL databases with minimal application changes. DMS can migrate data from an on-premises MySQL database to Amazon RDS for MySQL or Amazon Aurora while keeping the application largely unchanged. Option A (Amazon RDS for MySQL) is not a migration service; it is the target database service that requires manual import or use of DMS.

Option C (AWS Snowball) is designed for large-scale offline data transfers, not for live database migrations. Option D (Amazon S3) is an object storage service and cannot be used to migrate a relational database directly.

Full explanation →
1243
MCQmedium

A company is migrating a legacy on-premises application to AWS. The application uses a shared file system for user home directories. Which AWS service should the company use to minimize changes to the application while providing scalable, highly available file storage?

A.Amazon FSx for Lustre
B.Amazon EBS
C.Amazon S3
D.Amazon EFS
AnswerD

Amazon EFS provides a scalable NFS file system that can be shared across EC2 instances, minimizing changes.

Why this answer

(Amazon EFS) is correct because it provides a scalable, fully managed NFS file system that can be mounted by multiple EC2 instances, minimizing application changes. Option A (FSx for Lustre) is for high-performance computing, not general file sharing. Option B (EBS) is block storage attached to a single instance.

Option C (S3) is object storage, not a file system.

Full explanation →
1244
Multi-Selecthard

A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which TWO statements should be included in the IAM policy? (Choose two.)

Select 2 answers
A.{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}
B.{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}
C.{"Effect": "Allow", "Action": ["logs:CreateLogStream", "logs:PutLogEvents"], "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:my-log-group:*"}
D.{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}
E.{"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::my-bucket/*"}
AnswersA, C

Correct: Grants s3:GetObject on the bucket objects, allowing the EC2 instance to read data from S3 as required.

Why this answer

The correct answers are A and C. Option A grants s3:GetObject on the S3 bucket objects, allowing the EC2 instance to read data from the bucket. Option C grants the necessary permissions to create log streams and put log events to a specific CloudWatch Logs log group, enabling logging.

These two statements adhere to least-privilege by scoping to the exact actions and resources needed. Option E (s3:PutObject) is not required because the stem only specifies reading from S3; including it would violate the least-privilege principle. Options B and D are incorrect because B uses a wildcard action (s3:*) and D uses a wildcard resource, both of which are too broad and not scoped.

Exam trap

The trap is that candidates often include unnecessary permissions (like s3:PutObject) beyond what the stem explicitly requires, failing the least-privilege requirement. Always scope permissions to only the actions and resources stated.

Full explanation →
1245
MCQmedium

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

A.Amazon Redshift Spectrum
B.Amazon EMR
C.Amazon Athena
D.Amazon QuickSight
AnswerC

Athena is serverless and can query S3 data with standard SQL, optimized by partitioning and columnar formats.

Why this answer

Amazon Athena is a serverless interactive query service that uses standard SQL to analyze data directly in Amazon S3. It is optimized for querying large datasets with a pay-per-query model, and it automatically minimizes data scanned by leveraging features like columnar data formats (Parquet, ORC), partitioning, and compression to reduce the amount of data read per query.

Exam trap

The trap here is that candidates often confuse Amazon Redshift Spectrum with Athena because both query S3 data, but Redshift Spectrum requires a running Redshift cluster and is not serverless, while Athena is fully serverless and designed specifically for minimizing data scanned in a data lake scenario.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift Spectrum is an extension of Amazon Redshift that allows querying data in S3, but it requires an active Redshift cluster and is designed for hybrid queries that combine local and external data, not for a standalone data lake query service with minimal data scanned. Option B is wrong because Amazon EMR is a managed big data platform that supports frameworks like Apache Spark and Hive, but it requires provisioning and managing clusters, and its primary focus is not on minimizing data scanned for ad-hoc SQL queries; it is more suited for complex ETL and processing jobs. Option D is wrong because Amazon QuickSight is a business intelligence (BI) and visualization service, not a SQL query engine for scanning large datasets; it relies on underlying data sources like Athena or Redshift for query execution.

Full explanation →
1246
MCQmedium

A company is migrating a legacy on-premises application to AWS. The application requires a relational database with Oracle compatibility and the ability to run read replicas across multiple Availability Zones. Which AWS service should the company use to minimize migration effort?

A.Amazon RDS for MySQL
B.Amazon EC2 with self-managed Oracle
C.Amazon DynamoDB
D.Amazon RDS for Oracle
AnswerD

RDS for Oracle offers managed Oracle database with read replicas across AZs.

Why this answer

Amazon RDS for Oracle provides a managed Oracle database with Oracle compatibility and supports read replicas across multiple Availability Zones, minimizing migration effort. Option A is wrong because Amazon RDS for MySQL does not offer Oracle compatibility. Option B is wrong because Amazon EC2 with self-managed Oracle requires more operational overhead.

Option C is wrong because Amazon DynamoDB is a NoSQL database, not relational.

Full explanation →
1247
MCQhard

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

A.No, because t3.large instances only support x86_64 architecture.
B.Yes, because t3.large supports both architectures.
C.No, because t3.large is not a current generation instance type.
D.Yes, but only if they use a custom AMI that supports both architectures.
AnswerA

Correct. t3.large instances only support x86_64 architecture, not arm64. Therefore, they cannot meet the requirement of supporting both architectures.

Why this answer

T3.large instances only support the x86_64 architecture. They do not support arm64. Therefore, the company cannot meet the requirement of supporting both x86_64 and arm64 architectures with t3.large instances.

Options B and D are incorrect because t3.large does not support arm64, and a custom AMI cannot add architecture support beyond what the instance type offers. Option C is incorrect because t3.large is a current generation instance type, but that is not relevant to the architecture support limitation.

Full explanation →
1248
MCQhard

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?

A.The security group for the EC2 instances does not allow outbound traffic to the RDS instance.
B.The RDS Multi-AZ failover took longer than expected, exceeding the RTO.
C.The RDS endpoint DNS record did not update to point to the new primary.
D.The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.
AnswerD

The application is likely using a hardcoded IP address or an endpoint pointing to the old primary RDS instance instead of the RDS DNS name, which fails after failover. This is the most likely cause. Option D is correct.

Why this answer

The RDS Multi-AZ failover promotes the standby to primary, changing the underlying IP address. If the application uses a hardcoded IP address or an endpoint that points to the old primary, it will fail to connect after failover. The correct approach is to use the RDS DNS name (CNAME) which automatically resolves to the current primary.

Option A is incorrect because the stem states the security groups are correctly configured. Option B is incorrect because the failover completed in about 2 minutes, which is within normal Multi-AZ failover time (1-2 minutes). Option C is incorrect because the RDS endpoint DNS record updates quickly (within seconds) after a failover.

Full explanation →
1249
Drag & Dropmedium

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First identify failure, wait for failover, verify promotion, update endpoints, then investigate.

Full explanation →
1250
Multi-Selecthard

A company runs a stateful web application on EC2 instances with EBS volumes. They want to improve resilience by distributing the workload across multiple Availability Zones. Which THREE steps should they take?

Select 3 answers
A.Use Amazon EFS for shared storage across AZs.
B.Attach the same EBS volume to instances in different AZs.
C.Place EC2 instances in an Auto Scaling group spanning multiple AZs.
D.Use an Application Load Balancer with targets in multiple AZs.
E.Configure EBS Read Replicas in another AZ.
AnswersA, C, D

EFS is a shared file system accessible from multiple AZs.

Why this answer

Correct answers are A, C, and D. Option A ensures data is available in multiple AZs. Option C distributes instances for high availability.

Option D handles traffic distribution and health checks. Option B is wrong because EBS volumes cannot be attached cross-AZ. Option E is wrong because Read Replicas are for RDS, not EBS.

Full explanation →
1251
Multi-Selecthard

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Select 2 answers
A.Use DynamoDB Streams to trigger the Lambda function for each record.
B.Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.
C.Configure the Kinesis Data Stream with 10 shards.
D.Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.
E.Configure the Lambda function to process records from each shard sequentially by setting the batch size to 1.
AnswersC, E

10 shards provide sufficient throughput and each shard maintains record order.

Why this answer

With a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Exam trap

The trap here is that candidates often assume Step Functions can enforce exactly-once delivery, but Step Functions is a state machine orchestrator and does not provide data-level deduplication; exactly-once processing must be implemented at the application layer with idempotent consumers.

Full explanation →
1252
MCQhard

A company is migrating a large-scale data analytics workload from on-premises to AWS. The workload uses Apache Spark to process terabytes of data daily. The company wants to use Amazon EMR for the migration. The current on-premises cluster has 20 nodes, each with 64 vCPUs and 256 GB of RAM. The data is stored in HDFS on the cluster. The company wants to minimize costs while maintaining performance. The data sources are in Amazon S3 and on-premises. The company has set up a dedicated AWS Direct Connect connection. Which EMR configuration should the company use?

A.Use EMR with EC2 instances of similar size (e.g., r5.8xlarge) and store data in Amazon S3 using EMRFS.
B.Use EMR with Graviton-based instances and store intermediate data in HDFS on EBS volumes.
C.Use EMR with a mix of On-Demand and Spot Instances, and use S3 for all data storage.
D.Use AWS Glue to run the Spark jobs with the same resource configuration.
AnswerA

Correct. Using EMR with r5.8xlarge instances closely matches the on-premises resources (64 vCPUs, 256 GB RAM per node) and using S3 with EMRFS eliminates HDFS overhead, reducing costs and management effort while maintaining performance via Direct Connect.

Why this answer

It directly maps the on-premises cluster capacity to equivalent EC2 instances (r5.8xlarge provides 32 vCPUs and 256 GB RAM, so two per node would match the 64 vCPUs and 256 GB RAM). Storing data in S3 via EMRFS eliminates HDFS management and leverages S3 durability and scalability. This configuration minimizes costs by avoiding over-provisioning and using S3 for cost-effective storage, while maintaining performance through Direct Connect for data transfer.

Using EMR with similar instance sizes ensures the Spark jobs run efficiently without reconfiguration. Other options introduce unnecessary complexity or higher costs: Option B uses Graviton-based instances which may require code changes, and storing intermediate data on EBS volumes incurs additional costs and management overhead. Option C mixes On-Demand and Spot Instances, which can reduce costs but still requires cluster management and does not align with the goal of minimizing costs while maintaining performance as effectively as option A.

Option D uses AWS Glue, which is a fully managed service but may not provide the same level of control or performance for large-scale workloads; it may also be more expensive for sustained high-volume processing compared to EMR with reserved capacity.

Full explanation →
1253
MCQmedium

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

A.Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.
B.Create an SCP that denies creation of resources unless they comply with the baseline.
C.Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.
D.Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.
AnswerC

Control Tower automates account provisioning with pre-defined guardrails and blueprints.

Why this answer

AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Exam trap

The trap here is that candidates often confuse SCPs with automation tools, thinking they can enforce resource creation or trigger deployments, when in reality SCPs only restrict permissions and cannot provision resources or invoke AWS services.

How to eliminate wrong answers

Option A is wrong because SCPs cannot trigger AWS CloudFormation StackSets; SCPs are permission policies that control which AWS API actions are allowed, not event-driven automation triggers. Option B is wrong because an SCP that denies creation of resources unless they comply with a baseline would be impractical to enforce at the point of account creation and does not proactively create the required VPC and Config rules. Option D is wrong because AWS Config conformance packs are deployed to existing accounts to evaluate compliance, not to provision resources like a VPC, and SCPs cannot deploy conformance packs.

Full explanation →
1254
MCQhard

A company is migrating a 10 TB Oracle database to Amazon RDS for Oracle. The migration must have minimal downtime. The source database is running on-premises with limited bandwidth (50 Mbps). Which strategy should be used?

A.Use AWS Snowball to transfer a full backup, then manually apply transaction logs.
B.Set up a VPN connection and use Oracle GoldenGate for replication.
C.Use AWS Database Migration Service (DMS) with a full load and ongoing change data capture (CDC).
D.Export the database to flat files, upload to Amazon S3, and import into RDS.
AnswerC

DMS with CDC allows minimal downtime by replicating changes after initial load.

Why this answer

AWS Database Migration Service (DMS) with a full load and ongoing change data capture (CDC) minimizes downtime by continuously replicating changes from the source Oracle database to Amazon RDS for Oracle during the full load. After the full load completes, changes are applied to keep the target in sync, allowing a very brief cutover window. Over a 50 Mbps link, the initial 10 TB full load may take days, but CDC ensures minimal downtime at cutover.

Option A (Snowball) is an offline method that requires exporting, shipping, and importing the database, which introduces significant downtime. Option B (Oracle GoldenGate) is a valid replication tool but adds complexity and cost; DMS is a managed service better integrated with AWS. Option D (export to flat files and import) requires taking the database offline for the export and import, causing substantial downtime.

Full explanation →
1255
MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. They want to update a stack but need to ensure that a specific resource is not accidentally replaced. Which CloudFormation attribute should they use?

A.DeletionPolicy
B.UpdateReplacePolicy
C.CreationPolicy
D.UpdatePolicy
AnswerB

Correct. UpdateReplacePolicy with 'Retain' prevents replacement by keeping the old resource during an update.

Why this answer

UpdateReplacePolicy. This attribute allows you to specify how CloudFormation handles resource updates that require replacement. You can set it to 'Retain' to keep the old resource and prevent replacement during a stack update.

DeletionPolicy (option A) only controls what happens when a resource is deleted, not during updates that require replacement. CreationPolicy and UpdatePolicy do not address replacement prevention.

Exam trap

Candidates often confuse DeletionPolicy with UpdateReplacePolicy. DeletionPolicy applies when a resource is removed from the template or the stack is deleted, not when an update forces replacement.

Full explanation →
1256
MCQmedium

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

A.AWS PrivateLink with VPC endpoint services.
B.Amazon Route 53 private hosted zones with DNS records for each service.
C.AWS Cloud Map with namespaces and service instances.
D.Elastic Load Balancing with internal load balancers for each service.
AnswerC

Cloud Map is designed for service discovery in microservices.

Why this answer

AWS Cloud Map is the correct choice because it is a cloud resource discovery service specifically designed for microservices architectures. It allows you to define custom namespaces (public, private DNS, or API-based) and register service instances with health checks. Services running on ECS with Fargate can then discover each other via DNS queries or API calls, enabling dynamic and secure communication without managing static IPs or load balancers.

Exam trap

The trap here is that candidates often confuse Route 53 private hosted zones (which only provide static DNS resolution) with AWS Cloud Map (which adds dynamic registration, health checks, and service instance management), leading them to choose Option B as a simpler but incorrect solution.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink with VPC endpoint services is used to expose a service privately within a VPC or across accounts, not for service discovery via DNS names between microservices. Option B is wrong because Amazon Route 53 private hosted zones only provide DNS resolution for static records; they do not automatically register dynamic service instances or perform health checks, requiring manual updates for scaling or failures. Option D is wrong because Elastic Load Balancing with internal load balancers introduces a single point of load balancing and does not provide native DNS-based service discovery; it is designed for traffic distribution, not for services to find each other by name.

Full explanation →
1257
MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

A.AWS Step Functions
B.Amazon SNS
C.Amazon SQS
D.Amazon Kinesis
AnswerC

SQS provides a message queue for asynchronous decoupling.

Why this answer

Amazon SQS is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, allowing them to send, store, and receive messages without direct coupling. Services can poll or receive messages from the queue at their own pace, ensuring that the producer and consumer are decoupled and can operate independently, even if one is temporarily unavailable.

Exam trap

The trap here is that candidates often confuse Amazon SNS (pub/sub) with Amazon SQS (queue), but SNS pushes messages to subscribers and does not provide a buffer for asynchronous decoupling, whereas SQS allows services to pull messages at their own pace, which is the key requirement for decoupling.

How to eliminate wrong answers

Option A is wrong because AWS Step Functions is a serverless orchestration service that coordinates multiple AWS services into a workflow, but it does not inherently decouple services asynchronously; it tightly couples the execution flow and is not a message queue. Option B is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, which still requires subscribers to be active and does not provide a buffer for asynchronous decoupling like a queue does. Option D is wrong because Amazon Kinesis is designed for real-time streaming data ingestion and processing, not for simple asynchronous decoupling of microservices; it introduces complexity with shards and retention periods that are unnecessary for basic decoupling needs.

Full explanation →
1258
Multi-Selecthard

A company is migrating a large e-commerce platform to AWS using a lift-and-shift approach. The application consists of a web tier, application tier, and a MySQL database. After migration, users report intermittent slow page loads. The operations team notices high CPU utilization on the application tier instances. Which THREE steps should the team take to address the performance issues?

Select 3 answers
A.Implement Amazon CloudFront to cache static content and reduce load on the web tier.
B.Create an Amazon RDS read replica for the MySQL database and route read queries to it.
C.Replace the current application tier instances with larger instance types.
D.Move the MySQL database to Amazon RDS for MySQL and enable Multi-AZ deployment.
E.Configure an Auto Scaling group for the application tier to scale based on CPU utilization.
AnswersA, B, E

Reduces requests to the origin servers.

Why this answer

Implementing Amazon CloudFront to cache static content offloads requests from the web tier, reducing the number of dynamic requests that reach the application tier. This directly lowers CPU utilization on the application instances by minimizing the processing overhead for repeated static asset deliveries.

Exam trap

The trap here is that candidates often confuse database-level solutions (like Multi-AZ or read replicas) with application-tier CPU issues, or they default to vertical scaling (larger instances) instead of recognizing the need for horizontal scaling and content caching.

Full explanation →
1259
MCQmedium

A company runs a web application on a single EC2 instance. They want to improve availability and fault tolerance with minimal architectural changes. What should they do?

A.Attach multiple EBS volumes to the instance.
B.Use an Auto Scaling group with a minimum of two instances across two Availability Zones.
C.Create multiple subnets in the same Availability Zone.
D.Upgrade to a larger instance type.
AnswerB

Spreading instances across AZs provides high availability and fault tolerance.

Why this answer

Using an Auto Scaling group with a minimum of two instances across two Availability Zones provides high availability and fault tolerance. If one Availability Zone fails, the other zone continues to serve traffic. Option A is wrong because multiple EBS volumes do not protect against instance or AZ failure.

Option C is wrong because multiple subnets in the same Availability Zone still share the same failure domain. Option D is wrong because a larger instance type does not add redundancy.

Full explanation →
1260
Multi-Selectmedium

A company uses AWS Organizations with a large number of accounts. The security team needs to enforce that only approved AMIs from a central account can be used to launch EC2 instances in all accounts. Which combination of actions should be taken? (Choose TWO.)

Select 2 answers
A.Share the approved AMIs from the central account with all other accounts.
B.Use AWS CloudFormation Guard to validate templates before deployment.
C.Apply an SCP that denies ec2:RunInstances with a condition that the image owner is not the central account.
D.Use AWS Service Catalog to create a product for approved AMIs.
AnswersA, C

Necessary so that accounts can launch from those AMIs.

Why this answer

Sharing AMIs from a central account with all other accounts allows those accounts to launch EC2 instances using the approved AMIs. Option C is correct because applying a service control policy (SCP) that denies ec2:RunInstances with a condition that the image owner is not the central account enforces that only AMIs owned by the central account can be used, preventing the use of unapproved AMIs from other sources.

Exam trap

The trap here is that candidates often think AWS Service Catalog or CloudFormation Guard can enforce organization-wide AMI restrictions, but they lack the ability to block direct API calls across all accounts without an SCP.

Full explanation →
1261
Multi-Selecthard

A company is designing a multi-region disaster recovery solution for a critical application running on Amazon EC2. The application uses an Amazon Aurora MySQL database. The RTO is 15 minutes and RPO is 1 minute. Which THREE steps should the solutions architect take to meet these requirements?

Select 3 answers
A.Pre-provision EC2 instances in the DR region with the application code and configuration.
B.Use Route 53 health checks with failover routing policy to direct traffic to the DR region.
C.Configure a cross-region read replica in the DR region and promote it during failover.
D.Take frequent snapshots of the Aurora cluster and copy them to the DR region.
E.Use Amazon Aurora Global Database for replication to the DR region.
AnswersA, B, E

Ensures compute capacity is ready for failover.

Why this answer

Pre-provisioning EC2 instances in the DR region with the application code and configuration ensures that compute capacity is ready to serve traffic immediately upon failover. This eliminates the time needed to launch and configure instances, which is critical for meeting the 15-minute RTO. Without pre-provisioning, the time to spin up and configure instances would likely exceed the RTO.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have higher replication lag and slower promotion) with Aurora Global Database (which provides low-latency, fast failover), leading them to select Option C instead of Option E.

Full explanation →
1262
Multi-Selecteasy

A company wants to migrate a legacy .NET application to AWS. The application uses Windows authentication and requires a shared file system. Which TWO AWS services should the company use to modernize this application? (Choose two.)

Select 2 answers
A.Amazon FSx for Windows File Server
B.AWS Elastic Beanstalk
C.Amazon S3
D.Amazon EBS
E.AWS Lambda
AnswersA, B

Managed SMB file share.

Why this answer

Options A and B are correct. Amazon FSx for Windows File Server (A) provides a native Windows file system with SMB support, ideal for shared file storage in .NET applications that require Windows authentication. AWS Elastic Beanstalk (B) offers a managed environment for .NET applications, simplifying deployment and scaling.

Option C (Amazon S3) is object storage, not a shared file system. Option D (Amazon EBS) is block storage and cannot be shared across multiple instances. Option E (AWS Lambda) does not support .NET Framework natively and is not suitable for this use case.

Full explanation →
1263
MCQeasy

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

A.S3 buckets in each account with cross-region replication enabled to a central bucket.
B.Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.
C.Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.
D.Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.
AnswerC

This provides near real-time streaming and cross-account aggregation.

Why this answer

It uses CloudWatch Logs subscription filters to stream log data in near real-time to a Kinesis Data Stream in the central logging account, which then feeds into Kinesis Data Firehose for durable delivery to S3. This architecture is resilient to Regional failures because Kinesis Data Streams can be configured with cross-region replication or multi-region failover, and Firehose can buffer and retry writes to S3 across availability zones. It provides near real-time delivery (typically within 60 seconds) and centralizes logs without relying on per-account S3 replication or Lambda polling.

Exam trap

The trap here is that candidates often choose Option A (S3 cross-region replication) because it seems simple and resilient, but they overlook the requirement for near real-time delivery, which S3 replication cannot guarantee due to its eventual consistency model and potential for multi-minute delays.

How to eliminate wrong answers

Option A is wrong because S3 cross-region replication is asynchronous and can introduce significant delays (often minutes to hours), not near real-time delivery, and it requires managing per-account S3 buckets with replication rules that can fail silently. Option B is wrong because Lambda functions reading CloudWatch Logs would require polling or event-driven triggers that introduce latency and scalability bottlenecks, and Lambda has a maximum execution timeout of 15 minutes, making it unsuitable for sustained high-volume log streaming. Option D is wrong because Kinesis Data Firehose delivery streams in each account cannot directly send logs to a centralized S3 bucket in another account without a cross-account role or destination configuration, and Firehose alone lacks the streaming aggregation and cross-account subscription capabilities that CloudWatch Logs subscription filters provide.

Full explanation →
1264
Multi-Selecthard

A company is designing a new data lake on AWS. The data lake will store raw data from various sources in Amazon S3. The data will be processed using AWS Glue ETL jobs and queried using Amazon Athena. To optimize costs and performance, which three practices should the solutions architect implement?

Select 3 answers
A.Store data in JSON format for flexibility.
B.Compress data using Snappy or Gzip compression.
C.Use columnar storage formats such as Parquet or ORC.
D.Store data in many small files to improve parallel processing.
E.Partition the data by date and other high-cardinality columns.
AnswersB, C, E

Compression reduces storage and scan costs.

Why this answer

Compressing data with Snappy or Gzip reduces storage costs in Amazon S3 and decreases the amount of data scanned by Athena, which charges per TB scanned. Snappy offers faster decompression for ETL workloads, while Gzip provides higher compression ratios. Both are natively supported by AWS Glue and Athena, making them optimal for cost and performance.

Exam trap

The trap here is that candidates often choose JSON for its flexibility without realizing its severe cost and performance penalties in analytics workloads, or they mistakenly believe many small files improve parallelism, when in fact they cause S3 request throttling and increased Athena query overhead.

Full explanation →
1265
MCQhard

A company uses AWS Organizations with a single OU for all member accounts. The company wants to restrict the use of specific Amazon EC2 instance types across all member accounts. However, the management account should not be restricted. Which solution meets this requirement?

A.Use AWS CloudTrail to monitor and alert when restricted instance types are launched.
B.Attach an SCP that denies the restricted instance types to the OU.
C.Create an IAM policy in the management account that denies the restricted instance types, and attach it to all member account users.
D.Attach an SCP to the root of the organization and exclude the management account.
AnswerB

SCPs attached to the OU apply to all member accounts but not to the management account.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that denies specific EC2 instance types to the OU, you restrict all member accounts while the management account is not affected by SCPs. This meets the requirement without impacting the management account.

Exam trap

The trap here is that candidates often think SCPs apply to all accounts including the management account, but in reality, the management account is never affected by SCPs, so attaching an SCP to the OU correctly restricts only member accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail only provides auditing and alerting, not preventive enforcement; it cannot block the launch of restricted instance types. Option C is wrong because IAM policies attached in the management account do not propagate to member accounts; each member account has its own IAM namespace and would require separate policy attachments. Option D is wrong because SCPs attached to the root of the organization apply to all accounts, including the management account, unless explicitly excluded; however, SCPs cannot be applied to the management account at all, so excluding it is unnecessary and the statement is technically incorrect.

Full explanation →
1266
MCQmedium

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

A.Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL
B.Refactor the application into AWS Lambda functions using an API Gateway
C.Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern
D.Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL
AnswerC

App Runner allows running containerized applications with minimal configuration. The sidecar pattern enables adding microservices without altering the existing application code.

Why this answer

AWS App Runner allows you to run the existing monolithic application with minimal code changes by simply pointing it at a container image or source code, while new microservices can be added as separate App Runner services. The sidecar pattern enables you to attach auxiliary processes (e.g., logging, monitoring) without modifying the core application code, making this the most cost-effective and least disruptive approach for decoupling into microservices.

Exam trap

Candidates often assume that containerization (Option D) is necessary for decoupling into microservices. However, AWS App Runner allows running the existing monolithic application with minimal changes and adding new microservices as separate services, without needing to refactor the monolith first. Note that App Runner does not natively support the sidecar pattern (multiple containers per service), but the decoupling is achieved by deploying separate services.

How to eliminate wrong answers

Option A is wrong because AWS Elastic Beanstalk still runs the application as a monolith on a single EC2 instance or a small fleet, which does not decouple the application into microservices; it merely lifts and shifts the monolith with managed infrastructure. Option B is wrong because refactoring into AWS Lambda functions and API Gateway requires significant code changes to break the monolith into event-driven functions, which contradicts the requirement to minimize code changes. Option D is wrong because containerizing the application with Docker and running it on Amazon ECS with Fargate still treats the entire monolith as a single container; while it improves portability, it does not inherently decouple the application into microservices without additional refactoring, and the sidecar pattern is not natively supported in the same way as App Runner.

Full explanation →
1267
MCQhard

A financial services company is designing a highly available architecture for a critical application on AWS. The application runs on EC2 instances and uses an Oracle database. The database must be resilient to an Availability Zone failure and must have automated failover. Which database solution meets these requirements?

A.Use Amazon Aurora (MySQL-compatible) with Multi-AZ.
B.Use Amazon RDS for Oracle with a Read Replica in another AZ.
C.Deploy Oracle on EC2 in two Availability Zones and use asynchronous replication.
D.Use Amazon RDS for Oracle with Multi-AZ deployment.
AnswerD

RDS Multi-AZ provides automatic failover and synchronous standby.

Why this answer

Amazon RDS for Oracle with Multi-AZ deployment provides automatic failover to a standby instance in a different Availability Zone, meeting the requirements for high availability and automated failover. Option A is incorrect because Amazon Aurora (MySQL-compatible) is not Oracle-compatible, so it cannot replace an Oracle database. Option B is incorrect because a Read Replica in another AZ does not provide automated failover; it is used for read scaling and requires manual promotion.

Option C is incorrect because deploying Oracle on EC2 with asynchronous replication requires manual failover management and does not provide automated failover.

Full explanation →
1268
Multi-Selectmedium

A company is migrating a web application to AWS and wants to modernize it by using a microservices architecture. Which TWO AWS services should the company use to implement service discovery and API gateway functionality?

Select 2 answers
A.Amazon Route 53
B.AWS App Mesh
C.Amazon API Gateway
D.Elastic Load Balancing (ELB)
E.AWS Cloud Map
AnswersC, E

API Gateway provides API management and gateway functionality.

Why this answer

(Amazon API Gateway) provides API gateway functionality for managing, securing, and publishing APIs. Option E (AWS Cloud Map) provides service discovery for microservices. Option A (Route 53) is a DNS service, not specialized for service discovery or API gateway.

Option B (App Mesh) provides a service mesh for observability and traffic control, not API gateway. Option D (ELB) handles load balancing, not service discovery or API gateway.

Full explanation →
1269
MCQhard

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application writes transaction logs to an Amazon EFS file system. The company needs to ensure that the logs are encrypted at rest using a customer-managed AWS KMS key. Additionally, the logs must be retained for 7 years and should not be accessible after that period. Which solution meets the encryption and retention requirements?

A.Store logs directly in Amazon S3 with default encryption. Use an S3 Lifecycle policy to delete objects older than 7 years.
B.Enable encryption at rest on the EFS file system using a customer-managed KMS key. Use a Lambda function to copy logs to Amazon S3 and apply an S3 Lifecycle policy to expire objects after 7 years.
C.Use Amazon CloudWatch Logs to stream logs from the application and set a retention policy of 7 years. Enable encryption using a customer-managed KMS key.
D.Enable encryption at rest on the EFS file system using an AWS managed key. Use a cron job on the EC2 instances to delete logs older than 7 years.
AnswerB

EFS encryption with customer KMS key meets encryption requirement; S3 Lifecycle enforces retention.

Why this answer

EFS supports encryption at rest using a customer-managed KMS key, and by copying logs to S3 and applying a lifecycle policy with expiration after 7 years, both encryption and retention requirements are met. Option A is incorrect because storing logs directly in S3 with default encryption uses S3-managed keys, not a customer-managed KMS key. Option C is incorrect because CloudWatch Logs is for real-time monitoring and not designed for long-term archival with the specified encryption and retention requirements.

Option D is incorrect because enabling encryption on EFS with an AWS managed key does not meet the customer-managed KMS key requirement, and deleting logs via a cron job on EC2 instances is not reliable and may not ensure complete deletion after exactly 7 years.

Full explanation →
1270
MCQmedium

A company is migrating a stateful application that uses local storage on EC2. They want to modernize to a stateless architecture using Amazon EFS for shared storage. What is the best approach to migrate the existing data?

A.Use AWS Fsx for Lustre with S3 as data repository
B.Copy data from local storage to EFS using AWS DataSync during a maintenance window
C.Detach the EBS volume and attach it to the new EC2 instance
D.Create an EBS snapshot and restore it on the new instance
AnswerB

DataSync efficiently copies data to EFS, enabling a stateless architecture.

Why this answer

The best approach is to use AWS DataSync to copy data from the local EC2 instance storage to Amazon EFS during a maintenance window, then reconfigure the application to use EFS as shared storage. Option A (AWS FSx for Lustre with S3) is overcomplicated and not appropriate for a simple shared file system migration to EFS. Option C (detach EBS volume and attach to new instance) is not stateless and does not enable shared access.

Option D (EBS snapshot restore) retains the stateful nature and does not provide shared storage.

Full explanation →
1271
MCQmedium

Refer to the exhibit. An IAM policy is attached to a user in the management account of AWS Organizations. The user wants to assume the OrganizationAccountAccessRole in a member account. However, the user receives an access denied error. What is the most likely reason?

A.The trust policy of the OrganizationAccountAccessRole in the member account does not grant access to the management account.
B.The IAM role does not exist in the same region as the user.
C.An SCP in the member account denies the sts:AssumeRole action.
D.The policy does not specify the exact member account ARN.
AnswerA

The role must trust the management account to allow AssumeRole.

Why this answer

The OrganizationAccountAccessRole in the member account must have a trust policy that explicitly allows the management account's IAM user (or the management account itself) to assume the role. Without this trust relationship, the sts:AssumeRole call from the management account user will be denied, even if the user's IAM policy grants permission to assume the role.

Exam trap

The trap here is that candidates often assume SCPs are the cause of cross-account access denials, but SCPs do not apply to principals in the management account; the real issue is almost always the trust policy on the target role.

How to eliminate wrong answers

Option B is wrong because IAM roles are global resources — they exist across all AWS regions, and region is not a factor in IAM role assumption. Option C is wrong because SCPs in the member account cannot deny actions to a user in the management account; SCPs only apply to principals within the member account's own organization hierarchy. Option D is wrong because the IAM policy attached to the user can use a wildcard or specify the member account ID without requiring the exact role ARN; the policy just needs to allow sts:AssumeRole on the role's ARN, which can include the member account number.

Full explanation →
1272
MCQeasy

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

A.Make the bucket public with read-only access.
B.Generate presigned URLs for each account to access the bucket.
C.Create IAM roles in each account with permissions to assume a role in the central account.
D.Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.
AnswerD

Condition key ensures only accounts in the organization can access.

Why this answer

Using the `aws:PrincipalOrgID` condition key in an S3 bucket policy allows you to grant access to all principals (users, roles) within your AWS Organization without needing to list individual account IDs. This approach is both secure (no public access) and scalable (automatically includes new accounts added to the organization).

Exam trap

The trap here is that candidates often choose Option C (cross-account IAM roles) because it is a familiar pattern, but they overlook the simpler and more scalable centralized policy approach using the Organization ID condition key, which AWS specifically tests for centralized resource sharing scenarios.

How to eliminate wrong answers

Option A is wrong because making the bucket public with read-only access violates the principle of least privilege and exposes the data to any internet user, not just the intended accounts. Option B is wrong because presigned URLs are temporary and require manual generation and distribution for each account, which is not scalable for multiple accounts and does not provide a persistent, policy-based access control mechanism. Option C is wrong because creating IAM roles in each account with permissions to assume a role in the central account introduces cross-account trust complexity and requires managing role ARNs for every account, whereas the Organization ID condition key provides a simpler, centralized policy.

Full explanation →
1273
MCQhard

A company runs a stateful application on EC2 instances in an Auto Scaling group behind an ALB. They want to perform a rolling update without losing session state. Which solution is most appropriate?

A.Enable sticky sessions (session affinity) on the ALB and perform a rolling update.
B.Use a blue/green deployment with a new Auto Scaling group.
C.Scale out the Auto Scaling group, then scale in the old instances.
D.Terminate instances one by one and let Auto Scaling replace them.
AnswerA

Sticky sessions keep users on the same instance during transition.

Why this answer

Enabling sticky sessions (session affinity) on the ALB ensures that requests from a user are consistently routed to the same instance during the rolling update, preserving session state. Option B (blue/green deployment) would require external session state management or state replication. Option C (scale out then scale in) may route new requests to instances lacking state, and Option D (terminate instances one by one) loses the state when the instance is terminated.

Full explanation →
1274
MCQmedium

A company has a centralized logging account and multiple member accounts. The security team wants to enable VPC Flow Logs for all VPCs across all accounts and centralize the logs in the logging account. The solution must be automated and ensure that new VPCs are automatically included. Which approach should be taken?

A.Use AWS CloudTrail to monitor VPC creation and invoke an AWS Lambda function to enable Flow Logs.
B.Use Amazon EventBridge to capture VPC creation events and trigger an AWS Lambda function to enable Flow Logs.
C.Use an AWS Config rule to detect VPCs without Flow Logs and trigger an AWS Systems Manager Automation runbook to enable them, publishing to a centralized Amazon S3 bucket.
D.Use AWS Trusted Advisor to check VPC Flow Logs configuration and send alerts to an Amazon SNS topic.
AnswerC

This automates detection and remediation.

Why this answer

AWS Config can continuously evaluate all VPCs against a custom rule that checks for the presence of VPC Flow Logs. When a non-compliant VPC is detected (including newly created ones), Config can trigger an AWS Systems Manager Automation runbook that enables Flow Logs and publishes them to a centralized Amazon S3 bucket in the logging account. This approach is fully automated, covers existing and new VPCs, and centralizes logs without requiring event-driven triggers that might miss resources created before the rule was deployed.

Exam trap

The trap here is that candidates often choose EventBridge (Option B) because it seems like the most direct way to react to VPC creation, but they overlook the requirement to also handle existing VPCs and the need for continuous compliance monitoring, which AWS Config provides out of the box.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is designed to record API activity, not to monitor resource state or trigger remediation; using CloudTrail to invoke Lambda for VPC creation would require additional custom event processing and does not handle existing VPCs or VPCs created outside of CloudTrail’s scope. Option B is wrong because Amazon EventBridge captures real-time events like CreateVpc, but it only reacts to future VPC creation events and does not remediate VPCs that already exist without Flow Logs, nor does it provide ongoing compliance checks. Option D is wrong because AWS Trusted Advisor only checks for best practices on a limited set of resources and does not support automated remediation; it can send alerts via SNS but cannot enable Flow Logs or centralize logs, and it does not cover all VPCs in all accounts automatically.

Full explanation →
1275
MCQhard

Refer to the exhibit. A security engineer applied this bucket policy to an S3 bucket. A developer tries to upload an object using the AWS CLI without specifying any encryption. What is the outcome?

A.The upload succeeds because the policy only denies if encryption is not KMS.
B.The upload fails because the bucket policy is malformed and rejects all requests.
C.The upload fails because the policy denies PutObject when encryption is not KMS with the specific key.
D.The upload succeeds because the developer is using the AWS CLI with default encryption settings.
AnswerC

Both statements deny the upload if the encryption does not match the required key. Without encryption, the condition is true, so the upload is denied.

Why this answer

The bucket policy includes a Deny statement that explicitly denies s3:PutObject unless the request includes the x-amz-server-side-encryption header with value aws:kms and the x-amz-server-side-encryption-aws-kms-key-id header matching the specific KMS key ARN. Since the developer does not specify any encryption, the condition fails, and the Deny statement applies, causing the upload to fail.

Exam trap

The trap here is that candidates often assume a Deny without a matching Allow automatically blocks all requests, but they overlook that the Deny only applies when the condition is met; however, in this case, the condition is met because the request lacks the required encryption headers, so the Deny is triggered.

How to eliminate wrong answers

Option A is wrong because the policy denies PutObject when encryption is not KMS, not just when encryption is not KMS; the condition also requires a specific key ID, so any upload without the correct encryption headers is denied. Option B is wrong because the bucket policy is syntactically valid (it has proper Sid, Effect, Principal, Action, Resource, and Condition blocks) and is not malformed. Option D is wrong because the AWS CLI does not automatically apply KMS encryption with a specific key ID by default; without explicit encryption parameters, the request lacks the required headers and is denied by the policy.

Full explanation →
Page 16

Page 17 of 23

Page 18

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →