Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 76–150

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 2 of 23

76

Multi-Selecteasy

A company is designing a new VPC with public and private subnets. The company wants to ensure that instances in the private subnets can download updates from the internet, but cannot be directly accessed from the internet. Which THREE components are required to meet these requirements? (Choose THREE.)

Select 3 answers

A.A route table for private subnets with a default route pointing to the NAT Gateway.

B.An Internet Gateway attached to the VPC.

C.A Virtual Private Gateway (VGW).

D.A NAT Gateway in a public subnet.

E.A VPC endpoint for S3.

AnswersA, B, D

This route ensures that outbound traffic from private subnets is directed to the NAT Gateway.

Why this answer

A route table for private subnets with a default route (0.0.0.0/0) pointing to a NAT Gateway ensures that outbound traffic from instances in private subnets is forwarded to the NAT Gateway for internet access, while the NAT Gateway does not allow inbound connections initiated from the internet. This satisfies the requirement that instances can download updates but cannot be directly accessed from the internet.

Exam trap

The trap here is that candidates often confuse a Virtual Private Gateway (VGW) with a NAT Gateway, mistakenly thinking a VGW can provide internet access, or they assume a VPC endpoint for S3 is sufficient for general internet downloads, when it only covers S3 traffic.

Full explanation →

77

MCQeasy

A company is designing a new web application that will be accessed by users worldwide. The application will serve static content (HTML, CSS, images) and dynamic API responses. The company wants to minimize latency for all users. Which combination of AWS services should the company use?

A.Amazon Route 53 and Amazon S3

B.Amazon CloudFront and Amazon API Gateway

C.Amazon S3 and Amazon CloudFront

D.Application Load Balancer (ALB) and Amazon CloudFront

AnswerB

CloudFront provides edge caching for static content and can route API requests to API Gateway, reducing latency.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that serves static content (HTML, CSS, images) from edge locations, minimizing latency. For dynamic API responses, CloudFront can route requests to Amazon API Gateway, which acts as a backend to handle API calls. This combination provides low-latency access worldwide for both static and dynamic content.

Option A (Route 53 + S3) is incorrect because Route 53 is DNS only and S3 alone does not provide caching at edge locations. Option C (S3 + CloudFront) is missing a managed API service for dynamic responses; while CloudFront can serve static content from S3, it needs API Gateway or a compute origin for dynamic APIs. Option D (ALB + CloudFront) places CloudFront in front of an ALB, but ALB is regional and does not effectively reduce latency for static assets; additionally, ALB is not optimized for API management like API Gateway.

Full explanation →

78

MCQeasy

A company is migrating a legacy application that uses a proprietary binary protocol over TCP. The application must be migrated with minimal changes and requires high throughput. Which AWS service should the architect recommend for load balancing?

A.Network Load Balancer (NLB)

B.AWS Global Accelerator

C.Application Load Balancer (ALB)

D.Classic Load Balancer (CLB)

AnswerA

NLB operates at Layer 4 and handles TCP traffic with high throughput.

Why this answer

Network Load Balancer (NLB) is designed for TCP traffic at high throughput with minimal latency, making it ideal for migrating legacy applications using proprietary binary protocols over TCP. Option B (AWS Global Accelerator) improves application performance by directing traffic over the AWS global network but is not a load balancer. Option C (Application Load Balancer) operates at Layer 7 and is best for HTTP/HTTPS traffic, not TCP.

Option D (Classic Load Balancer) is a legacy option that lacks the performance and features of NLB.

Full explanation →

79

MCQhard

A company is designing a new real-time analytics platform that ingests data from thousands of IoT devices. The devices send JSON messages every second to an AWS IoT Core topic. The messages must be processed and stored in Amazon S3 for long-term analysis. The processing includes enrichment by calling a third-party API to add location data. The company expects the workload to vary significantly, with peak traffic of 100,000 messages per second. The solution must be cost-effective and minimize operational overhead. The current architecture uses a Lambda function subscribed to the IoT topic, which processes each message and writes to S3. However, during initial testing, the Lambda function frequently times out due to the third-party API latency, causing message loss. What should the company do to resolve this issue while meeting all requirements?

A.Increase the Lambda function timeout to 15 minutes and memory to 10240 MB

B.Use Amazon Kinesis Data Firehose to buffer data and write to S3, then trigger a Lambda function to enrich data asynchronously

C.Enable Provisioned Concurrency on the Lambda function to reduce cold starts

D.Configure the IoT rule to write messages to an Amazon SQS queue. Then use a Lambda function with reserved concurrency to poll the queue and process messages at a controlled rate

AnswerD

SQS decouples ingestion from processing, preventing message loss, and reserved concurrency ensures consistent performance.

Why this answer

Decoupling the ingestion from the processing using an SQS queue allows the Lambda function to poll messages at a controlled rate, preventing timeouts from third-party API latency. The SQS queue acts as a buffer, absorbing traffic spikes of up to 100,000 messages per second, and Lambda can process messages asynchronously without loss. This approach is cost-effective and minimizes operational overhead by leveraging managed services.

Exam trap

The trap here is that candidates may think Kinesis Data Firehose is the best choice for buffering and enrichment, but they overlook that Firehose does not support real-time enrichment via Lambda before writing to S3; it only supports transformation with a Lambda function that has a limited timeout (60 seconds) and cannot handle asynchronous API calls reliably.

How to eliminate wrong answers

Option A is wrong because increasing the Lambda timeout to 15 minutes and memory to 10240 MB does not resolve the underlying issue of third-party API latency; it only delays the timeout, and Lambda has a maximum execution time of 15 minutes, but the function may still fail if the API is slow, and high memory increases cost without solving the buffering problem. Option B is wrong because Kinesis Data Firehose writes directly to S3, but triggering a Lambda function asynchronously from S3 events would not enrich data before storage; the enrichment would need to happen after the data is already in S3, which does not meet the requirement to enrich before storage and could lead to duplicate processing or data loss. Option C is wrong because Provisioned Concurrency reduces cold starts but does not address the timeout issue caused by third-party API latency; the function would still time out if the API is slow, and it does not provide buffering for traffic spikes.

Full explanation →

80

MCQhard

A CloudFormation stack creation command is run with a parameter. The template.yaml includes a parameter declared as follows: Parameters: InstanceTypeParameter: Type: String Default: t2.micro AllowedValues: - t2.micro - t2.small - t2.medium The stack creation fails with the error: "Value (t2.nano) for parameter InstanceTypeParameter is invalid. Must be one of: t2.micro, t2.small, t2.medium". What is the most likely cause?

A.The AWS CLI is using a deprecated version

B.The template.yaml file was modified after the command was run

C.The parameter was overridden by a previous stack operation or a different parameter file

D.The CLI command had a typo in the parameter value

AnswerD

The error shows 't2.nano', which is not in the allowed list. This directly points to a typo in the command or parameter file where the user inadvertently typed 't2.nano' instead of a valid instance type.

Why this answer

The error message shows that the value 't2.nano' was passed for the parameter. This value is not in the AllowedValues list. The most direct explanation is that the user made a typo in the CLI command or parameter file, supplying 't2.nano' instead of a valid value like 't2.micro'.

While CloudFormation can inherit parameters from previous operations, the specific invalid value 't2.nano' in the error indicates it was provided in the current command, not from an override. Therefore, option D is correct.

Full explanation →

81

MCQmedium

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

A.Enable AWS CloudTrail in the master account and log sts:AssumeRole events.

B.Create an IAM Access Analyzer in each member account to monitor cross-account access.

C.Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

D.Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.

AnswerA

CloudTrail logs all STS API calls, providing a centralized audit trail for cross-account role assumptions.

Why this answer

AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Exam trap

The trap here is that candidates often confuse AWS Config (which records resource configuration changes) with CloudTrail (which records API calls), leading them to choose Option C even though it cannot log the actual sts:AssumeRole events needed for auditing.

How to eliminate wrong answers

Option B is wrong because IAM Access Analyzer is designed to identify resources shared with external entities (outside the organization), not to audit or enforce cross-account role assumptions within the same organization. Option C is wrong because AWS Config records configuration changes to IAM roles but does not log the actual sts:AssumeRole API calls; it cannot provide an audit trail of role assumption events. Option D is wrong because a service control policy (SCP) that denies all IAM actions except sts:AssumeRole would prevent users from creating, modifying, or deleting IAM resources in member accounts, but it does not enforce that all IAM users and roles are created only in the master account, nor does it provide auditing of role assumptions.

Full explanation →

82

MCQeasy

A company wants to allow developers to launch EC2 instances only in the us-east-1 Region. They have a single AWS account. What is the simplest way to enforce this?

A.Create an IAM policy that denies EC2 actions unless the region is us-east-1.

B.Use AWS Config to terminate instances in other Regions.

C.Apply an SCP to the account.

D.Configure the default VPC in us-east-1 only.

AnswerA

IAM policy directly restricts user actions.

Why this answer

An IAM policy with a Deny effect for ec2:RunInstances when the region is not us-east-1 directly prevents developers from launching EC2 instances in any other region. This is the simplest approach as it uses native IAM condition keys (aws:RequestedRegion) without requiring additional services or complex configurations.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming SCPs can be applied to a standalone account, but SCPs require AWS Organizations and are not available for a single account without an organization.

How to eliminate wrong answers

Option B is wrong because AWS Config can detect non-compliant instances but cannot terminate them directly; it requires a custom remediation action (e.g., via AWS Systems Manager Automation) which adds complexity and is not the simplest solution. Option C is wrong because Service Control Policies (SCPs) are only available in AWS Organizations, and the question specifies a single AWS account without mentioning an organization, making SCPs inapplicable. Option D is wrong because configuring the default VPC only in us-east-1 does not prevent developers from launching instances in other regions; they can create a new VPC or use a non-default VPC in any region.

Full explanation →

83

Multi-Selectmedium

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Select 2 answers

A.Accounts cannot be moved between OUs once created.

B.Each organizational unit (OU) should contain only one account for security isolation.

C.AWS CloudTrail can be configured to log management events across all accounts from the management account.

D.Service control policies (SCPs) can be used to centrally restrict permissions across accounts.

E.SCPs can only be applied to root accounts, not OUs.

AnswersC, D

CloudTrail can be enabled for all accounts via Organizations.

Why this answer

AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can only be applied to the root account, when in fact they can be attached to any OU or account within the organization.

Full explanation →

84

MCQeasy

Refer to the exhibit. A company is using an S3 bucket to store migration logs. The company has set a lifecycle policy to transition objects to Glacier after 30 days and expire them after 365 days. After 45 days, the company notices that the objects are still in S3 Standard. What is the most likely reason?

A.The lifecycle policy has a filter that excludes these objects.

B.The objects were created after the lifecycle policy was applied, so they have not reached 30 days of age yet.

C.The lifecycle policy is not enabled for the bucket.

D.The S3 bucket versioning is disabled, so lifecycle rules do not apply.

AnswerB

Lifecycle rules are based on object age.

Why this answer

The lifecycle policy transitions objects based on their creation date (age), not the policy creation date. If the objects were created after the policy was applied, they have not yet reached 30 days of age even though 45 days have passed since policy creation. For example, objects created 20 days ago are only 20 days old and will not transition until they are 30 days old.

Option A is incorrect because while a filter could exclude objects, it is not the most likely reason given no evidence of a filter. Option C is incorrect because the policy is enabled (implied by the exhibit). Option D is incorrect because lifecycle rules apply regardless of versioning state; versioning is not required for transitions.

Full explanation →

85

MCQeasy

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. The company also needs to ensure that any attempt to upload an unencrypted object is blocked. How can the company enforce this requirement?

A.Use a bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with value aws:kms

B.Enable default encryption on the bucket with AWS KMS

C.Use AWS CloudTrail to monitor PutObject calls and alert on unencrypted uploads

D.Enable S3 Object Lock on the bucket

AnswerA

This policy condition ensures encryption is used.

Why this answer

A bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with the value aws:kms will enforce encryption at upload time, blocking any unencrypted upload. Option B (default encryption) does not enforce on all uploads if the request header is omitted. Option C (CloudTrail) is detective, not preventive.

Option D (Object Lock) is for write-once-read-many (WORM) compliance, not encryption.

Full explanation →

86

MCQmedium

A company is migrating a multi-tier web application to AWS. The application consists of a stateless web tier and a stateful application tier that uses sticky sessions. The company wants to reduce operational overhead and improve elasticity. Which architecture should the solutions architect recommend?

A.Use an Application Load Balancer with sticky sessions for the web tier. Store session data in Amazon ElastiCache.

B.Use Amazon CloudFront with an origin load balancer and store session data in the web tier's local storage.

C.Use an Application Load Balancer with cross-zone load balancing and store session data in Amazon DynamoDB.

D.Use a Network Load Balancer with instance targets and Amazon EFS to share session data.

AnswerA

ALB sticky sessions route requests to the same instance, but session data is stored externally in ElastiCache, allowing any instance to serve requests.

Why this answer

Using an Application Load Balancer (ALB) with sticky sessions (session affinity) enables the web tier to be stateless and scale horizontally. The application tier can use ElastiCache for session state storage, making it stateless as well. This reduces overhead and improves elasticity.

NLB with EFS is not suitable for session state; ALB with DynamoDB is overkill; CloudFront does not support sticky sessions.

Full explanation →

87

MCQhard

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

A.Two log files are larger than 1 KB.

B.The log files are larger than 1000 KB.

C.The bucket contains only two objects with the prefix 'logs/'.

D.The bucket has versioning enabled.

AnswerA

1000 bytes = 1 KB.

Why this answer

The command uses the --query parameter to filter objects where size > 1000 bytes (1 KB) and returns only the keys of those objects. The output displays two keys, meaning exactly two log files are larger than 1 KB. Therefore, option A is correct.

Option B is incorrect because the filter is 1000 bytes, not 1000 KB. Option C is incorrect because the bucket may contain more than two objects with the prefix 'logs/', but only two are larger than 1 KB. Option D is incorrect because the command does not query versioning.

Full explanation →

88

MCQmedium

A company is designing a containerized microservices architecture on Amazon ECS. The services must be able to discover each other using DNS names. Which AWS service should the company use for service discovery?

A.AWS Cloud Map

B.Amazon Route 53 Resolver

C.Elastic Load Balancing (ELB)

D.Amazon Elastic Container Registry (ECR)

AnswerA

Cloud Map provides DNS-based service discovery for microservices.

Why this answer

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS. It allows microservices to register their DNS names and health checks, enabling other services to discover them via DNS queries or API calls. This directly supports the requirement for containerized services to find each other using DNS names within an ECS cluster.

Exam trap

The trap here is confusing a load balancer (ELB) with service discovery; candidates often think ELB provides DNS-based discovery, but it only routes traffic to a group of targets, not per-instance DNS names for dynamic microservice-to-microservice communication.

How to eliminate wrong answers

Option B (Amazon Route 53 Resolver) is wrong because it is a DNS resolution service for hybrid networks (on-premises to AWS), not a service discovery mechanism for ECS microservices; it does not register or manage service instances. Option C (Elastic Load Balancing) is wrong because it distributes traffic to targets but does not provide DNS-based service discovery for individual service instances; it is a load balancer, not a discovery registry. Option D (Amazon Elastic Container Registry) is wrong because it is a container image repository, not a service discovery tool; it stores Docker images but has no role in DNS resolution or instance registration.

Full explanation →

89

MCQmedium

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

A.The condition key 'aws:SourceIp' is misspelled.

B.The deny statement does not apply to the users attempting to access the bucket.

C.The policy is an IAM policy, not a bucket policy, and the condition key is invalid.

D.The policy is attached to the IAM user instead of the bucket.

AnswerB

The deny statement might be scoped to a different principal, allowing access from other IPs.

Why this answer

An explicit deny in a bucket policy overrides any allow, but only if the deny statement applies to the principal making the request. If the deny statement specifies a different principal (e.g., an AWS account or role not matching the users), or includes a condition that does not evaluate to true for these users, the deny does not take effect. Therefore, the allow statement granting access based on IP range would still apply, allowing users outside the range to access the bucket.

Option A is incorrect because the condition key syntax is not the issue; the deny is not applying to the correct principals. Option C is incorrect because the question states an IAM policy is attached to an S3 bucket, which is possible (resource-based policy), and the condition key 'aws:SourceIp' is valid. Option D is incorrect because the policy is attached to the bucket, not to individual users.

Full explanation →

90

MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. The company wants to ensure that if a stack update fails, the stack automatically rolls back to the last known good state. Which CloudFormation stack option should the company configure?

A.Enable termination protection on the stack.

B.Configure a stack policy to prevent updates to critical resources.

C.Set the 'Rollback on failure' option to 'Yes' when performing the stack update.

D.Use a change set to review changes before updating the stack.

AnswerC

This is the default behavior; if an update fails, CloudFormation rolls back automatically.

Why this answer

When performing a stack update, you can set the 'Rollback on failure' option to 'Yes'. This ensures that if the update fails, CloudFormation automatically rolls back to the last known good state. Option A is incorrect because termination protection prevents accidental deletion, not rollback.

Option B is incorrect because a stack policy controls which resources can be updated, not rollback behavior. Option D is incorrect because change sets allow you to review changes but do not provide automatic rollback.

Full explanation →

91

MCQmedium

A company is migrating a legacy application from an on-premises data center to AWS. The application uses a proprietary network protocol that is not supported by AWS Application Migration Service. What should the company do to migrate this application?

A.Refactor the application to use standard protocols before migration.

B.Use the 7 Rs migration strategy to evaluate other options.

C.Use AWS Application Migration Service with a network bridge appliance.

D.Perform a manual rehost migration using Amazon EC2 and custom AMIs.

AnswerD

Manual rehost bypasses MGN's limitations.

Why this answer

D is correct because performing a manual rehost migration using Amazon EC2 and custom AMIs allows the company to migrate the legacy application without depending on AWS Application Migration Service (MGN), which does not support the proprietary protocol. This approach replicates the on-premises environment in AWS. A is incorrect because refactoring the application to use standard protocols would require significant code changes and is not necessary for migration.

B is incorrect because the 7 Rs strategy is a framework for evaluating migration approaches, not a specific solution to the protocol incompatibility. C is incorrect because AWS Application Migration Service with a network bridge appliance does not address the lack of support for the proprietary protocol.

Full explanation →

92

MCQmedium

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

A.Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

B.Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

C.Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

D.Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.

AnswerD

Run Command can execute commands immediately on targeted instances.

Why this answer

AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts.

Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Full explanation →

93

MCQhard

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

A.Launch the ECS tasks in the same private subnet as the RDS instance.

B.Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

C.Set up a VPN connection between the ECS tasks and the database.

D.Use an Application Load Balancer to route traffic to the database.

AnswerA

Tasks in the same subnet can communicate via security groups.

Why this answer

ECS tasks should be launched in the same private subnet as the RDS instance to allow direct network communication via VPC routing, without needing internet gateways or NAT. Option B is incorrect because placing ECS tasks in a public subnet with a NAT gateway would require traffic to go through the NAT, but NAT gateways are for outbound internet access, not for inbound traffic to private resources; also, public subnets have direct internet access which is unnecessary and could introduce security risks. Option C is incorrect because a VPN connection is typically used for on-premises to VPC connectivity, not for internal VPC communication; VPC routing and security groups are sufficient.

Option D is incorrect because an Application Load Balancer is used for load balancing HTTP/HTTPS traffic to application targets, not for routing internal database traffic; it would add unnecessary complexity and latency.

Full explanation →

94

Multi-Selectmedium

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

Select 2 answers

A.Create an Aurora read replica and direct read queries to it.

B.Increase the DB instance class to a larger size.

C.Implement an ElastiCache for Redis caching layer to cache frequent queries.

D.Enable Amazon RDS Performance Insights to identify slow queries.

E.Increase the Auto Scaling group maximum size to handle more traffic.

AnswersA, C

Read replicas offload read traffic from the primary instance.

Why this answer

Creating an Aurora read replica offloads read queries from the primary DB instance, reducing CPU load on it. Option C is correct because implementing an ElastiCache for Redis caching layer reduces the number of repeated read queries hitting the database, further lowering CPU utilization. Option B is wrong: while increasing the DB instance class could provide more CPU resources, it does not reduce load—it only scales up, which is not a best practice for immediate load reduction without code changes.

Option D is wrong because Performance Insights is a monitoring tool for identifying performance bottlenecks, not a direct mechanism to reduce database load. Option E is wrong because increasing the Auto Scaling group size only scales the application tier, which would increase traffic to the database, worsening the CPU issue.

Full explanation →

95

Multi-Selecthard

A company is modernizing its monolithic Java application to a microservices architecture on AWS. The application uses a shared Oracle database. The team wants to implement an event-driven architecture. Which TWO AWS services should be used to decouple microservices and handle asynchronous communication?

Select 2 answers

A.AWS AppSync

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Streams

D.Amazon EventBridge

E.Amazon Simple Queue Service (SQS)

AnswersD, E

Amazon EventBridge enables event-driven architectures by routing events between sources and targets; it is a correct choice for decoupling and asynchronous communication.

Why this answer

Correct answers are D (Amazon EventBridge) and E (Amazon Simple Queue Service - SQS). SQS provides a reliable message queue for decoupling microservices and enabling asynchronous communication. EventBridge allows building event-driven architectures by routing events from various sources to targets.

Option A (AWS AppSync) is for building GraphQL APIs; it does not handle decoupling in an event-driven pattern. Option B (Amazon SNS) is a pub/sub notification service but not primarily for decoupling queues; it can be used for fan-out but not as a queue. Option C (Amazon Kinesis Data Streams) is for real-time streaming data; it is not typically used for simple decoupling of microservices.

Full explanation →

96

MCQhard

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL database. Recently, the application has become slow during peak hours. The operations team notices that the database CPU utilization is high, but the number of connections is within limits. The application is read-heavy. The team wants to improve performance with minimal changes to the application code. The database is currently a single Aurora instance. Which solution should the team implement?

A.Add an Aurora Replica and configure the application to use the reader endpoint for read-only queries.

B.Use Amazon DynamoDB Accelerator (DAX) to cache database queries.

C.Add an Amazon ElastiCache Redis cluster in front of the database.

D.Increase the instance size of the Aurora primary instance.

AnswerA

This offloads read traffic with minimal application changes.

Why this answer

Adding an Aurora Replica distributes read traffic, reducing load on the primary instance. The application must be configured to use the reader endpoint for read queries.

Full explanation →

97

MCQhard

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

A.The bucket is not encrypted.

B.The bucket policy does not restrict access to a specific IP range.

C.Bucket versioning is not enabled.

D.No logging configuration is specified.

AnswerD

Logging is needed for audit.

Why this answer

The question states that the security team requires all access to be logged, but the CloudFormation template does not include any logging configuration (e.g., server access logs or AWS CloudTrail object-level logging). Without enabling S3 server access logging or delivering logs to a target bucket, no access records are generated, violating the logging requirement. The bucket policy and versioning are irrelevant to the logging gap.

Exam trap

The trap here is that candidates confuse security controls like encryption, IP restrictions, or versioning with logging, failing to recognize that the specific requirement for 'all access to be logged' can only be met by explicitly configuring a logging destination.

How to eliminate wrong answers

Option A is wrong because encryption (e.g., SSE-S3, SSE-KMS) protects data at rest but does not provide access logging; the security requirement is about logging, not encryption. Option B is wrong because restricting access to a specific IP range controls who can access the bucket but does not enable logging; the requirement is for all access to be logged, not restricted. Option C is wrong because bucket versioning is already enabled per the template description, and versioning preserves object versions but does not log access events.

Full explanation →

98

Multi-Selectmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and EC2 instance status checks. The team needs to identify the root cause of the latency. Which TWO actions should the team take to diagnose the issue? (Choose two.)

Select 2 answers

A.Enable detailed monitoring (1-minute metrics) on the ALB and create a CloudWatch dashboard to view the RequestCount and TargetResponseTime metrics.

B.Integrate the application with AWS X-Ray and enable tracing on the EC2 instances to capture trace data for all requests.

C.Set up an Amazon CloudWatch Synthetics canary that follows a step-by-step guide through the application and monitor the step durations.

D.Enable access logging on the ALB and analyze the logs to find requests with high latency.

E.Enable VPC Flow Logs on the subnets where the EC2 instances reside and analyze the logs for packet loss.

AnswersC, D

Correct: Canaries can measure end-to-end latency and pinpoint slow steps.

Why this answer

CloudWatch Synthetics canaries simulate user workflows step by step, and monitoring step durations helps pinpoint which specific part of the application is causing latency spikes. This provides granular, end-to-end visibility into the user experience beyond what aggregate metrics offer. Option D is correct because ALB access logs contain detailed information about each request, including timestamps, processing times, and response times.

Analyzing these logs can help identify specific requests that contribute to high latency, such as those with long target response times or backend errors.

Exam trap

The trap here is that candidates often confuse network-level diagnostics (VPC Flow Logs) or aggregate metrics (ALB detailed monitoring) with the application-level, user-experience-focused diagnostics needed to pinpoint the root cause of latency spikes in a web application.

Full explanation →

99

MCQhard

A company uses AWS Organizations and wants to delegate administration of a specific service to a member account. The service must be able to perform actions across all accounts in the organization. Which steps should the company take?

A.Use AWS Organizations to register the member account as a delegated administrator for the service.

B.Create a service-linked role in each account to allow the service to perform actions.

C.Grant the member account IAM permissions to assume the OrganizationAccountAccessRole in all accounts.

D.Create an IAM role in each account with a trust policy that allows the service to assume it.

AnswerA

Delegated administration allows the member account to manage the service across the organization.

Why this answer

AWS Organizations allows you to designate a member account as a delegated administrator for a specific AWS service. Once registered, that account can perform administrative actions (e.g., creating resources, managing policies) across all accounts in the organization on behalf of that service, without needing individual IAM roles or permissions in each account.

Exam trap

The trap here is that candidates often confuse delegated administration with creating cross-account IAM roles or using the OrganizationAccountAccessRole, not realizing that AWS Organizations provides a native, centralized registration mechanism for service-level delegation.

How to eliminate wrong answers

Option B is wrong because service-linked roles are automatically created by AWS services for their own use, not for delegating administration to a member account; they do not grant cross-account administrative capabilities. Option C is wrong because the OrganizationAccountAccessRole is designed for human administrators to access member accounts via the AWS Management Console or API, not for a service to perform actions programmatically across all accounts. Option D is wrong because creating an IAM role in each account with a trust policy for the service would require manual setup and maintenance in every account, which is not the intended mechanism for delegated administration; AWS Organizations provides a centralized registration process instead.

Full explanation →

100

MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team needs to allocate costs to different departments based on resource tags. However, some resources are not tagged. What is the most effective solution?

A.Use AWS Trusted Advisor to check for untagged resources.

B.Use Service Control Policies to deny creation of untagged resources.

C.Use AWS Cost Categories to create rules for untagged resources and AWS Budgets to alert when resources lack tags.

D.Use AWS Cost Explorer to filter by tags and manually identify untagged resources.

AnswerC

Cost Categories allocate costs; Budgets can trigger alerts for untagged resources.

Why this answer

AWS Cost Categories allow allocating costs based on rules, and AWS Budgets can alert when untagged resources exist. Option A is wrong because AWS Trusted Advisor can identify untagged resources but cannot enforce cost allocation. Option B is wrong because Service Control Policies can deny creation of untagged resources but do not address cost allocation for existing untagged resources.

Option D is wrong because AWS Cost Explorer can filter by tags but requires manual identification and does not automate cost allocation for untagged resources.

Full explanation →

101

MCQmedium

A company is designing a new CI/CD pipeline for a containerized application using AWS CodePipeline. The application source code is stored in an Amazon S3 bucket. The pipeline must automatically build a Docker image from the source code and push it to Amazon ECR. Which action should be used as the build provider?

A.AWS CodeDeploy

B.AWS CodeCommit

C.Amazon ECS

D.AWS CodeBuild

AnswerD

AWS CodeBuild is a fully managed build service that can compile source code, run tests, and produce software packages, including Docker images, which it can push to ECR.

Why this answer

AWS CodeBuild is the correct build provider because it is a fully managed continuous integration service that can compile source code, run tests, and produce Docker images. It integrates natively with CodePipeline and Amazon ECR, allowing you to define a buildspec.yml file that uses the 'aws ecr get-login-password' command and 'docker build/push' commands to build and push the image directly to ECR.

Exam trap

The trap here is that candidates often confuse Amazon ECS (a container runtime service) with a build service, or assume CodeDeploy can handle image building because it supports ECS deployments, but neither service can compile source code or push images to ECR.

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is a deployment service that automates application deployments to EC2, Lambda, or on-premises instances; it does not build Docker images or push them to ECR. Option B is wrong because AWS CodeCommit is a source control service for hosting Git repositories; it cannot perform build actions or push images to ECR. Option C is wrong because Amazon ECS is a container orchestration service that runs containers on a cluster; it does not build images or act as a build provider in CodePipeline.

Full explanation →

102

MCQeasy

A company's security team wants to ensure that all S3 buckets are encrypted at rest. They have thousands of existing buckets. Which approach should a Solutions Architect use to identify noncompliant buckets?

A.Use AWS Trusted Advisor to check bucket encryption.

B.Analyze AWS CloudTrail logs for PutBucketEncryption API calls.

C.Enable S3 Inventory to list all objects and their encryption status.

D.Create an AWS Config rule to evaluate S3 bucket encryption settings.

AnswerD

Config rules can evaluate all buckets.

Why this answer

AWS Config provides managed rules to evaluate resource compliance. The 's3-bucket-server-side-encryption-enabled' rule checks if S3 buckets have server-side encryption enabled. This can be applied to all buckets in the account.

Option A is incorrect because while AWS Trusted Advisor can check for bucket encryption, AWS Config is specifically designed for continuous compliance monitoring and auditing at scale, making it the better approach for identifying noncompliant buckets across thousands of resources. Option B is incorrect: CloudTrail logs record API calls (like PutBucketEncryption), but do not show the current encryption configuration of existing buckets. Option C is incorrect: S3 Inventory provides a list of objects and their metadata, but it does not directly indicate bucket-level encryption settings; it focuses on object-level encryption.

Full explanation →

103

MCQmedium

A company needs to store configuration files for multiple environments (dev, test, prod) and retrieve them programmatically with versioning and access control. Which AWS service should be used?

A.AWS Secrets Manager

B.Amazon S3

C.AWS Systems Manager Parameter Store

D.Amazon DynamoDB

AnswerC

Parameter Store is designed for configuration management.

Why this answer

AWS Systems Manager Parameter Store is the correct choice because it is designed to store configuration data and secrets hierarchically (e.g., /dev/config, /prod/config) with built-in versioning and fine-grained access control via IAM policies. It supports retrieval programmatically through the AWS SDK, CLI, or API, and integrates natively with other AWS services for parameter updates and notifications.

Exam trap

The trap here is that candidates confuse Secrets Manager with Parameter Store because both can store secure strings, but Secrets Manager lacks hierarchical path support and is overkill for non-secret configuration files, while Parameter Store is purpose-built for hierarchical config management with versioning.

How to eliminate wrong answers

Option A is wrong because AWS Secrets Manager is optimized for managing secrets (e.g., database credentials, API keys) with automatic rotation, not for general configuration files with versioning; it lacks hierarchical storage for environments like dev/test/prod. Option B is wrong because Amazon S3 can store configuration files with versioning and access control, but it is an object storage service, not a purpose-built configuration store; it requires additional logic for hierarchical retrieval and lacks native parameter-store features like tiered pricing and secure string encryption without extra setup. Option D is wrong because Amazon DynamoDB is a NoSQL database designed for high-performance key-value and document workloads, not for storing configuration files with versioning; it would require custom implementation for version control and access control, adding unnecessary complexity and cost.

Full explanation →

104

MCQeasy

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 10 minutes. Which AWS service should be used?

A.Amazon Inspector

B.AWS Config

C.Amazon CloudWatch Alarms

D.AWS CloudTrail

AnswerC

CloudWatch Alarms monitor metrics and send notifications.

Why this answer

CloudWatch Alarms can monitor metrics and trigger actions when a threshold is breached.

Full explanation →

105

Multi-Selectmedium

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Select 2 answers

A.AWS Secrets Manager

B.AWS Systems Manager Parameter Store

C.Amazon S3

D.AWS CloudFormation

E.AWS KMS

AnswersA, B

Designed for secrets management.

Why this answer

AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secure strings) with AWS Secrets Manager, but the exam expects you to know that Secrets Manager is the preferred service for secrets that require automatic rotation, while Parameter Store is better for configuration data that does not need rotation, and both are correct in this question because the requirement is to store both configuration data and secrets securely.

Full explanation →

106

MCQeasy

A company uses AWS Organizations with a single OU. The management account has a service control policy (SCP) that denies all actions on EC2 instances with a specific tag. However, users in a member account can still terminate tagged instances. What is the most likely cause?

A.The SCP is attached to the root, not the OU.

B.The users have a permissions boundary that allows the actions.

C.The SCP's condition key does not match the actual tag.

D.The users are operating in the management account.

AnswerD

SCPs do not apply to the management account.

Why this answer

SCPs do not affect the management account in AWS Organizations. They can only restrict permissions in member accounts. Since the users are operating in the management account, the SCP denying EC2 termination based on a tag has no effect, allowing them to terminate the tagged instances.

Exam trap

The trap here is that candidates assume SCPs apply to all accounts in the organization, including the management account, but AWS explicitly exempts the management account from SCP evaluation.

How to eliminate wrong answers

Option A is wrong because attaching the SCP to the root or the OU does not change its applicability—SCPs apply to all member accounts under the root or OU, but never to the management account. Option B is wrong because a permissions boundary can only restrict, not allow, actions beyond what the SCP denies; SCPs are an outer boundary that overrides any IAM permissions, including boundaries. Option C is wrong because if the condition key did not match the actual tag, the SCP would not deny the action, but the question states the SCP is designed to deny actions on EC2 instances with a specific tag; the most likely cause given the scenario is that users are in the management account, not a condition mismatch.

Full explanation →

107

MCQmedium

A media company is designing a new video transcoding pipeline on AWS. Raw video files (up to 10 GB each) are uploaded by users to an S3 bucket. Each upload must be transcoded into multiple formats (MP4, WebM, HLS) and stored in another S3 bucket. The transcoding job can take up to 30 minutes per file. The company needs a solution that is cost-effective and can handle hundreds of concurrent uploads. The operations team wants to minimize maintenance. Which solution should a Solutions Architect recommend?

A.Use S3 event notifications to invoke an AWS Lambda function that performs transcoding and stores results.

B.Use S3 event notifications to invoke a Lambda function that submits a job to AWS Elemental MediaConvert for each file.

C.Use an Auto Scaling group of EC2 instances with transcoding software installed. Configure S3 events to send messages to an SQS queue, which the instances poll.

D.Use S3 event notifications to trigger an AWS Step Functions workflow that runs an ECS Fargate task for each file.

AnswerB

MediaConvert is a managed, scalable service designed for video transcoding; Lambda handles the orchestration.

Why this answer

AWS Elemental MediaConvert is a fully managed, serverless media transcoding service designed for high-volume, multi-format video processing. Using S3 event notifications to invoke a Lambda function that submits a job to MediaConvert offloads the transcoding complexity, scales automatically to handle hundreds of concurrent uploads, and requires no infrastructure maintenance, making it both cost-effective and operationally minimal.

Exam trap

The trap here is that candidates may choose Option A (Lambda) without considering the 15-minute timeout limit, or Option D (Step Functions + Fargate) because it sounds serverless, but they overlook that MediaConvert is the fully managed, cost-optimized service specifically designed for this use case.

How to eliminate wrong answers

Option A is wrong because AWS Lambda has a maximum execution timeout of 15 minutes, but the transcoding job can take up to 30 minutes per file, so the Lambda function would time out before completion. Option C is wrong because managing an Auto Scaling group of EC2 instances with transcoding software introduces significant maintenance overhead (patching, scaling policies, instance health) and is not cost-effective for sporadic or bursty workloads compared to a serverless service. Option D is wrong while technically possible, using ECS Fargate tasks orchestrated by Step Functions adds unnecessary complexity and cost compared to MediaConvert, which is purpose-built for video transcoding and natively integrates with S3; Fargate requires custom container images, task definitions, and more operational overhead.

Full explanation →

108

Multi-Selecthard

A company is migrating a large number of on-premises VMs to AWS. They need to assess the current environment and track migration progress. Which THREE AWS services should be used together?

Select 3 answers

A.AWS Server Migration Service (SMS)

B.AWS Application Migration Service (MGN)

C.AWS Migration Hub

D.AWS Database Migration Service (DMS)

E.AWS Application Discovery Service

AnswersB, C, E

Automates lift-and-shift migration of VMs.

Why this answer

To assess the current environment and track migration progress for a large number of on-premises VMs, the correct combination is AWS Application Discovery Service (to discover and map dependencies), AWS Migration Hub (to track progress across multiple tools), and AWS Application Migration Service (MGN) (to automate VM migration). Option A (SMS) is deprecated and replaced by MGN. Option D (DMS) is for databases, not VMs.

Full explanation →

109

MCQhard

A company has a multi-account AWS environment and uses AWS Organizations. The security team wants to automatically remediate non-compliant resources, such as S3 buckets that are publicly accessible. Which design should they implement?

A.Use Amazon Inspector to scan for public buckets.

B.Use an SCP to deny making buckets public.

C.Use AWS Config rules to detect public buckets and trigger an AWS Lambda function to make them private.

D.Use AWS CloudTrail to send alerts when a bucket becomes public.

AnswerC

Config rules can invoke Lambda for remediation.

Why this answer

AWS Config rules can continuously evaluate S3 bucket configurations against a custom or managed rule (e.g., 's3-bucket-public-read-prohibited'). When a bucket is detected as publicly accessible, the rule can invoke an AWS Lambda function via an Amazon CloudWatch Events event to automatically apply a bucket policy that removes public access, achieving automated remediation.

Exam trap

The trap here is that candidates often confuse preventive controls (SCPs) with detective and corrective controls (AWS Config + Lambda), assuming SCPs can automatically fix existing non-compliant resources, when in reality SCPs only block future API actions and do not remediate current state.

How to eliminate wrong answers

Option A is wrong because Amazon Inspector is designed for vulnerability management and network accessibility assessments of EC2 instances, containers, and Lambda functions, not for scanning S3 bucket public access configurations. Option B is wrong because Service Control Policies (SCPs) can only deny or allow API actions at the account level (e.g., s3:PutBucketPolicy), but they cannot remediate already-public buckets; they prevent future changes but do not fix existing non-compliant resources. Option D is wrong because AWS CloudTrail logs API calls and can send alerts via CloudWatch alarms when a bucket becomes public, but it does not provide automated remediation; it only notifies, leaving the security team to manually fix the issue.

Full explanation →

110

MCQmedium

A company uses Amazon DynamoDB as its primary database. The operations team is seeing increased read latency during peak hours. The table has a provisioned read capacity of 1000 RCU, but CloudWatch metrics show that consumed read capacity frequently reaches 1000 RCU. The application uses eventually consistent reads. What is the MOST cost-effective way to reduce read latency?

A.Switch to strongly consistent reads to improve consistency.

B.Enable DynamoDB Accelerator (DAX) to cache frequently read items.

C.Create a global secondary index (GSI) on the table to offload reads.

D.Increase the provisioned read capacity to 2000 RCU.

E.Use Amazon ElastiCache for Memcached as a read cache.

AnswerB

DAX provides microsecond read latency and reduces load on the table.

Why this answer

DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency by serving frequently accessed items from cache, without increasing provisioned RCU. This is cost-effective as it adds minimal cost compared to increasing capacity. Option A is wrong because switching to strongly consistent reads consumes double the RCU (since they require a read of the primary replica), increasing cost and potentially worsening latency.

Option C is wrong because a Global Secondary Index (GSI) offloads reads from the base table but does not reduce latency for reads on the base table itself; it also incurs additional write costs. Option D is wrong because increasing RCU to 2000 would double the cost, though it might reduce throttling, it's not the most cost-effective. Option E is wrong because using ElastiCache adds operational complexity and cost, and DAX is a more seamless, DynamoDB-native caching solution.

Full explanation →

111

MCQmedium

A company is moving a legacy application that uses a shared file system to AWS. The application requires POSIX-compliant file storage that can be accessed by multiple EC2 instances simultaneously. Which AWS storage service should they use?

A.Amazon FSx for Windows File Server

B.Amazon EFS

C.Amazon EBS with Multi-Attach

D.Amazon S3

AnswerB

Provides a scalable, POSIX-compliant NFS file system.

Why this answer

(Amazon EFS) is correct because it provides a scalable, POSIX-compliant NFS file system that can be accessed by multiple EC2 instances simultaneously. Option A (Amazon FSx for Windows File Server) uses SMB protocol and is not POSIX-compliant. Option C (Amazon EBS with Multi-Attach) only supports a limited number of instances and has specific constraints, and it is not a fully managed shared file system.

Option D (Amazon S3) is object storage and does not provide POSIX compliance.

Full explanation →

112

Multi-Selecthard

A company is migrating a large-scale e-commerce platform to AWS. The platform uses a MySQL database with a 2 TB dataset. They want to modernize to Amazon Aurora MySQL with minimal downtime. Which THREE steps should they take? (Select THREE.)

Select 2 answers

A.Use AWS Schema Conversion Tool (SCT) to convert the existing schema to Aurora MySQL

B.Set up an Aurora Replica from the source MySQL instance

C.Use Amazon RDS for MySQL instead of Aurora

D.Migrate the database to Amazon DynamoDB

E.Use AWS DMS with ongoing replication using Change Data Capture (CDC)

AnswersA, E

Correct. AWS SCT helps convert the existing MySQL schema to be compatible with Aurora MySQL, addressing any differences in storage engines, partitioning, or other features.

Why this answer

To migrate a large MySQL database to Amazon Aurora MySQL with minimal downtime, the recommended steps are to use AWS Schema Conversion Tool (SCT) to convert the schema to Aurora-compatible format and AWS DMS with ongoing replication using Change Data Capture (CDC) to synchronize data with near-zero downtime. Setting up an Aurora Replica from the source MySQL instance (Option B) is not possible because Aurora Replicas are only within Aurora, not from an external MySQL source. Options C and D are incorrect as they do not target Aurora.

Full explanation →

113

MCQmedium

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

A.The Suspended account was invited to the organization.

B.The Production account is the management account.

C.The Suspended account cannot be used until it is reactivated.

D.The Management account was created directly.

AnswerC

Suspended accounts are not active and must be reactivated.

Why this answer

The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Exam trap

The trap here is that candidates often confuse account status (SUSPENDED) with the method of account creation (invited vs. created), leading them to incorrectly infer that a suspended account must have been invited, when in fact suspension is independent of how the account joined the organization.

How to eliminate wrong answers

Option A is wrong because a suspended account is not necessarily one that was invited; it could have been created directly or invited and then suspended. The status alone does not indicate the invitation method. Option B is wrong because the 'Production' account is listed as a member account (not the management account), as the management account is the one that initiated the organization and is not shown in the list of member accounts.

Option D is wrong because the management account is the original account that created the organization; it is not 'created directly' within the organization — it is the root account that already existed before the organization was formed.

Full explanation →

114

Multi-Selectmedium

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

Select 2 answers

A.Enable Multi-AZ deployment for the database.

B.Create one or more read replicas in the same Region.

C.Increase the instance size of the primary database.

D.Use Amazon ElastiCache to cache query results.

E.Implement an RDS Proxy to manage connections.

AnswersB, E

Read replicas serve read traffic, reducing load on the primary.

Why this answer

Read replicas offload read queries from the primary database, reducing CPU utilization. Option E is correct because RDS Proxy manages connections, reducing overhead from a large number of read queries. Option A is wrong: Multi-AZ provides high availability, not read scaling.

Option C is wrong: increasing instance size may help but does not specifically offload read traffic and is often more expensive than read replicas. Option D is wrong: ElastiCache caches query results but does not offload read queries from the database directly.

Full explanation →

115

MCQmedium

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

A.Use a VPN connection from each application VPC to the shared VPC.

B.Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.

C.Use VPC peering between the shared VPC and each application VPC.

D.Create IAM roles in each application account that allow the networking team to create VPC attachments.

AnswerB

RAM allows sharing the Transit Gateway, and the networking team can accept or reject attachments via RAM.

Why this answer

AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Exam trap

The trap here is that candidates often confuse IAM permissions (Option D) with resource-based sharing via RAM, thinking that granting IAM roles to create attachments is sufficient, but RAM provides explicit authorization at the resource level, which is more secure and scalable for cross-account access.

How to eliminate wrong answers

Option A is wrong because using a VPN connection from each application VPC to the shared VPC introduces unnecessary complexity, latency, and bandwidth limitations compared to using a Transit Gateway, and it does not scale well as the number of VPCs increases. Option C is wrong because VPC peering requires a one-to-one connection between each application VPC and the shared VPC, which does not scale and creates a mesh of connections that is difficult to manage, and it also does not provide centralized routing or transitive connectivity. Option D is wrong because creating IAM roles in each application account that allow the networking team to create VPC attachments does not control which VPCs can connect; it only grants permission to create attachments, but any VPC in the application account could potentially attach, and it does not enforce authorization at the resource level like RAM does.

Full explanation →

116

Multi-Selecthard

A company has a multi-account environment and wants to centralize logging for all AWS API calls. Which TWO services should they use together to achieve this?

Select 2 answers

A.AWS CloudTrail

B.Amazon CloudWatch Logs

C.Amazon GuardDuty

D.Amazon S3

E.AWS Config

AnswersA, B

Logs API calls.

Why this answer

AWS CloudTrail is the service that records all AWS API calls made in an account, capturing the who, what, when, and source IP for every action. To centralize these logs from multiple accounts into a single location, you can configure CloudTrail to deliver log files to a centralized Amazon S3 bucket, and then use Amazon CloudWatch Logs to monitor, search, and alert on those API events in real time. Together, they provide a complete, centralized logging and monitoring solution for API activity across a multi-account environment.

Exam trap

The trap here is that candidates often confuse Amazon S3 as a logging service rather than a storage destination, or they mistakenly think GuardDuty or AWS Config can replace CloudTrail for capturing API calls.

Full explanation →

117

MCQmedium

A company is migrating a monolithic application to microservices on AWS. They have identified that some services require high-throughput, low-latency data sharing. Which AWS service should they use for this purpose?

A.Amazon ElastiCache for Redis

B.Amazon RDS

C.Amazon S3

D.AWS Glue

AnswerA

ElastiCache for Redis provides high-throughput, low-latency in-memory caching.

Why this answer

Amazon ElastiCache for Redis is an in-memory data store that provides microsecond latency and high throughput, making it ideal for data sharing between microservices. Option A is correct. Option B (Amazon RDS) is a relational database, not optimized for low-latency data sharing.

Option C (Amazon S3) is object storage with higher latency. Option D (AWS Glue) is an ETL service, not suitable for real-time data sharing.

Full explanation →

118

Multi-Selectmedium

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

Select 3 answers

A.Store the database credentials in AWS Secrets Manager.

B.Configure automatic rotation for the secret in AWS Secrets Manager.

C.Grant the Lambda function's IAM role permission to access the RDS database directly.

D.Write custom rotation logic in the Lambda function to change the database password.

E.Grant the Lambda function's IAM role permission to retrieve the secret from Secrets Manager.

AnswersA, B, E

Secrets Manager is designed for storing secrets.

Why this answer

AWS Secrets Manager is designed to securely store, manage, and automatically rotate database credentials, including for Amazon RDS for PostgreSQL. By storing credentials in Secrets Manager, the company avoids hardcoding secrets in code or configuration files, ensuring a centralized and auditable secrets management solution.

Exam trap

The trap here is that candidates often confuse IAM roles for database access (which is only supported for Amazon RDS with IAM database authentication, not for standard PostgreSQL credentials) with the need to retrieve secrets via IAM permissions, leading them to select Option C instead of Option E.

Full explanation →

119

MCQmedium

A company is running a production web application on AWS Auto Scaling EC2 instances behind an Application Load Balancer. Recent deployments have caused intermittent errors. The team wants to implement a deployment strategy that minimizes downtime and allows for quick rollback. Which strategy should they use?

A.Deploy a new version to a single instance, test, then scale out.

B.Use blue/green deployment with a second Auto Scaling group and switch the ALB target group.

C.Perform rolling updates with a single Auto Scaling group, updating a few instances at a time.

D.Use an immutable deployment by launching a new Auto Scaling group and terminating the old one.

AnswerB

Blue/green allows instant switch and immediate rollback.

Why this answer

Blue/green deployment with a second Auto Scaling group and ALB switch allows instant rollback by switching back to the original environment. Option A is wrong because rolling updates with a single ASG can still cause partial downtime and slower rollback. Option C is wrong because it does not minimize downtime and requires manual intervention.

Option D is wrong because immutable deployments replace instances, but rollback requires redeployment.

Full explanation →

120

MCQhard

Refer to the exhibit. A company has an S3 bucket policy that allows GetObject access from two IP ranges (10.0.0.0/16 and 192.168.0.0/16). The policy also denies all S3 actions on the 'confidential/' prefix unless the request comes from the 10.0.0.0/16 range. Which of the following statements is true?

A.Users from 192.168.0.0/16 can access objects in the confidential/ prefix.

B.Users from 10.0.0.0/16 can access objects in the confidential/ prefix, but users from 192.168.0.0/16 cannot.

C.Users from 10.0.0.0/16 cannot access objects in the confidential/ prefix.

D.The policy has no effect because the Allow and Deny statements cancel each other.

AnswerB

The Deny statement denies access to confidential/ for IPs not in 10.0.0.0/16, so only 10.0.0.0/16 is allowed.

Why this answer

The S3 bucket policy includes an explicit Deny statement that blocks all S3 actions on the 'confidential/' prefix unless the request originates from the 10.0.0.0/16 IP range. Since explicit Deny statements override any Allow statements in AWS IAM policy evaluation, users from 192.168.0.0/16 are denied access to the 'confidential/' prefix even though the GetObject Allow statement includes that range. Only users from 10.0.0.0/16 satisfy the condition in the Deny statement and can therefore access objects in the 'confidential/' prefix.

Exam trap

The trap here is that candidates often assume an Allow statement for a broader set of IPs will grant access to all prefixes, overlooking that an explicit Deny with a condition can carve out exceptions, and that AWS evaluates Deny statements before Allow statements.

How to eliminate wrong answers

Option A is wrong because the explicit Deny statement on the 'confidential/' prefix blocks all requests not coming from 10.0.0.0/16, so users from 192.168.0.0/16 are denied access. Option B is correct as explained. Option C is wrong because the Deny statement specifically allows requests from 10.0.0.0/16, so users from that range can access the 'confidential/' prefix.

Option D is wrong because the Allow and Deny statements do not cancel each other; AWS IAM policy evaluation uses an explicit Deny override, so the Deny statement takes precedence over the Allow statement for requests from 192.168.0.0/16, while the Allow statement still applies to other objects.

Full explanation →

121

MCQmedium

A company is migrating a legacy Citrix XenApp environment to AWS. The application requires Windows-based virtual desktops for 200 users. Users need to access the desktops from various devices, including thin clients and mobile devices. Which solution is most cost-effective and scalable?

A.Use Amazon AppStream 2.0 to stream the application to users.

B.Launch Amazon EC2 Windows instances and enable Remote Desktop Services (RDS).

C.Deploy Amazon WorkSpaces with Windows-based bundles.

D.Use Amazon WorkDocs for document access and collaboration.

AnswerC

WorkSpaces provides managed virtual desktops accessible from any device.

Why this answer

Amazon WorkSpaces provides fully managed Windows desktops that can be accessed from various devices, making it cost-effective and scalable for 200 users. Option A (Amazon AppStream 2.0) is incorrect because AppStream 2.0 streams individual applications, not full desktops, and is not the best fit for replacing a Citrix XenApp environment that requires full desktops. Option B (EC2 with RDS) is incorrect because while it can provide desktops, it requires manual management of the Remote Desktop Services and is not as scalable or managed as WorkSpaces.

Option D (Amazon WorkDocs) is incorrect as it is a document management and collaboration service, not a desktop virtualization solution.

Full explanation →

122

MCQeasy

A company is modernizing a monolithic application into microservices on Amazon ECS. They want to decouple services and improve resilience. Which AWS service should they use for asynchronous communication between microservices?

A.Amazon SQS

B.Amazon Kinesis Data Streams

C.Amazon API Gateway

D.Amazon SNS

AnswerA

Amazon SQS provides a fully managed message queue for asynchronous communication, decoupling services.

Why this answer

Amazon SQS provides a fully managed message queue for asynchronous communication, decoupling services. Option B (Amazon Kinesis Data Streams) is for streaming data. Option C (Amazon API Gateway) is for synchronous REST APIs.

Option D (Amazon SNS) is pub/sub, not point-to-point queue.

Full explanation →

123

MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate launch type. The application needs to store session state that is shared across multiple tasks. The session data must be highly available and low-latency. Which AWS service should be used to store the session state?

A.Amazon EFS

B.Amazon ElastiCache for Redis

C.Amazon RDS for MySQL

D.Amazon DynamoDB

AnswerB

Redis is an in-memory data store that provides sub-millisecond latency and supports session management features.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides an in-memory data store with sub-millisecond latency, which is ideal for storing session state that must be shared across multiple ECS Fargate tasks. Redis supports data structures like hashes and strings that map directly to session data, and it offers built-in replication and automatic failover for high availability. This makes it a purpose-built solution for distributed session management in containerized applications.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB because it is serverless and highly available, but they overlook that session state requires ultra-low latency that only an in-memory cache like Redis can provide, and DynamoDB's millisecond latency is not sufficient for high-throughput session management.

How to eliminate wrong answers

Option A is wrong because Amazon EFS is a file-level storage service that introduces higher latency compared to in-memory solutions, and it is not optimized for the frequent read/write operations of session state. Option C is wrong because Amazon RDS for MySQL is a relational database with disk-based storage, which incurs higher latency and is overkill for simple key-value session data; it also requires connection management overhead that is unsuitable for high-frequency session access. Option D is wrong because Amazon DynamoDB is a NoSQL database that, while highly available and scalable, has higher latency than an in-memory cache like Redis for session state, and its cost per operation is typically higher for the small, transient data patterns of sessions.

Full explanation →

124

Multi-Selectmedium

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. Which TWO actions are required?

Select 2 answers

A.Create a Lambda function to trigger the approval

B.Add a manual approval action to the pipeline

C.Set up a CloudWatch Events rule to invoke the approval

D.Configure an SNS topic to notify the approver

E.Create an IAM role that allows the approver to perform the approval action

AnswersB, E

The pipeline must include a manual approval stage.

Why this answer

To add a manual approval step, you must add a manual approval action to the pipeline (option B) and create an IAM role that allows the approver to approve or reject (option E). The approval action itself provides an SNS topic for notification, but configuring it is optional. Options A, C, and D are incorrect: A (Lambda function) is not required; C (CloudWatch Events) is not required; D (SNS topic) is automatically created by the approval action, but explicit configuration is not required.

Full explanation →

125

MCQeasy

A company uses AWS CloudFormation to manage infrastructure. They want to detect drift from the intended template configuration. Which service should they use?

A.AWS Config

B.AWS Service Catalog

C.AWS CloudTrail

D.CloudFormation Drift Detection

AnswerD

CloudFormation Drift Detection directly compares stack resources to the template.

Why this answer

AWS CloudFormation Drift Detection is a native feature that compares the actual resource configuration with the template, identifying any drift. This is the correct service for the stated requirement. AWS Config is used for compliance and resource inventory, not specifically for CloudFormation drift detection.

AWS Service Catalog helps manage approved IT services, and AWS CloudTrail logs API calls for auditing. Therefore, Option D is correct.

Full explanation →

126

MCQhard

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

A.Allows only t3.micro and t3.small instances to be launched.

B.Denies launching instances that are not t3.micro or t3.small for IAM users and roles, but not root.

C.Has no effect because SCPs cannot deny actions.

D.Denies launching any instance except t3.micro and t3.small for all users including root.

AnswerB

SCPs apply to IAM users and roles, not to root user.

Why this answer

The SCP uses a Deny effect with a condition that denies any EC2:RunInstances action unless the instance type is t3.micro or t3.small. However, SCPs do not affect the root user (the management account's root user) because SCPs cannot restrict the root user in the management account. Therefore, the policy denies launching non-compliant instance types for IAM users and roles, but not for the root user.

Exam trap

The trap here is that candidates often forget that SCPs do not apply to the root user of the management account, leading them to incorrectly assume the policy denies all users including root.

How to eliminate wrong answers

Option A is wrong because the SCP does not allow only those instance types; it denies all others, but the effect is a deny, not an allow, and it does not apply to root. Option C is wrong because SCPs can deny actions; they are a type of policy that can explicitly deny API actions. Option D is wrong because SCPs do not apply to the root user in the management account; root is exempt from SCP restrictions.

Full explanation →

127

MCQhard

A company is designing a new application that must be highly available across multiple AWS Regions. The application will run on EC2 instances behind an Application Load Balancer. The company needs a DNS-based routing policy that routes users to the nearest healthy endpoint based on latency. Which Amazon Route 53 routing policy should be used?

A.Latency routing policy

B.Failover routing policy

C.Weighted routing policy

D.Simple routing policy

AnswerA

Latency routing policy routes traffic to the region that provides the lowest latency for the user based on historical latency data.

Why this answer

Latency routing policy is correct because it directs traffic to the AWS Region that provides the lowest latency for the end user, based on historical latency data between the user's DNS resolver and the AWS endpoints. This meets the requirement for a DNS-based routing policy that routes users to the nearest healthy endpoint based on latency, while also supporting health checks to ensure traffic is only sent to healthy targets.

Exam trap

The trap here is that candidates often confuse 'latency-based routing' with 'geolocation routing' or 'geoproximity routing,' but the question explicitly asks for routing based on latency, not geographic location or proximity.

How to eliminate wrong answers

Option B (Failover routing policy) is wrong because it is designed for active-passive failover between two endpoints, not for routing based on latency or proximity. Option C (Weighted routing policy) is wrong because it distributes traffic based on assigned weights, not on the user's latency or geographic location. Option D (Simple routing policy) is wrong because it routes all traffic to a single endpoint (or multiple endpoints in a round-robin fashion if multiple records are returned) and does not consider latency, health, or proximity.

Full explanation →

128

MCQmedium

A company is migrating a batch processing workload to AWS. The workload runs on a schedule and processes large files stored on a network file system. The company wants to use a serverless architecture to reduce costs. Which combination of AWS services should the company use?

A.AWS Step Functions, Amazon EMR, and Amazon EFS.

B.Amazon CloudWatch Events, AWS Lambda, and Amazon Kinesis Data Firehose.

C.AWS Step Functions, AWS Lambda, and Amazon S3.

D.Amazon CloudWatch Events, Amazon EC2, and Amazon EBS.

AnswerC

Step Functions orchestrates Lambda functions, and S3 stores files.

Why this answer

AWS Step Functions can orchestrate the workflow, AWS Lambda can process files in a serverless manner, and Amazon S3 can store the large files. Option A is wrong because Amazon EMR is not a serverless service and EFS is a network file system, not ideal for serverless batch processing. Option B is wrong because Amazon Kinesis Data Firehose is designed for streaming data, not batch processing of large files.

Option D is wrong because Amazon EC2 and EBS are not serverless.

Full explanation →

129

MCQhard

A company is designing a global application that requires a highly available and low-latency API. The API will be consumed by clients across the world. The backend consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances in a single AWS Region. The company wants to improve performance for global users. Which solution meets these requirements with minimal operational overhead?

A.Deploy the application in multiple Regions and use Amazon Route 53 latency-based routing with active-passive failover.

B.Create an Amazon CloudFront distribution with Lambda@Edge to proxy requests to the ALB.

C.Create an AWS Global Accelerator accelerator with the ALB as an endpoint.

D.Create an Amazon CloudFront distribution with the ALB as the origin.

AnswerC

Global Accelerator uses the AWS global network and anycast IPs to route traffic to the nearest healthy endpoint, reducing latency without multi-Region deployment.

Why this answer

AWS Global Accelerator uses the AWS global network to route user traffic to the optimal endpoint, reducing latency and improving availability. By using the ALB as an endpoint, it provides static anycast IP addresses and automatically reroutes traffic if the ALB becomes unhealthy, all with minimal operational overhead since it requires no changes to the application or additional infrastructure.

Exam trap

The trap here is that candidates often confuse CloudFront (a CDN optimized for cacheable content) with Global Accelerator (a network layer service for improving performance of non-cacheable, dynamic traffic), leading them to choose Option D without realizing that CloudFront adds latency for uncacheable API requests.

How to eliminate wrong answers

Option A is wrong because deploying in multiple Regions and using Route 53 latency-based routing with active-passive failover introduces significant operational overhead for managing multi-Region infrastructure, and Route 53 DNS-based routing can be affected by client-side DNS caching, which may not provide the lowest latency for all users. Option B is wrong because Lambda@Edge is designed for lightweight compute at edge locations, not for proxying requests to an ALB; it would add unnecessary complexity, latency, and cost, and it is not a recommended pattern for simply routing traffic to an ALB. Option D is wrong because a CloudFront distribution with the ALB as the origin does not inherently optimize the network path from the client to the ALB; CloudFront caches content at edge locations, but for dynamic API traffic that cannot be cached, it adds an extra hop and does not improve the latency of the connection to the origin ALB.

Full explanation →

130

MCQhard

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

A.SSE-S3

B.SSE-C

C.Client-side encryption

D.SSE-KMS

AnswerB

Allows customer to provide keys stored in CloudHSM.

Why this answer

SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Exam trap

The trap here is that candidates often choose SSE-KMS assuming it supports CloudHSM via a custom key store, but SSE-KMS still allows S3 to access the key through KMS policies without requiring the key to be provided per request, which does not meet the 'explicit permission per access' requirement as strictly as SSE-C does.

How to eliminate wrong answers

Option A (SSE-S3) is wrong because it uses AWS-managed keys stored and managed entirely by S3, not in CloudHSM, and S3 inherently has access to the keys without explicit customer permission. Option C (Client-side encryption) is wrong because it encrypts data before sending to S3, which does not use S3's server-side encryption at rest and does not involve S3 managing keys or encryption; the requirement specifies S3 encryption at rest. Option D (SSE-KMS) is wrong because it uses AWS KMS keys, which are not stored in CloudHSM; while KMS can use a CloudHSM key store (custom key store), the keys are still managed by KMS, and S3 can access them via KMS policies without requiring per-request key provision, which does not satisfy the explicit permission requirement as strictly as SSE-C.

Full explanation →

131

MCQmedium

A company wants to migrate its on-premises Active Directory to AWS Managed Microsoft AD to support Windows-based workloads on AWS. The company has a complex Active Directory structure with multiple domains, group policies, and trusts with external directories. Which migration approach should the company use?

A.Replace Active Directory with AWS Identity and Access Management (IAM) for all authentication

B.Establish a forest trust between the on-premises AD and AWS Managed Microsoft AD, then gradually move resources to AWS

C.Rebuild the entire Active Directory structure from scratch in AWS Managed Microsoft AD

D.Use AD Connector to proxy authentication requests from AWS to the on-premises AD

AnswerB

Correct. A trust allows seamless coexistence and incremental migration.

Why this answer

Setting up a trust between the on-premises AD and AWS Managed Microsoft AD allows gradual migration of resources. This maintains existing authentication and group policies during the transition. Replacing AD with IAM is not suitable for Windows workloads.

Replicating the entire AD structure via AD Connector is not possible. A full rebuild is complex and risky.

Full explanation →

132

MCQhard

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

A.Use AWS Global Accelerator to reduce data transfer costs

B.Place all web tier instances in one AZ and all application tier instances in another AZ

C.Use a single AZ for all tiers to avoid cross-AZ traffic

D.Place web and application tier instances in the same subnets across all three AZs

AnswerD

ALB and NLB can route to targets in the same AZ, reducing cross-AZ traffic.

Why this answer

Placing web and application tier EC2 instances in the same subnets across all three Availability Zones ensures that traffic between the ALB and NLB, as well as between the NLB and application instances, stays within the same AZ whenever possible. This design leverages the ALB's cross-zone load balancing behavior (enabled by default) and the NLB's ability to route traffic to targets in the same AZ, minimizing cross-AZ data transfer costs. AWS charges for data transfer between AZs, so keeping traffic within the same AZ reduces those costs while maintaining high availability across three AZs.

Exam trap

The trap here is that candidates may think placing all resources in a single AZ (Option C) is acceptable for cost savings, but the question explicitly requires high availability across three AZs, making that option invalid despite its cost advantage.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance and availability by routing traffic over the AWS global network, but it does not reduce cross-AZ data transfer costs within a single region; it primarily reduces latency and improves fault tolerance for global traffic. Option B is wrong because placing all web tier instances in one AZ and all application tier instances in another AZ violates the high availability requirement (single AZ failure would take down the entire tier) and actually increases cross-AZ traffic, incurring higher data transfer costs. Option C is wrong because using a single AZ for all tiers eliminates cross-AZ traffic but completely defeats the requirement for high availability across three Availability Zones, making the application vulnerable to AZ failures.

Full explanation →

133

MCQmedium

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

A.The CloudWatch Logs subscription filter does not have permissions to write to Firehose.

B.The OpenSearch cluster's access policy denies write access from the Firehose stream.

C.The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.

D.The Firehose delivery stream does not have a TLS certificate configured.

AnswerC

Firehose needs kms:Encrypt and kms:Decrypt permissions on the key.

Why this answer

The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Exam trap

The trap here is that candidates often assume the error is due to network or access policies (Options A or B) rather than recognizing that KMS key policies must explicitly grant encryption permissions to intermediate services like Firehose, which is a subtle but critical requirement for encrypted log pipelines.

How to eliminate wrong answers

Option A is wrong because the question explicitly states that the CloudWatch Logs delivery to Firehose is configured correctly, meaning the subscription filter already has the necessary permissions to write to Firehose. Option B is wrong because the OpenSearch cluster's access policy controls access to the cluster itself, not the Firehose delivery stream's ability to write; the error occurs before data reaches OpenSearch, during Firehose's encryption step. Option D is wrong because TLS certificates are used for encrypting data in transit between Firehose and OpenSearch, but the 'AccessDenied' error is related to KMS permissions, not TLS configuration; Firehose automatically uses TLS for data delivery to OpenSearch.

Full explanation →

134

Multi-Selecthard

A company runs a containerized application on Amazon ECS with Fargate. They want to improve the security of their container images without slowing down the CI/CD pipeline. Which THREE measures should they implement?

Select 3 answers

A.Use AWS CodePipeline with approval gates for security checks.

B.Require manual vulnerability scanning before each deployment.

C.Encrypt all container images using AWS KMS.

D.Integrate Amazon ECR scanning into the CI/CD pipeline.

E.Implement image signing using AWS Signer.

AnswersA, D, E

Approval gates allow security review without manual scanning.

Why this answer

AWS CodePipeline with approval gates allows you to introduce manual or automated approval steps that can enforce security checks (e.g., vulnerability scan results, policy compliance) before a container image is promoted to production. This ensures that security validation occurs without blocking the entire CI/CD pipeline—only the deployment stage is gated, preserving pipeline speed for earlier stages like build and test.

Exam trap

The trap here is that candidates may confuse 'improving security' with 'adding manual steps' (Option B) or 'encrypting images' (Option C), failing to recognize that the question explicitly requires measures that do not slow down the CI/CD pipeline, making automated, integrated solutions (scanning, signing, and gated approvals) the correct choices.

Full explanation →

135

Multi-Selecthard

A company has a centralized logging account and multiple member accounts. The member accounts generate VPC Flow Logs that need to be sent to a central S3 bucket in the logging account. Which TWO steps must be taken to enable this cross-account delivery?

Select 2 answers

A.Add a bucket policy on the central S3 bucket that grants the service principal 'delivery.logs.amazonaws.com' s3:PutObject permission.

B.Create an IAM role in the logging account that the member accounts can assume to put objects.

C.Create an S3 bucket in each member account to receive Flow Logs, and replicate to the central bucket.

D.Configure VPC Flow Logs in each member account to deliver to the central S3 bucket.

E.Enable AWS CloudTrail in the management account to aggregate logs.

AnswersA, D

This allows the Flow Logs service to write to the bucket.

Why this answer

The S3 bucket policy must grant the `delivery.logs.amazonaws.com` service principal the `s3:PutObject` permission. This allows the VPC Flow Logs delivery service, which runs in the member accounts, to write log data directly into the central S3 bucket in the logging account without requiring cross-account IAM roles or temporary credentials.

Exam trap

The trap here is that candidates often assume cross-account access always requires an IAM role (Option B), but VPC Flow Logs use a service principal and bucket policy instead, which is a unique pattern tested in SAP-C02.

Full explanation →

136

MCQmedium

A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

A.The user will be allowed only if the object was uploaded with SSE-KMS.

B.The user will be denied access because the condition is not met.

C.The user will be allowed to download the object.

D.The user will be denied because SSE-S3 is not AES256.

AnswerC

The condition requires SSE-S3 (AES256), which matches the object's encryption.

Why this answer

SSE-S3 uses AES-256 encryption managed by Amazon S3, and the encryption/decryption process is transparent to the user. When a user has the s3:GetObject permission in their IAM policy, they can download the object regardless of SSE-S3 encryption, as S3 automatically decrypts the object upon retrieval. The IAM policy does not require any additional conditions for SSE-S3, so the user is allowed to download the object.

Exam trap

The trap here is that candidates often confuse SSE-S3 with SSE-KMS and assume that any server-side encryption requires additional IAM conditions or KMS permissions, but SSE-S3 is fully transparent to the user and does not impose any such requirements.

How to eliminate wrong answers

Option A is wrong because SSE-KMS is a different encryption type that requires additional kms:Decrypt permissions; the question specifies SSE-S3, not SSE-KMS, so the user would not need KMS permissions. Option B is wrong because there is no condition in the IAM policy that would deny access; SSE-S3 does not impose any condition on the user's ability to download. Option D is wrong because SSE-S3 does use AES-256 encryption (it is the default), and the statement 'SSE-S3 is not AES256' is factually incorrect.

Full explanation →

137

Multi-Selectmedium

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

Select 2 answers

A.Attach an Elastic IP to each EC2 instance.

B.Assign Elastic IP addresses to the Network Load Balancer.

C.Configure an Application Load Balancer instead of NLB.

D.Use AWS WAF to allow traffic from the partners' IP ranges.

E.Use AWS Global Accelerator with the NLB as an endpoint.

AnswersB, E

NLB supports Elastic IP per AZ, providing static IPs.

Why this answer

You can assign Elastic IP addresses to the Network Load Balancer per Availability Zone, providing static IPs for external partners to whitelist. Option E is correct because AWS Global Accelerator provides two static IP addresses (or allows you to bring your own) and can be used with an NLB as an endpoint, offering static IPs that partners can whitelist. Option A is incorrect because attaching Elastic IPs to EC2 instances does not provide static IPs for the NLB frontend; the NLB uses its own IPs.

Option C is incorrect because an Application Load Balancer (ALB) does not support static IP addresses by default and operates at layer 7, not suitable for this requirement. Option D is incorrect because AWS WAF is a web application firewall that filters traffic based on rules but does not provide static IP addresses for the load balancer.

Full explanation →

138

MCQhard

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

A.Deploy a third-party log collector agent on each EC2 instance.

B.Configure AWS Transit Gateway to aggregate flow logs.

C.Use a CloudFormation StackSet to deploy VPC Flow Logs to an S3 bucket in the central account using bucket policies.

D.Enable VPC Flow Logs in each account and publish to a CloudWatch Logs group in the central account.

AnswerC

StackSet can create flow logs with cross-account delivery to a central S3 bucket.

Why this answer

Using a CloudFormation StackSet allows you to deploy VPC Flow Logs consistently across multiple accounts and regions, publishing them to a centralized S3 bucket in the logging account. Bucket policies grant cross-account write access, making this approach highly scalable without per-account agent management or CloudWatch Logs cross-account limitations.

Exam trap

The trap here is that candidates may think CloudWatch Logs can natively publish to a cross-account log group, but it cannot; S3 with bucket policies is the correct scalable approach for multi-account VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because deploying a third-party log collector agent on each EC2 instance is not scalable, introduces agent management overhead, and does not capture VPC-level network traffic (only instance-level). Option B is wrong because AWS Transit Gateway does not aggregate or generate flow logs; it is a network transit hub, not a logging service. Option D is wrong because CloudWatch Logs does not support publishing directly to a cross-account log group; you would need to use a subscription filter or a separate solution, and this approach does not scale as well as S3-based centralized storage.

Full explanation →

139

MCQhard

A financial services company is designing a multi-account AWS environment using AWS Organizations. They need to enforce that all newly created S3 buckets in any account have server-side encryption enabled using AWS KMS (SSE-KMS) with a customer managed key. Additionally, they want to prevent any S3 bucket from being publicly accessible. What is the MOST efficient and comprehensive way to enforce these policies?

A.Use a service control policy (SCP) to deny the s3:PutBucketAcl action that grants public access, and rely on bucket policies to enforce encryption.

B.Use AWS Config rules with automatic remediation to enable encryption and block public access on any non-compliant bucket.

C.Create an SCP that denies s3:PutObject without the x-amz-server-side-encryption-aws:kms header, and another SCP that denies s3:PutBucketPublicAccessBlock with a condition key. Also, use a resource-based policy on the S3 service to block public access.

D.Create an SCP that denies the s3:PutBucketPublicAccessBlock action and attach it to the root OU.

AnswerC

SCPs can deny actions based on conditions, and resource policies can prevent public access proactively.

Why this answer

SCPs can deny the s3:PutObject action unless the x-amz-server-side-encryption-aws:kms header is present, ensuring SSE-KMS is enforced at the API level across all accounts. Additionally, an SCP denying s3:PutBucketPublicAccessBlock with a condition key (e.g., requiring the PublicAccessBlockConfiguration to be fully enabled) prevents any bucket from being made publicly accessible. This approach is comprehensive and efficient as it proactively blocks non-compliant actions before they occur, rather than relying on reactive remediation.

Exam trap

The trap here is that candidates often confuse SCPs with resource-based policies or AWS Config remediation, thinking reactive detection is sufficient, but the question asks for the 'most efficient and comprehensive' approach, which requires proactive prevention at the API level using SCPs.

How to eliminate wrong answers

Option A is wrong because bucket policies alone cannot enforce SSE-KMS on all objects; they can only require encryption headers on PutObject, but SCPs are needed to deny non-compliant actions across all accounts. Option B is wrong because AWS Config with automatic remediation is reactive—it detects non-compliance after the bucket is created or modified, which may leave a window of exposure, and it is less efficient than proactive prevention via SCPs. Option D is wrong because denying s3:PutBucketPublicAccessBlock would actually prevent the use of the PublicAccessBlock configuration, which is the mechanism to block public access; instead, you need to deny actions that make buckets public (e.g., s3:PutBucketAcl with public access) or require the PublicAccessBlock to be set.

Full explanation →

140

MCQeasy

A company is planning to migrate 50 TB of data from on-premises to Amazon S3 over a 100 Mbps internet connection. The data is not time-sensitive and can tolerate some latency. Which migration method is MOST cost-effective and suitable?

A.Use AWS DataSync over the existing internet connection.

B.Enable S3 Transfer Acceleration on the destination bucket.

C.Use AWS Snowball Edge devices to transfer the data.

D.Provision a 1 Gbps AWS Direct Connect connection.

AnswerC

Cost-effective for large data volumes over slow network.

Why this answer

AWS Snowball Edge is designed for large-scale data transfer when network bandwidth is limited, making it cost-effective for 50 TB over a 100 Mbps link. Option A is wrong because AWS DataSync over the internet would take very long (approximately 46 days) and is not optimal for such a large volume. Option B is wrong because S3 Transfer Acceleration improves speed via optimized routing but cannot overcome the 100 Mbps bandwidth cap; the transfer would still be slow.

Option D is wrong because a 1 Gbps Direct Connect connection would be significantly more expensive than Snowball Edge, and since the data is not time-sensitive, physical shipment is more suitable.

Full explanation →

141

MCQeasy

A company is migrating a batch processing workload to AWS. The workload runs daily on a single on-premises server and takes 6 hours to complete. The company wants to reduce processing time and cost. Which approach should the solutions architect recommend?

A.Use AWS Batch to run the workload in parallel on multiple compute resources

B.Use AWS Lambda with a 6-hour timeout

C.Use AWS Step Functions to orchestrate the workload sequentially

D.Use a single larger EC2 instance with more vCPUs

AnswerA

Correct: AWS Batch can parallelize the workload to reduce processing time.

Why this answer

AWS Batch can orchestrate parallel processing across multiple EC2 or Fargate resources, reducing time. A single larger instance may not reduce time as much as parallel processing. Lambda has a 15-minute execution limit.

Step Functions alone does not provide compute.

Full explanation →

142

MCQeasy

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

A.Use a single VPC with network ACLs to block database ports between services.

B.Use IAM policies to restrict database access at the API level.

C.Place all services in the same VPC and use security groups to restrict database access.

D.Create a separate VPC for each service and use VPC peering for API communication only.

AnswerD

Separate VPCs provide strong isolation; VPC peering allows controlled API traffic.

Why this answer

Placing each microservice in its own VPC and using VPC peering for API communication only enforces strict network isolation at the VPC boundary. This prevents any direct database access between services, as the peering connection can be configured to allow only specific API ports (e.g., HTTPS 443) and not database ports (e.g., 3306, 5432). This design aligns with the principle of least privilege and ensures that services cannot bypass API gateways to reach each other's databases.

Exam trap

The trap here is that candidates often assume security groups within a single VPC are sufficient for isolation, but the question requires strict enforcement that services cannot directly access each other's databases, which is best achieved by separate VPCs with peering limited to API ports.

How to eliminate wrong answers

Option A is wrong because network ACLs are stateless and apply at the subnet level, not at the instance or service level; they cannot enforce fine-grained isolation between services within the same VPC, and a misconfigured rule could inadvertently allow database traffic. Option B is wrong because IAM policies control access to AWS API actions (e.g., RDS API calls), not direct network-level database connections; they cannot prevent a service from connecting to another service's database if the database endpoint is reachable over the network. Option C is wrong because security groups within the same VPC can restrict traffic, but they do not provide the strong isolation required; a misconfigured security group or a compromised service could still access the database if the security group rule is too permissive, and the services share the same VPC routing table, increasing the attack surface.

Full explanation →

143

Multi-Selectmedium

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Select 2 answers

A.Use AWS Config rules to automatically remediate non-compliant buckets.

B.Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

C.Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.

D.Create an S3 bucket policy in each account to enforce encryption and block public access.

E.Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.

AnswersA, C

Correct. AWS Config rules can detect non-compliant buckets for both encryption and public access, and trigger automatic remediation actions (e.g., enable encryption or block public access) to enforce compliance.

Why this answer

Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met.

Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.

Exam trap

The trap is that Option E might seem correct because it mentions encryption and public access, but it does not actually prohibit public access—it only ties the ability to modify public access settings to having encryption enabled. The correct SCP for prohibiting public access would be one that outright denies actions that grant public access, which is not listed. Thus, remediation via AWS Config (Option A) is needed to actively fix public access violations.

Full explanation →

144

MCQhard

A company is migrating a data warehouse from on-premises to Amazon Redshift. The current workload runs complex queries that join large tables. The company wants to optimize query performance after migration. Which design should the company implement?

A.Use distribution style AUTO and let Redshift decide

B.Use distribution style EVEN on all tables

C.Use distribution style ALL on all large tables

D.Use distribution style KEY on the join columns of large tables

AnswerD

Co-locates rows from different tables on the same node, avoiding data movement.

Why this answer

Distribution style KEY on join columns ensures data is co-located, minimizing data movement. Option A (AUTO) may not use the optimal distribution strategy. Option B (EVEN) distributes rows evenly, which can cause significant data movement across nodes.

Option C (ALL) is not suitable for large tables because it duplicates the entire table on every node, leading to high storage and performance issues.

Full explanation →

145

MCQeasy

A company is migrating a monolithic application to AWS. They want to minimize changes to the application code while taking advantage of AWS managed services. Which migration strategy should they use?

A.Rehost / Lift-and-Shift

B.Repurchase / Drop and Shop

C.Replatform / Lift, Tinker, and Shift

D.Refactor / Re-architect

AnswerA

Moves the application as-is, minimizing code changes.

Why this answer

(Rehost / Lift-and-Shift) is correct because it involves moving the application as-is to AWS, typically using services like EC2, without requiring any code changes. This minimizes changes while leveraging AWS managed services. Option B (Repurchase) replaces the application with a SaaS solution, which is not what the company wants.

Option C (Replatform) involves some optimization but still requires changes. Option D (Refactor) requires significant code changes to re-architect the application.

Full explanation →

146

MCQhard

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

A.Create an IAM policy that requires the security group when launching instances with a public IP.

B.Use AWS Config rules to detect non-compliant instances and automatically terminate them.

C.Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.

D.Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.

AnswerD

Prevents non-compliant launches.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Exam trap

The trap here is that candidates often choose AWS Config (Option B) because it is a well-known compliance tool, but they overlook that Config is reactive (detect and remediate) rather than proactive (prevent at the API call), which is the key distinction for 'enforce' in this question.

How to eliminate wrong answers

Option A is wrong because IAM policies are attached to users, roles, or groups and cannot enforce conditions based on the instance's runtime configuration (like public IP assignment) at the time of launch across all accounts in an organization; they also cannot prevent launches by users with full admin privileges. Option B is wrong because AWS Config rules are detective, not preventive—they can detect non-compliant instances and trigger auto-remediation (e.g., termination), but this allows a window of non-compliance and potential cost/security exposure before remediation. Option C is wrong because CloudFormation StackSets deploy templates but cannot enforce a blanket policy across all accounts; users with sufficient IAM permissions can still launch instances manually via the console, CLI, or SDK outside of CloudFormation, bypassing the template's constraints.

Full explanation →

147

MCQmedium

A company runs a batch processing application on AWS. The application reads input files from an S3 bucket, processes them on EC2 instances, and writes results to another S3 bucket. The processing job runs once a day and takes approximately 3 hours. The company wants to reduce costs and operational overhead. The Solutions Architect suggests using AWS Lambda for processing, but the processing time per file can exceed the Lambda maximum execution time of 15 minutes. The architect also considers using AWS Batch. The company wants to minimize the need for infrastructure management. Which solution should the Solutions Architect recommend?

A.Provision a fleet of EC2 instances and use Auto Scaling to manage the processing.

B.Use AWS Lambda with a larger memory allocation to increase CPU and reduce processing time.

C.Use AWS Batch with a managed compute environment that uses Spot Instances and a job queue.

D.Use Amazon ECS with Fargate launch type and run the processing as a task.

AnswerC

AWS Batch with a managed compute environment automatically handles job scheduling, scaling, and infrastructure provisioning. It can accommodate long-running jobs beyond Lambda's 15-minute limit and uses Spot Instances to reduce costs, minimizing operational overhead.

Why this answer

AWS Batch with a managed compute environment automatically handles job scheduling, scaling, and infrastructure provisioning. It can accommodate long-running jobs beyond Lambda's 15-minute limit and uses Spot Instances to reduce costs, minimizing operational overhead. Option A is incorrect because managing EC2 instances and Auto Scaling requires more operational effort than using a managed service like AWS Batch.

Option B is incorrect because even with increased memory, Lambda has a maximum execution time of 15 minutes, which may not be sufficient for processing files that exceed this limit. Option D is incorrect because while ECS with Fargate reduces infrastructure management, AWS Batch is specifically designed for batch processing and provides more features like job queues, automatic retries, and integration with Spot Instances, making it a better fit for this use case.

Full explanation →

148

Multi-Selecteasy

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Select 3 answers

A.Place the Lambda function in a VPC with access to the RDS instance

B.Enable encryption on the RDS instance

C.Store database credentials in the Lambda function code

D.Assign an IAM role to the Lambda function with permissions to connect to RDS

E.Use a public IP address for the RDS instance

AnswersA, B, D

Lambda in VPC can access RDS.

Why this answer

Placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Exam trap

The trap here is that candidates often confuse IAM roles with direct database authentication, thinking that assigning an IAM role alone is sufficient without also configuring IAM database authentication on the RDS side, or they overlook the necessity of VPC placement for private network connectivity.

Full explanation →

149

MCQmedium

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

A.Use an in-place update without any hooks.

B.Use a rolling update with a lifecycle hook to gracefully handle connections and unmount the file system before instance termination.

C.Perform a blue/green deployment.

D.Terminate all instances and launch new ones.

AnswerB

Lifecycle hooks allow graceful shutdown.

Why this answer

A rolling update with a lifecycle hook (Option B) is the best approach for minimizing downtime in a stateful web application using a shared file system. The lifecycle hook allows the instance to gracefully handle existing connections and unmount the file system before termination, ensuring no data corruption or abrupt disconnection. This reduces downtime compared to other methods.

Option A (in-place update without hooks) risks disrupting active connections. Option C (blue/green deployment) may not work seamlessly with stateful applications due to shared storage. Option D (terminate all instances) causes full downtime.

Full explanation →

150

MCQmedium

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The Lambda function has been running successfully for months. Recently, the company updated the Lambda function code and started seeing occasional throttling errors (HTTP 429) from the Lambda service. The function's reserved concurrency is set to 100. The company is unsure why throttling is occurring only after the code update. What is the MOST likely cause?

A.The Lambda function is writing logs to CloudWatch Logs at a rate that exceeds the CloudWatch throttling limit.

B.The S3 bucket is receiving more uploads than before, causing more Lambda invocations.

C.The updated Lambda function no longer has the required IAM permissions to access S3, causing retries that throttle.

D.The code update increased the execution time of the Lambda function, leading to a higher number of concurrent executions that exceed the account-level concurrency limit.

AnswerD

Longer execution time means more invocations overlap, increasing concurrency and potentially hitting account limits.

Why this answer

When a Lambda function's execution time increases due to a code update, each invocation holds a concurrency slot for longer. With reserved concurrency set to 100, if the function's invocations per second remain the same but each takes longer, the number of concurrent executions can exceed the account-level concurrency limit (default 1000), causing throttling (HTTP 429). Option A is wrong because CloudWatch Logs throttling would result in dropped log events, not Lambda throttling errors.

Option B is wrong because if the S3 bucket received the same rate of uploads, the invocation rate wouldn't change; the question states throttling occurred only after the code update, not due to increased uploads. Option C is wrong because missing IAM permissions would cause access denied errors (HTTP 403), not throttling errors.

Full explanation →

Page 2 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →