Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1276–1350

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 18 of 23

1276

MCQmedium

A company is using AWS Lambda functions to process data from an SQS queue. The Lambda function sometimes fails due to transient errors, but the messages are not being retried. Which configuration should the company check to ensure proper retry behavior?

A.Configure the Lambda function's dead-letter queue (DLQ)

B.Adjust the Maximum retries setting in the Lambda event source mapping

C.Set the SQS queue's redrive policy maxReceiveCount to a higher value

D.Increase the SQS queue's Default visibility timeout

AnswerB

This setting directly controls how many times Lambda retries failed messages from SQS.

Why this answer

The correct setting is the 'Maximum retries' in the Lambda event source mapping for SQS. This parameter controls how many times Lambda will retry a failed message batch (default is 3). Option A is incorrect because the dead-letter queue (DLQ) is used to store messages that have failed after all retries are exhausted, not to control the number of retries.

Option C is incorrect because the SQS queue's redrive policy 'maxReceiveCount' is used for SQS redrive to a DLQ, not for Lambda retries. Option D is incorrect because the SQS queue's Default visibility timeout determines how long a message is hidden after being received, but does not affect the retry count for Lambda processing.

Full explanation →

1277

Multi-Selectmedium

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Select 3 answers

A.Amazon SQS queues between services

B.Amazon API Gateway as a front end

C.Application Load Balancer (ALB) as a service mesh

D.AWS Cloud Map service discovery

E.Amazon DynamoDB as a communication channel

AnswersB, C, D

API Gateway can route to internal services.

Why this answer

Amazon API Gateway acts as a front-end proxy that can route requests to ECS Fargate services, enabling synchronous service-to-service communication via RESTful or WebSocket APIs. It handles authentication, throttling, and request transformation, making it a suitable mechanism for external or internal service calls.

Exam trap

The trap here is that candidates often confuse asynchronous messaging (SQS) or data stores (DynamoDB) with direct service-to-service communication, overlooking that microservices typically require synchronous HTTP/gRPC calls or service mesh patterns for real-time interactions.

Full explanation →

1278

Multi-Selecteasy

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

Select 2 answers

A.A route table in the private subnet with a default route pointing to the NAT Gateway

B.An Internet Gateway attached to the VPC

C.A NAT Gateway in a public subnet

D.VPC Flow Logs

E.A virtual private gateway

AnswersA, C

The route table directs traffic to the NAT Gateway.

Why this answer

A route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway is required to direct outbound internet traffic from the EC2 instances to the NAT Gateway. The NAT Gateway then forwards this traffic to the Internet Gateway, enabling the instances to download updates while remaining inaccessible from the internet.

Exam trap

The trap here is that candidates often assume an Internet Gateway alone suffices for all internet access, forgetting that instances in private subnets require a NAT device (NAT Gateway or NAT Instance) to translate their private IPs for outbound traffic.

Full explanation →

1279

MCQhard

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all VPC Flow Logs from all accounts are delivered to a central Amazon S3 bucket in the logging account. The logs must be encrypted at rest using AWS KMS. The company currently uses AWS Organizations. Which solution meets these requirements with the least operational overhead?

A.Create a bucket in the logging account with default S3-managed encryption and enable VPC Flow Logs in each account to publish to that bucket.

B.Create a bucket in the logging account with a KMS key. Grant the necessary permissions to the VPC Flow Logs service in each account to write to that bucket using the KMS key. Enable VPC Flow Logs in each account to publish to the central bucket.

C.Create a bucket in each account with KMS encryption and use S3 Cross-Region Replication to copy logs to the central bucket.

D.Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket with KMS encryption.

AnswerB

Direct delivery to central bucket with KMS encryption.

Why this answer

It uses a central S3 bucket in the logging account with a customer-managed KMS key, which satisfies the encryption-at-rest requirement. By granting the VPC Flow Logs service principal in each account the necessary permissions to write to the central bucket and use the KMS key, logs are delivered directly without additional infrastructure. This approach minimizes operational overhead by avoiding replication, streaming services, or per-account bucket management.

Exam trap

The trap here is that candidates may overlook the KMS encryption requirement and choose Option A with SSE-S3, or assume that cross-account delivery requires complex replication or streaming services, when in fact VPC Flow Logs support direct cross-account S3 delivery with proper bucket and KMS key policies.

How to eliminate wrong answers

Option A is wrong because S3-managed encryption (SSE-S3) does not use AWS KMS, failing the explicit requirement for KMS encryption. Option C is wrong because it requires creating a bucket in each account and using S3 Cross-Region Replication, which adds complexity, cost, and potential replication delays, increasing operational overhead. Option D is wrong because it introduces Amazon Kinesis Data Firehose in each account, which adds unnecessary infrastructure and cost compared to direct VPC Flow Logs delivery to S3.

Full explanation →

1280

MCQhard

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. The team wants to capture network traffic between containers for troubleshooting. Which solution should they implement?

A.Enable AWS X-Ray tracing on the ECS tasks.

B.Configure the awslogs driver to send container logs to CloudWatch Logs.

C.Use Amazon ECS Exec to access containers and run tcpdump.

D.Enable VPC Flow Logs on the ENIs attached to the ECS tasks.

AnswerD

Flow Logs capture IP traffic metadata.

Why this answer

Using Amazon ECS task networking with VPC and enabling VPC Flow Logs captures network traffic metadata. Option A is wrong because AWS X-Ray captures application-level traces, not network packets. Option B is wrong because CloudWatch Logs agent captures logs, not network traffic.

Option C is wrong because ECS Exec allows shell access but not traffic capture.

Full explanation →

1281

MCQmedium

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

A.Amazon Kinesis Data Firehose

B.Amazon SQS

C.Amazon Kinesis Data Analytics

D.AWS Lambda

AnswerC

Kinesis Data Analytics processes streaming data in real time.

Why this answer

Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose's ability to deliver data to S3 with the need for real-time transformations, overlooking that Firehose only supports basic transformations and not the complex, stateful stream processing that Kinesis Data Analytics provides.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose is a delivery service that can load streaming data into S3, but it only supports basic transformations (e.g., Lambda-based or built-in data format conversion) and cannot perform complex, real-time analytics or multi-step transformations natively. Option B is wrong because Amazon SQS is a message queue service for decoupling application components; it does not provide real-time data processing or transformation capabilities, nor does it directly integrate with S3 for streaming ingestion. Option D is wrong because AWS Lambda can process streaming data but is not designed for continuous, stateful stream processing; it has a maximum execution timeout of 15 minutes and is better suited for event-driven, short-lived tasks rather than persistent real-time transformations on unbounded streams.

Full explanation →

1282

MCQmedium

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

A.RDS Storage Auto Scaling

B.Read Replicas

C.RDS Proxy

D.Multi-AZ deployment

AnswerC

RDS Proxy is a fully managed database proxy that pools and shares database connections, which helps applications scale and handle unpredictable surges in traffic. It reduces connection overhead and improves resilience during spikes, making it the best fit for variable workloads.

Why this answer

RDS Proxy is the correct choice because it acts as a connection pooling layer that efficiently manages database connections, allowing the application to handle variable workloads and predictable spikes without overwhelming the database. It reduces the overhead of connection management and improves scalability. RDS Storage Auto Scaling only scales storage capacity, not compute or connection handling, and thus does not address workload spikes.

Read Replicas are useful for offloading read traffic but do not provide automatic scaling for unpredictable spikes. Multi-AZ deployment ensures high availability and failover but does not scale the database for variable workloads.

Full explanation →

1283

MCQhard

A company is designing a new application that must meet PCI DSS compliance requirements. The application will process credit card transactions and store encrypted data. Which AWS service should be used to manage the encryption keys?

A.AWS CloudHSM

B.AWS Key Management Service (KMS)

C.AWS Secrets Manager

D.Amazon S3 server-side encryption (SSE-S3)

AnswerA

Dedicated HSM for compliance with PCI DSS.

Why this answer

AWS CloudHSM is the correct choice because PCI DSS requires that encryption keys used to protect cardholder data be stored in a hardware security module (HSM) that is FIPS 140-2 Level 3 validated, and that the customer retains sole control over the keys. CloudHSM provides dedicated, single-tenant HSM appliances that you manage directly, ensuring you meet the key management and physical security requirements of PCI DSS without sharing the HSM with other AWS customers.

Exam trap

The trap here is that candidates often confuse AWS KMS with CloudHSM because both manage encryption keys, but the exam specifically tests the PCI DSS requirement for FIPS 140-2 Level 3 validation and sole customer control of the HSM, which only CloudHSM provides.

How to eliminate wrong answers

Option B (AWS KMS) is wrong because KMS uses a shared, multi-tenant HSM backend that is FIPS 140-2 Level 2 validated, not Level 3, and AWS retains the ability to manage and rotate the root keys, which does not satisfy PCI DSS requirement 3.5 for sole control of key management. Option C (AWS Secrets Manager) is wrong because it is a service for rotating and managing secrets (e.g., database credentials), not a dedicated key management service; it relies on KMS for encryption and does not provide direct HSM-level key storage or customer-managed HSMs. Option D (Amazon S3 server-side encryption with SSE-S3) is wrong because SSE-S3 uses AWS-managed keys where AWS controls the key material and rotation, offering no customer visibility or control over the keys, which fails PCI DSS requirement 3.6 for documented key management processes and sole control.

Full explanation →

1284

MCQmedium

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to store session state data that must be highly available and low latency. The data is accessed frequently and can be recreated if lost. Which storage solution should the solutions architect recommend?

A.Store session state in Amazon DynamoDB.

B.Store session state in Amazon S3.

C.Store session state in Amazon ElastiCache for Redis.

D.Store session state in Amazon EFS.

AnswerC

ElastiCache for Redis provides ultra-low latency in-memory storage, ideal for session state that can be recreated.

Why this answer

Amazon ElastiCache for Redis is the ideal choice for storing session state data in a containerized ECS with Fargate environment because it provides in-memory caching with sub-millisecond latency, high availability through replication and automatic failover, and supports data persistence. Since the session data can be recreated if lost, the ephemeral nature of Redis is acceptable, and its low-latency access pattern perfectly matches the frequent read/write requirements of session state.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB (Option A) because it is a fully managed, highly available NoSQL database, but they overlook the specific requirement for 'low latency' and 'frequently accessed' data, which in-memory caching like Redis is designed to satisfy, not a disk-based database like DynamoDB.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB, while highly available and durable, introduces higher latency due to disk-based storage and eventual consistency models, making it less suitable for the frequent, low-latency access required for session state; it is better for persistent, structured data that must survive failures. Option B is wrong because Amazon S3 is an object store with high latency (typically tens to hundreds of milliseconds) and is designed for infrequent access patterns, not for the sub-millisecond reads and writes needed for session state; it also lacks native session expiration mechanisms. Option D is wrong because Amazon EFS is a network file system (NFS) that provides shared file storage but has higher latency compared to in-memory caching, and it is not optimized for the high-throughput, low-latency access patterns of session state; it is better suited for shared file systems or persistent storage that requires POSIX compliance.

Full explanation →

1285

MCQhard

A startup is designing a data lake on AWS using Amazon S3. They expect to ingest hundreds of terabytes of data from IoT devices daily. Data is in JSON format and will be queried using Amazon Athena. Which combination of actions will optimize query performance and minimize costs?

A.Store data as gzip-compressed JSON in S3, partition by device_id, and use Athena with compression.

B.Convert data to Parquet, partition by date, and use S3 Intelligent-Tiering.

C.Convert data to Parquet format, partition by year/month/day, and use S3 Standard storage.

D.Store data as Parquet in S3 Glacier Deep Archive, unpartitioned, and query with Athena.

AnswerB

Parquet reduces scan, partitioning limits data, Intelligent-Tiering optimizes cost.

Why this answer

Converting data to Parquet format provides columnar storage and efficient compression, reducing the amount of data scanned by Athena. Partitioning by date (e.g., year/month/day) aligns with typical query patterns for time-series IoT data, allowing Athena to skip irrelevant partitions and minimize costs. S3 Intelligent-Tiering automatically moves data between access tiers to optimize storage costs without manual intervention.

Option A is incorrect because gzip-compressed JSON is not as efficient as Parquet in terms of compression and query performance, and partitioning by device_id would create too many small files (poor partitioning). Option C is incorrect because while Parquet and date partitioning are good, S3 Standard is more expensive for data that may not be accessed frequently after initial queries; Intelligent-Tiering is more cost-effective. Option D is incorrect because S3 Glacier Deep Archive has high retrieval costs and long retrieval times, making it unsuitable for frequent Athena queries, and lack of partitioning leads to full table scans.

Exam trap

Candidates often overlook the cost optimization of storage tiers like S3 Intelligent-Tiering for data lakes with variable access patterns.

Full explanation →

1286

MCQhard

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

A.S3 bucket policies cannot enforce encryption; you must use bucket default encryption

B.The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

C.The policy does not apply to objects uploaded using AWS KMS managed keys

D.The policy does not deny requests that omit the encryption header

AnswerD

If no encryption header is present, the condition evaluates to false, so Deny does not apply.

Why this answer

The bucket policy only requires encryption but does not explicitly deny requests that omit the `x-amz-server-side-encryption` header. Without a `Deny` effect for requests lacking the header, the policy is effectively a statement of intent rather than an enforcement mechanism. S3 bucket policies can enforce encryption by using a `Deny` statement with a condition key like `s3:x-amz-server-side-encryption` set to `AES256`.

Exam trap

The trap here is that candidates assume a policy with a `Condition` that requires encryption is sufficient, but without an explicit `Deny` for requests that omit the header, the policy is only a 'soft' requirement and does not block unencrypted uploads.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies can enforce encryption using a `Deny` effect with the `s3:x-amz-server-side-encryption` condition key; bucket default encryption is a separate, simpler mechanism but not the only way. Option B is wrong because the condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` is used to enforce a specific KMS key, not to require AES256 encryption; the correct key for AES256 is `s3:x-amz-server-side-encryption` with value `AES256`. Option C is wrong because the policy can apply to objects uploaded with AWS KMS managed keys if the condition key is set appropriately (e.g., `s3:x-amz-server-side-encryption` with value `aws:kms`), but the issue here is the lack of a `Deny` for missing headers, not the key type.

Full explanation →

1287

MCQeasy

A company is moving its application from on-premises to AWS. They want to use the same third-party software licenses on AWS. Which AWS purchasing option allows them to bring their own licenses?

A.Savings Plans

B.Dedicated Hosts

C.Spot Instances

D.Reserved Instances

AnswerB

Allows you to use existing licenses per socket/core.

Why this answer

(Dedicated Hosts) is correct because it provides visibility and control over physical servers, allowing you to use your own licenses per socket/core. Option A (Savings Plans) is just a billing discount. Option C (Spot Instances) are interruptible.

Option D (Reserved Instances) is also a billing discount and does not provide the license flexibility of Dedicated Hosts.

Full explanation →

1288

Multi-Selectmedium

A company is designing a new serverless application using AWS Lambda. The application must process files uploaded to an S3 bucket. Each file can be up to 1 GB in size. The processing time for each file is expected to be up to 15 minutes. The company wants to minimize cost and operational overhead. Which TWO configuration choices should the company make? (Choose TWO.)

Select 2 answers

A.Mount an Amazon EFS file system to the Lambda function for temporary storage.

B.Use S3 event notifications to send the file content directly to Lambda.

C.Extend the Lambda function timeout to 30 minutes.

D.Configure S3 to send event notifications to the Lambda function.

E.Set the Lambda function timeout to 15 minutes.

AnswersD, E

S3 can trigger Lambda directly via event notifications when a new object is created, which is a simple and cost-effective integration.

Why this answer

S3 event notifications can be configured to invoke a Lambda function when an object is created, providing an event-driven architecture that eliminates the need for polling or custom triggers. Option E is correct because the maximum execution timeout for AWS Lambda is 15 minutes (900 seconds), and setting it to 15 minutes allows the function to process files up to the expected processing time without exceeding the service limit.

Exam trap

The trap here is that candidates may confuse S3 event notifications with sending file content directly to Lambda, or assume Lambda timeouts can be extended beyond 15 minutes, but AWS enforces a hard 15-minute maximum for synchronous and asynchronous invocations.

Full explanation →

1289

MCQhard

A company uses AWS Organizations with 50 accounts. The network team wants to centrally manage VPC flow logs for all accounts, storing them in a central S3 bucket in the security account. The flow logs must be encrypted with a KMS key managed by the security account. What is the MOST efficient way to configure this?

A.Manually create VPC flow logs in each account and point to the central S3 bucket

B.Use AWS CloudFormation StackSets to deploy a stack that creates VPC flow logs with the required configuration in all accounts

C.Use AWS Config rules to enforce flow log creation across accounts

D.Use AWS Systems Manager Automation to create flow logs in each account

AnswerB

StackSets can deploy the same template across multiple accounts and regions, ensuring consistent configuration.

Why this answer

AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in an AWS Organization. By defining the VPC flow log resource with the central S3 bucket ARN and the KMS key from the security account (using a cross-account KMS key policy), StackSets can automatically create flow logs in all member accounts with the required encryption, making it the most efficient and centralized approach.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option C) thinking they can enforce resource creation, but Config is a detective control, not a provisioning tool, and cannot directly create flow logs without additional automation.

How to eliminate wrong answers

Option A is wrong because manually creating VPC flow logs in each account is not scalable, error-prone, and violates the principle of central management for 50 accounts. Option C is wrong because AWS Config rules can only detect non-compliance (e.g., missing flow logs) and trigger remediation actions, but they cannot directly create or manage the flow log resources themselves; they rely on other services like AWS Systems Manager or Lambda for remediation, adding complexity. Option D is wrong because AWS Systems Manager Automation is designed for operational tasks on EC2 instances or on-premises machines, not for creating VPC flow logs across accounts; it lacks the native multi-account deployment capability that StackSets provides.

Full explanation →

1290

Multi-Selectmedium

A company has a stateful web application running on Amazon EC2 instances. They want to implement blue/green deployments to reduce downtime. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Migrate session state to Amazon ElastiCache or DynamoDB.

B.Use an Elastic Load Balancer (ELB) to manage the blue and green environments.

C.Use Amazon Route 53 weighted routing policies to shift traffic gradually.

D.Set a high TTL on the DNS record to prevent caching issues.

E.Immediately deregister the blue instances from the load balancer after deployment.

AnswersA, C

Decoupling session state from instances enables seamless blue/green.

Why this answer

For blue/green deployments with stateful applications, migrating session state to a durable store like ElastiCache or DynamoDB (Option A) ensures continuity across environments. Using Route 53 weighted routing (Option C) allows gradual traffic shifting to the green environment, minimizing downtime. Option B is incorrect because ELB itself does not manage blue/green deployments natively; it is used within the architecture but not the primary action.

Option D is incorrect because a high TTL on DNS records would delay traffic switching. Option E is incorrect because deregistering instances immediately would cause disruption; proper testing should occur first.

Full explanation →

1291

MCQeasy

A company wants to modernize a legacy monolithic application by decomposing it into microservices. The application handles HTTP requests and uses a MySQL database. The company needs to decouple the microservices and improve scalability. Which AWS services should be used?

A.Amazon SQS for decoupling and Amazon Aurora MySQL for data.

B.Amazon S3 for decoupling and Amazon RDS for MySQL.

C.Amazon SQS for decoupling and Amazon DynamoDB for data.

D.Amazon Kinesis Data Streams for decoupling and Amazon RDS for MySQL.

AnswerA

SQS provides message queuing for decoupling; Aurora is MySQL-compatible and scalable.

Why this answer

Amazon SQS provides a reliable message queue for decoupling microservices, and Amazon Aurora MySQL offers a scalable, MySQL-compatible database for persistent data. Option B (S3) is incorrect because S3 is an object storage service, not a decoupling mechanism. Option C (DynamoDB) is incorrect because although SQS for decoupling is fine, DynamoDB is a NoSQL database, not a relational database like MySQL, and the question specifies MySQL.

Option D (Kinesis Data Streams) is incorrect because Kinesis is designed for real-time data streaming, not for general-purpose decoupling of microservices.

Full explanation →

1292

Multi-Selecteasy

A company is migrating a web application to AWS and wants to use a microservices architecture. The application needs to communicate synchronously via REST APIs. Which TWO AWS services should the architect consider for implementing API communication?

Select 2 answers

A.Application Load Balancer

B.AWS Step Functions

C.Amazon API Gateway

D.AWS AppSync

E.Amazon Simple Queue Service (Amazon SQS)

AnswersA, C

ALB can route HTTP requests to different microservices based on paths.

Why this answer

Amazon API Gateway is a fully managed service for creating RESTful APIs. AWS AppSync is for GraphQL. For internal microservice communication, API Gateway is suitable.

Application Load Balancer can also route HTTP traffic to multiple services. NLB is for TCP/UDP. SQS is asynchronous.

Step Functions orchestrate workflows.

Full explanation →

1293

MCQhard

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

A.Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.

B.Migrate the application to use Amazon DynamoDB with global tables.

C.Use Amazon RDS Multi-AZ with a standby instance for read traffic.

D.Implement Amazon ElastiCache in front of the database to cache read queries.

AnswerA

Read replicas offload read traffic and the reader endpoint distributes reads.

Why this answer

Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Exam trap

The trap here is that candidates often confuse Multi-AZ standby instances with read replicas, not realizing that Multi-AZ standby instances are strictly for high availability and cannot serve read traffic, while read replicas are specifically designed to offload read workloads.

How to eliminate wrong answers

Option B is wrong because migrating to Amazon DynamoDB with global tables would require significant application changes to adapt from a relational to a NoSQL data model, which contradicts the requirement for minimal application changes. Option C is wrong because Amazon RDS Multi-AZ with a standby instance does not support read traffic; the standby instance is only for failover and cannot serve read requests. Option D is wrong because implementing Amazon ElastiCache would require application code changes to implement caching logic, which does not meet the minimal application changes requirement.

Full explanation →

1294

Multi-Selectmedium

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

Select 3 answers

A.Set up an automatic remediation action using AWS Config to enable encryption on non-compliant buckets.

B.Attach an IAM policy to each account's root user.

C.Create a Service Control Policy (SCP) that denies creating S3 buckets without encryption.

D.Define an AWS Config rule to check that S3 buckets have encryption enabled.

E.Enable AWS CloudTrail to log all S3 API calls.

AnswersA, C, D

Remediation can auto-fix violations detected by Config rules.

Why this answer

AWS Config can be configured with automatic remediation actions (e.g., using AWS Systems Manager Automation) to enable encryption on S3 buckets that are found non-compliant. Option C is correct because a Service Control Policy (SCP) can be applied to organizational units (OUs) in AWS Control Tower to deny the creation of S3 buckets without encryption, providing preventive governance. Option D is correct because an AWS Config rule can be defined to evaluate whether S3 buckets have encryption enabled, alerting on non-compliance.

Option B is incorrect because IAM policies attached to the root user are not effective for enforcing baseline rules across multiple accounts; SCPs are designed for that purpose. Option E is incorrect because AWS CloudTrail only logs API calls for auditing and does not enforce or remediate compliance; it is not a control mechanism for ensuring encryption at rest.

Full explanation →

1295

Multi-Selectmedium

A company uses AWS CloudFormation to manage infrastructure. A recent update to a stack failed, and the stack is now in a ROLLBACK_COMPLETE state. The team needs to investigate the cause and then redeploy the update. Which TWO actions should the team take? (Choose two.)

Select 2 answers

A.View the stack events in the CloudFormation console.

B.Review the previous stack template version.

C.Create a ChangeSet to review the proposed changes before applying.

D.Use AWS CloudFormation StackSets to redeploy across accounts.

E.Execute a rollback to continue the rollback process.

AnswersA, C

Stack events provide error messages that indicate the cause of failure.

Why this answer

After a stack update fails and reaches ROLLBACK_COMPLETE, the team should view stack events (Option A) to see detailed error messages for each resource, which helps identify the cause. Then, before redeploying, they should create a ChangeSet (Option C) to review the proposed changes and ensure they are correct. Option B is not directly helpful because the previous template version is already known.

Option D, StackSets, is for managing stacks across multiple accounts, not for debugging a single stack. Option E is incorrect because executing a rollback is unnecessary when the stack has already completed rollback.

Full explanation →

1296

MCQhard

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

A.Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

B.Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

C.Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

D.Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.

AnswerD

This enforces that account-level block public access settings cannot be changed, effectively blocking all public access.

Why this answer

S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Exam trap

The trap here is that candidates often confuse reactive detection (AWS Config) or partial policy restrictions (denying s3:PutBucketPolicy) with the comprehensive, preventive account-level block that SCPs can enforce, missing that S3 Block Public Access at the account level is the only way to block all public access without touching existing bucket policies.

How to eliminate wrong answers

Option A is wrong because CloudTrail only provides logging and alerting; it does not enforce or prevent public access, so it fails to meet the requirement to block public access without modifying bucket policies. Option B is wrong because denying s3:PutBucketPolicy does not block public access via bucket ACLs or object-level permissions; it only prevents policy changes, leaving other public access vectors open. Option C is wrong because AWS Config rules with auto-remediation via Lambda can detect and fix public buckets, but this is a reactive approach that may have a delay and does not proactively block public access at the account level as required.

Full explanation →

1297

MCQeasy

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

A.The template will create an S3 bucket with versioning enabled.

B.The template will create an S3 bucket with a random name.

C.The template will fail because the bucket name is not globally unique.

D.The template will create an S3 bucket with versioning disabled.

AnswerA

Correct: The template explicitly enables versioning via VersioningConfiguration set to Enabled.

Why this answer

The CloudFormation template snippet includes the `VersioningConfiguration` property set to `Enabled` within the `AWS::S3::Bucket` resource. This explicitly enables versioning when the stack is deployed. The template also specifies a `BucketName`, so CloudFormation uses that name rather than generating a random one.

Option B is incorrect because the bucket name is explicitly provided, not randomly generated. Option C is incorrect because the template will only fail if the bucket name is already taken, but that is not guaranteed. Option D is incorrect because versioning is explicitly enabled.

Exam trap

The trap is that candidates might think versioning is disabled by default, but here it is explicitly enabled. Also, candidates may assume a missing BucketName causes failure, but the template includes a name, so the name is not random.

How to eliminate wrong answers

Option B is wrong because, while CloudFormation does generate a random bucket name when no `BucketName` property is provided, the template also enables versioning, so the bucket is not created with versioning disabled; the statement is incomplete. Option C is wrong because the template does not specify a `BucketName`, so CloudFormation automatically generates a globally unique name, preventing a failure due to non-uniqueness. Option D is wrong because the template explicitly sets `VersioningConfiguration` to `Enabled`, so versioning is enabled, not disabled.

Full explanation →

1298

MCQeasy

A company uses AWS Organizations with multiple OUs. The security team wants to enforce that no resources can be created outside of approved AWS Regions. Which policy should be used, and how should it be attached?

A.Create a resource-based policy on each resource type that denies creation in unapproved Regions.

B.Create a service control policy (SCP) that denies actions in unapproved Regions. Attach it to the root or OUs.

C.Create an IAM policy that denies actions in unapproved Regions. Attach it to all IAM users and roles.

D.Enable AWS CloudTrail to log resource creation and set up a CloudWatch alarm to notify if resources are created in unapproved Regions.

AnswerB

SCPs provide centralized control over maximum permissions for accounts in an organization.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict AWS service actions across all accounts in an AWS Organization. By attaching an SCP that denies actions in unapproved Regions to the root or OUs, the security team ensures that no principal (including the root user) can create resources outside the allowed Regions, regardless of any IAM policies attached at the account level.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that attaching an IAM policy to all users is sufficient, but they overlook that SCPs are the only way to enforce restrictions across all accounts in an organization, including the management account's root user and any accounts that might have full administrative access.

How to eliminate wrong answers

Option A is wrong because resource-based policies are attached to individual resources (e.g., S3 bucket policies) and cannot be applied globally to prevent resource creation across all services; they also do not apply before the resource exists. Option C is wrong because IAM policies are attached to IAM users, groups, or roles and can be overridden by a user with administrative privileges or bypassed by the root user; they do not provide centralized enforcement across all accounts in an organization. Option D is wrong because CloudTrail and CloudWatch alarms are detective controls that only notify after a resource has been created in an unapproved Region, not preventive controls that block the action.

Full explanation →

1299

MCQmedium

A company runs a containerized application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The company has configured a target tracking scaling policy based on average memory utilization. During a traffic spike, the ECS service scales out, but the new tasks are immediately deregistered and replaced. The CloudWatch logs show that the new tasks are failing the ALB health check. The health check is configured to ping the '/health' endpoint on the container. The solutions architect verifies that the application container correctly responds to the '/health' endpoint with a 200 status code. What is the MOST likely cause of the health check failures?

A.The ALB is not configured with a proper listener rule to forward traffic to the target group.

B.The security group attached to the ECS tasks does not allow inbound traffic from the ALB on the health check port.

C.The deregistration delay (connection draining) is set too high, causing the ALB to think the tasks are unhealthy.

D.The health check path is incorrect; it should be '/index.html' instead of '/health'.

AnswerB

Without inbound rules allowing traffic from the ALB, health checks will fail.

Why this answer

Since the application container correctly responds to the '/health' endpoint with a 200 status code, the health check failures are likely due to network connectivity. For Fargate tasks, each task gets an ENI, and the security group attached to the tasks must allow inbound traffic from the ALB on the health check port. If this rule is missing, the ALB cannot reach the health check endpoint, causing tasks to be deregistered.

Option A is incorrect because the ALB listener rule is for routing traffic, not health checks. Option C is incorrect because a high deregistration delay would cause slow draining, not immediate health check failures. Option D is incorrect because the health check path is confirmed correct by the architect.

Full explanation →

1300

Multi-Selecteasy

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Select 2 answers

A.Configure an IAM identity provider to use the on-premises Active Directory.

B.Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.

C.Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

D.Use AWS Resource Access Manager to share the AWS Managed Microsoft AD directory with other accounts in the organization.

E.Deploy AWS Managed Microsoft AD in each account and configure replication.

AnswersB, D

This enables users to authenticate with their existing credentials.

Why this answer

Establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Exam trap

The trap here is that candidates often confuse IAM identity providers (Option A) with Active Directory trust relationships, or they incorrectly assume that storing credentials in Parameter Store (Option C) is a valid authentication strategy for directory integration, when in fact the correct approach is to establish a forest trust and share the directory via RAM.

Full explanation →

1301

MCQmedium

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

A.Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.

B.Use client-side encryption with the AWS SDK.

C.Use S3 server-side encryption with customer-provided keys (SSE-C).

D.Use S3 server-side encryption with S3 managed keys (SSE-S3).

AnswerA

Customer managed keys can be rotated automatically yearly.

Why this answer

SSE-KMS with customer managed keys (CMKs) meets the compliance requirements because it allows the company to manage the encryption key lifecycle, including automatic annual rotation. AWS KMS supports automatic key rotation for customer managed keys, which can be configured to rotate every year, satisfying the mandate for company-managed keys with automatic rotation.

Exam trap

The trap here is that candidates often confuse SSE-C (customer-provided keys) with customer managed keys, but SSE-C does not support automatic rotation and requires the customer to manage key material outside AWS, whereas SSE-KMS with customer managed keys provides automatic rotation and is the correct choice for company-managed keys with rotation.

How to eliminate wrong answers

Option B is wrong because client-side encryption encrypts data before it reaches S3, but the key management and rotation are handled by the client application, not by AWS, and the compliance requirement specifies that the key must be managed by the company but does not require client-side control; also, automatic rotation would require custom implementation. Option C is wrong because SSE-C requires the company to provide and manage their own encryption keys, but AWS does not support automatic key rotation for SSE-C—the customer must manually rotate keys and re-encrypt data. Option D is wrong because SSE-S3 uses AWS-managed keys (Amazon S3 managed keys), which are not managed by the company, violating the requirement that the key must be managed by the company.

Full explanation →

1302

Multi-Selecthard

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

Select 3 answers

A.Amazon Kinesis Data Analytics

B.AWS Lambda

C.Amazon EMR

D.AWS Glue

E.Amazon Redshift

AnswersB, D, E

Lambda can trigger on S3 events for late-arriving data.

Why this answer

AWS Lambda is correct because it can be triggered by S3 events to process late-arriving data in near real-time, transforming and loading it into Amazon Redshift. Lambda's serverless nature allows it to handle variable data arrival patterns without managing infrastructure, ensuring data consistency through idempotent processing logic.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Analytics for batch processing or assume Amazon EMR is required for any transformation, overlooking the serverless, event-driven capabilities of AWS Lambda and AWS Glue for S3-to-Redshift pipelines.

Full explanation →

1303

Multi-Selectmedium

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Select 2 answers

A.Service control policies (SCPs) apply to all accounts in the organization, including the management account.

B.AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.

C.Each account in an organization must have its own payment method.

D.Consolidated billing allows you to combine usage and receive volume discounts.

E.AWS Config rules cannot be applied across accounts via AWS Organizations.

AnswersB, D

An organization trail automatically logs events for all accounts.

Why this answer

AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Exam trap

The trap here is that candidates often assume SCPs apply to all accounts including the management account, but AWS explicitly excludes the management account from SCP effects to prevent accidental lockout of administrative access.

Full explanation →

1304

MCQhard

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a 5-minute downtime. The application uses a connection pool with a 30-second connection timeout. The RDS DNS name is used as the endpoint. What is the MOST likely cause of the downtime?

A.The DNS TTL for the RDS endpoint is set too high

B.The connection pool timeout is too short to allow failover

C.The Multi-AZ failover took longer than expected

D.The application is using the wrong endpoint after failover

AnswerA

High DNS TTL causes clients to cache the old IP, leading to connection failures until cache expires.

Why this answer

During an RDS Multi-AZ failover, the DNS name remains the same but the underlying IP address changes. If the DNS TTL is set too high (default is 60 seconds but can be configured higher), clients may continue to use the old cached IP address for the duration of the TTL, leading to connection failures until the cache expires. This explains the 5-minute downtime, as the application's connection pool with a 30-second timeout cannot recover until the DNS record is refreshed.

Option B is incorrect because the 30-second timeout is sufficient to wait for failover, but the issue is DNS propagation, not timeout duration. Option C is incorrect because Multi-AZ failover typically completes within 1-2 minutes, not 5 minutes. Option D is incorrect because the endpoint (DNS name) does not change after failover; only the IP changes.

Full explanation →

1305

MCQhard

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

A.Use Amazon EBS with a multi-attach enabled volume.

B.Use Amazon EFS with provisioned throughput.

C.Use Amazon S3 with S3 File Gateway to present as a file system.

D.Use Amazon FSx for Windows File Server with a single file system.

AnswerB

EFS provides a shared NFS file system that scales throughput and is accessible across AZs.

Why this answer

Amazon EFS with provisioned throughput is the correct choice because it provides a fully managed, scalable, shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones simultaneously. It uses the NFSv4.1 protocol, delivers high throughput and low latency, and allows you to provision throughput independently of storage size to meet performance requirements.

Exam trap

The trap here is that candidates often confuse Amazon EBS multi-attach with a true shared file system, overlooking its single-AZ limitation and low instance count cap, while also underestimating EFS's ability to handle hundreds of concurrent NFS clients across multiple AZs with provisioned throughput.

How to eliminate wrong answers

Option A is wrong because Amazon EBS multi-attach volumes can only be attached to a maximum of 16 Nitro-based EC2 instances in a single Availability Zone, not hundreds across multiple AZs, and they do not provide a shared file system interface. Option C is wrong because Amazon S3 with S3 File Gateway presents an SMB or NFS file system but is designed for hybrid cloud caching and does not natively provide the low-latency, high-throughput performance required for hundreds of concurrent EC2 instances across AZs; it also introduces gateway latency and throughput limitations. Option D is wrong because Amazon FSx for Windows File Server supports only Windows-based clients via SMB protocol and is not optimized for the high-throughput, low-latency requirements of hundreds of Linux-based EC2 instances across multiple AZs; it also has a single file system that can be accessed across AZs but is not designed for the scale and performance profile described.

Full explanation →

1306

MCQhard

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

A.Increase the memory and CPU for each task definition to reduce contention.

B.Increase the number of tasks to distribute the load evenly.

C.Change the task placement strategy to spread across Availability Zones.

D.Use a launch type of EC2 with GPU instances to handle the load.

AnswerC

Spread strategy distributes tasks, reducing resource contention.

Why this answer

Changing the task placement strategy to spread distributes tasks across Availability Zones, reducing resource contention and improving latency. Option A is wrong because increasing memory and CPU does not address placement-related contention. Option B is wrong because increasing the number of tasks with the default binpack strategy may worsen contention by packing tasks more densely.

Option D is wrong because using EC2 with GPU instances does not solve placement issues and introduces unnecessary complexity.

Full explanation →

1307

MCQeasy

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

A.Use AWS Snowball to transfer the database files to RDS.

B.Use an RDS read replica from the on-premises database.

C.Use AWS Database Migration Service (DMS) with ongoing replication.

D.Export the database to Amazon S3 and import into RDS.

AnswerC

DMS supports full load and CDC replication with minimal downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports both a full load of the 500 GB database and continuous change data capture (CDC) using the MySQL binary log (binlog) to replicate ongoing changes with minimal downtime. DMS can perform the initial load while the source remains operational, then switch to CDC to keep the target in sync until cutover.

Exam trap

The trap here is that candidates often confuse the one-time bulk transfer capability of Snowball or S3 with the need for ongoing replication, failing to recognize that minimal downtime requires a continuous change capture mechanism like DMS CDC, not just an initial data load.

How to eliminate wrong answers

Option A is wrong because AWS Snowball is designed for offline bulk data transfer of large datasets (e.g., terabytes to petabytes) and cannot provide ongoing replication; it would require a separate replication mechanism for changes after the initial load, defeating the minimal-downtime goal. Option B is wrong because an RDS read replica can only be created from an existing RDS instance, not from an on-premises database; it uses MySQL's asynchronous replication which requires the source to be an RDS MySQL instance. Option D is wrong because exporting the database to Amazon S3 and importing into RDS is a one-time, offline process that does not capture ongoing changes, so it would result in significant downtime while the export and import occur, and it lacks CDC capabilities.

Full explanation →

1308

Multi-Selecthard

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Select 3 answers

A.Enable CloudTrail to log all console logins and alert if MFA is not used.

B.Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.

C.Use AWS Config rules to detect IAM users without MFA and automatically remediate by sending notifications.

D.Use a service control policy (SCP) to require MFA on all IAM users.

E.Create an IAM policy that requires MFA for ConsoleLogin and attach it to all IAM users in each account.

AnswersB, C, E

IAM Identity Center can enforce MFA centrally for all accounts.

Why this answer

AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can enforce MFA enrollment, when in fact SCPs only deny actions based on the presence of MFA and cannot force users to configure or use MFA at login.

Full explanation →

1309

MCQmedium

A company is migrating a large-scale data warehouse from on-premises to Amazon Redshift. The current on-premises solution uses a proprietary columnar storage format. The company needs to minimize data transformation effort. Which approach should the company take?

A.Use the Amazon Redshift COPY command to load data directly from the on-premises storage.

B.Use AWS Glue to convert the proprietary format to Apache Parquet and load into Amazon Redshift.

C.Use AWS Database Migration Service (DMS) to migrate the data directly to Redshift.

D.Use Amazon Kinesis Data Firehose to stream the data to Redshift.

AnswerB

AWS Glue can transform data into columnar formats optimized for Redshift.

Why this answer

AWS Glue can crawl the proprietary columnar storage format and convert it to Apache Parquet, a columnar format efficiently loaded into Amazon Redshift via COPY from S3, minimizing data transformation effort. Option A is incorrect because the COPY command cannot directly load from on-premises storage; data must first be staged in Amazon S3 in a supported format. Option C is incorrect because AWS DMS is designed for migrating relational databases, not proprietary file formats.

Option D is incorrect because Amazon Kinesis Data Firehose is for streaming real-time data, not batch migration of existing large-scale data.

Full explanation →

1310

MCQhard

A company is modernizing a legacy application by breaking it into microservices. The application uses a shared MySQL database. The team wants to refactor the database to use Amazon DynamoDB for better scalability. Which migration strategy should be used?

A.Rehost the database to Amazon RDS

B.Use the Strangler Fig pattern to incrementally migrate data to DynamoDB

C.Replatform the database to Amazon Aurora

D.Retire the existing database and switch to DynamoDB

AnswerB

Allows gradual transition with minimal risk.

Why this answer

The Strangler Fig pattern is the correct migration strategy because it allows for incremental and iterative migration of data and business logic from the legacy MySQL database to Amazon DynamoDB without a full cutover. This approach minimizes risk and enables the team to gradually refactor the application while maintaining continuous operation. Option A (rehost to Amazon RDS) would still use a relational database and not achieve the goal of moving to DynamoDB.

Option C (replatform to Amazon Aurora) also retains a relational model. Option D (retire the existing database and switch to DynamoDB) is risky as it requires a complete cutover without incremental transition.

Full explanation →

1311

MCQhard

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

A.The IAM role used by the DevOps team has a trust policy that does not allow EC2 actions

B.The EC2 service has been disabled via AWS Config in that account

C.The development account is in an organizational unit (OU) with a different SCP that denies EC2

D.The SCP denies all services not explicitly allowed, and EC2 is not on the whitelist

AnswerD

SCPs that use an allow list deny all services not explicitly listed.

Why this answer

The SCP uses a deny-all approach with a whitelist of allowed services. Since EC2 is not on that whitelist, the SCP implicitly denies all EC2 actions, overriding any IAM policy that explicitly allows ec2:RunInstances. SCPs act as a guardrail that cannot be bypassed by account-level IAM policies.

Exam trap

The trap here is that candidates may think an explicit IAM allow can override an SCP, but SCPs set the maximum permissions boundary, so any action not explicitly allowed by the SCP is implicitly denied.

How to eliminate wrong answers

Option A is wrong because a trust policy controls which principals can assume a role, not the actions the role can perform; the issue is about authorization, not trust. Option B is wrong because AWS Config is a compliance and monitoring service, not a service control mechanism that can disable EC2; it cannot prevent API calls. Option C is wrong because the question states the SCP does not explicitly deny EC2, and the SCP described is the only one mentioned; while an OU-level SCP could cause this, the most direct and likely cause given the whitelist design is that EC2 is simply not allowed.

Full explanation →

1312

Multi-Selecthard

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Select 2 answers

A.Increase the number of shards in the Kinesis data stream

B.Increase the batch size in the event source mapping

C.Change the data source from Kinesis to an Amazon SQS queue

D.Increase the Lambda function memory to 1024 MB

E.Increase the Lambda function's reserved concurrency to a higher value

AnswersA, B

More shards allow more Lambda executions in parallel, improving throughput.

Why this answer

Increasing the number of shards in the Kinesis data stream (Option A) increases parallelism because each shard can be processed by one concurrent Lambda instance, allowing the pipeline to handle higher data volumes. Increasing the batch size in the event source mapping (Option B) allows each Lambda invocation to process more records at once, reducing the number of invocations and lowering per-record overhead. Together, these two strategies directly improve throughput and reduce latency.

Option D (increasing memory) can improve performance for compute-bound functions but does not directly address parallelism or batching, and is not one of the two best choices for this scenario.

Exam trap

The trap here is that candidates may think increasing reserved concurrency (Option E) is the key to scaling, but without increasing shards, Lambda cannot process more data in parallel because each shard is processed by only one concurrent Lambda instance at a time.

Full explanation →

1313

MCQmedium

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

A.To ensure that only requests originating from accounts within the specified organization are allowed.

B.To restrict access to only the root user of the management account.

C.To enforce that all requests are made using HTTPS.

D.To allow access only from specific IP addresses within the organization.

AnswerA

The aws:SourceOrgID condition checks the organization ID.

Why this answer

The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Exam trap

The trap here is that candidates may confuse `aws:PrincipalOrgID` with other condition keys like `aws:SourceIp` or `aws:SecureTransport`, or assume it restricts to the management account root user, when in fact it validates organization membership for any principal in the organization.

How to eliminate wrong answers

Option B is wrong because the condition does not reference the root user of the management account; it uses `aws:PrincipalOrgID` which applies to all principals in the organization, not just the root user. Option C is wrong because enforcing HTTPS is done using the `aws:SecureTransport` condition key, not `aws:PrincipalOrgID`. Option D is wrong because restricting access to specific IP addresses is achieved with the `aws:SourceIp` condition key, not `aws:PrincipalOrgID`.

Full explanation →

1314

Multi-Selectmedium

A company is designing a new serverless application that uses AWS Lambda, Amazon DynamoDB, and Amazon API Gateway. The application must handle burst traffic and cannot lose any data. The company wants to use a dead-letter queue (DLQ) for failed Lambda invocations. Which TWO services can be used as a DLQ for Lambda? (Choose two.)

Select 2 answers

A.Amazon DynamoDB Streams

B.Amazon SNS

C.Amazon Kinesis Data Streams

D.Amazon SQS

E.Amazon Simple Email Service (SES)

AnswersB, D

Lambda can use SNS as a DLQ for asynchronous invocations.

Why this answer

Amazon SNS and Amazon SQS are the two supported destinations for Lambda's dead-letter queue (DLQ) configuration, but only for asynchronous invocations. When a Lambda function is invoked asynchronously and fails after the configured number of retries, the event can be redirected to an SNS topic or an SQS queue for later reprocessing or analysis. This ensures no data is lost during burst traffic, as failed events are persisted in the DLQ.

Synchronous invocations do not support DLQ.

Exam trap

The trap here is that candidates often confuse Lambda's event sources (like DynamoDB Streams or Kinesis) with supported DLQ destinations, but Lambda only allows SQS and SNS as DLQ targets for asynchronous invocations.

Full explanation →

1315

MCQmedium

A multinational company wants to implement a multi-account AWS environment using AWS Organizations. The security team requires that all new accounts automatically have AWS CloudTrail and AWS Config enabled with specific rules. Which solution should the company use to enforce these settings across all accounts?

A.Use AWS Organizations Service Control Policies (SCPs) to deny actions that disable CloudTrail and AWS Config.

B.Use AWS CloudFormation StackSets to deploy CloudTrail and AWS Config in each account.

C.Use IAM permissions boundaries to restrict what users can do in each account.

D.Use AWS Config conformance packs to deploy rules across accounts.

AnswerA

Service Control Policies (SCPs) allow you to centrally control which AWS services and actions are allowed or denied across all accounts in an organization. By creating SCPs that deny actions that disable CloudTrail or AWS Config, you can enforce that these services remain enabled in all accounts, including new accounts that are created.

Why this answer

Service Control Policies (SCPs) can be used to enforce that CloudTrail and AWS Config are enabled and cannot be disabled by member accounts. Option B is wrong because CloudFormation StackSets require manual deployment to each account and do not prevent disabling. Option C is wrong because IAM permissions boundaries do not enforce service enablement.

Option D is wrong because AWS Config conformance packs deploy rules but cannot enforce CloudTrail enablement.

Full explanation →

1316

Multi-Selectmedium

A company is migrating a legacy e-commerce platform to AWS. The platform includes a MySQL database that experiences heavy read traffic. The company wants to improve performance and reduce latency for read operations. Which TWO actions should the solutions architect take?

Select 2 answers

A.Enable Multi-AZ on the RDS instance.

B.Shard the database across multiple RDS instances.

C.Upgrade to Provisioned IOPS for the database.

D.Add read replicas to the RDS MySQL database.

E.Use Amazon ElastiCache in front of the database.

AnswersD, E

Read replicas reduce load on the primary and improve read latency.

Why this answer

Adding read replicas offloads read traffic from the primary database, improving performance. Implementing Amazon ElastiCache for caching reduces database load for frequently accessed data. Multi-AZ is for high availability, not read performance.

Provisioned IOPS improves write performance. Sharding adds complexity and may not be necessary.

Full explanation →

1317

MCQmedium

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

A.Amazon CloudFront

B.Amazon Route 53

C.Auto Scaling groups

D.Elastic Load Balancing

AnswerC

Auto Scaling can scale EC2 instances based on metrics.

Why this answer

Auto Scaling groups (Option C) are the correct service because they directly manage the automatic scaling of EC2 instances based on defined policies, such as a target CPU utilization threshold. When CPU utilization exceeds the threshold, the Auto Scaling group launches new instances to handle the load, and it terminates instances when utilization drops, ensuring the web tier scales automatically.

Exam trap

The trap here is that candidates often confuse Elastic Load Balancing with automatic scaling, but ELB only distributes traffic and does not add or remove instances; the Auto Scaling group is the service that actually scales the compute capacity.

How to eliminate wrong answers

Option A is wrong because Amazon CloudFront is a content delivery network (CDN) that caches content at edge locations to reduce latency, not a service that scales compute resources based on CPU utilization. Option B is wrong because Amazon Route 53 is a DNS web service that routes end users to internet applications, but it does not provide automatic scaling of compute capacity. Option D is wrong because Elastic Load Balancing distributes incoming traffic across multiple targets (e.g., EC2 instances), but it does not automatically scale the number of instances; it works in conjunction with Auto Scaling groups to distribute traffic to scaled instances.

Full explanation →

1318

MCQmedium

An IAM policy condition allows launching EC2 instances only if the instance type is t2.micro or t2.small. A developer tries to launch a t2.medium instance. What happens?

A.The launch is denied only if the user does not have a separate policy allowing t2.medium.

B.The launch succeeds because the condition only allows, not denies.

C.The launch succeeds if the user has an additional Allow for t2.medium.

D.The launch is denied because t2.medium is not in the allowed list.

AnswerD

Only allowed types are permitted.

Why this answer

The IAM policy condition explicitly allows only t2.micro and t2.small. When the developer tries to launch a t2.medium instance, the condition restricts the allowed types, so the launch is denied. Option D is correct because t2.medium is not in the allowed list.

Option A is incorrect because the condition is explicit and no additional policy can override a deny from the condition. Option B is incorrect because the condition applies to both allow and deny. Option C is incorrect because even with an additional Allow for t2.medium, the condition would still deny it unless the condition is modified.

Full explanation →

1319

MCQeasy

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

A.Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

B.Use AWS CloudFormation templates that specify t3.micro.

C.Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.

D.Use AWS Config rules to terminate non-compliant instances.

AnswerC

SCPs prevent non-compliant actions at the OU level.

Why this answer

A Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Exam trap

The trap here is that candidates often choose AWS Config rules (Option D) thinking they can prevent launches, but Config is detective, not preventive; SCPs are the correct preventive control at the organization level.

How to eliminate wrong answers

Option A is wrong because an IAM role attached to users does not apply to all principals in the OU; users could still launch instances via other roles or services, and the role does not enforce the restriction across all accounts in the OU. Option B is wrong because CloudFormation templates are not an enforcement mechanism; developers could bypass the template and launch instances manually via the console or CLI. Option D is wrong because AWS Config rules only detect and report non-compliance after the instance is launched; they do not prevent the launch, and terminating instances after creation is reactive and can incur costs and operational overhead.

Full explanation →

1320

MCQhard

A company is migrating a distributed application that uses a custom TCP protocol between components. The application is deployed on-premises across multiple servers. The company wants to use AWS without modifying the application code. Which approach should the company take to migrate the application while maintaining low latency between components?

A.Use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency.

B.Use AWS Direct Connect to connect the on-premises servers to AWS and keep the application on-premises.

C.Use VPC Peering to connect the application components across different VPCs.

D.Use a VPN connection between the on-premises environment and AWS VPC.

AnswerA

Placement Groups provide low latency and high throughput, and EC2 allows running the application unchanged.

Why this answer

Using a Placement Group ensures that EC2 instances are placed close together within the same Availability Zone, minimizing network latency and maximizing throughput for the custom TCP protocol. This allows the application to run unchanged on AWS. Option B is incorrect because Direct Connect connects on-premises to AWS, but the application components would still be separated by network distance, increasing latency.

Option C is incorrect because VPC Peering connects different VPCs, which does not guarantee low latency within a single VPC. Option D is incorrect because a VPN is used for secure connectivity over the internet, which introduces higher latency and is not necessary for components within the same VPC.

Full explanation →

1321

MCQhard

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

A.Use AWS Config rules to detect non-compliant security groups and send alerts.

B.Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

C.Use AWS Firewall Manager to centrally define and apply security group policies across accounts.

D.Use network ACLs instead of security groups to enforce segmentation.

AnswerC

Firewall Manager automates policy enforcement across all accounts.

Why this answer

AWS Firewall Manager is the correct choice because it provides a centralized, policy-based approach to define and apply security group rules across multiple accounts and VPCs in an AWS Organization. It integrates with AWS Transit Gateway to enforce consistent network segmentation in a hub-and-spoke model, minimizing operational overhead by automating rule enforcement and compliance without custom scripting or manual periodic checks.

Exam trap

The trap here is that candidates often confuse AWS Config's detective capabilities (alerting) with Firewall Manager's preventive and automated enforcement, or they underestimate the operational burden of custom scripting (Option B) versus a fully managed service like Firewall Manager.

How to eliminate wrong answers

Option A is wrong because AWS Config rules only detect and alert on non-compliant security groups; they do not automatically apply or enforce consistent rules across accounts, leaving remediation as a separate manual or automated step. Option B is wrong because creating a custom Python script with AWS SDK introduces significant operational overhead for maintenance, error handling, and periodic execution, and it lacks the native integration with AWS Organizations and centralized policy management that Firewall Manager provides. Option D is wrong because network ACLs are stateless and operate at the subnet level, not the instance level, making them unsuitable for granular, stateful security group-like policies; they also cannot be centrally managed across multiple accounts as easily as Firewall Manager's security group policies.

Full explanation →

1322

MCQhard

A global company has a multi-region AWS deployment. They need to share a single Amazon RDS for MySQL database across multiple AWS Regions for disaster recovery. The database must have minimal data loss and RTO of less than 1 minute. Which solution meets these requirements?

A.Use cross-Region Read Replicas with automatic failover.

B.Use Amazon Aurora Global Database with MySQL compatibility.

C.Use a Multi-AZ RDS instance with a standby in another Region.

D.Use AWS Database Migration Service for continuous replication.

AnswerB

Amazon Aurora Global Database replicates data asynchronously across up to five AWS Regions with typical latency under one second, enabling a Recovery Point Objective (RPO) of seconds and a Recovery Time Objective (RTO) of under one minute by promoting a secondary region to primary. This satisfies the requirement for minimal data loss and sub-minute RTO across multiple Regions for disaster recovery.

Why this answer

Amazon Aurora Global Database with MySQL compatibility is designed for cross-Region disaster recovery with a Recovery Time Objective (RTO) of less than 1 minute and minimal data loss (typically sub-second). It uses storage-based replication that is asynchronous but with very low latency, and it supports a managed failover process that promotes a secondary Region to primary in under a minute, meeting the strict RTO requirement.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is intra-Region) with cross-Region disaster recovery, or assume that cross-Region Read Replicas can achieve sub-minute RTO without understanding the manual promotion and DNS propagation delays inherent in that approach.

How to eliminate wrong answers

Option A is wrong because cross-Region Read Replicas for Amazon RDS for MySQL use asynchronous replication and require manual promotion to become the primary, which cannot guarantee an RTO of less than 1 minute due to the time needed for DNS changes and replication lag. Option C is wrong because Multi-AZ RDS instances only provide high availability within a single AWS Region by placing a standby in a different Availability Zone, not across Regions, so it cannot serve as a cross-Region disaster recovery solution. Option D is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migration tasks, not for automated failover with sub-minute RTO; it requires manual intervention to redirect traffic and does not provide the low-latency replication and automatic failover needed for disaster recovery.

Full explanation →

1323

MCQmedium

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

A.The stack was created in the wrong AWS region.

B.The EC2 instance type is not available in the region.

C.The IAM role used by CloudFormation does not have permission to create EC2 instances.

D.The CloudFormation template has a syntax error.

AnswerC

Insufficient permissions cause resource creation to fail, leading to rollback.

Why this answer

A stack status of ROLLBACK_COMPLETE indicates that CloudFormation successfully initiated resource creation but one or more resources failed, triggering a rollback. The most common cause is that the IAM role associated with the stack lacks permissions to create the required resources (e.g., EC2 instances). A template syntax error would cause a validation error before any resource creation begins, resulting in a status like CREATE_FAILED without a rollback.

Wrong region selection would not cause a rollback after resources start being created; the stack would either succeed or fail due to availability issues. Option C is correct because insufficient IAM permissions are a frequent cause of resource creation failures leading to rollback.

Full explanation →

1324

MCQmedium

A company is migrating a legacy .NET application to AWS. The application currently runs on Windows Server and uses a SQL Server database. The company wants to minimize licensing costs and operational overhead. Which migration strategy should the company use?

A.Replatform using Docker containers on Amazon ECS with Windows containers.

B.Rehost the application on Amazon EC2 Windows instances with SQL Server using License Mobility.

C.Replatform the application by moving the database to Amazon RDS for SQL Server and the application to Elastic Beanstalk.

D.Refactor the application to .NET Core and deploy on Amazon Linux with SQL Server.

AnswerB

Rehosting minimizes changes and can leverage existing licenses through License Mobility.

Why this answer

Rehost the application on Amazon EC2 Windows instances with SQL Server using License Mobility. This approach minimizes licensing costs by allowing the company to bring existing SQL Server licenses to AWS via License Mobility, avoiding new license purchases. It also minimizes operational overhead by requiring no application code changes.

Option A is incorrect because replatforming to Docker containers on ECS with Windows containers adds complexity and may require modifications to the legacy application. Option C is incorrect because moving the database to Amazon RDS for SQL Server reduces operational overhead but licensing costs depend on the license model and may not be minimal. Option D is incorrect because refactoring to .NET Core on Linux requires significant rework, increasing cost and operational overhead.

Full explanation →

1325

Multi-Selectmedium

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

Select 2 answers

A.Use AWS CloudFormation StackSets to enforce service usage.

B.Use an SCP with an Allow effect for allowed services.

C.Use AWS Config rules to detect disallowed services.

D.Use IAM policies in each account to deny services.

E.Use an SCP with a Deny effect for services not allowed.

AnswersB, E

Explicitly allows only specified services.

Why this answer

Service control policies (SCPs) are the correct mechanism to centrally restrict which AWS services can be used across accounts in an AWS Organization. An SCP with an Allow effect explicitly permits only the specified services, while an SCP with a Deny effect blocks the specified services; both approaches achieve the goal of restricting service usage at the OU level. SCPs apply to all IAM users, roles, and root users in the member accounts, making them the appropriate tool for this requirement.

Exam trap

The trap here is that candidates often choose AWS Config rules (option C) thinking detective controls can prevent actions, but Config is reactive and cannot block service usage; only SCPs or IAM permissions boundaries can proactively restrict services.

Full explanation →

1326

Multi-Selecteasy

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Select 2 answers

A.Use a Network Load Balancer instead of an ALB

B.Use an Application Load Balancer with a single target group

C.Configure a health check on the ALB for the target group

D.Use an Auto Scaling group with a minimum of two instances across two Availability Zones

E.Launch all EC2 instances in a single Availability Zone

AnswersC, D

Health checks allow ALB to detect unhealthy instances and stop routing traffic.

Why this answer

Configuring a health check on the ALB for the target group allows the load balancer to periodically send health check requests to each registered EC2 instance. If an instance fails to respond with a healthy status (e.g., HTTP 200) within the configured interval and threshold, the ALB automatically deregisters it and stops routing traffic to it, ensuring high availability and fault tolerance.

Exam trap

The trap here is that candidates often think simply using an ALB or a single target group automatically provides health-based traffic routing, but without explicitly configuring a health check on the target group, the ALB will continue sending traffic to failed instances.

Full explanation →

1327

MCQmedium

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

A.The --filters parameter is incorrectly formatted.

B.The --query parameter is used without specifying --output.

C.The tag value is missing.

D.The AWS CLI version is outdated.

AnswerD

This is correct. Outdated AWS CLI versions do not support the --query parameter. If the version is older than 1.6.0, --query is not a known option, leading to the 'Unknown options' error. Upgrading the AWS CLI resolves the issue.

Why this answer

The 'Unknown options: --query' error occurs when the AWS CLI version is outdated and does not recognize the --query parameter. The --query parameter was introduced in AWS CLI version 1.6.0. If the CLI version is older, it will treat --query as an unknown option.

While it is true that --query often requires --output for proper formatting, the error for missing --output would be different, not 'Unknown options'. Therefore, the most likely cause is an outdated AWS CLI version.

Exam trap

The 'Unknown options: --query' error is most commonly caused by an outdated AWS CLI version that does not support the --query parameter, not by a missing --output parameter. Candidates often incorrectly assume that --query requires explicit --output specification.

How to eliminate wrong answers

Option A is wrong because the `--filters` parameter is correctly formatted in the command (Name=tag:Name,Values=MyInstance) and would not cause an 'Unknown options' error; an incorrectly formatted filter would produce a different error like 'Bad value' or 'Invalid filter'. Option C is wrong because the tag value 'MyInstance' is explicitly provided in the command, so a missing tag value is not the issue. Option D is wrong because the 'Unknown options: --query' error is not related to CLI version; both AWS CLI v1 and v2 support `--query`, but the error occurs only when `--output` is omitted, regardless of version.

Full explanation →

1328

MCQhard

A company is designing a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda function sometimes experiences throttling, causing messages to be sent to the dead-letter queue (DLQ). The company wants to minimize throttling and ensure that messages are processed in order. What should the solutions architect do?

A.Use a standard SQS queue and configure a Lambda function with a higher concurrency limit.

B.Use an SQS FIFO queue with provisioned concurrency on the Lambda function.

C.Increase the batch size in the Lambda event source mapping and use a standard queue.

D.Use a FIFO SQS queue and configure the Lambda function with reserved concurrency.

AnswerD

FIFO queues preserve order. Reserved concurrency prevents throttling by ensuring enough capacity.

Why this answer

Using an SQS FIFO queue guarantees strict message ordering, and reserved concurrency on the Lambda function prevents throttling by allocating a fixed number of concurrent executions exclusively for this function. This combination ensures messages are processed in order without being throttled, avoiding unnecessary DLQ deliveries.

Exam trap

The trap here is confusing provisioned concurrency (which reduces cold starts) with reserved concurrency (which guarantees execution capacity), and assuming standard queues can maintain order when they only offer best-effort ordering.

How to eliminate wrong answers

Option A is wrong because a standard SQS queue does not guarantee message ordering, and simply raising the concurrency limit does not prevent throttling if the account-level concurrency pool is exhausted. Option B is wrong because provisioned concurrency is used to pre-warm execution environments for latency-sensitive workloads, not to prevent throttling; it does not reserve capacity away from other functions. Option C is wrong because increasing the batch size does not address ordering requirements (standard queues lack ordering) and does not mitigate throttling, which is a concurrency management issue.

Full explanation →

1329

Multi-Selecthard

A company is migrating to a multi-account structure and needs to manage DNS resolution across accounts. The company uses Amazon Route 53 private hosted zones. They want a central resolver in the shared services VPC. Which THREE components are required?

Select 3 answers

A.Route 53 Resolver outbound endpoints in each VPC to forward queries to the central resolver.

B.A Transit Gateway connecting all VPCs.

C.Route 53 private hosted zones associated with the shared services VPC.

D.Route 53 Resolver inbound endpoints in the shared services VPC.

E.VPC peering connections between each VPC and the shared services VPC.

AnswersA, B, C

Allows conditional forwarding.

Why this answer

Route 53 Resolver outbound endpoints in each VPC forward DNS queries from those VPCs to the central resolver in the shared services VPC, enabling conditional forwarding for private hosted zones. This is the standard mechanism for cross-account DNS resolution when using a central resolver, as it allows each VPC to send queries to a resolver that can access private hosted zones associated with the shared services VPC.

Exam trap

The trap here is that candidates often confuse inbound and outbound Resolver endpoints, assuming inbound endpoints are needed for forwarding queries from other VPCs, when in fact outbound endpoints are used to send queries out of a VPC to a central resolver.

Full explanation →

1330

MCQmedium

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

A.Amazon EMR

B.Amazon Athena

C.Amazon Redshift

D.AWS Glue

AnswerB

Athena allows serverless SQL queries on S3.

Why this answer

Amazon Athena is a serverless, interactive query service that allows you to run standard SQL queries directly against data stored in Amazon S3 without needing to move or transform the data. It uses Presto under the hood and charges only for the data scanned per query, making it ideal for ad-hoc SQL analysis on a data lake.

Exam trap

The trap here is that candidates often confuse AWS Glue (which catalogs and transforms data but does not run SQL queries) with Athena, or they assume Amazon EMR is required for SQL-on-S3, overlooking Athena's serverless and direct-query capability.

How to eliminate wrong answers

Option A is wrong because Amazon EMR is a managed big data platform that requires you to provision and configure clusters (e.g., Hadoop, Spark) to run SQL via tools like Hive or Presto, which adds operational overhead and does not allow querying data directly without moving it into a separate processing framework. Option C is wrong because Amazon Redshift is a fully managed data warehouse that requires you to load data into its columnar storage before querying, which contradicts the requirement of not moving data to a separate database. Option D is wrong because AWS Glue is a serverless data integration service primarily used for ETL (extract, transform, load) and cataloging metadata via the Glue Data Catalog; it does not provide a direct SQL query engine against S3 data.

Full explanation →

1331

MCQhard

A company is migrating a legacy mainframe application to AWS. The application uses a hierarchical database (IMS) and has complex batch processing jobs. The company wants to minimize changes to the application code. Which approach should be taken?

A.Rehost the application on AWS Mainframe Modernization using Blu Age

B.Replace the application with a SaaS-based ERP system

C.Re-platform the database to Amazon RDS for PostgreSQL

D.Refactor the application to use microservices on Amazon EKS

AnswerA

Minimizes code changes by rehosting mainframe workloads.

Why this answer

AWS Mainframe Modernization with Blu Age allows rehosting legacy mainframe applications with minimal code changes, preserving the existing IMS database and batch processing logic. Option D is incorrect because refactoring to microservices on EKS would require significant code changes. Option B is incorrect because replacing with a SaaS ERP introduces a completely different application.

Option C is incorrect because replatforming the database to RDS still requires changes to adapt the hierarchical IMS to relational.

Full explanation →

1332

MCQhard

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

A.Amazon EFS with One Zone storage classes

B.Amazon EBS with gp3 volume type

C.Amazon S3 with Mountpoint for S3

D.Amazon FSx for Lustre

AnswerC

Correct. S3 with Mountpoint provides highly available, durable shared storage accessible by multiple pods concurrently.

Why this answer

Amazon S3 with Mountpoint for S3 is the correct choice because it provides a fully managed, highly available, and durable object storage that can be accessed by multiple Amazon EKS pods simultaneously via a file system interface. S3 is designed for 99.999999999% durability and 99.99% availability, and Mountpoint allows concurrent read/write access from multiple pods, meeting the RWX access mode requirement. Amazon EFS One Zone (Option A) is not highly available as it resides in a single Availability Zone, Amazon EBS gp3 (Option B) supports only RWO, and Amazon FSx for Lustre (Option D) is optimized for high-performance computing and is not a general-purpose shared storage solution.

Exam trap

The trap is that many candidates choose EFS One Zone, thinking it is highly available, but it is only durable within a single AZ. They overlook that S3 with Mountpoint can also serve as shared, highly available storage for EKS pods.

How to eliminate wrong answers

Option B is wrong because Amazon EBS volumes support only ReadWriteOnce (RWO) access mode, meaning they can be attached to a single pod at a time, not multiple pods simultaneously as required. Option C is wrong because Mountpoint for S3 provides a file-system-like interface to Amazon S3 but does not support POSIX semantics or concurrent write access from multiple pods; it is designed for read-heavy workloads and lacks the consistency guarantees needed for shared persistent storage. Option D is wrong because Amazon FSx for Lustre is a high-performance file system optimized for compute-intensive workloads like HPC and machine learning, not for general-purpose shared storage with high availability and durability requirements; it is typically used with scratch or persistent deployments that are not designed for multi-pod concurrent access in Kubernetes.

Full explanation →

1333

MCQmedium

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

A.The instance launches only if the developer's IAM policy explicitly allows t2.medium.

B.The instance launch is allowed because there is no explicit Allow statement in the SCP.

C.The instance launches successfully because the SCP does not affect IAM users.

D.The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.

AnswerD

Correct interpretation of the Deny with condition.

Why this answer

The SCP explicitly denies all EC2 instance types except t2.micro and t2.small. Since t2.medium is not in the allowed list, the deny effect applies, and the instance launch is blocked. SCPs act as a guardrail that overrides any Allow in IAM policies within the affected accounts.

Exam trap

The trap here is that candidates mistakenly think SCPs only apply to the root user or that an explicit Allow in an IAM policy can override an SCP Deny, but in reality SCPs set a maximum permission boundary that cannot be exceeded by any IAM policy within the account.

How to eliminate wrong answers

Option A is wrong because even if the developer's IAM policy explicitly allows t2.medium, the SCP deny overrides it; SCPs are evaluated before IAM policies and a deny in an SCP cannot be overridden by an IAM Allow. Option B is wrong because the SCP does contain an explicit Deny statement for all instance types except t2.micro and t2.small, so the absence of an explicit Allow is irrelevant; the Deny applies directly. Option C is wrong because SCPs apply to all principals in the account, including IAM users, not just the root user; they affect every identity under the OU.

Full explanation →

1334

Multi-Selectmedium

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

Select 3 answers

A.Configure Amazon RDS Multi-AZ deployments.

B.Use a single Availability Zone for EC2 instances to simplify failover.

C.Implement a Pilot Light strategy by replicating data to a secondary region and launching resources on failover.

D.Store backups in Amazon S3 Glacier.

E.Use Amazon EBS cross-region snapshot copy to replicate data.

AnswersA, C, E

Multi-AZ provides automatic failover with RTO typically under 1 minute and RPO of seconds.

Why this answer

Amazon RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone, enabling automatic failover with an RTO typically under 1-2 minutes and an RPO of effectively zero, which meets the 15-minute RTO and 1-minute RPO requirements for the database tier.

Exam trap

The trap here is that candidates often confuse Pilot Light with Warm Standby or Multi-Site, and may incorrectly assume that using a single AZ or Glacier backups can meet aggressive RTO/RPO targets, when in fact they introduce unacceptable latency or single points of failure.

Full explanation →

1335

MCQeasy

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

A.All versions of the object are permanently deleted.

B.The delete marker is removed, and the object becomes current again.

C.The object is permanently deleted along with the delete marker.

D.The previous version is permanently deleted, but the delete marker remains.

AnswerD

Noncurrent version expires.

Why this answer

The lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted, but the delete marker remains.

Option A is wrong because the delete marker is not permanently deleted. Option B is wrong because the delete marker is not removed and the object does not become current again. Option C is wrong because only the noncurrent version is permanently deleted, not the delete marker.

Full explanation →

1336

MCQhard

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

A.Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption

B.Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation

C.Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption

D.Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts

AnswerB

Provides continuous compliance and automatic remediation across the organization.

Why this answer

AWS Config conformance packs with remediation via Systems Manager Automation can be deployed across all accounts in an AWS Organization. This allows automatic detection and remediation of non-compliant S3 buckets (e.g., lacking encryption or having public read access) in near real-time, providing a scalable and operationally efficient solution without custom code. Option A (SCPs) can prevent public access policies but cannot enforce encryption on existing buckets.

Option C (CloudWatch Events) requires per-account setup and custom Lambda functions, and does not cover bucket modifications. Option D (daily Lambda scans) is not real-time and does not provide automatic remediation.

Full explanation →

1337

Multi-Selecthard

A company uses AWS Organizations with a central security account. They need to ensure that any S3 bucket created in any account is configured with encryption and versioning enabled. Which THREE steps should they take?

Select 3 answers

A.Create IAM policies in each account that require encryption and versioning for any bucket creation.

B.Use AWS CloudFormation StackSets to deploy a stack in each account that creates a bucket with encryption and versioning, and use SCPs to prevent deletion.

C.Deploy AWS Config rules across all accounts to detect buckets without encryption or versioning and trigger auto-remediation.

D.Apply a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified.

E.Use AWS CloudTrail to monitor bucket creation and send alerts.

AnswersB, C, D

Ensures a compliant bucket exists.

Why this answer

AWS CloudFormation StackSets allow you to deploy a standardized stack across multiple accounts in an organization, ensuring that any bucket created by the stack has encryption and versioning enabled. Combining this with a service control policy (SCP) that denies s3:CreateBucket unless encryption and versioning are specified (Option D) provides a preventive guardrail at the organization level. Additionally, deploying AWS Config rules with auto-remediation (Option C) acts as a detective and corrective measure, ensuring compliance even if buckets are created outside the approved stack.

Exam trap

The trap here is that candidates often think IAM policies alone can enforce resource configuration parameters, but IAM only controls permissions, not the actual values passed in the API call, which requires SCPs or service-specific controls.

Full explanation →

1338

MCQeasy

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

A.Use AWS Global Accelerator with endpoints pointing to the S3 bucket.

B.Deploy EC2 instances in multiple Regions and use a load balancer.

C.Use Amazon CloudFront with the S3 bucket as the origin.

D.Host the content directly from the S3 bucket and use S3 Transfer Acceleration.

AnswerC

CloudFront caches content at edge locations, reducing latency and data transfer costs.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.

Exam trap

The trap here is that candidates confuse AWS Global Accelerator (which optimizes network path but does not cache) with a CDN like CloudFront, or mistakenly think S3 Transfer Acceleration improves download performance for end users when it only accelerates uploads to S3.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves TCP/UDP traffic performance via the AWS global network but does not cache content; it would still require all requests to reach the S3 bucket, increasing latency and costs compared to a CDN. Option B is wrong because deploying EC2 instances in multiple Regions to serve static content introduces unnecessary compute costs, management overhead, and complexity, while a CDN like CloudFront provides caching at edge locations more efficiently. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache or accelerate downloads for end users; it would not reduce latency for serving content globally and can incur higher costs per GB transferred.

Full explanation →

1339

Multi-Selecthard

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

Select 3 answers

A.EC2 instances with enhanced networking and high-throughput (e.g., p4d, p3dn)

B.VPC peering between multiple VPCs

C.AWS Global Accelerator

D.Placement Groups (Cluster Placement Group)

E.Elastic Fabric Adapter (EFA)

AnswersA, D, E

These instance types offer high network bandwidth and EFA support.

Why this answer

EC2 instances like p4d and p3dn are designed for HPC workloads, offering enhanced networking (up to 100 Gbps) and high-throughput capabilities. These instances support Elastic Fabric Adapter (EFA) and are optimized for tightly coupled inter-node communication, providing the low latency and high bandwidth required for HPC.

Exam trap

The trap here is that candidates may confuse VPC peering or Global Accelerator as solutions for inter-node latency, but these services address different problems (cross-VPC connectivity and global traffic optimization) and do not reduce latency for tightly coupled HPC communication within a single cluster.

Full explanation →

1340

MCQeasy

An organization is planning to migrate a large number of on-premises virtual machines to AWS. The migration must be automated and support replication of live workloads with minimal downtime. Which AWS service is best suited for this task?

A.AWS DataSync

B.AWS Application Migration Service (MGN)

C.AWS Server Migration Service (SMS)

D.AWS Database Migration Service (DMS)

AnswerB

MGN automates lift-and-shift migration with continuous replication and minimal downtime.

Why this answer

(AWS Application Migration Service) is correct as it automates lift-and-shift migration with continuous replication and cutover. Option A (AWS DataSync) is for data transfer, not live VM replication. Option C (AWS Server Migration Service) is legacy and less capable.

Option D (AWS Database Migration Service) is for databases, not general VM migration.

Full explanation →

1341

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

A.Increase the instance size to handle the load.

B.Enable detailed monitoring on the EC2 instances.

C.Add a scaling policy based on CPU utilization.

D.Enable AWS CloudTrail to log EC2 API calls.

AnswerB

Detailed monitoring provides metrics at 1-minute granularity, helping to identify when spikes occur.

Why this answer

Enabling detailed monitoring on EC2 instances provides CloudWatch metrics at a 1-minute granularity, which is crucial for identifying the exact timing and duration of CPU spikes. The intermittent nature of the latency spikes and the lack of correlation with request count suggest that the root cause may be a specific process or internal instance activity. Detailed monitoring allows for more precise analysis of CPU usage patterns, helping to isolate the cause.

Option A is incorrect because increasing instance size only masks the symptom without addressing the underlying issue. Option C is incorrect because scaling policies respond to sustained high CPU utilization, not intermittent spikes, and would not help identify the root cause. Option D is incorrect because CloudTrail logs API calls and does not provide instance-level metric data needed to diagnose CPU spikes.

Full explanation →

1342

MCQeasy

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

A.Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.

B.Use IAM roles to grant developers access only to their own resources.

C.Use AWS Config rules to detect changes to networking resources.

D.Use resource tags to identify networking resources and apply IAM conditions.

AnswerA

SCPs can block specific actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) allow the central IT team to define a permission guardrail that explicitly denies actions on networking resources (e.g., ec2:CreateVpc, ec2:DeleteSubnet) for developer accounts. SCPs are applied at the account or organizational unit level and cannot be overridden by any IAM policy within the account, ensuring developers cannot modify networking resources even if they have full administrative access.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config) with preventive controls (SCPs), or assume IAM roles alone can enforce cross-account restrictions without understanding that SCPs are the only mechanism to set a centralized permission boundary that cannot be bypassed by account administrators.

How to eliminate wrong answers

Option B is wrong because IAM roles grant permissions within an account but do not prevent developers from modifying networking resources if the role includes those permissions; they also cannot enforce restrictions across multiple accounts from a central point. Option C is wrong because AWS Config rules are detective, not preventive—they can detect changes to networking resources after they occur but cannot block the modification itself. Option D is wrong because resource tags combined with IAM conditions can restrict actions based on tags, but developers could still modify networking resources if they have permission to change tags or if the resources are not tagged; this approach is not a centralized, enforceable guardrail like SCPs.

Full explanation →

1343

MCQmedium

A company is migrating a multi-tier web application to AWS. The application uses a commercial database that requires a license. The company wants to reduce licensing costs. Which migration strategy should be considered?

A.Rehost the database to EC2 with the same database software

B.Replatform the database to Amazon RDS for an open-source engine like PostgreSQL

C.Repurchase a Software as a Service (SaaS) alternative

D.Refactor the application to use Amazon DynamoDB

AnswerB

Eliminates commercial license costs, minimal changes.

Why this answer

(Replatform the database to Amazon RDS for an open-source engine like PostgreSQL) is correct because migrating to an open-source database on Amazon RDS eliminates the need for commercial licenses, thereby reducing licensing costs. Option A (Rehost) is incorrect because it retains the same commercial database software, so licensing costs remain. Option C (Repurchase to SaaS) may not be applicable or cost-effective for the database.

Option D (Refactor to DynamoDB) typically requires significant application changes and may not align with a license cost reduction goal.

Full explanation →

1344

MCQhard

A media company runs a video processing pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The first Lambda function downloads a video file from an S3 bucket, the second transcodes it using AWS Elemental MediaConvert, and the third uploads the transcoded files to a different S3 bucket. Recently, the pipeline has been failing intermittently with 'State machine execution timed out' errors. The Step Functions execution history shows that the first Lambda function takes up to 25 minutes to complete for large video files. The Step Functions state machine has a default execution timeout of 5 minutes. The company wants to fix the timeout issue without redesigning the entire pipeline. Which solution should the solutions architect recommend?

A.Increase the 'timeoutSeconds' value in the Step Functions state machine definition to 1800 (30 minutes) or more.

B.Increase the Lambda function timeout to 30 minutes in the Lambda configuration.

C.Increase the Lambda function timeout to 15 minutes and increase the state machine execution timeout to 30 minutes.

D.Replace the Lambda function with an Amazon SQS queue and have the Step Functions wait for a callback.

AnswerD

Replacing the Lambda function with an SQS queue and using a callback pattern allows the long-running download task to be processed asynchronously by a worker that can run for more than 15 minutes, without redesigning the entire pipeline. Step Functions waits for the callback, avoiding both the Lambda timeout and the state machine execution timeout.

Why this answer

The Lambda function has a maximum timeout of 15 minutes, so increasing the state machine timeout alone (Option A) does not solve the Lambda function's inability to run for 25 minutes. Replacing the Lambda with an SQS queue allows the long-running task to be processed asynchronously, with Step Functions waiting for a callback, avoiding the Lambda timeout limit and the state machine timeout error. Options B and C are invalid because Lambda cannot be configured beyond 15 minutes: setting it to 30 or 15 minutes still fails for a 25-minute task.

Option D changes only the problematic component, meeting the requirement to fix the issue without redesigning the entire pipeline.

Exam trap

Candidates often forget that Lambda has a hard timeout of 15 minutes. Simply increasing the state machine timeout does not fix the underlying Lambda timeout.

Full explanation →

1345

MCQhard

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

A.The second interface is not attached to the instance.

B.The second interface has a device index of 0.

C.The command only returns interfaces that are attached.

D.The second interface is associated with a different security group.

AnswerD

Filter limits to sg-12345678.

Why this answer

The command filters by security group ID, so only interfaces in that group are shown. The second interface may belong to a different security group. Option A is wrong because the filter is by group-id, not instance-id.

Option B is wrong because the command does not filter by device index. Option C is wrong because the command can list all interfaces in the group regardless of attachment.

Full explanation →

1346

MCQeasy

A company is migrating a web application to AWS and wants to decouple the frontend and backend tiers to improve scalability. The frontend runs on Amazon EC2 behind an Application Load Balancer (ALB). The backend processes orders asynchronously. Which service should the company use to decouple the tiers?

A.Amazon MQ

B.Amazon Simple Queue Service (SQS)

C.Amazon Simple Notification Service (SNS)

D.Amazon Kinesis Data Streams

AnswerB

SQS provides a fully managed message queue for asynchronous processing.

Why this answer

For decoupling frontend and backend asynchronously, Amazon Simple Queue Service (SQS) is the appropriate service. It allows the frontend to send order messages to a queue, and the backend components poll and process them independently. Option A (Amazon MQ) is a managed message broker for existing protocols like JMS, but SQS is simpler and more scalable for this use case.

Option C (Amazon SNS) is a pub/sub service, not designed for point-to-point decoupling with pull-based consumers. Option D (Amazon Kinesis Data Streams) is for real-time streaming data, not for decoupling web tiers.

Full explanation →

1347

MCQeasy

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

A.It denies all actions if the request is not made over HTTPS.

B.It denies all actions if the request does not include multi-factor authentication.

C.It denies all actions from IP addresses outside the corporate network.

D.It allows all actions as long as the request is made over HTTPS.

AnswerA

The condition aws:SecureTransport false denies non-HTTPS requests.

Why this answer

This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS.

Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Full explanation →

1348

Multi-Selecthard

A company has a multi-account architecture with a shared services account that hosts a central Amazon RDS instance. Member accounts need to access this database. Which TWO actions should the company take to enable secure access?

Select 2 answers

A.Create a Transit Gateway and attach all VPCs to it, then use route tables to enable connectivity.

B.Use AWS Lambda to proxy database requests from member accounts.

C.Configure the RDS security group to allow inbound traffic from the member account VPC CIDRs.

D.Make the RDS instance publicly accessible and use IAM authentication.

E.Create a VPC peering connection between each member VPC and the shared services VPC.

AnswersA, C

Centralized connectivity for many VPCs.

Why this answer

AWS Transit Gateway acts as a central hub that allows you to connect multiple VPCs (including member account VPCs and the shared services VPC) in a scalable, managed way. By attaching all VPCs to the Transit Gateway and configuring route tables, you enable private, secure connectivity between member accounts and the central RDS instance without requiring individual VPC peering connections or exposing the database to the internet.

Exam trap

The trap here is that candidates often default to VPC peering (Option E) because it is a familiar concept, but they overlook that Transit Gateway (Option A) is the scalable, managed solution for connecting many VPCs in a multi-account environment, as tested in the SAP-C02 exam's organizational complexity domain.

Full explanation →

1349

MCQeasy

A company is migrating a monolithic application to microservices on AWS. They want to implement a continuous improvement process for existing services. Which AWS service should they use to collect and analyze operational metrics and logs from all microservices in a centralized location?

A.AWS Config

B.Amazon Inspector

C.Amazon CloudWatch

D.AWS X-Ray

AnswerC

CloudWatch provides centralized metrics and logs.

Why this answer

Amazon CloudWatch provides centralized monitoring of metrics and logs from all microservices. Option A is wrong because AWS Config tracks configuration changes and compliance, not operational metrics. Option B is wrong because Amazon Inspector performs automated security assessments, not log/metrics collection.

Option D is wrong because AWS X-Ray is used for tracing requests across services, not for centralized log and metric analysis.

Full explanation →

1350

Multi-Selecthard

A company wants to use AWS Resource Access Manager (RAM) to share a subnet in a VPC with other accounts in the organization. Which of the following are required? (Choose THREE.)

Select 3 answers

A.The subnet must be created by the owning account.

B.The consumer accounts must accept the resource share invitation.

C.The VPC must be in the same AWS Region as the shared subnet.

D.Each consumer account must create a subnet in the same VPC.

E.Enable VPC sharing in the AWS Organizations console.

AnswersA, B, C

The owner creates the subnet to share.

Why this answer

AWS Resource Access Manager (RAM) requires the subnet to be created by the owning account. The owning account creates the subnet in its own VPC and then shares it via RAM. Consumer accounts cannot share subnets they did not create; they can only use the shared subnet to launch resources.

Exam trap

The trap here is that candidates often think VPC sharing requires enabling a feature in the Organizations console, but RAM handles the sharing directly without any Organizations-level toggle, and they also mistakenly believe consumer accounts must create subnets to use them.

Full explanation →

Page 18 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →