Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 301–375

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 5 of 23

301

MCQhard

A financial services company is designing a multi-tier application that must achieve a Recovery Time Objective (RTO) of 1 hour and a Recovery Point Objective (RPO) of 15 minutes for a database tier. The application uses Amazon RDS for MySQL with Multi-AZ deployment. Which disaster recovery strategy meets these requirements at the LOWEST cost?

A.Deploy the RDS instance in Multi-AZ configuration and take frequent snapshots to another Region.

B.Use AWS Database Migration Service (DMS) for continuous replication to an RDS instance in another Region.

C.Use Amazon Aurora Global Database, which provides global replication with typical RPO of 1 second.

D.Create a cross-Region read replica of the RDS MySQL instance in another Region. In a disaster, promote the read replica to a standalone instance.

AnswerD

Cross-Region read replicas provide asynchronous replication with low RPO, and promotion takes minutes, meeting RTO at lower cost than other solutions.

Why this answer

A cross-Region read replica for Amazon RDS MySQL provides asynchronous replication with an RPO typically under 15 minutes, and promoting it during a disaster can achieve an RTO of 1 hour. This approach incurs only the cost of the replica instance and cross-Region data transfer, making it the lowest-cost option that meets the stated RTO and RPO requirements.

Exam trap

The trap here is that candidates may confuse Multi-AZ (high availability within a Region) with cross-Region disaster recovery, or assume that Aurora Global Database is always the best choice for low RPO without considering cost constraints, leading them to overlook the simpler and cheaper cross-Region read replica option that still meets the specified RPO of 15 minutes.

How to eliminate wrong answers

Option A is wrong because Multi-AZ is a high-availability feature within a single Region, not a disaster recovery strategy; taking frequent snapshots to another Region cannot achieve an RPO of 15 minutes due to snapshot scheduling overhead and recovery time. Option B is wrong because AWS DMS for continuous replication adds significant cost for a replication instance and ongoing data transfer, and it is not the lowest-cost solution for the given RPO/RTO. Option C is wrong because Amazon Aurora Global Database, while offering very low RPO (~1 second), is more expensive than a cross-Region read replica for MySQL and exceeds the required RPO of 15 minutes, making it over-engineered and not the lowest-cost option.

Full explanation →

302

MCQmedium

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

A.The instance does not have an IAM role that allows sending metrics to CloudWatch.

B.The instance's security group is blocking outbound traffic to CloudWatch endpoints.

C.The instance is in the wrong AWS region for CloudWatch.

D.The CloudWatch agent is not installed or running on the instance.

AnswerD

The monitoring state is 'disabled', indicating detailed monitoring is off, but even with basic monitoring, the CloudWatch agent is needed for system-level metrics.

Why this answer

The exhibit shows an EC2 instance that is running and has internet connectivity, but metrics are not being sent to CloudWatch. For custom metrics (such as memory or disk utilization) to be published, the CloudWatch agent must be installed and running on the instance. Without the agent, the instance cannot collect and send operating-system-level metrics, even if network connectivity and IAM permissions are correctly configured.

Exam trap

The trap here is that candidates often assume missing IAM permissions or network restrictions are the root cause, overlooking that the CloudWatch agent must be explicitly installed and running to publish custom metrics beyond the default EC2 metrics.

How to eliminate wrong answers

Option A is wrong because the question states the instance has internet connectivity, and the default EC2 instance metadata service can provide temporary credentials if an IAM role is attached; however, even without a role, the instance could still send metrics if it uses access keys configured in the agent. The core issue is the absence of the agent, not the IAM role. Option B is wrong because the instance has internet connectivity, which implies outbound traffic is not blocked; CloudWatch endpoints are reachable via HTTPS (port 443), and if the security group allowed general internet access, it would not block CloudWatch specifically.

Option C is wrong because CloudWatch is a regional service, and the instance's region is irrelevant as long as the agent is configured to send metrics to the correct CloudWatch endpoint in that region; the instance being in the 'wrong' region would not prevent metric transmission if the agent is running.

Full explanation →

303

MCQmedium

Refer to the exhibit. An IAM role trust policy is shown. A user from account 123456789012 tries to assume this role but receives an 'AccessDenied' error. The user has MFA enabled and is passing the MFA token. What is the MOST likely reason for the failure?

A.The condition uses 'BoolIfExists' instead of 'Bool' which causes the policy to fail when the key is present.

B.The role requires MFA, but the user's MFA device is not configured correctly.

C.The user is not passing the MFA serial number and token code in the assume-role API call.

D.The principal is set to the root account, which does not allow IAM users to assume the role.

AnswerC

Even if MFA is enabled, the user must provide serial number and token code in the STS AssumeRole call.

Why this answer

The IAM role trust policy includes a condition that checks for the presence of both `aws:MultiFactorAuthPresent` and `aws:MultiFactorAuthAge`. Even though the user has MFA enabled and is passing the MFA token, the `aws:MultiFactorAuthSerialNumber` and `aws:MultiFactorAuthTokenCode` parameters must be explicitly included in the `sts:AssumeRole` API call. Without these, the condition evaluates to false, resulting in an 'AccessDenied' error.

Exam trap

The trap here is that candidates often assume that simply having MFA enabled and passing the token in the session is sufficient, but the `sts:AssumeRole` API call requires the MFA serial number and token code to be explicitly provided as parameters, which is a common oversight in programmatic role assumption scenarios.

How to eliminate wrong answers

Option A is wrong because `BoolIfExists` is a valid condition operator that returns true if the key exists and matches the value, or if the key is absent (missing). In this case, the condition uses `BoolIfExists` correctly to allow the role to be assumed when MFA is present; the failure is not due to the operator choice. Option B is wrong because the user has MFA enabled and is passing the MFA token, so the MFA device is configured correctly; the issue is that the MFA serial number and token code are not being passed in the API call.

Option D is wrong because setting the principal to the root account (the account ID) allows any IAM user in that account to assume the role, provided they meet the conditions; the root principal does not inherently block IAM users.

Full explanation →

304

MCQmedium

A Solutions Architect runs the following command for an EC2 instance that is part of an Auto Scaling group. The instance is in a private subnet and should only receive traffic from an Application Load Balancer. However, the instance is accessible from the internet. ``` $ aws ec2 describe-instances --instance-id i-0abcd1234efgh5678 { "Reservations": [ { "Instances": [ { "InstanceId": "i-0abcd1234efgh5678", "SecurityGroups": [ { "GroupName": "sg-web-app", "GroupId": "sg-0123456789abcdef0" } ], "PublicIpAddress": null, "SubnetId": "subnet-12345678", "VpcId": "vpc-23456789" } ] } ] } ``` Based on the output, what is the most likely reason?

A.The subnet's route table has a route to an internet gateway.

B.The instance has an Elastic IP address attached.

C.The instance has a public IP address assigned.

D.The security group attached to the instance allows inbound traffic from 0.0.0.0/0.

AnswerD

The security group 'sg-web-app' might have an inbound rule allowing all traffic, making the instance accessible even in a private subnet if there is a NAT gateway or if the instance has a public IP.

Why this answer

The output shows the instance has a security group 'sg-web-app' attached to its network interface. If that security group allows inbound traffic from 0.0.0.0/0, the instance would be accessible from the internet regardless of the subnet being private. The subnet's route table (Option A) having a route to an internet gateway would not matter for inbound traffic because the instance is in a private subnet and lacks a public IP; the ALB would handle inbound traffic via its public IP and forward to the private instance.

Option B is incorrect because an Elastic IP would make the instance directly reachable from the internet, but the output does not show an Elastic IP. Option C is incorrect because the instance is in a private subnet and would not have a public IP assigned automatically.

Full explanation →

305

MCQeasy

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

A.Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

B.Create an AWS Lambda function that encrypts objects after they are uploaded.

C.Configure an S3 Access Point with a policy that requires encryption.

D.Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.

AnswerD

Correct. Default encryption on the S3 bucket automatically encrypts all objects at rest using SSE-S3 or SSE-KMS, regardless of the upload request. It is the simplest and most effective solution to ensure encryption at rest.

Why this answer

Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload.

Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Full explanation →

306

MCQeasy

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

A.Enable termination protection on the stack.

B.Use AWS CodePipeline to automatically deploy changes.

C.Use Change Sets and require manual approval to execute them.

D.Use stack policies to prevent updates.

AnswerC

Change Sets show the impact of changes and can be executed after review.

Why this answer

AWS CloudFormation Change Sets allow you to preview how proposed changes will affect your running resources before executing them. By using Change Sets in conjunction with a manual approval process (e.g., via AWS CodePipeline or a separate review step), you can ensure changes are reviewed and approved before being applied. Option A (termination protection) only prevents stack deletion, not updates.

Option B (auto-deployment with CodePipeline) can include approval gates, but the question asks for the "BEST way" in the context of CloudFormation itself; Change Sets are the native mechanism for review. Option D (stack policies) control which resources can be updated, but do not enforce a review process.

Full explanation →

307

MCQeasy

A DevOps engineer notices that an EC2 instance's CPU utilization is consistently above 90%. They need to optimize costs without affecting performance. What should they do?

A.Add more EC2 instances behind a load balancer.

B.Rightsize the instance to a larger instance type.

C.Purchase a Reserved Instance for the current instance type.

D.Terminate the instance and launch a new one of the same type.

AnswerA

Adding more EC2 instances behind a load balancer allows scaling out, which can distribute the workload across smaller, cheaper instances, optimizing cost while maintaining or improving performance.

Why this answer

Adding more EC2 instances behind a load balancer allows you to distribute the workload across multiple smaller instances, which can be more cost-effective than a single large instance. This approach (scaling out) can improve performance and availability without necessarily increasing costs, as you can use smaller, cheaper instance types. Option B is wrong because rightsizing to a larger instance typically increases cost, contrary to the goal of cost optimization.

Option C is wrong because purchasing a Reserved Instance reduces cost but does not address the high CPU utilization performance issue. Option D is wrong because launching a new instance of the same type does not solve the performance problem.

Full explanation →

308

MCQmedium

Refer to the exhibit. A company has a trust policy on an IAM role in account 222222222222. The trust policy allows the root user of account 111111111111 to assume the role. However, a user in account 111111111111 is unable to assume the role. What is the most likely cause?

A.A service control policy in account 222222222222 is denying the sts:AssumeRole action

B.The role is not in the same region as the user

C.The trust policy only allows the root user, not individual users

D.The trust policy is malformed

AnswerC

The principal is the root user ARN; individual users need a separate ARN or permissions.

Why this answer

The trust policy explicitly allows only the root user of account 111111111111 (arn:aws:iam::111111111111:root) to assume the role. Individual IAM users within that account are not granted permission unless the trust policy includes the specific user ARN or a condition that allows federated access. Since the user is not the root user, the sts:AssumeRole call fails due to the principal restriction in the trust policy.

Exam trap

The trap here is that candidates often confuse the root user ARN (which represents the account but only grants access to the root user) with allowing all IAM users in the account, leading them to overlook the need to specify individual user ARNs or use a condition for broader access.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) in account 222222222222 would affect all principals in that account, but the issue is that the user in account 111111111111 cannot assume the role; SCPs do not block cross-account assume role calls from an external account. Option B is wrong because IAM roles and users are global resources; region does not affect the ability to assume a role via the global STS endpoint. Option D is wrong because the trust policy is not malformed; it is syntactically valid but overly restrictive by only allowing the root user principal.

Full explanation →

309

Multi-Selectmedium

A company is designing a new solution to store and analyze log files from multiple sources. The solution must provide near real-time analytics and the ability to query the logs using SQL. Which TWO AWS services should be used together to meet these requirements? (Choose two.)

Select 2 answers

A.Amazon CloudWatch Logs

B.Amazon Athena

C.Amazon ElastiCache

D.Amazon Redshift

E.Amazon Kinesis Data Firehose

AnswersB, E

Athena can query data in S3 using standard SQL.

Why this answer

Amazon Kinesis Data Firehose can ingest log data in near real-time and load it into Amazon S3. Amazon Athena can then query the data in S3 using SQL. Option A (CloudWatch Logs) is for monitoring, not ad-hoc analytics.

Option C (ElastiCache) is a cache, not for analytics. Option D (Redshift) is a data warehouse, not designed for near real-time log analysis with Athena-like querying.

Full explanation →

310

MCQmedium

A company is designing a microservices architecture on AWS ECS with Fargate. Each service needs to store and retrieve session state. The solution must be highly available and low latency. Which AWS service should be used for session state storage?

A.Amazon ElastiCache for Redis

B.Amazon RDS for MySQL

C.Amazon S3

D.Amazon DynamoDB

AnswerA

ElastiCache for Redis is an in-memory cache with sub-millisecond latency, ideal for session state.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides an in-memory data store with sub-millisecond latency, ideal for session state storage in a microservices architecture. Redis supports data structures like hashes and strings that map directly to session data patterns, and its replication and cluster modes ensure high availability across multiple Availability Zones. Fargate tasks can connect to ElastiCache via private subnets, maintaining low latency without the overhead of disk-based I/O.

Exam trap

The trap here is that candidates often choose DynamoDB because it is a managed, highly available database with low latency, but they overlook that session state is ephemeral and best served by an in-memory cache like Redis, which offers lower latency, automatic TTL expiration, and lower cost for transient data patterns.

How to eliminate wrong answers

Option B (Amazon RDS for MySQL) is wrong because relational databases introduce unnecessary latency and overhead for session state, which is ephemeral and requires fast reads/writes; RDS is optimized for persistent, ACID-compliant transactional data, not high-throughput key-value access. Option C (Amazon S3) is wrong because S3 is an object store with eventual consistency (unless using S3 Select or additional features) and higher latency (tens to hundreds of milliseconds), making it unsuitable for real-time session retrieval. Option D (Amazon DynamoDB) is wrong because while DynamoDB offers single-digit millisecond latency and is highly available, it is a NoSQL database with disk-based storage and higher per-request cost compared to an in-memory cache like Redis; for session state, which is transient and benefits from TTL-based expiration, Redis's in-memory model is more cost-effective and performant.

Full explanation →

311

MCQeasy

A company has a legacy application that runs on Windows Server 2008 R2 on-premises. The application is no longer supported by the vendor, but the company still needs to run it for compliance reasons. They are migrating to AWS and want to minimize changes. What should the solutions architect recommend?

A.Refactor the application to run on a supported Windows Server version

B.Upgrade to Windows Server 2019 and use AWS License Manager

C.Replace the application with a SaaS alternative

D.Use an Amazon EC2 instance with a Windows Server 2008 R2 BYOL AMI

AnswerD

Correct: Allows the legacy OS to run as-is, minimizing changes.

Why this answer

Using a Windows Server 2008 R2 BYOL AMI allows the company to run the legacy OS without changes. AWS does not provide mainstream support for 2008 R2, but BYOL allows it. Refactoring or replacing the application would require changes.

Upgrading the OS might break the application.

Full explanation →

312

Multi-Selecteasy

Which TWO AWS services can be used together to automate the discovery and migration of on-premises servers to AWS? (Choose two.)

Select 2 answers

A.AWS DataSync

B.AWS Database Migration Service (DMS)

C.AWS Server Migration Service (SMS)

D.AWS Application Migration Service (MGN)

E.AWS Application Discovery Service

AnswersD, E

MGN automates server migration.

Why this answer

AWS MGN automates server migration. AWS Application Discovery Service helps discover on-premises server inventory. AWS DMS is for databases.

AWS SMS is deprecated. AWS DataSync is for file/object storage.

Full explanation →

313

MCQeasy

A company wants to design a serverless event-driven architecture where multiple downstream services need to process events from a single source. Events must be reliably delivered and each downstream service must process every event independently. Which AWS service should be used as the event router?

A.AWS Step Functions

B.Amazon Kinesis Data Streams

C.Amazon Simple Queue Service (SQS)

D.Amazon EventBridge

AnswerD

Amazon EventBridge allows you to create rules that send events to multiple targets (e.g., Lambda, SQS, SNS, Step Functions) simultaneously, enabling independent processing.

Why this answer

Amazon EventBridge is the correct choice because it provides a fully managed event bus that can receive events from a single source and fan out to multiple downstream targets (e.g., Lambda, SQS, Step Functions) with built-in filtering, transformation, and reliable delivery. Each downstream service subscribes independently via rules, ensuring every event is processed by all subscribers without the need for a polling mechanism or manual orchestration.

Exam trap

The trap here is that candidates often confuse Amazon SQS or Kinesis as a fan-out solution, but SQS is point-to-point and Kinesis requires custom consumer logic, whereas EventBridge natively supports independent, reliable event routing to multiple targets without additional infrastructure.

How to eliminate wrong answers

Option A is wrong because AWS Step Functions is a workflow orchestration service, not an event router; it would require custom logic to fan out events and does not natively support independent, reliable delivery to multiple downstream services. Option B is wrong because Amazon Kinesis Data Streams is designed for real-time streaming data ingestion and processing with shard-level ordering, but it does not natively fan out events to multiple independent consumers—each consumer must share the same stream and manage its own checkpointing, which can lead to contention and does not guarantee independent processing of every event. Option C is wrong because Amazon SQS is a message queue that delivers each message to a single consumer; to fan out to multiple downstream services, you would need multiple queues and a publisher to send copies, which adds complexity and does not provide built-in event filtering or transformation.

Full explanation →

314

Multi-Selecteasy

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

Select 2 answers

A.AWS CloudTrail

B.AWS Organizations SCPs

C.AWS CloudFormation StackSets

D.Amazon VPC Flow Logs

E.AWS Config rules

AnswersB, E

SCPs can deny or allow actions across accounts.

Why this answer

AWS Organizations Service Control Policies (SCPs) allow you to centrally control the maximum available permissions for all accounts, enabling automated enforcement of compliance policies by restricting actions across multiple accounts without per-account configuration. AWS Config rules allow you to define rules that evaluate resource configurations against desired policies and can trigger automatic remediation actions, enforcing compliance across accounts when integrated with AWS Organizations.

Exam trap

The trap here is that candidates often confuse monitoring services (CloudTrail, VPC Flow Logs) with enforcement services, or assume that infrastructure deployment tools (CloudFormation StackSets) inherently enforce compliance, when in fact they only provision resources without policy enforcement.

Full explanation →

315

MCQmedium

A company is migrating an on-premises Hadoop cluster to Amazon EMR. The cluster processes large datasets that are stored on HDFS. The company wants to minimize migration effort and cost. Which storage option should the company use with Amazon EMR?

A.Amazon EBS volumes attached to the core nodes

B.Amazon S3 with EMRFS

C.Amazon FSx for HDFS

D.Amazon Elastic File System (EFS)

AnswerB

EMRFS allows EMR to use S3 as a drop-in replacement for HDFS.

Why this answer

Amazon S3 with EMRFS allows EMR to use S3 as a scalable, durable, and cost-effective storage layer, eliminating the need to manage HDFS. Option A is incorrect because EBS volumes require provisioning and management, and do not provide the same scalability and cost benefits. Option C is incorrect because Amazon FSx for HDFS is suitable for workloads requiring HDFS compatibility but is more complex and expensive than using S3.

Option D is incorrect because Amazon EFS is a file system, not optimized for Hadoop workloads and typically used for shared file storage.

Full explanation →

316

MCQeasy

A company is using AWS CloudFormation to manage infrastructure. The stack creation fails with the error 'Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/Admin/MySession is not authorized to perform: ec2:RunInstances'. What is the MOST likely cause?

A.The IAM role used by CloudFormation does not have ec2:RunInstances permission.

B.The region specified in the template is disabled.

C.The CloudFormation template has a syntax error.

D.The AWS account is not subscribed to EC2 service.

AnswerA

The error clearly states the role is not authorized.

Why this answer

The error message indicates that the IAM role assumed by CloudFormation does not have permission to perform ec2:RunInstances. Therefore, the IAM role used by CloudFormation lacks the necessary permissions (Option A). Option B is incorrect because a disabled region would cause a different error, not an authorization issue.

Option C is incorrect because a syntax error would produce a validation error, not an IAM authorization error. Option D is incorrect because AWS accounts are automatically subscribed to EC2; there is no subscription requirement.

Full explanation →

317

MCQmedium

A company is building a data lake on Amazon S3 using Parquet files. The data will be queried by multiple teams using Amazon Athena. The security team requires that access to sensitive columns (e.g., PII) be restricted based on the user's role. Which solution provides column-level access control with the LEAST administrative overhead?

A.Use AWS Lake Formation to define column-level permissions in the Data Catalog.

B.Create separate S3 buckets for sensitive and non-sensitive data and apply bucket policies to restrict access.

C.Load the data into Amazon Redshift and use Redshift Spectrum to query S3, then apply column-level security through Redshift.

D.Use IAM policies with condition keys to restrict access based on the Athena workgroup.

AnswerA

Lake Formation integrates with Athena and allows fine-grained column-level access control with minimal effort.

Why this answer

AWS Lake Formation provides native column-level filtering in the Data Catalog, allowing you to define granular permissions on specific columns of a table without moving or duplicating data. When Athena queries a table registered with Lake Formation, the service automatically applies column-level access controls based on the IAM role or user, enforcing the restriction at query runtime with minimal administrative overhead.

Exam trap

The trap here is that candidates often assume S3 bucket policies or IAM conditions can achieve column-level access, but these operate at the object or API level and cannot filter columns within a single file, which is a key distinction tested in the SAP-C02 exam.

How to eliminate wrong answers

Option B is wrong because S3 bucket policies operate at the object or prefix level, not at the column level, so they cannot restrict access to specific columns within a Parquet file. Option C is wrong because it introduces unnecessary complexity and administrative overhead by requiring a separate Redshift cluster and Redshift Spectrum setup, whereas Lake Formation directly integrates with Athena and the Glue Data Catalog. Option D is wrong because IAM condition keys for Athena workgroups can limit which workgroup a user can use, but they cannot enforce column-level restrictions on the query results.

Full explanation →

318

MCQeasy

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

A.AWS Key Management Service (KMS)

B.AWS CloudHSM

C.AWS Systems Manager Parameter Store

D.AWS Secrets Manager

AnswerD

Secrets Manager provides secret storage with automatic rotation.

Why this answer

AWS Secrets Manager is designed for storing and rotating secrets centrally. Option A: AWS KMS is for encryption keys, not secret storage. Option B: AWS CloudHSM provides hardware security modules for key storage, not secret management with rotation.

Option C: AWS Systems Manager Parameter Store can store secrets but does not natively rotate them; rotation requires custom solutions.

Full explanation →

319

MCQmedium

An administrator attached the above IAM policy to a group of developers. A developer tries to launch a t3.medium EC2 instance and receives an 'AccessDenied' error. What is the MOST likely reason?

A.The policy denies all instance types except t3.micro and t3.small.

B.The policy has a syntax error that causes all actions to be denied.

C.The policy does not explicitly allow ec2:RunInstances.

D.The policy requires a specific Amazon Machine Image (AMI) that the developer is not using.

AnswerA

The condition denies if the instance type is not in the list.

Why this answer

The IAM policy includes a Deny statement that explicitly denies ec2:RunInstances for any instance type that is not t3.micro or t3.small. Since the developer is attempting to launch a t3.medium instance, which is not listed in the allowed types, the Deny statement matches and overrides any Allow, resulting in an AccessDenied error. This is the most likely reason because explicit Deny always takes precedence over Allow in IAM policy evaluation logic.

Exam trap

The trap here is that candidates may overlook the explicit Deny statement and assume the error is due to a missing Allow, but AWS IAM requires both an Allow and no matching Deny for the action to succeed, and the Deny here is the direct cause of the failure.

How to eliminate wrong answers

Option B is wrong because a syntax error in an IAM policy would cause the policy to be invalid and not saved or attached; AWS validates policy syntax before attachment, so a syntax error would not silently deny actions. Option C is wrong because the policy does explicitly allow ec2:RunInstances in the Allow statement (for t3.micro and t3.small), so the developer is not denied due to a missing Allow. Option D is wrong because the policy does not reference any AMI condition; the Deny is based solely on instance type, not on the AMI used.

Full explanation →

320

MCQhard

A company has a multi-account setup with AWS Organizations. The security team wants to enforce that all IAM users must have MFA enabled. Which approach is most effective?

A.Use AWS Config rules to detect users without MFA and send alerts.

B.Use AWS CloudTrail to monitor and disable users without MFA.

C.Set an IAM password policy that requires MFA for all users.

D.Apply an SCP that denies all actions if the principal does not have MFA.

AnswerD

Forces MFA for all API calls.

Why this answer

Service Control Policies (SCPs) in AWS Organizations can enforce preventive security controls across all accounts in the organization. By denying all actions when a principal does not have MFA, the SCP effectively blocks any API call from IAM users or roles that haven't authenticated with MFA, ensuring compliance at the organizational level regardless of individual account configurations.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config alerts) with preventive controls (like SCPs), or mistakenly think IAM password policies can enforce MFA, when in fact password policies only govern password characteristics, not multi-factor authentication.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are detective, not preventive; they can detect users without MFA and send alerts, but they cannot enforce MFA or block actions. Option B is wrong because AWS CloudTrail is a logging service that records API calls; it cannot disable users or enforce MFA, and monitoring alone does not prevent non-compliant actions. Option C is wrong because an IAM password policy cannot require MFA for all users; password policies control password complexity, rotation, and reuse, but MFA enforcement must be done via IAM policies or SCPs, not password policies.

Full explanation →

321

MCQmedium

A company has a centralized security account and wants to enable AWS Config in all accounts. They want to centrally manage Config rules and view compliance. What should they do?

A.Apply an SCP to enable AWS Config in all accounts.

B.Use CloudFormation StackSets to deploy Config rules, then view in each account.

C.Enable AWS Config in the security account only and use cross-account roles.

D.Enable AWS Config in each account and use an aggregator in the security account.

AnswerD

Aggregator collects compliance data from multiple accounts.

Why this answer

AWS Config must be enabled in each individual account to record resource configurations and evaluate rules. An aggregator in the security account can then collect compliance data from all accounts, enabling centralized viewing and management of Config rules without needing to log into each account separately.

Exam trap

The trap here is that candidates assume a single Config instance in a central account can monitor all other accounts via cross-account roles, but AWS Config is account-scoped and must be enabled in each account to record its own resources.

How to eliminate wrong answers

Option A is wrong because SCPs (Service Control Policies) can only restrict or deny permissions; they cannot enable a service like AWS Config in accounts. Option B is wrong because CloudFormation StackSets can deploy Config rules across accounts, but without Config being enabled in each account first, the rules have no configuration recorder to evaluate against, and compliance cannot be viewed centrally without an aggregator. Option C is wrong because enabling AWS Config only in the security account would only record resources in that account; cross-account roles allow access but do not enable Config recording or rule evaluation in other accounts.

Full explanation →

322

MCQeasy

A company is designing a new application that will run on AWS. The application needs to store and retrieve user session data with low latency. The session data is small (less than 1 KB per user) and must be highly available. The company expects up to 10 million active users per day. Which AWS service should be used as the session store?

A.Amazon DynamoDB

B.Amazon S3

C.Amazon RDS for MySQL

D.Amazon ElastiCache for Redis

AnswerD

Amazon ElastiCache for Redis is an in-memory key-value store that provides sub-millisecond latency, making it the best choice for storing user session data for up to 10 million active users.

Why this answer

Amazon ElastiCache for Redis is an in-memory data store designed for low-latency access, making it ideal for session storage for millions of users. Option A: DynamoDB has higher latency compared to in-memory stores. Option B: S3 is object storage and not suitable for low-latency session data.

Option C: RDS for MySQL is relational and slower for session access.

Full explanation →

323

MCQhard

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

A.The GuardDuty detector in the management account is not configured to publish findings to S3.

B.GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

C.The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

D.Each member account must individually configure the S3 bucket as a publishing destination for its own findings.

AnswerD

Each account must set up its own publishing destination.

Why this answer

For GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place.

Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Full explanation →

324

Multi-Selectmedium

A company is planning to migrate its on-premises Oracle database to Amazon RDS for Oracle using AWS DMS. The database is 5 TB in size with continuous changes. Which TWO steps should the company take to minimize downtime during the migration?

Select 2 answers

A.Set up ongoing replication using change data capture (CDC) from the start.

B.Enable Multi-AZ on the target RDS instance during migration.

C.Use AWS Direct Connect to establish a dedicated network connection.

D.Use a large DMS replication instance to improve throughput.

E.Perform a full load migration first, then apply CDC after the cutover window.

AnswersA, D

CDC minimizes downtime by replicating changes continuously.

Why this answer

Setting up ongoing replication using change data capture (CDC) from the start allows continuous synchronization of changes, minimizing the final cutover downtime. Option D is correct because using a large DMS replication instance improves throughput and speeds up the data transfer, reducing the overall migration time. Option B is incorrect because Multi-AZ is a high-availability feature for the target RDS instance, not a factor in migration speed or downtime reduction.

Option C is incorrect because while AWS Direct Connect can provide a reliable network connection, it is not a specific step to minimize downtime during migration; the primary focus should be on replication strategy and instance size. Option E is incorrect because performing a full load first and then applying CDC after the cutover window would result in a longer downtime compared to having CDC running from the start.

Full explanation →

325

MCQmedium

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

A.Store the Docker image in Amazon S3 instead of ECR.

B.Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.

C.Use the 'latest' tag for all images.

D.Retry the failed pipeline step after a delay.

AnswerB

Unique tags prevent collisions and ensure the correct image is used.

Why this answer

Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Full explanation →

326

MCQeasy

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts and business applications. The company uses Microsoft Active Directory on-premises. Which AWS service should be used to integrate with the existing directory?

A.Amazon Cognito user pools

B.AWS Organizations

C.AWS Identity and Access Management (IAM)

D.AWS IAM Identity Center (AWS SSO) with an AWS Managed Microsoft AD directory

AnswerD

Integrates with on-premises AD via AD Connector or managed AD.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) can be integrated with an AWS Managed Microsoft AD directory to provide a single sign-on experience across multiple AWS accounts and business applications. This integration allows users to authenticate using their existing on-premises Active Directory credentials via AD Connector or a two-way forest trust, enabling seamless access to the AWS Management Console, command-line interface, and supported SAML 2.0 applications.

Exam trap

The trap here is that candidates often confuse AWS IAM Identity Center with AWS IAM, assuming IAM alone can provide SSO across multiple accounts, but IAM is account-scoped and lacks the centralized application portal and cross-account federation capabilities that IAM Identity Center provides.

How to eliminate wrong answers

Option A is wrong because Amazon Cognito user pools are designed for customer-facing identity and access management, not for integrating with an existing on-premises Microsoft Active Directory for employee SSO across multiple AWS accounts. Option B is wrong because AWS Organizations is a service for centrally managing and governing multiple AWS accounts, not for providing identity federation or SSO capabilities. Option C is wrong because AWS IAM is used for managing permissions for individual AWS users and roles, but it does not natively support SSO integration with on-premises Active Directory or provide a centralized portal for accessing multiple AWS accounts and business applications.

Full explanation →

327

MCQeasy

A company wants to centrally manage backups for Amazon EBS volumes across multiple AWS accounts. They need a solution that can automatically back up volumes based on tags, retain backups according to a policy, and send notifications on failures. Which AWS service should they use?

A.AWS CloudFormation StackSets

B.Amazon RDS automated backups

C.AWS Backup

D.Amazon S3 lifecycle policies

AnswerC

AWS Backup provides centralized backup management across accounts.

Why this answer

AWS Backup is the correct service because it provides a centralized, policy-based backup solution for Amazon EBS volumes across multiple AWS accounts. It supports tag-based backup policies, retention rules, and integrates with Amazon CloudWatch Events and Amazon SNS to send notifications on failures, meeting all the stated requirements.

Exam trap

The trap here is that candidates might confuse AWS Backup with native snapshot management or assume that a service like CloudFormation StackSets can handle backup automation, but only AWS Backup provides the centralized, policy-driven, cross-account backup management with notification capabilities required by the scenario.

How to eliminate wrong answers

Option A is wrong because AWS CloudFormation StackSets is used to deploy infrastructure as code across multiple accounts and regions, not for managing backups or retention policies. Option B is wrong because Amazon RDS automated backups are specific to RDS databases and cannot back up EBS volumes or operate across multiple accounts. Option D is wrong because Amazon S3 lifecycle policies manage the transition and expiration of objects within S3 buckets, not the backup of EBS volumes.

Full explanation →

328

MCQeasy

A company is designing a new static website hosted on Amazon S3. The website must be served over HTTPS with a custom domain name. Which AWS service should be used to achieve this?

A.Amazon Route 53 with alias record

B.Amazon CloudFront with SSL certificate

C.Amazon S3 static website hosting with bucket policy

D.Elastic Load Balancer with SSL termination

AnswerB

CloudFront can be configured with a custom SSL certificate and domain to serve HTTPS.

Why this answer

Amazon CloudFront can be configured to serve content from an S3 bucket as the origin, and it supports custom SSL certificates via AWS Certificate Manager (ACM) or IAM, enabling HTTPS for a custom domain. This is the recommended architecture for static websites requiring HTTPS because CloudFront provides edge caching, DDoS protection, and seamless SSL termination.

Exam trap

The trap here is that candidates often assume S3 static website hosting can directly serve HTTPS with a custom domain, but S3's built-in website endpoint does not support custom SSL certificates, making CloudFront the required service for HTTPS termination with a custom domain.

How to eliminate wrong answers

Option A is wrong because Amazon Route 53 with an alias record only provides DNS resolution, not HTTPS termination; it cannot serve content over HTTPS directly. Option C is wrong because Amazon S3 static website hosting does not support custom SSL certificates or HTTPS for custom domains; it only provides HTTPS via the S3 website endpoint (which uses a domain like s3-website-<region>.amazonaws.com) and cannot bind a custom SSL certificate. Option D is wrong because an Elastic Load Balancer with SSL termination is designed for dynamic content behind EC2 or containers, not for static S3-hosted websites, and it adds unnecessary complexity and cost without leveraging S3's native static hosting benefits.

Full explanation →

329

MCQmedium

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

A.Replace the ALB with a Network Load Balancer and associate an ACM certificate with it.

B.Change the ALB listener to TCP and use a self-signed certificate on the EC2 instances.

C.Place a CloudFront distribution in front of the ALB and configure HTTPS between viewers and CloudFront.

D.Add an HTTPS listener to the ALB using an ACM certificate, and configure the HTTP listener to redirect to HTTPS.

AnswerD

This provides encryption and uses ACM for certificate management.

Why this answer

Adding an HTTPS listener to the ALB with an ACM certificate and configuring the HTTP listener to redirect to HTTPS ensures all traffic is encrypted in transit. This meets the security requirement directly without additional components. Option A is incorrect because Network Load Balancers do not support ACM certificates for TLS termination; they require TLS termination on the backend instances.

Option B is incorrect because TCP listeners cannot terminate TLS, and self-signed certificates on EC2 instances would not provide trusted encryption for clients. Option C is incorrect because while CloudFront can provide HTTPS, it adds unnecessary complexity and cost; the requirement can be met natively with the ALB.

Full explanation →

330

MCQeasy

A Solutions Architect is reviewing an Amazon S3 bucket policy that grants access to users from another AWS account. The policy uses the Principal element with "AWS": "arn:aws:iam::123456789012:root". The users in the other account are unable to access the bucket. What is the most likely cause?

A.The policy must specify the IAM user ARN, not the root user ARN.

B.The bucket policy must also include a VPC endpoint condition.

C.Cross-account access is not supported with bucket policies.

D.The bucket policy must use the CanonicalUser ID instead of the account ID.

AnswerA

The root user ARN does not cover IAM users in that account.

Why this answer

The root user ARN does not grant access to individual IAM users; the policy must allow the entire account or specific user ARNs. Option B is wrong because the bucket policy can refer to another account. Option C is wrong because S3 does not require VPC endpoints for cross-account access.

Option D is wrong because the bucket policy can use IAM user ARNs.

Full explanation →

331

MCQhard

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

A.The security group for the tasks does not allow inbound traffic from the ALB on the health check port.

B.The ECS service is configured with a desired count of zero.

C.The task definition specifies an invalid container image.

D.The ECS cluster has insufficient capacity.

AnswerA

Health checks fail if traffic is blocked.

Why this answer

If the security group for the tasks does not allow inbound traffic from the ALB on the health check port, health checks fail and tasks cannot register. Option B is incorrect because a desired count of zero would prevent new tasks from running, but the scenario describes deployments failing due to health check failures on new tasks. Option C is incorrect: an invalid container image would cause the task to fail to start, not cause health check failures after the task is running.

Option D is incorrect because Fargate manages capacity; insufficient capacity would cause a different error (e.g., unable to provision tasks), not health check failures.

Full explanation →

332

MCQmedium

A company is building a new data lake on AWS to store and analyze petabytes of data from various sources. The data includes structured (CSV, Parquet), semi-structured (JSON), and unstructured (images, videos) files. The company needs a cost-effective storage solution that allows running SQL queries directly on the data without loading it into a database. Data is accessed infrequently but must be available within minutes. Which solution should a Solutions Architect recommend?

A.Store data in Amazon S3 Glacier Deep Archive for cost savings, and use Athena for queries.

B.Store data in Amazon Redshift, use Redshift Spectrum to query data in S3.

C.Store data in Amazon S3 using lifecycle policies to transition infrequent data to S3 Standard-IA. Use Amazon Athena for SQL queries.

D.Store data in Amazon EBS volumes attached to an EC2 instance running a SQL engine.

AnswerC

S3 is cost-effective object storage; Athena is serverless and queries data directly in S3.

Why this answer

Amazon S3 is the ideal storage for a data lake, supporting structured, semi-structured, and unstructured data. Lifecycle policies can transition infrequent data to S3 Standard-IA to reduce costs while maintaining low latency retrieval. Amazon Athena enables serverless SQL queries directly on data stored in S3 without requiring loading into a database.

Option A is incorrect because S3 Glacier Deep Archive is for long-term archival with retrieval times of hours, not minutes, making it unsuitable for queries that require availability within minutes. Option B is incorrect because Amazon Redshift is a data warehouse that requires data to be loaded into it; Redshift Spectrum can query S3, but the primary storage is not designed for a data lake scenario where data is queried directly. Option D is incorrect because Amazon EBS is block storage attached to a single EC2 instance, which does not provide the scalability or cost-effectiveness for petabytes of data in a data lake.

Full explanation →

333

MCQeasy

A company is building a new web application that will be accessed by users globally. They want to minimize latency and protect against DDoS attacks. Which AWS service should they use as the entry point?

A.Elastic Load Balancing

B.AWS Global Accelerator

C.Amazon CloudFront

D.Amazon Route 53

AnswerC

CloudFront provides edge caching, low latency, and integrated DDoS protection.

Why this answer

Amazon CloudFront is correct because it is a global content delivery network (CDN) that caches content at edge locations close to users, reducing latency for static and dynamic content. It also provides built-in DDoS protection through AWS Shield Standard and can integrate with AWS WAF for additional layer 7 filtering, making it the ideal entry point for a globally accessed web application requiring both low latency and DDoS mitigation.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with CloudFront because both improve latency globally, but Global Accelerator does not cache content or provide application-layer DDoS protection, making it unsuitable as the primary entry point for a web application requiring both features.

How to eliminate wrong answers

Option A is wrong because Elastic Load Balancing distributes traffic only within a single AWS Region and does not provide global edge caching or native DDoS protection at the application layer; it relies on other services for global latency reduction. Option B is wrong because AWS Global Accelerator improves latency by routing traffic over the AWS global network to the optimal regional endpoint, but it does not cache content or provide application-layer DDoS protection; it focuses on TCP/UDP traffic optimization and uses static anycast IPs. Option D is wrong because Amazon Route 53 is a DNS service that resolves domain names to IP addresses and can perform health checks and routing policies, but it does not cache content or provide DDoS mitigation beyond basic DNS-level protection; it is not an entry point for application traffic.

Full explanation →

334

MCQmedium

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

A.An IAM policy must be attached to the role granting permissions to the S3 bucket

B.A service control policy must allow Lambda to assume roles

C.The S3 bucket must have a resource-based policy allowing the Lambda function

D.The trust policy must specify the Lambda function name

AnswerA

The trust policy allows Lambda to assume the role, but the role itself needs an IAM policy to grant S3 access.

Why this answer

The IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Exam trap

The trap here is that candidates often confuse the trust policy (which controls who can assume the role) with the permissions policy (which controls what actions the role can perform), leading them to think the trust policy alone is sufficient for accessing resources.

How to eliminate wrong answers

Option B is wrong because service control policies (SCPs) are used in AWS Organizations to restrict permissions for accounts, not to allow Lambda to assume roles; SCPs can only deny or allow permissions, but they do not grant the ability to assume roles—that is handled by IAM trust policies. Option C is wrong because the S3 bucket resource-based policy is not required when the Lambda function and the bucket are in the same account; in the same account, IAM roles alone can grant access without needing a bucket policy. Option D is wrong because the trust policy does not need to specify the Lambda function name; it only needs to specify the AWS service principal (lambda.amazonaws.com) to allow the Lambda service to assume the role on behalf of any function in the account.

Full explanation →

335

MCQhard

A company is migrating a legacy Oracle database to Amazon Aurora PostgreSQL. The migration must be completed with minimal downtime and minimal manual effort. Which AWS service should be used?

A.AWS DataSync

B.AWS DMS with ongoing replication

C.AWS Snowball Edge

D.AWS Schema Conversion Tool (SCT)

AnswerB

DMS can migrate from Oracle to PostgreSQL with minimal downtime via ongoing replication.

Why this answer

(AWS DMS with ongoing replication) is correct because AWS DMS can migrate data from Oracle to Aurora PostgreSQL with ongoing replication, enabling minimal downtime. Option A (AWS DataSync) is designed for file-based data transfers, not databases. Option C (AWS Snowball Edge) is for large-scale offline data transfer, not suitable for minimal downtime migration.

Option D (AWS Schema Conversion Tool) helps assess schema compatibility and convert schemas, but does not perform the actual data migration.

Full explanation →

336

Multi-Selecteasy

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which THREE actions can the company take?

Select 3 answers

A.Configure an S3 bucket policy to deny access from specific IP ranges.

B.Use CloudFront geo-restriction to allow or block countries.

C.Associate an AWS WAF web ACL with the CloudFront distribution and use a geo match condition.

D.Use CloudFront geographic restriction.

E.Use Lambda@Edge to check the request's country and return a 403.

AnswersB, C, D

Directly restricts access by country.

Why this answer

CloudFront's built-in geo-restriction feature allows whitelisting or blacklisting countries. Option C is correct because AWS WAF geo match conditions can be used with a CloudFront distribution to block or allow requests based on country codes. Option D is correct because CloudFront geographic restriction is another name for the same feature as geo-restriction, and it is a valid action.

Option A is incorrect because S3 bucket policies do not support geographic location conditions; they only support IP-based conditions. Option E is incorrect: although Lambda@Edge can be used to check the country and return a 403, it is not one of the simplest recommended actions; the question asks for actions the company can take, and geo-restriction and WAF are the primary methods.

Full explanation →

337

MCQeasy

A startup runs its application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to distribute traffic. During a recent marketing campaign, the application experienced high latency and some requests returned 503 errors. The team suspects that the tasks are hitting resource limits. The team wants to automatically scale the tasks based on CPU utilization. Which solution should the team implement?

A.Configure Application Auto Scaling for the ECS service with a target tracking scaling policy based on average CPU utilization.

B.Create a CloudWatch alarm that triggers a Lambda function to stop idle tasks.

C.Create an Auto Scaling group for the ECS cluster and configure it to scale based on CPU utilization.

D.Use AWS Lambda to periodically check CPU utilization and update the desired count of the ECS service.

AnswerA

Target tracking automatically adjusts the desired count to maintain a target CPU utilization.

Why this answer

Uses Application Auto Scaling with a target tracking scaling policy based on average CPU utilization, which automatically adjusts the desired count of ECS tasks to maintain CPU utilization. Option B stops idle tasks via Lambda, but does not scale based on CPU utilization. Option C creates an Auto Scaling group for the ECS cluster, which is designed for EC2 instances, not Fargate tasks.

Option D uses Lambda to periodically check CPU and update desired count, which is inefficient compared to native Application Auto Scaling. Therefore, Option A is correct.

Full explanation →

338

MCQhard

A global company uses AWS Organizations with hundreds of accounts. The networking team needs to allow VPCs in different accounts to communicate privately using AWS Transit Gateway. The company wants to centralize management while allowing individual account owners to create and attach VPCs. Which solution meets these requirements?

A.Create a VPN connection from each VPC to a central network appliance.

B.Use AWS PrivateLink to connect each VPC to a central VPC endpoint service.

C.Create a Transit Gateway in the networking account and share it with other accounts using AWS Resource Access Manager.

D.Create VPC peering connections between each VPC and a central VPC.

AnswerC

Allows centralized management and self-service attachment via RAM.

Why this answer

AWS Transit Gateway allows you to centralize network connectivity across multiple VPCs and accounts. By creating the Transit Gateway in the networking account and sharing it via AWS Resource Access Manager (RAM), you enable individual account owners to attach their VPCs to the shared Transit Gateway, achieving private communication while maintaining centralized management.

Exam trap

The trap here is that candidates often confuse AWS PrivateLink (which is for service exposure, not general routing) with Transit Gateway, or assume VPC peering can be scaled via a central VPC, failing to recognize that peering is non-transitive and requires a full mesh for multi-VPC connectivity.

How to eliminate wrong answers

Option A is wrong because VPN connections from each VPC to a central network appliance introduce significant complexity, bandwidth limitations, and operational overhead; they do not leverage native AWS transit capabilities and are not designed for scalable inter-VPC communication across hundreds of accounts. Option B is wrong because AWS PrivateLink is used to expose services privately from a VPC to other VPCs, not to enable general VPC-to-VPC routing; it requires creating endpoint services and does not provide a hub-and-spoke transit architecture for arbitrary VPC connectivity. Option D is wrong because VPC peering connections are one-to-one and do not scale to hundreds of accounts; they require full mesh or star topology with manual peering for each pair, and they do not support transitive routing, making centralized management impractical.

Full explanation →

339

MCQhard

A company is migrating a stateful firewall appliance to AWS. The appliance currently inspects traffic between multiple on-premises segments. In AWS, the company wants to deploy the appliance in a VPC to inspect traffic between subnets. Which architecture should the company use to ensure that the appliance can inspect all traffic?

A.Deploy the appliance behind an Application Load Balancer and configure the VPC route tables.

B.Deploy the appliance behind a Gateway Load Balancer in an inspection VPC and use a Transit Gateway to route traffic through it.

C.Deploy the appliance behind a Network Load Balancer and configure the VPC route tables to send traffic to the NLB.

D.Use VPC Gateway Endpoints to route traffic through the appliance.

AnswerB

GWLB is designed for transparent inspection of network traffic.

Why this answer

A Gateway Load Balancer (GWLB) can be deployed in an inspection VPC and used with a Transit Gateway to route traffic from subnets through the appliance for inspection. Option A is wrong because an Application Load Balancer cannot inspect traffic and is designed for HTTP/HTTPS. Option C is wrong because a Network Load Balancer does not inspect traffic; it forwards traffic without inspection.

Option D is wrong because VPC Gateway Endpoints are used to access AWS services privately, not for traffic inspection.

Full explanation →

340

MCQeasy

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

A.Create an Organizational Unit for each business unit within the existing account.

B.Use IAM policies with conditions based on resource tags to restrict access within the single account.

C.Create a separate AWS account for each business unit and use consolidated billing to manage costs.

D.Use Service Control Policies to restrict each business unit's access to specific services.

AnswerB

Allows logical separation without additional accounts.

Why this answer

It allows business units to have their own IAM users and permissions within the single account by using IAM policies with conditions based on resource tags, minimizing administrative overhead and avoiding additional costs associated with multiple accounts. Option A is incorrect because creating an OU within the existing account does not provide separate IAM user management; OUs are for grouping accounts in Organizations, not for user management. Option C is incorrect because while separate accounts with consolidated billing can provide separation, it increases administrative overhead and may lead to higher costs due to minimum usage per account.

Option D is incorrect because SCPs are used to manage permissions at the account level, not for individual IAM users; they cannot provide the granular user-level control that the business units require.

Full explanation →

341

MCQhard

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

A.The bucket contains delete markers that are not being expired.

B.The bucket has a bucket policy that prevents deletion.

C.Versioning is not enabled on the bucket.

D.The lifecycle rule is disabled.

AnswerA

Lifecycle does not automatically delete delete markers; need ExpiredObjectDeleteMarker.

Why this answer

Lifecycle rules for noncurrent versions do not automatically expire delete markers. Delete markers are not considered noncurrent versions and require a separate ExpiredObjectDeleteMarker action in the lifecycle policy. Option B is incorrect because bucket policies do not affect lifecycle expiration.

Option C is incorrect because versioning must be enabled for noncurrent version expiration to work; if versioning were disabled, the lifecycle rule would not apply. Option D is incorrect because the lifecycle rule is enabled as per the template; the issue is the absence of a rule for delete markers.

Full explanation →

342

MCQeasy

A company wants to migrate its on-premises virtualized workloads to AWS using the VMware Cloud on AWS service. The company currently uses VMware vSphere for virtualization. What is the primary benefit of using VMware Cloud on AWS for this migration?

A.It allows the company to continue using existing VMware management tools and processes

B.It provides better application performance compared to running on AWS native compute

C.It reduces the total cost of ownership by eliminating the need for any hardware maintenance

D.It eliminates the need to refactor applications for the cloud

AnswerA

Correct. VMware Cloud on AWS provides a consistent VMware environment.

Why this answer

VMware Cloud on AWS allows organizations to use the same VMware tools and processes, minimizing the learning curve and operational changes. It does not automatically reduce costs, nor does it provide better performance or eliminate the need to refactor applications.

Full explanation →

343

MCQhard

A company uses AWS Organizations and has a requirement that all API calls to AWS services must be logged and monitored. The security team wants to create a central CloudWatch dashboard that shows API activity across all accounts. Which solution should be implemented with the least operational overhead?

A.Use Amazon EventBridge to capture API calls from all accounts and route them to a central CloudWatch Logs group.

B.Enable CloudTrail in each account and configure the trail to send logs to a CloudWatch Logs group in that account. Then create a cross-account CloudWatch dashboard.

C.Use CloudWatch cross-account observability to aggregate logs from all accounts into a single monitoring account.

D.Enable an organization trail in CloudTrail in the management account to deliver logs to a central S3 bucket. Use Amazon CloudWatch Logs to process the logs and create a metric filter, then build a dashboard.

AnswerD

Organization trail centralizes logs, and CloudWatch Logs can create metrics and dashboards.

Why this answer

Enabling an organization trail in CloudTrail from the management account automatically applies to all accounts in the AWS Organization, delivering logs to a central S3 bucket with minimal per-account configuration. Using CloudWatch Logs with metric filters on that S3 bucket allows the security team to create a central CloudWatch dashboard that monitors API activity across all accounts, satisfying the requirement with the least operational overhead.

Exam trap

The trap here is that candidates often assume cross-account observability (Option C) is the simplest solution for central monitoring, but it does not natively aggregate CloudTrail logs and requires additional configuration, whereas an organization trail provides automatic, centralized logging with minimal overhead.

How to eliminate wrong answers

Option A is wrong because Amazon EventBridge captures events from AWS services but does not natively capture all API calls; CloudTrail is the service designed to log API activity, and EventBridge would require custom rules and additional infrastructure to route logs centrally. Option B is wrong because enabling CloudTrail in each account individually and sending logs to separate CloudWatch Logs groups creates significant operational overhead (managing trails per account) and cross-account dashboards require complex IAM permissions and log group sharing, which is not the simplest approach. Option C is wrong because CloudWatch cross-account observability is designed for monitoring metrics, logs, and traces across accounts but does not directly aggregate CloudTrail logs; it would still require each account to send logs to a central monitoring account, adding overhead compared to a single organization trail.

Full explanation →

344

Multi-Selectmedium

A company is migrating a web application to AWS and wants to use a multi-tier architecture with an Auto Scaling group of EC2 instances behind an Application Load Balancer. The company needs to store session state for the application. Which TWO approaches should the company use to store session state in a scalable and highly available manner? (Choose TWO.)

Select 2 answers

A.Use Amazon DynamoDB with on-demand capacity.

B.Use an EC2 instance store for each instance.

C.Use Amazon EBS snapshots shared across instances.

D.Use Amazon ElastiCache for Redis with replication.

E.Use Amazon RDS for MySQL with Multi-AZ.

AnswersA, D

DynamoDB is a fully managed NoSQL database with high availability.

Why this answer

Options A and D are correct because ElastiCache for Redis and DynamoDB are both highly available and scalable solutions for session state. Option B is wrong because instance store is ephemeral and data is lost if the instance stops or terminates. Option C is wrong because EBS snapshots are point-in-time backups and cannot be used for real-time session state sharing.

Option E is wrong because RDS is a relational database not optimized for session state storage.

Full explanation →

345

Multi-Selectmedium

A company is migrating a legacy application to AWS. The application currently runs on a single on-premises server with a local MySQL database. The company wants to minimize changes and reduce operational overhead. Which TWO strategies should the solutions architect recommend? (Select TWO.)

Select 2 answers

A.Refactor the application to use microservices

B.Retire the application

C.Replatform the database to Amazon RDS for MySQL

D.Rehost the application on Amazon EC2

E.Repurchase a SaaS alternative

AnswersC, D

Correct: Reduces operational overhead with managed database.

Why this answer

Rehost (lift-and-shift) minimizes changes by moving the application as-is. Replatforming the database to RDS reduces operational overhead by offloading database management. Retire is not applicable.

Refactor would require changes. Repurchase involves buying new software.

Full explanation →

346

MCQhard

Refer to the exhibit. A company has the above AWS Organization with a management account (111111111111) and a production account (222222222222). The security administrator in the management account creates an SCP that denies s3:DeleteBucket. The SCP is attached to the root. The production account's administrator tries to delete an S3 bucket and fails. What is the MOST likely reason?

A.The production account's IAM policy denies s3:DeleteBucket.

B.The SCP only applies to the management account.

C.The SCP applies to the production account because it is attached to the root.

D.The production account is the management account.

AnswerC

SCPs at the root apply to all member accounts.

Why this answer

SCPs are applied to all accounts in the organization when attached to the root, including the production account. The SCP denying s3:DeleteBucket is an effective deny that overrides any allow in IAM policies, so the production account's administrator cannot delete the bucket regardless of their IAM permissions.

Exam trap

The trap here is that candidates often think SCPs only affect the management account or that IAM policies can override SCPs, but SCPs attached to the root apply to all member accounts and create an effective deny that IAM policies cannot bypass.

How to eliminate wrong answers

Option A is wrong because even if the production account's IAM policy allows s3:DeleteBucket, the SCP deny at the root overrides it (an explicit deny in an SCP is an effective deny). Option B is wrong because SCPs attached to the root apply to all member accounts in the organization, not just the management account. Option D is wrong because the production account (222222222222) is a separate member account, not the management account (111111111111).

Full explanation →

347

MCQmedium

A CloudFormation stack is created using the template above. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]'. Logs show: 'AMI 'ami-0abcdef1234567890' does not exist.' What is the most likely cause?

A.The AMI ID is not available in the region where the stack is being deployed.

B.The SQS queue name 'my-queue' is already in use.

C.The AMI ID is invalid because it contains letters.

D.The instance type t2.micro is not supported in the region.

AnswerA

AMI IDs are region-specific; hardcoding can cause cross-region failures.

Why this answer

The error 'AMI does not exist' indicates that the hardcoded AMI ID in the CloudFormation template is not available in the region where the stack is being deployed. AMI IDs are region-specific, so using a hardcoded ID from another region causes the failure. Option B is incorrect because the SQS queue name collision would result in a different error.

Option C is incorrect because AMI IDs are alphanumeric by design. Option D is incorrect because the error specifically mentions the AMI, not the instance type.

Full explanation →

348

MCQhard

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

A.Increase the Glue job timeout setting to 24 hours.

B.Enable S3 Transfer Acceleration on the source bucket.

C.Increase the number of DPUs allocated to the Glue job.

D.Convert the input data from CSV to Parquet format.

AnswerC

More DPUs provide more parallelism and reduce runtime.

Why this answer

Increasing the number of DPUs (data processing units) allocated to the Glue job allows for greater parallelism, which directly reduces processing time for CPU-bound or memory-bound workloads. Option A is incorrect because increasing the timeout does not improve performance; it only prevents the job from failing due to time limits. Option B is incorrect because S3 Transfer Acceleration speeds up data transfer to S3, not the processing within Glue.

Option D is incorrect because while converting to Parquet can improve read performance and reduce data volume, it does not address the core processing bottleneck if the job is compute-intensive; the most effective immediate step is to increase DPUs.

Full explanation →

349

MCQhard

A global company uses AWS Organizations with multiple organizational units (OUs) for different business units. The networking team wants to ensure that all VPCs across all accounts can communicate through a central transit gateway. However, the security team requires that specific accounts cannot access each other's resources. Which combination of actions should the company take to meet these requirements?

A.Create a central transit gateway with a single route table. Use VPC endpoints to control traffic between VPCs.

B.Create VPC peering connections between all VPCs and use route tables to control access.

C.Create a central transit gateway with separate route tables for each VPC attachment. Use network ACLs in each VPC to restrict traffic between specific VPCs.

D.Create a central transit gateway with a single route table. Use security groups in each VPC to restrict traffic.

AnswerC

Separate route tables allow granular routing, and network ACLs can filter traffic at the subnet level.

Why this answer

It uses a central transit gateway with separate route tables for each VPC attachment, which allows the networking team to enable communication between all VPCs via the transit gateway while the security team can isolate specific accounts by controlling which route tables are associated with which VPC attachments. Network ACLs in each VPC provide an additional layer of stateless traffic filtering to restrict traffic between specific VPCs, complementing the route table isolation.

Exam trap

The trap here is that candidates assume a single transit gateway route table with security groups or network ACLs is sufficient, but security groups cannot filter traffic at the VPC level and network ACLs alone do not prevent the transit gateway from routing traffic between VPCs—route table isolation is the primary mechanism to enforce such restrictions.

How to eliminate wrong answers

Option A is wrong because a single route table in a transit gateway would allow all attached VPCs to communicate with each other by default, and VPC endpoints are used for private access to AWS services (e.g., S3, DynamoDB), not for controlling traffic between VPCs. Option B is wrong because VPC peering connections require a full mesh of connections (O(n²) complexity) and do not scale for a global company with many accounts; route tables alone cannot enforce the security requirement to block specific account pairs without complex, manual configuration. Option D is wrong because a single route table in the transit gateway would allow all VPCs to communicate, and security groups are stateful firewalls that operate at the instance level (not the VPC level) and cannot restrict traffic between entire VPCs or prevent VPC-to-VPC routing through the transit gateway.

Full explanation →

350

MCQeasy

A company uses AWS CloudFormation to manage its infrastructure. The operations team reports that stack updates often fail because of resource conflicts. The team wants to improve the reliability of updates without manual intervention. Which solution provides the MOST automated recovery from update failures?

A.Use CloudFormation change sets to review and approve all changes before update.

B.Write a custom AWS Lambda function that reverts changes when a stack update fails.

C.Apply a stack policy to prevent updates to critical resources.

D.Use the default CloudFormation rollback behavior that automatically reverts changes on failure.

AnswerD

CloudFormation automatically rolls back failed stack updates by default.

Why this answer

CloudFormation's built-in rollback behavior automatically reverts all changes made during a failed stack update, restoring the stack to its last known stable state without requiring any custom code or manual intervention. This provides the most automated recovery mechanism as it is natively integrated into the CloudFormation service and requires no additional infrastructure or scripting.

Exam trap

The trap here is that candidates may overthink the solution and choose a custom Lambda function (Option B) thinking it provides more control, when in fact CloudFormation's native rollback is the most automated and reliable approach, and custom solutions often introduce additional failure points.

How to eliminate wrong answers

Option A is wrong because change sets are a review and approval mechanism that helps prevent errors before an update is executed, but they do not provide any automated recovery after a failure occurs. Option B is wrong because writing a custom Lambda function to revert changes introduces unnecessary complexity, potential for errors, and is not as reliable or automated as CloudFormation's native rollback, which handles state management and resource dependencies correctly. Option C is wrong because stack policies only prevent updates to specific critical resources during a stack update, but they do not provide any recovery mechanism if the update fails due to conflicts elsewhere.

Full explanation →

351

MCQhard

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

A.Amazon Aurora Serverless

B.Amazon DynamoDB

C.Amazon DocumentDB (with MongoDB compatibility)

D.Amazon RDS for MySQL with Multi-AZ deployment

AnswerB

DynamoDB is a fully managed NoSQL database with high availability and auto scaling.

Why this answer

Amazon DynamoDB is a NoSQL database that supports high availability and automatic scaling. Option A: Amazon Aurora Serverless is a relational database, not NoSQL. Option C: Amazon DocumentDB (with MongoDB compatibility) is a NoSQL database but is MongoDB-compatible; DynamoDB is more fully managed and serverless and better suited for microservices on EKS.

Option D: Amazon RDS for MySQL with Multi-AZ deployment is relational and not NoSQL.

Full explanation →

352

MCQeasy

A company is migrating a legacy application to AWS. The application uses a proprietary binary protocol that is not HTTP-based. The application currently runs on a single server and communicates with clients over TCP port 4444. The company wants to use AWS Elastic Load Balancing to distribute traffic across multiple EC2 instances for high availability. Which load balancer type should the company use?

A.AWS Global Accelerator

B.Classic Load Balancer (CLB)

C.Network Load Balancer (NLB)

D.Application Load Balancer (ALB)

AnswerC

NLB supports TCP at Layer 4 and can handle proprietary protocols.

Why this answer

Network Load Balancer (NLB) operates at the transport layer (Layer 4) and supports TCP traffic, including proprietary protocols over port 4444. Option A is incorrect because AWS Global Accelerator uses anycast IP to improve performance but does not function as a regional load balancer; it is typically used with ALB or NLB. Option B is incorrect because Classic Load Balancer (CLB) is a legacy option that supports TCP but lacks advanced features and is not recommended for new applications.

Option D is incorrect because Application Load Balancer (ALB) only supports HTTP/HTTPS and cannot handle non-HTTP traffic.

Full explanation →

353

Multi-Selectmedium

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

Select 2 answers

A.Attach the IAM role to the EC2 instance profile.

B.Store the AWS access key and secret access key in a configuration file on the instance.

C.Create an S3 bucket policy that allows access from the EC2 instance's IP address.

D.Configure the EC2 security group to allow outbound traffic to S3.

E.Create an IAM role with a policy that grants the required S3 permissions.

AnswersA, E

Attaching the role to the instance profile allows the instance to assume the role.

Why this answer

An IAM role can be attached to an EC2 instance via an instance profile, allowing the instance to obtain temporary credentials from the AWS Security Token Service (STS) without storing any long-term credentials on the instance. This is the recommended secure method for granting EC2 instances access to AWS services like S3.

Exam trap

The trap here is that candidates often confuse network-level controls (security group outbound rules) with authentication/authorization mechanisms, thinking that allowing outbound traffic to S3 is sufficient to grant access, when in fact the instance still needs valid IAM credentials to authenticate requests to S3.

Full explanation →

354

MCQmedium

A media company is designing a video transcoding pipeline. They receive raw video files in Amazon S3, which need to be transcoded into multiple formats. The pipeline must handle sporadic bursts of uploads and complete processing within 30 minutes for each video. The cost should be minimized. Which design should they use?

A.Use AWS Lambda with layers containing FFmpeg to transcode videos.

B.Use Amazon S3 event notifications to trigger an AWS Elemental MediaConvert job.

C.Provision a cluster of EC2 instances running FFmpeg, with Auto Scaling based on SQS queue depth.

D.Use Amazon Elastic Transcoder, which is fully managed and triggers from S3 events.

AnswerB

MediaConvert is serverless, scales automatically, and is cost-effective for sporadic jobs.

Why this answer

AWS Elemental MediaConvert is a fully managed, serverless video transcoding service designed for high-volume, bursty workloads. It integrates directly with S3 event notifications, scales automatically to handle sporadic uploads, and completes each job within the required 30-minute window. Its pay-per-use pricing minimizes cost by eliminating idle infrastructure, unlike provisioned EC2 clusters or Lambda's 15-minute execution limit.

Exam trap

The trap here is that candidates often assume Lambda can handle any short-lived compute task, but they overlook the 15-minute timeout and lack of GPU support for video encoding, making it unsuitable for transcoding jobs that require longer processing times or specialized hardware acceleration.

How to eliminate wrong answers

Option A is wrong because AWS Lambda has a maximum execution timeout of 15 minutes, which cannot accommodate transcoding jobs that may exceed this limit, especially for high-resolution or long-duration videos. Option C is wrong because provisioning a cluster of EC2 instances with Auto Scaling based on SQS queue depth incurs significant idle costs during low-activity periods and requires ongoing operational overhead for patching and scaling, making it less cost-effective than a fully managed service. Option D is wrong because Amazon Elastic Transcoder is a legacy service that is being phased out in favor of Elemental MediaConvert; it lacks advanced features like per-title encoding, Dolby Vision, and HDR10+ support, and its pricing model is generally less flexible for sporadic workloads.

Full explanation →

355

MCQmedium

A company is designing a new microservices application using Amazon ECS with Fargate. The services need to communicate securely within the VPC. Which approach should be used for service discovery?

A.Amazon Route 53 private hosted zones with health checks

B.AWS Cloud Map

C.VPC peering connections between services

D.Application Load Balancer with path-based routing

AnswerB

Managed service discovery for microservices.

Why this answer

AWS Cloud Map is the correct choice because it provides a fully managed service discovery solution that integrates natively with Amazon ECS and Fargate. It allows microservices to register themselves with DNS-based or API-based service endpoints, enabling dynamic, secure communication within the VPC without requiring manual IP management or external DNS configuration.

Exam trap

The trap here is that candidates often confuse DNS-based resolution (Route 53 private hosted zones) with dynamic service discovery (AWS Cloud Map), assuming that static DNS records with health checks are sufficient for microservices that scale and change IPs frequently.

How to eliminate wrong answers

Option A is wrong because Route 53 private hosted zones with health checks are designed for DNS resolution and health monitoring of static resources, not for dynamic service discovery where service endpoints change frequently due to scaling or restarts. Option C is wrong because VPC peering connects entire VPCs, not individual services, and does not provide service discovery; it is a network connectivity mechanism, not a discovery mechanism. Option D is wrong because an Application Load Balancer with path-based routing is used for traffic distribution and routing to backend targets, not for service discovery; it does not provide a registry or DNS-based resolution for individual service instances.

Full explanation →

356

MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on AWS. They want to use an event-driven design where services react to state changes. Which AWS service should they use to capture, store, and replay events?

A.Amazon SNS

B.Amazon Kinesis Data Streams

C.Amazon EventBridge

D.Amazon SQS

AnswerC

EventBridge supports event archiving and replay.

Why this answer

(Amazon EventBridge) is correct because it is a serverless event bus that can capture events from various sources, store them, and allow replay, making it ideal for event-driven microservices. Amazon EventBridge supports event archival and replay, enabling services to react to state changes. In contrast, Option A (Amazon SNS) is a pub/sub messaging service that does not store events for replay.

Option B (Amazon Kinesis Data Streams) can replay data but is designed for real-time streaming data ingestion, not event sourcing in microservices. Option D (Amazon SQS) is a queue service for message decoupling and lacks event replay capability.

Full explanation →

357

MCQeasy

A startup is building a web application on AWS that requires a relational database. They expect unpredictable traffic patterns and want to minimize costs while ensuring high availability. Which database solution should they choose?

A.Amazon Redshift with concurrency scaling

B.Amazon Aurora Serverless (MySQL-compatible)

C.Amazon RDS for MySQL with Single-AZ deployment

D.Amazon DynamoDB with on-demand capacity

AnswerB

Aurora Serverless provides auto-scaling and high availability, cost-effective for unpredictable traffic.

Why this answer

Amazon Aurora Serverless (MySQL-compatible) is the correct choice because it automatically scales compute capacity based on actual application demand, making it ideal for unpredictable traffic patterns. It provides high availability through multi-AZ storage and automated failover, while minimizing costs by only charging for consumed capacity during active periods.

Exam trap

The trap here is that candidates often confuse 'relational database' with 'NoSQL' (DynamoDB) or choose a cheaper but non-HA option (Single-AZ RDS), overlooking that Aurora Serverless uniquely combines relational capabilities, automatic scaling, and built-in high availability at a cost-effective pay-per-request model.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse optimized for analytical queries on large datasets, not a transactional relational database for a web application, and concurrency scaling adds cost without addressing unpredictable traffic for OLTP workloads. Option C is wrong because Amazon RDS for MySQL with Single-AZ deployment lacks high availability—it does not provide automatic failover to a standby instance in another Availability Zone, which is required for the stated goal. Option D is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational database, and while on-demand capacity handles unpredictable traffic, it does not support SQL queries or relational data models needed for a web application with a relational database requirement.

Full explanation →

358

MCQmedium

Refer to the exhibit. A company has this IAM policy attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 with the tag 'Environment: staging'. What happens?

A.The instance is terminated because the policy allows TerminateInstances.

B.The termination is denied because the condition requires the 'Environment' tag to be 'production'.

C.The termination is denied because the Resource is not the instance's ARN.

D.The instance is terminated because the condition is not evaluated.

AnswerB

The condition StringEquals requires the tag value to be 'production'.

Why this answer

The TerminateInstances action has a condition that requires the tag 'Environment: production'. Since the instance has 'staging', the condition is not met, so the action is denied. Options A, B, and D are incorrect because the condition explicitly requires 'production'.

Full explanation →

359

MCQmedium

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

A.Modify the DBInstanceClass property in the CloudFormation template and use an UpdatePolicy of AutoScalingReplacingUpdate.

B.Create a new CloudFormation stack with the new DB instance class and delete the old stack.

C.Edit the CloudFormation template to change the DBInstanceClass and update the stack directly.

D.Use AWS OpsWorks to manage the DB instance and apply the change.

AnswerC

Updating the stack directly with the new instance class causes a reboot, which typically has minimal downtime. This is the correct approach for changing DB instance class.

Why this answer

Updating the CloudFormation stack directly with a new DBInstanceClass property will cause a reboot of the RDS DB instance, which typically has minimal downtime compared to creating a new instance. This is the standard approach for modifying RDS instance classes. Option A is incorrect because AutoScalingReplacingUpdate is an update policy for Auto Scaling groups, not applicable to RDS DB instances.

Option B is incorrect because creating a new stack and deleting the old one would cause significant downtime and is not efficient. Option D is incorrect because AWS OpsWorks is not used for managing RDS instances.

Full explanation →

360

MCQeasy

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

A.AWS CloudFormation Drift Detection

B.AWS CloudFormation StackSets

C.AWS CloudFormation Change Sets

D.AWS CloudFormation Nested Stacks

AnswerC

Change Sets provide a preview of changes before execution.

Why this answer

AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the DevOps team to review and approve stack updates by generating a summary of the changes (additions, modifications, deletions) without executing them immediately, meeting the requirement for a review-and-approval workflow.

Exam trap

The trap here is that candidates may confuse Drift Detection (which detects post-deployment configuration drift) with Change Sets (which preview intended changes before deployment), leading them to select Option A incorrectly.

How to eliminate wrong answers

Option A is wrong because Drift Detection is used to detect whether a stack's actual resources have deviated from the expected template configuration, not to review or approve updates before execution. Option B is wrong because StackSets enable you to deploy stacks across multiple accounts and regions from a single template, but they do not provide a mechanism to preview or approve changes before applying them. Option D is wrong because Nested Stacks allow you to compose stacks from other stacks for modularity, but they do not offer a change review or approval process for updates.

Full explanation →

361

MCQmedium

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

A.Enable CloudTrail Insights to detect unusual key creation patterns.

B.Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.

C.Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.

D.Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.

AnswerB

CloudWatch Events can react to specific CloudTrail events in real-time.

Why this answer

The most efficient way to alert when an IAM user creates a new access key is to use CloudWatch Events (now Amazon EventBridge) to match the CreateAccessKey API call from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail Insights is for detecting unusual activity patterns, not for real-time event-driven alerts. Option C is less efficient because it requires additional steps of publishing logs to CloudWatch Logs and creating a metric filter, adding complexity.

Option D is inefficient because querying CloudTrail logs with Athena is not real-time and requires custom scheduling.

Full explanation →

362

Multi-Selectmedium

A company is migrating a large number of on-premises virtual machines (VMs) to AWS using AWS Application Migration Service (AWS MGN). During the initial replication, some VMs fail with the error 'Replication agent cannot communicate with the AWS MGN endpoint'. Which TWO actions should the company take to resolve this issue? (Choose TWO.)

Select 2 answers

A.Reinstall the AWS Replication Agent on the source servers

B.Configure AWS PrivateLink VPC endpoints for AWS MGN in the target VPC

C.Ensure that the security group of the replication servers allows inbound traffic from the source servers

D.Verify that the source servers have outbound internet access to the AWS MGN endpoint

E.Increase the instance type of the source servers to provide more CPU and memory

AnswersB, D

VPC endpoints allow private connectivity without internet access.

Why this answer

The correct actions are B and D. AWS Application Migration Service (MGN) requires the replication agent to communicate with the AWS MGN endpoint. If the source servers do not have outbound internet access (option D), you can configure AWS PrivateLink VPC endpoints for AWS MGN (option B) to establish connectivity without internet access.

Option A (reinstalling the agent) is not a first troubleshooting step for connectivity issues. Option C (security group inbound rules) is about inbound traffic, but the agent initiates outbound connections. Option E (increasing CPU/memory) does not resolve communication failures.

Full explanation →

363

MCQhard

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

A.Update the Lambda function configuration to remove the VPC settings, then delete the subnet.

B.Modify the CloudFormation template to ignore the deletion failure using a DeletionPolicy attribute.

C.Use the AWS CLI to force delete the subnet.

D.Manually delete the Elastic Network Interface (ENI) from the AWS Management Console.

AnswerA

This releases the ENI, allowing subnet deletion.

Why this answer

To delete a subnet that is in use by a Lambda function's ENI, you must first disassociate the ENI. This can be done by updating the Lambda function configuration to remove the VPC settings, which causes Lambda to delete the ENI. After the ENI is deleted, you can delete the subnet.

Option B is incorrect because the DeletionPolicy attribute only handles deletion, not update failures, and the subnet is still in use. Option C is incorrect because there is no force delete option for subnets; dependencies must be resolved first. Option D is incorrect because ENIs managed by Lambda cannot be manually deleted; you must update or delete the Lambda function.

Full explanation →

364

Multi-Selecteasy

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Select 2 answers

A.Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

B.Enable AWS Config in all accounts to track patch compliance.

C.Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

D.Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.

E.Create a maintenance window in the management account and target instances using AWS Resource Groups that span accounts.

AnswersD, E

Required for SSM to manage instances.

Why this answer

Systems Manager requires an IAM service role in each member account to delegate permissions from the management account; the AmazonSSMManagedInstanceCore policy provides the minimum necessary permissions for SSM Agent to communicate with the Systems Manager service. Option E is correct because a maintenance window created in the management account can target instances across multiple accounts using AWS Resource Groups that are configured with cross-account resource queries, enabling centralized patch management without logging into each account.

Exam trap

The trap here is that candidates often confuse instance-level permissions (instance profile) with account-level permissions (service role), and they overlook that a maintenance window in the management account can target instances in member accounts only when a proper IAM service role is configured in each member account to allow cross-account Systems Manager operations.

Full explanation →

365

Multi-Selectmedium

A company is migrating a three-tier web application to AWS and wants to decouple the layers for scalability. Which THREE AWS services should they use?

Select 3 answers

A.Application Load Balancer (ALB)

B.Amazon Simple Queue Service (SQS)

C.Amazon RDS

D.Amazon CloudFront

E.Amazon ElastiCache

AnswersA, B, C

Routes traffic to web servers.

Why this answer

Options A, B, and C are correct. ALB for web tier, SQS for decoupling, and RDS for database. Option D (CloudFront) is a CDN, not for decoupling.

Option E (ElastiCache) is optional caching.

Full explanation →

366

MCQhard

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

A.Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

B.Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

C.Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

D.Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.

AnswerD

This enforces data residency at the organizational level.

Why this answer

AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies or permissions boundaries, thinking that IAM-level controls are sufficient for cross-account isolation, when in fact only SCPs at the OU level can enforce a hard deny across all accounts in an organization.

How to eliminate wrong answers

Option A is wrong because creating OUs per account type (Prod, Dev, Test) does not provide a mechanism to isolate access between countries; tags can be changed or omitted, and SCPs based on tags are not a reliable enforcement for strict data residency requirements. Option B is wrong because a single OU for all accounts cannot enforce cross-country isolation; IAM permissions boundaries are per-account and do not prevent cross-account access between countries within the same OU. Option C is wrong because AWS Resource Access Manager (RAM) is used for sharing resources, not for restricting access; IAM policies alone cannot prevent cross-country access if the accounts are in the same organization without SCPs at the OU level.

Full explanation →

367

MCQmedium

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to implement a change management process where all stack updates must be reviewed and approved before execution. The team currently uses AWS CodePipeline for CI/CD. Which solution meets these requirements with the LEAST operational overhead?

A.Use CloudFormation Change Sets and require a senior engineer to execute them.

B.Write an AWS Lambda function that triggers on stack update events and requires approval via Amazon SNS.

C.Use AWS Service Catalog to govern CloudFormation templates and require approval for provisioning.

D.Store CloudFormation templates in AWS CodeCommit and use AWS CLI to execute updates after peer review.

E.Create a CodePipeline pipeline with an approval stage before the CloudFormation deployment action.

AnswerE

CodePipeline supports manual approval actions that pause the pipeline until approval.

Why this answer

It leverages the existing CodePipeline CI/CD system with a built-in approval gate, allowing the operations team to review and approve CloudFormation stack updates before deployment with minimal additional overhead. Option A (Change Sets) requires manual execution and lacks integration with the CI/CD pipeline. Option B (Lambda + SNS) introduces custom code and additional management overhead.

Option C (Service Catalog) is designed for provisioning new resources, not for change management of existing stacks. Option D (manual CLI + peer review) does not automate the process and increases operational overhead.

Full explanation →

368

MCQmedium

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

A.Set up a VPN connection from each VPC to the on-premises AD.

B.Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.

C.Clone the directory and deploy it in each account.

D.Deploy an AD Connector in each VPC pointing to the on-premises AD.

AnswerB

Allows centralized directory with cross-account sharing.

Why this answer

AWS Resource Access Manager (RAM) allows you to share AWS Managed Microsoft AD directories across accounts without duplicating the directory or managing multiple trust relationships. This provides a single, centrally managed directory that multiple VPCs in different accounts can authenticate against, ensuring scalability and security by avoiding cross-account credential replication or complex VPN meshes.

Exam trap

The trap here is that candidates often assume each VPC needs its own directory or AD Connector, but AWS RAM enables secure, scalable sharing of a single Managed AD across accounts without additional infrastructure.

How to eliminate wrong answers

Option A is wrong because setting up a VPN from each VPC to on-premises AD does not leverage AWS Managed Microsoft AD and introduces latency, single points of failure, and management overhead for multiple VPN tunnels; it also fails to migrate the directory to AWS as required. Option C is wrong because cloning the directory and deploying it in each account creates multiple independent directories that require complex cross-forest trusts or replication, breaking the requirement for a single shared directory and increasing administrative burden. Option D is wrong because deploying an AD Connector in each VPC points back to the on-premises AD, which does not migrate the directory to AWS Managed Microsoft AD and still relies on on-premises infrastructure, defeating the purpose of the migration.

Full explanation →

369

Multi-Selectmedium

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

Select 2 answers

A.Use DynamoDB global tables to replicate data to another region.

B.Increase the read capacity units for the table.

C.Enable DynamoDB Accelerator (DAX) for the table.

D.Change the table's sort key to a more evenly distributed attribute.

E.Add a Global Secondary Index with a different partition key.

AnswersB, C

More read capacity reduces throttling and latency.

Why this answer

Increasing read capacity units (RCUs) directly increases the number of read operations per second, reducing latency during peak hours. Option C is correct because DynamoDB Accelerator (DAX) is an in-memory cache that significantly reduces read latency by caching frequently accessed items. Option E, adding a Global Secondary Index (GSI), can improve query performance but not necessarily overall read latency for existing access patterns; it is a design change that may not address peak-hour latency directly.

Option A is incorrect because global tables are for multi-region replication, not single-region performance. Option D is incorrect because changing the sort key does not improve read performance; sort key affects ordering within a partition, not throughput.

Full explanation →

370

MCQhard

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

A.Increase the SQS visibility timeout to allow more time per message.

B.Increase the Lambda function reserved concurrency.

C.Increase the Lambda function memory and timeout settings.

D.Increase the SQS batch size to the maximum of 100.

AnswerB

More concurrent executions allow processing more messages simultaneously.

Why this answer

Increasing the number of Lambda function instances will increase concurrency and process more messages in parallel. Option A is wrong because increasing batch size may cause timeouts. Option C is wrong because increasing function memory/timeout does not directly improve throughput.

Option D is wrong because SQS visibility timeout does not affect Lambda concurrency.

Full explanation →

371

MCQhard

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

A.Amazon S3 Glacier Deep Archive

B.Amazon S3 Intelligent-Tiering

C.Amazon S3 Standard

D.Amazon S3 One Zone-Infrequent Access

AnswerB

Automatically optimizes cost by moving data between tiers.

Why this answer

Amazon S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, optimizing storage costs without compromising performance. This meets the requirement for infrequently accessed data to be cost-effective while still providing immediate access for Athena queries and SageMaker training, as data in the archive instant access tier can be retrieved within milliseconds.

Exam trap

The trap here is that candidates might choose S3 Standard for its immediate access or S3 Glacier Deep Archive for lowest cost, overlooking that S3 Intelligent-Tiering provides both cost optimization for infrequent access and immediate retrieval via the Archive Instant Access tier.

How to eliminate wrong answers

Option A is wrong because Amazon S3 Glacier Deep Archive has retrieval times of 12-48 hours, which fails the requirement for immediate access when needed for Athena and SageMaker. Option C is wrong because Amazon S3 Standard is designed for frequently accessed data and would be more expensive for infrequently accessed data, not minimizing storage costs. Option D is wrong because Amazon S3 One Zone-Infrequent Access stores data in a single Availability Zone, which risks data loss if that AZ fails, and it lacks automatic cost optimization for varying access patterns.

Full explanation →

372

MCQeasy

A company is migrating a large Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime and support ongoing replication. Which AWS service should the company use?

A.AWS Application Discovery Service

B.AWS Server Migration Service

C.AWS Database Migration Service

D.AWS Schema Conversion Tool

AnswerC

DMS supports ongoing replication for minimal downtime.

Why this answer

AWS Database Migration Service (DMS), is the correct answer because it is specifically designed for migrating databases to AWS with minimal downtime, and it supports ongoing replication from Oracle to Aurora PostgreSQL using change data capture (CDC). Option A is incorrect because AWS Application Discovery Service is used for discovering on-premises servers and applications, not for database migration. Option B is incorrect because AWS Server Migration Service (now part of SMS) is for migrating virtual machines, not databases.

Option D is incorrect because AWS Schema Conversion Tool (SCT) is used to convert the database schema from one engine to another, not for ongoing replication; it is often used alongside DMS.

Full explanation →

373

Multi-Selectmedium

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Select 2 answers

A.TLS for all data in transit

B.AWS Certificate Manager (ACM) for all encryption

C.SSL certificates for all connections

D.AWS Key Management Service (KMS) for encryption at rest

E.AWS Identity and Access Management (IAM) for data encryption

AnswersA, D

TLS encrypts data in transit.

Why this answer

TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Exam trap

The trap here is that candidates confuse SSL/TLS certificates (which are just cryptographic containers) with the actual encryption protocol (TLS), and they mistakenly think ACM or IAM directly perform encryption instead of managing certificates or access.

Full explanation →

374

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

A.Use AWS CloudTrail to monitor and alert on bucket creation without encryption

B.Use AWS Config rules with auto-remediation in each account

C.Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption

D.Define an IAM policy in each account to deny S3:PutBucket without encryption

AnswerC

SCPs centrally deny actions across all accounts.

Why this answer

A service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Exam trap

The trap here is that candidates often choose AWS Config with auto-remediation (Option B) because it can fix noncompliant buckets, but they overlook that SCPs provide a preventive, centrally managed control that cannot be overridden by account-level administrators, which is the key requirement for central enforcement across multiple accounts.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is a logging service that records API calls; it can alert on bucket creation without encryption but cannot enforce or prevent the creation of unencrypted buckets—it is reactive, not proactive. Option B is wrong because AWS Config rules with auto-remediation run within each individual account and require per-account setup; they do not provide a central enforcement mechanism across all accounts in an organization, and auto-remediation can be disabled or bypassed by account administrators. Option D is wrong because IAM policies defined in each account can be modified or removed by administrators in that account, so they do not provide a centrally enforceable, immutable guardrail across the entire organization.

Full explanation →

375

MCQmedium

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

A.Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

B.Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.

C.Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

D.Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

AnswerB

RAM provides fine-grained sharing and the service-linked role ensures secure creation of resources.

Why this answer

AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Exam trap

The trap here is that candidates often confuse network connectivity solutions (like Transit Gateway or VPC Peering) with resource sharing and authorization mechanisms, leading them to select options that enable traffic flow but do not control which accounts can create resources in shared subnets.

How to eliminate wrong answers

Option A is wrong because AWS Transit Gateway is a network transit hub for routing traffic between VPCs and on-premises networks, not a mechanism to control which accounts can create resources in shared subnets; route tables manage traffic flow, not authorization. Option C is wrong because VPC Peering connections enable network connectivity between VPCs but do not provide a way to share subnets or control which accounts can launch EC2 instances in them; security groups only filter traffic at the instance level, not authorize account-level access. Option D is wrong because an SCP that denies ec2:RunInstances unless the subnet is in the network account would prevent all consuming accounts from launching instances in shared subnets, as the subnet belongs to the network account, not the consuming account; SCPs cannot conditionally allow actions based on subnet ownership across accounts in this way.

Full explanation →

Page 5 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →