Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1426–1500

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 19

Page 20 of 23

Page 21
1426
MCQmedium

An administrator runs the above command and sees that the 'Prod' account is suspended. What is the MOST likely cause?

A.The account has an unpaid AWS bill.
B.The account was suspended due to a Service Control Policy (SCP) violation.
C.The account was suspended due to a security breach detected by AWS.
D.The account was removed from the organization by the root user.
AnswerA

AWS suspends accounts with overdue payments.

Why this answer

When an AWS account is suspended, the most common reason is an unpaid bill. AWS suspends accounts that have outstanding charges beyond the payment due date, disabling access to resources until the balance is paid. The command output showing the 'Prod' account as 'SUSPENDED' directly indicates a billing issue, as AWS does not suspend accounts for SCP violations, security breaches, or removal from an organization in the same manner.

Exam trap

The trap here is that candidates may confuse account suspension with SCP enforcement or security incidents, but AWS only suspends accounts for billing non-payment, not for policy violations or security events.

How to eliminate wrong answers

Option B is wrong because Service Control Policies (SCPs) do not cause account suspension; they only restrict permissions on accounts within an organization, and violations result in denied API calls, not account suspension. Option C is wrong because AWS does not suspend accounts due to security breaches; instead, it may notify the account owner or apply temporary restrictions, but suspension is reserved for billing non-payment. Option D is wrong because removing an account from an organization does not suspend it; the account becomes a standalone account and remains active, not suspended.

Full explanation →
1427
Drag & Dropmedium

Drag and drop the steps to migrate an on-premises MySQL database to Amazon RDS using AWS DMS in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First create the replication instance, then endpoints, then the migration task, start it, and finally cut over.

Full explanation →
1428
MCQmedium

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

A.Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.
B.Use AWS WAF with rate-based rules and associate it with the ALB.
C.Use an AWS Network Firewall and configure stateful rules to block malicious IPs.
D.Enable AWS Shield Standard and use security groups to restrict traffic.
AnswerA

Deploying CloudFront with AWS Shield Advanced provides edge DDoS protection and enforces TLS 1.3, making this the correct solution.

Why this answer

Deploying CloudFront in front of the ALB with AWS Shield Advanced provides edge-based DDoS protection, absorbing attacks before they reach the ALB. CloudFront supports TLS 1.3, meeting the encryption requirement. Option B is incorrect because AWS WAF with rate-based rules can help filter malicious traffic but does not absorb DDoS attacks at the edge; it works at the ALB level.

Option C is incorrect because AWS Network Firewall is a stateful firewall that protects VPCs, not at the edge, and cannot absorb large DDoS attacks. Option D is incorrect because AWS Shield Standard provides basic protection, but it is not sufficient for absorbing DDoS attacks, and security groups do not mitigate DDoS at the edge.

Exam trap

The trap is assuming that any AWS WAF or firewall solution at the ALB level can absorb DDoS attacks, but edge protection (CloudFront + Shield Advanced) is required for absorbing attacks before they reach the ALB.

Full explanation →
1429
MCQhard

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

A.Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.
B.Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.
C.Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.
D.Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.
AnswerD

Cross-Region read replicas provide low RPO; scaling from 0 minimizes cost; Route 53 failover provides RTO.

Why this answer

Option D meets the RPO of less than 5 minutes because RDS cross-Region read replicas use asynchronous replication with a typical lag of seconds. It meets the RTO of less than 30 minutes because the read replica can be promoted to a standalone primary in minutes. The standby EC2 environment with Auto Scaling set to 0 (scaling up based on health check alarms) minimizes cost when not in use.

Route 53 failover routing redirects traffic to us-west-2 after promotion. Option A is incorrect because a single hot standby EC2 instance incurs ongoing cost, and it does not meet the cost minimization requirement. Option B is incorrect because automated snapshots have an RPO of up to 24 hours (not <5 minutes), and restoring to S3-mounted volumes is not a functional database serving solution.

Option C is incorrect because Multi-AZ in both regions is costly (always running instances) and cross-Region load balancing with ALB is not a native feature for failover; plus Multi-AZ does not provide a separate read replica in another region for DR without additional replication.

Full explanation →
1430
MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

A.Run an Amazon ECS service with Fargate that polls the SQS queue and writes to DynamoDB. Configure auto scaling based on CPU utilization.
B.Use an Amazon ECS service with Fargate and a target tracking scaling policy based on SQS queue depth.
C.Use Amazon Kinesis Data Streams to ingest messages and an AWS Lambda function to process and write to DynamoDB.
D.Use an AWS Lambda function with an SQS trigger to process messages and write to DynamoDB.
AnswerD

Lambda scales to zero when idle and scales up to handle thousands of messages, making it cost-effective and scalable.

Why this answer

Using an AWS Lambda function with an SQS trigger is serverless, scales automatically with the queue depth, and incurs no cost when no messages are processed, making it the most cost-effective and scalable choice for unpredictable workloads. Option A is wrong because auto scaling based on CPU utilization does not directly correlate with the number of messages in the queue, potentially causing delays or over-provisioning. Option B is wrong because, although a target tracking policy based on SQS queue depth is better, an ECS with Fargate service still requires at least one running task, which may be idle and incur costs.

Option C is wrong because Amazon Kinesis Data Streams is designed for real-time streaming, not standard message queuing, and is more expensive and complex than the SQS and Lambda combination.

Full explanation →
1431
MCQmedium

A company is migrating a monolithic application to Amazon ECS. The application currently stores session data in local memory. Which migration strategy should the company adopt to ensure scalability and fault tolerance?

A.Store session data in Amazon ElastiCache for Redis.
B.Use Amazon S3 to store session data.
C.Use sticky sessions (session affinity) on the Application Load Balancer.
D.Migrate session data to Amazon DynamoDB.
AnswerA

ElastiCache provides a highly available, in-memory cache that containers can access independently.

Why this answer

Amazon ElastiCache for Redis provides a fast, in-memory data store that can be shared across multiple containers, enabling horizontal scaling and fault tolerance. Option C (sticky sessions) ties a client to a specific container, preventing true statelessness and causing uneven load distribution. Option B (Amazon S3) has high latency unsuitable for session data.

Option D (Amazon DynamoDB) is a NoSQL database that can store sessions but is slower and more costly than a dedicated caching layer like Redis for session management.

Full explanation →
1432
MCQhard

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

A.Increase the Lambda function timeout and use a single database connection per function instance.
B.Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.
C.Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.
D.Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.
AnswerB

RDS Proxy efficiently manages connection pooling and reduces load on the database.

Why this answer

Amazon RDS Proxy sits between the Lambda function and the RDS database, maintaining a pool of established connections. When Lambda invocations scale up, they reuse connections from the pool instead of opening new ones, preventing the database from being overwhelmed. This is the recommended AWS pattern for serverless applications with high concurrency and relational databases.

Exam trap

The trap here is that candidates often think batching or reducing concurrency is the solution, but the real challenge is managing connection reuse under elastic scaling, which only a dedicated proxy like RDS Proxy can solve without sacrificing throughput.

How to eliminate wrong answers

Option A is wrong because increasing the Lambda timeout does not reduce the number of connections; each concurrent invocation still opens its own connection, and a single connection per instance does not scale safely under high concurrency. Option C is wrong because setting reserved concurrency to 1 cripples throughput and defeats the purpose of using DynamoDB Streams, which expects parallel processing; it also does not address connection pooling, as the single instance still opens one connection per invocation. Option D is wrong because batching records does not reduce the number of concurrent Lambda invocations; each batch still runs in its own instance and opens a separate database connection, so the connection count remains high.

Full explanation →
1433
Multi-Selecthard

A company has a production AWS account with multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The firewall must be able to process traffic, and the solution must be highly available. Which THREE steps should the company take?

Select 3 answers
A.Attach Elastic Network Interfaces (ENIs) of the firewall instances to the inspection VPC subnets.
B.Configure the Transit Gateway to propagate routes directly between VPCs.
C.Deploy the firewall appliance as an EC2 instance in each AZ, with auto scaling groups.
D.Use a single route table in the Transit Gateway for all VPC attachments.
E.Create a dedicated inspection VPC with firewall instances in different Availability Zones.
AnswersA, C, E

ENIs are required for traffic to pass through the firewall.

Why this answer

Options A, C, and E are correct. A: Attaching ENIs of firewall instances to the inspection VPC subnets allows traffic to be forwarded to the firewall for inspection. C: Deploying the firewall appliance as an EC2 instance in each AZ with auto scaling groups ensures high availability and scalability.

E: Creating a dedicated inspection VPC with firewall instances in different Availability Zones centralizes inspection and provides fault tolerance. Option B is incorrect because propagating routes directly between VPCs would bypass the inspection firewall. Option D is incorrect because using a single route table in the Transit Gateway would not allow for selective routing to the inspection VPC and limits high availability.

Full explanation →
1434
MCQmedium

A global company is using a multi-account AWS Organizations setup with a centralized logging account. They want to aggregate CloudTrail logs from all accounts into a single S3 bucket in the logging account. Which combination of steps will meet this requirement?

A.Create an IAM role in each account that allows the logging account to assume and copy logs. Schedule a Lambda function to copy logs hourly.
B.Create an S3 bucket in the logging account with a bucket policy that grants read/write access to all accounts. Configure each account's CloudTrail to deliver to that bucket.
C.Create a CloudTrail trail in the management account that applies to all accounts in the organization, and specify the S3 bucket in the logging account as the destination.
D.Enable AWS Config in each account and stream configuration history to a centralized S3 bucket.
AnswerC

Organization trails deliver logs from all accounts to a single bucket.

Why this answer

AWS Organizations allows you to create a single CloudTrail trail in the management account that automatically applies to all member accounts. By specifying the S3 bucket in the centralized logging account as the destination, CloudTrail delivers logs from every account directly to that bucket without needing cross-account IAM roles or manual copying. This leverages the organization trail feature, which simplifies log aggregation and ensures consistent logging across the entire organization.

Exam trap

The trap here is that candidates often assume they need to configure CloudTrail in each account individually or use cross-account IAM roles to copy logs, but AWS Organizations provides a native organization trail feature that automatically aggregates logs from all accounts into a single S3 bucket in a centralized logging account.

How to eliminate wrong answers

Option A is wrong because it introduces unnecessary complexity and latency by requiring an IAM role in each account and a scheduled Lambda function to copy logs hourly, which is not real-time and violates the principle of least privilege by granting cross-account copy permissions. Option B is wrong because CloudTrail does not support delivering logs to an S3 bucket in a different account using a bucket policy that grants read/write access to all accounts; CloudTrail requires the destination bucket to be in the same account as the trail or uses an organization trail with a bucket policy that grants CloudTrail service principal write access, not all accounts. Option D is wrong because AWS Config streams configuration history and changes, not CloudTrail logs, and it does not aggregate CloudTrail API activity logs; it serves a different purpose for compliance and resource tracking.

Full explanation →
1435
MCQmedium

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

A.The instance is pending.
B.The instance is stopped.
C.The instance is running and has passed its status checks.
D.The instance is terminated.
AnswerC

Running means the instance is operational.

Why this answer

The CLI command `aws ec2 describe-instance-status` returns the instance state as 'running' and the instance status as 'ok'. The 'running' state in the output refers to the EC2 instance's lifecycle state, but the question specifically asks what the 'running' state indicates about the instance. In the context of `describe-instance-status`, the 'running' state shown is the instance's lifecycle state, which means the instance is powered on and has passed its initial boot.

However, the correct interpretation here is that the instance is running and has passed its status checks (both system status and instance status are 'ok'), as indicated by the full output. Option C is correct because the output shows the instance is in the 'running' state and all status checks have passed.

Exam trap

The trap here is that candidates often confuse the instance lifecycle state (e.g., 'running') with the status check results, assuming 'running' alone implies full health, but the question requires recognizing that the output also includes 'InstanceStatus: ok' and 'SystemStatus: ok', which together confirm the instance is running and has passed its status checks.

How to eliminate wrong answers

Option A is wrong because 'pending' is a separate lifecycle state that occurs when an instance is starting up, not when it is already running; the output explicitly shows 'running', not 'pending'. Option B is wrong because 'stopped' is a different lifecycle state where the instance is shut down and not running; the output shows 'running', so the instance is not stopped. Option D is wrong because 'terminated' is a final lifecycle state where the instance is permanently deleted and cannot be started; the output shows 'running', so the instance is not terminated.

Full explanation →
1436
Multi-Selectmedium

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

Select 2 answers
A.Increase the Auto Scaling group's desired capacity to a higher fixed value.
B.Configure an Application Load Balancer in front of the Auto Scaling group.
C.Switch to a different Amazon Machine Image (AMI) with optimized performance.
D.Launch the Auto Scaling group in multiple Availability Zones.
E.Increase the instance size to a larger type.
AnswersB, D

ALB distributes traffic evenly across instances.

Why this answer

An Application Load Balancer distributes incoming traffic across multiple EC2 instances, reducing load on individual instances and improving scalability. Option D is correct because launching instances in multiple Availability Zones increases fault tolerance and allows the Auto Scaling group to scale across zones, improving availability and performance during peak hours. Option A is incorrect because increasing desired capacity to a fixed value does not adapt to variable demand and may lead to overprovisioning.

Option C is incorrect because changing the AMI does not address the root cause of overload; performance improvements from AMI changes are negligible compared to scaling. Option E is incorrect because increasing instance size (vertical scaling) has limits and does not provide the elasticity and cost-efficiency of horizontal scaling.

Full explanation →
1437
MCQhard

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

A.The policy does not allow the s3:ListBucket action for the S3 bucket
B.The policy does not allow the dms:TestConnection action
C.The policy does not allow the dms:CreateEndpoint action
D.The policy does not allow the rds:ModifyDBInstance action
AnswerC

Correct. DMS needs permissions to create and describe endpoints for the source and target.

Why this answer

DMS needs permission to describe endpoints and test connections, which are not in the policy. The policy allows creating and starting tasks but not the prerequisite actions like creating endpoints. S3 access is correct if using S3 as a source/target, but the core issue is missing endpoint permissions.

Full explanation →
1438
MCQhard

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

A.RDS Multi-AZ in the same region
B.RDS Cross-Region Read Replicas
C.Amazon S3
D.AWS Database Migration Service
AnswerB

Provides a readable replica in another region for DR.

Why this answer

RDS Multi-AZ provides high availability within a single region by synchronously replicating data to a standby instance in a different Availability Zone. To protect against a regional failure, you need a cross-region disaster recovery solution. RDS Cross-Region Read Replicas asynchronously replicate data to a different AWS Region, allowing you to promote the replica to a standalone primary database in the event of a regional outage.

Exam trap

The trap here is that candidates confuse Multi-AZ (which is high availability within a region) with cross-region disaster recovery, assuming Multi-AZ alone provides regional protection.

How to eliminate wrong answers

Option A is wrong because RDS Multi-AZ in the same region only protects against Availability Zone failures, not regional failures; it does not replicate data across AWS Regions. Option C is wrong because Amazon S3 is an object storage service and cannot serve as a direct disaster recovery target for a relational database; it lacks native database replication and failover capabilities. Option D is wrong because AWS Database Migration Service (DMS) is designed for one-time or ongoing migrations, not for automated, low-RPO disaster recovery with automatic failover; it requires manual intervention to promote a target database.

Full explanation →
1439
MCQeasy

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

A.Full S3 access to the bucket and objects for the root user of account 123456789012.
B.Full S3 access to the bucket and objects for all IAM users in account 123456789012.
C.No access because the root user is not allowed.
D.Read-only access to the bucket.
AnswerB

Correct. The root user ARN in an S3 bucket policy grants access to all IAM users in the account.

Why this answer

In AWS S3 bucket policies, specifying the root user ARN `arn:aws:iam::123456789012:root` as the principal grants access to all IAM users and roles in that account, not just the root user. The root user ARN is a shorthand for the entire account. Therefore, the policy grants full S3 access to all IAM users in account 123456789012, making option B correct.

Exam trap

A common misconception is that the root user ARN only grants access to the root user. In reality, in resource-based policies like S3 bucket policies, the root user ARN represents all IAM principals in the account.

How to eliminate wrong answers

Option B is wrong because the policy specifies the root user principal (`arn:aws:iam::123456789012:root`), which does not grant access to all IAM users in the account; IAM users would need their own explicit permissions or a role with a trust policy. Option C is wrong because the root user is explicitly allowed by the policy, and AWS root users can be granted access via resource-based policies like S3 bucket policies. Option D is wrong because the policy grants `s3:*` (all S3 actions), not just read-only access.

Full explanation →
1440
MCQmedium

A company is migrating a batch processing workload to AWS. The workload runs on a scheduled basis and processes large files from an on-premises NFS share. The company wants to use AWS services to replace the on-premises server and minimize operational overhead. Which solution is MOST suitable?

A.Use AWS Lambda to directly read from the NFS share over VPN and process the files.
B.Mount the on-premises NFS share to Amazon EFS using AWS Direct Connect, and use AWS Batch with AWS Fargate to process the files.
C.Use AWS Snowball Edge to transfer files to Amazon S3 and then process with EC2 instances.
D.Use AWS DataSync to copy files to Amazon S3 and trigger an AWS Lambda function to process.
AnswerB

Serverless, scheduled processing with minimal overhead.

Why this answer

AWS Batch with AWS Fargate is a serverless compute service that integrates with Amazon EFS. By mounting the on-premises NFS share to EFS via AWS Direct Connect, files are accessible in AWS without copying. AWS Batch can then process the files on a scheduled basis, minimizing operational overhead.

Option A is wrong because AWS Lambda has execution time and file size limits, and directly reading from NFS over VPN may be unreliable. Option C is wrong because Snowball Edge is a one-time transfer tool, not suitable for ongoing scheduled processing. Option D is wrong because while DataSync can copy files to S3, triggering Lambda has similar limitations, and using EC2 adds management overhead.

Full explanation →
1441
MCQmedium

A company has a multi-account environment with a central security account. They want to use AWS Security Hub to aggregate findings from all accounts. What is the correct setup?

A.Set up Amazon EventBridge to forward findings from each account to the central account.
B.Use Amazon CloudWatch cross-account dashboards to view findings.
C.Enable AWS Config aggregator in the central account.
D.Enable Security Hub in the central account and invite member accounts to enable Security Hub.
AnswerD

This is the standard way to aggregate findings in Security Hub.

Why this answer

AWS Security Hub uses a multi-account architecture where a central administrator account invites member accounts to enable Security Hub. This allows the administrator account to aggregate findings, insights, and compliance scores from all member accounts into a single view, enabling centralized security monitoring without additional forwarding infrastructure.

Exam trap

The trap here is that candidates confuse Security Hub's multi-account model with other aggregation services like AWS Config aggregator or CloudWatch cross-account dashboards, assuming any cross-account aggregation tool can consolidate Security Hub findings, when in fact Security Hub requires its own dedicated multi-account feature.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge can forward events but is not the native mechanism for Security Hub multi-account aggregation; Security Hub uses its own invitation-based model, and EventBridge would require custom event buses and rules, adding unnecessary complexity and missing native cross-account finding consolidation. Option B is wrong because Amazon CloudWatch cross-account dashboards aggregate metrics and logs, not Security Hub findings; Security Hub findings are not stored in CloudWatch Logs or Metrics by default, so dashboards cannot display them. Option C is wrong because AWS Config aggregator aggregates AWS Config rules and compliance data across accounts, not Security Hub findings; Security Hub findings are separate from AWS Config and require Security Hub's own multi-account enablement.

Full explanation →
1442
MCQhard

A global company is using AWS Organizations with hundreds of accounts. The IT team needs to centrally manage DNS records for all accounts using Amazon Route 53 private hosted zones. The solution must be highly available and support cross-account DNS resolution. What should the team do?

A.Create a private hosted zone in the central account and configure Route 53 Resolver rules in each account to forward queries to the central account.
B.Create a private hosted zone in each account and configure Route 53 inbound endpoints in the central account to accept DNS queries.
C.Create a private hosted zone in the central account, associate it with a central VPC, and configure Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account.
D.Create a private hosted zone in each account and use Route 53 zone sharing to share it with the central account.
AnswerC

Resolver endpoints enable cross-account DNS resolution.

Why this answer

It uses Route 53 Resolver outbound endpoints in each account to forward DNS queries to the central account's private hosted zone, enabling centralized management of DNS records across accounts. This approach provides high availability and supports cross-account DNS resolution.

Exam trap

The trap here is that candidates often confuse Route 53 Resolver rules (which forward queries to a target) with the need for both inbound and outbound endpoints to enable cross-account DNS resolution, leading them to choose Option A which lacks the necessary endpoint infrastructure.

How to eliminate wrong answers

Option A is wrong because Route 53 Resolver rules forward queries to a target IP address, but they do not inherently support cross-account private hosted zone resolution without additional infrastructure like inbound/outbound endpoints. Option B is wrong because creating private hosted zones in each account defeats centralized management, and inbound endpoints in the central account only accept queries, not forward them to other accounts' zones. Option D is wrong because Route 53 zone sharing is not supported for private hosted zones; it only applies to public hosted zones and does not enable cross-account DNS resolution.

Full explanation →
1443
Multi-Selecthard

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The solution must have a Recovery Time Objective (RTO) of less than 15 minutes and a Recovery Point Objective (RPO) of less than 5 minutes. The application data is stored on Amazon EBS volumes. Which THREE steps should be taken to meet these requirements? (Choose three.)

Select 3 answers
A.Create Amazon Machine Images (AMIs) with pre-installed software and use AWS Backup to automate recovery in another region.
B.Use Amazon EBS snapshots and replicate them to another AWS Region using cross-region snapshot copy.
C.Use AWS CloudEndure Disaster Recovery to continuously replicate the EC2 instances to another region.
D.Enable Amazon S3 cross-region replication for the EBS snapshots.
E.Use AWS Database Migration Service (DMS) to replicate data to a secondary region.
AnswersA, B, C

AWS Backup can create AMI backups and support cross-region copy and restore.

Why this answer

Creating AMIs with pre-installed software and using AWS Backup to automate recovery in another region enables rapid instance launch with all required software already configured, supporting an RTO of under 15 minutes. AWS Backup can automate cross-region AMI copying and recovery, ensuring the RPO of less than 5 minutes is met when combined with frequent backup schedules.

Exam trap

The trap here is that candidates may confuse S3 cross-region replication (which works only for S3 objects) with the cross-region snapshot copy feature for EBS, leading them to select option D incorrectly.

Full explanation →
1444
MCQhard

A company uses AWS Organizations with hundreds of accounts. The security team needs to ensure that no IAM user in any account can create a new IAM user or access key. What is the most scalable way to enforce this?

A.Use AWS Config rules to detect and automatically delete any new users or keys.
B.Enable AWS CloudTrail and create a metric filter to alert on these actions.
C.Attach an IAM policy to the Administrator role in each account that denies these actions.
D.Apply a service control policy (SCP) that denies the iam:CreateUser and iam:CreateAccessKey actions.
AnswerD

SCPs apply to all principals in the account.

Why this answer

Service control policies (SCPs) are the most scalable way to enforce restrictions across all accounts in an AWS Organization because they apply to all IAM users and roles in every member account, including the root user. By denying the iam:CreateUser and iam:CreateAccessKey actions at the organization root or OU level, the security team can prevent any IAM user from creating new users or access keys without needing to manage individual account policies or rely on reactive measures.

Exam trap

The trap here is that candidates often choose Option C because they think attaching a deny policy to the Administrator role is sufficient, but they overlook that SCPs are the only mechanism that can restrict the root user and scale across hundreds of accounts without per-account management.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are reactive—they detect non-compliant resources after creation and can trigger auto-remediation, but they do not prevent the action from occurring, leaving a window where the user or key exists and could be used. Option B is wrong because CloudTrail with metric filters and alerts only provides notification after the fact; it does not block the action, so the security violation still occurs. Option C is wrong because attaching an IAM policy to the Administrator role in each account is not scalable for hundreds of accounts—it requires manual per-account configuration and does not prevent actions by the root user or other roles that might bypass the policy.

Full explanation →
1445
MCQmedium

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared EFS file system for persistent data. The operations team notices that during scale-in events, some requests fail because the instance is terminated while still processing. What is the BEST way to prevent request failures during scale-in?

A.Use a Network Load Balancer with connection draining enabled
B.Increase the cooldown period for the Auto Scaling group
C.Decrease the scale-in threshold to reduce the frequency of termination
D.Use lifecycle hooks to put the instance in a 'terminating:wait' state and complete request processing
AnswerD

Lifecycle hooks allow graceful shutdown.

Why this answer

Lifecycle hooks allow the Auto Scaling group to put the instance in a 'terminating:wait' state, giving it time to complete processing existing requests before termination. Option A (Network Load Balancer with connection draining) can help drain new connections but does not ensure that in-flight requests are completed, especially for a stateful application using EFS. Option B (increase cooldown) only delays scaling decisions and does not prevent termination of an instance that is already processing.

Option C (decrease scale-in threshold) reduces the frequency of scale-in events but does not prevent request failures when termination occurs.

Full explanation →
1446
MCQhard

A company is designing a new data lake solution on AWS using Amazon S3 as the storage layer. The data lake will be used by multiple teams for analytics and machine learning. The company needs to enforce fine-grained access control at the object level, enable auditing of data access, and ensure that sensitive data is masked for unauthorized users. Which combination of AWS services should be used?

A.Use S3 bucket policies and S3 access logs for auditing.
B.Use Amazon Macie to discover sensitive data and apply S3 bucket policies to restrict access.
C.Use IAM policies with condition keys and enable AWS CloudTrail for auditing.
D.Use AWS Lake Formation for fine-grained access control and auditing, and Amazon S3 Object Lambda to mask data on the fly.
AnswerD

Lake Formation provides row/column-level security and auditing; S3 Object Lambda can transform data for masking.

Why this answer

AWS Lake Formation provides fine-grained access control at the column, row, and cell level for data in S3, and it integrates with AWS CloudTrail for auditing data access. Amazon S3 Object Lambda can transform data on the fly, such as masking sensitive fields, before returning it to the requester, meeting the requirement to mask data for unauthorized users.

Exam trap

The trap here is that candidates often assume IAM policies or S3 bucket policies alone can achieve fine-grained access control, but they lack the column/row-level granularity and dynamic data masking that Lake Formation and S3 Object Lambda provide.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies alone cannot enforce fine-grained access control at the object level (e.g., column or row level), and S3 access logs provide basic request logging but lack the granular auditing and data masking capabilities required. Option B is wrong because Amazon Macie discovers sensitive data but does not enforce access control or mask data; S3 bucket policies are too coarse for fine-grained control and cannot mask data on the fly. Option C is wrong because IAM policies with condition keys can restrict access based on attributes like tags or IP, but they cannot provide column/row-level permissions or mask sensitive data; AWS CloudTrail logs API calls but does not enable real-time data masking.

Full explanation →
1447
MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

A.Use Amazon RDS for MySQL or PostgreSQL with read replicas.
B.Use Amazon Aurora Serverless to reduce management.
C.Store data in Amazon S3 and use Athena for queries.
D.Migrate to Amazon DynamoDB for scalability.
AnswerA

RDS maintains SQL compatibility, minimizing code changes.

Why this answer

Using Amazon RDS with the same database engine (MySQL or PostgreSQL) minimizes code changes, as the application can connect via standard SQL drivers. Read replicas can help with read scaling without altering the codebase. Option B is wrong because Aurora Serverless may require configuration changes and does not necessarily minimize code changes.

Option C is wrong because S3 and Athena are not suitable for transactional relational queries and would require significant architectural changes. Option D is wrong because DynamoDB would require schema redesign and application changes to use NoSQL.

Full explanation →
1448
Multi-Selecthard

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Select 3 answers
A.Create a private hosted zone in the central networking account.
B.Share the private hosted zone with other accounts using AWS Resource Access Manager.
C.Create a public hosted zone with the same name and configure DNSSEC.
D.Associate the private hosted zone with the VPCs in the member accounts.
E.Create a Route 53 Resolver outbound endpoint in each account.
AnswersA, B, D

Central account holds the zone.

Why this answer

A private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Exam trap

The trap here is that candidates often confuse the need for a public hosted zone or outbound endpoints with the simpler mechanism of sharing a private hosted zone via AWS RAM and associating it with VPCs, leading them to select unnecessary or incorrect options.

Full explanation →
1449
MCQmedium

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web frontend, a REST API, and a PostgreSQL database. The migration plan is to containerize the frontend and API using Amazon ECS with Fargate, and use Amazon RDS for PostgreSQL. The company expects variable traffic with peak loads during promotional events. The architecture must be highly available and cost-effective. The operations team wants to minimize manual scaling interventions. Which solution should a Solutions Architect recommend?

A.Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon DynamoDB for the database with on-demand capacity mode.
B.Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon RDS for PostgreSQL with Multi-AZ deployment and Auto Scaling for storage.
C.Deploy the API and frontend on Amazon EC2 instances behind an Application Load Balancer. Use Auto Scaling groups with dynamic scaling policies. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.
D.Deploy the API and frontend on Amazon ECS with Fargate. Configure a scheduled task to scale out during known promotional events. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.
AnswerB

ECS with Fargate and target tracking scaling provides automated, cost-effective scaling without over-provisioning.

Why this answer

It combines ECS with Fargate for serverless containers, Application Auto Scaling with target tracking based on CPU and memory utilization for automatic scaling, and Amazon RDS for PostgreSQL with Multi-AZ deployment for high availability and storage auto scaling. This meets the requirements for variable traffic, high availability, cost-effectiveness, and minimal manual intervention. Option A is wrong because it suggests Amazon DynamoDB instead of PostgreSQL, which is unsuitable for the relational workload.

Option C is wrong because it uses EC2 instances with Auto Scaling, which adds management overhead and is less cost-effective than Fargate. Option D is wrong because it relies on scheduled scaling, which cannot handle unexpected spikes in traffic.

Full explanation →
1450
MCQeasy

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

A.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.
B.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.
C.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.
D.Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.
AnswerA

This encrypts backend traffic, uses ACM for backend (same cert), and health checks use HTTP to avoid certificate issues.

Why this answer

It meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.

Exam trap

The trap here is that candidates often assume health checks must use the same protocol as the target group traffic, but AWS recommends using HTTP health checks even for HTTPS target groups to avoid certificate validation failures and ensure reliable health monitoring.

How to eliminate wrong answers

Option B is wrong because it configures the target group with HTTP health checks on port 80 but does not specify HTTPS for the target group traffic, leaving traffic between the ALB and EC2 instances unencrypted, violating the security requirement. Option C is wrong because it uses a self-signed certificate for the target group HTTPS, which would cause the ALB to reject the certificate during health checks and traffic forwarding (ALB requires trusted certificates for HTTPS target groups), and health checks using HTTPS on port 443 would fail due to certificate validation issues. Option D is wrong because it uses a separate ACM certificate for the target group HTTPS health checks, which is unnecessary and introduces complexity; the same ACM certificate can be used, and health checks should use HTTP to avoid certificate validation overhead and ensure reliable health monitoring.

Full explanation →
1451
MCQmedium

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS for MySQL database. The stack creation fails with the error 'The following resource(s) failed to create: [DBInstance]'. The solutions architect needs to troubleshoot the issue. Which approach should be taken first?

A.Review the CloudFormation stack events in the AWS Management Console.
B.Check the RDS console for any database events.
C.Delete the stack and deploy again with the same parameters.
D.Use AWS CloudTrail to view the CreateStack API call.
AnswerA

Stack events provide the specific failure reason.

Why this answer

When a CloudFormation stack creation fails, the stack events provide detailed status reasons for each resource, including the specific error message for the DBInstance. This is the first step to diagnose the failure. Option B is incorrect because while RDS events may show database-level issues, the failure occurred during stack creation and CloudFormation events are more direct.

Option C is incorrect because deleting and redeploying without understanding the cause is inefficient. Option D is incorrect because CloudTrail logs API calls but does not provide the detailed resource failure reasons that CloudFormation events do.

Full explanation →
1452
MCQeasy

A company is designing a new web application that will be accessed by users worldwide. The application should have low latency and high availability. The application uses a stateless web tier and a relational database. Which architecture minimizes latency for global users?

A.Deploy the application in multiple regions with Route 53 latency-based routing, and use Amazon Aurora Global Database for the database tier.
B.Deploy the application in a single region and use Route 53 geolocation routing.
C.Deploy the application in multiple regions, use CloudFront to cache static content, and route dynamic requests to the nearest region via Route 53 latency-based routing.
D.Deploy the application in a single region and use Amazon CloudFront to cache content globally.
AnswerA

Aurora Global Database allows reads from local regions, reducing latency for read-heavy workloads.

Why this answer

Deploying in multiple regions with Route 53 latency-based routing directs users to the region with the lowest network latency, minimizing response times. Amazon Aurora Global Database provides a fully managed cross-region replication solution with typical latency of under one second, ensuring the relational database tier is available close to each application deployment for low-latency reads and fast failover.

Exam trap

The trap here is that candidates often assume CloudFront alone can solve global latency for dynamic applications, overlooking that the database tier remains a single point of latency unless a global database solution like Aurora Global Database is used.

How to eliminate wrong answers

Option B is wrong because deploying in a single region forces all global users to traverse potentially high-latency paths to that one region, and Route 53 geolocation routing does not reduce latency—it only routes based on geographic location, which may not correspond to the lowest latency path. Option C is wrong because while CloudFront caching static content and latency-based routing for dynamic requests improves performance, the relational database remains in a single region (or requires manual cross-region replication), creating a bottleneck for database reads and writes that increases latency for users far from the database region. Option D is wrong because a single-region deployment with CloudFront only accelerates static content delivery; dynamic requests and database operations still incur the full round-trip latency to the single region, failing to minimize latency for global users.

Full explanation →
1453
MCQmedium

Refer to the exhibit. A solutions architect runs the CLI command to list EC2 instances. The output shows three instances. The architect wants to start the stopped instance and ensure it retains its instance store data. What should the architect do?

A.Modify the instance type to one that supports instance store, then start the instance.
B.Detach the instance store volume and attach it to a running instance.
C.Create an AMI from the stopped instance before starting it, then launch a new instance from the AMI.
D.Run `aws ec2 start-instances --instance-ids i-0a1b2c3d4e5f6g7h9` to start the instance.
AnswerC

An AMI captures only the root volume and any attached EBS volumes. Instance store volumes are not included in the AMI, so creating an AMI from a stopped instance will not capture the instance store data.

Why this answer

Instance store volumes provide temporary block-level storage for an EC2 instance. The data on instance store volumes persists only during the lifetime of the associated instance; it is lost when the instance is stopped or terminated. Therefore, once an instance with instance store volumes is stopped, the data on those volumes is irrecoverable.

None of the provided options can retain the instance store data. Option A is incorrect because modifying the instance type does not recover lost data. Option B is incorrect because instance store volumes cannot be detached.

Option C is incorrect because an AMI captures only EBS-backed volumes, not instance store volumes. Option D is incorrect because simply starting the instance will not restore the lost data. To preserve instance store data, it must be copied to persistent storage (e.g., EBS, S3) before stopping the instance.

Exam trap

A common misconception is that creating an AMI from a stopped instance will preserve all its data, including instance store volumes. In reality, AMIs only capture EBS-backed volumes, not instance store volumes.

Full explanation →
1454
Multi-Selectmedium

A company is planning a large-scale migration of hundreds of applications to AWS. Which TWO strategies should the architect consider to reduce migration risks?

Select 2 answers
A.Use only the rehosting strategy for all applications
B.Migrate all applications in a single wave to reduce coordination effort
C.Use a wave-based migration approach with defined groups and dependencies
D.Conduct a pilot migration of a small subset of applications
E.Roll back all migrations if any application experiences issues
AnswersC, D

Wave-based migration allows controlled, incremental migration.

Why this answer

A pilot migration allows testing the process on a small set of applications. A wave-based approach groups applications for migration and helps manage dependencies. Rolling back all migrations if issues occur is not practical.

Migrating all at once increases risk. Using only rehosting may not be optimal for all applications.

Full explanation →
1455
MCQmedium

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

A.Use a standard SQS queue and set the Lambda function reserved concurrency to 1.
B.Use an SQS FIFO queue and enable content-based deduplication.
C.Use a standard SQS queue and configure Lambda destinations for the queue.
D.Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.
AnswerB

SQS FIFO queues support exactly-once processing when combined with deduplication IDs.

Why this answer

An SQS FIFO queue guarantees first-in, first-out delivery and exactly-once processing, eliminating duplicates within a message group. Enabling content-based deduplication allows the queue to automatically detect and discard duplicate messages based on the message body, ensuring each Lambda invocation processes a unique message without additional application logic.

Exam trap

The trap here is that candidates often assume reserved concurrency or Lambda destinations can enforce exactly-once processing, but only SQS FIFO queues with deduplication provide the necessary guarantee at the queue level.

How to eliminate wrong answers

Option A is wrong because setting reserved concurrency to 1 on a standard SQS queue does not prevent duplicate messages; standard queues offer at-least-once delivery, and concurrency limits only throttle processing, not eliminate duplicates. Option C is wrong because Lambda destinations (e.g., for success/failure events) are used for asynchronous invocation results, not for deduplication; they do not affect the at-least-once delivery behavior of a standard SQS queue. Option D is wrong because DynamoDB Streams as an event source for Lambda does not provide exactly-once processing for SQS messages; it is unrelated to SQS deduplication and introduces its own at-least-once delivery semantics.

Full explanation →
1456
MCQmedium

A company is running a web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes that cause increased latency. The company wants to implement a solution to automatically adjust capacity in anticipation of traffic changes. What should a solutions architect do?

A.Configure a simple scaling policy based on CPU utilization.
B.Configure a scheduled scaling policy to add instances during known peak hours.
C.Configure a target tracking scaling policy based on average CPU utilization.
D.Configure a predictive scaling policy using historical traffic patterns.
AnswerD

Predictive scaling uses machine learning to forecast traffic and proactively scale.

Why this answer

Predictive scaling uses historical traffic patterns to forecast future demand and proactively adjust capacity before traffic spikes occur, which directly addresses the requirement to anticipate changes. This approach reduces latency by ensuring sufficient resources are available ahead of time, unlike reactive policies that only respond after utilization increases.

Exam trap

The trap here is that candidates often confuse reactive scaling policies (simple, step, or target tracking) with proactive predictive scaling, assuming that maintaining a target metric like CPU utilization is sufficient to handle anticipated spikes, but only predictive scaling uses historical patterns to act before the load increases.

How to eliminate wrong answers

Option A is wrong because a simple scaling policy based on CPU utilization is reactive, only adjusting capacity after a threshold is breached, which cannot anticipate traffic spikes and may still cause latency during the scaling cooldown period. Option B is wrong because scheduled scaling assumes fixed peak hours, but the scenario describes periodic spikes that may not follow a strict schedule, making it inflexible and potentially wasteful or insufficient. Option C is wrong because target tracking scaling, while more sophisticated than simple scaling, is still reactive—it maintains a target metric (e.g., average CPU) but does not proactively forecast demand, so it cannot eliminate latency during sudden spikes.

Full explanation →
1457
MCQeasy

A company wants to automate the migration of on-premises servers to AWS. The migration plan includes discovery, assessment, and automated replication. Which AWS service should the company use?

A.AWS CloudEndure Migration
B.AWS Migration Hub
C.AWS Schema Conversion Tool
D.AWS Database Migration Service
AnswerB

Correct. AWS Migration Hub provides a single location to track migration progress across multiple tools, integrates with discovery services, and supports automated replication through services like AWS Application Migration Service.

Why this answer

(AWS Migration Hub) is correct because it provides a centralized location to track the progress of migrations across multiple AWS and partner tools, including discovery, assessment, and replication. It integrates with AWS Application Discovery Service for discovery and assessment, and with AWS Server Migration Service (SMS) or AWS Application Migration Service (MGN) for automated replication. Option A (AWS CloudEndure Migration) is now part of AWS Application Migration Service (MGN) and focuses on replication, not end-to-end tracking.

Option C (AWS Schema Conversion Tool) is used for converting database schemas, not for server migration. Option D (AWS Database Migration Service) is specifically for database migrations, not for general server migration management.

Full explanation →
1458
MCQeasy

A small business is migrating its on-premises infrastructure to AWS. The current environment consists of two VMs running a LAMP stack (Linux, Apache, MySQL, PHP) and a separate file server. The business has limited IT staff and wants to minimize operational overhead. They also want to ensure high availability for the web application. The company has a modest budget and is looking for a cost-effective solution. You need to design the migration. Which approach should be taken?

A.Migrate the VMs to two EC2 instances in an Auto Scaling group behind an ALB. Use RDS for MySQL Multi-AZ.
B.Use Amazon Lightsail to host the entire application on a single instance with a managed database.
C.Use AWS Elastic Beanstalk to deploy the web application. Use Amazon RDS for MySQL Multi-AZ for the database. Use S3 for file storage.
D.Containerize the application and run on Amazon ECS with Fargate. Use Amazon RDS for MySQL.
AnswerC

Minimizes operational overhead and provides high availability.

Why this answer

The best approach because AWS Elastic Beanstalk provides a managed platform for the web application, reducing operational overhead. Amazon RDS for MySQL Multi-AZ ensures high availability for the database with automatic failover. Using S3 for file storage is cost-effective and scalable.

Option A (EC2 Auto Scaling with ALB) requires more management than Elastic Beanstalk. Option B (Lightsail on a single instance) does not provide high availability. Option D (ECS Fargate) introduces containerization complexity and higher cost, which is not ideal for a small business with limited IT staff and a modest budget.

Full explanation →
1459
Multi-Selecteasy

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

Select 3 answers
A.Store AWS access keys in AWS Secrets Manager and retrieve them at runtime.
B.Create an IAM role with permissions to access the S3 bucket.
C.Attach the IAM role to the ECS task definition as the task role.
D.Enable the ECS task execution role to pass the task role to the container.
E.Configure the application to use the AWS CLI with environment variables for credentials.
AnswersB, C, D

The task role will assume this role to get temporary credentials.

Why this answer

The application must not have long-term credentials stored in the container image or environment variables. By creating an IAM role with permissions to access the S3 bucket and attaching it as the ECS task role (Option C), the application can obtain temporary credentials from the ECS task metadata endpoint. This eliminates the need to store any static access keys.

Option D is also correct because the ECS task execution role must have the `iam:PassRole` permission to allow the task role to be associated with the container, enabling the credential retrieval mechanism.

Exam trap

The trap here is that candidates may think storing credentials in AWS Secrets Manager (Option A) is acceptable because it removes them from the image, but the requirement explicitly prohibits any long-term credentials from being present in the container at runtime, which Secrets Manager retrieval still introduces.

Full explanation →
1460
MCQmedium

A company is migrating a batch processing workload to AWS. The workload runs a Java application that processes files from an S3 bucket. The company wants to minimize operational overhead. Which AWS service should the company use to run the Java application?

A.Amazon EC2
B.Amazon ECS with EC2 launch type
C.AWS Batch
D.AWS Lambda
AnswerD

Lambda is serverless and can process files triggered by S3 events.

Why this answer

(AWS Lambda) is correct because it allows running Java code in response to S3 events with no server management, minimizing operational overhead. AWS Lambda supports Java runtime, can be triggered by S3 object creation events, and automatically scales. Options A (Amazon EC2) and B (Amazon ECS with EC2 launch type) require managing EC2 instances or cluster, increasing overhead.

Option C (AWS Batch) is designed for batch jobs but still requires compute environments (EC2 or Fargate) and is more complex than Lambda for simple file processing.

Full explanation →
1461
MCQeasy

A company is using AWS Config to evaluate resource compliance. They want to receive notifications when a noncompliant resource is detected. Which AWS service should be used to send these notifications to an email endpoint?

A.Amazon Simple Queue Service (SQS)
B.Amazon Simple Notification Service (SNS)
C.Amazon CloudWatch Events
D.AWS Lambda
AnswerB

SNS can send email notifications directly.

Why this answer

(Amazon SNS) is correct because Amazon SNS can send email notifications when triggered by AWS Config rules to notify about noncompliant resources. Option A (SQS) is incorrect because SQS is a message queue service that does not directly send email. Option C (CloudWatch Events) can trigger other actions but cannot directly send email to endpoints.

Option D (AWS Lambda) can process notifications but requires additional services like SNS to send email.

Full explanation →
1462
MCQmedium

A company is migrating a legacy .NET Framework 4.7 web application to AWS. The application currently runs on Windows Server 2012 R2 with IIS and uses SQL Server Express for local storage. The company wants to minimize re-architecture and reduce operational overhead. Which migration strategy should the company use?

A.Retire the application and replace it with a SaaS-based solution.
B.Refactor the application to use .NET Core and deploy on Linux containers with Amazon ECS.
C.Replatform the application to use AWS Elastic Beanstalk with a SQL Server Express Multi-AZ RDS instance.
D.Rehost the application on Amazon EC2 Windows instances using an AWS Migration Acceleration Program (MAP) partner tool.
AnswerD

Rehosting lifts and shifts the application with minimal changes, reducing operational overhead.

Why this answer

Rehosting (lift-and-shift) the .NET Framework 4.7 application to Amazon EC2 Windows instances minimizes re-architecture and reduces operational overhead. The application is tightly coupled to Windows Server and IIS, and SQL Server Express is a local database; rehosting preserves the existing architecture without code changes. Using an AWS MAP partner tool streamlines the migration process, aligning with the goal of minimizing changes.

Exam trap

The trap here is that candidates may choose replatforming (Option C) thinking it reduces overhead, but it actually requires modifying the database connection string and handling Multi-AZ failover, which adds re-architecture effort beyond a simple lift-and-shift.

How to eliminate wrong answers

Option A is wrong because retiring the application and replacing it with a SaaS solution would require significant re-architecture and business process changes, contradicting the goal to minimize re-architecture. Option B is wrong because refactoring to .NET Core and deploying on Linux containers with Amazon ECS would require substantial code changes and re-architecture, which the company wants to avoid. Option C is wrong because replatforming to AWS Elastic Beanstalk with a SQL Server Express Multi-AZ RDS instance still requires modifying the application to use a remote database instead of local SQL Server Express, introducing re-architecture and increased operational complexity.

Full explanation →
1463
MCQmedium

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. They need to ensure that users can authenticate to AWS resources using their existing corporate credentials. What is the MOST secure and scalable solution?

A.Federate using SAML 2.0 with on-premises ADFS and map AD groups to IAM roles.
B.Deploy AD Connector in each VPC to proxy authentication requests to on-premises Active Directory.
C.Set up AWS Managed Microsoft AD and establish a trust with the on-premises Active Directory. Use IAM roles to grant access based on AD groups.
D.Use AWS Directory Service Simple AD and synchronize with on-premises Active Directory using AD Connector.
AnswerC

AWS Managed Microsoft AD supports trust relationships and can be used for IAM authentication.

Why this answer

AWS Managed Microsoft AD can establish a forest trust with an on-premises Active Directory, allowing users to authenticate using their existing corporate credentials. This approach is secure (Kerberos-based trust, no password exposure) and scalable (AWS handles AD infrastructure). IAM roles can then be mapped to AD groups via SAML or IAM Identity Center for fine-grained access to AWS resources.

Exam trap

The trap here is that candidates often confuse AD Connector (a proxy) with a trust relationship, thinking it provides the same level of integration, but AD Connector does not support native Kerberos trusts or scalable authentication for AWS Managed Microsoft AD migration.

How to eliminate wrong answers

Option A is wrong because federating with SAML 2.0 and ADFS requires maintaining a separate federation infrastructure and does not directly integrate with AWS Managed Microsoft AD for native AD authentication; it also adds complexity without leveraging the trust relationship. Option B is wrong because AD Connector is a proxy that forwards authentication requests to on-premises AD, but it does not provide a scalable solution for migrating to AWS Managed Microsoft AD and introduces a single point of failure in each VPC. Option D is wrong because Simple AD is a standalone LDAP directory based on Samba 4, not compatible with Active Directory trusts or Kerberos authentication, and AD Connector cannot synchronize with Simple AD; it only proxies to on-premises AD.

Full explanation →
1464
MCQeasy

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

A.Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.
B.Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.
C.Use resource-based policies on the buckets to allow access from the IAM Identity Center users.
D.Use S3 bucket policies that grant access to specific IAM users based on their usernames.
AnswerA

ABAC with tags enables fine-grained, scalable access control.

Why this answer

It uses IAM roles with tag-based policies, which integrate with AWS IAM Identity Center via attribute-based access control (ABAC). Developers assume the role after authenticating through Identity Center, and the policy dynamically grants access to S3 buckets matching their team tags, enabling fine-grained, scalable permissions without managing individual users or groups.

Exam trap

The trap here is that candidates often assume IAM groups (Option B) are the natural way to organize users from Identity Center, but Identity Center uses its own group structure and permission sets, not IAM groups, making Option B incompatible.

How to eliminate wrong answers

Option B is wrong because IAM groups are not directly compatible with IAM Identity Center; Identity Center uses permission sets and groups within its own directory, not IAM groups, so attaching policies to IAM groups would not apply to Identity Center users. Option C is wrong because resource-based policies on S3 buckets cannot directly reference IAM Identity Center users or groups; they can only reference IAM principals (users, roles, or AWS accounts), and Identity Center users are not IAM principals. Option D is wrong because S3 bucket policies that grant access based on IAM usernames are brittle and unscalable; they require hardcoding usernames, do not leverage team membership, and do not integrate with Identity Center's federated identity model.

Full explanation →
1465
MCQhard

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

A.Reduce the batch size in the Lambda event source mapping.
B.Increase the Lambda function's reserved concurrency and timeout.
C.Increase the SQS visibility timeout to 6 minutes.
D.Configure a dead-letter queue for the SQS queue.
AnswerB

Increasing reserved concurrency allows Lambda to scale to handle the burst, and increasing the timeout prevents timeouts during processing, thus reducing reprocessing.

Why this answer

Increasing the reserved concurrency ensures Lambda can scale to handle the burst, and increasing the timeout allows the function to complete processing without timing out. Option A is wrong because reducing the batch size may reduce the number of messages processed per invocation but does not address the timeout issue. Option C is wrong because increasing the SQS visibility timeout would cause messages to be delayed before becoming visible again after a timeout, but it does not solve the root cause of the Lambda function timing out; it just delays reprocessing.

Option D is wrong because a dead-letter queue is used to capture messages that repeatedly fail processing after maximum retries, not to prevent reprocessing of timeout failures.

Full explanation →
1466
MCQeasy

A company is designing a serverless data processing pipeline using AWS Lambda functions. The pipeline processes messages from an Amazon SQS queue. Each message takes approximately 30 seconds to process, and the pipeline must handle bursts of up to 10,000 messages per minute. The messages must be processed in the order they are received. Which solution meets these requirements?

A.Use an SQS FIFO queue with a Lambda function that sets the Concurrency limit to 100.
B.Use an SQS FIFO queue with a Lambda function configured with a reserved concurrency of 1000.
C.Use an SQS Standard queue with a Lambda function that processes messages in batches.
D.Use an Amazon Kinesis Data Stream with a Lambda function that processes multiple records per invocation.
AnswerB

FIFO queues preserve order; Lambda with reserved concurrency avoids throttling.

Why this answer

An SQS FIFO queue guarantees first-in-first-out delivery within each message group, and with multiple message group IDs, messages can be processed in parallel. The Lambda function can be configured with a batch size of up to 10 messages from the same group. Assuming that messages are distributed across many groups, each invocation processes a batch of messages in approximately 30 seconds, yielding a per-group throughput of up to 20 messages per minute.

With a reserved concurrency of 1000, the pipeline can handle up to 1000 groups concurrently, achieving a total throughput of 20,000 messages per minute, which exceeds the required burst of 10,000 messages per minute. Reserved concurrency also ensures that the necessary capacity is available when needed, preventing throttling.

Exam trap

The trap here is that candidates often confuse 'Concurrency limit' (which caps maximum concurrency) with 'reserved concurrency' (which guarantees availability), and they may overlook that SQS Standard queues do not preserve order, leading them to choose Option A or C incorrectly.

How to eliminate wrong answers

Option A is wrong because setting a Concurrency limit to 100 restricts the Lambda function to only 100 concurrent executions, which at 30 seconds per message yields a maximum throughput of 200 messages per minute, far below the required 10,000. Option C is wrong because an SQS Standard queue does not guarantee message ordering, which violates the requirement that messages must be processed in the order they are received. Option D is wrong because Amazon Kinesis Data Streams does not provide strict per-message ordering across shards; ordering is only guaranteed within a shard, and processing multiple records per invocation can still lead to out-of-order processing if records from different shards are interleaved.

Full explanation →
1467
MCQhard

A company is designing a new application that will process sensitive financial data. They need to ensure that data at rest is encrypted using customer-provided encryption keys (SSE-C) in Amazon S3. Which action is required to enable this?

A.Use AWS KMS to generate a key
B.Enable default encryption on the bucket
C.Provide the encryption key in the request headers
D.Configure a bucket policy to require SSE-C
AnswerC

SSE-C requires the key to be provided with each request.

Why this answer

SSE-C requires the customer to provide the encryption key in the request headers when uploading or accessing objects. Amazon S3 uses the provided key to encrypt data at rest and then discards the key; the customer is responsible for managing the key lifecycle. This is the only way to enforce customer-provided encryption keys at the object level.

Exam trap

The trap here is that candidates confuse SSE-C with SSE-KMS or SSE-S3, assuming that a bucket policy or default encryption alone can enforce customer-provided keys, when in fact SSE-C requires the key to be explicitly supplied in every request.

How to eliminate wrong answers

Option A is wrong because AWS KMS generates AWS-managed or customer-managed keys (SSE-KMS), not customer-provided keys (SSE-C) that are supplied per request. Option B is wrong because enabling default encryption on the bucket applies SSE-S3 or SSE-KMS automatically, not SSE-C, which requires the key to be sent with each request. Option D is wrong because a bucket policy can require SSE-C (e.g., via a condition key like s3:x-amz-server-side-encryption-customer-algorithm), but it does not enable SSE-C itself; the key must still be provided in the request headers.

Full explanation →
1468
MCQhard

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

A.Use a step scaling policy with a lower scale-out threshold and a larger adjustment
B.Increase the task memory allocation to improve performance
C.Increase the health check interval to reduce the number of tasks marked unhealthy
D.Use a target tracking scaling policy with a higher target value
AnswerA

Step scaling can add more tasks faster when CPU exceeds thresholds.

Why this answer

Step scaling policies can respond more aggressively to larger traffic spikes by using a lower scale-out threshold and a larger adjustment, adding capacity faster when needed. Option B (increase task memory) does not directly affect scaling behavior. Option C (increase health check interval) would actually delay detection of unhealthy tasks, potentially reducing resilience.

Option D (target tracking) is reactive and may not handle sudden spikes as effectively as step scaling.

Full explanation →
1469
MCQhard

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

A.The security group allows SSH from a restricted IP, but not from the users.
B.The security group does not allow outbound traffic, so responses cannot be sent.
C.The security group allows HTTP only from the IP range 203.0.113.0/24.
D.The security group does not allow inbound HTTP traffic.
AnswerC

Correct. The security group only allows HTTP from 203.0.113.0/24, which excludes many users, blocking access.

Why this answer

Security groups are stateful: if inbound HTTP traffic is allowed, the corresponding outbound response traffic is automatically allowed, regardless of outbound rules. Therefore, missing outbound rules cannot prevent responses. The most likely issue is that the security group only allows HTTP from the IP range 203.0.113.0/24.

Users outside that range will be blocked, even though the instance is in a public subnet with an internet gateway.

Exam trap

The trap is that candidates may incorrectly blame missing outbound rules, overlooking the stateful nature of security groups. The real issue is often a restrictive inbound rule that does not permit traffic from the users' IP ranges.

How to eliminate wrong answers

Option A is wrong because the issue is about HTTP access, not SSH; SSH restrictions would not prevent HTTP users from reaching the web server. Option C is wrong because the security group allows HTTP from 0.0.0.0/0, not just 203.0.113.0/24, so IP-based restriction is not the problem. Option D is wrong because the security group explicitly allows inbound HTTP traffic on port 80 from 0.0.0.0/0, so inbound HTTP is permitted.

Full explanation →
1470
MCQhard

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

A.{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}
B.{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}
C.{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}
D.{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}
AnswerA

UpdateService is the action needed to update the ECS service.

Why this answer

The CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Exam trap

The trap here is that candidates confuse the permissions needed for different stages of the pipeline (e.g., pushing to ECR or registering a task definition) with the specific permission required to update the ECS service, leading them to select options that are valid for other actions but not for the failing step.

How to eliminate wrong answers

Option B is wrong because ecr:PutImage is used to push Docker images to an ECR repository, which is typically performed by the build stage (e.g., CodeBuild) rather than the CodePipeline service role that updates the ECS service. Option C is wrong because ecs:RunTask is used to run standalone tasks, not to update an existing ECS service; updating a service requires ecs:UpdateService. Option D is wrong because ecs:RegisterTaskDefinition is used to create a new task definition revision, which is usually done by the build or deploy stage, not by the pipeline service role when updating the service itself.

Full explanation →
1471
Multi-Selectmedium

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

Select 2 answers
A.Configure a scheduled scaling policy to add instances during business hours.
B.Replace the ALB with a Network Load Balancer for better performance.
C.Create a dynamic scaling policy based on the average CPU utilization metric.
D.Create an Auto Scaling group and associate it with the ALB.
E.Create a CloudWatch alarm that sends an email when CPU exceeds 80%.
AnswersC, D

Scales based on CPU.

Why this answer

To automatically scale EC2 instances based on CPU utilization, you need an Auto Scaling group to manage the instances (Option D) and a dynamic scaling policy based on the average CPU utilization metric (Option C). Option A is a scheduled scaling policy based on time, not CPU utilization. Option B is incorrect because a Network Load Balancer is not required for scaling based on CPU.

Option E is incorrect because while a CloudWatch alarm can be used to trigger scaling, it is not a required step on its own; the scaling policy is the primary requirement.

Full explanation →
1472
MCQeasy

A company is migrating its on-premises VMware VMs to AWS. The company wants to use the same management tools and maintain consistency. Which AWS service should be used for this migration?

A.AWS Server Migration Service (SMS)
B.AWS Snowball Edge
C.VMware Cloud on AWS
D.AWS Database Migration Service (DMS)
AnswerC

VMware Cloud on AWS allows running VMware workloads natively on AWS with consistent management.

Why this answer

VMware Cloud on AWS allows running VMware workloads natively on AWS with consistent management. Option A is wrong because Server Migration Service (SMS) is for server migration but not VMware management. Option B is wrong because Snowball Edge is for offline data transfer, not for VM migration.

Option D is wrong because Database Migration Service (DMS) is for database migration, not for VM migration.

Full explanation →
1473
MCQhard

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

A.Full access to all AWS services because no SCP is applied to the DevAccount.
B.Nothing, because the management account's SCP applies to all accounts.
C.Only read-only actions because of default SCP.
D.Only actions allowed by the root user's implicit full access.
AnswerB

As explained above: the management account's SCP applies to all accounts in the organization, denying all actions.

Why this answer

SCPs are inherited from the root of the organization. The management account (111111111111) has an SCP that denies all actions, and since the DevAccount (222222222222) is a member of the same AWS Organization, this SCP applies to all accounts in the organization, including the DevAccount. Therefore, the root user of the DevAccount is denied all actions, even though no SCP is explicitly attached to the DevAccount.

Exam trap

The trap is that candidates assume that because the DevAccount has no SCP attached, the root user has full access. However, SCPs are inherited from the root OU, and the management account's SCP denying all actions applies to all accounts in the organization, including the DevAccount.

How to eliminate wrong answers

Option B is wrong because SCPs only apply to accounts that are members of the same AWS Organization; the management account's SCP does not automatically apply to accounts outside its organization, and the DevAccount is not stated to be a member. Option C is wrong because there is no 'default SCP' that enforces read-only actions; when no SCP is attached, the default behavior is to allow all actions (full access). Option D is wrong because the root user's implicit full access is not limited by any SCP in this scenario, so the root user can perform all actions, not just those allowed by implicit full access (which is already full access).

Full explanation →
1474
MCQmedium

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

A.Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.
B.Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.
C.Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.
D.Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.
AnswerB

CloudFront provides HTTPS and works with ACM.

Why this answer

Amazon CloudFront can terminate HTTPS at the edge using an SSL certificate from AWS Certificate Manager (ACM), and it can be configured with an origin pointing to an S3 bucket configured for static website hosting. This combination allows the use of a custom domain name (e.g., www.example.com) via a CloudFront alternate domain name (CNAME) and enforces HTTPS for all client connections, which S3 static website hosting alone cannot natively support.

Exam trap

The trap here is that candidates assume S3 static website hosting can directly serve HTTPS with a custom domain and SSL certificate, but S3 does not support SSL termination or custom certificates on its website endpoint, making a CDN like CloudFront mandatory for HTTPS enforcement.

How to eliminate wrong answers

Option A is wrong because S3 static website hosting does not support attaching a custom SSL certificate directly; S3 only serves HTTP on the bucket's website endpoint, and HTTPS is not available without a front-end service like CloudFront. Option C is wrong because Route 53 with an alias record pointing to an S3 website endpoint does not provide HTTPS termination; DNSSEC only secures DNS queries, not the HTTP connection, and the S3 website endpoint itself does not support HTTPS. Option D is wrong because an Application Load Balancer (ALB) cannot be placed directly in front of an S3 bucket as an origin; ALBs require targets such as EC2 instances, IP addresses, or Lambda functions, not S3 buckets.

Full explanation →
1475
MCQmedium

A company runs a stateless web application on AWS Elastic Beanstalk. The application experiences periodic spikes in traffic that cause CPU utilization to reach 90% on the EC2 instances. The company wants to automatically scale the environment based on CPU usage. They also want to ensure that the scaling is proactive and can handle sudden traffic surges. What should they do?

A.Configure a simple scaling policy based on CPU utilization with a cooldown period.
B.Configure a predictive scaling policy using AWS Auto Scaling.
C.Manually increase the instance count when traffic spikes are expected.
D.Use scheduled scaling to add instances during known peak times.
AnswerB

Predictive scaling uses historical data to forecast and proactively add capacity before spikes.

Why this answer

Predictive scaling policies in AWS Auto Scaling use historical data to forecast future traffic and proactively adjust capacity, handling sudden surges. Option A: Simple scaling policies react after alarms trigger, causing delays. Option C: Manual scaling is not automated.

Option D: Scheduled scaling works for known peak times but not for unpredictable surges.

Full explanation →
1476
Multi-Selecthard

A company is migrating a legacy application to AWS. The application requires a relational database with high I/O and low latency. The database size is 2 TB and growing. The Solutions Architect must choose a storage solution that provides the best price-performance. Which TWO solutions meet these requirements?

Select 2 answers
A.Use Amazon Aurora with I/O-Optimized cluster configuration.
B.Use Amazon RDS with Provisioned IOPS (io2) volumes.
C.Use Amazon DynamoDB with provisioned capacity.
D.Use Amazon Redshift with dense compute nodes.
E.Use Amazon RDS with gp3 storage.
AnswersA, B

Aurora I/O-Optimized is cost-effective for high I/O.

Why this answer

Options A and B are correct: Amazon Aurora with I/O-Optimized cluster configuration provides high I/O and low latency for demanding workloads, often at a lower cost than Provisioned IOPS for sustained high I/O. Amazon RDS with Provisioned IOPS (io2) volumes delivers consistent low latency and high throughput, suitable for I/O-intensive applications. Option C is wrong because DynamoDB is a NoSQL database, not a relational one.

Option D is wrong because Redshift is a data warehouse for analytics, not a relational database for OLTP. Option E is wrong because gp3 storage is general-purpose and not optimized for high I/O workloads.

Full explanation →
1477
MCQeasy

A company is migrating a monolithic application to AWS. The application currently runs on a single on-premises server and uses a MySQL database. The company wants to minimize changes to the application code during migration. Which migration strategy should the company use?

A.Refactor the application to use microservices and Amazon RDS.
B.Rehost the application on Amazon EC2 and migrate the database to Amazon RDS.
C.Replatform the application to use AWS Elastic Beanstalk and Amazon Aurora.
D.Repurchase the application by adopting a SaaS solution.
AnswerB

Rehosting minimizes code changes.

Why this answer

Rehosting (lift-and-shift) involves moving applications to AWS with minimal changes, which fits the requirement to minimize code changes. Option A is wrong because refactoring requires code changes. Option C is wrong because replatforming involves some optimizations.

Option D is wrong because repurchasing replaces the application with a SaaS product.

Full explanation →
1478
MCQhard

A multinational corporation uses AWS Organizations with hundreds of accounts. The security team requires that all Amazon S3 buckets across the organization be encrypted with a specific AWS KMS key from the security account. Which combination of controls should be implemented to enforce this requirement?

A.Create an AWS Service Catalog portfolio that restricts bucket creation to encrypted buckets only.
B.Use IAM policies in each account to deny PutBucketEncryption actions that do not specify the required KMS key.
C.Enable AWS CloudTrail and create a CloudWatch Events rule to automatically remediate non-compliant buckets.
D.Apply an SCP to deny s3:PutBucketEncryption with any key other than the required KMS key, and use AWS Config rules to detect and remediate existing non-compliant buckets.
AnswerD

SCPs can deny actions organization-wide, and AWS Config rules can detect and remediate non-compliant buckets.

Why this answer

SCPs can deny the creation of S3 buckets without encryption or with the wrong KMS key, and AWS Config rules can detect non-compliant existing buckets for remediation. Option A is wrong because AWS Service Catalog is not designed for this purpose. Option B is wrong because IAM policies alone cannot enforce encryption at the organizational level across multiple accounts.

Option C is wrong because AWS CloudTrail only logs, not enforces.

Full explanation →
1479
MCQmedium

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

A.Increase the ALB idle timeout to 120 seconds.
B.Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.
C.Enable cross-zone load balancing on the ALB.
D.Reduce the target tracking scaling threshold to 50% average CPU.
AnswerB

Step scaling can add capacity quickly in response to high CPU, reducing timeouts.

Why this answer

Adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Exam trap

The trap here is that candidates assume reducing the target tracking threshold (Option D) is sufficient, but they overlook that target tracking cannot react quickly enough to sudden spikes, whereas a step scaling policy provides the immediate, aggressive scale-out needed to prevent 100% CPU utilization and timeouts.

How to eliminate wrong answers

Option A is wrong because increasing the ALB idle timeout to 120 seconds does not address the root cause of CPU spikes; it only keeps connections open longer, which can mask timeouts but does not prevent them. Option C is wrong because cross-zone load balancing is already enabled by default on ALBs and does not affect CPU utilization or scaling behavior. Option D is wrong because reducing the target tracking threshold to 50% average CPU would cause the Auto Scaling group to maintain a lower average utilization, but it does not provide the rapid, proactive scaling needed to handle sudden spikes that reach 100% CPU.

Full explanation →
1480
MCQeasy

A company has a multi-account AWS environment with a centralized logging account. They want to collect VPC Flow Logs from all accounts and store them in a centralized S3 bucket in the logging account. What is the MOST scalable and cost-effective solution?

A.Configure VPC Flow Logs to deliver to an S3 bucket in each account, then enable S3 Cross-Region Replication to the central bucket in the logging account.
B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket.
C.Create a Lambda function in each account that copies log files to the central bucket.
D.Use S3 Batch Operations to copy logs from each account to the central bucket daily.
AnswerA

S3 replication is serverless, cost-effective, and scales automatically.

Why this answer

VPC Flow Logs can be delivered directly to an S3 bucket in each account, and S3 Cross-Region Replication (CRR) can then automatically and asynchronously replicate the logs to a centralized bucket in the logging account. This approach is highly scalable (CRR handles replication without any custom code or infrastructure) and cost-effective (no additional compute or streaming services are needed; you only pay for S3 storage and replication costs).

Exam trap

The trap here is that candidates often assume Kinesis Data Firehose is the most scalable streaming solution, but for VPC Flow Logs delivered to S3, direct S3 delivery with CRR is simpler, more cost-effective, and avoids unnecessary streaming costs and complexity.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose introduces additional per-GB ingestion and processing costs, and requires managing delivery streams in each account, making it less cost-effective and more complex than direct S3 delivery with CRR. Option C is wrong because using a Lambda function in each account to copy log files introduces cold starts, concurrency limits, and additional compute costs, and does not scale as well as S3's built-in replication for high-volume logs. Option D is wrong because S3 Batch Operations is designed for one-time or periodic bulk actions (e.g., copying existing objects), not for continuous, real-time replication of streaming VPC Flow Logs, and it would require manual scheduling and additional orchestration.

Full explanation →
1481
Multi-Selecteasy

A company is migrating a legacy .NET Framework 4.7 application to AWS. The application currently uses Windows Authentication and stores session state in-process. The company wants to minimize code changes and use AWS managed services. Which TWO strategies should the company adopt?

Select 2 answers
A.Migrate the application to run on Amazon EC2 instances joined to AWS Managed Microsoft AD.
B.Rewrite the application to .NET Core and deploy on AWS Elastic Beanstalk with Amazon RDS for SQL Server.
C.Store session data in Amazon ElastiCache for Redis using the Redis Session State Provider.
D.Use Amazon Cognito with an Active Directory connector for authentication.
E.Use Amazon DynamoDB to persist session state.
AnswersA, C

AWS Managed Microsoft AD supports Windows Authentication with minimal code changes.

Why this answer

AWS Managed Microsoft AD supports Windows Authentication and can integrate with EC2 without code changes. Option C is correct because ElastiCache for Redis can be used as a distributed session store, replacing in-process session state with minimal code changes (using Redis Session State Provider). Option B is wrong because .NET Core is not compatible with .NET Framework 4.7 without significant rewrite.

Option D is wrong because Cognito is for external identity providers, not Windows Authentication. Option E is wrong because DynamoDB is not a drop-in replacement for in-process sessions; it requires custom code.

Full explanation →
1482
MCQhard

A company is designing a new data lake on Amazon S3. The data is ingested from various sources and must be encrypted at rest. The company has a strict requirement to use an AWS KMS customer master key (CMK) that is stored in a different AWS account for additional security. The S3 bucket is in Account A, and the KMS key is in Account B. Which steps are necessary to enable server-side encryption with AWS KMS (SSE-KMS) for objects in the S3 bucket?

A.Enable SSE-KMS on the S3 bucket in Account A and specify the ARN of the KMS key from Account B. S3 will automatically use the key.
B.Update the KMS key policy in Account B to grant Account A access to the key. No changes needed in Account A.
C.Update the KMS key policy in Account B to grant Account A access to the key, and update the S3 bucket policy in Account A to allow the kms:Encrypt and kms:Decrypt actions for the key.
D.Update the S3 bucket policy in Account A to allow s3:PutObject with the kms:Encrypt permission. No changes needed in Account B.
AnswerC

Both policies are required for cross-account SSE-KMS.

Why this answer

When using an AWS KMS CMK from a different account (Account B) for SSE-KMS on an S3 bucket in Account A, you must explicitly grant Account A access to the key via the KMS key policy in Account B. Additionally, the S3 bucket policy in Account A must allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 will use these permissions to encrypt and decrypt objects on behalf of the bucket owner. Without both policy updates, the cross-account KMS operation will fail with an access denied error.

Exam trap

The trap here is that candidates assume that specifying a cross-account KMS key ARN in the S3 bucket configuration is sufficient, overlooking the mandatory two-way policy update (KMS key policy in the key-owning account and S3 bucket policy in the bucket-owning account) required for cross-account KMS operations.

How to eliminate wrong answers

Option A is wrong because simply enabling SSE-KMS on the S3 bucket and specifying the ARN of the KMS key from Account B does not automatically grant Account A the necessary permissions; the KMS key policy in Account B must explicitly allow Account A to use the key. Option B is wrong because updating only the KMS key policy in Account B is insufficient; the S3 bucket policy in Account A must also allow the kms:Encrypt and kms:Decrypt actions for the cross-account key, as S3 performs the encryption/decryption on behalf of the requester. Option D is wrong because updating only the S3 bucket policy to allow s3:PutObject with kms:Encrypt permission does not grant Account A access to the KMS key in Account B; the KMS key policy must also be updated to allow Account A to use the key.

Full explanation →
1483
Matchingmedium

Match each AWS security service to its purpose.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Protect web applications from common exploits

Enhanced DDoS protection for critical workloads

Create and manage encryption keys

Rotate and manage secrets securely

Manage user identities and permissions

Why these pairings

Security services address different aspects of threat protection and access control.

Full explanation →
1484
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent slowdowns. CloudWatch metrics show high CPU utilization on the instances. The company wants to improve performance with minimal architectural changes. What should a solutions architect do?

A.Use Amazon ElastiCache to offload database queries.
B.Configure an Auto Scaling group with a dynamic scaling policy based on CPU utilization.
C.Replace the EC2 instances with a larger instance type.
D.Enable Amazon CloudFront in front of the ALB to cache content.
AnswerB

Auto Scaling adds instances during high demand, distributing load and reducing CPU per instance.

Why this answer

Auto Scaling with a dynamic scaling policy based on CPU utilization automatically adds or removes EC2 instances in response to load, handling spikes without manual intervention. This is a minimal architectural change. Option A is wrong because ElastiCache offloads database queries, but the high CPU may be from compute-intensive operations, not database.

Option C is wrong because vertical scaling (larger instances) has an upper limit and may require downtime during resizing. Option D is wrong because CloudFront caches static content at the edge, but it does not reduce CPU load from dynamic requests or compute processing on the instances.

Full explanation →
1485
MCQmedium

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

A.Use the awslogs log driver in the task definition and specify the log group.
B.Install and configure the CloudWatch agent in the container image.
C.Output logs to stdout/stderr and use a Lambda function to push them.
D.Configure a sidecar container running the CloudWatch agent.
AnswerA

The awslogs log driver is the native integration for ECS and Fargate to send logs to CloudWatch.

Why this answer

The awslogs log driver is the native, built-in mechanism for Amazon ECS tasks using the Fargate launch type to send container logs directly to CloudWatch Logs. By specifying the 'awslogs' log driver in the task definition and providing the log group name, ECS automatically streams stdout and stderr from the container to the specified CloudWatch log group without requiring any additional agents or infrastructure.

Exam trap

The trap here is that candidates often over-engineer the solution by thinking a separate agent or sidecar is required for log shipping, when in fact the awslogs log driver is the simplest and most efficient native integration for ECS with Fargate.

How to eliminate wrong answers

Option B is wrong because installing the CloudWatch agent inside the container image is unnecessary and adds complexity; the awslogs log driver handles log shipping natively at the container runtime level. Option C is wrong because using a Lambda function to push logs from stdout/stderr is an overly complex, non-standard approach that introduces latency and potential data loss, whereas the awslogs driver streams logs in real time. Option D is wrong because a sidecar container running the CloudWatch agent is redundant and consumes additional resources; the awslogs log driver is the recommended and simpler method for Fargate tasks.

Full explanation →
1486
MCQeasy

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

A.Use AWS Client VPN to connect each account to the central VPC.
B.Use VPC Peering between the central VPC and each member account VPC.
C.Use AWS Direct Connect between accounts.
D.Use AWS Transit Gateway with VPN attachments between the central networking account and each member account VPC.
AnswerD

Provides IPsec encryption and centralized routing.

Why this answer

AWS Transit Gateway with VPN attachments enables encrypted traffic between the central networking account and each member account VPC using IPsec tunnels. This satisfies the encryption-in-transit requirement while ensuring all traffic routes through the central networking account, preventing direct account-to-account access. Transit Gateway also allows all accounts to share a single VPC for workloads without creating separate VPCs.

Exam trap

The trap here is that candidates may assume VPC Peering or Direct Connect inherently meet encryption requirements, but VPC Peering does not encrypt traffic and Direct Connect requires an additional VPN layer for encryption, while Transit Gateway VPN attachments provide both encryption and centralized routing control.

How to eliminate wrong answers

Option A is wrong because AWS Client VPN provides encrypted client-to-VPN access but is designed for individual user connections, not for routing traffic between VPCs or accounts, and it does not enforce that all inter-account traffic must go through the central networking account. Option B is wrong because VPC Peering does not natively encrypt traffic in transit; it relies on AWS's physical network security but does not meet explicit encryption requirements, and it allows direct peering relationships that could bypass the central networking account. Option C is wrong because AWS Direct Connect provides a dedicated private connection from on-premises to AWS, not between accounts, and it does not inherently encrypt traffic unless combined with IPsec VPN, which is not specified in the option.

Full explanation →
1487
MCQhard

Refer to the exhibit. A security engineer ran this AWS CLI command to investigate who created a CloudTrail trail in January 2024. The command returned no results. However, the security team knows that a trail was created during that period. What is the most likely reason for the empty result?

A.The start time is too far in the past and CloudTrail only retains events for 90 days.
B.The trail was created using the AWS Management Console, not the CLI.
C.The trail was created in a different region and the command did not specify a region.
D.The command syntax is incorrect; the --lookup-attributes parameter should be --attribute.
AnswerC

By default, the CLI uses the current region; the trail might be in another region.

Why this answer

The AWS CLI command `aws cloudtrail lookup-events` defaults to the region configured in the AWS CLI profile (e.g., `us-east-1`). If the CloudTrail trail was created in a different region, the command will return no results unless the `--region` parameter is explicitly specified. Since the security team knows the trail was created in January 2024, the most likely reason for the empty result is that the command did not target the correct region.

Exam trap

The trap here is that candidates assume CloudTrail events are globally visible by default, but `lookup-events` is region-scoped unless the trail is a multi-region trail, and even then, the command must be run in the home region of the trail to see the creation event.

How to eliminate wrong answers

Option A is wrong because CloudTrail `lookup-events` can retrieve events for up to 90 days, but the command can also access events beyond that if the trail is configured to send events to CloudWatch Logs or S3, and the `--lookup-attributes` parameter does not impose a 90-day limit on the API itself. Option B is wrong because the method of creation (Console vs. CLI) does not affect the ability of `lookup-events` to retrieve the event; CloudTrail records all management events regardless of the interface used.

Option D is wrong because the `--lookup-attributes` parameter is the correct syntax for the `lookup-events` command; there is no `--attribute` parameter in the AWS CLI for CloudTrail.

Full explanation →
1488
MCQhard

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

A.Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.
B.Use Amazon Aurora Global Database.
C.Use Amazon RDS with automated backups and restore in another Region.
D.Use Amazon RDS Multi-AZ with a standby in a different AWS Region.
AnswerA

Cross-Region read replicas use asynchronous replication with minimal lag, and can be promoted quickly, meeting the RPO/RTO requirements.

Why this answer

Amazon RDS for MySQL cross-Region read replicas use asynchronous replication with a typical lag of less than 5 seconds, meeting the RPO requirement. In a disaster, you promote the replica to a standalone primary instance, which takes under 1 minute, satisfying the RTO. This is the only option that provides both sub-5-second RPO and sub-1-minute RTO for RDS MySQL.

Exam trap

The trap here is that candidates confuse Amazon Aurora Global Database (which is not available for RDS MySQL) with RDS cross-Region replicas, or assume Multi-AZ can be configured across Regions, which is technically impossible.

How to eliminate wrong answers

Option B is wrong because Amazon Aurora Global Database uses a dedicated storage-based replication layer that can achieve sub-1-second RPO, but it is not compatible with Amazon RDS for MySQL; it requires Aurora MySQL. Option C is wrong because automated backups have a default RPO of 5 minutes (or up to 35 days of retention) and restoring in another Region typically takes 15 minutes or more, far exceeding the 1-minute RTO. Option D is wrong because Amazon RDS Multi-AZ with a standby in a different Region is not supported; Multi-AZ replicas must be in the same AWS Region, and cross-Region failover is not possible.

Full explanation →
1489
Multi-Selecthard

A company is migrating a multi-tier e-commerce application to AWS. The application consists of a web tier, an application tier, and a MySQL database tier. The company wants to improve scalability and availability while reducing administrative overhead. Which THREE actions should the solutions architect take? (Select THREE.)

Select 3 answers
A.Migrate the MySQL database to Amazon RDS Multi-AZ
B.Use Amazon ElastiCache to cache session data
C.Use Amazon EFS for shared storage between web instances
D.Configure an Application Load Balancer and Auto Scaling group for the web tier
E.Use Spot Instances for all EC2 instances to reduce costs
AnswersA, B, D

Correct: Reduces overhead and provides high availability.

Why this answer

Using an ALB and Auto Scaling for web tier improves scalability and availability. Migrating to RDS Multi-AZ reduces overhead and provides high availability. ElastiCache for session caching improves performance, but is not the only option for scalability.

EFS is for shared file storage, not needed. Using Spot Instances for all tiers may cause interruptions.

Full explanation →
1490
Multi-Selectmedium

A company is building a new application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which two AWS services or features meet these requirements?

Select 2 answers
A.Amazon Aurora DB cluster with multiple Availability Zones
B.Amazon RDS Multi-AZ deployment
C.Amazon RDS Single-AZ deployment with automated backups
D.Amazon DynamoDB with global tables
E.Amazon RDS Read Replica
AnswersA, B

Aurora automatically fails over to a replica in another AZ.

Why this answer

Amazon Aurora DB cluster with multiple Availability Zones meets the requirements because Aurora automatically replicates data across three Availability Zones by default, providing high availability and automatic failover with minimal downtime (typically under 30 seconds). Aurora's distributed storage layer allows the primary instance to fail over to a read replica in another AZ without data loss, making it ideal for applications requiring a relational database with multi-AZ high availability.

Exam trap

The trap here is that candidates may overlook the 'relational database' requirement and select DynamoDB (a NoSQL service) or assume that RDS Read Replica provides automatic failover, when in fact it requires manual promotion and does not meet the minimal downtime requirement.

Full explanation →
1491
MCQhard

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

A.Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present
B.Use AWS Config rules to remediate non-compliant objects
C.Require users to use pre-signed URLs for uploads
D.Attach an SCP that denies s3:PutObject without encryption
AnswerA

Bucket policies can enforce encryption at upload time.

Why this answer

An S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Exam trap

The trap here is that candidates often choose AWS Config (Option B) thinking it can enforce encryption, but Config is detective and reactive, not preventive, whereas a bucket policy with a deny condition is the only way to block unencrypted uploads at the API level.

How to eliminate wrong answers

Option B is wrong because AWS Config rules are reactive, not preventive; they can detect non-compliant objects after upload and trigger remediation (e.g., copying the object with encryption), but they do not block the initial unencrypted write, leaving a window where data is stored without encryption. Option C is wrong because pre-signed URLs control access duration and permissions but do not enforce encryption headers; a pre-signed URL for s3:PutObject can be used to upload unencrypted data unless the bucket policy explicitly denies such requests. Option D is wrong because Service Control Policies (SCPs) apply to all IAM principals in an AWS Organizations account but cannot enforce object-level encryption headers; SCPs can deny actions based on conditions, but the condition for encryption headers (e.g., s3:x-amz-server-side-encryption) is not supported in SCPs, making this option ineffective.

Full explanation →
1492
Multi-Selecthard

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Select 2 answers
A.Create an SCP that denies the ec2:RunInstances action for specific instance types.
B.Use AWS Config rules to detect non-compliant instance types and automatically terminate them using AWS Systems Manager Automation.
C.Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.
D.Use Service Quotas to restrict the number of instances of specific types.
E.Create an IAM policy in each account that denies the specified instance types.
AnswersA, B

SCPs can deny actions based on condition keys like ec2:InstanceType.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Exam trap

The trap here is that candidates often confuse detective controls (AWS Config, CloudTrail) with preventive controls (SCPs), or they assume IAM policies can be centrally managed across accounts, when in fact SCPs are the only native mechanism for organization-wide preventive restrictions.

Full explanation →
1493
MCQeasy

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

A.Use Amazon API Gateway with VPC Link
B.Use an Application Load Balancer with target groups per service
C.Use Amazon Route 53 with weighted routing policies
D.Use AWS App Mesh with Envoy sidecars
AnswerD

App Mesh provides traffic splitting and observability for canary deployments.

Why this answer

AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Exam trap

The trap here is that candidates often confuse DNS-based routing (Route 53) or load balancer-level routing (ALB) with the application-layer traffic management needed for canary deployments, overlooking that only a service mesh like App Mesh provides the granular, proxy-based control required for HTTP traffic splitting without operational overhead.

How to eliminate wrong answers

Option A is wrong because Amazon API Gateway with VPC Link is designed for external API management and routing to private VPC resources, not for internal service-to-service communication within a microservices architecture, and it adds unnecessary latency and complexity for internal calls. Option B is wrong because an Application Load Balancer with target groups per service can route traffic but does not natively support canary deployments with weighted traffic splitting across service versions; it requires external tooling or custom scripting for gradual rollouts. Option C is wrong because Amazon Route 53 with weighted routing policies operates at the DNS level, which cannot handle HTTP-level traffic routing, session affinity, or fine-grained canary percentages, and DNS caching can cause uneven traffic distribution during deployments.

Full explanation →
1494
MCQmedium

A company's AWS CloudTrail logs are stored in an S3 bucket. A Solutions Architect needs to analyze the logs to identify API calls that created or modified IAM roles in the last 30 days. What is the MOST efficient way to perform this analysis?

A.Use Amazon CloudWatch Logs Insights to query the logs.
B.Use Amazon Athena to run SQL queries on the logs.
C.Use an AWS Lambda function to process the logs and export to Amazon Redshift.
D.Use S3 Select to filter the records.
AnswerB

Athena can directly query CloudTrail logs in S3 using SQL, making it efficient for this analysis.

Why this answer

Amazon Athena enables running SQL queries directly on CloudTrail logs stored in S3 without the need to move or transform data. This is the most efficient method for analyzing historical CloudTrail data. Option A is incorrect because CloudWatch Logs Insights is designed for logs stored in CloudWatch Logs, not for S3-stored CloudTrail logs.

Option C is incorrect because using Lambda to export to Redshift adds unnecessary complexity and cost compared to querying in place with Athena. Option D is incorrect because S3 Select is limited to filtering data within a single object and does not support complex SQL queries across multiple log files.

Full explanation →
1495
MCQmedium

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

A.Disable cross-zone load balancing on the NLB.
B.Enable cookie-based stickiness on the NLB listener.
C.Switch to an Application Load Balancer and enable cookie-based stickiness.
D.Enable source IP stickiness on the NLB target group.
AnswerD

NLB target groups can be configured with source IP stickiness, which binds a client's session to a specific target instance based on the client's IP address.

Why this answer

Network Load Balancer (NLB) supports target group stickiness based on source IP address, which ensures that client requests are routed to the same EC2 instance, maintaining session persistence. This is the appropriate method for stateful applications. Option A is incorrect because disabling cross-zone load balancing does not provide stickiness; it only restricts traffic to instances in the same Availability Zone.

Option B is incorrect because NLB does not support cookie-based stickiness; that is a feature of Application Load Balancer. Option C is incorrect because while ALB does support cookie-based stickiness, switching to ALB is unnecessary; NLB already supports source IP stickiness.

Exam trap

Candidates often mistakenly believe that NLB cannot do stickiness or that they must switch to ALB for session persistence. However, NLB supports source IP-based stickiness, which is sufficient for this use case.

Full explanation →
1496
MCQmedium

A company uses AWS Organizations and has a member account that needs to access a shared S3 bucket in another member account. The bucket policy allows access from the account's root user. What is the simplest way to grant an IAM user in the member account access?

A.Create an IAM role in the source account and have the user assume it.
B.Update the bucket policy to allow the user's ARN directly.
C.Attach an IAM policy to the user that allows s3:GetObject on the bucket.
D.Use a bucket ACL to grant access to the user's canonical ID.
AnswerC

Since the bucket policy trusts the account, the user just needs IAM permissions.

Why this answer

The simplest way to grant an IAM user in a member account access to a shared S3 bucket in another member account is to attach an IAM policy to the user that allows the required S3 action (e.g., s3:GetObject) on the bucket. Since the bucket policy already allows access from the account's root user, the IAM user inherits permissions through the account's identity-based policies, and no cross-account role assumption or bucket policy update is needed.

Exam trap

The trap here is that candidates often overcomplicate cross-account access by assuming a role or modifying the bucket policy, when the simplest solution is to use an IAM policy on the user because the bucket policy already authorizes the account's root user.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in the source account and having the user assume it introduces unnecessary complexity; the bucket policy already allows the account's root user, so a simple IAM policy on the user suffices. Option B is wrong because updating the bucket policy to allow the user's ARN directly is not the simplest approach and would require modifying the bucket policy, which is more complex than attaching an IAM policy to the user. Option D is wrong because bucket ACLs are legacy and do not support granting access to IAM users directly; they only grant access to AWS accounts or canonical IDs, not individual IAM users.

Full explanation →
1497
MCQmedium

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

A.Yes, because the user can override the policy with s3:PutObjectAcl.
B.Yes, because the bucket has default encryption enabled.
C.No, because the user needs additional permissions.
D.No, because the policy denies the request.
AnswerD

The policy explicitly denies PutObject without AES256 encryption.

Why this answer

The IAM policy denies the s3:PutObject action when the encryption header is not present or does not match AES256. Since the user did not specify encryption, the condition is triggered, and the request is denied. Options A and B are incorrect because policy evaluation occurs before default encryption is applied and ACL permissions cannot override a deny.

Option C is incorrect because the user does not need additional permissions; the policy explicitly denies the request.

Full explanation →
1498
MCQmedium

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

A.Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.
B.Enable AWS Config in the management account and use an aggregator for all accounts.
C.Use an SCP to automatically enable the AWS Config rule in all accounts.
D.Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.
AnswerA

Correct. CloudFormation StackSets can deploy the Config rule to all accounts, and with automatic deployment, new accounts automatically receive it, offering the least operational overhead for this requirement.

Why this answer

AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule.

Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Exam trap

The trap here is that candidates may think SCPs can enforce configuration standards, but SCPs only control API actions and cannot create or enable resources like Config rules. The correct approach is to use a deployment mechanism such as CloudFormation StackSets to automatically deploy the rule across accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets require manual setup and ongoing maintenance to deploy to new accounts as they are added, which adds operational overhead compared to a policy-based approach. Option B is wrong because enabling AWS Config in the management account and using an aggregator only centralizes compliance data; it does not enforce the Config rule in new accounts automatically. Option C is wrong because SCPs cannot directly enable AWS Config rules; they can only deny or allow API actions, not create or configure AWS resources.

Full explanation →
1499
MCQhard

A company is migrating a large Hadoop cluster to Amazon EMR. The cluster uses HDFS for storage. The company wants to decouple compute and storage to reduce costs. Which approach should the company take?

A.Use Amazon S3 as the data store and EMRFS
B.Use Amazon FSx for Lustre
C.Use Amazon EFS for HDFS
D.Use EBS volumes for HDFS
AnswerA

Decouples storage, allows compute to be ephemeral.

Why this answer

The correct approach is Option A: Use Amazon S3 as the data store with EMRFS (EMR File System). This decouples compute and storage because Amazon EMR clusters can read/write data directly to S3, allowing the cluster to be terminated when not needed while data persists in S3. Option B (FSx for Lustre) is a high-performance file system but still ties compute to storage.

Option C (EFS) is not optimized for Hadoop workloads. Option D (EBS volumes) are attached to the EC2 instances, coupling compute and storage.

Full explanation →
1500
MCQmedium

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

A.Use AWS Config to detect and delete untagged VPCs.
B.Use IAM policies in each account to require tags.
C.Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.
D.Use AWS CloudFormation StackSets to deploy VPC templates with tags.
AnswerC

Prevents creation at the organization level.

Why this answer

AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.

Exam trap

The trap here is that candidates often confuse AWS Config's detective capabilities with preventive controls, or assume IAM policies in individual accounts can be centrally enforced, when only SCPs provide organization-wide preventive enforcement that cannot be bypassed by account-level administrators.

How to eliminate wrong answers

Option A is wrong because AWS Config can detect and report untagged VPCs, but it cannot prevent their creation; it only provides post-hoc compliance evaluation and can trigger remediation, not enforce the tag at creation time. Option B is wrong because IAM policies in each account can require tags, but they are managed per-account and cannot be enforced centrally across all accounts in the organization; a user with sufficient permissions in their own account could modify or remove the IAM policy. Option D is wrong because AWS CloudFormation StackSets can deploy VPC templates with tags, but they do not prevent users from creating VPCs outside of CloudFormation using the console, CLI, or SDK, so they do not enforce the tag requirement.

Full explanation →
Page 19

Page 20 of 23

Page 21

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →