Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 151–225

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 2

Page 3 of 23

Page 4
151
Multi-Selecteasy

A company is hosting a static website on Amazon S3. The website uses JavaScript to make API calls to a backend API hosted on Amazon API Gateway. The company wants to reduce latency for users worldwide. Which combination of AWS services should the solutions architect use? (Choose two.)

Select 2 answers
A.Use CloudFront with API Gateway as an origin.
B.Use AWS Global Accelerator for the S3 website.
C.Use Lambda@Edge to process API calls at the edge.
D.Use Amazon CloudFront for both the S3 website and the API Gateway endpoint.
E.Enable S3 Transfer Acceleration on the bucket.
AnswersA, D

This allows API calls to be served from edge locations.

Why this answer

Amazon CloudFront can use API Gateway as a custom origin, allowing API requests to be served from edge locations closer to users, which reduces latency. This integration caches API responses at the edge when possible and terminates the user's TCP connection at the edge, improving performance for global users.

Exam trap

The trap here is that candidates may think Lambda@Edge can directly process API calls to API Gateway, but Lambda@Edge only intercepts CloudFront events and cannot replace the API Gateway origin or handle backend API logic.

Full explanation →
152
MCQmedium

Refer to the exhibit. A company is migrating an application to AWS and has attached the IAM policy shown to an IAM role. The application runs on an EC2 instance and needs to upload files to an S3 bucket. However, the uploads are failing with an access denied error. What is the most likely cause?

A.The IAM policy does not allow the s3:PutObject action
B.The IAM policy uses an incorrect resource ARN
C.The IAM policy restricts access based on source IP, but the EC2 instance's public IP is not in the allowed range
D.The S3 bucket policy denies access from the instance
AnswerC

Correct: The IP condition is likely blocking the instance.

Why this answer

The IAM policy explicitly allows s3:PutObject, so option A is incorrect. The resource ARN is correctly formatted as arn:aws:s3:::example-bucket/*, ruling out option B. The policy includes a condition (aws:SourceIp) that restricts access to the IP range 203.0.113.0/24.

The EC2 instance's public IP may not fall within this range, causing the access denied error, making option C correct. Option D is incorrect because there is no indication of a bucket policy; the deny is due to the IAM policy's IP restriction.

Full explanation →
153
MCQhard

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

A.Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.
B.Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.
C.Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.
D.Use S3 bucket policies to deny PutObject if encryption is not set.
AnswerB

SCP prevents new non-compliant buckets; Config remediates existing ones.

Why this answer

An SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Exam trap

The trap here is that candidates often assume AWS Config rules automatically evaluate all existing resources when enabled, but they only evaluate resources on configuration changes after enablement unless a manual or scheduled evaluation is triggered, leading to the misconception that Config alone cannot cover pre-existing buckets.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy templates but cannot enforce encryption on buckets created outside of CloudFormation, and teams can still create buckets via other methods (console, CLI) that bypass the template. Option C is wrong because CloudTrail only detects and alerts on bucket creation events but does not prevent creation of non-compliant buckets or remediate existing ones, leaving the security gap open. Option D is wrong because S3 bucket policies can deny PutObject without encryption but do not enforce encryption at the bucket level (SSE-S3 or SSE-KMS) during bucket creation, and they cannot prevent creation of buckets without encryption settings.

Full explanation →
154
MCQeasy

A company is migrating a legacy application to AWS. The application runs on a single Windows Server instance and uses a local MySQL database. The company wants to minimize changes to the application code. Which migration strategy should the company use?

A.Rehost the application on Amazon EC2 with MySQL installed on the same instance
B.Retire the application and replace it with a SaaS alternative
C.Refactor the application to use a serverless architecture with AWS Lambda and Amazon DynamoDB
D.Replatform the application by moving the database to Amazon RDS for MySQL
AnswerA

Rehosting moves the application without changes, minimizing risk.

Why this answer

Rehost (lift-and-shift) migrates the application as-is to EC2, keeping MySQL on the same instance to minimize code changes. Option B (Retire) is not a migration strategy. Option C (Refactor) requires code changes to adapt to serverless and DynamoDB.

Option D (Replatform) moves the database to RDS, which may require code changes due to different database configuration or features.

Full explanation →
155
MCQeasy

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

A.AWS Lambda function invoked by CloudWatch Events.
B.Amazon Route 53 health checks with failover routing.
C.AWS CodeBuild with post-build actions.
D.CodeDeploy automatic rollback configuration with CloudWatch alarm.
AnswerD

CodeDeploy supports automatic rollback when a CloudWatch alarm is in ALARM state.

Why this answer

AWS CodeDeploy natively supports automatic rollback triggered by CloudWatch alarms. When a deployment causes a CloudWatch alarm to enter an ALARM state, CodeDeploy can automatically revert to the previous working version. This is the most straightforward and integrated solution for the requirement.

Option A (Lambda + CloudWatch Events) is possible but not the primary recommended feature. Option B (Route 53 health checks) is for DNS-level failover, not deployment rollback. Option C (CodeBuild post-build actions) is for build phase, not post-deployment monitoring.

Full explanation →
156
MCQeasy

A company is designing a new web application that will serve static content (HTML, CSS, JS, images) to users globally. The application must have low latency and high availability. Content changes infrequently, but when updated, the changes must be reflected immediately. Which solution should the architect recommend?

A.Store content in an S3 bucket and use Amazon CloudFront with S3 as origin
B.Store content on an EC2 instance behind an Application Load Balancer and use CloudFront
C.Store content in Amazon ElastiCache for Redis and use CloudFront
D.Store content in an S3 bucket and use S3 Transfer Acceleration
AnswerA

CloudFront provides global edge caching for low latency, and invalidations allow immediate content updates.

Why this answer

Amazon CloudFront, with an S3 bucket as the origin, provides a global content delivery network (CDN) that caches static content at edge locations, significantly reducing latency for users worldwide. S3 offers durable, highly available storage, and CloudFront’s cache invalidation or versioned object updates allow changes to be reflected immediately when content is updated. This combination meets the requirements for low latency, high availability, and immediate content refresh.

Exam trap

The trap here is that candidates may over-engineer the solution by choosing EC2 or ElastiCache, mistakenly thinking they need compute or caching layers for static content, when S3 + CloudFront is the simplest, most cost-effective, and fully managed solution for global static content delivery.

How to eliminate wrong answers

Option B is wrong because storing static content on an EC2 instance behind an Application Load Balancer introduces unnecessary compute overhead, management complexity, and higher cost without any benefit for static content; EC2 is designed for dynamic processing, not serving static assets efficiently at global scale. Option C is wrong because Amazon ElastiCache for Redis is an in-memory cache designed for transient, high-speed data (e.g., session state, database query results), not for durable, long-term storage of static content; it lacks the persistence and origin-pull capabilities needed for a CDN origin. Option D is wrong because S3 Transfer Acceleration only speeds up uploads to an S3 bucket over long distances using AWS edge locations, but it does not cache content at edge locations for low-latency downloads; it does not provide global content distribution or high availability for serving static content to users.

Full explanation →
157
MCQmedium

A company is designing a new application that will store sensitive user data in Amazon S3. The data must be encrypted at rest and in transit. The solution must use AWS managed keys and must be compliant with PCI DSS. Which combination of encryption options should be used?

A.SSE-S3 for at-rest encryption and HTTPS for in-transit encryption
B.Client-side encryption for at-rest and HTTPS for in-transit
C.SSE-KMS for at-rest encryption and HTTP for in-transit encryption
D.SSE-C for at-rest encryption and HTTPS for in-transit
AnswerA

SSE-S3 uses AWS managed keys and HTTPS is standard for in-transit.

Why this answer

SSE-S3 provides server-side encryption at rest using AWS-managed keys (S3-managed keys), which satisfies the requirement for AWS managed keys. HTTPS ensures encryption in transit, and both are compliant with PCI DSS standards for protecting sensitive data.

Exam trap

The trap here is that candidates may confuse SSE-KMS (which also uses AWS managed keys but adds additional control and cost) with SSE-S3, but SSE-S3 is simpler and fully compliant; the key requirement is 'AWS managed keys,' not necessarily KMS, and SSE-S3 meets that without extra overhead.

How to eliminate wrong answers

Option B is wrong because client-side encryption does not use AWS managed keys; it uses keys managed by the client, which violates the requirement for AWS managed keys. Option C is wrong because HTTP does not provide encryption in transit, leaving data vulnerable to interception, and PCI DSS requires encrypted transmission (e.g., HTTPS/TLS). Option D is wrong because SSE-C uses customer-provided keys, not AWS managed keys, failing the requirement for AWS managed keys.

Full explanation →
158
Multi-Selectmedium

A company has multiple AWS accounts. They want to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO steps should be taken to enforce this across all accounts?

Select 2 answers
A.Use AWS CloudTrail to detect console logins without MFA and send alerts.
B.Attach an SCP that denies all AWS actions if the aws:MultiFactorAuthPresent condition is false.
C.Require each IAM user to have a virtual MFA device assigned.
D.Create an IAM group for users without MFA and deny them console access.
E.Attach an IAM policy to all users that denies console access if MFA is not present.
AnswersB, E

This denies actions when MFA is not used.

Why this answer

AWS Organizations Service Control Policies (SCPs) can be applied to all accounts in the organization to centrally enforce that any API action is denied unless the request includes MFA. By using the `aws:MultiFactorAuthPresent` condition key set to `false`, the SCP effectively blocks all AWS actions (including console login) for any principal that has not authenticated with MFA. This ensures a blanket, unmodifiable guard across all member accounts, even preventing account administrators from bypassing the requirement.

Exam trap

The trap here is that candidates often confuse detection (CloudTrail) with enforcement (SCP or IAM policy), or they assume that assigning an MFA device is sufficient without a corresponding deny policy, leading them to pick options that only monitor or partially enforce the requirement.

Full explanation →
159
MCQmedium

A company is migrating a multi-tier web application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to use AWS services to improve scalability and reduce management overhead. The web and application tiers run on Linux. The database is Oracle running on Linux. Which solution meets these requirements with the LEAST operational overhead?

A.Deploy web and application tiers on Amazon EC2 instances in an Auto Scaling group. Migrate the database to an Amazon RDS for Oracle DB instance.
B.Containerize the web and application tiers and deploy them on Amazon ECS with AWS Fargate. Migrate the database to Amazon RDS for Oracle.
C.Deploy the web and application tiers using AWS Elastic Beanstalk with an Auto Scaling group. Migrate the database to Amazon RDS for Oracle.
D.Deploy web and application tiers on Amazon EC2 instances in an Auto Scaling group. Migrate the database to Oracle on Amazon RDS Custom.
AnswerC

Elastic Beanstalk automates capacity provisioning, load balancing, and scaling, reducing operational overhead.

Why this answer

AWS Elastic Beanstalk automatically manages the capacity provisioning, load balancing, and scaling of the web and application tiers, significantly reducing management overhead. Amazon RDS for Oracle handles database administration tasks such as patching, backups, and replication. Option A (EC2 + Auto Scaling) requires manual configuration and management of EC2 instances, increasing operational overhead.

Option B (ECS with Fargate) introduces containerization complexity that is not necessary for a straightforward migration and may require additional learning and orchestration. Option D (RDS Custom) provides more customization but at the cost of increased operational overhead compared to standard RDS. Therefore, Option C offers the least operational overhead.

Full explanation →
160
MCQeasy

A company wants to implement a centralized logging solution for all AWS accounts in AWS Organizations. The logs include CloudTrail, VPC Flow Logs, and AWS Config configuration items. Which approach provides the MOST scalable and cost-effective solution?

A.Configure each account to deliver logs to a central Amazon S3 bucket in a logging account, and use S3 Lifecycle policies to transition logs to Amazon S3 Glacier.
B.Use Amazon Kinesis Data Firehose in each account to stream logs to a central Amazon S3 bucket.
C.Configure each account to deliver logs to its own S3 bucket and use S3 Replication to copy logs to a central bucket.
D.Send logs to Amazon CloudWatch Logs in each account and use cross-account CloudWatch Logs subscription filters to forward logs to a central account.
AnswerA

S3 is cost-effective for central log storage.

Why this answer

Delivering logs from all accounts to a central Amazon S3 bucket in a logging account is the most scalable and cost-effective approach. S3 Lifecycle policies can automatically transition older logs to Amazon S3 Glacier, reducing storage costs while retaining data for compliance. This design avoids cross-account data transfer fees and minimizes operational overhead by using a single bucket with centralized access controls.

Exam trap

The trap here is that candidates often over-engineer the solution by choosing streaming services like Kinesis or CloudWatch Logs, thinking they are more scalable, but they fail to recognize that direct S3 delivery with Lifecycle policies is both more cost-effective and sufficiently scalable for centralized logging in AWS Organizations.

How to eliminate wrong answers

Option B is wrong because using Amazon Kinesis Data Firehose in each account to stream logs to a central S3 bucket introduces unnecessary complexity and cost, as Firehose incurs per-GB ingestion fees and requires managing stream configurations per account, making it less cost-effective than direct S3 delivery. Option C is wrong because configuring each account to deliver logs to its own S3 bucket and using S3 Replication to copy logs to a central bucket incurs replication costs (per-object and data transfer fees) and adds latency, making it less scalable and more expensive than direct delivery to a single bucket. Option D is wrong because sending logs to CloudWatch Logs in each account and using cross-account subscription filters to forward logs to a central account incurs CloudWatch Logs ingestion and storage costs, as well as data transfer charges, and the subscription filter approach does not scale well for high-volume logs like VPC Flow Logs, leading to potential throttling and higher costs.

Full explanation →
161
MCQhard

A company has an S3 bucket that stores critical data. They need to ensure that all objects are encrypted at rest. The bucket policy currently denies uploads if the x-amz-server-side-encryption header is not set to AES256. However, some objects are still stored with SSE-KMS. How can the company enforce SSE-S3 exclusively?

A.Use S3 Lifecycle policies to transition objects to SSE-S3.
B.Enable default encryption on the bucket with SSE-S3.
C.Update the bucket policy to deny uploads with SSE-KMS.
D.Use S3 Object Lambda to change encryption.
AnswerC

Denying SSE-KMS enforces SSE-S3.

Why this answer

Updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively.

Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption.

Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption.

Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.

Full explanation →
162
MCQmedium

A company is designing a new application that requires a relational database. The application has variable traffic, with high spikes during business hours and low traffic at night. The company wants to minimize costs while ensuring the database can handle the spikes. Which solution should the architect recommend?

A.Use Amazon RDS with Multi-AZ and read replicas, or Amazon Aurora Serverless
B.Use Amazon RDS with a Single-AZ instance and automatic scaling
C.Use Amazon DynamoDB with on-demand capacity
D.Use Amazon RDS with a Single-AZ instance and a large instance size
AnswerA

Multi-AZ provides high availability, read replicas handle read spikes, and Aurora Serverless automatically scales compute.

Why this answer

Amazon Aurora Serverless automatically scales compute capacity based on application demand, making it ideal for variable traffic with high spikes during business hours and low traffic at night, while minimizing costs by only paying for consumed resources. Multi-AZ RDS with read replicas provides high availability and read scaling but does not automatically scale compute for write spikes, so Aurora Serverless is the more cost-effective and fully managed solution for this use case.

Exam trap

The trap here is that candidates may choose Multi-AZ RDS with read replicas (option A) thinking it handles spikes via read scaling, but they overlook that write spikes still require manual compute scaling, whereas Aurora Serverless is the only option that automatically scales both compute and cost for variable traffic.

How to eliminate wrong answers

Option B is wrong because Amazon RDS does not support automatic scaling of compute resources; it only supports storage auto-scaling, so a Single-AZ instance would still require manual scaling or over-provisioning to handle spikes. Option C is wrong because DynamoDB is a NoSQL database, not a relational database, and the question explicitly requires a relational database. Option D is wrong because using a large instance size for a Single-AZ instance leads to over-provisioning and higher costs during low-traffic periods, failing to minimize costs while handling variable traffic.

Full explanation →
163
Multi-Selectmedium

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Select 2 answers
A.Allow all users to assume cross-account roles for easier management.
B.Share the same VPC across all OUs to simplify networking.
C.Use separate AWS accounts for each environment to provide strong isolation.
D.Use resource tagging to isolate environments instead of accounts.
E.Apply separate SCPs to each OU to enforce different security policies.
AnswersC, E

Separate accounts provide the best isolation between environments.

Why this answer

Using separate AWS accounts for each environment provides strong isolation at the AWS account boundary, which is the most secure and recommended practice for preventing production workloads from being impacted by changes in other environments. Account-level isolation ensures that IAM policies, resource limits, and service quotas are independent, and that no cross-account resource sharing can accidentally affect production.

Exam trap

The trap here is that candidates often confuse logical isolation (like tagging or VPC sharing) with the strong, account-level isolation required for production workloads, and may overlook that SCPs are the correct mechanism to enforce different security policies per OU.

Full explanation →
164
Multi-Selectmedium

A company is building a serverless data processing pipeline using AWS Lambda, Amazon DynamoDB, and Amazon S3. The pipeline processes JSON files uploaded to an S3 bucket, transforms the data, and writes results to DynamoDB. The company wants to ensure the pipeline can handle bursts of traffic without data loss. Which TWO design decisions should the solutions architect make?

Select 2 answers
A.Configure DynamoDB with on-demand capacity mode.
B.Use an Amazon SQS queue to buffer events from S3 before processing by Lambda.
C.Increase the Lambda function timeout to 15 minutes.
D.Use DynamoDB Streams to capture changes and process in batches.
E.Enable S3 Transfer Acceleration on the bucket.
AnswersA, B

On-demand capacity automatically scales to handle bursts without throttling.

Why this answer

DynamoDB on-demand capacity mode (Option A) automatically scales read/write throughput to handle traffic spikes without requiring capacity planning or risking throttling. This is essential for a serverless pipeline that experiences bursts of traffic, as it prevents data loss by ensuring writes always succeed without ProvisionedThroughputExceededException errors.

Exam trap

The trap here is that candidates may confuse DynamoDB Streams with a buffering mechanism for incoming writes, when in fact streams only capture post-write changes and do not prevent data loss from S3 event delivery failures.

Full explanation →
165
MCQmedium

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically deleted after 30 days. The current lifecycle policy is configured to expire objects after 30 days, but objects are not being deleted. What is the most likely cause?

A.The bucket has versioning enabled, and lifecycle rules apply only to current versions.
B.The objects are stored in the S3 Glacier Deep Archive storage class.
C.The bucket has S3 Object Lock enabled with a retention period exceeding 30 days.
D.The IAM role used by S3 Lifecycle lacks the s3:DeleteObject permission.
AnswerC

Object Lock prevents object deletion before retention expires.

Why this answer

S3 Object Lock with a retention period exceeding 30 days prevents lifecycle expiration until the retention period ends. Option A is incorrect: when versioning is enabled, lifecycle expiration still applies – S3 creates a delete marker for the current version and permanently deletes noncurrent versions based on the noncurrent days configuration. Option B is incorrect: storage class (including Glacier Deep Archive) does not block expiration; objects in any class can be expired.

Option D is incorrect: S3 Lifecycle does not use an IAM role; it operates under the bucket's permissions, and while a bucket policy denying s3:DeleteObject could block deletion, the issue described is not with an IAM role.

Full explanation →
166
MCQeasy

A company is migrating a web application to AWS. They want to use the same domain name for both the development and production environments, but route traffic based on the source IP address. Which AWS service can accomplish this?

A.Amazon Route 53 with geolocation routing policy
B.Elastic Load Balancer (ELB)
C.AWS Global Accelerator
D.Amazon CloudFront
AnswerA

Route 53 can route based on the geographic location of the client's IP.

Why this answer

Amazon Route 53 with geolocation routing policy allows you to route traffic based on the geographic location of the source IP address, which meets the requirement of using the same domain name for different environments based on client IP. ELB distributes traffic within a region and does not consider source IP for routing. AWS Global Accelerator uses anycast IPs and cannot route based on source IP.

Amazon CloudFront is a CDN that can cache content but cannot route based on source IP at the DNS level.

Full explanation →
167
MCQhard

An SCP is attached to a production OU. An IAM user in a member account under that OU attempts to launch an m5.large EC2 instance. What happens?

A.The launch succeeds because the condition evaluates to true.
B.The launch succeeds because the SCP only denies StartInstances.
C.The launch fails because the SCP denies the action.
D.The launch succeeds because the SCP allows all instance types except t3.micro.
AnswerC

The condition matches, so the deny is applied.

Why this answer

The SCP explicitly denies the ec2:RunInstances action for any instance type except t3.micro. Since the user attempts to launch an m5.large, the condition does not match, so the default deny applies, and the launch fails. SCPs are evaluated before IAM policies, and an explicit deny in an SCP overrides any allow.

Exam trap

The trap here is that candidates may misinterpret the condition logic, thinking the SCP allows all instance types except t3.micro, when in fact it denies all except t3.micro, causing the m5.large launch to fail.

How to eliminate wrong answers

Option A is wrong because the condition evaluates to false for m5.large, not true, so the deny effect applies. Option B is wrong because the SCP denies RunInstances, not StartInstances, and the launch action is RunInstances. Option D is wrong because the SCP does not allow all instance types except t3.micro; it explicitly denies all instance types except t3.micro, meaning only t3.micro is allowed.

Full explanation →
168
Multi-Selecteasy

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

Select 2 answers
A.Enable SSL/TLS for the S3 bucket
B.Configure a bucket policy to enforce encryption
C.Use client-side encryption
D.Use AWS KMS (SSE-KMS)
E.Use S3-Managed Keys (SSE-S3)
AnswersD, E

Correct. SSE-KMS uses AWS KMS to manage encryption keys, providing encryption at rest.

Why this answer

Options D and E are correct. Both SSE-KMS (AWS KMS) and SSE-S3 (S3-Managed Keys) are server-side encryption options that encrypt data at rest in Amazon S3. Option A (SSL/TLS) encrypts data in transit, not at rest.

Option B (bucket policy) controls access permissions but does not provide encryption. Option C (client-side encryption) would encrypt data before sending to S3, but it is not an AWS-managed service and requires client-side implementation; the question focuses on encryption at rest provided by AWS.

Full explanation →
169
MCQmedium

A CloudFormation stack update failed with the above error. What is the likely cause?

A.The S3 bucket does not contain the zip file.
B.The IAM role ARN is incorrect.
C.The timeout value is too high.
D.The runtime is no longer supported by AWS Lambda.
AnswerD

Node.js 14.x is deprecated.

Why this answer

The error message explicitly states that the runtime 'nodejs14.x' is not supported. Option A is wrong because the S3 bucket is not the issue. Option B is wrong because the role ARN is correct.

Option C is wrong because the timeout is within limits.

Full explanation →
170
Multi-Selectmedium

A company is designing a new application that will use Amazon S3 to store user-uploaded images. The application must enforce that all uploads are encrypted in transit and at rest. Additionally, the bucket must be configured to block all public access. Which TWO actions should be taken to meet these requirements?

Select 2 answers
A.Use server-side encryption with customer-provided keys (SSE-C).
B.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
C.Use Amazon CloudFront to serve the images and enforce HTTPS.
D.Create a bucket policy that denies uploads without encryption in transit.
E.Configure the S3 Block Public Access settings to block all public access.
AnswersB, E

Default encryption ensures all objects are encrypted at rest automatically.

Why this answer

Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects stored in the bucket are encrypted at rest automatically, even if the upload request does not include encryption headers. Option E is correct because configuring the S3 Block Public Access settings to block all public access prevents any public access to the bucket and its objects, meeting the requirement to block all public access.

Exam trap

The trap here is that candidates often confuse enforcing encryption in transit (via bucket policy condition aws:SecureTransport) with ensuring encryption at rest (via default encryption), and may overlook that Block Public Access settings are required to explicitly block all public access, even if the bucket policy seems restrictive.

Full explanation →
171
MCQhard

A company is migrating a legacy Windows-based .NET application to AWS. The application uses a SQL Server database and a proprietary authentication mechanism that relies on Active Directory. The company wants to reduce operational overhead and licensing costs. Which combination of AWS services should the architect recommend for the migration?

A.Migrate the application to Amazon EC2 Linux instances and use Amazon Aurora with PostgreSQL compatibility
B.Migrate the application to Amazon EC2 Windows instances and the database to Amazon RDS for SQL Server
C.Containerize the application on Amazon ECS with Windows containers and use Amazon RDS for SQL Server
D.Migrate the application to AWS Elastic Beanstalk for Windows and the database to Amazon RDS for MySQL
AnswerB

This minimizes changes and reduces database overhead and licensing costs through RDS.

Why this answer

Using EC2 for the application (lift-and-shift) and RDS for SQL Server reduces overhead from database management and licensing. Moving to RDS for MySQL would require code changes for compatibility. Moving to Windows containers would require containerization effort.

Moving to Aurora would not support SQL Server.

Full explanation →
172
MCQmedium

A company is using AWS Organizations and wants to allow only specific AWS services to be used in member accounts. The security team needs to block the use of Amazon EC2 and Amazon RDS, but allow all other services. Which SCP configuration should be used?

A.Deny effect with "*" as the action.
B.Deny effect with NotAction set to ec2:* and rds:*.
C.Allow effect with ec2:* and rds:* as the actions.
D.Deny effect with ec2:* and rds:* as the actions.
AnswerD

This denies all EC2 and RDS operations.

Why this answer

AWS SCPs use an explicit deny to block specific services. By applying a Deny effect with ec2:* and rds:* as the actions, the SCP will block all operations for Amazon EC2 and Amazon RDS in the member accounts, while allowing all other services by default (since SCPs do not grant permissions; they only filter what is allowed by IAM policies).

Exam trap

The trap here is that candidates confuse NotAction with a targeted deny, mistakenly thinking it blocks only the specified services, when in fact NotAction denies everything except those services.

How to eliminate wrong answers

Option A is wrong because a Deny effect with '*' as the action would block all AWS services, not just EC2 and RDS. Option B is wrong because NotAction with ec2:* and rds:* would deny everything except EC2 and RDS, which is the opposite of the requirement. Option C is wrong because an Allow effect in an SCP does not override an implicit deny; SCPs are deny-only filters and cannot grant permissions, so this would not block EC2 and RDS.

Full explanation →
173
MCQhard

A company is modernizing its application by migrating from a monolithic architecture to microservices on Amazon ECS Fargate. The application uses an on-premises Oracle database, which is being migrated to Amazon Aurora PostgreSQL as part of the modernization. The team has refactored the application into several microservices, each with its own database schema in the same Aurora cluster. During load testing, the team notices that one microservice's heavy write operations cause increased latency for other microservices' read queries. The Aurora cluster uses a single writer and multiple readers. The team needs to isolate the write-heavy microservice without changing the application code. What should the solutions architect do?

A.Use Amazon RDS Proxy to manage database connections.
B.Create a separate Aurora cluster for the write-heavy microservice and point the microservice to that cluster.
C.Configure Aurora read replicas to offload read queries from the writer.
D.Increase the instance size of the Aurora writer to handle the write load.
AnswerB

A separate cluster provides complete isolation of write operations.

Why this answer

Using a separate Aurora cluster for the write-heavy microservice physically isolates the workload, preventing impact on other microservices. The application code points to different cluster endpoints. Using a larger instance might help but does not isolate; read replicas do not help with write contention; RDS Proxy is for connection pooling, not isolation.

Full explanation →
174
MCQhard

A company is designing a multi-region disaster recovery solution for a critical application. The application uses Amazon RDS for MySQL with Multi-AZ in the primary region. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

A.Create an RDS MySQL cross-region read replica in the secondary region and promote it during a disaster.
B.Take manual snapshots of the RDS instance every 5 seconds and copy them to the secondary region.
C.Use AWS Database Migration Service (DMS) to continuously replicate to a database in the secondary region.
D.Use Amazon Aurora Global Database with a primary instance in the primary region and one secondary in the secondary region.
AnswerD

Aurora Global Database provides low-latency replication and fast failover.

Why this answer

Amazon Aurora Global Database is the only solution that can achieve an RPO of 5 seconds and an RTO of 1 minute for a multi-region disaster recovery setup. It uses storage-based replication with typical latency under 1 second, and failover to a secondary region can be completed in about 1 minute by promoting the secondary cluster. Aurora Global Database also avoids the replication lag and promotion delays inherent in cross-region read replicas or DMS-based replication.

Exam trap

The trap here is that candidates often assume a cross-region read replica (Option A) can meet a 5-second RPO because MySQL replication is 'near real-time,' but in practice, replication lag is unpredictable and often exceeds 5 seconds, especially during peak loads or network issues.

How to eliminate wrong answers

Option A is wrong because an RDS MySQL cross-region read replica typically has replication lag of several seconds to minutes, making it impossible to guarantee a 5-second RPO, and promoting a read replica takes longer than 1 minute due to the need to stop replication and apply any pending changes. Option B is wrong because manual snapshots cannot be taken every 5 seconds (the minimum interval is 5 minutes for automated snapshots, and manual snapshots have no such frequency guarantee), and copying snapshots to another region adds significant delay, far exceeding the 5-second RPO. Option C is wrong because AWS DMS continuous replication introduces latency that often exceeds 5 seconds, and the failover process to promote the target database as the primary typically takes more than 1 minute, especially if schema changes or data consistency checks are required.

Full explanation →
175
MCQeasy

A company has a management account and several member accounts in AWS Organizations. They want to allow a developer in a member account to create an organization trail. What should they do?

A.Register the member account as a delegated administrator for CloudTrail in AWS Organizations.
B.Create a resource-based policy on the CloudTrail service to allow the member account to create trails.
C.Create an IAM role in the management account and grant the developer permission to assume it.
D.Attach an SCP to the member account that allows CloudTrail actions.
AnswerA

Allows the member account to create organization trails.

Why this answer

Registering a member account as a delegated administrator for CloudTrail in AWS Organizations allows that account to create organization trails on behalf of the management account. This delegation grants the member account the necessary permissions to call CreateTrail with the OrganizationTrail parameter set to true, which is required for organization-wide logging.

Exam trap

The trap here is that candidates often assume creating an IAM role in the management account (Option C) is sufficient, but they miss that organization trails require the member account to be explicitly registered as a delegated administrator in AWS Organizations to bypass the default restriction that only the management account can create organization trails.

How to eliminate wrong answers

Option B is wrong because CloudTrail does not support resource-based policies; it uses IAM policies and service-linked roles for access control. Option C is wrong because while an IAM role in the management account could be assumed, this approach does not enable the member account to create an organization trail directly—organization trails require the member account to be a delegated administrator or have explicit permissions from Organizations. Option D is wrong because SCPs are used to restrict permissions, not to grant them; attaching an SCP that allows CloudTrail actions would not grant the developer the ability to create an organization trail without additional IAM permissions.

Full explanation →
176
MCQmedium

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

A.Amazon CloudFront
B.AWS Global Accelerator
C.AWS Shield Advanced
D.AWS WAF
AnswerA

CloudFront caches content at edge locations, reducing latency and offloading EC2 instances.

Why this answer

CloudFront is a CDN that caches content at edge locations, reducing latency and offloading traffic. Option B is wrong because Global Accelerator improves performance via AWS global network but does not cache. Option C is wrong because Shield Advanced is for DDoS protection.

Option D is wrong because WAF is a web application firewall.

Full explanation →
177
MCQhard

A global company with 50 AWS accounts uses AWS Organizations and wants to centralize CloudTrail logs. The security team requires that all accounts send their CloudTrail logs to a central S3 bucket in the audit account. Which combination of steps will ensure this?

A.Use AWS Config to forward logs to a central S3 bucket.
B.Enable CloudTrail in each account and use AWS Organizations to aggregate logs.
C.Create a CloudTrail trail in the audit account that logs all accounts via CloudWatch Logs.
D.Create a CloudTrail trail in the audit account with an S3 bucket, and add a bucket policy that grants cross-account permissions for each member account to deliver logs. Then configure each member account to use the same trail.
AnswerD

This is the standard cross-account CloudTrail setup.

Why this answer

It uses a single CloudTrail trail in the audit account with a central S3 bucket, and the bucket policy grants the necessary s3:PutObject permissions to each member account's CloudTrail service principal. Each member account then configures CloudTrail to use the same trail (the audit account's trail), which allows CloudTrail to deliver logs from all accounts to the central bucket without requiring separate trails or manual log forwarding.

Exam trap

The trap here is that candidates often think they need to enable CloudTrail in each account individually (Option B) or use a different service like AWS Config (Option A), when the correct approach is to create a single organization trail in the audit account with cross-account permissions and have member accounts reference that trail.

How to eliminate wrong answers

Option A is wrong because AWS Config is a configuration auditing service, not a log delivery mechanism; it cannot forward CloudTrail logs to an S3 bucket. Option B is wrong because enabling CloudTrail in each account individually would create separate trails and separate log deliveries, not centralize logs into a single bucket; AWS Organizations can aggregate trails only when a single organization trail is created from the management account. Option C is wrong because CloudTrail cannot log all accounts via CloudWatch Logs; CloudWatch Logs is a destination for CloudTrail logs, not a mechanism to aggregate logs from multiple accounts.

Full explanation →
178
MCQeasy

An organization is modernizing a legacy application by breaking it into microservices on AWS. The application processes customer orders and sends notifications. The team wants to decouple the order processing from the notification service to improve scalability. Which AWS service should they use to asynchronously pass messages between the services?

A.Amazon Kinesis Data Streams
B.Amazon EventBridge
C.Amazon Simple Notification Service (Amazon SNS)
D.Amazon Simple Queue Service (Amazon SQS)
AnswerD

SQS provides a durable message queue that decouples the order processing service from the notification service, allowing asynchronous processing.

Why this answer

Amazon SQS is a fully managed message queue service that enables decoupling of application components. SNS is pub/sub; EventBridge is event bus; Kinesis is for real-time streaming. For simple point-to-point async messaging, SQS is the best fit.

Full explanation →
179
Multi-Selectmedium

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences high request latency during peak traffic. A solutions architect discovers that the ALB is not distributing traffic evenly across the instances. The instances have different sizes (t3.large and t3.xlarge). Which TWO actions should the solutions architect take to improve load distribution?

Select 2 answers
A.Enable connection draining on the target group.
B.Replace all instances with the same instance type.
C.Change the ALB routing algorithm from round robin to least outstanding requests.
D.Enable sticky sessions (session affinity) on the target group.
E.Increase the deregistration delay (connection draining) on the target group to 300 seconds.
AnswersB, C

Using the same instance type eliminates capacity differences, allowing round-robin to distribute evenly.

Why this answer

The correct answers are B and C. Option B: Using the same instance type ensures uniform capacity, so round-robin routing distributes traffic evenly. Option C: Changing the routing algorithm to least outstanding requests (LOR) distributes traffic based on pending requests, naturally giving more traffic to larger instances (t3.xlarge) and balancing load despite size differences.

Option A (connection draining) helps with graceful deregistration but does not improve distribution. Option D (sticky sessions) worsens distribution by pinning users. Option E (increasing deregistration delay) does not affect distribution.

Exam trap

Candidates often mistake connection draining for a load-distribution mechanism. It only handles in-flight requests during deregistration.

Full explanation →
180
MCQhard

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

A.Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.
B.Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.
C.Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.
D.Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.
AnswerD

Client-side encryption with the AWS Encryption SDK encrypts data before upload, ensuring at-rest encryption. Secrets Manager can store the keys and automatically rotate them every 90 days with no custom code. CloudTrail logs all Secrets Manager access, providing an audit trail of key usage. This meets all requirements with least operational overhead.

Why this answer

Meets all requirements with the least operational overhead. Client-side encryption with the AWS Encryption SDK ensures data is encrypted at rest. Keys are stored in AWS Secrets Manager, which supports automatic rotation on a custom 90-day schedule.

CloudTrail logs all Secrets Manager API calls, providing an audit trail of key usage. Option A requires custom Lambda code for rotation. Option B uses SSE-S3, which cannot be rotated on a 90-day schedule and lacks key usage audit.

Option C uses SSE-KMS, but automatic rotation for customer managed keys is fixed at 365 days, failing the 90-day requirement.

Exam trap

The trap here is that candidates may think SSE-S3 (Option B) is sufficient because it encrypts data at rest, but they overlook the requirement for a specific 90-day rotation schedule and detailed key usage audit trail, which SSE-S3 cannot provide.

How to eliminate wrong answers

Option A is wrong because SSE-C requires the customer to manage and provide encryption keys with each S3 request, and implementing a Lambda function to rotate keys every 90 days introduces significant operational overhead and does not natively provide an audit trail of key usage. Option B is wrong because SSE-S3 uses S3-managed keys that are rotated automatically by AWS but do not support customer-controlled rotation schedules (they are rotated at least annually, not every 90 days) and S3 server access logs do not provide a detailed audit trail of key usage. Option D is wrong because client-side encryption with the AWS Encryption SDK requires managing encryption logic in the application, and storing keys in Secrets Manager with automatic rotation adds complexity and operational overhead compared to a fully managed server-side solution.

Full explanation →
181
MCQmedium

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

A.Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.
B.Create a separate pipeline in each account using the same source repository.
C.Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.
AnswerA

Correct. A central DevOps account with cross-account IAM roles aligns with AWS best practices for multi-account environments, especially with Control Tower, providing centralized management and security.

Why this answer

The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity.

Therefore, only Option A fully meets the requirements.

Exam trap

Candidates may think that both A and C are correct, but the question asks for the 'most secure and scalable' approach. Option A explicitly centralizes the pipeline in a dedicated account, which is superior for governance and scalability in a Control Tower setup.

How to eliminate wrong answers

Option B is wrong because creating a separate pipeline in each account duplicates infrastructure, increases management overhead, and does not use a shared artifact store or source repository consistently, leading to potential drift and inconsistency. Option C is wrong because while it mentions cross-account actions, it is essentially the same as Option A but less specific about the central account pattern; however, the question asks for the MOST secure and scalable approach, and Option A explicitly describes the best practice of a central DevOps account with cross-account IAM roles, which is more aligned with AWS Control Tower's multi-account governance model than simply using cross-account actions in CodePipeline without a dedicated central account.

Full explanation →
182
MCQhard

A company is migrating a legacy application that uses a proprietary binary protocol over TCP. They want to modernize to a containerized microservices architecture on Amazon EKS. The protocol must be preserved for backward compatibility. Which approach should they take?

A.Use Amazon API Gateway to expose the legacy service as a REST API
B.Deploy a sidecar proxy container in the same pod to translate the protocol
C.Refactor the legacy application to use HTTP
D.Use a Network Load Balancer to route TCP traffic to the legacy container
AnswerB

Correct approach. The sidecar can handle the proprietary protocol and translate it to HTTP for other microservices while preserving backward compatibility.

Why this answer

A sidecar proxy running on the same pod as the legacy container can handle the proprietary protocol and translate it to HTTP for other microservices. Option A (API Gateway) requires HTTP, which is not suitable. Option C (Refactor the protocol) is too risky and time-consuming.

Option D (Network Load Balancer) cannot translate protocols; it only forwards TCP traffic at layer 4.

Full explanation →
183
Multi-Selecteasy

A company is migrating a large number of on-premises virtual machines to AWS. The company wants to automate the migration process and reduce manual effort. Which TWO AWS services can be used together to achieve this goal? (Choose TWO.)

Select 2 answers
A.AWS Database Migration Service (DMS)
B.AWS CloudFormation
C.AWS Application Migration Service (MGN)
D.AWS DataSync
E.AWS Schema Conversion Tool (SCT)
AnswersB, C

CloudFormation automates infrastructure deployment.

Why this answer

AWS Application Migration Service (MGN) and AWS CloudFormation are correct. MGN automates the migration of virtual machines from on-premises to AWS. CloudFormation automates the provisioning of AWS infrastructure using infrastructure as code.

AWS DMS is for database migrations, not server migration. AWS DataSync is for file transfers. AWS SCT is for schema conversion.

Full explanation →
184
MCQmedium

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

A.Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.
B.Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.
C.Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.
D.Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.
AnswerB

Firewall Manager can enforce security group rules centrally.

Why this answer

AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Exam trap

The trap here is that candidates often confuse AWS Firewall Manager's audit-only mode (which generates reports) with its enforcement mode (which automatically creates and manages security groups), leading them to choose the reporting option instead of the correct enforcement option.

How to eliminate wrong answers

Option A is wrong because AWS Config rules with Lambda remediation are reactive—they detect non-compliant resources after creation and then attempt to fix them, which is not a preventive enforcement mechanism and can introduce latency or race conditions. Option C is wrong because auditing and generating reports only provides visibility into non-compliance but does not actively enforce the policy or prevent insecure security groups from being used. Option D is wrong because SCPs cannot deny specific API actions like ec2:AuthorizeSecurityGroupIngress based on port numbers or IP ranges; SCPs operate at the API action level and cannot inspect the parameters of the request, so they cannot block opening a specific port to the internet.

Full explanation →
185
Multi-Selectmedium

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

Select 3 answers
A.Enable S3 default encryption with SSE-KMS.
B.Use client-side encryption with a customer key.
C.Use bucket policies to restrict access based on IAM roles.
D.Configure the bucket policy to deny requests that do not use HTTPS.
E.Make the bucket publicly accessible for ease of access.
AnswersA, C, D

Encrypts data at rest with KMS-managed keys.

Why this answer

Enabling S3 default encryption with SSE-KMS ensures that all objects stored in the bucket are encrypted at rest using AWS Key Management Service (KMS) keys. This provides centralized key management, auditability via AWS CloudTrail, and the ability to enforce encryption policies without requiring client-side changes.

Exam trap

The trap here is that candidates may confuse client-side encryption (which is not an S3-managed encryption option) with server-side encryption, or they may overlook that public access is never acceptable for sensitive data, even if other controls are in place.

Full explanation →
186
MCQmedium

A company is modernizing its infrastructure by moving from EC2 instances to a serverless architecture using AWS Lambda. The application processes images uploaded to Amazon S3. The current EC2-based solution uses a third-party image processing library that is not supported in Lambda's runtime environment. What is the best approach to migrate to serverless while using the same library?

A.Package the library as a Lambda layer and reference it in the function.
B.Use AWS Fargate to run the image processing library in a container.
C.Rewrite the image processing code to use AWS Rekognition.
D.Use AWS App Runner to deploy the existing application as-is.
AnswerA

Lambda layers allow inclusion of custom libraries, enabling use of the third-party library without code changes.

Why this answer

AWS Lambda supports custom runtime environments by bundling the library with the deployment package or using Lambda layers. The library can be included as a layer, allowing the Lambda function to use it. AWS Fargate runs containers but is not serverless in the same sense; it adds overhead.

Using a different library would require code changes. App Runner is for containerized applications.

Full explanation →
187
MCQeasy

A company's IT team uses AWS CloudFormation to deploy infrastructure. They want to enforce tagging standards across all stacks. Which approach should they use?

A.Create an IAM policy that requires tags on all resources and attach it to all IAM users.
B.Configure CloudFormation to reject any stack that does not include tags.
C.Define stack-level tags in CloudFormation templates and use an SCP to deny creation of stacks without required tags.
D.Use AWS Config to detect resources without tags and automatically remediate using Systems Manager Automation.
AnswerC

SCPs can enforce that all stacks have required tags, and stack-level tags propagate to resources.

Why this answer

AWS Organizations Service Control Policies (SCPs) can deny the creation of CloudFormation stacks that do not include required stack-level tags, while stack-level tags defined in the template propagate to all resources created by the stack. This combination enforces tagging standards across all stacks without relying on individual IAM user permissions or post-creation remediation.

Exam trap

The trap here is that candidates often choose AWS Config (Option D) because it is a common tagging enforcement tool, but they overlook that it is reactive and does not prevent non-compliant stacks from being created, whereas SCPs provide preventive enforcement at the organization level.

How to eliminate wrong answers

Option A is wrong because IAM policies attached to users can be bypassed if users have permissions to create resources via CloudFormation with a service role that overrides user-level permissions, and IAM policies cannot enforce tags on resources created by CloudFormation if the stack itself is created without tags. Option B is wrong because CloudFormation does not have a native configuration to reject stacks based on missing tags; it only supports stack-level tags as optional metadata and will create stacks without tags if no tags are specified. Option D is wrong because AWS Config detects resources without tags after they are created, which is reactive rather than preventive, and automatic remediation via Systems Manager Automation may not cover all resource types or may incur additional costs and delays.

Full explanation →
188
MCQeasy

A company is migrating a monolithic application to AWS and wants to adopt a microservices architecture. The application currently runs on a single server and uses a shared MySQL database. Which AWS service can help the company decouple the microservices and enable asynchronous communication?

A.Amazon API Gateway
B.AWS Step Functions
C.Elastic Load Balancing
D.Amazon Simple Queue Service (SQS)
AnswerD

Amazon SQS is a message queue service that enables asynchronous communication, making it ideal for decoupling microservices.

Why this answer

Amazon Simple Queue Service (SQS) is a message queue service that enables asynchronous communication between microservices, which is essential for decoupling components in a microservices architecture. Amazon API Gateway is used for creating RESTful APIs, not for asynchronous messaging. AWS Step Functions orchestrates workflows but does not provide a message queue for asynchronous communication.

Elastic Load Balancing distributes incoming traffic across targets, not for decoupling services via messaging.

Full explanation →
189
MCQhard

Refer to the exhibit. A solutions architect runs the AWS CLI command and receives the output shown. The instance was stopped 2 hours ago. The company wants to minimize costs. What should the architect do next?

A.Keep the instance stopped; only storage costs apply.
B.Terminate the instance to avoid any further charges.
C.Start the instance to verify it works.
D.Hibernate the instance to save memory state.
AnswerA

Correct. A stopped instance does not incur instance charges, only storage costs for EBS volumes.

Why this answer

When an EC2 instance is stopped, you are not charged for instance usage hours, but you continue to pay for any attached EBS volumes. Thus, keeping the instance stopped minimizes costs while retaining the instance configuration and data. Option B (terminate) would delete the instance and its attached volumes, potentially incurring data loss and additional costs for snapshots.

Option C (start) would resume instance charges and EBS volume costs. Option D (hibernate) is not available from a stopped state; hibernation can only be initiated from a running instance and saves the memory state to an EBS volume, but it also incurs charges for that volume.

Full explanation →
190
MCQhard

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

A.Deploy all microservices in a new VPC and cut over DNS after testing.
B.Create a new version of the monolith that calls Lambda functions as backend.
C.Use AWS CodeDeploy to perform a blue/green deployment of the monolith to Lambda.
D.Use the strangler fig pattern: implement API Gateway to route traffic to new Lambda functions for specific endpoints while keeping the monolith for others.
AnswerD

Allows incremental migration without downtime.

Why this answer

The strangler fig pattern allows incremental migration by routing specific API requests to new Lambda functions via API Gateway while keeping the monolithic application for the rest. This approach avoids downtime. Option A is incorrect because deploying all microservices in a new VPC and cutting over DNS risks downtime and is not incremental.

Option B is incorrect because creating a new version of the monolith that calls Lambda functions still leaves the monolith in place and does not fully utilize API Gateway for routing. Option C is incorrect because CodeDeploy blue/green deployment is for deploying to EC2 or Lambda, but it does not provide a pattern for incremental migration of a monolith to microservices; the strangler fig pattern is more appropriate.

Full explanation →
191
MCQmedium

A company wants to centralize access control for multiple AWS accounts using AWS Organizations. They need to allow developers in a specific account to launch EC2 instances only in certain regions. What is the most scalable solution?

A.Create an IAM role in each account with a policy to deny non-compliant regions.
B.Use AWS Config rules to detect and terminate instances in non-compliant regions.
C.Use an SCP attached to the organizational unit to deny EC2 actions in non-compliant regions.
D.Create an IAM policy in each account to deny non-compliant regions.
AnswerC

SCPs provide centralized policy enforcement across accounts in an organization.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally define the maximum permissions for all accounts in an organizational unit (OU). By attaching an SCP that denies EC2 actions in non-compliant regions, you enforce the restriction across multiple accounts without needing to manage individual IAM policies or roles, making it the most scalable solution.

Exam trap

The trap here is that candidates often choose detective solutions like AWS Config (Option B) or per-account IAM policies (Options A and D) because they are familiar, but they miss that SCPs provide a centralized, preventive, and scalable control that applies to all principals, including the root user.

How to eliminate wrong answers

Option A is wrong because creating an IAM role in each account still requires per-account management and does not prevent the root user or other principals from launching instances in non-compliant regions; SCPs apply to all principals including the root user. Option B is wrong because AWS Config rules are detective, not preventive; they can detect and terminate instances after launch, but this is reactive and does not prevent the initial launch, leading to potential cost and security exposure. Option D is wrong because creating an IAM policy in each account requires manual per-account configuration and does not scale; it also cannot restrict the root user, whereas SCPs apply to all principals in the account.

Full explanation →
192
MCQeasy

A company uses AWS Organizations and wants to centrally manage backups for EC2 instances across multiple accounts. They want to create a backup plan that backs up all EC2 instances tagged with Backup=Weekly. The backup must be stored in a central backup vault in the management account. Which solution meets these requirements?

A.Create a backup plan in each account targeting the tagged instances and store backups in the management account's vault using cross-account backup.
B.Use AWS CloudFormation StackSets to deploy a backup plan to each account.
C.Use AWS Backup with a backup policy in AWS Organizations to centrally manage backups across accounts.
D.Use Amazon Data Lifecycle Manager to create cross-account snapshot copies for tagged instances.
AnswerC

AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags.

Why this answer

AWS Backup can be configured across accounts using backup policies in AWS Organizations, which can apply a backup plan to resources in member accounts based on tags. Option A is wrong because creating a backup plan in each account is not central management and requires manual setup. Option B is wrong because CloudFormation StackSets deploy infrastructure but do not dynamically manage backups based on tags.

Option D is wrong because Amazon Data Lifecycle Manager is for automated EBS snapshots, not for centralized backup management across accounts.

Full explanation →
193
MCQmedium

A company is running a batch processing job on an EC2 instance that processes data from an S3 bucket and writes results to another S3 bucket. The job runs once per hour and takes about 20 minutes. The company wants to optimize costs by only paying for compute time when the job is running. Which solution is MOST cost-effective?

A.Convert the batch job into an AWS Lambda function.
B.Purchase a Reserved Instance for the EC2 instance to reduce hourly cost.
C.Use a t3.micro instance and keep it running 24/7 since it's low cost.
D.Use AWS Batch with spot instances to run the job only when needed.
AnswerD

Pay only for compute time, spot reduces cost.

Why this answer

AWS Batch automatically provisions and terminates EC2 instances based on job queue requirements, and it can use Spot Instances for significant cost savings. Option A (AWS Lambda) is wrong because the batch job takes 20 minutes, exceeding the 15-minute maximum execution time for Lambda functions. Option B (Reserved Instance) is wrong because it requires a 1-year commitment and still incurs costs for idle hours when the job is not running.

Option C (t3.micro running 24/7) is wrong because while it is low-cost, it still charges for idle time, making it less cost-effective than only paying for compute during job execution.

Full explanation →
194
MCQmedium

A company uses AWS Control Tower to manage a multi-account environment. They want to ensure that all accounts are enrolled in AWS Shield Advanced for DDoS protection. What is the MOST efficient way to achieve this?

A.Use AWS Control Tower Account Factory Customization to deploy a CloudFormation template that enables Shield Advanced.
B.Manually enable Shield Advanced in each account after creation.
C.Use AWS Config to detect accounts without Shield Advanced and send notifications.
D.Use AWS Organizations to create an SCP that requires Shield Advanced.
AnswerA

This automates the setup for all new and existing accounts.

Why this answer

AWS Control Tower Account Factory Customization (AFC) allows you to automatically apply AWS CloudFormation templates to accounts as they are created or updated in the landing zone. By deploying a CloudFormation template that subscribes each account to AWS Shield Advanced, you ensure consistent, automated DDoS protection across all accounts without manual intervention. This is the most efficient method because it integrates directly with the account provisioning lifecycle.

Exam trap

The trap here is that candidates often confuse SCPs with proactive resource provisioning, assuming an SCP can enable a service, when in reality SCPs only control permissions and cannot perform actions like subscribing to Shield Advanced.

How to eliminate wrong answers

Option B is wrong because manually enabling Shield Advanced in each account after creation is inefficient, error-prone, and does not scale in a multi-account environment. Option C is wrong because AWS Config can only detect non-compliance and send notifications; it cannot automatically enable Shield Advanced, so it requires additional manual or automated remediation steps, making it less efficient than a proactive deployment. Option D is wrong because AWS Organizations Service Control Policies (SCPs) can only restrict permissions (e.g., deny disabling Shield Advanced) but cannot enable a service or perform actions like subscribing to Shield Advanced; SCPs are not capable of provisioning resources.

Full explanation →
195
MCQmedium

A company is designing a highly available application on AWS that uses an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application requires that the client's IP address be preserved in the application logs. The company also needs to perform SSL termination at the load balancer. How should the company configure the ALB to meet these requirements?

A.Use TCP listener on port 443 and forward to instances on port 80. Enable proxy protocol v2.
B.Use TCP listener on port 443 and forward to instances on port 443. Install SSL certificate on instances.
C.Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 443. Disable proxy protocol.
D.Use HTTPS listener on port 443, provide the SSL certificate, and forward to instances on port 80. Enable X-Forwarded-For header.
AnswerD

ALB terminates SSL and passes client IP via X-Forwarded-For.

Why this answer

Using an HTTPS listener on port 443 with SSL termination at the ALB allows the load balancer to decrypt traffic and forward it as HTTP on port 80. The X-Forwarded-For header is automatically added by the ALB to preserve the original client IP address in the application logs, meeting both requirements without additional configuration.

Exam trap

The trap here is that candidates often confuse TCP listeners with proxy protocol v2 as the only way to preserve client IP, overlooking that HTTPS listeners automatically provide the X-Forwarded-For header for client IP preservation when SSL termination is performed at the load balancer.

How to eliminate wrong answers

Option A is wrong because a TCP listener does not support SSL termination at the load balancer; it forwards encrypted traffic as-is, and proxy protocol v2 is used with TCP listeners to preserve client IP, but this does not meet the SSL termination requirement. Option B is wrong because using a TCP listener on port 443 and forwarding to instances on port 443 with SSL certificates on instances means SSL termination occurs on the instances, not at the load balancer, and client IP is not preserved without proxy protocol. Option C is wrong because forwarding HTTPS traffic on port 443 to instances on port 443 with SSL certificates on instances means SSL termination is performed on the instances, not at the load balancer, and disabling proxy protocol does not preserve the client IP via X-Forwarded-For.

Full explanation →
196
Multi-Selecthard

A company runs a critical application on Amazon ECS with Fargate launch type. The application needs to be highly available across multiple Availability Zones. The company wants to implement blue/green deployments to minimize downtime. Which THREE steps should the solutions architect take?

Select 3 answers
A.Store the application artifacts in Amazon ECR and use an ECS service with a single task definition.
B.Use a Network Load Balancer to route traffic to the ECS service.
C.Create two separate ECS task definitions for the blue and green environments.
D.Use AWS CodeDeploy with a blue/green deployment configuration.
E.Configure an Application Load Balancer with a target group for each task set.
AnswersC, D, E

Creating two separate ECS task definitions allows independent updates for blue and green environments, which is essential for blue/green deployments.

Why this answer

Options C, D, and E are correct because blue/green deployments for ECS require separate task definitions for each environment (C), CodeDeploy to manage traffic shifting (D), and an Application Load Balancer with separate target groups for each task set to route traffic (E). Option A is incorrect because storing artifacts in ECR is about container images, not a deployment step. Option B is incorrect because using a load balancer is a prerequisite for any ECS service, but it is not one of the specific steps required to implement blue/green deployments.

The blue/green-specific steps are C, D, and E.

Full explanation →
197
Multi-Selecteasy

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

Select 2 answers
A.Amazon DocumentDB (with MongoDB compatibility)
B.Amazon ElastiCache
C.Amazon DynamoDB
D.Amazon Aurora
E.Amazon RDS for MySQL
AnswersB, C

ElastiCache (Redis or Memcached) provides in-memory caching for low latency.

Why this answer

Amazon ElastiCache provides an in-memory caching layer (e.g., Redis or Memcached) that can absorb read-heavy traffic spikes with sub-millisecond latency, offloading reads from the primary database. Amazon DynamoDB is a fully managed NoSQL database that delivers consistent single-digit millisecond latency at any scale, supports auto-scaling for traffic spikes, and handles high write throughput via its distributed architecture.

Exam trap

The trap here is that candidates often choose Amazon Aurora or RDS for MySQL because they are familiar with SQL databases, but they overlook the requirement for single-digit millisecond latency and high throughput under spikes, which in-memory caching and NoSQL solutions like ElastiCache and DynamoDB are specifically designed to meet.

Full explanation →
198
MCQeasy

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single Windows Server with IIS and SQL Server. The company wants to adopt a microservices architecture on AWS using containers. The development team has containerized the application into several Docker containers. The company needs a solution that minimizes operational overhead for managing the container orchestration and scaling, and also integrates with AWS services like IAM, CloudWatch, and VPC. Which AWS service should the company use to run the containers?

A.Amazon ECS with the Fargate launch type.
B.Amazon EKS with managed node groups.
C.AWS Elastic Beanstalk with a Docker platform.
D.Amazon EC2 instances with Docker installed, managed by an Auto Scaling group.
AnswerA

Fargate is serverless, reducing operational overhead, and integrates well with AWS services.

Why this answer

(Amazon ECS with the Fargate launch type) is correct because it provides serverless container orchestration, eliminating the need to manage underlying infrastructure, integrates natively with AWS services like IAM, CloudWatch, and VPC, and is ideal for microservices. Option B (EKS with managed node groups) still requires managing Kubernetes control plane and worker nodes, adding operational overhead. Option C (Elastic Beanstalk with Docker) is better suited for simpler, single-container deployments and lacks fine-grained control for microservices.

Option D (EC2 instances with Docker and Auto Scaling) requires managing EC2 instances, patching, and scaling, increasing operational burden.

Full explanation →
199
MCQeasy

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

A.Replace the instance store volume with an Amazon EBS volume, create an AMI, and use Auto Scaling with an Application Load Balancer.
B.Attach an Amazon EBS volume and configure the application to write to it, then take periodic EBS snapshots.
C.Use AWS Backup to schedule backups of the instance and restore to a new instance if needed.
D.Create an AMI from the instance and launch a second instance in a different Availability Zone behind an Application Load Balancer.
AnswerA

EBS provides persistent storage, and Auto Scaling with ALB improves availability and disaster recovery.

Why this answer

The most cost-effective solution with minimal architectural changes. By replacing the ephemeral instance store with an EBS volume, the data becomes persistent. Then creating an AMI and using Auto Scaling with an Application Load Balancer provides high availability and disaster recovery automatically.

Option B only adds backups but does not provide high availability, and restoring from snapshots is slower. Option C, AWS Backup, cannot back up instance store data directly, so it is ineffective. Option D provides high availability but still uses instance store, so data is lost on instance failure; it also does not address data persistence.

Therefore, Option A is correct.

Full explanation →
200
MCQmedium

A company is migrating a critical application to AWS and needs to ensure that the migration has minimal downtime. The application uses a SQL Server database. The company wants to use AWS Database Migration Service (DMS) for the migration. What should the company do to minimize downtime during the database migration?

A.Use DMS with validation enabled and then truncate the target before cutover.
B.Use DMS with ongoing replication (change data capture) to keep the target database synchronized, then perform a brief cutover.
C.Use DMS with full load only and schedule the migration during a maintenance window.
D.Perform a full load migration using DMS and then manually copy any remaining data.
AnswerB

Ongoing replication minimizes downtime by continuously syncing changes.

Why this answer

Using change data capture (CDC) with AWS DMS enables ongoing replication of changes from the source SQL Server database to the target. This keeps the target nearly synchronized, so during cutover only a brief pause is needed to apply any final changes, minimizing downtime. Option A is incorrect because enabling validation does not reduce downtime; it only verifies data integrity after migration, and truncating the target before cutover would remove all data, causing potential data loss and additional downtime.

Option C is incorrect because a full load only captures a snapshot of the database at a point in time; any changes after that require a separate sync, leading to longer downtime. Option D is incorrect because manually copying remaining data after a full load migration defeats the purpose of using DMS and introduces significant downtime and risk of inconsistency.

Full explanation →
201
MCQhard

A company is migrating a large-scale .NET application to AWS. The application uses Windows authentication and requires Active Directory integration. The company wants to reduce operational overhead. Which migration approach should they use?

A.Rehost on EC2 with on-premises AD via VPN
B.Rehost on EC2 with AWS Managed Microsoft AD
C.Replatform to use Amazon Cognito for authentication
D.Replatform to AWS Elastic Beanstalk with Amazon Lightsail
AnswerB

Reduces overhead by outsourcing AD management to AWS.

Why this answer

(Rehost on EC2 with AWS Managed Microsoft AD) is correct because it provides Active Directory integration without the need to manage domain controllers, reducing operational overhead. Option A (Rehost on EC2 with on-premises AD via VPN) still requires managing on-premises resources and doesn't fully reduce overhead. Option C (Replatform to use Amazon Cognito) is aimed at web identity federation, not traditional Windows AD authentication.

Option D (Replatform to AWS Elastic Beanstalk with Amazon Lightsail) does not support Windows authentication or AD integration effectively.

Full explanation →
202
MCQhard

A company is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest using a key that is rotated every 90 days. The company wants to use AWS managed services to minimize operational overhead. Which encryption solution should they choose?

A.SSE-C
B.SSE-S3
C.Client-side encryption with AWS KMS
D.SSE-KMS with automatic rotation
AnswerB

SSE-S3 automatically rotates keys every 90 days with no customer management.

Why this answer

SSE-S3 (Amazon S3 managed keys) provides encryption at rest with automatic key rotation every 90 days, meeting the requirement without any operational overhead. The company wants AWS managed services to minimize operational overhead, and SSE-S3 handles key management and rotation entirely on the customer's behalf, with no configuration needed.

Exam trap

The trap here is that candidates often assume SSE-KMS with automatic rotation meets the 90-day requirement, but KMS automatic rotation is fixed at 365 days and cannot be changed, making SSE-S3 the only correct choice for a 90-day rotation policy with zero operational overhead.

How to eliminate wrong answers

Option A is wrong because SSE-C requires the customer to manage and rotate their own encryption keys, increasing operational overhead. Option C is wrong because client-side encryption with AWS KMS requires the application to handle encryption and key management, adding complexity and operational burden. Option D is wrong because SSE-KMS with automatic rotation rotates the KMS key only annually (once per year), not every 90 days as required, and also incurs additional costs and management overhead.

Full explanation →
203
MCQhard

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and connects to an on-premises SQL Server database. The company wants to minimize code changes. Which migration strategy is most appropriate?

A.Replatform the application to use Amazon Aurora PostgreSQL with AWS DMS.
B.Refactor the application into microservices using AWS Lambda and Amazon DynamoDB.
C.Rehost the application on EC2 Windows instances and use Amazon RDS for SQL Server.
D.Re-platform the application to run on Amazon Linux and use Amazon RDS for MySQL.
AnswerC

Rehosting minimizes code changes and supports Windows authentication.

Why this answer

Rehosting on EC2 Windows with RDS SQL Server minimizes changes and supports Windows authentication. Option A is wrong because re-platforming to Linux may break .NET dependencies. Option B is wrong because refactoring to serverless requires significant code changes.

Option D is wrong because moving to Aurora PostgreSQL requires code changes.

Full explanation →
204
MCQmedium

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

A.Disable Multi-AZ to avoid failover altogether.
B.Create a read replica and promote it during failover.
C.Enable Amazon RDS Proxy.
D.Increase the DB instance size to improve performance.
AnswerC

RDS Proxy maintains connections across failovers, reducing downtime.

Why this answer

Enabling Amazon RDS Proxy provides connection pooling and reduces failover time by keeping connections alive during failover. Option A is wrong because disabling Multi-AZ removes high availability and increases downtime. Option B is wrong because read replicas are for read scaling and promoting a replica involves manual intervention and DNS changes, which does not minimize failover time as effectively as RDS Proxy.

Option D is wrong because increasing the DB instance size improves performance but does not directly affect failover time.

Full explanation →
205
MCQeasy

A company is using AWS CloudFormation to manage infrastructure. The security team requires that all CloudFormation stacks include a specific tag (CostCenter). The company wants to enforce this tag automatically. Which method should be used to enforce the tag?

A.Use AWS Service Catalog to enforce mandatory tags on all provisioned products.
B.Use an AWS Config rule to check for the tag and a custom IAM policy to deny stack creation without the tag.
C.Create an AWS Lambda function that checks for the tag and sends alerts.
D.Use AWS Resource Groups to tag resources after stack creation.
AnswerB

Config can detect and IAM policy can prevent non-compliant stack creation.

Why this answer

An AWS Config rule can detect stacks missing the required tag, and a custom IAM policy can deny the ability to create or update stacks that do not have the tag, providing preventive enforcement. Option A is incorrect because AWS Service Catalog can enforce tags on products it provisions, but the question is about all CloudFormation stacks, not just those from Service Catalog. Option C is incorrect because a Lambda function can alert or remediate after the fact, but it does not prevent creation of non-compliant stacks.

Option D is incorrect because tagging after creation does not enforce the tag requirement at creation time, and AWS Resource Groups is not an enforcement mechanism.

Full explanation →
206
MCQmedium

A Solutions Architect runs the AWS CLI command shown in the exhibit. Which statement accurately describes the output?

A.The command lists all instances regardless of state.
B.The command lists instances in JSON format.
C.The command lists only running instances.
D.The command fails because --query is used incorrectly.
AnswerA

The command returns all instances with their state.

Why this answer

The AWS CLI command `aws ec2 describe-instances` without any filter returns all EC2 instances in the current region, regardless of their state (running, stopped, terminated, etc.). The `--query` parameter is used correctly to extract specific fields from the JSON output, but it does not filter instances by state. Therefore, the output includes every instance, and option A is correct.

Exam trap

The trap here is that candidates often assume `--query` filters the instances themselves (like a WHERE clause in SQL), but it only shapes the output fields—it does not reduce the set of instances returned, so without an explicit `--filters` parameter, all instances are listed.

How to eliminate wrong answers

Option B is wrong because the command does not inherently list instances in JSON format; the default output format is JSON, but the user can specify other formats like text or table with the `--output` parameter, and the question does not state that JSON is forced. Option C is wrong because the command includes no filter (e.g., `--filters Name=instance-state-name,Values=running`) to limit results to running instances; it returns all instances regardless of state. Option D is wrong because `--query` is used correctly here—it applies a JMESPath expression to filter the output fields, and the syntax `Reservations[*].Instances[*].[InstanceId,State.Name]` is valid and will not cause the command to fail.

Full explanation →
207
MCQeasy

A company has multiple AWS accounts managed through AWS Organizations. The security team requires that all VPC flow logs be enabled in every account and region. What is the MOST efficient way to enforce this requirement?

A.Apply a service control policy (SCP) that requires all VPCs to have flow logs enabled.
B.Use AWS CloudFormation StackSets to deploy a stack that enables VPC Flow Logs in every account and region.
C.Create an AWS Config rule in each account to check for flow logs and trigger an auto-remediation action.
D.Use AWS Service Catalog to create a VPC product that includes flow logs, and require accounts to use it.
AnswerB

StackSets can deploy stacks across accounts and regions from a single admin account.

Why this answer

AWS CloudFormation StackSets allows you to deploy a single CloudFormation template across multiple accounts and regions in a single operation, making it the most efficient way to enforce VPC Flow Logs across all accounts and regions. This approach ensures consistent configuration without requiring manual per-account or per-region setup, and it integrates with AWS Organizations for automated deployment to new accounts.

Exam trap

The trap here is that candidates often confuse SCPs with resource policies, thinking they can enforce resource configurations, but SCPs only control IAM permissions and cannot directly enable features like VPC Flow Logs.

How to eliminate wrong answers

Option A is wrong because SCPs cannot enforce resource configurations like enabling VPC Flow Logs; they only restrict permissions (e.g., deny actions) and cannot create or modify resources. Option C is wrong because while an AWS Config rule can detect non-compliant VPCs and trigger auto-remediation, it is reactive and requires each account to have the rule deployed, making it less efficient than a proactive, centralized deployment. Option D is wrong because AWS Service Catalog provides a pre-approved product template but does not enforce its use; accounts can still create VPCs without flow logs, so it does not guarantee compliance.

Full explanation →
208
MCQeasy

A company is using Amazon DynamoDB as the primary database for a web application. The application experiences occasional throttling on writes. The company wants to implement a solution that automatically increases write capacity during traffic spikes. Which solution should they use?

A.Switch to DynamoDB On-Demand capacity mode.
B.Implement DynamoDB Accelerator (DAX) for caching.
C.Use DynamoDB Global Tables to distribute writes.
D.Enable DynamoDB Auto Scaling for write capacity.
AnswerD

Auto Scaling adjusts capacity based on actual utilization.

Why this answer

DynamoDB Auto Scaling automatically adjusts the provisioned write capacity based on actual traffic patterns, preventing throttling during spikes while optimizing costs. Option A is wrong because On-Demand capacity mode handles spikes but incurs higher costs and does not involve manual auto-scaling configuration. Option B is wrong because DAX is an in-memory cache that reduces read latency, not a scaling solution for write capacity.

Option C is wrong because Global Tables provide multi-region replication and disaster recovery but do not address write throttling in a single region.

Full explanation →
209
Multi-Selectmedium

A company is migrating a legacy application to Amazon ECS. The application has a stateful component that stores data on the local filesystem. Which TWO storage options can be used to persist data beyond the lifecycle of the container?

Select 2 answers
A.Amazon EBS
B.Amazon ECS Fargate ephemeral storage
C.Amazon ECR
D.Amazon S3
E.Amazon EFS
AnswersA, E

Correct. Amazon EBS volumes provide persistent block storage that can be attached to EC2 instances running ECS tasks, surviving container restarts.

Why this answer

Options A (Amazon EBS) and E (Amazon EFS) are correct. Amazon EBS volumes can be attached to EC2 instances running ECS tasks (EC2 launch type) and persist beyond the container lifecycle. Amazon EFS provides a shared file system that can be mounted by containers, including Fargate tasks, and data persists after the container stops.

Option B (Fargate ephemeral storage) is incorrect because it is temporary and lost when the container stops. Option C (Amazon ECR) is a container registry, not a storage option. Option D (Amazon S3) is object storage, not a filesystem suitable for direct attachment to containers.

Full explanation →
210
MCQhard

An e-commerce company runs a customer-facing application on AWS. The application architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ DB instance. The application uses a custom web server that stores session data in a local file system. During peak traffic, users experience session timeouts and errors. The operations team observes that the Auto Scaling group launches new instances and terminates old ones frequently. The team wants to improve the user experience and ensure session persistence. The Solutions Architect proposes to modify the application to store session data in an external store. However, due to a legacy code dependency, the application cannot be modified in the short term. Which solution should the Solutions Architect implement to resolve the session persistence issue without modifying the application?

A.Replace the local file system storage with an Amazon ElastiCache for Redis cluster that is external to the instances.
B.Enable sticky sessions (session affinity) on the ALB and configure the Auto Scaling group to use a lifecycle hook to drain connections before instance termination.
C.Store session data in Amazon DynamoDB and configure the application to use the DynamoDB session handler.
D.Configure the Auto Scaling group to scale down based on memory utilization rather than CPU, to reduce termination frequency.
AnswerB

Sticky sessions route user to same instance; lifecycle hook ensures sessions complete before termination.

Why this answer

Enabling sticky sessions on the ALB ensures that a user's requests are always routed to the same instance, preserving the local session files. Additionally, configuring a lifecycle hook to drain connections before instance termination prevents session loss during scale-in events. Option A is incorrect because ElastiCache requires application code changes to use it.

Option C is incorrect because DynamoDB also requires code changes. Option D is incorrect because scaling down based on memory does not prevent session loss; it may cause more terminations.

Full explanation →
211
Multi-Selectmedium

A company is using AWS Organizations with a centralized logging account. They want to collect VPC Flow Logs from all member accounts into a single S3 bucket in the logging account. Which TWO steps are required to achieve this?

Select 2 answers
A.Create a bucket policy in the logging account that grants the member accounts permission to write flow logs.
B.Attach an SCP to the logging account that allows PutObject to the bucket.
C.Configure the bucket policy to include a condition that the principal is the VPC Flow Logs service.
D.Use AWS Resource Access Manager (RAM) to share the bucket with member accounts.
E.Attach an SCP to the member accounts that allows them to create flow logs.
AnswersA, C

Bucket policy allows cross-account writes.

Why this answer

A bucket policy in the logging account is required to grant cross-account permissions for VPC Flow Logs delivery. Without this policy, the VPC Flow Logs service in member accounts cannot write to the centralized S3 bucket, even if the member account has its own IAM permissions. Option C is correct because the bucket policy must include a condition that restricts the principal to the VPC Flow Logs service (e.g., `aws:SourceArn` or `aws:SourceAccount`) to prevent unauthorized writes from other services or accounts.

Exam trap

The trap here is that candidates often think SCPs or IAM roles in member accounts are sufficient for cross-account S3 writes, but the bucket policy is the only mechanism that authorizes the VPC Flow Logs service principal from another account to write objects.

Full explanation →
212
Multi-Selectmedium

An e-commerce company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL DB cluster with one writer and two reader instances. During a sales event, the database CPU utilization is high, and read replicas show high replica lag. The company needs to improve the read scalability and reduce replica lag. Which THREE actions should the company take? (Choose THREE.)

Select 3 answers
A.Add more reader instances to the cluster to distribute the read traffic.
B.Enable Multi-AZ for the cluster to improve read availability.
C.Increase the instance size of the writer instance to improve write throughput.
D.Increase the instance size of the reader instances to larger instance types.
E.Enable Aurora Auto Scaling for the reader instances.
AnswersA, D, E

More readers improve read scalability.

Why this answer

Adding more reader instances (Option A) distributes the read workload across additional nodes, reducing the load on each reader and helping to lower replica lag. Aurora Auto Scaling (Option E) automatically adjusts the number of reader instances based on metrics like CPU utilization or replica lag, providing dynamic scaling during traffic spikes. Increasing the instance size of reader instances (Option D) provides more CPU and memory resources to each reader, enabling them to process more read queries and apply changes from the writer faster, which directly reduces replica lag.

Exam trap

The trap here is that candidates may confuse Multi-AZ with read scaling, but Multi-AZ in Aurora is for high availability only and does not distribute read traffic, while the real solutions involve adding more readers, scaling readers up, or using Auto Scaling to handle variable load.

Full explanation →
213
Multi-Selecthard

A company is using AWS CodePipeline to automate deployments. The pipeline includes a build stage that compiles code and runs tests. The build stage fails intermittently due to network timeouts when downloading dependencies. Which THREE actions could improve the reliability of the build stage?

Select 3 answers
A.Increase the build timeout to allow more time for downloads.
B.Use CodeBuild local cache to store dependencies across builds.
C.Run the CodeBuild project in a VPC with a NAT gateway to ensure consistent outbound connectivity.
D.Store dependencies in an S3 bucket and configure the build to use cached dependencies.
E.Use a larger compute type for CodeBuild to improve network speed.
AnswersB, C, D

Local cache reduces download frequency.

Why this answer

Options B, C, and D are correct: Using CodeBuild local cache (B) stores dependencies across builds, reducing download time. Running CodeBuild in a VPC with a NAT gateway (C) ensures consistent outbound connectivity, mitigating network timeouts. Storing dependencies in an S3 bucket and configuring the build to use cached dependencies (D) also reduces reliance on external downloads.

Option A is incorrect because increasing the timeout only delays the failure but does not address the root cause. Option E is incorrect because a larger compute type may improve build speed but does not fix network timeouts.

Full explanation →
214
MCQhard

A company is deploying a serverless application using AWS Lambda. The application processes high-resolution images and stores them in Amazon S3. The processing time for each image is variable, but some images require more than 15 minutes to process. Lambda has a maximum execution time of 15 minutes. How can the company process these long-running image transformations?

A.Use AWS Step Functions to chain multiple Lambda functions, each processing a part of the image.
B.Use AWS Batch to run the image processing as a job on EC2 or Fargate.
C.Use Amazon SQS to queue the images and have Lambda poll the queue; the Lambda function can process one image per invocation.
D.Increase the Lambda timeout to 20 minutes.
AnswerB

AWS Batch can run jobs with longer execution times and can scale based on demand.

Why this answer

AWS Lambda has a hard limit of 15 minutes per invocation, so images requiring more than 15 minutes cannot be processed within a single Lambda function. AWS Batch is designed for long-running, batch-oriented compute jobs and can run on EC2 or Fargate without any time limit, making it the correct choice for processing high-resolution images that exceed Lambda's timeout.

Exam trap

The trap here is that candidates assume Step Functions can extend Lambda's execution time by chaining functions, but each Lambda invocation still has a hard 15-minute limit, and Step Functions does not override that service quota.

How to eliminate wrong answers

Option A is wrong because chaining multiple Lambda functions via Step Functions does not extend the per-invocation timeout; each individual Lambda function still has a 15-minute limit, and splitting an image into parts would require custom orchestration and state management, not a native solution for long-running tasks. Option C is wrong because using SQS to queue images does not change Lambda's maximum execution time; each Lambda invocation still cannot exceed 15 minutes, so images requiring longer processing would time out. Option D is wrong because Lambda's maximum timeout is fixed at 15 minutes (900 seconds) and cannot be increased; this is a hard AWS service limit, not a configurable parameter.

Full explanation →
215
MCQeasy

A company is migrating a legacy on-premises application to AWS. The application currently runs on a Windows Server with a SQL Server database. The company wants to minimize changes to the application code. Which migration strategy should the company use?

A.Rehost (lift-and-shift)
B.Refactor / re-architect
C.Replatform (lift-and-resize)
D.Rebuild
AnswerA

Correct. Rehosting moves the application to AWS with minimal changes.

Why this answer

Rehosting (lift-and-shift) involves moving the application as-is to AWS, minimizing code changes. Replatforming (lift-and-resize) may involve some changes, but rehosting requires the least modification. Refactoring and rebuilding involve significant changes.

Full explanation →
216
MCQhard

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

A.Amazon Kinesis Data Streams
B.AWS Lambda
C.Amazon Kinesis Data Firehose
D.Amazon SQS
AnswerC

Firehose provides serverless buffering and delivery to S3.

Why this answer

Amazon Kinesis Data Firehose is the correct choice because it is a fully managed service designed to ingest streaming data, buffer it for configurable durations (up to 15 minutes by default, but easily set to 5 minutes), and automatically deliver it to destinations like Amazon S3. It handles variable data volumes (100 to 100,000 events per second) without requiring manual scaling, minimizing operational overhead and cost compared to alternatives.

Exam trap

The trap here is that candidates often confuse Kinesis Data Streams (which requires custom consumers and scaling management) with Kinesis Data Firehose (which is purpose-built for buffering and automated delivery to S3), leading them to choose the more complex option A.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Streams requires you to manage shard provisioning and scaling to handle variable throughput, and it does not natively deliver data to S3 without additional consumers (e.g., Lambda or Firehose), increasing operational overhead and cost. Option B is wrong because AWS Lambda has a maximum execution timeout of 15 minutes and is not designed for buffering streaming data; it would require custom code to aggregate and write to S3, leading to complexity and potential data loss during bursts. Option D is wrong because Amazon SQS is a message queue with a maximum message retention of 14 days, but it does not provide built-in buffering for time-based delivery to S3; you would need additional components to poll, buffer, and write data, increasing overhead and cost.

Full explanation →
217
Multi-Selectmedium

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

Select 2 answers
A.AWS Security Token Service
B.AWS IAM
C.Amazon SQS
D.Amazon Cognito
E.Amazon CloudFront
AnswersB, D

IAM can authenticate users via API Gateway IAM authorization.

Why this answer

AWS IAM is correct because it can be used to authenticate users by attaching IAM authorization to API Gateway, allowing the API to verify the caller's identity via AWS Signature Version 4 signing. This is commonly used for machine-to-machine or internal service calls where the caller has AWS credentials.

Exam trap

The trap here is that candidates often confuse AWS STS (which issues temporary credentials) with an authentication service, or think SQS or CloudFront can handle authentication, when in fact only IAM and Cognito directly support user authentication for API Gateway in this context.

Full explanation →
218
MCQmedium

A solutions architect deployed the above CloudFormation template. However, the Lambda function is not triggered when objects are uploaded to the S3 bucket. What is the most likely cause?

A.The BucketNotification resource depends on MyLambdaFunction, but the notification configuration is incorrect.
B.The Lambda function lacks a resource-based policy that allows S3 to invoke it.
C.The Lambda execution role does not have permission to access S3.
D.The Lambda function code does not read the S3 object content.
AnswerB

Without an 'InvokeFunction' permission for S3, the trigger will fail.

Why this answer

The Lambda function requires a resource-based policy (also known as a function policy) that grants the S3 service permission to invoke the function. The CloudFormation template does not include such a policy, so S3 cannot trigger the Lambda function. Option A is incorrect because the BucketNotification resource is correctly configured to send events to the Lambda function, but the function itself lacks the invoke permission.

Option C is incorrect because the Lambda execution role manages permissions for the function to access other services (like CloudWatch Logs), not for other services to invoke it. Option D is irrelevant because the trigger itself is the issue, not the function code.

Full explanation →
219
MCQhard

A company has a complex AWS environment with hundreds of accounts. They want to implement a tagging strategy that allows them to track costs by department and project. The tags must be propagated from resources to cost reports automatically. Which approach meets these requirements with minimal ongoing maintenance?

A.Create a CloudFormation template that applies tags to all resources and deploy it via StackSets.
B.Use AWS Organizations tag policies to enforce required tags on resources, and activate cost allocation tags in the management account.
C.Use AWS Config rules to detect untagged resources and trigger a Lambda function to add tags.
D.Use AWS Cost Explorer to filter by resource tags after they are manually applied.
AnswerB

Tag policies enforce tags across accounts, and cost allocation tags are automatically activated.

Why this answer

AWS Organizations tag policies allow you to define and enforce required tags across all accounts in the organization, ensuring consistent tagging. When you activate cost allocation tags in the management account, these tags are automatically propagated to AWS Cost Explorer and cost reports without any manual intervention or ongoing maintenance, meeting the requirement for minimal ongoing effort.

Exam trap

The trap here is that candidates often confuse reactive remediation (like Config rules with Lambda) with proactive enforcement (like tag policies), and overlook that cost allocation tags must be explicitly activated in the management account to appear in cost reports.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can only apply tags to resources created by CloudFormation stacks, not to resources created outside of CloudFormation or pre-existing resources, and maintaining templates for hundreds of accounts introduces significant ongoing overhead. Option C is wrong because AWS Config rules with Lambda remediation is a reactive, event-driven approach that adds tags after resource creation, which does not guarantee propagation to cost reports automatically and requires ongoing maintenance of Lambda functions and Config rules. Option D is wrong because Cost Explorer can only filter by tags that are already applied and activated; manually applying tags does not ensure automatic propagation to cost reports and requires manual effort, failing the minimal ongoing maintenance requirement.

Full explanation →
220
Multi-Selecthard

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

Select 3 answers
A.A build stage that packages the application using AWS CodeBuild.
B.A manual approval step before deploying to production.
C.A deploy stage that deploys to production after staging tests pass.
D.A test stage that deploys to a staging environment and runs integration tests.
E.A deploy stage that deploys to a canary environment.
AnswersA, C, D

The build stage packages the application using AWS CodeBuild, preparing it for deployment.

Why this answer

The correct actions are: a build stage (Option A) to package the application using AWS CodeBuild, a test stage (Option D) that deploys to a staging environment and runs integration tests, and a deploy stage (Option C) that deploys to production after staging tests pass. Option B (manual approval) is not required because the goal is automatic testing before promotion, and Option E (canary deploy) is not specified as part of the requirement.

Full explanation →
221
MCQeasy

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

A.Create a service control policy in AWS Organizations that restricts instance types for all accounts.
B.Use AWS Config to automatically terminate instances that are not of allowed types.
C.Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.
D.Configure an S3 bucket policy that only allows specific instance types to be used.
AnswerC

IAM policies can restrict RunInstances actions based on instance type.

Why this answer

An IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, thinking SCPs can restrict specific users or groups within an account, when in fact SCPs only set account-wide permission boundaries and require additional IAM policies to enforce fine-grained restrictions.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) in AWS Organizations sets permissions boundaries for all accounts in the organization, but it cannot be used to restrict specific IAM users or groups within an account; it only defines the maximum allowed permissions for the entire account, and developers could still launch instances if the account-level permissions are not further restricted. Option B is wrong because AWS Config is a compliance and auditing service that can detect non-compliant instances and trigger remediation (e.g., termination), but it does not prevent the launch in real time; instances could be running and incurring costs before being terminated, and the termination itself might cause data loss or disruption. Option D is wrong because an S3 bucket policy controls access to S3 resources, not EC2 instance launches; it has no effect on the ec2:RunInstances API call and cannot restrict instance types.

Full explanation →
222
MCQmedium

A company is migrating a legacy application to AWS. The application requires a static IP address that can be used for whitelisting by third-party partners. The application will be deployed in multiple Availability Zones for high availability. The company wants to use a load balancer to distribute traffic. The solution must provide a single static IP address that does not change even if the underlying instances are replaced. Which combination of services should the company use?

A.Use an Application Load Balancer (ALB) with a static Elastic IP address attached to the ALB.
B.Use AWS Global Accelerator with an ALB as the endpoint.
C.Use Amazon CloudFront with an ALB as the origin.
D.Use a Network Load Balancer (NLB) with Elastic IP addresses assigned to each subnet.
AnswerD

NLBs support static IPs via Elastic IPs.

Why this answer

A Network Load Balancer (NLB) supports static IP addresses by allowing you to assign Elastic IP addresses to each Availability Zone subnet. This provides a single static IP per AZ that does not change even when backend instances are replaced, meeting the requirement for a fixed whitelisting address across multiple AZs.

Exam trap

The trap here is that candidates often assume an ALB can have a static IP attached because it is a common load balancer, but ALBs are Layer 7 and inherently use dynamic IPs, while only NLBs (Layer 4) support Elastic IP assignment per subnet.

How to eliminate wrong answers

Option A is wrong because an Application Load Balancer (ALB) does not support attaching Elastic IP addresses directly; ALBs are assigned dynamic DNS names and cannot provide a static IP. Option B is wrong because AWS Global Accelerator provides static anycast IP addresses but uses an ALB as an endpoint, which still requires the ALB's DNS name and does not give the ALB itself a static IP; the static IPs are at the accelerator level, not the load balancer. Option C is wrong because Amazon CloudFront provides static IP addresses for edge locations, but the origin (ALB) still uses a dynamic DNS name and does not receive a static IP; CloudFront is a CDN, not a load balancer for direct traffic distribution.

Full explanation →
223
MCQmedium

A company is using AWS Organizations with a single OU for all production accounts. The security team wants to restrict the use of specific instance types across all accounts in the OU. They create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not in the allowed list. However, some accounts still launch disallowed instance types. What is the most likely cause?

A.The SCP only denies future API calls; it does not affect already running instances.
B.The SCP has a delay of up to 24 hours before it takes effect.
C.The SCP is not attached to the management account.
D.The SCP condition is incorrectly formatted; SCPs cannot evaluate instance types.
AnswerA

SCPs are preventive, not detective or corrective.

Why this answer

The most likely cause is that the SCP only denies future API calls, not already running instances. SCPs are evaluated at the time of the API request; any instances launched before the SCP was applied or before it was updated to include the deny condition will continue to run unaffected. The security team may be observing those pre-existing disallowed instances, not new launches.

Exam trap

The trap here is that candidates assume SCPs apply retroactively to existing resources, but AWS SCPs only affect future API actions, not the state of already-provisioned resources.

How to eliminate wrong answers

Option B is wrong because SCPs take effect within minutes, not up to 24 hours; there is no built-in propagation delay of that magnitude. Option C is wrong because SCPs are attached to OUs or accounts, not to the management account; the management account is exempt from SCPs by design. Option D is wrong because SCPs can absolutely evaluate instance types using conditions like ec2:InstanceType in the ec2:RunInstances action; the condition syntax is valid and commonly used.

Full explanation →
224
MCQhard

A company is migrating a large-scale Hadoop cluster to Amazon EMR. The migration plan includes moving data from HDFS to Amazon S3. The company wants to minimize costs and ensure data durability. Which approach should the company use?

A.Set up a VPN connection and use rsync to copy data to S3.
B.Use Apache DistCp to copy data from HDFS to S3.
C.Use AWS Snowball Edge to physically transfer data from the cluster.
D.Use AWS Database Migration Service (DMS) to migrate the data to S3.
AnswerB

DistCp is the standard tool for copying between HDFS and S3.

Why this answer

B is correct because DistCp is designed for efficient HDFS-to-S3 transfers, and S3's 99.999999999% durability meets requirements. A is wrong because VPN and rsync are not optimized for large-scale data transfer to S3. C is wrong because Snowball Edge adds latency and is not necessary for data already in the cluster.

D is wrong because AWS DMS is for databases, not file systems.

Full explanation →
225
MCQhard

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

A.Use AWS CloudFormation StackSets to deploy Config rules to all accounts.
B.Use AWS Config rules in each account with AWS Lambda functions for remediation.
C.Use AWS Config conformance packs deployed via AWS Organizations with automatic remediation using Systems Manager Automation.
D.Use an AWS Config aggregator in the management account to view compliance across accounts.
AnswerC

Centralized, scalable, automated.

Why this answer

AWS Config conformance packs can be deployed at the organization level using AWS Organizations, enabling centralized management of rules across hundreds of accounts. Automatic remediation is achieved by associating Systems Manager Automation documents with non-compliant resources. Option A is incorrect because CloudFormation StackSets require per-account deployment and management, which does not scale as efficiently as conformance packs.

Option B is incorrect because Config rules in each account with Lambda functions lack centralized deployment and management. Option D is incorrect because an AWS Config aggregator only provides a cross-account compliance view, not enforcement or remediation.

Full explanation →
Page 2

Page 3 of 23

Page 4

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →