Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1576–1650

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 22 of 23

1576

MCQmedium

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

A.Amazon Elastic Kubernetes Service (EKS)

B.Amazon EC2 with Auto Scaling

C.Amazon Elastic Container Service (ECS) with AWS Fargate

D.AWS Lambda

AnswerC

ECS with Fargate is serverless and reduces operational overhead for container orchestration.

Why this answer

Amazon ECS with AWS Fargate is the correct choice because it provides a fully managed container orchestration service that eliminates the need to provision, configure, or scale underlying EC2 instances. Fargate runs each container in its own isolated compute environment, allowing each microservice to scale independently based on demand while minimizing operational overhead for cluster management.

Exam trap

The trap here is that candidates often choose Amazon EKS assuming Kubernetes is the only modern orchestration tool, but the question specifically asks for minimal operational overhead, and Fargate's serverless model removes the need to manage any cluster infrastructure, which EKS does not fully eliminate even with managed node groups.

How to eliminate wrong answers

Option A is wrong because Amazon EKS requires you to manage the Kubernetes control plane (or pay for it) and typically involves managing worker nodes or using managed node groups, which adds operational overhead compared to Fargate's serverless model. Option B is wrong because Amazon EC2 with Auto Scaling requires you to manage the underlying instances, including patching, scaling policies, and container orchestration software, which contradicts the goal of minimizing operational overhead. Option D is wrong because AWS Lambda is designed for short-running, event-driven functions with a maximum execution timeout of 15 minutes and limited runtime environments, making it unsuitable for long-running microservices that require container-level isolation and persistent connections.

Full explanation →

1577

Multi-Selectmedium

A company is migrating a critical application to AWS and must ensure high availability across multiple Availability Zones. Which TWO AWS services can be used to distribute traffic across instances in multiple AZs?

Select 2 answers

A.Amazon CloudFront

B.AWS Global Accelerator

C.Application Load Balancer (ALB)

D.Amazon Route 53

E.Network Load Balancer (NLB)

AnswersC, E

ALB distributes traffic across targets in multiple AZs.

Why this answer

The correct answers are C (Application Load Balancer) and E (Network Load Balancer). Both ALB and NLB are regional load balancers that can distribute traffic across targets in multiple Availability Zones, providing high availability. CloudFront (A) is a global content delivery network, not a regional load balancer.

Route 53 (D) is a DNS service that can route traffic but does not perform load balancing across instances. Global Accelerator (B) uses edge locations and typically routes to a regional load balancer, but it is not itself a load balancer that distributes traffic across AZs.

Full explanation →

1578

Multi-Selecthard

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

Select 3 answers

A.Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.

B.Configure an S3 bucket notification event to send events to the Lambda function.

C.Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.

D.Create an event source mapping in Lambda for the S3 bucket.

E.Create an IAM role for the Lambda function with permissions to read from the S3 bucket.

AnswersA, B, E

A resource-based policy (function policy) allows S3 to invoke the Lambda function.

Why this answer

Lambda uses a resource-based policy (also known as a function policy) to grant other AWS services, such as S3, permission to invoke the function. Without this policy, S3 does not have the necessary invoke permissions, and the Lambda function will reject the invocation request.

Exam trap

The trap here is confusing event source mappings (used for polling-based triggers like SQS or DynamoDB Streams) with S3 event notifications, which are push-based and require only a resource-based policy and a bucket notification configuration.

Full explanation →

1579

MCQhard

A company has a web application behind an Application Load Balancer that uses sticky sessions. The application is deployed on EC2 instances in an Auto Scaling group. During a deployment, the team notices that users are experiencing errors after new instances are launched. What is the MOST likely cause?

A.The target group's deregistration delay is too short.

B.The stickiness duration is set too long, causing requests to be routed to terminated instances.

C.The Auto Scaling group's scale-in policy is terminating instances with active sessions.

D.The ALB health check is not configured for the new instances.

AnswerC

Stickiness ties sessions to instances; if an instance is terminated, users lose session data. The correct fix is to externalize session state.

Why this answer

The correct answer. The issue occurs during deployment when new instances are launched. With sticky sessions enabled, user sessions are tied to specific instances.

If the Auto Scaling group's scale-in policy terminates instances that have active sessions (e.g., during a rolling update or instance replacement), users lose their session data and experience errors. Option A is incorrect because the deregistration delay is about waiting for in-flight requests to complete, not about session stickiness. Option B is incorrect because if stickiness duration were too long, requests would still be routed to terminated instances, but the issue here is after new instances are launched (scale-out), not scale-in.

Option D is incorrect because health checks are configured and would pass for new healthy instances; the errors stem from missing session data on the new instances.

Full explanation →

1580

Multi-Selectmedium

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Select 2 answers

A.Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server

B.Attach the Auto Scaling group to an Application Load Balancer

C.Configure lifecycle hooks in the Auto Scaling group to drain connections

D.Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

E.Use a Network Load Balancer to distribute traffic to web servers

AnswersA, B

Auto Scaling group provides automatic scaling and high availability.

Why this answer

A launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Exam trap

The trap here is that candidates may confuse lifecycle hooks (Option C) as necessary for scaling or connection draining, when in fact the ALB handles connection draining automatically, and lifecycle hooks are an optional feature for custom workflows like patching or logging.

Full explanation →

1581

MCQmedium

A company attaches the above SCP to the root organizational unit. The development team in a member account wants to launch an EC2 instance in the ap-southeast-1 region. What will happen?

A.The EC2 instance launch will be denied only if there is an explicit allow for us-east-1 and eu-west-1.

B.The EC2 instance launch will succeed because SCPs only restrict permissions, not deny.

C.The EC2 instance launch will be denied because the SCP denies actions in regions not listed.

D.The EC2 instance launch will succeed if the developer has IAM permissions to launch in ap-southeast-1.

AnswerC

The SCP explicitly denies ec2:* in disallowed regions.

Why this answer

SCPs are evaluated using a deny-by-default model where any action not explicitly allowed is implicitly denied. The SCP in question denies all EC2 actions in any region not listed in the allow list (us-east-1 and eu-west-1). Since ap-southeast-1 is not in that list, the EC2 launch is denied regardless of any IAM permissions the developer may have.

Exam trap

The trap here is that candidates often assume SCPs only restrict permissions (like a boundary) and do not deny, or that IAM permissions can override SCPs, but in reality SCPs can explicitly deny actions and always take precedence over IAM allows.

How to eliminate wrong answers

Option A is wrong because SCPs do not require an explicit allow for the denied region to trigger denial; the SCP explicitly denies all regions not listed, so the launch is denied regardless of any allows elsewhere. Option B is wrong because SCPs can deny permissions; they are not limited to only restricting permissions—they explicitly deny actions when conditions are met. Option D is wrong because even if the developer has IAM permissions to launch in ap-southeast-1, the SCP at the root organizational unit overrides those permissions, resulting in a deny.

Full explanation →

1582

MCQeasy

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

A.Enable all AWS services in the management account to centrally manage them.

B.Use the management account as the payer account and also host production workloads.

C.Restrict access to the management account and use it only for organization management tasks.

D.Use the management account for development environments to avoid creating additional accounts.

AnswerC

This minimizes the attack surface.

Why this answer

The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.

Exam trap

The trap here is that candidates often confuse the management account's billing role with a permission to host workloads, or they assume that central management requires enabling all services in the management account, when in fact the management account should be kept as a lightweight, resource-free administrative container.

How to eliminate wrong answers

Option A is wrong because enabling all AWS services in the management account for central management is unnecessary and insecure; instead, services should be enabled only in the member accounts where they are needed, and the management account should not host resources. Option B is wrong because while the management account is the payer account, hosting production workloads in it violates the best practice of isolating the management account from workloads, increasing the attack surface and risk of privilege escalation. Option D is wrong because using the management account for development environments defeats the purpose of a multi-account strategy, which is to isolate environments for security and cost tracking; development workloads should be placed in dedicated member accounts.

Full explanation →

1583

MCQhard

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

A.The Lambda function does not have permission to create log groups.

B.The Lambda function is not in the same VPC as DynamoDB.

C.The DynamoDB table 'Orders' does not exist.

D.The IAM role lacks a trust policy that allows Lambda to assume it.

AnswerD

The exhibit shows only permission policies; the trust policy is missing.

Why this answer

The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Exam trap

The trap here is that candidates often focus on the permissions policy (e.g., DynamoDB actions) and overlook the trust policy, assuming any IAM role can be used by Lambda, but AWS requires an explicit trust relationship for service-to-service role assumption.

How to eliminate wrong answers

Option A is wrong because Lambda automatically creates log groups via the AWSLambdaBasicExecutionRole managed policy if the function has logs:CreateLogGroup permission; a missing log group permission would cause a different error (e.g., 'Unable to write to CloudWatch Logs'), not an AccessDeniedException on DynamoDB writes. Option B is wrong because Lambda functions do not need to be in the same VPC as DynamoDB; DynamoDB is a fully managed service accessible over the public internet or via VPC endpoints, and VPC placement does not affect IAM authorization. Option C is wrong because if the table 'Orders' did not exist, the error would be a ResourceNotFoundException, not an AccessDeniedException.

Full explanation →

1584

MCQeasy

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

A.Increase the reserved concurrency of the Lambda function.

B.Increase the batch size in the SQS event source mapping.

C.Use a Lambda function URL instead of SQS invocation.

D.Increase the memory (and CPU) allocation for the Lambda function.

E.Migrate the Lambda function to run on Amazon ECS with Fargate using a larger task size.

AnswerD

Lambda allocates CPU proportionally to memory, so more memory speeds up CPU-bound tasks.

Why this answer

Increasing the Lambda function's memory also increases CPU allocation proportionally, which directly speeds up CPU-bound processing and reduces the chance of timeout during peak hours. Option A is wrong because increasing reserved concurrency only allows more parallel invocations, but does not improve per-invocation performance; it could actually increase load on the same slow function. Option B is wrong because increasing the batch size makes each invocation process more messages, which would further increase processing time and worsen timeouts.

Option C is wrong because using a Lambda function URL changes the invocation source but does not affect CPU allocation or timeout behavior. Option E is wrong because migrating to ECS with Fargate is more complex and not the simplest solution; increasing Lambda memory is a simpler and effective change.

Full explanation →

1585

MCQeasy

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data integrity. Which AWS service should they use for the migration?

A.AWS Schema Conversion Tool (SCT)

B.AWS Database Migration Service (DMS)

C.AWS DataSync

D.AWS Snowball Edge

AnswerB

DMS supports ongoing replication to minimize downtime.

Why this answer

AWS Database Migration Service (DMS) supports homogeneous and heterogeneous migrations with minimal downtime. Option A is wrong because SCT only helps with schema conversion, not the actual data migration. Option C is wrong because DataSync is for file storage, not databases.

Option D is wrong because Snowball Edge is for large-scale offline data transfer, not online database migration.

Full explanation →

1586

MCQeasy

A company has a multi-account AWS environment with a centralized network account that hosts a transit gateway. The company wants to share the transit gateway with multiple member accounts. Which AWS service should be used to share the transit gateway?

A.AWS Resource Access Manager (RAM)

B.AWS PrivateLink

C.VPC peering connection

D.AWS Direct Connect

AnswerA

RAM enables sharing of transit gateways across accounts.

Why this answer

AWS Resource Access Manager (RAM) enables you to share a transit gateway owned by a central network account with other AWS accounts in your organization. This eliminates the need to create separate transit gateway attachments or VPC peering connections, simplifying network architecture and reducing operational overhead.

Exam trap

The trap here is that candidates often confuse VPC peering (which is point-to-point and non-transitive) with transit gateway sharing via RAM, which provides transitive routing and centralized management across multiple accounts.

How to eliminate wrong answers

Option B is wrong because AWS PrivateLink is used to expose services privately within a VPC via interface endpoints, not for sharing transit gateways across accounts. Option C is wrong because VPC peering connects individual VPCs directly but does not provide a centralized hub-and-spoke model or support transitive routing between multiple VPCs and accounts. Option D is wrong because AWS Direct Connect establishes dedicated network connections from on-premises to AWS, not for sharing transit gateways between accounts.

Full explanation →

1587

MCQeasy

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

A.Use a service control policy to allow access from other accounts

B.Create IAM users in the development account for each developer

C.Share the access keys of an IAM user in the development account

D.Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it

AnswerD

This follows AWS best practices for cross-account access.

Why this answer

It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.

Exam trap

The trap here is that candidates often confuse service control policies (SCPs) with IAM policies, thinking SCPs can grant cross-account access, but SCPs only act as a guardrail and cannot allow access that isn't already explicitly granted by IAM policies.

How to eliminate wrong answers

Option A is wrong because service control policies (SCPs) are used to set permission boundaries across accounts in an AWS Organizations hierarchy; they cannot grant access or allow cross-account access—they only deny or allow permissions within the organization. Option B is wrong because creating IAM users in the development account for each developer from other accounts violates the principle of least privilege and requires managing separate credentials, which is insecure and not scalable for cross-account access. Option C is wrong because sharing access keys of an IAM user exposes long-term credentials, which increases the risk of credential leakage and violates AWS security best practices for cross-account access.

Full explanation →

1588

MCQeasy

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

A.Use Cost Explorer to filter by linked account, which automatically groups by business unit.

B.Use AWS Budgets to create budgets per account and manually aggregate.

C.Apply tags to resources and enable cost allocation tags in Billing and Cost Management.

D.Create a separate payer account for each business unit.

AnswerC

Correct: Tagging enables filtering by business unit.

Why this answer

Applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Exam trap

The trap here is that candidates may think filtering by linked account in Cost Explorer is sufficient, but they overlook that without tags or a structured account naming convention, linking accounts to business units requires manual effort, which violates the 'without additional overhead' requirement.

How to eliminate wrong answers

Option A is wrong because Cost Explorer can filter by linked account, but it does not automatically group by business unit unless accounts are tagged or organized in a way that maps to business units; filtering by linked account alone requires manual mapping of account IDs to business units, which adds overhead. Option B is wrong because AWS Budgets is a budgeting tool, not a cost reporting and aggregation tool; manually aggregating budgets per account introduces significant overhead and does not provide a scalable, automated solution for generating cost reports filtered by business unit. Option D is wrong because creating a separate payer account for each business unit defeats the purpose of consolidated billing and increases management complexity, as AWS Organizations is designed to consolidate multiple accounts under a single payer for centralized billing and cost management.

Full explanation →

1589

MCQmedium

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

A.Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.

B.Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

C.Use AWS Cost Explorer to report on untagged resources.

D.Create an IAM policy that requires tagging for all actions and attach it to all users.

AnswerA

SCPs prevent creation of untagged resources; Config identifies existing untagged resources.

Why this answer

It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Exam trap

The trap here is that candidates may confuse AWS Config's ability to detect non-compliance with the ability to automatically remediate (e.g., apply tags), or assume that Cost Explorer can enforce tagging, when in fact it only reports on existing tags.

How to eliminate wrong answers

Option B is wrong because AWS Config rules can detect untagged resources but cannot automatically tag them; they only evaluate compliance and can trigger remediation actions (e.g., via Systems Manager Automation), but the statement 'automatically tag them' is misleading as Config itself does not apply tags. Option C is wrong because AWS Cost Explorer is a cost visualization and analysis tool that can filter by tags but cannot enforce tagging on new resources or identify untagged resources in a proactive manner; it only reports on costs associated with tagged resources. Option D is wrong because IAM policies that require tagging for all actions would apply to API calls made by users, but they cannot enforce tagging on resources created by services (e.g., Auto Scaling, CloudFormation) that may not pass the tag condition, and such a policy would be overly restrictive, potentially blocking legitimate operations that do not support tagging.

Full explanation →

1590

Multi-Selecthard

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Select 3 answers

A.Launch the database instance in a public subnet.

B.Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.

C.Store database credentials in AWS Systems Manager Parameter Store.

D.Launch the web tier instances in a private subnet.

E.Set the 'Publicly accessible' option of the RDS instance to 'No'.

AnswersB, D, E

Security group rules restrict traffic to only the web tier.

Why this answer

The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.

Exam trap

The trap here is that candidates may confuse security best practices (like using Parameter Store for credentials) with network-level access controls, leading them to select Option C instead of recognizing that only security group rules and subnet placement directly control connectivity and internet exposure.

Full explanation →

1591

MCQhard

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

A.Define an IAM task role with S3 access policies and reference it in the ECS task definition.

B.Attach an IAM role to the underlying EC2 instance.

C.Assign an IAM role to the ECS service using the ECS service-linked role.

D.Store AWS credentials in the container environment variables.

AnswerA

The task role grants permissions to the container application.

Why this answer

An IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Exam trap

The trap here is that candidates may confuse the ECS service-linked role (used for ECS service management) with the IAM task role (used for granting permissions to the containerized application), or incorrectly assume that Fargate tasks require an underlying EC2 instance role.

How to eliminate wrong answers

Option B is wrong because Fargate does not use underlying EC2 instances; the infrastructure is fully managed by AWS, so attaching an IAM role to an EC2 instance is irrelevant and violates the principle of least privilege by granting permissions to all tasks on that instance. Option C is wrong because the ECS service-linked role (AWSServiceRoleForECS) is used by the ECS service itself to manage resources, not by the containers to access S3; assigning it to the service does not grant permissions to the application code. Option D is wrong because storing AWS credentials in container environment variables is insecure, violates the principle of least privilege, and is unnecessary when IAM task roles provide automatic credential rotation via the AWS STS endpoint.

Full explanation →

1592

MCQmedium

A company is running a stateful web application on Amazon EC2 instances in an Auto Scaling group. The instances store session data in an Amazon ElastiCache for Redis cluster. The company wants to improve the application's fault tolerance and ensure that session data is not lost if an Availability Zone fails. What should the solutions architect do?

A.Enable Cluster Mode on the ElastiCache for Redis cluster and configure Multi-AZ.

B.Configure the ElastiCache for Redis cluster to have multiple read replicas in the same region.

C.Increase the instance size of the EC2 instances to handle more load.

D.Migrate from ElastiCache for Redis to ElastiCache for Memcached.

AnswerA

Cluster Mode with Multi-AZ provides replication and automatic failover across AZs, protecting against AZ failure.

Why this answer

Enabling Cluster Mode on the ElastiCache for Redis cluster and configuring Multi-AZ provides automatic sharding and replication across Availability Zones. This ensures that session data is not lost if an AZ fails, as replicas in other AZs can take over. Option B is incorrect because read replicas alone do not provide automatic failover or data durability across AZ failures unless Multi-AZ is enabled.

Option C is incorrect because increasing instance size does not protect against AZ failure. Option D is incorrect because ElastiCache for Memcached does not support persistence or replication, so data would be lost on node failure.

Full explanation →

1593

Multi-Selecthard

A company is modernizing a monolithic application into microservices on AWS. The application currently uses a single SQL database. Which THREE AWS services can help decouple the data layer and enable event-driven communication between microservices?

Select 3 answers

A.Amazon Simple Notification Service (SNS)

B.Amazon RDS

C.Amazon Simple Queue Service (SQS)

D.Amazon ElastiCache

E.Amazon EventBridge

AnswersA, C, E

Decouples via pub/sub.

Why this answer

Amazon SQS provides message queuing for async communication. Amazon SNS enables pub/sub messaging. Amazon EventBridge provides event bus for decoupled communication.

Amazon RDS is a relational database, not for decoupling. Amazon ElastiCache is caching.

Full explanation →

1594

Multi-Selecthard

A company is migrating a legacy application to AWS and needs to decouple the application components. The application currently uses a monolithic architecture with direct calls between components. Which AWS services can help decouple the components? (Choose THREE.)

Select 3 answers

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.AWS Step Functions

D.Amazon Kinesis Data Streams

E.Amazon EventBridge

AnswersA, B, E

SQS provides message queues for asynchronous communication.

Why this answer

Amazon SQS (Option A), Amazon SNS (Option B), and Amazon EventBridge (Option E) are correct because they all enable asynchronous messaging and event-driven decoupling between application components. SQS provides message queues for decoupling producers and consumers, SNS supports pub/sub messaging, and EventBridge routes events from various sources. AWS Step Functions (Option C) is designed for orchestrating workflows, not primarily for decoupling.

Amazon Kinesis Data Streams (Option D) is used for real-time streaming analytics, not general decoupling.

Full explanation →

1595

MCQhard

A company is migrating its on-premises Oracle database to Amazon Aurora PostgreSQL using AWS DMS. The database has several large tables with hundreds of millions of rows. The migration must complete within a 2-hour downtime window. During the full load, DMS is running slowly on large tables. What should the company do to improve performance?

A.Disable foreign key constraints on the target during migration.

B.Use a smaller DMS instance to avoid network bottlenecks.

C.Set the LOB mode to 'Limited LOB mode' with a high max LOB size.

D.Partition the large tables on the source and target, and use multiple DMS tasks.

AnswerD

Partitioning large tables enables parallel loading with multiple DMS tasks, which is the most effective way to speed up the full load within a tight downtime window.

Why this answer

Partitioning the large tables on both source and target allows AWS DMS to load multiple partitions in parallel using separate tasks, significantly improving throughput. Option A is incorrect because disabling foreign key constraints can cause data integrity issues and is not recommended for performance. Option B is incorrect because using a larger DMS instance would help, not a smaller one.

Option C is incorrect because while LOB mode settings matter, they are not the primary bottleneck for full load of large tables; the key is parallelism via partitioning.

Full explanation →

1596

MCQeasy

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

A.AWS Elastic Beanstalk

B.AWS CloudFormation

C.AWS CodeDeploy

D.AWS OpsWorks

AnswerB

CloudFormation provisions infrastructure as code, including network, EC2, and ALB.

Why this answer

AWS CloudFormation. AWS CloudFormation allows infrastructure as code to provision all required resources, including the network, security groups, EC2 instances, and an Application Load Balancer. Option A (AWS Elastic Beanstalk) abstracts the underlying infrastructure and does not provide granular control.

Option C (AWS CodeDeploy) is used for deploying application code, not infrastructure. Option D (AWS OpsWorks) is a configuration management service, not an infrastructure provisioning tool.

Full explanation →

1597

MCQmedium

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

A.Use Amazon S3 with server-side encryption and enforce HTTPS.

B.Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.

C.Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.

D.Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.

AnswerD

EBS encryption provides at-rest encryption; TLS provides in-transit encryption.

Why this answer

It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.

Exam trap

The trap here is that candidates often pick options that address only one requirement (e.g., only encryption at rest or only encryption in transit) or confuse storage services (S3) with compute services (EC2), failing to realize both encryption states must be covered for the EC2-based application.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is a storage service, not the compute platform (EC2) where the application runs; using S3 with server-side encryption and HTTPS does not encrypt data at rest on EC2 EBS volumes or in transit to/from the application. Option B is wrong because enabling encryption on EBS volumes only covers data at rest, but does not address encryption in transit for network traffic. Option C is wrong because ACM-issued TLS certificates and HTTPS only encrypt data in transit, leaving data at rest on EC2 EBS volumes unencrypted.

Full explanation →

1598

MCQmedium

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

A.Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.

B.Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.

C.Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.

D.Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.

AnswerA

Correct. ECS Service Connect provides DNS-based service discovery and automatic encryption via TLS, meeting both requirements.

Why this answer

ECS Service Connect provides built-in DNS-based service discovery and automatic encryption via TLS for inter-service communication. Option B uses AWS Cloud Map for service discovery but does not enforce encryption in transit. Option C uses a Network Load Balancer (NLB) in front of each service, which adds unnecessary complexity and cost without addressing service discovery.

Option D uses an Application Load Balancer (ALB) in front of each service, which is also overly complex and costly for simple inter-service communication.

Full explanation →

1599

Multi-Selecthard

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage and a deploy stage. The company wants to add a test stage that runs automated integration tests after the build stage and before the deploy stage. Which THREE actions should the company take? (Choose three.)

Select 3 answers

A.Configure AWS CodeBuild to run the integration tests as part of the test stage.

B.Use AWS CloudFormation to create a test environment.

C.Add a test stage in the CodePipeline between build and deploy.

D.Use an AWS Lambda function to run the integration tests.

E.Set up a manual approval step after the test stage.

AnswersA, C, E

CodeBuild can run test scripts.

Why this answer

Options A, C, and E are correct. Option A: AWS CodeBuild is well-suited for running integration tests as part of a CodePipeline test stage. Option C: Adding a test stage between build and deploy is the correct way to insert testing into the pipeline.

Option E: A manual approval step after the test stage provides a safety checkpoint before deployment. Option B is incorrect because CloudFormation is used for infrastructure provisioning, not for running tests. Option D is incorrect because Lambda functions are not designed for running integration tests directly; they are better for lightweight event-driven tasks.

Full explanation →

1600

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AWS KMS keys managed by the security team. What is the MOST scalable and maintainable solution?

A.Apply a service control policy (SCP) at the root OU that denies s3:PutBucketAcl or s3:PutBucketPolicy actions unless encryption is configured.

B.Use AWS Trusted Advisor to check for unencrypted buckets and notify the security team.

C.Use AWS Config rules in each account to detect non-compliant buckets and trigger auto-remediation.

D.Create a CloudFormation StackSet that deploys an S3 bucket policy in every account.

AnswerC

Correct. AWS Config rules can be deployed across all accounts using StackSets, detect non-compliant buckets, and trigger auto-remediation to apply encryption, providing scalable and maintainable enforcement.

Why this answer

Using AWS Config rules deployed via StackSets across all accounts in the organization provides a scalable and maintainable way to detect non-compliant buckets (e.g., those without SSE-KMS encryption) and trigger auto-remediation to enforce encryption. This approach is proactive and centralized, while still being scalable via AWS Organizations. Option A is incorrect because the SCP actions mentioned (s3:PutBucketAcl and s3:PutBucketPolicy) do not control encryption settings.

Option B is only detective and does not enforce compliance. Option D does not address encryption enforcement.

Exam trap

The trap is that candidates may think an SCP is the only scalable solution, but in this case the SCP described uses the wrong actions. Option C with AWS Config and auto-remediation is a valid and scalable enforcement mechanism.

How to eliminate wrong answers

Option B is wrong because Trusted Advisor only provides reactive checks and notifications; it does not enforce encryption or prevent non-compliant buckets from being created. Option C is wrong because AWS Config rules must be deployed in each account individually (or via delegation), and auto-remediation can be complex to maintain across many accounts; it is less scalable and centralized than an SCP. Option D is wrong because a CloudFormation StackSet deploys a bucket policy in each account, but bucket policies cannot enforce encryption on the bucket itself (they control access), and they can be overridden by the account owner; this does not prevent creation of unencrypted buckets.

Full explanation →

1601

Multi-Selectmedium

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Select 2 answers

A.Enable AWS CloudTrail Insights to detect unusual activity.

B.Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.

C.Use IAM roles with a permissions boundary that restricts CloudTrail actions.

D.Add an S3 bucket policy on the CloudTrail log bucket that denies s3:DeleteObject for all principals in the 'Production' OU.

AnswersB, D

SCP prevents the actions at the account level.

Why this answer

Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Exam trap

The trap here is that candidates often think IAM permissions boundaries or CloudTrail Insights can enforce preventive controls, but only SCPs and resource-based policies (like S3 bucket policies) can deny actions across all users and roles in an account at the organizational level.

Full explanation →

1602

MCQmedium

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

A.Use Amazon QuickSight to connect to each account's AWS Cost and Usage Report and AWS Config data.

B.Use AWS Control Tower to set up a landing zone and use the built-in dashboard for operational data.

C.Use AWS Config aggregator to collect resource configurations from all accounts.

D.Use AWS Organizations to create a central management account and use AWS Systems Manager Explorer to aggregate operational data.

AnswerD

Systems Manager Explorer provides a single dashboard for operational data.

Why this answer

AWS Systems Manager Explorer, when used with AWS Organizations, provides a single-pane-of-glass dashboard that aggregates operational data (e.g., cost reports, security findings, resource inventory) across multiple accounts. The central management account in Organizations enables Explorer to collect and display data from all member accounts without requiring individual connections or manual aggregation.

Exam trap

The trap here is that candidates often confuse AWS Config aggregator (which only handles resource configurations) with a full operational data aggregator, or assume QuickSight can natively aggregate multi-account operational data without custom integration, leading them to overlook Systems Manager Explorer's purpose-built multi-account dashboard capabilities.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a business intelligence service for visualizing data, not a native aggregator for operational data; connecting to each account's Cost and Usage Report and Config data would require complex, custom pipelines and does not provide a built-in single pane of glass for operations. Option B is wrong because AWS Control Tower's built-in dashboard focuses on governance and compliance (e.g., guardrails, account factory status), not on aggregating operational data like cost reports, security findings, and resource inventory across accounts. Option C is wrong because AWS Config aggregator only collects resource configurations and compliance history, not cost reports or security findings, so it fails to meet the requirement for a comprehensive operational data view.

Full explanation →

1603

Multi-Selecteasy

Which TWO AWS services can be used to migrate on-premises applications to AWS without modifying the application code?

Select 2 answers

A.AWS DataSync

B.AWS VM Import/Export

C.AWS Application Migration Service (MGN)

D.AWS Database Migration Service (DMS)

E.AWS App2Container

AnswersB, C

Imports VMs as-is.

Why this answer

AWS VM Import/Export allows importing VM images as EC2 instances, preserving the OS and applications. AWS MGN automates lift-and-shift replication. AWS DMS requires some changes for database migration.

AWS DataSync is for data transfer. AWS App2Container requires containerization.

Full explanation →

1604

Multi-Selectmedium

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Select 2 answers

A.Configure RDS Multi-AZ in the primary region.

B.Deploy an Amazon Aurora Global Database with a secondary region.

C.Pre-warm a standby EC2 instance in the DR region.

D.Take hourly snapshots of RDS and copy them to the DR region.

E.Use Amazon S3 Cross-Region Replication for application data.

AnswersA, B

Multi-AZ provides automatic failover with low RTO.

Why this answer

RDS Multi-AZ provides automatic failover to a standby in a different Availability Zone within the same region, achieving an RTO typically under 1-2 minutes and an RPO of zero (synchronous replication). This meets the 15-minute RTO and 1-minute RPO for intra-region failures, but it does not address cross-region DR. Option B is correct because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of 1 second or less and can promote a secondary region in under 1 minute, satisfying both the 15-minute RTO and 1-minute RPO for a full regional disaster.

Exam trap

The trap here is that candidates often assume Multi-AZ alone is sufficient for cross-region DR, but Multi-AZ only protects against AZ failures within the same region, not a regional disaster, so a cross-region solution like Aurora Global Database is required to meet the RTO and RPO for a full region outage.

Full explanation →

1605

MCQmedium

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

A.Auto Scaling

B.DynamoDB Accelerator (DAX)

C.DynamoDB Streams

D.Global Tables

AnswerD

Global Tables provides fully managed, multi-region, multi-active replication, enabling low-latency reads and writes across multiple regions.

Why this answer

DynamoDB Global Tables provide a fully managed, multi-region, multi-active database for low-latency reads and writes globally. Option A (Auto Scaling) adjusts throughput but doesn't enable multi-region replication. Option B (DAX) is an in-memory cache that improves read latency but doesn't handle writes or multi-region.

Option C (Streams) captures item-level changes but requires additional setup for cross-region replication. Option D (Global Tables) is the correct feature for active-active multi-region workloads.

Full explanation →

1606

Multi-Selecteasy

A company wants to implement a centralized logging solution for multiple AWS accounts. Which TWO services should be used together?

Select 2 answers

A.Amazon S3

B.AWS CloudTrail

C.Amazon RDS

D.Amazon Athena

E.AWS Config

AnswersA, D

S3 is a durable and cost-effective storage for logs.

Why this answer

Amazon S3 serves as a central log repository, and Amazon Athena allows querying logs directly in S3.

Full explanation →

1607

MCQeasy

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally capture all VPC flow logs for analysis in Amazon Athena. What is the MOST cost-effective way to store the flow logs?

A.Publish VPC Flow Logs to an Amazon S3 bucket with S3 Intelligent-Tiering enabled.

B.Publish VPC Flow Logs to both CloudWatch Logs and S3 for redundancy.

C.Use Amazon Kinesis Data Firehose to stream flow logs to an S3 bucket.

D.Publish VPC Flow Logs to Amazon CloudWatch Logs and export them to S3 after 30 days.

AnswerA

S3 is cost-effective for log storage, and Intelligent-Tiering automatically moves data to lower-cost tiers.

Why this answer

VPC Flow Logs can be published directly to S3, and using S3 Intelligent-Tiering optimizes costs for logs that may be accessed infrequently. Option B is wrong because CloudWatch Logs is more expensive for long-term storage. Option C is wrong because Kinesis Data Firehose adds cost and complexity.

Option D is wrong because it duplicates storage.

Full explanation →

1608

MCQeasy

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

A.AWS Config rules with auto-remediation

B.AWS Service Catalog with a portfolio of approved AMIs

C.AWS Identity and Access Management (IAM) policies in each account

D.AWS Organizations Service Control Policies (SCPs)

AnswerD

Correct: SCPs can centrally restrict actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking that IAM policies in each account can centrally enforce controls, but SCPs are the only mechanism that applies across all accounts in an organization without requiring per-account management.

How to eliminate wrong answers

Option A is wrong because AWS Config rules with auto-remediation are detective and reactive—they can detect non-compliant resources and trigger remediation actions, but they cannot proactively prevent developers from launching EC2 instances in unapproved Regions or with unapproved AMIs at the time of the API call. Option B is wrong because AWS Service Catalog allows you to create a portfolio of approved AMIs that developers can launch, but it does not enforce controls across all accounts; developers could still bypass Service Catalog and launch EC2 directly via the console or CLI if not restricted by other policies. Option C is wrong because IAM policies in each account would require manual duplication and management across every account, leading to inconsistency and administrative overhead, and they cannot be enforced from a central point like SCPs can.

Full explanation →

1609

MCQeasy

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

A.Deploy EC2 instances in multiple AWS Regions and use Route 53 latency-based routing.

B.Use AWS Global Accelerator to route traffic to the EC2 instances via the AWS global network.

C.Move the dynamic content to Lambda@Edge functions running at CloudFront edge locations.

D.Add an Amazon ElastiCache cluster in front of the EC2 instances to cache dynamic responses.

AnswerB

Global Accelerator uses the AWS network to route traffic from edge locations to the nearest healthy endpoint, reducing latency and jitter.

Why this answer

AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal EC2 endpoint, reducing latency and jitter for distant users without requiring multi-region deployments. This minimizes operational effort because it involves only a single configuration change (creating an accelerator and associating it with the existing EC2 instances) rather than managing infrastructure across multiple regions.

Exam trap

The trap here is that candidates often assume Lambda@Edge can handle all dynamic content at the edge, but they overlook its execution time and resource constraints, making it unsuitable for complex backend logic or database queries.

How to eliminate wrong answers

Option A is wrong because deploying EC2 instances in multiple AWS Regions and using Route 53 latency-based routing requires significant operational overhead for managing, patching, and synchronizing infrastructure across regions, which contradicts the 'least operational effort' requirement. Option C is wrong because Lambda@Edge functions are designed for lightweight compute at edge locations (e.g., header manipulation, authentication) and are not suitable for serving full dynamic content from a backend, as they have execution time limits (5 seconds for viewer events) and cannot maintain persistent connections to databases. Option D is wrong because adding an ElastiCache cluster in front of EC2 instances only caches dynamic responses for repeated requests within a single region, but does not reduce network latency for users in distant regions who still traverse the public internet to reach the origin region.

Full explanation →

1610

MCQeasy

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

A.Use a NAT gateway to route traffic from ECS tasks to RDS.

B.Attach an internet gateway to the VPC and route through it.

C.Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.

D.Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.

AnswerD

This ensures traffic stays within the VPC.

Why this answer

Placing ECS tasks and RDS in the same VPC allows private communication via security groups. This ensures the database is not publicly accessible. Option A is incorrect because a NAT gateway is for outbound internet access, not for inbound traffic to RDS.

Option B is incorrect because an internet gateway would expose the RDS instance to the internet. Option C is incorrect because enabling public accessibility would violate the security mandate even with IP restrictions.

Full explanation →

1611

Multi-Selecthard

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

Select 1 answer

A.Use Amazon RDS Multi-AZ deployment in the primary Region with a standby in another Region.

B.Take manual snapshots of the RDS instance every hour and copy them to another Region.

C.Use Amazon Aurora Global Database with a primary in one Region and a secondary in another Region.

D.Use AWS Database Migration Service (DMS) for continuous replication to another Region.

E.Configure cross-Region read replicas for RDS MySQL.

AnswersC

Correct. Amazon Aurora Global Database provides synchronous cross-Region replication and automatic failover, achieving an RPO of 1 second and RTO of 1 minute. This requires migrating from RDS MySQL to Aurora but is a valid strategy.

Why this answer

Amazon RDS Multi-AZ does not support cross-Region standby; it only provides high availability within a single region. Option C is correct: Amazon Aurora Global Database offers synchronous cross-Region replication with automatic failover, typically achieving an RPO of less than 1 second and RTO of 1 minute, although it requires migrating from RDS MySQL to Aurora. Option D is incorrect: AWS DMS with continuous change data capture (CDC) uses asynchronous replication, which cannot guarantee a 1-second RPO.

Option B is incorrect because manual snapshots every hour cannot achieve an RPO of 1 second. Option E is incorrect because cross-Region read replicas use asynchronous replication, so RPO is not guaranteed to be 1 second, and manual promotion takes longer than 1 minute.

Exam trap

The trap here is that cross-Region read replicas are often mistaken for a valid DR solution, but their manual promotion process prevents meeting a 1-minute RTO.

Full explanation →

1612

MCQhard

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

A.The member account must create an IAM role to assume for launching resources in the shared subnet.

B.The member account must create a VPC and then associate the shared subnet.

C.The member account must accept the resource share invitation.

D.Nothing, shared subnets are automatically available to all accounts in the organization.

AnswerD

Within an organization, resource shares are automatically accepted.

Why this answer

When AWS Organizations is configured with all features enabled and sharing is enabled within the organization, Resource Access Manager (RAM) automatically shares resources with all accounts in the organization without requiring individual acceptance. Therefore, shared subnets are immediately available to member accounts for launching resources, and no additional action is needed in the member accounts.

Exam trap

The trap here is that candidates often assume a manual acceptance step is always required for RAM shares, but within an organization with enabled sharing, the process is automatic and no invitation or acceptance is needed.

How to eliminate wrong answers

Option A is wrong because member accounts do not need to create an IAM role to assume; they can directly launch resources into the shared subnet using their existing IAM permissions, provided they have the necessary ec2:RunInstances and subnet-related permissions. Option B is wrong because the shared subnet is already part of a centrally managed VPC; member accounts do not need to create their own VPC or associate the subnet—they simply use the shared subnet ID when launching resources. Option C is wrong because when sharing is enabled within an AWS Organization, resource shares are automatically available to all member accounts without requiring an invitation or acceptance; the acceptance step is only needed for accounts outside the organization.

Full explanation →

1613

MCQhard

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

A.Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

B.Apply an SCP that allows EC2 actions only in the allowed Regions.

C.Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

D.Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

AnswerB

SCPs deny actions by default, so you must explicitly allow only the desired Regions.

Why this answer

Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking a deny SCP (Option D) is equivalent to an allow SCP, but AWS evaluates SCPs as allow lists by default, making an explicit allow for specific Regions the correct and simpler approach to enforce Region restrictions without unintended side effects.

How to eliminate wrong answers

Option A is wrong because IAM permissions boundaries restrict the maximum permissions a role can have, but they are applied per role and do not prevent developers from creating new roles without the boundary, nor do they enforce Region restrictions across all accounts centrally. Option C is wrong because AWS Config rules are detective, not preventive; they can trigger remediation (e.g., termination) but cannot block the initial launch, leaving a window of unauthorized usage and potential cost. Option D is wrong because a deny SCP for disallowed Regions is less precise than an allow list; it could inadvertently block EC2 actions in allowed Regions if the SCP logic is not carefully crafted, and it does not align with the principle of explicit allow for restricted services.

Full explanation →

1614

Multi-Selecteasy

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

Select 2 answers

A.Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.

B.Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.

C.Create a conformance pack in the management account and deploy it to the organization.

D.Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.

E.Enable AWS Config in every account of the organization.

AnswersC, E

Correct. A conformance pack deployed to the organization from the management account applies AWS Config rules to all existing and new accounts.

Why this answer

To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources.

Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.

Exam trap

A common trap is confusing conformance packs with individual AWS Config rules. Conformance packs can be deployed organization-wide, but a single rule in the management account does not propagate to all accounts.

Full explanation →

1615

MCQmedium

A company is migrating a large-scale batch processing system from on-premises to AWS. The system runs millions of short-lived jobs each day. The company wants to minimize operational overhead and cost. Which AWS compute service should the company use?

A.Amazon EC2 with Spot Fleet

B.Amazon ECS with AWS Fargate

C.AWS Lambda

D.AWS Batch

AnswerD

AWS Batch manages job scheduling, compute provisioning, and can leverage Spot Instances.

Why this answer

AWS Batch is specifically designed for batch computing workloads, handling millions of short-lived jobs efficiently by automatically provisioning compute resources and scaling based on job demand. It integrates with Spot Instances to reduce costs. Option A is wrong because EC2 with Spot Fleet requires manual management of instances and scaling, increasing operational overhead.

Option B is wrong because ECS with Fargate is optimized for containerized applications, but AWS Batch provides more specialized features for batch job scheduling and cost optimization. Option C is wrong because Lambda has a maximum execution timeout of 15 minutes and is intended for short, event-driven functions, not suitable for batch processing.

Full explanation →

1616

Multi-Selecteasy

A company is migrating a batch processing workload to AWS. The workload runs on a schedule and processes large files stored on a network file system. The company wants to use serverless services. Which TWO services should the company use? (Choose TWO.)

Select 2 answers

A.Amazon EMR

B.Amazon EC2

C.Amazon S3

D.Amazon EFS

E.AWS Lambda

AnswersC, E

S3 can store large files and trigger Lambda functions.

Why this answer

Amazon S3 (Option C) is a serverless object storage service that can store the large files. AWS Lambda (Option E) is a serverless compute service that can process the files, for example by triggering on S3 events. Options A (Amazon EMR) requires a cluster of EC2 instances and is not serverless.

Option B (Amazon EC2) requires provisioning servers and is not serverless. Option D (Amazon EFS) is a managed file system that is serverless, but it does not provide compute capabilities and is not the primary serverless compute service needed for processing. Therefore, the correct answers are C and E.

Full explanation →

1617

MCQmedium

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

A.Use ElastiCache for Redis with replication.

B.Store session data in Amazon S3 with reduced redundancy.

C.Use DynamoDB with on-demand capacity.

D.Use ElastiCache for Memcached with multiple nodes.

AnswerA

Redis provides low latency and durability via replication, suitable for session storage.

Why this answer

ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Exam trap

The trap here is that candidates may choose DynamoDB for its durability and scalability, overlooking that its on-demand pricing is significantly more expensive than a provisioned Redis cluster for frequent reads with rare updates, or they may choose Memcached for its simplicity, forgetting that it lacks persistence and replication, which are required for durable session storage.

How to eliminate wrong answers

Option B is wrong because Amazon S3 with reduced redundancy (RRS) is not designed for low-latency session data access; it has higher latency (typically tens to hundreds of milliseconds) and lacks the sub-millisecond performance needed for real-time session reads, plus RRS is deprecated and offers lower durability (99.99%) than standard S3, making it unsuitable for critical session data. Option C is wrong because DynamoDB with on-demand capacity incurs higher costs for frequent reads with rare updates due to its pay-per-request pricing model, which is less cost-effective than a fixed-capacity Redis instance for predictable workloads; additionally, DynamoDB's latency (single-digit milliseconds) is higher than Redis's sub-millisecond performance. Option D is wrong because ElastiCache for Memcached does not support data persistence or replication, meaning session data is lost on node failure, violating the durability requirement; it also lacks features like snapshots or replication that Redis provides for durability.

Full explanation →

1618

MCQmedium

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

A.Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

B.Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

C.Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.

D.Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

AnswerC

SSE-KMS with automatic rotation meets encryption and rotation needs with low overhead.

Why this answer

SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Exam trap

The trap here is that candidates often confuse S3 bucket key rotation (which reduces KMS costs but does not rotate the encryption key) with actual key rotation, leading them to incorrectly select SSE-S3.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses S3-managed keys that cannot be rotated; the 'bucket key' feature reduces KMS API calls but does not rotate the encryption key itself. Option B is wrong because client-side encryption with the AWS Encryption SDK and Secrets Manager adds significant operational overhead for key management and rotation, and the question asks for the least operational overhead. Option D is wrong because SSE-C requires you to provide and manage your own encryption keys, including manual rotation, which increases operational complexity and does not meet the 'least operational overhead' requirement.

Full explanation →

1619

MCQeasy

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

A.Amazon Simple Notification Service (SNS)

B.Amazon Simple Queue Service (SQS)

C.Amazon Kinesis Data Streams

D.AWS Step Functions

AnswerB

SQS is a message queue that decouples components.

Why this answer

Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the frontend API from backend processing. The frontend can send requests to an SQS queue, and backend consumers can poll and process messages asynchronously, which improves scalability by buffering traffic spikes and enhances fault tolerance by persisting messages until they are successfully processed.

Exam trap

The trap here is that candidates often confuse SNS (push-based notification) with SQS (pull-based queue) for decoupling, but SNS does not provide the durable, asynchronous message buffer required for decoupling frontend and backend processing.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers (e.g., HTTP endpoints, Lambda, SQS) but does not provide a durable buffer for asynchronous decoupling; it is designed for fan-out notifications, not for queuing where consumers pull messages at their own pace. Option C is wrong because Amazon Kinesis Data Streams is optimized for real-time streaming of large-scale data (e.g., clickstreams, logs) with ordered records and replay capabilities, not for simple request/response decoupling where each message is processed independently by a single consumer. Option D is wrong because AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue; it does not inherently decouple frontend from backend via asynchronous message buffering.

Full explanation →

1620

MCQhard

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket (input-bucket), which triggers an AWS Lambda function that starts an AWS Glue job. The Glue job processes the video metadata and stores results in a DynamoDB table. Then, a second Lambda function triggers an Amazon ECS Fargate task to transcode the video into multiple formats. The transcoded videos are stored in another S3 bucket (output-bucket). Recently, the company started receiving complaints about delays in video availability. The operations team notices that CloudWatch Logs show no errors, but the ECS tasks often take longer than expected. They also see that the DynamoDB table has a high number of throttled write events. The video upload rate has increased by 50% in the last month. The team needs to improve the pipeline's performance and reduce delays. What should they do?

A.Enable DynamoDB auto scaling on the table with a target utilization of 70%.

B.Increase the Lambda function timeout for both functions to 15 minutes.

C.Introduce an Amazon SQS queue between the second Lambda and ECS to buffer requests.

D.Set reserved concurrency on the first Lambda function to 10 to control throttling.

AnswerA

Auto scaling will dynamically adjust write capacity to handle increased traffic, reducing throttling.

Why this answer

The primary bottleneck is DynamoDB throttling due to increased write load. Enabling DynamoDB auto scaling (Option A) dynamically adjusts read/write capacity to match demand, reducing throttling and delays. Option B (increasing Lambda timeout) does not address DynamoDB throttling.

Option C (SQS queue) improves decoupling but does not directly solve the DynamoDB issue. Option D (reserved concurrency) limits Lambda concurrency, which could reduce load on DynamoDB but also slows down processing and is not the best solution.

Full explanation →

1621

Multi-Selecthard

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Select 3 answers

A.Use IAM groups to restrict access to CloudTrail and S3.

B.Enable multi-factor authentication (MFA) delete on the S3 bucket.

C.Configure S3 bucket versioning and enable S3 Object Lock.

D.Attach a service control policy (SCP) to the account that denies cloudtrail:StopLogging and cloudtrail:DeleteTrail.

E.Store CloudTrail logs in a separate account that only the security team can access.

AnswersB, C, D

MFA delete adds an extra layer of protection to prevent accidental or malicious deletion.

Why this answer

Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.

Exam trap

The trap here is that candidates often overlook the need for multiple complementary controls (MFA delete, S3 Object Lock, and SCPs) and instead choose a single measure like IAM groups or cross-account storage, which do not fully address the requirement to prevent disabling or deletion of CloudTrail and its S3 bucket.

Full explanation →

1622

Multi-Selecthard

A company is migrating a data warehouse from on-premises to Amazon Redshift. The source database is Teradata. The company needs to convert the schema and migrate historical data with minimal downtime. Which THREE services should the company use?

Select 3 answers

A.AWS Snowball Edge

B.AWS Data Pipeline

C.Amazon Kinesis Data Analytics

D.AWS Schema Conversion Tool (SCT)

E.AWS Database Migration Service (DMS)

AnswersA, D, E

Snowball Edge can be used to transfer large volumes of data offline.

Why this answer

Options A, D, and E are correct. AWS SCT (D) converts schema and code from Teradata to Redshift. AWS DMS (E) migrates data with ongoing replication to minimize downtime.

AWS Snowball Edge (A) can be used for large initial data transfer. Option B (AWS Data Pipeline) is for orchestrating data transfers, not specifically for schema conversion or database migration. Option C (Amazon Kinesis Data Analytics) is for streaming analytics.

Full explanation →

1623

MCQhard

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

A.Use CodePipeline with a Lambda function to swap target groups and monitor health.

B.Use CodeDeploy with an in-place deployment configuration and a manual approval step.

C.Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

D.Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.

AnswerD

CodeDeploy natively supports blue/green deployments on ECS with traffic shifting and automatic rollback based on CloudWatch alarms.

Why this answer

CodeDeploy with ECS blue/green deployment provides built-in traffic shifting and automated rollback. Option A is wrong because it lacks traffic shifting. Option B is wrong because it does not support blue/green.

Option C is wrong because it lacks automated rollback.

Full explanation →

1624

MCQmedium

A company is migrating a stateful web application to AWS. The application uses local storage for user sessions. Which AWS service can help make the application stateless and scalable?

A.Amazon EBS

B.Amazon ElastiCache

C.Amazon RDS

D.Amazon S3

AnswerB

Amazon ElastiCache provides an in-memory cache (like Redis or Memcached) that can be shared across instances for session data, making the application stateless.

Why this answer

Amazon ElastiCache provides a managed in-memory cache that can store session data externally, allowing the web application to be stateless and scale horizontally. Amazon EBS volumes are attached to a single EC2 instance and cannot be shared across instances, so they do not help with statelessness. Amazon RDS is for relational databases and is not optimized for low-latency session state.

Amazon S3 is an object store with higher latency and is not suitable for frequent session reads/writes.

Full explanation →

1625

MCQeasy

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

A.Enable default encryption on each bucket using SSE-S3.

B.Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.

C.Require that all buckets use AWS KMS managed keys for encryption.

D.Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

AnswerB

The bucket policy rejects unencrypted uploads.

Why this answer

An S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Exam trap

The trap here is that candidates often confuse default encryption (which passively encrypts objects but does not enforce encryption) with a bucket policy that actively denies unencrypted uploads, leading them to choose Option A instead of the correct enforcement mechanism.

How to eliminate wrong answers

Option A is wrong because enabling default encryption on each bucket only applies encryption to objects that are uploaded without specifying encryption headers; it does not prevent unencrypted uploads, as a user could still override the default by explicitly omitting encryption headers. Option C is wrong because requiring AWS KMS managed keys is a specific encryption type, not a mechanism to enforce encryption; it does not block unencrypted uploads and may introduce additional cost and complexity without addressing the enforcement requirement. Option D is wrong because a CloudFormation stack policy prevents modifications to stack resources after deployment but does not enforce encryption on S3 buckets; it cannot block unencrypted PutObject requests at the bucket level.

Full explanation →

1626

Multi-Selecthard

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Select 3 answers

A.Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

B.Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager

C.Store secrets in AWS Secrets Manager and enable automatic rotation

D.Use the AWS Secrets and Configuration Provider (ASCP) for the Secrets Store CSI Driver to inject secrets into pods

E.Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

AnswersB, C, D

IRSA provides fine-grained permissions for pods.

Why this answer

IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Exam trap

The trap here is that candidates may think mounting the CSI driver without ASCP (Option A) is sufficient, but ASCP is the critical component that bridges the CSI driver to AWS Secrets Manager, and without it, the driver cannot retrieve secrets from AWS.

Full explanation →

1627

Multi-Selecthard

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Select 2 answers

A.VPC Flow Logs

B.AWS CloudTrail

C.AWS Config

D.Amazon CloudWatch Logs

E.Amazon S3

AnswersB, D

CloudTrail records API calls.

Why this answer

AWS CloudTrail is the correct service because it records all API calls made within an AWS account, including the identity, source IP, and timestamp. Centralizing logging across multiple accounts requires sending these CloudTrail logs to a central Amazon S3 bucket (often with cross-account permissions) and then using Amazon CloudWatch Logs to monitor, alert, or analyze the logs in real time. Together, CloudTrail captures the API activity, and CloudWatch Logs provides a unified log management and monitoring layer.

Exam trap

The trap here is that candidates often pick VPC Flow Logs (Option A) thinking it captures all API traffic, but it only captures network-level flows, not the application-layer API calls that CloudTrail records.

Full explanation →

1628

MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. Which step is MOST likely to resolve the issue?

A.Change the health check protocol from HTTP to HTTPS.

B.Use a Network Load Balancer instead of ALB.

C.Increase the number of instances in the target group.

D.Increase the health check timeout and decrease the unhealthy threshold.

AnswerD

Gives instances more time to respond and reduces sensitivity to transient failures.

Why this answer

Increasing the health check timeout gives instances more time to respond before being marked unhealthy, and decreasing the unhealthy threshold allows more consecutive failed health checks before considering an instance unhealthy, reducing false positives. Option A is incorrect because changing the protocol does not address the underlying cause of health check failures; it might even fail if the application does not support HTTPS. Option B is incorrect because using a Network Load Balancer does not resolve health check failures; NLB health checks are different but still need proper configuration.

Option C is incorrect because simply increasing the number of instances does not fix the health check issue; instances may still fail health checks if they are not healthy.

Full explanation →

1629

MCQeasy

A company wants to assess its on-premises environment for migration to AWS. The company needs to collect utilization data for servers and applications. Which AWS service should the company use?

A.AWS Migration Hub

B.AWS Database Migration Service (DMS)

C.AWS Application Discovery Service

D.AWS Server Migration Service (SMS)

AnswerC

Discovery Service collects data about on-premises servers and applications.

Why this answer

AWS Application Discovery Service collects server and application utilization data from on-premises environments to support migration planning. Option A is wrong because AWS Migration Hub tracks migrations but does not perform discovery. Option B is wrong because AWS Database Migration Service (DMS) is for migrating databases, not for collecting utilization data.

Option D is wrong because AWS Server Migration Service (SMS) is deprecated and was used for migrating individual servers, not for discovery.

Full explanation →

1630

Multi-Selectmedium

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Select 3 answers

A.EC2 Spot Instances to reduce compute costs.

B.AWS Lambda functions to process each file.

C.AWS Batch with a job queue and compute environment.

D.Amazon S3 Event Notifications to trigger the batch job when a new file is uploaded.

E.Auto Scaling group with scheduled scaling policies.

AnswersA, C, D

Spot Instances are cost-effective for fault-tolerant batch jobs.

Why this answer

A is correct because EC2 Spot Instances can reduce compute costs by up to 90% compared to On-Demand instances, making them ideal for fault-tolerant, stateless batch workloads that can handle interruptions. The batch processing system described is CPU-intensive and runs for up to 2 hours per file, which fits well within the typical Spot interruption notice (2 minutes) and can be retried using AWS Batch’s built-in retry logic.

Exam trap

The trap here is that candidates often choose AWS Lambda for any event-driven processing without considering its 15-minute timeout limit, overlooking that long-running CPU-intensive tasks require a different compute service like AWS Batch.

Full explanation →

1631

MCQeasy

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

A.Use AWS Config rules to automatically delete non-compliant VPCs.

B.Use IAM policies with conditions on the ec2:CreateVpc action in each account.

C.Use AWS CloudTrail to monitor VPC creation and alert the security team.

D.Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.

AnswerD

SCPs can deny VPC creation if the CIDR does not match allowed ranges.

Why this answer

SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-specific and can be overridden by local admins) with SCPs (which are organization-wide guardrails that cannot be bypassed by member account administrators), leading them to choose Option B instead of the correct preventive control.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect non-compliant VPCs and trigger remediation (e.g., deletion), but they are reactive and cannot prevent the creation of a non-compliant VPC in the first place; the VPC would exist momentarily, potentially causing transient security or networking issues. Option B is wrong because IAM policies with conditions on `ec2:CreateVpc` would need to be applied individually to each member account's IAM roles/users, which is operationally complex and does not prevent a rogue admin with full IAM permissions in that account from bypassing the restriction. Option C is wrong because AWS CloudTrail only logs API calls after they occur; it cannot enforce or block the creation of a VPC, only alert after the fact, which is not a preventive control.

Full explanation →

1632

MCQmedium

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

A.Check if the instance is terminated.

B.Check if the instance ID is correct.

C.Check the instance status checks.

D.Check the security group rules for the instance.

AnswerD

Security groups act as a virtual firewall.

Why this answer

The instance is running but the application is inaccessible, which often indicates that security group rules are not allowing the required inbound traffic. Option A is wrong because the instance is reported as 'running', so it is not terminated. Option B is wrong because the command output successfully returns instance details, meaning the instance ID is correct.

Option C is wrong because status checks relate to the health of the instance OS and system, not network access.

Full explanation →

1633

MCQeasy

A company is migrating a legacy Windows application to AWS. The application requires a shared file system accessible from multiple EC2 instances in the same VPC. Which AWS service should the company use to meet this requirement with minimal application changes?

A.Amazon EBS

B.Amazon S3

C.Amazon FSx for Windows File Server

D.AWS Storage Gateway

AnswerC

Provides a fully managed native Windows file system that is accessible from multiple EC2 instances.

Why this answer

Mazon FSx for Windows File Server (option C). This service provides a fully managed native Windows file system that is accessible from multiple EC2 instances in the same VPC, supporting the SMB protocol required by Windows applications. Option A (Amazon EBS) is block storage that can be attached to only one instance at a time, not a shared file system.

Option B (Amazon S3) is object storage and does not provide a file system interface. Option D (AWS Storage Gateway) is used for hybrid cloud storage and is not the optimal choice for this scenario.

Full explanation →

1634

MCQeasy

A company stores sensitive data in Amazon S3. They need to ensure that data is encrypted at rest using a key managed by the company's on-premises hardware security module (HSM). Which S3 encryption option should they use?

A.Server-Side Encryption with Customer-Provided Keys (SSE-C).

B.Client-Side Encryption using the company's own encryption library.

C.Server-Side Encryption with AWS KMS (SSE-KMS).

D.Server-Side Encryption with S3-Managed Keys (SSE-S3).

AnswerB

Client-side encryption allows the company to encrypt data with their own key before uploading to S3.

Why this answer

Client-Side Encryption (B) allows the company to encrypt the data locally using their own encryption keys from the on-premises HSM before uploading to S3. This ensures the HSM manages the key and the company retains full control. Option A (SSE-C) requires the customer to provide a key with each request, but the key is not managed by the on-premises HSM; it is provided per-request and S3 uses it for encryption/decryption.

Option C (SSE-KMS) uses AWS KMS, not the company's HSM. Option D (SSE-S3) uses S3-managed keys, which also do not involve the on-premises HSM.

Full explanation →

1635

MCQhard

A company is migrating a critical application to AWS using the 7 Rs migration strategy. The application has a monolithic architecture and runs on a single large on-premises server. The business wants to reduce operational overhead but cannot afford any downtime. Which strategy should the solutions architect recommend?

A.Rehost the application using AWS Application Migration Service

B.Retire the application and replace it with a SaaS solution

C.Replatform the application to use AWS managed services

D.Refactor / Re-architect the application into microservices

AnswerA

Correct: Lift-and-shift minimizes changes and downtime.

Why this answer

Rehost (lift-and-shift) moves the application as-is to minimize risk and downtime. Replatforming would require changes that could introduce downtime. Refactor/Re-architect would be too invasive.

Retire is not applicable as the application is critical.

Full explanation →

1636

Multi-Selectmedium

A company is modernizing a legacy CRM application to a microservices architecture on AWS. They want to use AWS Lambda for compute and Amazon API Gateway for the API layer. Which THREE design patterns should they consider? (Select THREE.)

Select 3 answers

A.Use Amazon ElastiCache for session state management

B.Decompose the monolith into separate Lambda functions for each business capability

C.Use API Gateway to expose each microservice as a REST API

D.Use EC2 Auto Scaling groups for each microservice

E.Use AWS Step Functions to orchestrate multiple Lambda functions

AnswersB, C, E

Decomposing the monolith into separate Lambda functions for each business capability aligns with microservices principles, enabling independent development, deployment, and scaling.

Why this answer

The three design patterns for this serverless microservices architecture are: B (Decompose the monolith into separate Lambda functions for each business capability), C (Use API Gateway to expose each microservice as a REST API), and E (Use AWS Step Functions to orchestrate multiple Lambda functions). Options A and D are incorrect: A (ElastiCache) is a caching solution, not a core microservices pattern, and D (EC2 Auto Scaling) introduces server-based compute, which contradicts the serverless approach.

Full explanation →

1637

MCQhard

A company needs to provide temporary credentials for users to access an S3 bucket for exactly 1 hour. The solution must not require any custom code or user management. Which AWS service should be used?

A.Amazon Cognito identity pools

B.An IAM role with a trust policy

C.S3 pre-signed URLs

D.AWS STS

AnswerD

STS generates temporary credentials with a specified duration.

Why this answer

AWS STS (Security Token Service) is the correct choice because it can generate temporary, limited-privilege credentials for IAM users or federated users, with a configurable expiration period (up to 1 hour for the default API call). This meets the requirement of providing temporary credentials for exactly 1 hour without requiring custom code or user management, as STS is a managed service that issues credentials via API calls like AssumeRole or GetFederationToken.

Exam trap

The trap here is that candidates often confuse IAM roles (which define permissions) with the actual mechanism to issue temporary credentials (STS), leading them to select Option B, but a role alone cannot generate credentials without STS or custom code.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito identity pools are designed for federated identities and user pools for authentication, but they require integration with a user pool or external identity provider and do not directly issue temporary S3 credentials without additional configuration; they also involve user management overhead. Option B is wrong because an IAM role with a trust policy defines who can assume the role but does not itself generate temporary credentials; it must be combined with AWS STS to actually issue credentials, and the role alone does not provide a mechanism to grant credentials to users without custom code. Option C is wrong because S3 pre-signed URLs grant time-limited access to specific S3 objects, not to the entire bucket, and they are generated using AWS SDK or CLI, which requires custom code; they also do not provide temporary credentials for general S3 operations.

Full explanation →

1638

MCQhard

A company is migrating a critical application from on-premises to AWS using a lift-and-shift approach. The application requires consistent low-latency access to an on-premises database. Which network solution should the company implement to meet the latency requirement during the migration?

A.Set up a site-to-site VPN over the internet.

B.Create a VPC peering connection between the on-premises network and AWS VPC.

C.Use AWS Client VPN to connect from the application servers.

D.Establish an AWS Direct Connect connection between the on-premises data center and AWS.

AnswerD

Direct Connect provides consistent low-latency and high-bandwidth connectivity.

Why this answer

D is correct because AWS Direct Connect provides dedicated, consistent low-latency connectivity from on-premises to AWS, meeting the latency requirement. A is wrong because a site-to-site VPN over the internet introduces variability and inconsistent latency due to internet routing. B is wrong because VPC peering is for connecting VPCs within AWS, not for on-premises connectivity.

C is wrong because AWS Client VPN is designed for individual client connections, not for consistent application-level latency.

Full explanation →

1639

Multi-Selectmedium

A company is designing a new system to ingest and process real-time streaming data from thousands of IoT devices. The system must be able to handle variable throughput and provide durable storage for the data. The data will be processed by a Lambda function and then stored in Amazon S3. Which two services should be used together to build this ingestion pipeline?

Select 2 answers

A.AWS Lambda

B.Amazon Kinesis Data Firehose

C.Amazon Simple Queue Service (SQS)

D.Amazon Kinesis Data Streams

E.Amazon Simple Notification Service (SNS)

AnswersA, D

Can process records from Kinesis Data Streams in near real-time.

Why this answer

Amazon Kinesis Data Streams (Option D) is the correct ingestion service because it provides durable, real-time data streaming with shard-level persistence for up to 365 days, enabling Lambda to process records in near real-time with at-least-once delivery semantics. AWS Lambda (Option A) is the correct processing service because it can be configured as a consumer of the Kinesis stream via event source mapping, scaling automatically with the number of shards to handle variable throughput without managing servers.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose with Kinesis Data Streams, assuming Firehose's direct S3 delivery is sufficient, but they miss that Firehose cannot trigger Lambda per-record processing and lacks the durable, replayable stream storage required for real-time IoT ingestion with Lambda.

Full explanation →

1640

MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. A recent change to a stack failed because an IAM role name already exists. The company wants to avoid this issue in the future. What should a solutions architect do?

A.Enable termination protection on the stack.

B.Use a DeletionPolicy of Retain on the IAM role resource.

C.Create a custom resource with an AWS Lambda function to generate a random role name.

D.Use the Fn::Sub function with a reference to the AWS::StackName in the IAM role name.

AnswerD

This ensures unique role names across stacks.

Why this answer

Using `Fn::Sub` with `!Ref AWS::StackName` makes the IAM role name unique per stack, preventing naming conflicts when stacks are deployed in the same account. Option A is incorrect because enabling termination protection only prevents accidental deletion, not naming conflicts. Option B is incorrect because a `DeletionPolicy` of `Retain` preserves the resource after stack deletion, but does not influence naming uniqueness; a future stack deployment could still encounter the same name conflict.

Option C is incorrect because a custom resource with a Lambda function unnecessarily adds complexity when a simpler built-in function (`Fn::Sub`) serves the purpose.

Full explanation →

1641

MCQmedium

A company is refactoring a legacy .NET application to run on AWS Lambda. The application currently uses Windows authentication and Active Directory. Which approach should the company use to support authentication in the new architecture?

A.Use Amazon Cognito user pools for authentication.

B.Use AWS Directory Service for Microsoft Active Directory and connect Lambda to the directory via VPC.

C.Use AWS Identity and Access Management (IAM) roles to authenticate users.

D.Use AWS Security Token Service (STS) to issue tokens for authentication.

AnswerB

This enables Kerberos/NTLM authentication within the VPC.

Why this answer

B is correct because AWS Directory Service for Microsoft Active Directory allows Lambda functions to authenticate users against an existing Active Directory. By connecting the Lambda function to the directory via a VPC, the function can perform Windows authentication for the refactored .NET application. Option A is incorrect because Amazon Cognito user pools are designed for external identity providers, not for Windows AD authentication.

Option C is incorrect because IAM roles are used for granting AWS service permissions, not for authenticating users with Windows credentials. Option D is incorrect because STS issues temporary tokens for AWS API access, not for Windows authentication.

Full explanation →

1642

MCQmedium

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

A.AWS Data Pipeline

B.AWS Step Functions

C.AWS Lambda functions

D.AWS Glue ETL jobs

AnswerB

Step Functions can orchestrate complex workflows with conditional branching.

Why this answer

AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Exam trap

The trap here is that candidates often confuse AWS Glue ETL jobs as an orchestration tool because it can transform data, but Glue is a processing engine, not a workflow orchestrator; Step Functions is the correct service for coordinating complex, conditional pipelines.

How to eliminate wrong answers

Option A is wrong because AWS Data Pipeline is a legacy service for moving data between sources and destinations, but it lacks native support for complex conditional transformations and is not as flexible as Step Functions for orchestrating custom processing logic. Option C is wrong because AWS Lambda functions are stateless and have a maximum execution timeout of 15 minutes, making them unsuitable for orchestrating long-running or multi-step transformation pipelines; they are better suited for individual processing tasks within the workflow. Option D is wrong because AWS Glue ETL jobs are designed for batch data transformation using Apache Spark, but they are not an orchestration service; they would be a component orchestrated by Step Functions, not the orchestrator itself.

Full explanation →

1643

MCQhard

A company has a multi-account architecture with a central networking account that hosts a Transit Gateway. Each workload account has VPCs attached to the Transit Gateway. The company wants to centrally manage DNS resolution across all VPCs using Route 53 Resolver. They create a Route 53 Resolver outbound endpoint in the networking account and associate it with the workload VPCs via RAM. However, workload accounts cannot resolve on-premises hostnames. What is the missing configuration?

A.Establish VPC peering between the workload VPCs and the networking account VPC.

B.Create a Route 53 private hosted zone in the networking account and associate it with the workload VPCs.

C.Create a Route 53 Resolver inbound endpoint in the networking account.

D.Create a Route 53 Resolver rule in each workload account that forwards queries for the on-premises domain to the outbound endpoint.

AnswerD

Resolver rules determine how DNS queries are forwarded.

Why this answer

The outbound endpoint forwards DNS queries from the workload VPCs to on-premises resolvers, but it does not automatically configure the workload VPCs to use it. A Route 53 Resolver rule must be created in each workload account (or centrally via RAM) to forward queries for the on-premises domain to the outbound endpoint. Without this rule, the workload VPCs will not send queries for on-premises hostnames to the outbound endpoint, so resolution fails.

Exam trap

The trap here is that candidates assume associating the outbound endpoint with workload VPCs via RAM automatically forwards all DNS queries, but they forget that a forwarding rule is required to specify which domain names should be sent to the outbound endpoint.

How to eliminate wrong answers

Option A is wrong because VPC peering does not enable DNS resolution forwarding; it only provides network connectivity, and the Transit Gateway already connects the VPCs. Option B is wrong because a private hosted zone is used to resolve custom domain names within AWS, not to forward queries to on-premises resolvers. Option C is wrong because an inbound endpoint allows on-premises resolvers to query Route 53 Resolver in AWS, but the issue is workload VPCs resolving on-premises hostnames, which requires an outbound endpoint with a forwarding rule.

Full explanation →

1644

Multi-Selecthard

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Select 3 answers

A.Create an IAM policy in each account that requires tags on role creation

B.Set up AWS Budgets to alert on untagged roles

C.Attach the SCP to the root organizational unit to apply it to all accounts

D.Create a service control policy (SCP) that denies iam:CreateRole if the request does not include the required tag

E.Use AWS Config rules to detect roles missing the tag and trigger automatic remediation

AnswersC, D, E

Attaching to root ensures all accounts are covered.

Why this answer

AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.

Exam trap

The trap here is that candidates often confuse AWS Budgets (a cost alerting tool) with a governance enforcement mechanism, or think that per-account IAM policies are sufficient for centralized control, missing the fact that SCPs are the only way to enforce organization-wide guardrails that cannot be overridden by account administrators.

Full explanation →

1645

MCQeasy

A company is planning to migrate a web application to AWS. The application currently runs on a single on-premises server with a few thousand users. The company wants to use a managed container service and minimize operational overhead. Which AWS service should the company use to run the application?

A.Amazon EKS

B.AWS Lambda

C.Amazon EC2

D.Amazon ECS with AWS Fargate

AnswerD

Fargate is serverless, reduces operational overhead.

Why this answer

Amazon ECS with AWS Fargate is a managed container service that eliminates the need to manage underlying EC2 instances, reducing operational overhead. Option A (Amazon EKS) is wrong because it is Kubernetes-based and more complex to manage, which does not align with minimizing operational overhead. Option B (AWS Lambda) is wrong because it is designed for short-running functions, not for running a web application as a container.

Option C (Amazon EC2) is wrong because it requires manual management of instances and containers, increasing operational overhead.

Full explanation →

1646

MCQhard

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The database is business-critical and must have minimal downtime. The company has set up AWS DMS with ongoing replication from the source. During the migration, the company notices that DMS is failing with an error indicating insufficient memory. What should the company do to resolve this issue and complete the migration?

A.Increase the memory on the source Oracle database

B.Increase the instance class of the DMS replication instance

C.Change the DMS task to use change data capture (CDC) only and skip the full load

D.Split the migration into multiple smaller tasks

AnswerB

DMS replication instance memory is insufficient; upgrading the instance class resolves the issue.

Why this answer

AWS DMS replication instances have finite memory allocated to cache changes during ongoing replication (CDC). When the volume of cached changes exceeds the instance's memory, DMS fails with an insufficient memory error. Increasing the instance class of the DMS replication instance (Option B) provides more memory to handle the cache, resolving the error without disrupting the migration.

Exam trap

The trap here is that candidates may think the error is on the source database (Option A) or that splitting tasks (Option D) solves memory issues, but DMS's memory error is specific to the replication instance's capacity, not the source or task granularity.

How to eliminate wrong answers

Option A is wrong because the source Oracle database's memory is unrelated to DMS's internal caching; DMS runs on its own replication instance, not on the source. Option C is wrong because skipping the full load would leave the target database empty, defeating the purpose of migration; CDC alone cannot populate the initial schema and data. Option D is wrong because splitting into multiple tasks does not increase the memory available to any single task; each task still runs on the same replication instance and would encounter the same memory limit.

Full explanation →

1647

MCQhard

A company has a management account in AWS Organizations and several member accounts. The security team wants to ensure that any IAM user created in any member account must have a password policy that enforces a minimum length of 14 characters. The team wants a preventive control that is enforced automatically. Which approach should be used?

A.Use AWS Service Catalog to provide a password policy product and require account owners to launch it.

B.Use an SCP to deny the iam:UpdateAccountPasswordPolicy action and deploy a password policy using CloudFormation StackSets.

C.Use an SCP to deny the iam:CreateUser action unless the request includes a condition that the password policy meets the requirement.

D.Use AWS Config rules to detect accounts without the required password policy and auto-remediate with a Lambda function.

AnswerB

Correct: Prevents changes and enforces policy.

Why this answer

An SCP can deny the iam:UpdateAccountPasswordPolicy action, preventing member accounts from altering the password policy, while CloudFormation StackSets can deploy a compliant password policy across all member accounts automatically. This combination provides a preventive control that enforces the minimum 14-character requirement without relying on user action or reactive detection.

Exam trap

The trap here is that candidates often choose a detective/reactive solution (like AWS Config with auto-remediation) because it seems automated, but the question explicitly asks for a preventive control that is enforced automatically, which requires blocking the ability to change the policy (SCP) and proactively applying the correct policy (StackSets).

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog requires account owners to manually launch the product, which is not automatic and does not prevent non-compliance if they skip it. Option C is wrong because SCPs cannot conditionally deny iam:CreateUser based on password policy requirements; password policy is an account-level setting, not a per-user request parameter, and the iam:CreateUser action does not support such a condition key. Option D is wrong because AWS Config rules are detective and reactive, not preventive; they detect non-compliance after the fact and auto-remediation via Lambda is still a corrective action, not an automatic preventive enforcement.

Full explanation →

1648

MCQhard

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

A.The SCP syntax is invalid because it uses StringNotEquals

B.The SCP must also allow the allowed instance types in a separate statement

C.The SCP does not include an Allow statement for the allowed instance types

D.The SCP is not attached to the correct OU or root

AnswerD

If the SCP is not attached to the OU containing the accounts, it will not take effect.

Why this answer

The most likely reason is that the SCP is not attached to the correct OU or root. SCPs must be explicitly attached to the target OU, account, or root to take effect. If the SCP is attached to a different OU or not attached at all, it will not restrict the accounts in the intended OU, allowing users to launch any instance type.

Exam trap

The trap here is that candidates assume SCPs apply globally once created, but they must be explicitly attached to the target OU, account, or root to take effect.

How to eliminate wrong answers

Option A is wrong because StringNotEquals is a valid condition key operator in SCPs; the syntax is not invalid. Option B is wrong because SCPs do not require separate Allow statements for allowed types; a single Deny with a NotResource or NotCondition can effectively restrict to allowed types. Option C is wrong because SCPs are deny-by-default; they do not need an explicit Allow statement for allowed instance types—the default implicit Allow covers them unless explicitly Denied.

Full explanation →

1649

MCQmedium

A company uses AWS Control Tower to manage a multi-account environment. They need to deploy a custom CloudFormation template to all accounts in a specific organizational unit (OU) whenever a new account is added. What should they use?

A.Use AWS Service Catalog portfolio to share templates.

B.Use AWS Lambda with lifecycle hooks in AWS CloudFormation.

C.Use AWS CloudFormation StackSets and manually trigger them for new accounts.

D.Use AWS Control Tower Account Factory Customization (AFC).

AnswerD

AFC automatically deploys custom templates to new accounts.

Why this answer

AWS Control Tower Account Factory Customization (AFC) is designed to automatically apply custom CloudFormation templates to new accounts provisioned through Account Factory within a specified OU. It uses lifecycle events to trigger the deployment, ensuring that every new account in the OU receives the baseline configuration without manual intervention.

Exam trap

The trap here is that candidates may confuse AWS Control Tower Account Factory Customization with AWS CloudFormation StackSets, but StackSets lack the automatic triggering mechanism tied to new account creation in an OU, which AFC provides natively.

How to eliminate wrong answers

Option A is wrong because AWS Service Catalog portfolios share templates for self-service provisioning but do not automatically deploy them when a new account is added to an OU. Option B is wrong because AWS CloudFormation does not have lifecycle hooks; lifecycle hooks are a feature of Auto Scaling groups and AWS CodeDeploy, not CloudFormation. Option C is wrong because while CloudFormation StackSets can deploy templates across accounts, they require manual triggering or custom automation to run when a new account joins an OU, which defeats the 'whenever a new account is added' requirement.

Full explanation →

1650

MCQhard

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The architecture must handle sudden spikes in traffic without losing events. Which configuration ensures the highest reliability?

A.Increase the SQS visibility timeout to 30 minutes.

B.Use DynamoDB on-demand capacity mode.

C.Configure an SQS dead-letter queue for failed messages.

D.Set Lambda reserved concurrency to a low value to control costs.

AnswerC

DLQ captures messages that cannot be processed, ensuring no data loss.

Why this answer

An SQS dead-letter queue (DLQ) captures messages that cannot be processed successfully after the maximum retries are exhausted, preventing event loss during traffic spikes. This ensures that failed messages are preserved for later analysis or reprocessing, which is critical for reliability in a serverless event-driven architecture.

Exam trap

The trap here is that candidates may confuse scalability features (like DynamoDB on-demand or Lambda concurrency) with reliability mechanisms for message processing, overlooking that a dead-letter queue is the specific AWS-recommended pattern to prevent event loss in SQS-based architectures.

How to eliminate wrong answers

Option A is wrong because increasing the SQS visibility timeout to 30 minutes does not prevent event loss; it only delays the reappearance of unprocessed messages in the queue, and if the Lambda function fails, the message will eventually become visible again and may still be lost if not handled. Option B is wrong because DynamoDB on-demand capacity mode handles traffic spikes without throttling, but it does not address event loss from Lambda processing failures or SQS message handling; it only ensures database scalability. Option D is wrong because setting Lambda reserved concurrency to a low value to control costs can cause throttling during traffic spikes, leading to SQS messages being discarded or sent to a DLQ only if configured, but it actively reduces reliability by limiting concurrent executions.

Full explanation →

Page 22 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →