Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 226–300

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 3

Page 4 of 23

Page 5
226
MCQeasy

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

A.Amazon S3
B.Amazon EFS
C.AWS Storage Gateway
D.Amazon EBS
AnswerA

S3 is object storage with HTTPS access and high durability.

Why this answer

Amazon S3 is the correct choice because it supports objects up to 5 TB in size, provides HTTPS access via RESTful API endpoints, and offers 99.999999999% (11 nines) durability by automatically replicating data across multiple Availability Zones. S3 is purpose-built for storing and retrieving large files over the internet with high durability and scalability.

Exam trap

The trap here is that candidates may confuse file storage (EFS) or block storage (EBS) with object storage (S3), overlooking that only S3 provides native HTTPS access and 11 nines durability for large objects without requiring an EC2 instance or additional infrastructure.

How to eliminate wrong answers

Option B (Amazon EFS) is wrong because it is a file-level storage service for Linux workloads, not designed for single objects up to 5 TB (its maximum file size is 52 TB, but it lacks native HTTPS object access and is optimized for shared file systems, not direct HTTP retrieval). Option C (AWS Storage Gateway) is wrong because it is a hybrid storage service that provides on-premises access to AWS storage, not a primary storage service for direct HTTPS access to large files; it adds latency and complexity for a purely cloud-native application. Option D (Amazon EBS) is wrong because it is block-level storage attached to a single EC2 instance, cannot be accessed directly via HTTPS, and has a maximum volume size of 16 TB but requires an EC2 instance to serve files, making it unsuitable for direct object retrieval over the internet.

Full explanation →
227
Multi-Selectmedium

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Select 2 answers
A.Use a DynamoDB table to store processed file IDs and check for duplicates before processing.
B.Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.
C.Increase the Lambda function timeout to 15 minutes.
D.Configure S3 event notifications to filter by prefix and suffix to avoid triggering multiple times.
E.Enable S3 Transfer Acceleration on the bucket.
AnswersA, D

Idempotency key store prevents duplicate processing.

Why this answer

Options A and D are correct. Using a DynamoDB table to store processed file IDs (A) ensures idempotency by checking for duplicates before processing. Configuring S3 event notifications with prefix and suffix filters (D) reduces the chance of triggering multiple invocations for the same file.

Option B is incorrect because simply using an SQS queue does not guarantee idempotent processing; additional deduplication logic is needed. Option C is incorrect because increasing the Lambda timeout does not prevent multiple invocations. Option E is incorrect because S3 Transfer Acceleration improves upload speed, not idempotency.

Full explanation →
228
MCQeasy

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

A.AWS Server Migration Service (SMS)
B.AWS DataSync
C.AWS Database Migration Service (DMS)
D.AWS Snowball
AnswerC

DMS supports continuous replication.

Why this answer

AWS DMS supports ongoing replication to minimize downtime during migration.

Full explanation →
229
MCQmedium

A company is designing a disaster recovery solution for a critical application running on EC2 with data in an Amazon RDS MySQL Multi-AZ DB instance. The recovery time objective (RTO) is 15 minutes and recovery point objective (RPO) is 1 hour. Which strategy meets these requirements?

A.Enable Multi-AZ in a different Region.
B.Create a cross-Region read replica of the RDS DB instance.
C.Take daily snapshots of the RDS DB instance and copy them to another Region.
D.Use Amazon S3 cross-Region replication for database backups.
AnswerB

Promoting a read replica can achieve RTO under 15 minutes and RPO under 1 hour.

Why this answer

A cross-Region read replica of an Amazon RDS MySQL DB instance provides asynchronous replication with a typical replication lag of seconds to minutes, meeting the RPO of 1 hour and RTO of 15 minutes by promoting the replica to a standalone instance in the event of a disaster. This approach minimizes data loss and allows rapid failover without relying on snapshot restoration or backup copying.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which is Region-bound) with cross-Region disaster recovery, or they assume daily snapshots are sufficient for a 1-hour RPO, failing to recognize that snapshot frequency must match the RPO window.

How to eliminate wrong answers

Option A is wrong because Multi-AZ in a different Region is not a supported configuration; Multi-AZ provides high availability within a single Region by synchronously replicating to a standby in a different Availability Zone, not across Regions. Option C is wrong because daily snapshots cannot achieve an RPO of 1 hour; snapshot frequency is at most once every 5 minutes, but daily snapshots would result in up to 24 hours of potential data loss, far exceeding the 1-hour RPO. Option D is wrong because Amazon S3 cross-Region replication is used for S3 objects, not for RDS database backups; RDS automated backups and manual snapshots are stored in S3, but the replication of those backups via S3 CRR does not provide the low RTO or RPO required, as it would still require restoring from a snapshot, which takes longer than 15 minutes.

Full explanation →
230
MCQhard

A solutions architect applies the IAM policy shown in the exhibit to an IAM user. The user attempts to upload an object to the S3 bucket 'my-bucket' without specifying the 'x-amz-server-side-encryption' header. What will happen?

A.The upload succeeds because the Allow statement grants the s3:PutObject permission.
B.The upload succeeds because the Deny statement only applies when the header is present but set to a value other than AES256.
C.The upload fails because the Deny statement blocks any PutObject request that does not specify AES256 encryption.
D.The upload fails because the condition is malformed and causes an error.
AnswerC

The Deny statement with StringNotEquals denies if encryption header is not present or not AES256.

Why this answer

The Deny statement with a StringNotEquals condition on the 's3:x-amz-server-side-encryption' header will block any PutObject request where the header is not present or is set to a value other than 'AES256'. Since the user does not specify the header, the condition evaluates to true, and the Deny applies, causing the upload to fail. Option B is incorrect because the Deny statement applies even when the header is missing, not only when it is present with a different value.

Option A is incorrect because the Allow statement's condition is not met, so it does not grant permission. Option D is incorrect because the condition is valid and correctly evaluated.

Full explanation →
231
MCQmedium

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The team notices that during a recent traffic spike, some instances were terminated and replaced, causing a temporary drop in performance. How can the team improve the resilience of the application?

A.Purchase Reserved Instances to ensure capacity.
B.Use lifecycle hooks to wait for instance termination.
C.Increase the instance size to handle more traffic.
D.Configure a warm pool for the Auto Scaling group.
AnswerD

Warm pools keep pre-initialized instances ready to replace terminated ones quickly.

Why this answer

A warm pool pre-initializes instances, reducing the time needed for new instances to become ready during scale-out events. Option A is wrong because Reserved Instances guarantee capacity but do not reduce the initialization delay. Option B is wrong because lifecycle hooks can delay termination but do not accelerate instance readiness.

Option C is wrong because larger instance size does not prevent the temporary drop in performance caused by instance replacement delays.

Full explanation →
232
MCQeasy

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

A.Amazon RDS Single-AZ deployment
B.Amazon RDS with Read Replicas
C.Amazon RDS Multi-AZ deployment
D.Amazon RDS cross-region replication
AnswerC

Multi-AZ provides automatic failover and high availability within a region.

Why this answer

RDS Multi-AZ provides automatic failover and high availability within a region. Option A is wrong because Single-AZ does not provide failover. Option B is wrong because Read Replicas are for read scaling, not failover.

Option D is wrong because cross-region replication is for disaster recovery, not primary failover.

Full explanation →
233
MCQmedium

A company uses AWS Lambda to process events from an Amazon SQS queue. The Lambda function is invoked with a batch size of 10. Recently, the function started failing with timeout errors when processing large batches. Which solution would improve the reliability of event processing without losing messages?

A.Increase the SQS queue visibility timeout to match the function timeout.
B.Increase the Lambda function reserved concurrency to handle more invocations.
C.Increase the Lambda function timeout to the maximum 15 minutes.
D.Reduce the batch size to a smaller value, such as 5.
AnswerD

Smaller batches reduce processing time per invocation.

Why this answer

Reducing the batch size decreases the number of messages processed per invocation, which reduces the total processing time and helps avoid timeouts. Option A is incorrect because increasing the visibility timeout does not reduce the processing time within the function; it only prevents messages from becoming visible again before the function finishes. Option B is incorrect because increasing reserved concurrency increases the number of concurrent invocations but does not affect the processing time of a single invocation.

Option C is incorrect because increasing the function timeout to 15 minutes may allow the function to complete, but it does not address the root cause of long processing times and could lead to higher costs and delayed processing; reducing the batch size is a more targeted solution.

Full explanation →
234
Multi-Selectmedium

A company is designing a real-time analytics platform that ingests data from thousands of IoT devices. The platform must process and store high-velocity data with low latency. Which TWO AWS services should be used together to meet these requirements? (Choose TWO.)

Select 2 answers
A.AWS Lambda
B.Amazon Kinesis Data Streams
C.Amazon Kinesis Data Analytics
D.Amazon S3
E.Amazon SQS
AnswersB, C

Ingests large amounts of data from IoT devices in real time.

Why this answer

Amazon Kinesis Data Streams is correct because it is designed to ingest and store high-velocity data streams from thousands of IoT devices with low latency, providing durable, ordered data that can be consumed in real time. Amazon Kinesis Data Analytics is correct because it can process streaming data from Kinesis Data Streams using SQL or Apache Flink to perform real-time analytics without needing to store the data first, meeting the low-latency processing requirement.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Streams with Amazon SQS or Amazon S3 for streaming ingestion, but SQS lacks ordered, replayable streams and S3 introduces latency, while Kinesis Data Streams is purpose-built for high-velocity, low-latency data ingestion and analytics.

Full explanation →
235
MCQmedium

Refer to the exhibit. A solutions architect is designing a new application that requires three EC2 instances running in different Availability Zones in us-east-1. The architect runs the AWS CLI command shown and sees three instances running in three AZs. However, the application is not highly available because if one AZ fails, the application loses one-third of its capacity. The architect needs to ensure that the application can survive the loss of an entire AZ without manual intervention. What should the architect do?

A.Create a launch configuration and manually associate it with the instances.
B.Create an Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three AZs.
C.Use EC2 Auto Recovery to automatically recover instances in case of failure.
D.Manually launch additional instances in other AZs.
AnswerB

Auto Scaling automatically replaces failed instances.

Why this answer

An Auto Scaling group with a minimum size of 2 and a maximum size of 6, spread across three Availability Zones, ensures that if one AZ fails, the Auto Scaling group automatically launches replacement instances in the remaining healthy AZs to maintain the desired capacity. This provides fault tolerance without manual intervention, as the group continuously monitors instance health and replaces failed instances across AZs.

Exam trap

The trap here is that candidates often confuse EC2 Auto Recovery (which recovers a single instance within the same AZ) with Auto Scaling groups (which can replace instances across multiple AZs), leading them to choose Option C even though it cannot handle an entire AZ failure.

How to eliminate wrong answers

Option A is wrong because a launch configuration is a template for launching instances, not a mechanism for automatic recovery or high availability; manually associating it with instances does not provide any automated failover or replacement. Option C is wrong because EC2 Auto Recovery only recovers an individual instance within the same AZ if it becomes impaired, but it cannot handle the loss of an entire AZ or redistribute instances across other AZs. Option D is wrong because manually launching additional instances in other AZs requires human intervention and does not provide automated recovery or scaling, violating the requirement to survive an AZ failure without manual action.

Full explanation →
236
MCQeasy

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

A.S3 bucket policies
B.CloudFront signed URLs
C.Presigned URLs
D.IAM roles
AnswerC

Presigned URLs grant time-limited access to specific objects.

Why this answer

Presigned URLs provide temporary, time-limited access to specific S3 objects without requiring AWS credentials. Option A (bucket policies) apply to all principals and cannot be restricted to specific users or time-limited directly. Option B (CloudFront signed URLs) are used for controlling access to content delivered via CloudFront, not for direct S3 access.

Option D (IAM roles) require the user to have AWS credentials and assume the role, which is not suitable for temporary external access.

Full explanation →
237
MCQhard

A company is migrating a legacy on-premises application to AWS. The application uses a proprietary database that runs on a single Windows server. The company wants to minimize downtime and avoid re-architecting the database. Which migration strategy should the solutions architect recommend?

A.Retire the application and replace it with a SaaS solution
B.Rehost using AWS Application Migration Service (CloudEndure)
C.Re-architect the application to use Amazon DynamoDB
D.Replatform by migrating the database to Amazon RDS for SQL Server
AnswerB

Correct: Allows lift-and-shift with minimal downtime and no changes to the database.

Why this answer

Rehost (lift-and-shift) is the best option because it moves the application without changes, minimizing downtime and avoiding re-architecture. Replatforming would require some changes, and re-architecting would involve significant rework. Retire is not applicable.

Full explanation →
238
MCQmedium

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other using REST APIs. The company wants to implement a service mesh to handle traffic routing, observability, and security. Which AWS service should the company use?

A.Elastic Load Balancing for internal network load balancers.
B.AWS App Mesh.
C.AWS Cloud Map for service discovery.
D.Amazon API Gateway with VPC linking.
AnswerB

App Mesh provides service mesh capabilities for ECS.

Why this answer

AWS App Mesh is a service mesh that provides application-level networking, enabling traffic routing, observability (metrics, logs, traces), and security (mTLS, authorization policies) for microservices. It integrates natively with Amazon ECS on Fargate, allowing sidecar Envoy proxies to handle inter-service communication without modifying application code.

Exam trap

The trap here is that candidates often confuse service discovery (Cloud Map) with a full service mesh, or assume that a load balancer (ELB) or API gateway can provide the same level of traffic routing, observability, and security for internal microservices communication.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing for internal NLB operates at Layer 4 and does not provide service mesh capabilities like traffic routing based on HTTP headers, observability with distributed tracing, or mTLS security between services. Option C is wrong because AWS Cloud Map is a service discovery tool that registers service instances and provides DNS-based or API-based resolution, but it does not handle traffic routing, observability, or security policies required for a service mesh. Option D is wrong because Amazon API Gateway with VPC linking is designed for external API management and routing to backend services, not for internal service-to-service communication within a microservices mesh, and it lacks the sidecar proxy model and fine-grained traffic control of a service mesh.

Full explanation →
239
MCQmedium

A company is migrating a stateful application to AWS. The application uses local storage for temporary data that must survive instance restarts but not region failures. Which storage solution should the company use?

A.Amazon EBS
B.Instance Store
C.Amazon S3
D.Amazon EFS
AnswerB

Ephemeral storage that persists across reboots.

Why this answer

Instance Store provides ephemeral block storage that persists across instance reboots but is lost if the instance is stopped or terminated. This matches the requirement for temporary data that survives restarts but not region failures. Option A (Amazon EBS) survives stops, which is unnecessary.

Option C (Amazon S3) is object storage, not temporary local storage. Option D (Amazon EFS) is a network file system, not local storage.

Full explanation →
240
Multi-Selecthard

Which THREE factors should be considered when designing a global application that requires low-latency access to static content and dynamic API responses?

Select 3 answers
A.Use VPC peering between all Regions to reduce latency.
B.Use Amazon CloudFront with multiple origins for static and dynamic content.
C.Use AWS Direct Connect for global connectivity.
D.Deploy application in multiple AWS Regions and use Route 53 latency-based routing.
E.Use AWS Global Accelerator for dynamic content.
AnswersB, D, E

Amazon CloudFront caches static content at edge locations and can route dynamic requests to the optimal origin, reducing latency for both types of content.

Why this answer

Amazon CloudFront provides edge caching for static content and can route dynamic requests to the nearest origin. AWS Global Accelerator improves performance for dynamic content via anycast IP. Multi-Region deployment with Route 53 latency routing reduces latency.

VPC peering (A) is for private networking between VPCs, not global content delivery. Direct Connect (C) provides dedicated private connectivity but does not optimize global latency for content delivery.

Full explanation →
241
MCQhard

A company is migrating a mission-critical application to AWS. The application requires a fixed IP address for whitelisting by external partners. The company plans to use an Application Load Balancer (ALB) to distribute traffic. However, ALB does not support static IP addresses. How can the company meet the requirement for static IP addresses while using the ALB?

A.Replace the ALB with a Network Load Balancer (NLB) that has Elastic IP addresses
B.Use AWS Global Accelerator with the ALB as an endpoint
C.Use Amazon Route 53 with a failover routing policy
D.Assign Elastic IP addresses to the ALB
AnswerB

Global Accelerator provides static IP addresses and routes traffic to the ALB.

Why this answer

Using AWS Global Accelerator provides static anycast IP addresses and directs traffic to the ALB, meeting the requirement for fixed IP whitelisting. Option A (replacing with NLB) would avoid the ALB entirely and may not be suitable for application-level traffic. Option C (Route 53 failover) does not provide static IP addresses for whitelisting.

Option D (assigning Elastic IP to ALB) is not supported.

Full explanation →
242
Multi-Selecthard

A company has a fleet of EC2 instances that process data from an SQS queue. The instances are part of an Auto Scaling group. The team notices that the queue depth is growing, but the Auto Scaling group is not scaling out quickly enough. Which THREE actions should the team take to improve the scaling responsiveness? (Choose three.)

Select 3 answers
A.Use a custom CloudWatch metric for the SQS queue depth to drive scaling.
B.Decrease the AWS CloudWatch metric warm-up time.
C.Reduce the Auto Scaling group cooldown period.
D.Use a step scaling policy instead of a simple scaling policy.
E.Increase the instance size in the launch template.
AnswersA, C, D

Custom metrics can trigger scaling based on actual queue length.

Why this answer

Using a custom CloudWatch metric for SQS queue depth enables scaling based on actual workload, providing more responsive scaling than the default CPU or network metrics. Option C: Reducing the cooldown period allows the Auto Scaling group to launch instances more quickly after a scaling activity, improving responsiveness. Option D: Step scaling policies adjust capacity incrementally based on the size of the alarm breach, allowing more aggressive scaling when queue depth is high.

Options B and E are incorrect: Decreasing warm-up time is not a supported CloudWatch feature, and increasing instance size does not improve scaling speed but rather increases capacity per instance.

Full explanation →
243
MCQhard

A company is designing a serverless data processing pipeline that uses AWS Lambda to process messages from Amazon SQS. Each message requires 5 minutes of processing time. The company expects a steady state of 1,000 messages per second. What is the MOST scalable and cost-effective design?

A.Deploy an Amazon ECS service with Fargate that polls the SQS queue. Use an SQS queue with long polling and auto scaling based on queue depth.
B.Use an SQS queue and a Lambda function that processes messages in batches. Set the Lambda function timeout to 15 minutes and use reserved concurrency.
C.Use an Amazon MQ broker with ActiveMQ and configure a Lambda function to consume messages from a queue.
D.Configure an SQS queue with a Lambda trigger. Set the Lambda function timeout to 5 minutes and the batch size to 1.
AnswerA

ECS can scale to thousands of tasks, each handling one message for 5 minutes, cost-effective and scalable.

Why this answer

Amazon ECS with Fargate provides a fully managed, serverless compute environment that can handle long-running tasks (5 minutes per message) without the 15-minute Lambda timeout limit. By using long polling and auto scaling based on queue depth, the solution scales cost-effectively to process 1,000 messages per second, as Fargate tasks can run indefinitely and scale horizontally to match the workload.

Exam trap

The trap here is that candidates assume Lambda is always the best serverless choice, but for long-running, high-throughput tasks (5 minutes per message at 1,000 msg/s), Lambda's 15-minute timeout, concurrency limits, and per-invocation cost make Fargate a more scalable and cost-effective option.

How to eliminate wrong answers

Option B is wrong because Lambda has a maximum execution timeout of 15 minutes, but each message requires 5 minutes of processing time; however, the real issue is that Lambda is not designed for sustained high-throughput, long-running tasks—it scales quickly but can hit concurrency limits and is less cost-effective for continuous 5-minute executions compared to Fargate. Option C is wrong because Amazon MQ (ActiveMQ) is a managed message broker that is not serverless and incurs fixed infrastructure costs, making it less scalable and cost-effective than SQS for this high-volume, steady-state workload. Option D is wrong because Lambda triggers from SQS have a maximum invocation timeout of 15 minutes (which is fine for 5-minute messages), but the batch size of 1 and the need to process 1,000 messages per second would require massive Lambda concurrency, quickly exhausting account limits and driving up costs due to per-invocation billing, making it less scalable and cost-effective than Fargate.

Full explanation →
244
MCQeasy

A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?

A.Use AWS CloudTrail to monitor for unencrypted objects.
B.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.
C.Enable S3 Versioning to protect objects.
D.Create a bucket policy that denies PutObject if the object is not encrypted.
AnswerB

Enabling default encryption using SSE-S3 or SSE-KMS ensures that all new objects written to the bucket are encrypted at rest.

Why this answer

Enabling default encryption on the bucket ensures all new objects are encrypted. Option A is wrong because CloudTrail only logs and does not enforce encryption. Option C is wrong because versioning does not enforce encryption.

Option D is wrong because a bucket policy that denies PutObject if not encrypted can be circumvented or does not cover existing objects, but default encryption is more straightforward.

Full explanation →
245
MCQhard

A financial services company is designing a new system on AWS to process real-time stock trades. The system must handle up to 10,000 trades per second with end-to-end latency under 500 milliseconds. Trades are ingested via REST API, validated, enriched with market data, and stored in a database for regulatory compliance. The architecture must be highly available across three Availability Zones. The company wants to use AWS managed services to minimize operational overhead. Which solution should a Solutions Architect recommend?

A.Use Network Load Balancer to distribute trade requests to a fleet of EC2 instances running a custom Java application. The application processes trades and writes to Amazon RDS for MySQL with Multi-AZ.
B.Use Amazon API Gateway to ingest trades, publish to an SNS topic, subscribe an SQS queue and a Lambda function. Lambda validates and enriches, then stores in DynamoDB.
C.Use Amazon API Gateway to ingest trades, send to an SQS FIFO queue for ordered processing, trigger an AWS Lambda function for validation and enrichment, and store in DynamoDB.
D.Use Amazon API Gateway to ingest trades, send to Amazon Kinesis Data Streams for buffering, use AWS Lambda to process in parallel, and store results in DynamoDB with on-demand capacity.
AnswerD

Kinesis can handle high throughput, Lambda scales automatically, DynamoDB provides low-latency storage.

Why this answer

It uses Amazon API Gateway for ingestion, Kinesis Data Streams for durable buffering and scalability (handles up to 10,000 tps by adding shards), AWS Lambda for stateless validation/enrichment (auto-scales with Kinesis), and DynamoDB with on-demand capacity for low-latency storage (millisecond response). This combination provides high availability across three AZs with minimal operational overhead. Option A is wrong because managing EC2 instances and RDS Multi-AZ adds operational overhead and slower scaling compared to serverless services.

Option B is wrong because SNS does not provide a persistent buffer; if the Lambda subscriber is unavailable or throttled, messages can be lost, and ordering is not guaranteed. Option C is wrong because SQS FIFO queues have a maximum throughput of 3,000 tps (with batching) or 300 tps (without), which is insufficient for 10,000 tps. Additionally, Kinesis Data Streams is better suited for real-time streaming at high throughput.

Full explanation →
246
MCQhard

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

A.Redeploy the previous version of the application that passed health checks.
B.Modify the target group health check to use path '/' instead of '/health'.
C.Create a new target group with the correct health check path and update the ECS service.
D.SSH into the Fargate container and restart the application.
AnswerB

A common path ensures both blue and green targets pass health checks during the transition.

Why this answer

The CodePipeline deploy action uses CodeDeploy for blue/green deployments. The error indicates that the original target group (blue) is not healthy, possibly because the health check path is not valid for the original application version. Adjusting the health check to a common path like '/' allows both versions to pass.

Option A is incorrect because Fargate does not allow SSH. Option C is incorrect because redeploying the same version won't fix the underlying health check issue. Option D is incorrect because a new target group does not address the root cause.

Full explanation →
247
Multi-Selecthard

A company is designing a hybrid cloud solution that extends its on-premises data center to AWS. The company has a 10 Gbps AWS Direct Connect connection and needs to securely connect multiple VPCs and on-premises networks with transitive routing. The solution must be highly available and use AWS managed services. Which TWO components should the company include in the design? (Choose TWO.)

Select 2 answers
A.AWS Global Accelerator endpoints in each VPC.
B.AWS Transit Gateway with attachments for each VPC and the Direct Connect Gateway.
C.AWS Site-to-Site VPN connections from on-premises to each VPC.
D.VPC peering between each VPC and the on-premises network.
E.AWS Direct Connect Gateway attached to the Transit Gateway.
AnswersB, E

Transit Gateway enables transitive routing and central management.

Why this answer

AWS Transit Gateway provides transitive routing between multiple VPCs and on-premises networks, eliminating the need for complex peering meshes. Option E is correct because attaching a Direct Connect Gateway to the Transit Gateway allows the single 10 Gbps Direct Connect connection to be shared across all attached VPCs, enabling centralized, highly available connectivity.

Exam trap

The trap here is that candidates often confuse VPC peering with transitive routing, or assume that Direct Connect alone provides transitive connectivity, but neither VPC peering nor a standalone Direct Connect connection offers the transitive routing required for a multi-VPC hybrid architecture.

Full explanation →
248
Multi-Selecthard

A company is migrating a stateful application that uses local disks for caching to AWS. The application requires high-performance, low-latency storage that can be attached to a single EC2 instance. Which THREE AWS services or features should the company consider for the cache storage?

Select 3 answers
A.Amazon EBS io2 Block Express
B.Amazon EFS
C.Instance store
D.Local NVMe instance store
E.Amazon S3
AnswersA, C, D

io2 Block Express provides high-performance persistent block storage for a single instance.

Why this answer

The correct answers are A (Amazon EBS io2 Block Express), C (Instance store), and D (Local NVMe instance store). EBS io2 Block Express provides high-performance, persistent block storage that can be attached to a single EC2 instance. Instance store offers high-performance, low-latency local storage but is ephemeral.

Local NVMe instance store is a type of instance store using NVMe SSDs for even higher performance. Option B (Amazon EFS) is a shared file system, not suitable for a single instance's cache. Option E (Amazon S3) is object storage, not designed for low-latency block-level access.

Full explanation →
249
MCQmedium

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application experiences sudden traffic spikes. What is the most effective way to ensure the application can handle the spikes without manual intervention?

A.Use a target tracking scaling policy based on average CPU utilization.
B.Increase the instance size to handle more load per instance.
C.Manually increase the desired capacity when traffic spikes.
D.Use scheduled scaling to add instances at expected peak times.
AnswerA

Target tracking automatically adjusts capacity to maintain a target metric, handling spikes.

Why this answer

A target tracking scaling policy based on average CPU utilization is the most effective approach because it automatically adjusts the Auto Scaling group's desired capacity in real-time to maintain a target CPU metric (e.g., 50%). This dynamic scaling method responds directly to sudden traffic spikes without any manual intervention, ensuring the application can handle increased load while optimizing cost.

Exam trap

The trap here is that candidates often confuse scheduled scaling (which works only for predictable patterns) with dynamic scaling (which reacts to real-time metrics), leading them to choose D instead of A for handling sudden, unplanned traffic spikes.

How to eliminate wrong answers

Option B is wrong because increasing the instance size (vertical scaling) is a manual, one-time change that does not automatically handle sudden traffic spikes; it also introduces a single point of failure and does not leverage the elasticity of Auto Scaling. Option C is wrong because manually increasing the desired capacity when traffic spikes requires human intervention and real-time monitoring, which defeats the purpose of automated scaling and can lead to delays or errors during spikes. Option D is wrong because scheduled scaling is designed for predictable traffic patterns (e.g., time-of-day peaks) and cannot react to sudden, unplanned traffic spikes; it would either over-provision or under-provision during unexpected events.

Full explanation →
250
MCQeasy

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by department. Each department has its own AWS account. Which feature should be used to map costs to departments?

A.Use cost allocation tags to tag resources with a department tag.
B.Use Amazon CloudWatch custom metrics to record department IDs.
C.Use service control policies (SCPs) to restrict costs per account.
D.Use AWS Budgets to create budgets per department.
AnswerA

Tags can be activated in AWS Cost Explorer to group costs.

Why this answer

Cost allocation tags allow you to tag AWS resources with metadata (e.g., department name) and then activate those tags in the AWS Billing and Cost Management console. Once activated, AWS generates cost reports that break down spending by those tags, enabling the finance team to map costs to each department's account. This is the native, recommended approach for cost attribution across accounts in AWS Organizations.

Exam trap

The trap here is that candidates confuse cost allocation tags with AWS Budgets or SCPs, mistakenly thinking that SCPs can limit costs or that Budgets can map costs, when in fact only tags provide the granular, reportable metadata needed for cost attribution.

How to eliminate wrong answers

Option B is wrong because Amazon CloudWatch custom metrics are designed for monitoring operational performance (e.g., CPU utilization), not for tracking or attributing costs; they cannot be used to generate cost allocation reports. Option C is wrong because service control policies (SCPs) are used to centrally control permissions and enforce guardrails across accounts, not to restrict or track costs; they do not provide cost mapping or reporting capabilities. Option D is wrong because AWS Budgets allow you to set cost thresholds and receive alerts, but they do not provide a mechanism to map historical or granular costs to specific departments; they are a monitoring tool, not a cost attribution feature.

Full explanation →
251
MCQmedium

Refer to the exhibit. A company creates this CloudFormation stack. After 30 days, what happens to objects with the prefix 'logs/'?

A.They are deleted because of the lifecycle rule.
B.They remain in Standard storage because versioning is enabled.
C.They are deleted after 30 days because no expiration is defined.
D.They are moved to the GLACIER storage class.
AnswerD

Correct, as the transition action moves objects to GLACIER after 30 days.

Why this answer

The lifecycle rule in the CloudFormation template specifies a transition to GLACIER after 30 days for objects with the prefix 'logs/'. Therefore, after 30 days, those objects are moved to GLACIER. Option A is incorrect because the lifecycle rule is set to transition, not delete.

Option B is incorrect because versioning does not prevent lifecycle transitions. Option C is incorrect because expiration is not required for transition; the transition action moves objects to GLACIER after 30 days.

Full explanation →
252
Multi-Selectmedium

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. The company currently uses server-side encryption with S3 managed keys (SSE-S3). The team wants to enforce encryption using a customer-managed key (CMK) from AWS KMS. Which TWO actions should the team take?

Select 2 answers
A.Configure a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.
B.Enable AWS CloudTrail to audit all PutObject requests.
C.Enable default encryption on the bucket with AWS KMS (SSE-KMS) as the encryption type.
D.Configure a bucket policy that allows PutObject only if the object is encrypted.
E.Disable SSE-S3 on the bucket so that only SSE-KMS can be used.
AnswersA, C

Correct. Denies PutObject if x-amz-server-side-encryption header is not set to 'aws:kms', enforcing SSE-KMS.

Why this answer

(bucket policy denying PutObject without x-amz-server-side-encryption header set to 'aws:kms') enforces that all uploads must specify SSE-KMS at the request level. Option C (default encryption with SSE-KMS) ensures that objects uploaded without encryption headers are automatically encrypted with a KMS key. Together, they enforce encryption with customer-managed KMS keys.

Option B (CloudTrail auditing) logs requests but does not enforce encryption. Option D (bucket policy allowing PutObject only if encrypted) allows any encryption type, not specifically KMS, so it does not enforce customer-managed keys. Option E (disabling SSE-S3) is not possible; you cannot disable SSE-S3, only set default encryption, and it would not enforce KMS alone.

Full explanation →
253
MCQeasy

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

A.Configure an S3 bucket policy to allow only specific IAM roles to put objects.
B.Continue using SSE-S3 and enable S3 Block Public Access.
C.Use client-side encryption with an AWS KMS key.
D.Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.
AnswerD

SSE-KMS allows key management and access control via IAM.

Why this answer

SSE-KMS allows the company to use AWS KMS for centralized key management and access control, ensuring that only authorized users can access the decryption keys. Option A is incorrect because an S3 bucket policy restricting put permissions does not control access to existing objects' encryption keys. Option B is incorrect because SSE-S3 keys are managed by AWS, not the customer, so the security team cannot enforce key access controls.

Option C is incorrect because client-side encryption does not use S3 server-side encryption and would require managing keys outside of AWS.

Full explanation →
254
MCQmedium

A social media startup uses AWS Lambda functions to process user-uploaded images. The Lambda function resizes images and stores them in Amazon S3. The function uses the S3 SDK to put objects. Recently, the team noticed that the function sometimes fails with 'Timeout' errors for large images. The Lambda function has a timeout of 5 seconds and 256 MB of memory. The team wants to improve the solution to handle larger images reliably and cost-effectively. Which solution should the team implement?

A.Migrate the image processing to a dedicated Amazon EC2 instance with an EBS volume.
B.Increase the Lambda function's timeout to 15 minutes and allocate more memory (e.g., 1024 MB).
C.Use Amazon API Gateway with a larger payload limit to offload the image processing.
D.Use AWS Elastic Transcoder to resize images instead of Lambda.
AnswerB

More memory and timeout allow processing larger images within Lambda limits.

Why this answer

(increase memory and timeout) directly addresses the issue: increasing memory also increases CPU and network throughput, which helps process large images faster; increasing timeout gives more time. Option A (EC2 with EBS) is overkill and not serverless, losing the benefits of Lambda. Option C (API Gateway with larger payload) does not help with Lambda's internal processing limits.

Option D (Elastic Transcoder) is for video transcoding, not image resizing.

Full explanation →
255
MCQmedium

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

A.The resource ARN is incorrect.
B.The principal should be the CloudTrail service principal, not the root account of 111111111111.
C.The bucket policy requires the x-amz-acl header, which CloudTrail does not set.
D.The bucket policy does not allow s3:PutObject for the account 222222222222.
AnswerB

CloudTrail uses a service principal to write logs across accounts.

Why this answer

The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Exam trap

The trap here is that candidates often assume cross-account access requires the source account's root user as the principal, but AWS services like CloudTrail use service principals (e.g., `cloudtrail.amazonaws.com`) for cross-account log delivery, not IAM users or root accounts.

How to eliminate wrong answers

Option A is wrong because the resource ARN (arn:aws:s3:::bucket-name/*) is correctly formatted for an S3 bucket policy and would not cause a cross-account CloudTrail delivery failure if the principal were correct. Option C is wrong because CloudTrail does not require the `x-amz-acl` header; S3 bucket policies can grant access without ACLs, and CloudTrail uses the bucket policy to authorize writes. Option D is wrong because the bucket policy does allow `s3:PutObject` for the specified principal (the root of 111111111111), but the issue is that the principal is not the CloudTrail service principal, not that the action is missing.

Full explanation →
256
MCQhard

A company is migrating a legacy application to AWS using the rehost (lift-and-shift) strategy. The application uses a proprietary database that is not supported by Amazon RDS. The company wants to automate the migration of multiple servers and minimize downtime. Which AWS service should be used to automate the server migration?

A.AWS CloudFormation to recreate the server configuration.
B.AWS Application Migration Service (AWS MGN).
C.AWS Server Migration Service (SMS).
D.AWS Database Migration Service (AWS DMS) for the database and manual server migration.
AnswerB

AWS Application Migration Service (MGN) automates lift-and-shift with minimal downtime.

Why this answer

AWS Application Migration Service (MGN) automates lift-and-shift with minimal downtime. Option A is wrong because AWS CloudFormation is for infrastructure provisioning, not migration. Option C is wrong because AWS Server Migration Service (SMS) is older and less automated compared to MGN.

Option D is wrong because AWS Database Migration Service (DMS) is for databases, not servers.

Full explanation →
257
Multi-Selectmedium

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

Select 2 answers
A.Use a bucket policy that denies PutObject without the x-amz-server-side-encryption header.
B.Configure default encryption on the S3 buckets to use SSE-S3 or SSE-KMS.
C.Enable S3 Cross-Region Replication.
D.Enable S3 Versioning on the buckets.
E.Enable S3 Server Access Logs.
AnswersA, B

Denies uploads without encryption.

Why this answer

Options A and B are correct. A bucket policy that denies PutObject without the x-amz-server-side-encryption header enforces encryption at upload time, ensuring all objects are encrypted. Default encryption on the bucket automatically encrypts objects that are uploaded without encryption headers, covering cases where the policy may not apply.

Option C (Cross-Region Replication) replicates objects but does not enforce encryption. Option D (Versioning) provides object version management and can help protect against overwrites, but does not enforce encryption. Option E (Server Access Logs) provides logging but does not enforce encryption.

Full explanation →
258
MCQeasy

A company is designing a new application that will process sensitive financial transactions. The application must be deployed in a VPC with no public internet access. The application needs to send logs to Amazon CloudWatch Logs and store files in Amazon S3. Which set of actions should be taken to meet these requirements without allowing internet access?

A.Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for CloudWatch Logs
B.Place the application behind a public Application Load Balancer
C.Set up a NAT gateway in a public subnet and route traffic through it
D.Use AWS PrivateLink to connect to CloudWatch Logs and S3
AnswerA

Gateway endpoints for S3 and Interface endpoints for CloudWatch Logs provide private connectivity within the VPC, no internet required.

Why this answer

A Gateway VPC endpoint for S3 allows private connectivity to S3 without traversing the internet, using route table entries. An Interface VPC endpoint for CloudWatch Logs, powered by AWS PrivateLink, enables private HTTPS connections to the CloudWatch Logs API without requiring a NAT gateway or internet gateway. Together, these endpoints satisfy the requirement for a VPC with no public internet access.

Exam trap

The trap here is that candidates often assume AWS PrivateLink can be used for both S3 and CloudWatch Logs uniformly, but S3 primarily uses Gateway VPC endpoints (not Interface endpoints) for private access, and PrivateLink is the mechanism for Interface endpoints only.

How to eliminate wrong answers

Option B is wrong because placing the application behind a public Application Load Balancer requires the ALB to have public internet access, which violates the 'no public internet access' requirement. Option C is wrong because a NAT gateway in a public subnet still requires an internet gateway for outbound traffic, and the application would need a route to the NAT gateway, which ultimately uses the internet; this does not meet the 'no internet access' condition. Option D is wrong because AWS PrivateLink is the underlying technology for Interface VPC endpoints, but it cannot be used directly for S3; S3 requires a Gateway VPC endpoint (or an Interface endpoint with a different configuration), and PrivateLink alone does not provide the correct connectivity for S3 without additional setup.

Full explanation →
259
MCQhard

A company is migrating its on-premises data center to AWS. The company has over 200 applications, each with varying dependencies. The migration team wants to use AWS Migration Hub to track the migration progress. Which approach should the team take to ensure successful tracking and minimize manual effort?

A.Use Amazon CloudWatch dashboards to monitor the health of on-premises servers.
B.Use AWS Systems Manager to automate the migration of each application.
C.Use AWS Application Discovery Service to discover dependencies and then use AWS Migration Hub to track the migration of each application.
D.Manually create a spreadsheet of all applications and their dependencies, and update it weekly.
AnswerC

Application Discovery Service automates discovery, and Migration Hub provides a central tracking dashboard.

Why this answer

AWS Application Discovery Service helps discover dependencies and collect data about on-premises servers, which is used to create a migration plan. AWS Migration Hub then tracks the migration progress of each application across multiple tools, automating tracking and minimizing manual effort. Option A is incorrect because Amazon CloudWatch dashboards monitor resource health but do not track migration progress or dependencies.

Option B is incorrect because AWS Systems Manager is for operational management, not specifically for migration tracking. Option D is incorrect because manual spreadsheets are error-prone and require significant effort, defeating the purpose of using AWS tools for automation.

Full explanation →
260
MCQhard

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

A.Decrease the batch size in the KCL configuration.
B.Increase the number of shards in the Kinesis stream.
C.Increase the Kinesis stream's retention period to 7 days.
D.Increase the number of EC2 instances running the consumer application.
AnswerD

Adding more EC2 instances adds workers, allowing KCL to distribute shards across them, increasing parallel processing and improving throughput.

Why this answer

The Kinesis Client Library (KCL) distributes shard processing across workers. Increasing the number of EC2 instances running the consumer application adds more workers, allowing parallel processing of shards and thus improving throughput for the lagging consumer. Option A is incorrect because decreasing the batch size reduces the number of records processed per call, which typically lowers throughput.

Option B is incorrect because increasing the number of shards increases the stream's total capacity but does not directly help a consumer that is already falling behind; it may actually require more workers to handle the additional shards. Option C is incorrect because extending the retention period affects how long data is stored, not how quickly it is processed.

Exam trap

Candidates often think that increasing shards directly improves consumer throughput, but the consumer's processing capacity depends on the number of workers. Adding shards without adding workers can worsen the lag.

Full explanation →
261
MCQmedium

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

A.Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.
B.Create a customer managed key in the backup account and share it with member accounts.
C.Grant the backup account full S3 access to member account buckets.
D.Enable AWS Config in member accounts to track backup compliance.
AnswerA

Cross-account role assumption is the standard pattern.

Why this answer

AWS Backup requires cross-account IAM roles to delegate backup and restore permissions. The central backup account assumes an IAM role in each member account that has a trust policy allowing the backup account's IAM entity to perform backup and restore actions. This is the minimal set of permissions needed to manage backups across accounts without granting broader access.

Exam trap

The trap here is that candidates often think sharing a KMS key or enabling a monitoring service like AWS Config is sufficient for cross-account backup permissions, but AWS Backup requires explicit IAM role delegation via sts:AssumeRole for the backup account to act in member accounts.

How to eliminate wrong answers

Option B is wrong because sharing a customer managed key (CMK) from the backup account to member accounts is not a permission for backup operations; it only enables encryption/decryption, and AWS Backup can use AWS managed keys or KMS key policies for cross-account encryption without requiring CMK sharing. Option C is wrong because granting full S3 access to member account buckets is excessive and not specific to AWS Backup; AWS Backup uses its own service-linked roles and does not require direct S3 access for backup operations. Option D is wrong because AWS Config tracks resource compliance but does not grant any permissions for backup or restore actions; it is a monitoring service, not an authorization mechanism.

Full explanation →
262
MCQmedium

A company is migrating a critical application to AWS. The application requires a relational database with high availability and automated failover. The company wants to use a fully managed database service. Which AWS service should the architect choose?

A.Amazon RDS Multi-AZ
B.Amazon ElastiCache
C.Amazon DynamoDB
D.Amazon RDS Single-AZ
AnswerA

RDS Multi-AZ provides high availability with automatic failover.

Why this answer

Amazon RDS Multi-AZ provides high availability with automated failover. Amazon Aurora is also fully managed and provides high availability, but the question asks for a relational database service; both RDS and Aurora are valid, but RDS Multi-AZ is a direct fit for the requirement. DynamoDB is NoSQL.

RDS Single-AZ does not provide failover. ElastiCache is for caching.

Full explanation →
263
MCQmedium

A multinational company operates a multi-account AWS environment using AWS Organizations. The security team needs to enforce that all Amazon S3 buckets are encrypted at rest using AWS KMS customer managed keys (CMKs) and that no bucket policies allow anonymous access. What is the MOST efficient way to achieve this across all accounts?

A.Create IAM roles in each account that deny non-encrypted S3 operations and attach to all users.
B.Create AWS Organizations service control policies (SCPs) that deny PutBucketPolicy with anonymous effects and PutObject without encryption.
C.Use S3 bucket policies with Deny statements for anonymous access and missing encryption.
D.Deploy AWS Config rules to detect unencrypted buckets and anonymous access, with auto-remediation using Lambda.
AnswerB

SCPs centrally enforce restrictions across all accounts, covering all users including root.

Why this answer

AWS Organizations Service Control Policies (SCPs) can centrally enforce restrictions across all accounts in the organization without requiring per-account configuration. By creating SCPs that deny `s3:PutBucketPolicy` actions with an anonymous effect (using a condition key like `aws:SourceAccount` or inspecting the policy content) and deny `s3:PutObject` without the `x-amz-server-side-encryption-aws:kms` header, the security team ensures that no bucket can be made publicly accessible and no object can be uploaded without KMS encryption. This approach is the most efficient because it applies globally and proactively prevents non-compliant actions rather than detecting them after the fact.

Exam trap

The trap here is that candidates often choose reactive detective controls (like AWS Config with auto-remediation) because they seem comprehensive, but the question asks for the 'most efficient' way, which is a proactive preventive control using SCPs that blocks non-compliant actions before they happen.

How to eliminate wrong answers

Option A is wrong because IAM roles attached to users cannot prevent actions performed by services or roles that bypass user permissions, and managing roles in every account is not centralized or efficient. Option C is wrong because S3 bucket policies only apply to individual buckets and cannot enforce encryption on object uploads across all accounts; they also cannot prevent the creation of new buckets with permissive policies. Option D is wrong because AWS Config rules with auto-remediation are reactive—they detect violations after they occur and rely on Lambda functions to fix them, which is less efficient than proactively denying the actions via SCPs.

Full explanation →
264
MCQeasy

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

A.Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.
B.Use Amazon RDS Proxy to manage database connections.
C.Configure the JDBC connection string with a timeout and implement automatic retry logic.
D.Increase the TTL for the RDS DNS record to 60 seconds.
AnswerC

Retry logic allows the application to reconnect after failover.

Why this answer

Implementing a timeout and automatic retry logic in the JDBC connection pool ensures that after a failover, the application can quickly detect the failed connection and reconnect to the new primary. Option A is incorrect because restarting the application via CloudWatch Events and Lambda does not directly address connection failures and may cause additional downtime. Option B is incorrect: while Amazon RDS Proxy can help manage connections and reduce latency, it does not eliminate the need for application-level retry logic; during failover, connections are dropped and need to be re-established.

Option D is incorrect because increasing the TTL of the RDS DNS record would actually cause the application to cache the old DNS record longer, delaying failover detection.

Full explanation →
265
MCQeasy

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

A.Amazon DynamoDB
B.AWS Secrets Manager
C.AWS Identity and Access Management (IAM)
D.AWS Systems Manager Parameter Store
AnswerB

Secrets Manager is the best choice for managing secrets with automatic rotation.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS SDK, allowing retrieval of credentials at runtime without hardcoding, and supports automatic rotation of secrets for supported databases like Amazon RDS.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation and is not designed as a full lifecycle secrets management service, making Secrets Manager the correct answer for database credential rotation requirements.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL database service designed for storing application data, not for securely managing secrets; storing credentials in DynamoDB would require you to manage encryption and access control manually, and it lacks built-in secret rotation. Option C is wrong because AWS Identity and Access Management (IAM) is used for managing permissions and access to AWS resources, not for storing secrets; while IAM roles can grant Lambda permissions to access Secrets Manager, IAM itself cannot store or retrieve credential values. Option D is wrong because AWS Systems Manager Parameter Store can store secrets as SecureString parameters, but it does not natively support automatic rotation of database credentials, which is a key requirement for securely managing credentials over time.

Full explanation →
266
MCQmedium

A company is migrating a legacy application that uses a third-party identity provider (IdP) for authentication. The application currently uses SAML 2.0. The company wants to use AWS IAM Identity Center for centralized access management. What is the best approach to integrate the IdP with AWS?

A.Use AWS Directory Service for Microsoft Active Directory to synchronize with the IdP
B.Create IAM users for each employee and assign groups and permissions
C.Configure IAM Identity Center to use the existing IdP as the identity source via SAML 2.0 federation
D.Use Amazon Cognito user pools with the IdP as a SAML identity provider
AnswerC

IAM Identity Center supports SAML 2.0 federation with external IdPs.

Why this answer

AWS IAM Identity Center supports SAML 2.0 federation with external identity providers (IdPs). This allows centralized access management without duplicating identities. Option A is incorrect because AWS Directory Service for Microsoft AD is for Active Directory synchronization, not generic SAML federation.

Option B is incorrect because creating IAM users for every employee would duplicate identities and increase administrative overhead. Option D is incorrect because Amazon Cognito user pools are designed for customer-facing applications, not for enterprise SSO with existing IdPs.

Full explanation →
267
MCQmedium

A company is designing a new serverless data processing pipeline. The pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The company wants to ensure that failed records are automatically retried and sent to a dead-letter queue after three failed attempts. Which configuration should the company use?

A.Configure the Kinesis stream to send failed records to an SQS standard queue.
B.Configure an on-failure destination on the Kinesis event source mapping to send records to an SQS queue.
C.Configure the Lambda function's dead-letter queue property with an SQS queue.
D.Configure a Lambda destination on the function to send events to an SQS queue.
AnswerB

The event source mapping for Kinesis supports an on-failure destination for DLQ.

Why this answer

The on-failure destination on a Kinesis event source mapping allows you to specify an SQS queue to which records are sent after a configurable number of retry attempts (default is 3). This is the native mechanism for handling failed records in a Lambda-Kinesis integration, providing automatic retries and dead-letter queue behavior without custom code.

Exam trap

The trap here is that candidates often confuse the Lambda function's dead-letter queue (DLQ) property, which only works for asynchronous invocations, with the on-failure destination on event source mappings, which is the correct configuration for stream-based sources like Kinesis.

How to eliminate wrong answers

Option A is wrong because a Kinesis stream cannot directly send records to an SQS queue; the dead-letter handling must be configured on the event source mapping, not on the stream itself. Option C is wrong because the Lambda function's dead-letter queue property (DLQ) is only applicable for asynchronous invocations, not for stream-based event source mappings like Kinesis. Option D is wrong because Lambda destinations are used for routing invocation results (success/failure) to other services, but they do not provide the automatic retry and dead-letter queue behavior for failed records from a Kinesis stream; the on-failure destination on the event source mapping is the correct mechanism.

Full explanation →
268
MCQhard

A large e-commerce company uses a multi-account AWS Organizations setup with a central logging account. The company has enabled AWS CloudTrail in all accounts and configured it to deliver logs to a centralized Amazon S3 bucket in the logging account. Recently, the security team noticed that some log files are missing for a period of 2 hours. The CloudTrail console shows that trails are still enabled and delivering to the bucket, but no new log files were created during that time. The team verified that there were API calls made during that period. Which action is most likely to resolve the issue and prevent recurrence?

A.Review the SCPs attached to the organization root; there might be a policy that denies CloudTrail actions.
B.Check the S3 bucket policy in the logging account to ensure it grants the required permissions to the CloudTrail service principal from all accounts.
C.Ensure that the KMS key used for encryption is accessible by the CloudTrail service.
D.Enable AWS Config to monitor CloudTrail delivery status and automatically restart the trail if logs are missing.
AnswerB

If the bucket policy inadvertently denies access, CloudTrail cannot write logs.

Why this answer

The most likely cause is that the S3 bucket policy in the central logging account does not grant the necessary permissions for CloudTrail from all accounts to write log files. Even though trails are enabled and appear to be delivering, a missing or misconfigured bucket policy can silently drop log deliveries when the CloudTrail service principal (cloudtrail.amazonaws.com) attempts to write objects. The security team verified API calls occurred, so the issue is at the delivery destination, not the trail configuration itself.

Exam trap

The trap here is that candidates assume missing logs are always due to trail misconfiguration or KMS issues, but the real cause is often a missing or overly restrictive S3 bucket policy that silently blocks CloudTrail writes without generating an obvious error in the CloudTrail console.

How to eliminate wrong answers

Option A is wrong because SCPs deny actions at the account level, but CloudTrail trails are still enabled and delivering; if an SCP denied CloudTrail actions, the trail would fail to start or stop logging entirely, not selectively miss logs for a 2-hour window. Option C is wrong because if the KMS key were inaccessible, CloudTrail would log a failure event and typically stop delivering all logs until the issue is resolved, not just miss a 2-hour period while continuing to deliver before and after. Option D is wrong because AWS Config can monitor delivery status but cannot automatically restart a trail; it only provides compliance checks and notifications, and the trail is already enabled and delivering—restarting it would not fix a missing bucket policy permission.

Full explanation →
269
MCQeasy

A company is using AWS Organizations to manage multiple accounts. The security team wants to ensure that no one can disable AWS CloudTrail or delete CloudTrail log files across any account. What is the most effective way to enforce this?

A.Use an SCP to require that CloudTrail is enabled.
B.Use IAM policies in each account to deny the same actions.
C.Use AWS Config rules to detect and remediate changes.
D.Attach an SCP to the root OU that denies cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject actions for the CloudTrail S3 bucket.
AnswerD

SCPs can deny these sensitive actions across all accounts.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can be attached to the root organizational unit (OU) to centrally deny specific actions across all accounts, including the management account. By denying `cloudtrail:StopLogging`, `cloudtrail:DeleteTrail`, and `s3:DeleteObject` on the CloudTrail S3 bucket, the security team ensures that no principal in any account can disable CloudTrail or delete log files, regardless of their IAM permissions. SCPs are the only mechanism that can enforce such guardrails across all accounts in an organization without requiring per-account configuration.

Exam trap

The trap here is that candidates often choose Option A (SCP to require CloudTrail) because they confuse 'requiring' a service with 'preventing its disablement,' but SCPs cannot enforce that a service is running—they can only deny API actions, making Option D the only effective preventive control.

How to eliminate wrong answers

Option A is wrong because an SCP that 'requires' CloudTrail to be enabled does not prevent disabling or deleting it after it is enabled; SCPs can only deny actions, not enforce a state or configuration. Option B is wrong because IAM policies in each account can be overridden by a user with sufficient privileges (e.g., an account admin) and do not provide a centralized, unchangeable guardrail across all accounts. Option C is wrong because AWS Config rules can detect and trigger remediation (e.g., via Lambda), but they are reactive and can be bypassed if the rule or remediation role is modified or if the change occurs faster than the remediation cycle; they do not prevent the action from happening in the first place.

Full explanation →
270
Multi-Selectmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

Select 2 answers
A.Increase the instance size to handle more traffic per instance.
B.Switch from a step scaling policy to a target tracking scaling policy based on CPU utilization.
C.Increase the health check grace period for the Auto Scaling group.
D.Decrease the cooldown period for the Auto Scaling group.
E.Decrease the minimum number of instances in the Auto Scaling group.
AnswersB, D

Target tracking provides more responsive scaling than step scaling.

Why this answer

To improve scaling responsiveness, the team should use a target tracking scaling policy based on CPU utilization (Option B) because target tracking continuously adjusts the desired capacity to meet the target value, providing faster and more precise scaling than step scaling. Decreasing the cooldown period (Option D) allows new instances to start contributing to metrics sooner, enabling the Auto Scaling group to scale out more quickly during spikes. Option A (increasing instance size) does not improve the speed of scaling out; it only increases capacity per instance but not responsiveness.

Option C (increasing health check grace period) delays the detection of unhealthy instances, slowing down scaling. Option E (decreasing minimum number) reduces baseline capacity and does not help with scaling out speed.

Full explanation →
271
MCQhard

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

A.The Lambda function is returning a malformed IAM policy.
B.The token has expired.
C.The Lambda authorizer is not being invoked due to throttling.
D.The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.
AnswerD

Cached deny responses cause subsequent valid tokens to be rejected.

Why this answer

API Gateway caches the authorizer result based on the token. If a previous request with the same token was denied (e.g., due to an invalid token at that time), the cached deny policy will be used for subsequent requests even if the token is now valid, causing a 401 error. Option A is incorrect because the Lambda authorizer is being invoked successfully and returning a policy; the issue is with caching.

Option B is incorrect because the problem states tokens are valid, not expired. Option C is incorrect because throttling would result in the authorizer not being invoked, but the logs show it is invoked.

Full explanation →
272
MCQeasy

A company is using Amazon ECS with Fargate launch type for a microservices application. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization but no obvious pattern. What should the company do to identify the cause?

A.Increase the CPU and memory for all ECS tasks.
B.Enable AWS X-Ray tracing on the ECS tasks to trace requests across microservices.
C.Set up CloudWatch Synthetics canaries to monitor the endpoints.
D.Use CloudWatch Logs Insights to analyze application logs for errors.
AnswerB

Identifies latency sources.

Why this answer

AWS X-Ray provides distributed tracing to pinpoint performance bottlenecks. Option A is wrong because increasing task size is a reactive fix that does not identify the cause. Option C is wrong because CloudWatch Synthetics monitors endpoint availability, not internal trace data.

Option D is wrong because CloudWatch Logs Insights is for querying logs, not for tracing requests across microservices.

Full explanation →
273
MCQmedium

A company is migrating a large-scale e-commerce platform from on-premises to AWS. The migration plan includes rehosting the application servers and replatforming the database to Amazon Aurora. The company needs to ensure minimal downtime during the cutover. Which strategy should the company use for the database migration?

A.Use AWS DMS with a full load and ongoing replication to keep the target synchronized
B.Use AWS DMS with a full load only, then cut over
C.Use an application-level dual-write to both databases during the cutover
D.Take a snapshot of the on-premises database and restore it to Amazon Aurora
AnswerA

Correct. Ongoing replication reduces downtime during cutover.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication allows continuous data sync, enabling a cutover with minimal downtime. Using a snapshot backup requires downtime for restoration. AWS DMS with full load only does not keep the target up-to-date.

Using an application-level dual-write is complex and error-prone.

Full explanation →
274
MCQhard

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

A.The user cannot stop the instance because the condition checks the request region.
B.The user cannot stop the instance because the second statement denies all actions in regions other than us-east-1.
C.The user can stop the instance because the first statement allows it.
D.The user can stop the instance because the condition applies only to the Deny statement, but the Allow statement is unconditional.
AnswerB

The deny statement with condition StringNotEquals us-east-1 denies the action in us-west-2.

Why this answer

IAM policy evaluation follows an explicit deny model: any explicit deny overrides any allow. The second statement uses a `Deny` effect with a `StringNotEquals` condition on `aws:RequestedRegion`, which denies all actions (including ec2:StopInstances) when the request region is NOT us-east-1. Since the user is attempting to stop an EC2 instance in us-west-2, the condition evaluates to true, and the deny applies, blocking the action regardless of the first statement's allow.

Exam trap

The trap here is that candidates often assume an unconditional Allow always wins, but they forget that an explicit Deny with a condition that matches the request will override that Allow, leading them to incorrectly choose Option D.

How to eliminate wrong answers

Option A is wrong because the condition does not check the request region in a vacuum; it is part of a Deny statement that explicitly blocks actions when the region is not us-east-1, so the user cannot stop the instance due to the deny, not because of a generic region check. Option C is wrong because while the first statement allows ec2:StopInstances, the second statement's explicit deny overrides that allow, making the action impossible. Option D is wrong because the condition applies to the Deny statement, and the Allow statement is unconditional, but in IAM, an explicit deny always overrides an allow, so the unconditional allow does not help when a deny is triggered.

Full explanation →
275
MCQmedium

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

A.Amazon ECS Service Discovery
B.Application Load Balancer (ALB)
C.AWS Cloud Map
D.Amazon Route 53 private hosted zones
AnswerC

Cloud Map is a service discovery service that allows resources to register and discover each other, with health checks.

Why this answer

AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Exam trap

The trap here is that candidates often confuse Amazon ECS Service Discovery (Option A) as a separate service, when it is actually a feature of AWS Cloud Map, leading them to overlook Cloud Map as the correct, standalone service for dynamic service discovery.

How to eliminate wrong answers

Option A is wrong because Amazon ECS Service Discovery is not a standalone service; it is a feature of AWS Cloud Map that is exposed through Amazon ECS, and it lacks the broader API-based discovery and health-check integration that Cloud Map provides. Option B is wrong because an Application Load Balancer (ALB) is a Layer 7 load balancer that distributes traffic to targets, not a service registry for dynamic service-to-service discovery; it does not support service registration or DNS-based discovery for internal microservices. Option D is wrong because Amazon Route 53 private hosted zones provide DNS resolution within a VPC but do not support dynamic service registration, health checking, or API-based discovery; they are a static DNS solution, not a service discovery registry.

Full explanation →
276
MCQmedium

A company is migrating a critical application to AWS and needs to ensure business continuity. The application must be able to fail over to a different AWS Region with a Recovery Time Objective (RTO) of 15 minutes and a Recovery Point Objective (RPO) of 1 minute. Which strategy should the company use?

A.Warm standby in another Region
B.Multi-Region active-active deployment with synchronous replication
C.Pilot light in another Region
D.Backup and restore to another Region
AnswerA

Warm standby can achieve RTO of 15 minutes and RPO of 1 minute by maintaining a scaled-down environment in another Region with continuous replication. Correct answer.

Why this answer

Warm standby in another Region is the best strategy to achieve RTO of 15 minutes and RPO of 1 minute. A warm standby involves running a scaled-down version of the production environment in another Region, which can be quickly scaled up during failover. This approach allows for continuous data replication, typically with asynchronous replication that can achieve an RPO of 1 minute, and failover within minutes, meeting the 15-minute RTO.

Multi-Region active-active with synchronous replication is often impractical across long distances due to latency and cost, and synchronous replication typically requires both Regions to be active, which is complex and not necessary for this requirement. Pilot light has longer RTO (typically 10-30 minutes or more) and backup and restore has much higher RTO and RPO.

Full explanation →
277
MCQmedium

A company is migrating a legacy on-premises .NET application to AWS. The application uses Windows Authentication and relies on Active Directory. The company wants to minimize code changes. Which solution should the architect recommend?

A.Use AWS Systems Manager to store credentials and inject them at runtime.
B.Migrate the application to Amazon WorkDocs and configure single sign-on.
C.Use Amazon Cognito user pools for authentication.
D.Deploy the application on Amazon EC2 instances joined to an AWS Managed Microsoft AD directory.
AnswerD

EC2 instances joined to Managed AD can use Windows Authentication with minimal changes.

Why this answer

Deploy the application on Amazon EC2 instances joined to an AWS Managed Microsoft AD directory. This allows the application to use Windows Authentication with minimal code changes because the EC2 instances are domain-joined, enabling the application to authenticate users against Active Directory as it did on-premises. Option A is incorrect because AWS Systems Manager Parameter Store or Secrets Manager can store credentials but does not provide Windows Authentication integration.

Option B is incorrect because Amazon WorkDocs is a document sharing service, not a compute platform. Option C is incorrect because Amazon Cognito user pools are designed for external user identities, not for Windows Authentication against Active Directory.

Full explanation →
278
MCQeasy

A company wants to store application logs in a centralized location for analysis. The logs are generated by EC2 instances in an Auto Scaling group. The solution must be cost-effective and support real-time analysis. Which service should be used to collect and analyze the logs?

A.Amazon S3
B.Amazon Kinesis Data Firehose
C.Amazon Elasticsearch Service
D.Amazon CloudWatch Logs
AnswerD

CloudWatch Logs provides real-time log collection and analysis.

Why this answer

Amazon CloudWatch Logs is the correct choice because it natively integrates with EC2 instances via the CloudWatch Logs agent to collect, monitor, and analyze log data in real time. It provides a centralized log storage with built-in metric filters and subscription filters for real-time analysis, making it cost-effective for logs generated by Auto Scaling groups without requiring additional infrastructure.

Exam trap

The trap here is that candidates often confuse 'real-time analysis' with needing a dedicated analytics service like Amazon Elasticsearch Service, overlooking that CloudWatch Logs provides built-in real-time monitoring and filtering capabilities without additional cost or complexity.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service that does not support real-time analysis; it is typically used for archival or batch processing, not for streaming log collection and live querying. Option B is wrong because Amazon Kinesis Data Firehose is a streaming data delivery service that requires additional downstream services (like Amazon Elasticsearch Service or S3) for analysis and storage, adding complexity and cost for a simple log collection use case. Option C is wrong because Amazon Elasticsearch Service (now Amazon OpenSearch Service) is a search and analytics engine that can ingest logs but requires separate log collection agents and additional configuration for real-time analysis, making it less cost-effective and more complex than CloudWatch Logs for this scenario.

Full explanation →
279
MCQmedium

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all new member accounts automatically have a specific AWS Config rule enabled. Which solution should be used?

A.Use AWS CloudFormation StackSets in each account.
B.Create an AWS Lambda function in the management account to enable Config rules.
C.Use an SCP to require Config recording.
D.Deploy an AWS Config conformance pack across accounts using AWS Organizations.
AnswerD

Conformance packs can be deployed to all accounts and regions via a single API call.

Why this answer

AWS Config conformance packs are collections of AWS Config rules and remediation actions that can be deployed across multiple accounts and Regions using AWS Organizations. By deploying a conformance pack from the management account, you ensure that all existing and new member accounts automatically inherit the specified Config rules, as the conformance pack is applied at the organization level and propagates to new accounts as they are created.

Exam trap

The trap here is that candidates often confuse SCPs with direct resource configuration, thinking they can enforce Config rules via permission boundaries, but SCPs only control API calls and cannot enable services or rules themselves.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets require manual setup or automation to target new accounts; they do not automatically apply to new member accounts unless you update the stack set instances or use automatic deployment, which is not a native feature of StackSets alone. Option B is wrong because creating an AWS Lambda function in the management account to enable Config rules would require custom code to detect new accounts and apply rules, and it does not leverage AWS Organizations' native integration for automatic propagation. Option C is wrong because Service Control Policies (SCPs) are used to restrict permissions and cannot directly enable AWS Config rules or recording; they only control what actions are allowed or denied.

Full explanation →
280
Multi-Selecteasy

A company is designing a new application that will run on Amazon EC2 instances. The application writes logs to local disk, and the logs must be aggregated centrally for analysis. The company wants a solution that requires minimal configuration and can handle high log volume. Which TWO AWS services should the company use?

Select 2 answers
A.Amazon S3
B.AWS Lambda
C.Amazon Kinesis Data Firehose
D.Amazon CloudWatch Logs
E.Amazon CloudWatch Logs Insights
AnswersD, E

CloudWatch Logs can collect logs from EC2 instances using the CloudWatch agent.

Why this answer

Amazon CloudWatch Logs (option D) can collect logs from EC2 instances via the CloudWatch agent with minimal configuration and at scale. Amazon CloudWatch Logs Insights (option E) provides a query engine to interactively search and analyze the aggregated logs. Option A (Amazon S3) is used for log storage, not for real-time collection or analysis.

Option B (AWS Lambda) can process logs but is not designed for high-volume log ingestion without additional setup. Option C (Amazon Kinesis Data Firehose) is for streaming data to destinations like S3 or Redshift, but it requires more configuration and is not the simplest solution for EC2 log collection.

Full explanation →
281
MCQmedium

A company is migrating a large .NET application to AWS. The application uses Windows authentication and integrates with Active Directory. The company wants to minimize operational overhead for the directory service. The on-premises Active Directory is already synchronized to AWS using AWS Directory Service for Microsoft Active Directory. During migration, the application fails to authenticate users. The security team confirms that the on-premises AD and AWS Managed AD are in sync. The application is running on EC2 instances that are joined to the AWS Managed AD domain. The application logs show authentication errors. What is the most likely cause of the authentication failure?

A.The application requires NTLM authentication, which is disabled by default.
B.The security group does not allow traffic on port 389 (LDAP).
C.The EC2 instances cannot resolve the domain controller DNS name.
D.The application is using a service account that is not in the AWS Managed AD.
AnswerD

Common cause: service account not migrated or created.

Why this answer

The most likely cause is that the application is using a service account that is not present in AWS Managed AD. While the on-premises AD is synchronized, the specific service account may not have been replicated or may have been excluded from synchronization. Without the correct service account, Windows authentication will fail.

NTLM is enabled by default in AWS Managed AD, so option A is incorrect. The security group must allow LDAP traffic (port 389) for domain-joined instances; if instances are joined, this is already configured, making option B unlikely. EC2 instances must resolve the domain controller DNS to join the domain; since they are joined, DNS resolution is working, so option C is incorrect.

Full explanation →
282
Multi-Selecthard

A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)

Select 3 answers
A.Apply an S3 bucket policy on each bucket that denies PutObject without encryption.
B.Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.
C.Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.
D.Enable AWS Config managed rule s3-bucket-server-side-encryption-enabled to detect non-compliant buckets.
E.Enable default encryption on all S3 buckets using the AWS S3 console or API.
AnswersB, D, E

SCPs can restrict actions that create unencrypted buckets.

Why this answer

A service control policy (SCP) can deny PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled, preventing disabling of encryption at the bucket level. Option D is correct because AWS Config managed rule s3-bucket-server-side-encryption-enabled can detect S3 buckets that lack server-side encryption. Option E is correct because enabling default encryption on all S3 buckets ensures that new objects are automatically encrypted.

Option A is incorrect because while an S3 bucket policy can enforce encryption on uploads, it does not enforce encryption on existing objects and must be applied per bucket; moreover, it is not an organization-wide enforcement mechanism. Option C is incorrect because AWS CloudTrail only logs API calls and does not enforce encryption; it can alert but does not remediate.

Full explanation →
283
MCQeasy

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application consists of a frontend service and a backend service. The backend service is CPU-intensive and experiences high load during business hours. The operations team observes that the frontend service sometimes returns 503 errors during peak load. The team has already configured an ECS service auto scaling policy for the backend service based on average CPU utilization with a target value of 70%. The backend service is currently running 4 tasks, and the frontend is running 2 tasks. The errors seem to correlate with the backend scaling up. Which solution should the team implement to improve the application's performance and reduce errors?

A.Update the backend service auto scaling policy to use a combination of CPU and memory utilization metrics with a step scaling policy, and increase the cooldown period to allow tasks to stabilize before additional scaling actions.
B.Reduce the target CPU utilization for the backend auto scaling policy from 70% to 50% to trigger scaling earlier and keep CPU lower.
C.Change the backend service from Fargate to EC2 launch type and use larger instance types to provide more CPU capacity.
D.Increase the desired count of the frontend service to 4 tasks to handle more requests and reduce the load on the backend service.
AnswerA

Multiple metrics and step scaling with proper cooldown prevent premature scaling and handle spikes better.

Why this answer

The 503 errors during backend scale-up are likely caused by the backend tasks not being fully ready to handle traffic immediately after launch. By using a combination of CPU and memory utilization metrics with a step scaling policy, the team can make scaling decisions more responsive to actual load patterns. Increasing the cooldown period prevents additional scaling actions from being triggered prematurely, giving new tasks time to stabilize and reducing the window where the backend is overwhelmed, which in turn reduces frontend timeouts.

Exam trap

The trap here is that candidates often assume the solution is to scale earlier (Option B) or add more frontend capacity (Option D), when the real issue is the instability during the scaling event itself, which is addressed by stabilizing the scaling process with step policies and cooldowns.

How to eliminate wrong answers

Option B is wrong because simply reducing the target CPU utilization to 50% would cause the backend to scale up even more aggressively, potentially increasing the frequency of 503 errors during the scaling event itself, without addressing the root cause of instability during scale-up. Option C is wrong because switching to EC2 launch type and larger instances does not solve the transient overload during scaling; it only changes the underlying compute platform, and the same scaling instability would persist. Option D is wrong because increasing the frontend desired count does not reduce the load on the backend; it would only distribute incoming requests across more frontend tasks, but the backend would still be the bottleneck and could continue to return errors when it cannot keep up.

Full explanation →
284
MCQmedium

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

A.Use AWS CloudFormation StackSets to deploy a bucket template with tags.
B.Use IAM policies in each account to require tags on bucket creation.
C.Use a Service Control Policy (SCP) in AWS Organizations that denies s3:CreateBucket if the request does not include the required tags.
D.Use AWS Config rules to automatically tag buckets after creation.
AnswerC

SCPs prevent the action at the account level.

Why this answer

A Service Control Policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action if the request does not include the required tags (cost center and environment). SCPs apply to all accounts in the organization, enforcing the tagging requirement at the API level before the bucket is created, which is the most effective preventive control.

Exam trap

The trap here is that candidates often choose a reactive solution like AWS Config (Option D) because it can tag buckets, but they miss that the question requires enforcement at creation time, which only a preventive control like an SCP can achieve.

How to eliminate wrong answers

Option A is wrong because CloudFormation StackSets can deploy a bucket template with tags, but they do not enforce tagging on buckets created outside of that template (e.g., via the console, CLI, or SDK). Option B is wrong because IAM policies in each account can require tags, but they are not centrally managed and can be overridden by account administrators; also, IAM policies cannot enforce tags on the s3:CreateBucket action because the condition key for tags (aws:RequestTag) is not evaluated for all services in the same way. Option D is wrong because AWS Config rules can detect and tag buckets after creation (reactive), but they do not prevent untagged buckets from being created, which violates the security team's requirement to enforce tagging automatically at creation time.

Full explanation →
285
MCQmedium

A migration engineer is using AWS Application Migration Service (MGN) to migrate a Windows server from on-premises. The engineer runs the command above and sees the source server is in the "READY_FOR_TEST" state. What should the engineer do next?

A.Launch a test instance to validate the migration
B.Perform the cutover to the AWS environment
C.Modify the source server's recommended instance type to a smaller size
D.Resume data replication from the source server
AnswerA

Correct. Testing is the standard next step after initial replication.

Why this answer

The READY_FOR_TEST state indicates the initial replication is complete and a test instance can be launched. The next step is to launch a test instance to validate the migration. Cutting over immediately without testing is risky.

Resuming data replication is for troubleshooting. Checking the recommended instance type is optional but not the next required step.

Full explanation →
286
MCQmedium

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

A.Amazon Aurora Global Database
B.Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas
C.Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ
D.Amazon DynamoDB Global Tables
AnswerA

Aurora Global Database provides RPO of 1 second and automated failover across Regions.

Why this answer

Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Exam trap

The trap here is that candidates often confuse Multi-AZ failover (which is Region-bound) with cross-Region failover, or they assume that RDS cross-Region read replicas can achieve the same low RPO as Aurora Global Database, but RDS cross-Region replication is asynchronous and cannot guarantee sub-5-second RPO.

How to eliminate wrong answers

Option B is wrong because Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas uses asynchronous replication for cross-Region replicas, which can introduce replication lag exceeding 5 seconds, and Multi-AZ only provides automated failover within a single Region, not across Regions. Option C is wrong because Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ also relies on asynchronous replication for cross-Region copies, which cannot guarantee an RPO of less than 5 seconds, and Multi-AZ failover is limited to the same Region. Option D is wrong because Amazon DynamoDB Global Tables is a NoSQL database, not a relational database, and the question explicitly requires a relational database solution.

Full explanation →
287
MCQmedium

A company is using AWS CodePipeline to automate deployments of a web application. The deployment to an Amazon ECS cluster often fails during the 'Deploy' stage due to insufficient capacity in the target group. The operations team wants to improve the pipeline to automatically handle such failures without manual intervention. Which solution is MOST operationally efficient?

A.Use Amazon CloudWatch Alarms to trigger an AWS Lambda function that restarts the pipeline.
B.Modify the CodeBuild project to run integration tests after deployment.
C.Add a manual approval step before the deploy stage to verify capacity.
D.Configure the ECS service to automatically scale down the desired count on deployment failure.
E.Add a retry action in the CodePipeline stage for the ECS deployment.
AnswerE

Correct because CodePipeline supports retry actions that automatically retry the stage on failure, reducing operational overhead.

Why this answer

The most operationally efficient because it uses CodePipeline's built-in retry mechanism to automatically retry the failed 'Deploy' stage when the ECS deployment fails due to insufficient capacity. This eliminates the need for manual intervention or additional services like Lambda, reducing operational overhead. Option A adds unnecessary complexity with CloudWatch Alarms and Lambda.

Option B does not address capacity issues. Option C requires manual approval, which is not automated. Option D would reduce capacity, exacerbating the failure.

Full explanation →
288
MCQmedium

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

A.The application is returning a 500 Internal Server Error.
B.The application is taking too long to respond.
C.The security group is blocking health check traffic.
D.The application is redirecting health checks to another URL.
AnswerD

A 302 redirect suggests the application is redirecting the health check request.

Why this answer

The ALB health check expects a 200 OK response from the target. A 302 redirect indicates the application is responding with a redirect (e.g., HTTP to HTTPS or to a login page) instead of a success status. This causes the health check to fail because the ALB does not follow redirects for health checks; it only accepts the configured success codes (default 200).

Exam trap

The trap here is that candidates may assume a redirect is harmless or that the ALB will follow it, but the ALB strictly evaluates the first response status code against the configured success codes, and a 302 is not a success by default.

How to eliminate wrong answers

Option A is wrong because a 500 Internal Server Error would produce a 5xx status, not a 302 redirect. Option B is wrong because a timeout would result in a 504 Gateway Timeout or no response, not a 302 redirect. Option C is wrong because if the security group were blocking health check traffic, the ALB would receive no response (connection timeout or refused), not a 302 redirect.

Full explanation →
289
MCQeasy

A retail company is migrating its on-premises e-commerce application to AWS. The application currently runs on a single server with a MySQL database. The company wants to minimize operational overhead and improve scalability. Which migration strategy should be used?

A.Re-platform the application to use AWS Elastic Beanstalk and Amazon RDS.
B.Repurchase a new SaaS-based e-commerce solution.
C.Refactor the application as microservices on Amazon ECS with Amazon Aurora Serverless.
D.Rehost the application on Amazon EC2 and use Amazon RDS for MySQL.
AnswerD

Rehosting is quick and reduces operational overhead via RDS.

Why this answer

(Rehost) is the best migration strategy for this scenario because it involves lifting and shifting the application to Amazon EC2 with minimal changes, and using Amazon RDS for MySQL reduces operational overhead for database management. Rehosting is the fastest approach and aligns with the goal of minimizing operational overhead while improving scalability through managed services. Option A (Re-platform) would require modifications to use Elastic Beanstalk, increasing effort.

Option B (Repurchase) involves switching to a new SaaS solution, which is not a migration of the existing application. Option C (Refactor) requires significant development to convert to microservices, which is high effort and not necessary for the stated goals.

Full explanation →
290
MCQhard

Refer to the exhibit. A solutions architect has attached this IAM policy to an IAM role used by an application. The application is trying to upload an object to the S3 bucket example-bucket with server-side encryption using AWS KMS (SSE-KMS). What will happen?

A.The upload succeeds because the policy allows s3:PutObject for the bucket.
B.The upload fails because the policy requires SSE-S3.
C.The upload fails because the bucket policy does not allow SSE-KMS.
D.The upload succeeds because the condition only applies to encryption at rest.
AnswerB

The condition StringEquals on s3:x-amz-server-side-encryption must be AES256, but the request uses SSE-KMS.

Why this answer

The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` header to be set to `AES256` (SSE-S3) via the `StringEquals` condition. Since the application is attempting to use SSE-KMS, the encryption header will be `aws:kms`, which does not match the required value. Therefore, the condition fails, and the `s3:PutObject` action is denied, causing the upload to fail.

Exam trap

The trap here is that candidates assume the `s3:PutObject` action alone grants permission, overlooking the restrictive condition that requires a specific encryption header value, which is a common IAM policy nuance tested on the SAP-C02 exam.

How to eliminate wrong answers

Option A is wrong because the policy includes a condition that restricts the `s3:PutObject` action to only requests with SSE-S3 encryption, so simply allowing the action for the bucket is insufficient. Option B is correct as explained. Option C is wrong because the question does not mention any bucket policy; the failure is due to the IAM policy's condition, not a bucket policy.

Option D is wrong because the condition explicitly applies to the encryption header in the request, which is part of the encryption at rest configuration, and the condition is enforced.

Full explanation →
291
MCQhard

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

A.Use a rolling update with a new Auto Scaling group and delete old instances.
B.Create a new launch template with a patched AMI, then perform a rolling update that detaches and reattaches the existing EBS volumes.
C.Terminate all instances and launch new ones with a patched AMI.
D.Use Systems Manager Patch Manager to apply patches to running instances.
AnswerB

This replaces instances while preserving data by reattaching volumes, minimizing downtime.

Why this answer

It minimizes downtime by using a rolling update and preserves data by detaching and reattaching existing EBS volumes. Option A is wrong because it does not preserve existing EBS volumes, leading to data loss. Option C is wrong because terminating all instances causes downtime and does not preserve data.

Option D is wrong because patching running instances may cause application instability and does not ensure data preservation in case of rollback.

Full explanation →
292
MCQmedium

A company is migrating a monolithic e-commerce application to AWS. The application currently runs on a single on-premises server running Windows Server and SQL Server. The company wants to minimize re-architecting effort and time to migrate. Which migration strategy should the company use?

A.Retire the application and replace it with a SaaS solution
B.Refactor the application to use microservices on Amazon ECS
C.Rehost the application on Amazon EC2 Windows instances with SQL Server
D.Replatform the application to use Amazon RDS for SQL Server
AnswerC

Rehosting moves the application as-is, minimizing effort and time.

Why this answer

Rehost (lift-and-shift) involves moving the application as-is to AWS, minimizing changes and time. Option A (Retire) is not appropriate because the application is still needed. Option B (Refactor) requires significant re-architecting.

Option D (Replatform) involves some optimization but still requires changes.

Full explanation →
293
MCQeasy

A company uses AWS Organizations and wants to allow a development account to assume a role in the production account for deployment purposes. Which component is necessary for this cross-account access?

A.A VPC peering connection between the accounts
B.An IAM role in the production account with a trust policy allowing the development account
C.A service control policy (SCP) that permits AssumeRole
D.An AWS Config rule to validate the role
AnswerB

Trust policies enable cross-account role assumption.

Why this answer

Cross-account IAM access requires a role in the target (production) account with a trust policy that explicitly lists the source (development) account as a trusted principal. The development account then uses the STS AssumeRole API to obtain temporary credentials for that role. Without this trust policy, the role cannot be assumed from another account.

Exam trap

The trap here is confusing network connectivity (VPC peering) with IAM authorization, or assuming that an SCP alone can enable cross-account access when SCPs only act as a permission guardrail within an organization.

How to eliminate wrong answers

Option A is wrong because VPC peering connects networks at Layer 3 and does not provide any IAM-based authentication or authorization for cross-account role assumption. Option C is wrong because SCPs can only deny or allow permissions for principals within the same organization; they cannot grant cross-account access or replace the need for a trust policy on the target role. Option D is wrong because AWS Config rules evaluate resource compliance after the fact and do not enable or control the ability to assume a role across accounts.

Full explanation →
294
MCQmedium

A company is using the 7 Rs strategy to migrate a monolithic application to AWS. They want to move the application to the cloud without modifying the code but plan to later refactor parts of it. Which migration strategy should they choose initially?

A.Relocate
B.Refactor
C.Replatform
D.Rehost
AnswerD

Rehost moves the application without code changes, allowing future refactoring.

Why this answer

Rehost (lift-and-shift) is the correct initial strategy because it moves the application to AWS without modifying any code, aligning with the company's goal to first migrate without changes and later refactor. Relocate (A) involves moving the hypervisor, not the application itself. Refactor (B) involves rewriting or re-architecting the application, which is not desired initially.

Replatform (C) involves making some cloud optimizations that could require minor code changes.

Full explanation →
295
MCQmedium

A company is migrating an on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and the company has a 1 Gbps AWS Direct Connect connection. They need to minimize downtime. Which approach should the solutions architect recommend?

A.Export the database using Oracle Data Pump and import into RDS
B.Use AWS Snowball Edge to transfer the database files and then restore to RDS
C.Use AWS Schema Conversion Tool to convert the schema and AWS DMS for data migration without CDC
D.Use AWS DMS with full load followed by ongoing replication using change data capture (CDC)
AnswerD

Correct: DMS with CDC minimizes downtime by replicating changes continuously.

Why this answer

AWS Database Migration Service (DMS) with change data capture (CDC) allows continuous replication and minimal downtime. Export/import would cause downtime. AWS Schema Conversion Tool (SCT) is for schema conversion, not data migration.

Snowball is for offline data transfer and would delay the process.

Full explanation →
296
MCQhard

A company is migrating a 5 TB Microsoft SQL Server database to Amazon RDS for SQL Server. The migration must have minimal downtime. The team uses AWS DMS with ongoing replication. During the full load, the task fails with an error indicating that the source server's transaction log is full. What should the team do to resolve this issue?

A.Stop the DMS task, take a native backup of the source, restore it to RDS, and then start DMS with ongoing replication.
B.Increase the source server's transaction log size and set the log retention to a higher value.
C.Pause the DMS task, create a larger source instance, and restart the task.
D.Switch the DMS task to use batch-optimized apply mode.
AnswerB

This gives DMS more time to capture changes without filling the log.

Why this answer

The error indicates the source transaction log is full during the full load phase of AWS DMS. Increasing the transaction log size and setting a higher log retention value prevents the log from filling up while DMS reads it for ongoing replication. This allows the full load to complete without interruption, addressing the root cause directly.

Exam trap

The trap here is that candidates may confuse the transaction log full error with a performance issue, leading them to choose options like resizing the instance or changing apply mode, rather than addressing the log space directly.

How to eliminate wrong answers

Option A is wrong because taking a native backup and restoring to RDS bypasses DMS's ongoing replication setup, requiring manual configuration and potentially causing data loss or inconsistency; it also does not resolve the transaction log issue on the source. Option C is wrong because pausing the task and resizing the source instance does not address the transaction log being full; it only changes compute resources, not log management. Option D is wrong because batch-optimized apply mode affects how DMS applies changes to the target, not how it reads the source transaction log; it does not prevent the log from filling up.

Full explanation →
297
Multi-Selectmedium

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

Select 2 answers
A.Enable Multi-AZ for the RDS instance.
B.Implement DynamoDB Accelerator (DAX) in front of the database.
C.Scale up the RDS instance to a larger instance type.
D.Add an Amazon RDS Read Replica in the same AWS Region.
E.Implement an Amazon ElastiCache for Redis cluster to cache frequent queries.
AnswersD, E

Read Replicas can handle read queries, reducing load on the primary.

Why this answer

Adding an Amazon RDS Read Replica offloads read traffic from the primary MySQL database, allowing read queries to be served by the replica and reducing load on the source instance. This directly addresses the high number of read queries causing the bottleneck, as read replicas are designed for read-heavy workloads and can be promoted to a standalone instance if needed.

Exam trap

The trap here is that candidates often confuse Multi-AZ with read replicas, assuming the standby instance can serve reads, when in fact Multi-AZ only provides failover and the standby is not accessible for read operations.

Full explanation →
298
MCQmedium

A company is designing a disaster recovery solution for a web application hosted on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The application uses an Amazon RDS for MySQL database. They need to recover the database with a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

A.Use RDS Multi-AZ in us-east-1 and failover to DR site.
B.Use AWS DMS with ongoing replication to an RDS instance in us-west-2.
C.Use RDS Cross-Region Read Replica and promote it.
D.Use Amazon Aurora Global Database.
AnswerC

Correct. RDS Cross-Region Read Replicas for MySQL replicate data with an RPO of seconds. Promoting the replica is a fast operation, typically taking minutes, so RTO of 1 hour is easily satisfied.

Why this answer

RDS Cross-Region Read Replicas for MySQL provide asynchronous replication with an RPO of typically seconds, and promoting the replica to a standalone instance can be done quickly (minutes), meeting the RTO of 1 hour. Option A is incorrect because Multi-AZ is single region. Option B is incorrect because while DMS can achieve low RPO, it is typically used for migrations and ongoing replication setups may have higher operational complexity and RTO.

Option D is incorrect because Amazon Aurora Global Database is not available for RDS MySQL; it is for Aurora databases.

Full explanation →
299
MCQeasy

A company runs a static website on Amazon S3 with a custom domain using Amazon Route 53. The website content is updated frequently by multiple developers. The company wants to implement a workflow where updates are automatically tested and deployed. They have existing CI/CD tools that integrate with AWS CodeCommit. The Solutions Architect needs to design a deployment pipeline that rebuilds the website only when changes are pushed to the main branch, and then invalidates the Amazon CloudFront cache if a CloudFront distribution is used. Which solution meets these requirements with the least operational overhead?

A.Use AWS CloudFormation with a custom resource that triggers a build on CodeCommit push.
B.Configure an S3 event notification to invoke an AWS Lambda function that builds and deploys the website.
C.Use AWS CodePipeline with a source stage tied to CodeCommit, a build stage using AWS CodeBuild, and a deploy stage that syncs the S3 bucket and invalidates CloudFront.
D.Use AWS Lambda@Edge to generate the website on the fly and cache at CloudFront.
AnswerC

Fully managed CI/CD pipeline.

Why this answer

AWS CodePipeline with a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that syncs to S3 and invalidates CloudFront provides a fully managed CI/CD pipeline with minimal operational overhead. Option A is wrong because CloudFormation is for infrastructure provisioning, not for building a deployment pipeline triggered by code pushes. Option B is wrong because S3 event notifications trigger Lambda functions for simple tasks, not for full CI/CD build and deploy workflows.

Option D is wrong because Lambda@Edge is for processing requests at edge locations, not for building and deploying static content.

Full explanation →
300
MCQhard

A company is migrating a legacy monolithic application to AWS. The application has tightly coupled components and high latency between them. The company wants to modernize the application into a microservices architecture. Which migration strategy should the company use?

A.Repurchase
B.Rehost
C.Refactor / Re-architect
D.Replatform
AnswerC

This strategy changes the application architecture to microservices.

Why this answer

The refactor/re-architect strategy involves re-architecting the application into microservices. Option A is wrong because repurchase involves buying a new product, not re-architecting. Option B is wrong because rehost (lift-and-shift) does not modernize.

Option D is wrong because replatform (lift-tinker-and-shift) makes minor optimizations but does not change architecture.

Full explanation →
Page 3

Page 4 of 23

Page 5

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →