Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1351–1425

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 19 of 23

1351

MCQmedium

A company uses AWS Organizations with multiple OUs. The DevOps team wants to allow developers in a specific OU to create and manage their own VPCs but restrict them from deleting VPCs created by the central networking team. How can this be achieved?

A.Use AWS Config rules to automatically recreate any VPC that is deleted.

B.Use a resource-based policy on each centrally created VPC to deny ec2:DeleteVpc to the developers' roles.

C.Create an SCP for the developers' OU that denies ec2:DeleteVpc for all VPCs.

D.Create an IAM policy for developers that denies ec2:DeleteVpc unless the VPC has a specific tag.

AnswerD

Correct. An IAM policy with a condition key (e.g., based on a tag) can allow or deny the ec2:DeleteVpc action selectively. Developers can delete only VPCs that have a specific tag, while centrally created VPCs without that tag are protected from deletion.

Why this answer

VPCs do not support resource-based policies (making Option B invalid). An IAM policy with a condition based on a tag can effectively restrict deletion. For example, developers can be allowed to delete VPCs only if the VPC has a specific tag (e.g., 'AllowDeletion: true'), which they can add to their own VPCs.

Centrally created VPCs would lack this tag, so deletion is denied. This provides granular control without affecting other permissions.

Exam trap

The key trap is that candidates often think resource-based policies (Option B) can be applied to VPCs, but VPCs do not support them. Instead, tag-based conditions in IAM policies or SCPs are the correct mechanisms for selective denial.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive and can only detect and remediate non-compliant resources after the fact; they cannot prevent the deletion from occurring in the first place, and automatically recreating a VPC does not meet the requirement to restrict deletion. Option C is wrong because an SCP that denies ec2:DeleteVpc for all VPCs would also prevent developers from deleting their own VPCs, which is overly restrictive and does not allow developers to manage their own VPCs as required. Option D is wrong because an IAM policy that denies ec2:DeleteVpc unless the VPC has a specific tag can be circumvented if developers add that tag to centrally created VPCs before deleting them, and it does not provide a reliable mechanism to distinguish centrally created VPCs from developer-created VPCs.

Full explanation →

1352

MCQeasy

Refer to the exhibit. A company has an Amazon ECS task definition with two containers. The 'web' container is essential, and the 'sidecar' container is not. The 'sidecar' container exits unexpectedly. What will happen to the task?

A.The sidecar container will be marked as essential.

B.ECS will automatically restart the sidecar container.

C.The task continues running as normal.

D.The ECS task will be stopped.

AnswerC

Non-essential container failure does not affect the task.

Why this answer

Non-essential containers can fail without affecting the task. Option A is wrong because only essential container failure stops the task. Option B is wrong because ECS will not restart a non-essential container by default; it depends on the task definition restart policy.

Option D is wrong because the sidecar's CPU=0 means it can use up to the available CPU, but it still runs.

Full explanation →

1353

MCQhard

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

A.The application VPCs have route tables that override the transit gateway routes with local routes.

B.The VPN connection is not configured to advertise the on-premises CIDR to the transit gateway.

C.The application VPCs have security groups that block traffic to the on-premises network.

D.The transit gateway route tables are not associated with the application VPC attachments.

AnswerD

For routes to be effective, the transit gateway route table that contains the VPN routes must be associated with the VPC attachments; otherwise, they won't receive the routes.

Why this answer

The most likely cause is that the transit gateway route tables are not associated with the application VPC attachments. Even if the VPN routes are propagated into the transit gateway route tables, the application VPCs will not receive those routes unless their VPC attachments are explicitly associated with the correct transit gateway route table. Without this association, the transit gateway does not propagate routes to the attached VPCs, leaving them unable to reach the on-premises network.

Exam trap

The trap here is confusing route propagation with route table association — candidates often assume that if routes are propagated into the transit gateway route table, all attached VPCs automatically receive them, but AWS requires an explicit association between the VPC attachment and the route table for route distribution.

How to eliminate wrong answers

Option A is wrong because local routes in VPC route tables have a higher priority than transit gateway routes by default, but the question states the application VPCs are not receiving the routes at all, not that they are being overridden. Option B is wrong because the network team confirmed that routes are propagated in the transit gateway route tables, meaning the VPN is correctly advertising the on-premises CIDR to the transit gateway. Option C is wrong because security groups operate at the instance level, not at the VPC routing level, and the issue is about route propagation, not traffic filtering.

Full explanation →

1354

MCQeasy

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

A.AWS Control Tower

B.Delegated administrator for AWS services

C.Cross-account IAM roles

D.AWS CloudTrail organization trail

AnswerB

This allows a member account to administer services like GuardDuty, Macie, etc., across the organization.

Why this answer

Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Exam trap

The trap here is that candidates often confuse the broad, role-based access of cross-account IAM roles (Option C) with the specific, service-level delegation model of delegated administrators, leading them to overlook the AWS Organizations-native feature designed for this exact purpose.

How to eliminate wrong answers

Option A is wrong because AWS Control Tower is a service for setting up and governing a multi-account environment using pre-built blueprints and guardrails, not for delegating administrative tasks for specific AWS services to a member account. Option C is wrong because cross-account IAM roles provide broad, role-based access to resources in another account but are not designed for the specific, service-level delegation model that AWS Organizations supports for delegated administrators. Option D is wrong because AWS CloudTrail organization trail logs API activity across all accounts in the organization for auditing, not for delegating administrative tasks for specific services.

Full explanation →

1355

MCQeasy

A company wants to migrate 500 TB of data from an on-premises data center to Amazon S3. The company has a 1 Gbps dedicated network connection to AWS. What is the most cost-effective and time-efficient migration method?

A.Use AWS Snowball Edge to physically ship the data to AWS.

B.Use S3 Transfer Acceleration to upload data over the existing internet connection.

C.Use AWS DataSync to transfer data over the dedicated network.

D.Establish an AWS Direct Connect connection and use S3 multipart upload.

AnswerA

Snowball Edge provides fast, secure physical transfer; economical for large datasets.

Why this answer

AWS Snowball Edge is the most cost-effective and time-efficient method for migrating 500 TB of data over a 1 Gbps dedicated connection. At 1 Gbps, the theoretical maximum transfer time for 500 TB is over 46 days, not accounting for overhead and network issues. Snowball Edge physically ships the data, avoiding network transfer delays.

Option B is wrong because S3 Transfer Acceleration still uses the network and does not reduce the transfer time sufficiently for 500 TB. Option C is wrong because AWS DataSync is optimized for smaller, ongoing transfers and would still be limited by the 1 Gbps link. Option D is wrong because Direct Connect provides a dedicated network connection but still requires transferring data over the network, which would take many days.

Full explanation →

1356

MCQhard

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

A.That the database password has not been rotated.

B.That the Lambda function's reserved concurrency is not set to zero.

C.That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.

D.That the Lambda function's environment variables are correctly set.

AnswerC

If the database is in a private subnet, a NAT gateway is needed for the Lambda function to access it.

Why this answer

When a Lambda function is configured with VPC access, it can communicate with RDS instances within the same VPC (or peered VPCs) using private IP addresses, assuming proper security group and network ACL rules. The most likely cause of a timeout after a change is a missing route in the Lambda function's subnet's route table to the RDS subnet. NAT gateways are only required for internet access, and VPC endpoints are for AWS services (not RDS).

Therefore, the administrator should first verify that the Lambda function's subnet has a route to the database's subnet. No password rotation, concurrency, or environment variable issue would cause a network timeout.

Full explanation →

1357

MCQhard

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

A.The Lambda function is running out of memory.

B.The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.

C.The Lambda function is hitting the reserved concurrency limit.

D.The Lambda function is using an incompatible runtime.

AnswerB

The pattern matches a timeout and retry cycle.

Why this answer

The pattern of errors occurring exactly at 00:10, 00:30, and 00:50 (20-minute intervals) indicates that the Lambda function is timing out after processing for a long duration, and the SQS visibility timeout is set to 20 minutes. When the function times out, the message becomes visible again in the queue after the visibility timeout, leading to a retry. This results in errors at regular intervals.

Option A is incorrect because memory exhaustion would cause out-of-memory errors, not timeouts. Option C is incorrect because hitting reserved concurrency would cause throttles (e.g., 429 errors), not function errors. Option D is incorrect because an incompatible runtime would cause all invocations to fail immediately, not in a pattern.

Full explanation →

1358

MCQmedium

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

A.Define cost allocation tags in the management account and activate them for all accounts.

B.Use AWS Config rules to automatically tag resources after creation.

C.Use an SCP that denies resource creation if the required tags are not present.

D.Use tag policies in AWS Organizations to enforce required tags on resources.

AnswerD

Tag policies can enforce tagging across all accounts.

Why this answer

Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.

Exam trap

The trap here is that candidates often confuse tag policies with SCPs or AWS Config rules, thinking that SCPs alone can enforce tag requirements, but SCPs only block actions based on existing tags and cannot enforce tag key presence for all services, whereas tag policies provide a centralized, organization-wide mechanism for defining and enforcing tag schemas.

How to eliminate wrong answers

Option A is wrong because cost allocation tags defined in the management account are not automatically propagated to member accounts; each account must activate them individually, and they only apply to billing reports, not to resource creation enforcement. Option B is wrong because AWS Config rules can only detect and remediate noncompliant resources after creation (e.g., via auto-remediation), but they do not prevent the creation of untagged resources in the first place, leading to potential gaps. Option C is wrong because SCPs can deny resource creation based on the absence of tags only if the service supports condition keys for tags in the IAM policy evaluation; not all services support this, and SCPs cannot enforce tag keys or values—they can only block actions based on existing tags.

Full explanation →

1359

MCQhard

A company uses AWS Organizations and has deployed a multi-account strategy. The security team wants to enforce that all S3 buckets have versioning enabled. They create an SCP that denies the PutBucketVersioning action if versioning is not enabled. However, they find that the SCP is not preventing users in member accounts from disabling versioning on existing buckets. What is the most likely reason?

A.The SCP is overridden by a service control policy that allows the action.

B.The SCP does not have an explicit deny; it uses a default deny.

C.SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters.

D.The SCP is not applied to the root organizational unit.

AnswerC

SCPs cannot check existing bucket configuration.

Why this answer

The most likely reason is option C: SCPs cannot evaluate the current state of a resource; they can only deny actions based on request parameters. SCPs do not have visibility into the current configuration of resources like S3 bucket versioning. Therefore, an SCP that attempts to deny PutBucketVersioning if versioning is not enabled cannot work because it cannot check the bucket's current versioning status.

This allows users to disable versioning. Option A is incorrect because SCPs are hierarchical and cannot be overridden by another SCP unless there is an explicit allow, but the core issue is the condition evaluation. Option B is incorrect because SCPs use explicit deny, not a default deny.

Option D is incorrect because applying the SCP to the root OU would not resolve the fundamental limitation that SCPs cannot check resource state.

Full explanation →

1360

MCQeasy

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

A.Host the frontend and backend on a single EC2 instance using Amazon Lightsail.

B.Host the frontend on Amazon S3 with static website hosting and the backend as AWS Lambda functions behind Amazon API Gateway.

C.Host the frontend on EC2 instances behind an ALB and the backend on EC2 instances behind another ALB.

D.Host the frontend on S3 and the backend on Amazon Elastic Beanstalk with a load balancer.

AnswerB

Serverless architecture minimizes operational overhead and scales automatically.

Why this answer

S3 for static hosting and API Gateway with Lambda provides a serverless, scalable solution with low overhead. Option A is wrong because EC2 requires management. Option C is wrong because Lightsail has limited scalability.

Option D is wrong because Elastic Beanstalk has more overhead than serverless.

Full explanation →

1361

Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. Which TWO benefits does this approach provide? (Choose TWO.)

Select 2 answers

A.Centrally enforce policies using service control policies (SCPs).

B.Automatically create VPC peering connections between accounts.

C.Simplify cross-region replication for Amazon RDS databases.

D.Isolate workloads and provide a boundary for security and cost management.

E.Reduce the total cost of EC2 instances by aggregating usage across accounts.

AnswersA, D

SCPs apply to all accounts in the organization.

Why this answer

Service control policies (SCPs) allow you to centrally manage permissions for all accounts in your AWS Organizations hierarchy. SCPs act as a guardrail, enabling you to define the maximum available permissions for IAM roles and users across member accounts without granting any permissions themselves. This ensures consistent enforcement of security and compliance policies across the entire organization.

Exam trap

The trap here is that candidates often confuse consolidated billing with direct cost reduction for EC2 instances, not realizing that aggregation only enables volume discounts and does not lower the per-instance price automatically.

Full explanation →

1362

Multi-Selecteasy

A company is planning to migrate its on-premises infrastructure to AWS. The company wants to assess the current environment and create a migration plan. Which TWO AWS services should be used for discovery and assessment?

Select 2 answers

A.AWS Server Migration Service (SMS)

B.AWS Migration Hub

C.Amazon CloudWatch

D.AWS Application Discovery Service

E.AWS Trusted Advisor

AnswersB, D

AWS Migration Hub provides a single place to track the progress of application migrations across multiple AWS and partner solutions, including discovery data from Application Discovery Service, making it useful for assessment and planning.

Why this answer

For discovery and assessment of on-premises infrastructure, AWS Application Discovery Service (Option D) automatically discovers servers and application dependencies, while AWS Migration Hub (Option B) provides a centralized view to track migrations and integrates with discovery data. AWS Server Migration Service (Option A) is a replication tool for migrating servers, not a discovery service, and it has been deprecated. Amazon CloudWatch (Option C) is a monitoring service, and AWS Trusted Advisor (Option E) provides best practice recommendations; neither performs discovery.

Exam trap

Candidates may assume AWS Server Migration Service (SMS) is a discovery tool because of its name, but it is actually a replication service used for migrating servers. Discovery is better handled by AWS Application Discovery Service.

Full explanation →

1363

MCQmedium

A company is designing a data lake on AWS using Amazon S3. They need to query the data using standard SQL without moving it to a separate analytics store. Which AWS service should they use?

A.Amazon Athena

B.AWS Glue

C.Amazon QuickSight

D.Amazon Redshift Spectrum

AnswerA

Athena is serverless, queries S3 directly with SQL.

Why this answer

Amazon Athena is correct because it is a serverless interactive query service that uses standard SQL to query data directly in Amazon S3 without requiring any infrastructure or data movement. Option B (AWS Glue) is primarily used for ETL and data cataloging, not for ad hoc querying. Option C (Amazon QuickSight) is a business intelligence tool for visualization, not direct SQL querying.

Option D (Amazon Redshift Spectrum) can query S3 data but requires an active Amazon Redshift cluster, making it not as simple or serverless as Athena for this use case.

Full explanation →

1364

MCQhard

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

A.Create an IAM policy in each account that requires the tag for ec2:RunInstances.

B.Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.

C.Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

D.Configure the EC2 service to automatically add the tag to all instances.

AnswerB

SCPs can conditionally deny actions based on tags.

Why this answer

A Service Control Policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the ec2:RunInstances action unless the request includes the required 'CostCenter' tag. This enforces the tagging requirement across all accounts in the organization without needing per-account IAM policies, and it cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config) with preventive controls (like SCPs), or assume that IAM policies in each account are sufficient for centralized enforcement, overlooking the fact that SCPs are the only mechanism that can enforce policies across all accounts in an organization without being overridden.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be modified or removed by account administrators, so they do not provide centralized enforcement across a multi-account environment. Option C is wrong because AWS Config rules are detective, not preventive; they can detect untagged instances after launch but cannot block the creation of untagged instances, which violates the security team's requirement to enforce tagging at launch time. Option D is wrong because the EC2 service does not have a native feature to automatically add tags to all instances; tags must be explicitly provided in the RunInstances request or added via automation after launch.

Full explanation →

1365

MCQmedium

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

A.Assign a public IP to the Lambda function and route through an Internet Gateway.

B.Configure the Lambda function to access the VPC and use a VPC endpoint for S3.

C.Use Lambda@Edge to process data at the edge location.

D.Place the Lambda function in a public subnet and use a NAT Gateway.

AnswerB

VPC access enables private connectivity to VPC resources; VPC endpoint keeps S3 traffic private.

Why this answer

It allows the Lambda function to be attached to a VPC, enabling it to access the VPC-hosted database securely over private IP addresses. Additionally, using a VPC endpoint for S3 ensures that data transfer between Lambda and the S3 buckets remains within the AWS network, avoiding public internet exposure and reducing data transfer costs.

Exam trap

The trap here is that candidates may think Lambda functions can be assigned public IPs or placed in public subnets like EC2 instances, but Lambda's VPC integration uses ENIs and requires private subnets, and the most secure way to access S3 from within a VPC is via a VPC endpoint, not a NAT Gateway.

How to eliminate wrong answers

Option A is wrong because assigning a public IP to a Lambda function is not supported; Lambda functions cannot have public IPs, and routing through an Internet Gateway would expose traffic to the public internet, violating security best practices. Option C is wrong because Lambda@Edge is designed for content distribution and edge processing with CloudFront, not for accessing VPC-hosted databases, and it cannot be configured to access VPC resources. Option D is wrong because placing a Lambda function in a public subnet is not possible; Lambda functions are attached to VPC subnets but do not have public IPs, and using a NAT Gateway would still route traffic through the public internet for S3 access, which is less secure and more costly than using a VPC endpoint.

Full explanation →

1366

MCQmedium

A company has a production Amazon ECS service running on Fargate. The service needs to be updated to use a new task definition with different environment variables. The company wants to perform a rolling update with minimal impact. What is the correct way to update the service?

A.Delete the existing service and recreate it with the new task definition.

B.Modify the task definition and then restart the service.

C.Update the service with the new task definition and use a rolling update deployment controller.

D.Create a new service with the new task definition and delete the old one.

AnswerC

Rolling update replaces tasks gradually.

Why this answer

Updating the ECS service with the new task definition while using the rolling update deployment controller performs a rolling update with minimal downtime. Option A is wrong because deleting and recreating the service causes downtime. Option B is wrong because modifying the task definition alone does not trigger a deployment; you must update the service to use the new revision.

Option D is wrong because creating a new service duplicates resources and is unnecessary.

Full explanation →

1367

MCQhard

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

A.Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

B.Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

C.Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

D.Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.

AnswerD

Flink provides exactly-once processing and handles late data.

Why this answer

Amazon Kinesis Data Analytics for Apache Flink provides built-in support for windowed aggregations, exactly-once processing semantics, and handling late-arriving data via allowed lateness and watermarking. It can output processed results directly to Amazon S3 using a Flink sink, meeting all requirements for a real-time analytics platform.

Exam trap

The trap here is that candidates often choose AWS Lambda or Kinesis Data Firehose for simplicity, overlooking the need for stateful windowed aggregations and exactly-once processing, which are not natively supported by those services.

How to eliminate wrong answers

Option A is wrong because Kinesis Data Firehose is a near-real-time ingestion service that does not support custom windowed aggregations or exactly-once processing; it delivers data with at-least-once semantics. Option B is wrong because Amazon EMR with Spark Streaming can process streaming data but does not natively provide exactly-once processing semantics without additional configuration (e.g., checkpointing and idempotent sinks), and it is not the simplest managed service for this use case. Option C is wrong because AWS Lambda processes records from Kinesis Data Streams but has a maximum execution timeout of 15 minutes and does not support stateful windowed aggregations or exactly-once processing; it is designed for lightweight, stateless transformations.

Full explanation →

1368

MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to automatically roll back a stack update if it fails, and receive a notification. What should be configured to meet these requirements?

A.Use AWS CloudTrail to monitor the UpdateStack API call and trigger a rollback via a Lambda function.

B.Use AWS Config rules to detect stack failure and revert changes.

C.Enable rollback on failure in the CloudFormation stack and configure an SNS notification topic.

D.Create a custom resource in the CloudFormation template that performs rollback.

AnswerC

CloudFormation can automatically roll back on failure and send SNS notifications.

Why this answer

CloudFormation natively supports automatic rollback on stack update failure via the 'Rollback on failure' setting. By configuring an SNS notification topic on the stack, the operations team receives alerts when a rollback occurs, meeting both requirements without additional custom logic.

Exam trap

The trap here is that candidates may overcomplicate the solution by adding unnecessary services like Lambda or Config, overlooking CloudFormation's native rollback and notification capabilities that directly satisfy the requirements.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail logs API calls but does not trigger actions directly; invoking a Lambda function from CloudTrail would require additional Amazon EventBridge rules and custom rollback logic, which is unnecessary when CloudFormation provides built-in rollback. Option B is wrong because AWS Config rules evaluate resource compliance against desired configurations and cannot detect stack update failures or revert changes; they are designed for continuous compliance, not stack lifecycle management. Option D is wrong because a custom resource in a CloudFormation template runs during stack operations but cannot perform a rollback of the entire stack; rollback is a stack-level operation controlled by CloudFormation, not by individual resources.

Full explanation →

1369

MCQhard

A company is modernizing a .NET Framework application to run on AWS. The application currently uses Windows Communication Foundation (WCF) services. The company wants to minimize code changes and run on Linux. Which approach should the company take?

A.Use AWS App2Container to generate Windows containers and run on Amazon ECS with Windows.

B.Rewrite the WCF services as AWS Lambda functions using a custom runtime.

C.Port the application to .NET Core and deploy on Amazon ECS with Linux containers.

D.Containerize the application using AWS Fargate and run on Windows containers.

AnswerC

.NET Core runs on Linux, enabling deployment on Linux containers with minimal changes.

Why this answer

Migrating the .NET Framework application to .NET Core allows it to run on Linux with minimal code changes, as .NET Core is cross-platform. Deploying on Amazon ECS with Linux containers meets the requirement to run on Linux. Option A is incorrect because using AWS App2Container to generate Windows containers would still require Windows, not Linux.

Option B is incorrect because rewriting WCF services as AWS Lambda functions would require significant refactoring, not minimal code changes. Option D is incorrect because AWS Fargate is a compute platform, not a framework, and running Windows containers does not satisfy the requirement to run on Linux.

Full explanation →

1370

MCQhard

A company is designing a multi-region active-active application using Amazon Aurora Global Database. The application writes to a custom domain endpoint that routes to the primary cluster. To minimize write latency, the application should write to the nearest region. Which configuration should the solutions architect use?

A.Configure Aurora Global Database with multiple primary clusters, each in a different region, and use Route 53 to route writes.

B.Use Amazon DynamoDB global tables instead of Aurora Global Database, as DynamoDB supports multi-region writes.

C.Use Aurora cross-region read replicas and failover to a secondary region for writes.

D.Use Route 53 latency-based routing to direct writes to the nearest region. Each region has its own Aurora cluster.

AnswerB

DynamoDB global tables allow active-active multi-region writes. Aurora Global Database does not.

Why this answer

Amazon Aurora Global Database does not support multi-region writes; it has a single primary (writer) cluster and multiple read-only secondary regions. Amazon DynamoDB global tables, however, natively support active-active multi-region writes, allowing the application to write to the nearest region and achieve low write latency. Therefore, DynamoDB global tables are the correct service for this requirement.

Exam trap

The trap here is that candidates assume Aurora Global Database supports multi-region writes because of the word 'Global,' but it actually enforces a single-writer model, making DynamoDB global tables the only AWS-managed relational-like service that supports active-active multi-region writes.

How to eliminate wrong answers

Option A is wrong because Aurora Global Database does not support multiple primary clusters; it has exactly one primary cluster that handles all writes, and secondary regions are read-only. Option C is wrong because Aurora cross-region read replicas are read-only and cannot accept writes; failover promotes a read replica to a primary, but that does not enable simultaneous multi-region writes. Option D is wrong because Route 53 latency-based routing to separate Aurora clusters in each region would create independent databases with no cross-region replication, leading to data inconsistency; Aurora Global Database is designed for a single writer, not active-active writes.

Full explanation →

1371

Multi-Selectmedium

A company uses AWS CodeBuild to compile and test code. The build process takes a long time because dependencies are downloaded from the internet each time. The company wants to speed up the build process. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Use AWS CodeArtifact to store and retrieve dependencies

B.Use a custom Docker image in CodeBuild that includes the dependencies

C.Use local build agents to run builds in parallel

D.Increase the compute type of the build environment

E.Enable the cache feature in CodeBuild to store dependencies in Amazon S3

AnswersB, E

Pre-installed dependencies eliminate download time.

Why this answer

Reduces build time by using a custom Docker image that pre-installs dependencies, avoiding repeated downloads. Option E caches dependency files in Amazon S3 so subsequent builds reuse them instead of downloading again. Option A (CodeArtifact) manages package storage but does not inherently speed up the initial build; it still requires downloading from CodeArtifact.

Option D (increasing compute) may help but does not address the root cause of repeated downloads. Option C (parallel builds) adds complexity without solving the dependency download issue.

Full explanation →

1372

Multi-Selectmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

Select 2 answers

A.Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.

B.Configure the ALB to forward the custom header to the target group and validate it on the application.

C.Use AWS WAF to create a rule that inspects the custom header and blocks requests without it.

D.Use Amazon Cognito to authenticate users and pass the header.

E.Configure the ALB's security group to allow traffic only from known IP addresses.

AnswersB, C

The application can validate the header if forwarded by ALB.

Why this answer

Options B and C are correct. AWS WAF can inspect the custom header and block requests without it (Option C), and the ALB can forward the custom header to the target group where the application can validate it (Option B). Option A is incorrect because using CloudFront with signed URLs would add an extra layer but does not directly validate the custom header.

Option D is incorrect because Amazon Cognito is used for authentication and user management, not for custom header validation. Option E is incorrect because security groups operate at the network layer and cannot inspect application headers.

Full explanation →

1373

Multi-Selecteasy

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Select 3 answers

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.AWS AppConfig

D.Amazon DynamoDB

E.Amazon S3

AnswersA, B, C

AWS Secrets Manager is purpose-built for storing and rotating secrets, meeting the requirements for secrets management.

Why this answer

AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration.

Option D (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Full explanation →

1374

Multi-Selectmedium

A company is migrating its on-premises applications to AWS. The company has a mix of Windows and Linux servers. The migration team wants to automate the discovery of application dependencies and track the migration progress. Which TWO AWS services should the team use? (Choose TWO.)

Select 2 answers

A.AWS Systems Manager

B.AWS Config

C.AWS Application Discovery Service

D.AWS CloudTrail

E.AWS Migration Hub

AnswersC, E

Discovers on-premises servers and their dependencies.

Why this answer

(AWS Application Discovery Service) and Option E (AWS Migration Hub) are correct. Application Discovery Service automatically discovers application dependencies. Migration Hub tracks migration progress across multiple tools.

Option A (AWS Systems Manager) manages instances but does not discover dependencies. Option B (AWS Config) tracks configuration changes but not dependencies. Option D (AWS CloudTrail) logs API calls.

Full explanation →

1375

MCQeasy

A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::source-bucket/*", "arn:aws:s3:::source-bucket" ] }, { "Effect": "Allow", "Action": [ "s3:PutObject" ], "Resource": "arn:aws:s3:::destination-bucket/*" } ] } The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

A.The Lambda function is in a VPC without an S3 VPC endpoint, so it cannot reach S3.

B.The Lambda function does not have permissions to read from the source bucket.

C.The IAM policy does not allow s3:PutObject on the destination bucket.

D.The destination bucket policy denies the Lambda function's access.

AnswerA

Lambda in a VPC requires a VPC endpoint for S3 to access S3 APIs; without it, calls fail.

Why this answer

The Lambda function is attached to a VPC and does not have an S3 VPC endpoint. When a Lambda function is configured to access a VPC, it loses public internet connectivity unless a NAT gateway or VPC endpoints are provided. Without an S3 VPC endpoint (gateway type) in the VPC, the function cannot reach the S3 API, causing PutObject calls to fail with 'Access Denied' (even though the IAM policy allows it).

Option B is incorrect because the IAM policy allows s3:GetObject and s3:ListBucket on the source bucket, and the error is on write to the destination bucket. Option C is incorrect because the IAM policy explicitly allows s3:PutObject on the destination bucket. Option D is incorrect because the destination bucket policy does not deny access, as stated in the question.

Full explanation →

1376

MCQmedium

A company is deploying a web application on AWS. The application requires a relational database with read replicas for scaling read queries. The database must support automatic failover and be Multi-AZ. Which database solution meets these requirements?

A.Amazon DynamoDB with global tables

B.Amazon Aurora with Multi-AZ and Aurora Replicas

C.Amazon ElastiCache for Redis with replication groups

D.Amazon RDS for MySQL with Multi-AZ and Read Replicas

AnswerB

Aurora provides Multi-AZ with automatic failover and up to 15 Aurora Replicas for read scaling.

Why this answer

Amazon Aurora with Multi-AZ and Aurora Replicas (Option B) is the correct choice because it provides a single integrated solution where Aurora Replicas serve as both read replicas for scaling read queries and automatic failover targets. In contrast, Amazon RDS for MySQL with Multi-AZ and Read Replicas (Option D) uses a separate Multi-AZ standby for failover and read replicas that are not automatically promoted; while it technically meets the individual requirements, it does not provide the combined failover and read scaling within the same tier, making Aurora the preferred solution. Option A is a NoSQL database, not relational.

Option C is a caching service, not a relational database.

Exam trap

A common trap is selecting Amazon RDS for MySQL with Multi-AZ and Read Replicas, thinking it provides an equivalent solution; however, Aurora's architecture integrates read replicas and failover, whereas RDS requires separate configurations and manual promotion of read replicas.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value/document database, not a relational database, and global tables provide multi-region replication but not read replicas for scaling read queries in the same region. Option C is wrong because Amazon ElastiCache for Redis is an in-memory data store, not a relational database, and replication groups provide high availability and read replicas but do not support SQL queries or automatic failover in the same sense as a relational database Multi-AZ deployment.

Full explanation →

1377

MCQhard

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application uses a custom health check that reports instance health to Amazon CloudWatch. The Auto Scaling group is configured with an EC2 health check type. Recently, the company noticed that instances failing the custom health check are not being terminated and replaced. What should the solutions architect do to ensure that instances failing the custom health check are automatically replaced?

A.Manually terminate the unhealthy instances from the EC2 console.

B.Configure the Auto Scaling group to use instance metadata to report health.

C.Create a CloudWatch alarm based on the custom health check metric and configure the alarm to terminate the instance.

D.Change the Auto Scaling group health check type to ELB and ensure the custom health check is integrated with the ELB target group.

AnswerD

ELB health checks can be customized via the target group, and Auto Scaling will replace instances that fail ELB health checks.

Why this answer

Auto Scaling only uses EC2 status checks (system/reachability) by default. To use a custom health check, you must configure the Auto Scaling group to use ELB health checks and integrate the custom health check with the ELB target group, so that instances failing the custom check are marked unhealthy by the ELB and automatically replaced. Option A is wrong because manually terminating instances is not automated and defeats the purpose of Auto Scaling.

Option B is wrong because instance metadata cannot be used to report custom health to Auto Scaling; it only provides instance metadata, not health information. Option C is wrong because a CloudWatch alarm alone cannot terminate instances; you would need a lifecycle hook or EventBridge to act on the alarm.

Full explanation →

1378

MCQhard

Refer to the exhibit. A company applies this S3 bucket policy to a central logging bucket. CloudTrail trails in multiple accounts are configured to deliver logs to this bucket. Recently, logs stopped being delivered. What is the most likely cause?

A.CloudTrail does not automatically set the 'bucket-owner-full-control' ACL when delivering logs.

B.The Principal element uses 'cloudtrail.amazonaws.com' which is not the correct service principal.

C.The Resource ARN does not include the account ID, so it matches all accounts.

D.The policy uses 'Deny' which is not allowed in S3 bucket policies.

AnswerA

The condition requires the ACL, but CloudTrail does not set it, causing denial.

Why this answer

When CloudTrail delivers logs to an S3 bucket owned by a different account, it does not automatically set the 'bucket-owner-full-control' ACL on the delivered objects. Without this ACL, the bucket owner (the central logging account) does not have full control over the objects, and the bucket policy's Deny statement (which requires s3:GetObjectAcl and s3:PutObjectAcl for bucket-owner-full-control) will block access, causing log delivery to fail. The solution is to configure CloudTrail to apply the 'bucket-owner-full-control' canned ACL or modify the bucket policy to grant the bucket owner full control via a different mechanism.

Exam trap

The trap here is that candidates often overlook the ACL requirement for cross-account S3 log delivery, assuming that a bucket policy alone is sufficient to grant the bucket owner full control, when in fact CloudTrail must be explicitly configured to set the 'bucket-owner-full-control' ACL.

How to eliminate wrong answers

Option B is wrong because 'cloudtrail.amazonaws.com' is the correct service principal for CloudTrail in S3 bucket policies; it is not a mistake. Option C is wrong because the Resource ARN does not need to include the account ID for the policy to work across accounts; the ARN format 'arn:aws:s3:::bucket-name/*' correctly matches objects in the bucket regardless of the delivering account. Option D is wrong because 'Deny' is absolutely allowed in S3 bucket policies and is commonly used to explicitly deny actions that would otherwise be allowed by other policies.

Full explanation →

1379

Multi-Selecteasy

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Select 3 answers

A.Ensure the read replica is in the same Availability Zone as the primary.

B.Create a read replica from the source DB instance.

C.Modify the application to send read-only queries to the read replica endpoint.

D.Enable Multi-AZ on the read replica.

E.Configure the read replica to be in a different Availability Zone for high availability.

AnswersB, C, E

A read replica is needed to offload read traffic.

Why this answer

To implement the solution of offloading read traffic using an RDS read replica, three steps are necessary. First, create a read replica from the source DB instance (option B), which provides a separate read-only copy of the database. Second, modify the application to send read-only queries to the read replica endpoint (option C); otherwise, the replica won't be utilized.

Third, configure the read replica to be in a different Availability Zone for high availability (option E). While not strictly required for basic read offloading, this step enhances fault tolerance and is considered a necessary part of the solution to ensure high availability of the read replica. Option A is incorrect because placing the read replica in the same AZ does not provide high availability and is not a necessary step.

Option D is incorrect because Multi-AZ is a feature for the primary instance, not for read replicas, and enabling it on a read replica is not supported.

Full explanation →

1380

Drag & Dropmedium

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

Why this order

The correct order is: first create the virtual interface in AWS, then configure the on-premises router, establish BGP, verify availability, and finally update route tables.

Full explanation →

1381

MCQhard

A company is using Amazon S3 to store sensitive documents. The security team requires that all objects be encrypted at rest using a customer-managed key (CMK) stored in AWS KMS. Additionally, the CMK must be rotated automatically every year. How should the company configure this?

A.Use S3 default encryption with SSE-KMS and create a new CMK every year.

B.Use S3 bucket policies to enforce encryption and use KMS manual key rotation.

C.Use S3 default encryption with SSE-KMS and enable automatic key rotation on the CMK.

D.Use S3 default encryption with SSE-S3 and enable KMS automatic key rotation.

AnswerC

This ensures all objects are encrypted with the CMK and the key is rotated annually.

Why this answer

Enable S3 default encryption with SSE-KMS and configure automatic key rotation on the CMK. This meets both requirements.

Full explanation →

1382

MCQhard

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles for cross-account access. They want to ensure that when a role is created in a member account, it automatically adheres to the principle of least privilege and is auditable. What solution should they implement?

A.Use AWS CloudFormation StackSets to deploy IAM roles from a central template in each account.

B.Use AWS Organizations service control policies (SCPs) to deny creation of IAM roles except through AWS CloudFormation, and use a centrally managed CloudFormation template via StackSets.

C.Configure AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them.

D.Create a Lambda function that monitors CloudTrail events for role creation and sends alerts.

AnswerB

SCPs can enforce that roles are only created via CloudFormation, and StackSets ensure consistent deployment and auditing.

Why this answer

AWS Organizations SCPs can be used to deny the creation of IAM roles except through AWS CloudFormation, ensuring that roles are only created via a centrally managed template. By combining this with AWS CloudFormation StackSets, the security team can deploy IAM roles from a single template across all member accounts, enforcing the principle of least privilege and providing full auditability through CloudFormation stack events and AWS CloudTrail.

Exam trap

The trap here is that candidates often choose Option A, thinking that CloudFormation StackSets alone provide enforcement, but they miss the critical need for a preventive control (SCPs) to block manual role creation outside the template.

How to eliminate wrong answers

Option A is wrong because using CloudFormation StackSets alone to deploy IAM roles does not prevent users from creating roles manually outside the template, so it fails to enforce the principle of least privilege or ensure auditability. Option C is wrong because configuring AWS Config rules to detect non-compliant roles and trigger a Lambda function to remove them is a reactive approach that does not prevent the creation of non-compliant roles in the first place, leading to potential security gaps and operational overhead. Option D is wrong because creating a Lambda function that monitors CloudTrail events for role creation and sends alerts is also reactive; it only notifies after a role is created, without enforcing least privilege or preventing non-compliant roles from being created.

Full explanation →

1383

Multi-Selectmedium

A company uses AWS Organizations and wants to centrally manage VPC flow logs for all VPCs across all accounts. Which TWO steps are required to achieve this?

Select 2 answers

A.Configure cross-account CloudWatch Logs subscription.

B.Create a centralized S3 bucket in the logging account.

C.Use VPC Flow Logs with Amazon Kinesis Data Firehose.

D.Apply an SCP that requires VPC Flow Logs to be enabled.

E.Use AWS Config rules to enable flow logs automatically.

AnswersB, D

VPC Flow Logs can be delivered to an S3 bucket.

Why this answer

Centralizing VPC flow logs requires a single S3 bucket in a dedicated logging account to aggregate logs from all accounts. This bucket must have a bucket policy that grants the necessary permissions for the flow log service to write logs from member accounts, enabling centralized storage and management.

Exam trap

The trap here is that candidates often think AWS Config rules can automatically enable flow logs, but Config only evaluates compliance and requires a separate remediation action (e.g., Lambda) to actually enable the resource, making it an indirect and incomplete solution compared to an SCP that enforces the setting.

Full explanation →

1384

MCQhard

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

A.Configure Amazon RDS for MySQL with a cross-Region read replica and automatic failover.

B.Use Route 53 health checks to detect regional failure and automatically update the Aurora Global Database endpoint.

C.Use the Aurora Global Database failover capability to promote the secondary region to primary.

D.Use Amazon RDS Multi-AZ with synchronous replication across Regions.

AnswerC

Aurora Global Database supports managed failover with low RPO/RTO.

Why this answer

Amazon Aurora Global Database provides a managed cross-Region failover capability that can promote a secondary region to primary with an RTO of as low as 1 minute and an RPO of typically less than 1 second, meeting the lowest possible RTO and RPO requirements for regional failures in an active-active architecture. This is achieved through storage-level replication that is asynchronous but very low latency, and the failover operation is a single API call or can be automated via Route 53 health checks, ensuring minimal data loss and downtime.

Exam trap

The trap here is that candidates often confuse Amazon RDS Multi-AZ (which is single-Region) with cross-Region replication, or assume that Route 53 health checks alone can handle the failover without understanding that the database failover must be explicitly managed via Aurora Global Database's promotion capability.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL with a cross-Region read replica does not support automatic failover; you must manually promote the read replica, resulting in higher RTO, and replication is asynchronous with potential for data loss (higher RPO). Option B is wrong because Route 53 health checks can detect regional failure and update DNS records, but they do not directly manage the Aurora Global Database endpoint; the failover must be initiated separately via the Aurora Global Database failover capability, and simply updating the endpoint does not promote the secondary region to primary. Option D is wrong because Amazon RDS Multi-AZ is designed for high availability within a single Region using synchronous replication, not across Regions; cross-Region synchronous replication is not supported, and Multi-AZ does not provide cross-Region failover.

Full explanation →

1385

MCQmedium

A company is using AWS Migration Hub to track a large-scale migration to AWS. The company wants to automate the replatforming of multiple Windows web servers to Amazon EC2 instances running Amazon Linux 2. The migration must be repeatable and minimize manual intervention. Which AWS service should the company use to achieve this?

A.AWS Application Migration Service (MGN)

B.AWS OpsWorks for Chef Automate

C.AWS Server Migration Service (SMS)

D.AWS CloudFormation templates to provision new EC2 instances and migrate data manually

AnswerA

MGN automates server migration and supports replatforming to different OS.

Why this answer

AWS Application Migration Service (MGN) is the correct choice because it automates the replatforming of Windows web servers to Amazon Linux 2 by continuously replicating source servers, performing automated conversion of the OS and applications, and enabling cutover to target EC2 instances with minimal manual intervention. It supports heterogeneous OS migrations (e.g., Windows to Linux) and provides a repeatable, automated workflow that aligns with the company's requirement for a large-scale, repeatable migration.

Exam trap

The trap here is that candidates often confuse AWS Server Migration Service (SMS) with Application Migration Service (MGN), not realizing that SMS is deprecated and only supports homogeneous migrations, while MGN is the current service that supports heterogeneous OS replatforming like Windows to Linux.

How to eliminate wrong answers

Option B (AWS OpsWorks for Chef Automate) is wrong because it is a configuration management service that automates server configuration and compliance, not a migration tool; it cannot perform OS replatforming from Windows to Amazon Linux 2. Option C (AWS Server Migration Service) is wrong because it is deprecated and only supports homogeneous migrations (e.g., VMware to EC2) with agentless replication, not OS conversion from Windows to Linux. Option D (AWS CloudFormation templates to provision new EC2 instances and migrate data manually) is wrong because it requires manual data migration and does not automate the replatforming process, violating the requirement to minimize manual intervention.

Full explanation →

1386

MCQhard

A company has a production AWS account that is part of an AWS Organization. The account has a VPC with a NAT gateway for internet access. The security team wants to ensure that all outbound traffic to the internet flows through a centralized inspection VPC in the security account for traffic inspection. Which architecture should be used?

A.Use AWS Cloud WAN to connect the VPCs and route all outbound traffic through the inspection VPC.

B.Create a VPC peering connection between the production VPC and the inspection VPC, and route all outbound traffic through the peered connection.

C.Create a transit gateway, attach both VPCs, and configure the production VPC's route table to send all internet-bound traffic to the transit gateway, then route it through the inspection VPC's firewall.

D.Place a NAT gateway in the inspection VPC and have the production VPC route internet traffic to the NAT gateway.

AnswerC

Transit gateway enables transitive routing for inspection.

Why this answer

A transit gateway allows you to centralize outbound internet traffic by attaching both the production VPC and the inspection VPC, then configuring the production VPC's route table to send 0.0.0.0/0 traffic to the transit gateway. The inspection VPC can then route that traffic through its firewall (e.g., a third-party appliance or AWS Network Firewall) before it reaches an internet gateway, enabling full traffic inspection while maintaining a single egress point.

Exam trap

The trap here is that candidates often assume VPC peering can be used for transitive routing or that a NAT gateway provides inspection capabilities, but VPC peering is non-transitive and NAT gateways only perform address translation, not deep packet inspection.

How to eliminate wrong answers

Option A is wrong because AWS Cloud WAN is designed for global network connectivity across multiple regions and on-premises locations, not for routing internet-bound traffic through a centralized inspection VPC within a single region; it lacks the granular route table controls needed to force internet traffic through a specific inspection VPC. Option B is wrong because VPC peering does not support transitive routing—traffic from the production VPC to the internet would need to go through the peered connection to the inspection VPC, but the inspection VPC cannot forward that traffic to its internet gateway because VPC peering does not allow a VPC to act as a transit hub for internet-bound traffic. Option D is wrong because placing a NAT gateway in the inspection VPC and routing production VPC traffic to it would require the production VPC to send internet-bound traffic directly to the NAT gateway's private IP, which is not routable across VPC boundaries without additional infrastructure; moreover, the NAT gateway itself does not provide traffic inspection capabilities.

Full explanation →

1387

MCQeasy

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

A.Use AWS Transit Gateway to connect individual VPCs managed by each team.

B.Use a shared VPC with separate subnets for each team, with IAM policies to control access.

C.Create a single VPC and use VPC peering to connect team resources.

D.Create a separate VPC for each application team and use VPC peering.

AnswerB

Shared VPC allows central management of network resources while teams manage their own resources.

Why this answer

A shared VPC allows the central IT team to own and manage the networking resources (VPC, subnets, route tables, etc.) while each application team can independently manage their own EC2 instances and RDS databases within their designated subnets. IAM policies can be scoped to restrict each team to only their subnets and resources, achieving clear separation of duties without requiring multiple VPCs or complex connectivity.

Exam trap

The trap here is that candidates often assume separate VPCs or Transit Gateway are necessary for isolation, but the shared VPC model with IAM policies provides both centralized network management and delegated resource control, which is the exact pattern tested in the SAP-C02 exam for organizational complexity.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway connects multiple VPCs but does not provide a mechanism for the central IT team to centrally manage networking while delegating resource management to application teams; each team would still need to manage their own VPC, and Transit Gateway adds cost and complexity without solving the separation of duties requirement. Option C is wrong because creating a single VPC and using VPC peering to connect team resources is redundant (peering is unnecessary within a single VPC) and does not allow the central team to control networking while isolating teams; all teams would share the same VPC without subnet-level isolation unless subnets are used, but the option fails to mention subnet separation or IAM controls. Option D is wrong because creating a separate VPC for each team and using VPC peering forces each team to manage their own VPC (including subnets, route tables, and security groups), which contradicts the requirement that the central IT team manages networking resources; VPC peering also does not provide centralized network management and introduces transitive routing limitations.

Full explanation →

1388

MCQmedium

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

A.Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

B.Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.

C.Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

D.Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

AnswerB

Glue crawlers automatically discover new partitions and update the table metadata.

Why this answer

Using AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type allows automatic discovery of new partitions as new accounts are added. The crawler can be scheduled to run periodically, updating the table metadata without manual intervention. Partition indexing improves query performance by reducing the amount of data scanned.

Option A is incorrect because updating a view requires manual DDL changes each time a new account is added. Option C is incorrect because manually managing partitions and using MSCK REPAIR TABLE still requires manual effort to add new partitions. Option D is incorrect because converting logs to Parquet adds overhead and does not solve the need for automatic partition discovery across accounts.

Full explanation →

1389

MCQeasy

A company is migrating a legacy application to AWS and needs to ensure that the application can access on-premises resources securely. The company has established an AWS Direct Connect connection. Which AWS service should the company use to route traffic between the VPC and the on-premises network?

A.Virtual Private Gateway (VGW).

B.VPC Peering.

C.Internet Gateway (IGW).

D.AWS Transit Gateway.

AnswerA

VGW is used with Direct Connect to connect to on-premises.

Why this answer

Virtual Private Gateway (VGW). A VGW is required to terminate the AWS Direct Connect connection and route traffic between the VPC and the on-premises network. Option B (VPC Peering) only connects VPCs, not on-premises networks.

Option C (Internet Gateway) is for internet access, not private connectivity via Direct Connect. Option D (AWS Transit Gateway) can be used to interconnect multiple VPCs and on-premises networks, but for a single VPC connected via Direct Connect, a VGW is the direct and appropriate service.

Full explanation →

1390

MCQeasy

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

A.Use a separate Amazon RDS instance for each microservice.

B.Use a single Amazon RDS instance shared by all microservices.

C.Use Amazon Aurora with RDS Proxy in front of it.

D.Use Amazon DynamoDB as a shared database for all microservices.

AnswerB

Minimizes application changes by preserving the existing relational database schema and joins.

Why this answer

The requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Exam trap

The trap here is that candidates often assume microservices require separate databases per service (database-per-service pattern) without considering the constraint of minimizing application changes, leading them to incorrectly choose option A.

How to eliminate wrong answers

Option A is wrong because using a separate RDS instance per microservice would require decomposing the monolithic database into multiple databases, breaking existing complex joins and forcing extensive application changes to handle cross-service data access. Option C is wrong because Amazon Aurora with RDS Proxy addresses connection pooling and scalability but does not change the fundamental need to share a single database; while it could be used with a shared instance, it is not a distinct strategy that minimizes changes compared to a single RDS instance. Option D is wrong because Amazon DynamoDB is a NoSQL database that does not support complex joins; migrating to it would require rewriting all queries and data access patterns, contradicting the goal of minimizing application changes.

Full explanation →

1391

MCQhard

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

A.Server-side encryption with customer-provided keys (SSE-C)

B.Server-side encryption with AWS KMS managed keys (SSE-KMS)

C.Server-side encryption with S3 managed keys (SSE-S3)

D.Client-side encryption

AnswerC

SSE-S3 uses AWS-managed keys that are automatically rotated.

Why this answer

SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option B is wrong because SSE-KMS uses customer-managed KMS keys.

Option D is wrong because client-side encryption is managed by the customer.

Full explanation →

1392

MCQhard

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

A.Modify the Lambda function to not use a VPC.

B.Add a deny rule for inbound 0.0.0.0/0 and allow only from the Lambda function's own IP.

C.Remove the VPC attachment from the Lambda function and use a VPC endpoint.

D.Restrict the security group source to the API Gateway's VPC endpoint or the ALB security group.

AnswerD

Limits inbound traffic to only the expected source.

Why this answer

The Lambda function should not be directly accessible from the internet. The security group sg-12345678 currently allows inbound traffic on port 443 from 0.0.0.0/0, which exposes the function to unnecessary risk. The function is intended to process API requests, typically invoked via API Gateway or an ALB.

Therefore, the security group should restrict inbound traffic to only the source from the API Gateway's VPC endpoint or the ALB's security group. Option A is incorrect because the Lambda function might need to be in a VPC to access internal resources, and removing VPC attachment is not the best security measure. Option B is incorrect because Lambda functions do not have their own static IP; the ENI's IP is dynamic and cannot be used as a source restriction.

More importantly, the source should be the API Gateway, not the Lambda function itself. Option C is incorrect because while using a VPC endpoint is beneficial, simply removing the VPC attachment does not solve the security group issue; the function may still need VPC access. The most direct fix is to modify the security group rule.

Full explanation →

1393

MCQeasy

A company wants to automate the creation of new AWS accounts and apply baseline security configurations. Which combination of services should be used to achieve this?

A.AWS Service Catalog and AWS Config.

B.AWS Organizations API and CloudTrail.

C.AWS Control Tower and Service Control Policies (SCPs).

D.AWS CloudFormation StackSets and IAM.

AnswerC

Control Tower provides account factory and guardrails via SCPs.

Why this answer

AWS Control Tower provides a managed service to automate the creation of new AWS accounts through Account Factory, while Service Control Policies (SCPs) enforce baseline security guardrails across all accounts in the organization. This combination ensures that every new account is provisioned with consistent security policies without manual intervention.

Exam trap

The trap here is that candidates often confuse AWS Control Tower with AWS Organizations alone, forgetting that Control Tower adds automated account provisioning and pre-built security guardrails (SCPs) that Organizations alone does not provide.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog is used for creating and managing approved IT service catalogs, not for automating account creation, and AWS Config is a configuration auditing service, not a provisioning tool. Option B is wrong because the AWS Organizations API can create accounts programmatically but lacks built-in baseline security configuration enforcement; CloudTrail only logs API activity and does not apply security policies. Option D is wrong because AWS CloudFormation StackSets deploy infrastructure templates across accounts but do not automate account creation itself, and IAM manages user permissions but not account provisioning or baseline security guardrails.

Full explanation →

1394

MCQhard

A company uses AWS Organizations and wants to implement a policy that prevents any account from disabling AWS CloudTrail or deleting CloudTrail log files. The solution must be enforceable across all accounts. Which combination of actions should be taken?

A.Enable CloudTrail with a trail that logs to a bucket in a separate account, and use IAM policies to deny CloudTrail deletion.

B.Create an SCP that denies cloudtrail:DeleteTrail and cloudtrail:StopLogging, and rely on S3 versioning to recover deleted logs.

C.Create an IAM policy in each account that denies CloudTrail deletion and attach it to all IAM users and roles.

D.Create an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket. Also attach a bucket policy to the log bucket that denies s3:DeleteObject for all principals except the management account.

AnswerD

Combines SCP and bucket policy for comprehensive protection.

Why this answer

It combines an SCP that denies cloudtrail:DeleteTrail, cloudtrail:StopLogging, and s3:DeleteObject on the log bucket with a bucket policy that denies s3:DeleteObject for all principals except the management account. This layered approach ensures that even if an account has full administrative permissions, the SCP blocks the CloudTrail and S3 actions, while the bucket policy prevents any account (including the root user) from deleting log files, with the management account as the sole exception for recovery purposes.

Exam trap

The trap here is that candidates assume an SCP alone is sufficient to protect CloudTrail logs, forgetting that SCPs do not protect the S3 bucket where logs are stored, and that IAM policies in individual accounts are ineffective against root user actions or privilege escalation.

How to eliminate wrong answers

Option A is wrong because IAM policies alone cannot prevent actions performed by the root user or by services that bypass IAM, and they are not enforceable across all accounts without additional controls. Option B is wrong because relying solely on S3 versioning does not prevent deletion of log files; versioning only allows recovery after deletion, and the SCP does not protect the S3 bucket from direct delete actions on objects. Option C is wrong because IAM policies in each account are not enforceable against the root user or against users with full administrative privileges, and they require manual maintenance across all accounts, making them unreliable for organization-wide enforcement.

Full explanation →

1395

MCQhard

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

A.The S3 bucket has a lifecycle policy that deletes logs after a short period.

B.The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

C.The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.

D.The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

AnswerC

The bucket policy likely restricts access to the logging account's role, so the analyst's direct access is denied.

Why this answer

The S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Exam trap

The trap here is that candidates often overlook bucket policy conditions that restrict principal types, assuming that granting read-only access to the S3 bucket via IAM is sufficient, when in fact the bucket policy itself may explicitly deny access to non-service principals.

How to eliminate wrong answers

Option A is wrong because a lifecycle policy that deletes logs after a short period would cause logs to be missing, but the analyst cannot access any logs at all, indicating a permissions issue rather than data absence. Option B is wrong because requiring the analyst to assume a role in the logging account is a valid cross-account access pattern; if the bucket policy allowed it, the analyst could assume the role and access the logs, so this is not the most likely cause. Option D is wrong because while KMS encryption could block access if the analyst lacks decrypt permissions, the question states the analyst has read-only access to the S3 bucket, and KMS key permissions are separate from S3 bucket policies; the most likely cause is a bucket policy restriction, not encryption.

Full explanation →

1396

Multi-Selecthard

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Select 3 answers

A.AWS CloudFormation

B.AWS CodePipeline

C.AWS CodeCommit

D.AWS CodeBuild

E.AWS CodeDeploy

AnswersB, C, D

CodePipeline orchestrates the build, test, and deploy stages.

Why this answer

AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Exam trap

The trap here is that candidates may incorrectly select AWS CodeDeploy (Option E) because they assume it supports all deployment targets, including EKS, but CodeDeploy does not natively support Kubernetes clusters; instead, EKS deployments are typically handled via CodeBuild or a custom action in CodePipeline.

Full explanation →

1397

MCQhard

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

A.The SCPs applied to member accounts are blocking CloudTrail from sending logs.

B.CloudTrail is a regional service and the trail is only in one region.

C.Member accounts have IAM policies that deny CloudTrail logging.

D.The trail was not created as an organization trail.

AnswerD

An organization trail must be enabled to log events from all accounts.

Why this answer

When a CloudTrail trail is created in the management account without enabling the 'organization trail' option, it only logs events for the management account itself and not for member accounts. To centralize logging across all accounts in AWS Organizations, the trail must be explicitly created as an organization trail, which automatically applies to all current and future member accounts. Without this setting, member account events are not forwarded to the management account's trail.

Exam trap

The trap here is that candidates often assume that creating a trail in the management account automatically covers all member accounts, but they overlook the explicit requirement to designate the trail as an organization trail during creation.

How to eliminate wrong answers

Option A is wrong because SCPs (Service Control Policies) can only deny or allow actions at the AWS Organizations level, but they do not block CloudTrail from sending logs; CloudTrail delivers logs to an S3 bucket, and SCPs cannot prevent that delivery unless they explicitly deny the `cloudtrail:PutEventSelectors` or similar actions, which is not the described issue. Option B is wrong because the question states the trail logs events across all regions, and CloudTrail trails can be configured as multi-region trails, so a single trail can capture events from all regions. Option C is wrong because IAM policies in member accounts do not affect CloudTrail logging; CloudTrail operates at the AWS service level and does not require IAM permissions in member accounts to log management events, as the trail is managed from the management account.

Full explanation →

1398

MCQeasy

A company uses Amazon S3 to store critical data. The company wants to ensure that data is protected against accidental deletion and that deleted objects can be recovered within 30 days. Which S3 feature should the company enable?

A.S3 Versioning

B.S3 Server Access Logging

C.S3 Object Lock in governance mode

D.S3 Intelligent-Tiering

AnswerA

Preserves all versions, allowing recovery of deleted objects.

Why this answer

(S3 Versioning) is correct because when enabled, it retains all versions of objects, allowing recovery of deleted or overwritten objects within a specified retention period. Combined with a lifecycle policy to expire old versions after 30 days, it meets the requirement. Option B (S3 Server Access Logging) is used for auditing access, not for data recovery.

Option C (S3 Object Lock in governance mode) prevents object deletion or overwrites by enforcing retention settings, but it is designed for compliance and does not inherently allow recovery of already deleted objects unless combined with versioning. Option D (S3 Intelligent-Tiering) optimizes storage costs based on access patterns, not for data protection or recovery.

Full explanation →

1399

MCQmedium

An S3 bucket contains thousands of objects under the 'logs/' prefix. The above AWS CLI command is run to list objects larger than 1000 bytes. The command returns an empty array, but there are known objects larger than 1000 bytes. What is the most likely reason?

A.The command only returns the first 1000 objects due to pagination

B.The prefix 'logs/' is case-sensitive and should be 'Logs/'

C.The command has a syntax error in the JMESPath query

D.The bucket policy does not allow listing objects

AnswerA

The list-objects API paginates; large objects may be in later pages.

Why this answer

The CLI command uses single quotes for the query, which is correct in Linux shells, but the issue is that the `Size` field is a number, and the comparison `Size > 1000` should work. However, the command might be returning an empty array because the bucket has a large number of objects and the API returned only a subset (truncated). The command does not include pagination, so it only returns the first 1000 objects.

If the large objects are after the first 1000, they won't appear. Also, the query syntax is correct. The bucket policy or permissions would cause an error, not an empty array.

Full explanation →

1400

Multi-Selecthard

A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)

Select 2 answers

A.Enable caching of authorization responses in API Gateway.

B.Use AWS WAF to block suspicious requests.

C.Increase the Lambda function timeout.

D.Increase the Lambda reserved concurrency.

E.Enable request validation in API Gateway.

AnswersA, C

Caching reduces Lambda invocations for repeated requests.

Why this answer

(enabling caching of authorization responses) is correct because it caches the authorizer's response for a specified time, reducing the number of Lambda invocations during peak traffic and improving performance without changing authentication logic. Option C (increasing the Lambda function timeout) is correct because if the authorizer times out during peak traffic, increasing the timeout gives it more time to complete. Option B (using AWS WAF) is incorrect because WAF blocks suspicious requests at the web application layer, but does not improve the performance of the Lambda authorizer.

Option D (increasing Lambda reserved concurrency) is incorrect because the issue is timeouts, not concurrency limits; reserved concurrency ensures capacity but does not prevent timeouts. Option E (enabling request validation in API Gateway) is incorrect because request validation checks request structure before reaching the authorizer, but does not affect authorizer performance.

Full explanation →

1401

Multi-Selectmedium

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Select 3 answers

A.Configure Amazon CloudWatch agent to send inventory data.

B.Set up an AWS Config aggregator in the management account.

C.Enable AWS Systems Manager Inventory in each account.

D.Create an IAM role in each member account that trusts the central account.

E.Enable AWS Systems Manager in each account.

AnswersC, D, E

Inventory collects instance information.

Why this answer

AWS Systems Manager Inventory provides a native, agentless mechanism to collect and query EC2 instance metadata, software inventory, and configuration across accounts. Enabling Systems Manager in each account is a prerequisite for using Inventory, as it relies on the SSM Agent and the Systems Manager service to gather and store inventory data in a centralized manner.

Exam trap

The trap here is that candidates often confuse AWS Config aggregators (which aggregate compliance data) with Systems Manager Inventory (which aggregates EC2 inventory data), leading them to incorrectly select Option B as a necessary step.

Full explanation →

1402

Multi-Selectmedium

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Select 2 answers

A.Enable default encryption with SSE-KMS on the S3 bucket.

B.Use client-side encryption before uploading to S3.

C.Enable S3 server access logging.

D.Use a bucket ACL to grant access to the data lake.

E.Configure an S3 bucket policy that allows access only from specific IAM roles.

AnswersA, E

SSE-KMS encrypts objects at rest with managed keys.

Why this answer

Options A and E are correct. A: Enabling default encryption with SSE-KMS ensures data is encrypted at rest using AWS Key Management Service, providing control over encryption keys. E: A bucket policy that allows access only from specific IAM roles ensures only authorized users can access the data, following the principle of least privilege.

Option B (client-side encryption) is not required as server-side encryption meets the requirement. Option C (server access logging) does not control access or encryption. Option D (bucket ACL) is less secure and not recommended for controlling access compared to IAM policies.

Full explanation →

1403

MCQeasy

A startup is using a single AWS account for development, testing, and production. They want to isolate environments and improve security. What is the most aligned AWS best practice?

A.Use separate VPCs within the same account.

B.Use IAM policies to restrict access per environment.

C.Create separate AWS accounts for each environment using AWS Organizations.

D.Use resource tagging to separate environments.

AnswerC

Accounts provide strong isolation boundaries.

Why this answer

Creating separate AWS accounts via AWS Organizations (Option C) is the recommended best practice for isolating environments and enhancing security. This approach provides strong logical and billing separation, aligns with the AWS Well-Architected Framework's security pillar, and minimizes blast radius. Option A (separate VPCs) does not fully isolate because all resources still reside in the same account, sharing service quotas and increasing risk.

Option B (IAM policies) alone cannot prevent cross-environment access at the network or resource level. Option D (resource tagging) only aids in organization, not isolation.

Full explanation →

1404

Multi-Selecthard

Which THREE design patterns are recommended for decoupling components in a microservices architecture on AWS?

Select 3 answers

A.Use Amazon EventBridge for event-driven integration.

B.Use AWS Direct Connect for private connectivity.

C.Use Amazon SNS topics for pub/sub messaging.

D.Use Amazon SQS queues between services.

E.Use Elastic Load Balancing to distribute traffic.

AnswersA, C, D

EventBridge decouples event producers and consumers.

Why this answer

Amazon EventBridge provides a fully managed event bus that decouples microservices by enabling event-driven communication. Services publish events to EventBridge, which then routes them to appropriate consumers based on rules, eliminating direct dependencies between producers and consumers.

Exam trap

The trap here is that candidates may confuse network connectivity solutions (Direct Connect) or load balancing (ELB) with true decoupling patterns, but decoupling in microservices requires asynchronous, event-driven or message-based integration, not synchronous request/response or network links.

Full explanation →

1405

MCQeasy

A solutions architect notices that an Auto Scaling group's instances are continuously being terminated and replaced. CloudWatch logs show that health checks are failing due to high memory usage. The instances run a memory-intensive application. What should the architect do to improve stability?

A.Change the instance type to a memory-optimized family like R5.

B.Use a scheduled scaling policy to add instances during peak hours.

C.Increase the minimum number of instances in the Auto Scaling group.

D.Create a CloudWatch alarm for memory utilization and attach it to a scaling policy.

AnswerD

Memory alarm triggers scaling before health check failures.

Why this answer

Creating a CloudWatch alarm for memory utilization and attaching it to a scaling policy allows the Auto Scaling group to dynamically add instances when memory usage is high, preventing health check failures. Option A is incorrect because switching to memory-optimized instances may help but does not provide automatic scaling based on memory pressure. Option B is incorrect because scheduled scaling is for predictable traffic patterns, not for responding to real-time memory usage.

Option C is incorrect because increasing the minimum number of instances does not address the root cause; it only adds more instances but does not adapt to varying memory demand.

Full explanation →

1406

MCQmedium

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

A.Enable Multi-AZ deployment for failover.

B.Create one or more Read Replicas in the same region.

C.Use Amazon ElastiCache to cache frequent queries.

D.Upgrade to a larger instance type.

AnswerB

Read Replicas handle read queries, reducing load on primary.

Why this answer

Creating Read Replicas offloads read traffic from the primary instance. Option A increases cost unnecessarily, C requires application changes, and D does not directly improve read performance.

Full explanation →

1407

MCQhard

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

A.The EC2 instances are of a burstable performance type.

B.The Auto Scaling group's minimum size is too small.

C.The health check target path or port is misconfigured.

D.The health check interval is too long.

AnswerC

Misconfigured health checks can mark healthy instances as unhealthy, causing them to be replaced and disrupting traffic.

Why this answer

If the health check target path or port is misconfigured, healthy instances may fail health checks and be replaced, causing errors during peak traffic. Option A is incorrect because burstable performance instances are not directly related to health check failures; health checks depend on the configured endpoint. Option B is incorrect because a small minimum size affects capacity, not the accuracy of health checks.

Option D is incorrect because a longer health check interval delays detection of unhealthy instances but does not cause healthy instances to be mistakenly replaced.

Full explanation →

1408

MCQeasy

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

A.Use Amazon ElastiCache for Redis to store session data

B.Store session data on an Amazon EBS volume attached to each instance

C.Store session data in an Amazon RDS database

D.Enable sticky sessions (session affinity) on the ALB

AnswerA

Redis provides a fast, shared session store that all instances can access.

Why this answer

Amazon ElastiCache for Redis provides a fully managed, in-memory data store that is ideal for storing session state externally from the EC2 instances. This decouples session data from the compute layer, allowing any instance to retrieve the same session data regardless of which instance originally handled the request. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it both highly scalable and cost-effective for session management at scale.

Exam trap

The trap here is that candidates often confuse sticky sessions (session affinity) as a valid solution for session persistence, but it actually undermines scalability and fault tolerance by tying a user to a single instance, which is the opposite of what a stateless, horizontally scalable architecture requires.

How to eliminate wrong answers

Option B is wrong because storing session data on an EBS volume attached to each instance creates a single point of failure and prevents instances from sharing session data; EBS volumes are tied to a single Availability Zone and cannot be concurrently accessed by multiple instances. Option C is wrong because using Amazon RDS for session data introduces unnecessary relational database overhead, higher latency for simple key-value lookups, and increased cost compared to an in-memory cache like Redis. Option D is wrong because enabling sticky sessions (session affinity) on the ALB forces traffic from a user to the same instance, which reduces scalability and defeats the purpose of horizontal scaling; if that instance fails, the session data is lost.

Full explanation →

1409

Multi-Selecthard

A company is designing a new data lake on AWS using Amazon S3. The data must be encrypted at rest. Which TWO options comply with the requirement? (Choose TWO.)

Select 2 answers

A.Enable SSL/TLS for all data transfers

B.Use S3 Access Points with a bucket policy

C.Use server-side encryption with Amazon S3 managed keys (SSE-S3)

D.Use client-side encryption before uploading

E.Use server-side encryption with AWS KMS (SSE-KMS)

AnswersC, E

SSE-S3 encrypts data at rest.

Why this answer

Server-side encryption with Amazon S3 managed keys (SSE-S3) encrypts data at rest using AES-256, with S3 managing the encryption keys entirely. This meets the requirement for encryption at rest without any additional customer effort or key management overhead.

Exam trap

The trap here is that candidates may confuse encryption in transit (SSL/TLS) with encryption at rest, or think that access controls (S3 Access Points) provide encryption, leading them to select options A or B instead of focusing on the two server-side encryption methods (SSE-S3 and SSE-KMS) that directly encrypt data at rest.

Full explanation →

1410

MCQmedium

A company is modernizing a legacy .NET application by containerizing it on Amazon ECS. The application currently uses Windows authentication against on-premises Active Directory. After migrating, the application needs to authenticate users against AWS Managed Microsoft AD. The security team requires that credentials never leave the corporate network. Which solution should the company implement?

A.Store user passwords in AWS Secrets Manager and authenticate against it.

B.Use AWS AD Connector to proxy authentication to on-premises AD.

C.Use AWS Directory Service Simple AD with password sync.

D.Set up AWS Managed Microsoft AD with a two-way trust to on-premises AD over Direct Connect.

AnswerD

Keeps credentials on-premises.

Why this answer

The correct solution is D. By setting up AWS Managed Microsoft AD with a two-way trust to on-premises Active Directory over Direct Connect, user authentication can be performed against the on-premises AD while credentials remain within the corporate network. The trust relationship allows the on-premises AD to authenticate users without credentials leaving the network.

Option A is incorrect because storing passwords in Secrets Manager and authenticating against it would require credentials to leave the corporate network, violating the security requirement. Option B, AD Connector, proxies authentication requests to on-premises AD but still requires credentials to be passed through the proxy, which may not satisfy the security policy. Option C, Simple AD, does not support trusts and is not compatible with on-premises AD integration.

Full explanation →

1411

MCQmedium

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

A.The ec2:ResourceTag condition key is not supported for ec2:StopInstances.

B.The Resource element is set to '*', which does not include the specific instance.

C.The ec2:StopInstances action is not listed in the policy.

D.The policy requires a resource ARN for the condition to work.

AnswerA

The ec2:ResourceTag condition key is not supported for ec2:StopInstances or ec2:StartInstances actions.

Why this answer

The ec2:ResourceTag condition key is not supported for the ec2:StopInstances action; it is only supported for read actions such as ec2:DescribeInstances. Therefore, even though the instance has the tag 'Environment=production', the condition is not evaluated and the action fails. Option B is incorrect because the Resource element '*' includes all instances.

Option C is incorrect because the policy does include ec2:StopInstances. Option D is incorrect because a resource ARN is not required for the condition to work; the issue is the unsupported condition key.

Full explanation →

1412

MCQhard

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

A.Deploy the Auto Scaling group in a single Region with instances spread across two AZs

B.Deploy the Auto Scaling group in three Availability Zones within a single Region

C.Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover

D.Use an active-active configuration across two Regions with Route 53 weighted routing

AnswerC

Active-passive reduces cost; failover provides resilience.

Why this answer

It provides multi-Region resilience using an active-passive architecture, which is the most cost-effective approach for a stateless application that must survive a regional outage. The active-passive setup uses Route 53 failover routing to direct traffic to the primary Region under normal conditions and automatically fail over to the secondary Region only when the primary is unhealthy, minimizing ongoing costs by keeping the secondary infrastructure idle or minimal until needed.

Exam trap

The trap here is that candidates often choose a single-Region, multi-AZ option (A or B) because they assume high availability within a Region is sufficient, but the question explicitly requires resilience during a regional outage, which only multi-Region architectures can provide.

How to eliminate wrong answers

Option A is wrong because deploying in a single Region, even across two AZs, cannot survive a regional outage, as the entire Region may become unavailable. Option B is wrong because using three AZs within a single Region still leaves the application vulnerable to a full regional failure, and it does not address the requirement for regional outage resilience. Option D is wrong because an active-active configuration across two Regions with Route 53 weighted routing is less cost-effective than active-passive, as it requires both Regions to be fully operational and handling traffic at all times, increasing costs without providing additional benefit for a stateless application that can handle instance failures.

Full explanation →

1413

MCQeasy

A company is designing a new application that will be deployed on EC2 instances across multiple Availability Zones. The application must be highly available and must automatically recover from instance failures. Which solution should the architect recommend?

A.Use a single EC2 instance in one AZ and a standby instance in another AZ

B.Use AWS Elastic Beanstalk with a single instance environment

C.Use AWS CloudFormation to launch a single instance in each AZ

D.Use an Auto Scaling group with a minimum of two instances across two Availability Zones

AnswerD

Auto Scaling automatically replaces failed instances and distributes across AZs.

Why this answer

An Auto Scaling group with a minimum of two instances across two Availability Zones ensures that if one instance or an entire AZ fails, the remaining instance continues to serve traffic, and Auto Scaling automatically launches a replacement instance to restore the desired count. This architecture provides both high availability and automatic recovery from instance failures without manual intervention.

Exam trap

The trap here is that candidates often confuse 'high availability' with 'fault tolerance' and assume that simply having two instances in different AZs (Option C) is sufficient, but without an auto-recovery mechanism like Auto Scaling, a failed instance remains down and requires manual remediation.

How to eliminate wrong answers

Option A is wrong because a single active instance with a standby instance in another AZ does not provide automatic recovery; failover to the standby would require manual or custom scripting, and the standby instance is idle, wasting resources. Option B is wrong because AWS Elastic Beanstalk with a single instance environment runs only one EC2 instance, which is a single point of failure and cannot automatically recover from instance failures without additional configuration like a multi-instance environment. Option C is wrong because using AWS CloudFormation to launch a single instance in each AZ creates two independent instances but does not include any health-check or auto-replacement mechanism; if one instance fails, CloudFormation does not automatically replace it, and there is no load balancing or failover logic.

Full explanation →

1414

Multi-Selecthard

A company is running a production web application on Amazon EKS. The application experiences intermittent latency spikes. The operations team suspects that the issue is related to pod networking. Which THREE tools should they use to diagnose the issue? (Choose 3)

Select 3 answers

A.tcpdump on worker nodes

B.VPC Flow Logs

C.Amazon CloudWatch Logs

D.Amazon CloudWatch Container Insights

E.AWS CodePipeline

AnswersB, C, D

Captures network traffic metadata.

Why this answer

The correct tools for diagnosing intermittent latency spikes in an Amazon EKS pod networking issue are VPC Flow Logs (B), Amazon CloudWatch Logs (C), and Amazon CloudWatch Container Insights (D). VPC Flow Logs capture network traffic metadata, helping identify packet loss or delays. CloudWatch Logs aggregate container logs for debugging application behavior.

Container Insights provides metrics like network usage and pod performance. Option A (tcpdump) is a Linux command-line tool that can capture packets but is not an AWS managed service and may require elevated access; it is not optimal for production troubleshooting on EKS. Option E (AWS CodePipeline) is a CI/CD service unrelated to network diagnostics.

Full explanation →

1415

MCQhard

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

A.Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Enable Aurora Auto Scaling to add read replicas based on CPU or connections.

B.Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Use Amazon SQS to queue read requests during peak traffic.

C.Use an Auto Scaling group with a simple scaling policy based on CPU utilization. Use DynamoDB Auto Scaling for the database.

D.Use an Auto Scaling group with a step scaling policy based on CPU utilization. Use ElastiCache Auto Scaling to add cache nodes for read traffic.

AnswerA

Auto Scaling scales web tier; Aurora Auto Scaling scales read capacity automatically.

Why this answer

It uses an Auto Scaling group with a target tracking scaling policy based on CPU utilization to automatically scale the web tier, and enables Aurora Auto Scaling to add read replicas based on CPU or connections, which meets the requirements for both web and database scaling. Option B is incorrect because Amazon SQS is a message queue service and does not scale the database or handle read traffic for Aurora. Option C is incorrect because DynamoDB is a NoSQL database, not the specified Aurora MySQL database, and its auto scaling does not apply.

Option D is incorrect because ElastiCache is a caching service, not the database tier, and its auto scaling does not address read scaling for Aurora.

Full explanation →

1416

MCQhard

A company is running a stateful web application on EC2 instances in an Auto Scaling group behind an ALB. The application stores session data locally on the instance. The company notices that users are frequently logged out and lose session data during scaling events. What is the MOST operationally efficient way to preserve session state?

A.Migrate session data to ElastiCache for Redis and modify the application to use it.

B.Create a custom AMI that pre-populates session data from Amazon S3.

C.Increase the Auto Scaling group's cooldown period to 600 seconds.

D.Enable sticky sessions (session affinity) on the ALB.

AnswerA

Externalizing session state ensures data persists across instance replacements.

Why this answer

Migrating session state to ElastiCache for Redis provides a centralized, external, and highly available session store that persists independently of EC2 instance lifecycles. This ensures that when instances are terminated or added during Auto Scaling events, session data remains intact and accessible from any instance, eliminating user logouts and data loss. It is operationally efficient as it requires minimal application code changes and leverages a fully managed, in-memory data store optimized for low-latency access.

Exam trap

The trap here is that candidates often choose sticky sessions (Option D) thinking it solves session persistence, but they overlook that sticky sessions only route traffic to the same instance and do not protect against data loss when that instance is terminated during scaling events.

How to eliminate wrong answers

Option B is wrong because pre-populating a custom AMI with session data from S3 is impractical and inefficient: session data is dynamic and changes constantly, so a static AMI cannot reflect real-time session states, and this approach would require frequent AMI rebuilds and complex synchronization. Option C is wrong because increasing the cooldown period to 600 seconds only delays scaling events but does not prevent session loss when instances are eventually terminated; it also reduces the Auto Scaling group's ability to respond to load changes, potentially impacting availability. Option D is wrong because enabling sticky sessions (session affinity) on the ALB only binds a user's session to a specific instance, but if that instance is terminated during a scale-in event, the session data is still lost; it does not provide a durable, shared session store.

Full explanation →

1417

MCQmedium

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

A.Use S3 default encryption to automatically encrypt new objects.

B.Use an AWS Config rule to check for encryption and automatically remediate by enabling SSE-S3.

C.Use an SCP to deny creation of buckets without SSE-KMS and use an AWS Config rule with remediation to enable SSE-KMS on existing buckets.

D.Create an AWS Lambda function that scans all buckets and enables encryption.

AnswerC

SCP prevents new non-compliant buckets, Config remediates existing ones.

Why this answer

An SCP can deny creation of buckets without SSE-KMS, and AWS Config with automatic remediation can enable SSE-KMS on existing buckets. Option A is wrong because S3 default encryption only encrypts new objects, not existing ones. Option B is wrong because SSE-S3 does not meet the KMS requirement.

Option D is wrong because a Lambda function is reactive and requires custom code, whereas the combination of SCP and Config provides a more scalable and policy-driven approach.

Full explanation →

1418

MCQhard

A company is modernizing its application by breaking a monolith into microservices on Amazon EKS. The application uses a shared PostgreSQL database. The company wants to implement a database-per-service pattern. The migration must be done with zero downtime. Which approach should the company use?

A.Implement the strangler fig pattern: gradually migrate functionality and data to new services.

B.Use AWS DMS with CDC to replicate the shared database to multiple target databases.

C.Use Amazon RDS read replicas to create separate databases for each service.

D.Create new databases for each service, migrate data during a maintenance window.

AnswerA

The strangler fig pattern enables incremental migration of functionality and data to new microservices without downtime, by gradually intercepting and routing traffic and data.

Why this answer

The strangler fig pattern allows gradual migration of functionality and data to new services, enabling zero downtime by incrementally routing traffic and data away from the monolith. Option B is incorrect because AWS DMS with CDC can replicate data but does not provide a gradual migration pattern; it would require custom logic to split data per service. Option C is incorrect because Amazon RDS read replicas are for read scaling, not for creating separate databases; they share the same underlying data and do not enable a database-per-service pattern.

Option D is incorrect because performing migration during a maintenance window causes downtime, which violates the zero-downtime requirement.

Full explanation →

1419

MCQeasy

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

A.Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

B.Manually enable CloudTrail in each account by logging into every account.

C.Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.

D.Create an SCP that requires CloudTrail to be enabled in each account.

AnswerC

StackSets allow centralized, automated deployment of CloudTrail across accounts.

Why this answer

AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Exam trap

The trap here is that candidates often confuse the capabilities of SCPs (which only control permissions) with resource enforcement, leading them to incorrectly select Option D, not realizing that SCPs cannot create or enable resources like CloudTrail.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can only detect non-compliance and trigger auto-remediation via Systems Manager Automation or Lambda, but they do not natively deploy CloudTrail across all accounts; they react to existing resources rather than proactively provisioning them, making them less efficient for initial deployment. Option B is wrong because manually enabling CloudTrail in each account by logging into every account is not scalable, error-prone, and violates the principle of least effort for a multi-account environment. Option D is wrong because Service Control Policies (SCPs) can only deny or allow API actions, not enforce the presence of a resource like CloudTrail; an SCP cannot require CloudTrail to be enabled—it can only block actions that disable it, which is insufficient to ensure initial enablement.

Full explanation →

1420

Multi-Selectmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Select 2 answers

A.Amazon CloudFront

B.AWS Global Accelerator

C.Network Load Balancer

D.Application Load Balancer

E.Amazon Route 53

AnswersC, D

NLB distributes traffic at Layer 4.

Why this answer

Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and can distribute incoming traffic across multiple EC2 instances in an Auto Scaling group with extremely low latency and high throughput. It is ideal for applications that require handling millions of requests per second while preserving the source IP address of clients.

Exam trap

The SAP-C02 exam often tests the distinction between services that perform actual load balancing (ALB, NLB) versus services that provide DNS-based routing (Route 53) or content delivery (CloudFront) or global traffic optimization (Global Accelerator), leading candidates to mistakenly select Route 53 or CloudFront as load balancers.

Full explanation →

1421

Multi-Selecteasy

A company is designing a new application that will process images uploaded by users. The application must automatically resize images and store them in Amazon S3. The solution should be serverless and event-driven. Which THREE AWS services should be used together? (Choose three.)

Select 3 answers

A.Amazon S3

B.AWS Lambda

C.Amazon EC2

D.Amazon Simple Queue Service (SQS)

E.Amazon S3 Event Notification

AnswersA, B, E

S3 stores the uploaded and processed images.

Why this answer

Options A, B, and E are correct. Amazon S3 can trigger a Lambda function on object uploads. Lambda can process the image and store the result back in S3.

Option C is wrong because EC2 is not serverless. Option D is wrong because SQS is not needed for this event-driven flow.

Full explanation →

1422

MCQeasy

A company is migrating a legacy application to AWS and needs to ensure compliance with data residency requirements. The application stores personally identifiable information (PII) in an on-premises MySQL database. The company wants to encrypt the data at rest and in transit during the migration. The database will be migrated to Amazon RDS for MySQL. The solutions architect must ensure that all data is encrypted end-to-end. Which combination of steps will meet these requirements?

A.Use a custom AMI with encrypted EBS volumes, enforce TLS, and use AWS DMS with SSL.

B.Enable RDS encryption at launch, use AWS DMS with SSL, and require SSL certificate verification on the RDS endpoint.

C.Enable RDS encryption at launch, enforce TLS for connections, and configure the application to use SSL/TLS.

D.Enable RDS encryption after migration, use AWS DMS with SSL, and set up a VPN connection.

AnswerC

RDS encryption encrypts data at rest; TLS encrypts data in transit; application configuration ensures end-to-end encryption.

Why this answer

To meet the requirements for encrypting data at rest and in transit end-to-end, the solution must include encryption for the RDS database at rest (only possible at launch) and encryption in transit for both the migration process and ongoing application connections. Option C correctly combines enabling RDS encryption at launch (for at-rest encryption), enforcing TLS for connections to the RDS endpoint (for in-transit encryption), and configuring the application to use SSL/TLS (ensuring the application sends encrypted traffic). Option A is incorrect because using a custom AMI with encrypted EBS applies to EC2 instances, not RDS; the database needs to be migrated to RDS, not EC2.

Option B is partially correct but fails to include the application-side TLS configuration, so it does not ensure end-to-end encryption from the application to the database. Option D is incorrect because RDS encryption cannot be enabled after migration; it must be enabled at launch, and a VPN does not encrypt the database at rest.

Full explanation →

1423

MCQhard

A company is modernizing a monolithic application by decomposing it into microservices. The application currently uses a single MySQL database. The company wants to use a polyglot persistence approach, with different microservices using the most appropriate database type. The team has limited experience with NoSQL databases. Which strategy should the team use to minimize risk during the migration?

A.Rewrite the entire application as microservices using a new database for each service from the start

B.Use the strangler fig pattern to incrementally replace parts of the monolith with microservices, starting with a non-critical function

C.Migrate the entire monolith to a containerized application on Amazon ECS in one go

D.Use AWS DMS to replicate the monolith's database to multiple target databases simultaneously

AnswerB

Correct. The strangler fig pattern allows gradual migration with minimal risk.

Why this answer

Using the strangler fig pattern allows incremental migration, replacing parts of the monolith with microservices one at a time. This reduces risk because each microservice can be tested independently. Starting with a non-critical service provides learning opportunity without high impact.

Full explanation →

1424

MCQhard

A solutions architect attempts to create this stack but receives an error: "Value of property SecurityGroups must be a list of strings". What is the likely cause?

A.The SecurityGroups property should be a list, but the YAML specifies a single reference incorrectly.

B.The security group ingress rule allows SSH from anywhere.

C.There is a circular dependency between the EC2 instance and the security group.

D.The AMI ID is invalid.

AnswerA

The error occurs when the SecurityGroups property is provided as a single string instead of a list. In CloudFormation, even one security group must be specified as a list, e.g., [!Ref MySecurityGroup].

Why this answer

The error 'Value of property SecurityGroups must be a list of strings' occurs because the YAML template specifies the SecurityGroups property as a single string (e.g., !Ref MySecurityGroup) instead of a list of strings (e.g., [!Ref MySecurityGroup]). In AWS CloudFormation, the SecurityGroups property for an EC2 instance expects a list of security group IDs or names, even if only one security group is provided. The YAML syntax must wrap the reference in square brackets to form a list, or the template will fail validation.

Exam trap

The trap here is that candidates may confuse the SecurityGroups property with SecurityGroupIds, or assume that a single reference can be passed as a scalar, but CloudFormation strictly enforces the list type for SecurityGroups even when only one security group is used.

How to eliminate wrong answers

Option B is wrong because allowing SSH from anywhere (0.0.0.0/0) is a security concern but does not cause a 'list of strings' error; it would only trigger a security review or a different validation error if the template explicitly forbids it. Option C is wrong because a circular dependency between the EC2 instance and the security group would cause a stack creation failure with a 'circular dependency' error, not a type mismatch error about SecurityGroups. Option D is wrong because an invalid AMI ID would produce an error like 'AMI ID not found' or 'InvalidAMIID.NotFound', not a property type validation error.

Full explanation →

1425

MCQmedium

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application has a health check endpoint at /health. Recently, the ALB is marking instances as unhealthy even though the application is running. The health check settings are: interval 30 seconds, timeout 5 seconds, unhealthy threshold 2. What is the most likely cause?

A.The health check interval of 30 seconds is too long.

B.The unhealthy threshold of 2 is too high.

C.The health check timeout of 5 seconds is too short for the application to respond.

D.The health check path /health is not accessible from the ALB.

AnswerC

A short timeout can cause false unhealthy markings.

Why this answer

A timeout of 5 seconds may be insufficient if the application's /health endpoint takes longer to respond due to high load or backend processing. The ALB expects a response within the timeout; if not received, it marks the instance unhealthy. Option A is wrong because a 30-second interval is standard and not too long; reducing it would increase load but not fix the timeout issue.

Option B is wrong because an unhealthy threshold of 2 is reasonable; lowering it would mark instances unhealthy more quickly but does not address the root cause of slow responses. Option D is wrong because the path /health is accessible (the application is running), so the ALB can reach it; the problem is the response time.

Full explanation →

Page 19 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →