Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 376–450

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 5

Page 6 of 23

Page 7
376
Multi-Selecteasy

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Select 1 answer
A.AWS Cloud Directory
B.A service control policy (SCP) attached to the root
C.An IAM user in each account
D.An external identity provider (IdP) such as Azure AD or Okta
E.Permission sets that define the level of access to each account
AnswersE

Permission sets are always required to define access levels for users and groups.

Why this answer

AWS Single Sign-On requires an identity source and permission sets. The identity source can be the built-in identity store or an external identity provider (IdP). Therefore, an external IdP is not strictly required.

From the given options, only permission sets (E) are a required component.

Exam trap

Candidates often mistakenly think an external IdP is mandatory for AWS SSO, but AWS SSO includes a built-in identity store that can manage access to AWS accounts. An external IdP is optional and primarily needed for business applications.

Full explanation →
377
Multi-Selectmedium

A company is migrating a web application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to ensure high availability and scalability. The web application is stateless. Which TWO actions should the company take to achieve these goals? (Choose TWO.)

Select 2 answers
A.Deploy the web application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones, with an Application Load Balancer
B.Use a single Amazon RDS for MySQL DB instance
C.Use Multi-AZ Amazon RDS for MySQL
D.Use Amazon ElastiCache to cache database queries
E.Use a large EC2 instance for the web application with Elastic IP
AnswersA, C

Auto Scaling and ALB across AZs provide scalability and high availability.

Why this answer

To achieve high availability and scalability for the web application, the company should deploy the web tier across multiple Availability Zones using an Auto Scaling group with an Application Load Balancer (Option A), which distributes traffic and automatically scales instances. For the MySQL database, using Multi-AZ Amazon RDS (Option C) provides automatic failover and high availability. Option B (single RDS instance) is a single point of failure.

Option D (ElastiCache) is for caching, not for high availability or scaling. Option E (large EC2 instance with Elastic IP) does not provide scalability or availability.

Full explanation →
378
Multi-Selecthard

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Select 3 answers
A.Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.
B.Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.
C.Enable AWS CloudTrail Insights in each account to capture S3 access logs.
D.Create an AWS CloudTrail trail in each account that delivers logs to the central S3 bucket.
E.Apply a bucket policy on the central S3 bucket that grants cross-account write access from each account's CloudTrail service.
AnswersA, D, E

S3 server access logs are enabled per bucket and can be delivered to a target bucket.

Why this answer

S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Exam trap

The trap here is that candidates often confuse CloudWatch Logs subscription filters or CloudTrail Insights as mechanisms to collect S3 access logs, when in fact S3 server access logging and CloudTrail trails are the correct services for this centralized logging requirement.

Full explanation →
379
MCQmedium

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

A.Amazon GuardDuty
B.Amazon Inspector
C.AWS Shield Advanced
D.AWS WAF
AnswerD

WAF can block SQL injection and XSS attacks.

Why this answer

AWS WAF integrates with API Gateway and CloudFront to protect against web exploits like SQL injection and cross-site scripting. Option A: Amazon GuardDuty is for threat detection, not inline protection. Option B: Amazon Inspector is for vulnerability assessment.

Option C: AWS Shield Advanced provides DDoS protection, not application-layer filtering.

Full explanation →
380
MCQhard

A company is migrating a stateful application to AWS and needs to preserve the client IP addresses at the application layer. The application runs on EC2 instances behind a load balancer. Which load balancer type should they use?

A.Network Load Balancer (NLB)
B.Application Load Balancer (ALB)
C.Classic Load Balancer (CLB)
D.Gateway Load Balancer (GWLB)
AnswerA

Preserves the source IP address of the client.

Why this answer

(Network Load Balancer) is correct because it preserves the client IP address by default. Option B (ALB) uses proxy protocol, but the application must be configured to parse it. Option C (Classic Load Balancer) does not preserve IP.

Option D (Gateway Load Balancer) is for third-party appliances.

Full explanation →
381
MCQmedium

A company is migrating a legacy application that uses Windows Authentication for SQL Server. The company wants to use AWS Managed Microsoft AD. Which migration strategy should be used for the database to maintain compatibility?

A.Use AWS DMS to migrate to Amazon DynamoDB
B.Replatform to Amazon RDS for MySQL
C.Replatform to Amazon RDS for SQL Server with Windows Authentication
D.Replatform to Amazon Aurora PostgreSQL
AnswerC

RDS for SQL Server supports Windows Authentication integrated with AWS Managed Microsoft AD.

Why this answer

(Replatform to Amazon RDS for SQL Server with Windows Authentication) is correct because RDS for SQL Server supports Windows Authentication via AWS Managed Microsoft AD. Option A (Amazon DynamoDB) is incorrect because DynamoDB is a NoSQL database and does not support Windows Authentication. Option B (Amazon RDS for MySQL) is incorrect because MySQL does not support Windows Authentication.

Option D (Amazon Aurora PostgreSQL) is incorrect because PostgreSQL does not support Windows Authentication.

Full explanation →
382
Multi-Selectmedium

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

Select 2 answers
A.Use instance store volumes for temporary data.
B.Store session state in an external data store such as ElastiCache.
C.Implement lifecycle hooks to gracefully handle instance termination.
D.Use a custom CloudWatch metric to scale based on CPU utilization.
E.Use a fixed number of EC2 instances instead of Auto Scaling.
AnswersB, C

Storing session state externally makes instances stateless, preventing data loss on scale-in.

Why this answer

Storing session state in an external data store like ElastiCache decouples session data from individual EC2 instances. This ensures that if an instance is terminated or replaced during scaling events, the session data persists and can be served by any other instance in the Auto Scaling group, preventing data loss and maintaining user experience.

Exam trap

The trap here is that candidates often confuse instance store with EBS or assume that lifecycle hooks alone (Option C) prevent data loss, but lifecycle hooks only delay termination for cleanup—they do not preserve session data if the instance is ultimately terminated, making an external data store essential.

Full explanation →
383
MCQmedium

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

A.AWS CodeDeploy
B.AWS CodeBuild
C.Amazon ECR
D.AWS CodeCommit
AnswerB

CodeBuild is a build service that can build Docker images and run tests.

Why this answer

AWS CodeBuild is the correct service because it is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. In this scenario, CodeBuild can build the Docker image from a Dockerfile, run unit or integration tests inside the build environment, and then push the image to Amazon ECR, all within the CI/CD pipeline defined in AWS CodePipeline.

Exam trap

The trap here is that candidates may confuse AWS CodeDeploy's role in ECS deployments with the build and test phase, assuming CodeDeploy handles the entire CI/CD process, when in fact it only handles the deployment step after the image is built and tested by CodeBuild.

How to eliminate wrong answers

Option A is wrong because AWS CodeDeploy is a deployment service that automates code deployments to compute services like ECS, EC2, or Lambda, but it does not build or test Docker images. Option C is wrong because Amazon ECR is a container image registry for storing, managing, and deploying Docker images; it does not perform build or test operations. Option D is wrong because AWS CodeCommit is a source control service for hosting Git repositories; it does not build or test code.

Full explanation →
384
Multi-Selectmedium

A company is using AWS Control Tower to manage multiple accounts. The security team wants to enforce that all accounts use a specific AWS Region for data storage. Which TWO steps should be taken to enforce this requirement?

Select 2 answers
A.Use AWS Config rules to detect resources in unapproved Regions and trigger automatic remediation.
B.Create an IAM policy that denies actions in unapproved Regions and attach it to all IAM roles.
C.Configure AWS IAM Identity Center to restrict access to approved Regions.
D.Enable AWS CloudTrail and set up an SNS notification for any API call in an unapproved Region.
E.Create a service control policy (SCP) that denies all actions in non-compliant Regions. Attach it to the root or OUs.
AnswersA, E

AWS Config can detect non-compliant resources and trigger remediation to delete or flag them.

Why this answer

AWS Control Tower uses Service Control Policies (SCPs) to centrally enforce restrictions across all accounts in an organization. An SCP that denies all actions in non-compliant Regions, attached to the root or OUs, prevents users in those accounts from performing any action in unapproved Regions, even if they have IAM permissions. AWS Config rules can detect non-compliant resources and trigger automatic remediation (e.g., deleting or stopping resources), providing a detective and corrective layer.

Together, these two steps enforce the requirement proactively (SCP) and reactively (Config).

Exam trap

The trap here is that candidates often confuse IAM policies (which are account-level and can be bypassed by administrators) with SCPs (which are organization-wide and cannot be overridden by account admins), leading them to select Option B instead of Option E.

Full explanation →
385
MCQhard

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

A.Design the application to handle eventual consistency using conditional writes and application logic.
B.Enable strong consistency in the global table configuration.
C.Use DynamoDB Streams to replicate data to another region with strong consistency.
D.Use DynamoDB Accelerator (DAX) to provide strong consistency reads.
AnswerA

Application can manage consistency.

Why this answer

DynamoDB global tables inherently replicate data asynchronously across regions, which means they only support eventual consistency. To meet strong consistency requirements in an active-active multi-region setup, the application must be designed to handle eventual consistency by using conditional writes and application logic to manage conflicts and ensure data integrity. This approach acknowledges the technical limitation of global tables while still achieving the desired consistency level through careful application design.

Exam trap

The trap here is that candidates often assume DynamoDB global tables can be configured for strong consistency reads, but the service explicitly only supports eventual consistency across regions, making application-level handling the only viable solution.

How to eliminate wrong answers

Option B is wrong because DynamoDB global tables do not support strong consistency reads; the global tables feature is designed for eventual consistency only, and enabling strong consistency in the configuration is not possible. Option C is wrong because DynamoDB Streams provide an ordered stream of item-level changes but do not offer strong consistency reads across regions; they can be used for cross-region replication but still result in eventual consistency due to asynchronous processing. Option D is wrong because DynamoDB Accelerator (DAX) is an in-memory cache that can provide strongly consistent reads for a single-region DynamoDB table, but it does not extend strong consistency to global tables or across multiple regions.

Full explanation →
386
MCQhard

A large enterprise has a multi-account AWS environment managed through AWS Organizations. The central networking team uses a transit gateway in a shared services VPC to connect all VPCs. The security team requires that all traffic between VPCs be inspected by a third-party firewall appliance that is deployed in an auto-scaling group in the shared services VPC. The firewall appliance is configured as a Gateway Load Balancer (GWLB) endpoint. The transit gateway has a route table that sends all inter-VPC traffic to the GWLB endpoint. Recently, the operations team noticed that some applications are experiencing high latency and packet loss when communicating across VPCs. Upon investigation, they found that the firewall appliance is not scaling properly. Which solution should be implemented to ensure that the firewall can handle the traffic load and maintain low latency?

A.Enable cross-zone load balancing on the Gateway Load Balancer to distribute traffic evenly across all firewall instances in all Availability Zones.
B.Increase the size of the firewall instances to larger instance types to handle more traffic per instance.
C.Create additional Gateway Load Balancer endpoints in each Availability Zone and use a separate transit gateway route table for each AZ.
D.Configure the auto-scaling group to use a step scaling policy based on network throughput.
AnswerA

Cross-zone load balancing ensures that traffic is balanced across all healthy targets, improving scaling and reducing latency.

Why this answer

Gateway Load Balancers (GWLB) by default do not distribute traffic across Availability Zones (AZs); they only send traffic to targets in the same AZ as the GWLB endpoint. Enabling cross-zone load balancing allows the GWLB to distribute traffic evenly across all healthy firewall instances in all AZs, which prevents overloading a single AZ's instances and ensures the auto-scaling group can scale effectively based on overall load, reducing latency and packet loss.

Exam trap

The trap here is that candidates assume Gateway Load Balancers inherently distribute traffic across all Availability Zones like Application Load Balancers do, but in reality, GWLB endpoints are zonal by default and require explicit cross-zone load balancing to spread traffic across AZs.

How to eliminate wrong answers

Option B is wrong because increasing instance size addresses per-instance capacity but does not fix the root cause of uneven traffic distribution across AZs; the firewall may still be overwhelmed in one AZ while others are underutilized, and scaling policies based on aggregate metrics may not trigger correctly. Option C is wrong because creating additional GWLB endpoints per AZ and separate TGW route tables per AZ would actually isolate traffic to each AZ, exacerbating the uneven distribution problem and potentially increasing complexity without solving the scaling issue. Option D is wrong because step scaling policies based on network throughput can help with scaling but do not address the fundamental issue that traffic is not evenly distributed across AZs; without cross-zone load balancing, the auto-scaling group may not scale appropriately because the load is concentrated in one AZ.

Full explanation →
387
MCQhard

Refer to the exhibit. A solutions architect has attached this key policy to an AWS KMS key. The IAM role MyAppRole is used by an application running on an EC2 instance in us-east-1. The application tries to decrypt an object stored in the S3 bucket my-bucket using server-side encryption with AWS KMS (SSE-KMS). What will happen?

A.The decryption fails because the key policy does not grant decrypt to the role.
B.The decryption succeeds because the role has permissions via this key policy.
C.The decryption fails if the application calls KMS Decrypt directly instead of letting S3 decrypt.
D.The decryption succeeds only if the object was uploaded with the correct encryption context.
AnswerC

The condition kms:ViaService requires the request to come from S3, not direct SDK call.

Why this answer

The key policy includes a condition that limits the `kms:Decrypt` permission to only be allowed when the request comes from Amazon S3 (using `kms:ViaService`). When the application calls KMS Decrypt directly, the request does not come from S3, so the condition is not satisfied, and the decryption fails. The IAM role MyAppRole does not have an IAM policy granting `kms:Decrypt`, and the key policy does not grant it directly to the role.

Options A, B, and D are incorrect because the decryption fails only when calling KMS directly, not because of the role's permissions or encryption context.

Exam trap

The trap is that candidates may assume the key policy's kms:Decrypt permission granted to the root account with a condition automatically allows any IAM role to call KMS Decrypt directly. In reality, the condition restricts the permission to requests made via S3 (kms:ViaService), so direct KMS calls are denied unless the role has an explicit IAM policy granting kms:Decrypt or is listed as a principal in the key policy without the restrictive condition.

How to eliminate wrong answers

Option A is wrong because the key policy does grant `kms:Decrypt` to the root account (AWS account root user), and the IAM role MyAppRole inherits permissions from the root account via IAM policies, so decryption via S3 would succeed. Option B is wrong because the key policy does not directly grant `kms:Decrypt` to MyAppRole; it only grants it to the root account with a condition on encryption context, and the role's permissions depend on IAM policies, not the key policy alone. Option D is wrong because the encryption context condition in the key policy only applies to the root account's decrypt permission; if the application calls KMS Decrypt directly, the encryption context must match, but the fundamental issue is the lack of explicit permission for the role, not just the context.

Full explanation →
388
MCQhard

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

A.Enable auto scaling for DynamoDB and implement retry logic with exponential backoff in the Lambda function.
B.Increase the provisioned read/write capacity of the DynamoDB table to a high fixed value.
C.Use an SQS queue between API Gateway and Lambda to buffer requests.
D.Configure API Gateway to automatically retry failed requests.
AnswerA

Auto scaling handles capacity, retries handle transient errors.

Why this answer

It combines DynamoDB auto scaling to adjust capacity during traffic spikes with retry logic and exponential backoff in the Lambda function to handle transient ProvisionedThroughputExceededException errors gracefully without losing requests. Option B is wrong because fixing capacity to a high value is costly and inefficient; it doesn't adapt to variable traffic. Option C is wrong because using an SQS queue between API Gateway and Lambda would buffer requests but does not directly address the DynamoDB throughput exception; it would only shift the problem.

Option D is wrong because API Gateway cannot automatically retry failed requests; retries must be implemented in the backend.

Full explanation →
389
MCQmedium

A company is designing a new microservices application on AWS. Each microservice needs to store and retrieve stateful data with low latency (single-digit milliseconds). The data must be durable and highly available across multiple Availability Zones. Which AWS service should be used for the primary data store for each microservice?

A.Amazon DynamoDB
B.Amazon S3
C.Amazon RDS with Multi-AZ
D.Amazon ElastiCache for Redis
AnswerA

Amazon DynamoDB is a NoSQL database that delivers single-digit millisecond latency, is fully managed, and replicates data across multiple AZs automatically. It is ideal for stateful microservices.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It is designed for high availability and durability by automatically replicating data across three Availability Zones in an AWS Region, meeting the requirements for stateful microservices data storage.

Exam trap

The SAP-C02 exam often tests the distinction between a durable primary data store and a cache or object store, where candidates mistakenly choose ElastiCache for its low latency without considering durability, or S3 for its high availability without recognizing its higher latency profile.

How to eliminate wrong answers

Option B is wrong because Amazon S3 is an object storage service designed for high throughput and large data volumes, not for low-latency single-digit millisecond access typical of microservices stateful data; its read/write latency is higher and it lacks native support for fine-grained updates. Option C is wrong because Amazon RDS with Multi-AZ provides high availability through synchronous replication to a standby instance, but it is a relational database that introduces overhead from SQL parsing and connection management, making it less suitable for the sub-10ms latency requirements of microservices compared to DynamoDB. Option D is wrong because Amazon ElastiCache for Redis is an in-memory cache, not a durable primary data store; while it offers low latency, its data is not durable by default (unless using Redis AOF with persistence, which still risks data loss on failure) and it is not designed for long-term stateful storage with the same durability guarantees as DynamoDB.

Full explanation →
390
MCQeasy

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

A.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}
B.{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}
C.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}
D.{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}
AnswerC

Correct. This Deny policy with a condition on aws:RequestTag/CostCenter being null ensures that any launch without the CostCenter tag is denied, enforcing the requirement.

Why this answer

It uses a Deny effect with a condition that checks if the 'aws:RequestTag/CostCenter' key is null (i.e., not provided). This policy will deny any RunInstances request that does not include the 'CostCenter' tag, effectively requiring the tag to be present at launch. Option A is incorrect because the 'ec2:CreateAction' condition key is unrelated to tag enforcement; it checks the action type, not the presence of a tag.

Option B is incorrect because an Allow policy with a condition does not prevent untagged launches if there are other Allow policies (e.g., a broader Allow without conditions). Option D is incorrect because it denies only when the tag is not equal to a specific value 'MyProject', which does not enforce the presence of the tag but rather a specific value.

Full explanation →
391
MCQhard

A company is migrating a large-scale Oracle data warehouse to Amazon Redshift. The migration must minimize downtime. The source database is 10 TB and runs on a single on-premises server with 1 Gbps network. Which approach should be used for the initial data load?

A.Use AWS DMS to migrate data directly to Redshift over the network.
B.Use AWS Snowball Edge to transfer data to S3, then copy to Redshift.
C.Use AWS DMS with ongoing replication after initial load via network.
D.Use S3 Transfer Acceleration to upload data to S3, then COPY to Redshift.
AnswerB

Offline transfer bypasses bandwidth constraints.

Why this answer

Using AWS Snowball Edge devices for offline transfer avoids network bandwidth limitations and provides fast, secure transfer of large data volumes. Option A is wrong because 1 Gbps network would take over 22 hours and may cause congestion. Option B is wrong because DMS works for ongoing replication but initial load over network is slow.

Option D is wrong because S3 Transfer Acceleration only speeds up S3 uploads, not the full pipeline.

Full explanation →
392
MCQhard

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

A.The SCP does not include an explicit allow for the sts:GetSessionToken action.
B.The IAM policy attached to the users does not allow any actions.
C.The SCP does not apply to users who have administrative privileges.
D.The SCP also denies access to the root user of each account.
AnswerA

Without allowing STS:GetSessionToken, the MFA challenge cannot be completed.

Why this answer

When users authenticate with MFA, the AWS Management Console calls the STS GetSessionToken API to obtain temporary credentials that include the MFA session. If the SCP denies all actions, including sts:GetSessionToken, then even with valid MFA the user cannot obtain the necessary temporary credentials, resulting in access denial. The SCP must explicitly allow the sts:GetSessionToken action for users who authenticate with MFA.

Option B is incorrect because the issue is not about the users' IAM policies but about the SCP. Option C is incorrect because SCPs apply to all principals in the account, including administrators. Option D is incorrect because the SCP does not inherently affect the root user differently; root user is not affected by SCPs in the management account.

Full explanation →
393
Multi-Selecthard

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Select 3 answers
A.Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.
B.Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.
C.Associate each VPC with the private hosted zone using the authorize zone association API.
D.Use AWS RAM to share the private hosted zone with the other accounts.
E.Create a VPC peering connection between the central account and each VPC.
AnswersB, C, D

IAM permissions control who can perform the association.

Why this answer

Restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.

Exam trap

The trap here is that candidates often confuse VPC peering with DNS resolution; peering provides network connectivity but does not automatically grant DNS resolution from a private hosted zone, which requires explicit association or sharing via AWS RAM.

Full explanation →
394
Multi-Selecthard

A company is modernizing a monolithic Java application to run on Amazon ECS with Fargate. The application uses a proprietary configuration management system. Which TWO AWS services can replace the configuration management system to store and retrieve configuration at runtime?

Select 2 answers
A.Amazon S3 with versioning enabled.
B.AWS Secrets Manager.
C.Amazon DynamoDB with application-side caching.
D.AWS AppConfig, a feature of AWS Systems Manager.
E.AWS Systems Manager Parameter Store.
AnswersD, E

AppConfig is designed for application configuration management.

Why this answer

(AWS AppConfig, a feature of AWS Systems Manager) and Option E (AWS Systems Manager Parameter Store) are both purpose-built services for storing and retrieving configuration at runtime. AppConfig provides validation, deployment strategies, and rollback capabilities, making it ideal for managing application configuration in a controlled manner. Parameter Store offers secure, hierarchical storage for configuration data and integrates seamlessly with AWS services.

Option A (S3) is general object storage, not optimized for runtime configuration retrieval with validation. Option B (Secrets Manager) is designed for managing secrets, not general configuration. Option C (DynamoDB) is a NoSQL database; while it can store configuration, it lacks the deployment controls and native integration of AppConfig and Parameter Store.

Full explanation →
395
MCQhard

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to example-bucket with SSE-S3 (AES256) encryption. What will happen?

A.The upload fails because the Deny statement explicitly denies it
B.The upload fails because there is no explicit Allow for PutObject
C.The upload succeeds because the Allow statement permits it
D.The upload succeeds because SSE-S3 is allowed by the first statement
AnswerA

Deny condition matches when encryption is not aws:kms.

Why this answer

The Deny statement explicitly denies s3:PutObject when the encryption is not aws:kms. Since the user uses SSE-S3 (AES256), the condition 'StringNotEquals' evaluates to true (AES256 != aws:kms), so the Deny applies and the request is denied. Option B is incorrect because even if there is no explicit Allow, a Deny overrides any implicit allow.

Options C and D are incorrect because the Deny overrides any Allow statement, and the Allow statement in the policy is for GetObject, not PutObject.

Full explanation →
396
MCQeasy

A company is migrating its on-premises virtual machines (VMs) to AWS. The company has 50 VMs running various operating systems and applications. The architect wants to use a service that automates the replication and conversion of the VMs to Amazon EC2 instances. Which AWS service should the architect use?

A.AWS Application Migration Service (AWS MGN)
B.AWS DataSync
C.AWS Server Migration Service (AWS SMS)
D.AWS CloudEndure Migration
AnswerA

AWS MGN automates replication and conversion of VMs to EC2.

Why this answer

AWS Application Migration Service (AWS MGN) automatically replicates and converts VMs to EC2. AWS Server Migration Service (SMS) is an older service, but MGN is the recommended service for automated migration. AWS CloudEndure Migration has been rebranded as AWS Application Migration Service.

AWS DataSync is for file transfers.

Full explanation →
397
MCQeasy

A company is planning to migrate 50 TB of data from an on-premises data center to Amazon S3. The on-premises network bandwidth is 100 Mbps. The migration must be completed within 30 days. What is the most cost-effective solution?

A.Use AWS Direct Connect to increase bandwidth.
B.Use AWS Snowball Edge device.
C.Use AWS DataSync over the internet.
D.Use AWS Database Migration Service (AWS DMS).
AnswerB

Snowball Edge can transfer 50 TB in a few days, meeting the deadline cost-effectively.

Why this answer

At 100 Mbps, transferring 50 TB over the internet would take approximately 50 days (50*8*1024*1024 / (100*86400) ≈ 48.5 days), exceeding the 30-day window. AWS Snowball Edge is a physical device that can transfer data offline faster and is cost-effective for large data volumes. AWS DMS is for databases; Direct Connect requires setup time; S3 Transfer Acceleration improves speed but still limited by bandwidth.

Full explanation →
398
MCQhard

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

A.Use a single Network Load Balancer in the primary region with cross-zone load balancing.
B.Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.
C.Use Amazon CloudFront with origins in each region.
D.Use AWS Global Accelerator with Network Load Balancers in each region.
AnswerB

Latency routing and ALB are appropriate for stateless web apps.

Why this answer

Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with Route 53 latency-based routing, assuming Global Accelerator is always better for multi-region latency, but the question specifically asks for a stateless web application using ECS Fargate, where an ALB is the natural fit and Route 53 latency-based routing provides the simplest and most cost-effective solution for HTTP/HTTPS traffic distribution across regions.

How to eliminate wrong answers

Option A is wrong because a single Network Load Balancer (NLB) in one primary region cannot distribute traffic across multiple AWS Regions; cross-zone load balancing only distributes traffic within a single region's Availability Zones, not across regions. Option C is wrong because Amazon CloudFront with origins in each region is a content delivery network (CDN) optimized for caching static content, not for routing dynamic, stateless web application traffic with low latency across regions; it adds unnecessary caching complexity and does not provide regional load balancing for dynamic requests. Option D is wrong because AWS Global Accelerator uses Anycast IPs to route traffic to the nearest regional endpoint, but it requires Network Load Balancers or Elastic IPs as endpoints, not Application Load Balancers, and while it improves latency, it does not natively support latency-based routing to multiple regions as precisely as Route 53 latency-based routing; additionally, Global Accelerator is better suited for TCP/UDP traffic and non-HTTP protocols, whereas the question specifies a stateless web application (HTTP/HTTPS) where ALB is more appropriate.

Full explanation →
399
MCQeasy

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

A.Use AWS Organizations to create a new IAM user in each member account with full permissions, and disable the root user.
B.Capture the root user email addresses and passwords in a secure password manager and share them with the security team.
C.Use the management account to assume an IAM role in each member account that has permissions to reset the root user password and enable MFA. Then, rotate the root user password and enable MFA.
D.Use AWS Single Sign-On (SSO) to grant the security team access to the root user credentials for each account.
AnswerC

This allows central management without sharing credentials.

Why this answer

It leverages AWS Organizations to create an IAM role in each member account with permissions to reset the root user password and enable MFA. The security team can assume this role from the management account, allowing them to securely manage root user credentials without sharing them. Option A is incorrect because the root user cannot be disabled, and creating an IAM user does not provide access to the root user.

Option B is insecure as it involves sharing root credentials. Option D is incorrect because AWS SSO (now IAM Identity Center) does not manage root user credentials.

Full explanation →
400
Multi-Selecthard

A company is performing a server migration to AWS using AWS Server Migration Service (SMS). The company needs to automate the replication of servers and track the migration status. Which THREE components are required for this solution? (Choose three.)

Select 3 answers
A.AWS SMS connector installed on the on-premises hypervisor
B.AWS Schema Conversion Tool
C.AWS Migration Hub
D.AWS Database Migration Service
E.AWS CloudFormation
AnswersA, C, E

Facilitates replication to AWS.

Why this answer

Options A, C, and E are correct. AWS SMS connector is installed on-premises to enable server replication. AWS Migration Hub provides a central location to track the migration status of servers.

AWS CloudFormation can be used to automate the deployment of resources and manage the migration pipeline. Option B (AWS Schema Conversion Tool) is for schema conversion of databases, not server migration. Option D (AWS Database Migration Service) is specifically for database migrations, not server replication.

Full explanation →
401
MCQeasy

A company needs to design a new solution for storing and retrieving user-uploaded images. The images are accessed frequently for the first 30 days and then rarely accessed after that. The company wants to minimize storage costs while maintaining low-latency access for frequently accessed images. Which storage strategy should be used?

A.Store images in Amazon EBS volumes attached to a web server.
B.Store images in Amazon S3 Standard and use lifecycle policies to transition to S3 Standard-IA after 30 days.
C.Store all images in Amazon S3 Glacier Flexible Retrieval.
D.Store all images in Amazon S3 Standard.
AnswerB

Lifecycle policies automate cost optimization while keeping low-latency access during frequent access period.

Why this answer

Amazon S3 Standard provides low-latency access for frequently accessed images, and S3 lifecycle policies allow automatic transition to S3 Standard-Infrequent Access (Standard-IA) after 30 days, reducing storage costs while maintaining rapid access for the initial period. This strategy directly meets the requirement of minimizing costs without sacrificing performance for the first 30 days.

Exam trap

The trap here is that candidates may choose Option D (all S3 Standard) because it guarantees low-latency access, overlooking the cost savings of transitioning to Standard-IA for data that becomes rarely accessed after 30 days.

How to eliminate wrong answers

Option A is wrong because Amazon EBS volumes are block-level storage attached to a single EC2 instance, not designed for storing and retrieving user-uploaded images at scale, and they incur costs even when not accessed, lacking lifecycle management for infrequent access. Option C is wrong because Amazon S3 Glacier Flexible Retrieval has retrieval times of minutes to hours, which does not provide low-latency access for frequently accessed images during the first 30 days. Option D is wrong because storing all images in Amazon S3 Standard incurs higher storage costs for data that becomes rarely accessed after 30 days, failing to minimize storage costs as required.

Full explanation →
402
MCQeasy

A startup is building a serverless application using AWS Lambda for business logic and Amazon DynamoDB for data storage. The application must process a high volume of writes to a single DynamoDB table. The development team is concerned about throttling due to hot partitions. Which design should the team implement to avoid throttling?

A.Enable DynamoDB Accelerator (DAX) to cache write operations.
B.Use a composite primary key with a partition key that has high cardinality, such as a user ID.
C.Use a global secondary index (GSI) as the primary index for writes.
D.Add a local secondary index (LSI) to the table.
AnswerB

High cardinality partition keys distribute writes evenly across partitions.

Why this answer

Using a partition key with high cardinality, such as a user ID, ensures that write requests are evenly distributed across all partitions in the DynamoDB table. This prevents any single partition from becoming a hot partition, which would otherwise lead to throttling when the partition's throughput capacity is exceeded. DynamoDB scales by splitting partitions based on the partition key's hash, so high cardinality is essential for avoiding throttling under high write volumes.

Exam trap

The trap here is that candidates often confuse caching (DAX) as a solution for write performance, not realizing DAX only accelerates reads, or they mistakenly believe that secondary indexes (GSI/LSI) can redistribute write load, when in fact they share the base table's partition key and do not solve hot partition issues.

How to eliminate wrong answers

Option A is wrong because DynamoDB Accelerator (DAX) is an in-memory cache for read operations only; it does not cache or accelerate write operations, so it cannot prevent write throttling. Option C is wrong because a global secondary index (GSI) is a secondary index that supports read and write operations, but it does not replace the primary index for writes; writes are still directed to the base table's partition key, and using a GSI as the primary index is not a valid design—GSIs have their own throughput and can also experience throttling if not properly provisioned. Option D is wrong because a local secondary index (LSI) shares the same partition key as the base table and does not improve write distribution; it only provides an alternative sort key for querying within a partition, so it does not address hot partition issues.

Full explanation →
403
MCQmedium

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application currently uses a central MySQL database. The architects plan to refactor the database into separate RDS instances per microservice. Which strategy will ensure data consistency across services with minimal application changes?

A.Enable the STRICT_TRANS_TABLES SQL mode on all RDS instances to enforce data integrity.
B.Implement a saga pattern using choreography, where each service publishes events and reacts to events from other services.
C.Configure RDS read replicas for each service to ensure eventually consistent reads.
D.Use distributed transactions with a two-phase commit protocol across RDS instances.
AnswerB

The saga pattern with choreography maintains data consistency across microservices without tight coupling, and can be implemented with minimal changes using event-driven communication.

Why this answer

The saga pattern with choreography allows each microservice to maintain its own RDS instance while ensuring data consistency through a sequence of local transactions and compensating events. This approach avoids the need for distributed transactions across separate databases, which aligns with the goal of minimal application changes by leveraging existing event-driven communication patterns in ECS with Fargate.

Exam trap

The trap here is that candidates often confuse eventual consistency with read replicas (Option C) or assume that traditional ACID transactions can be extended across separate databases (Option D), but the saga pattern is the correct distributed consistency approach for microservices with separate databases.

How to eliminate wrong answers

Option A is wrong because enabling STRICT_TRANS_TABLES SQL mode only enforces data type and constraint validation within a single RDS instance, not across multiple databases, and does not address cross-service consistency. Option C is wrong because RDS read replicas provide eventually consistent reads for a single database, not consistency across separate RDS instances per microservice, and they do not handle write conflicts or distributed transactions. Option D is wrong because two-phase commit (2PC) across RDS instances introduces tight coupling, performance overhead, and scalability issues, and is not recommended for microservices architectures due to its blocking nature and lack of support across separate RDS endpoints.

Full explanation →
404
MCQmedium

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. The Auto Scaling group has a minimum of 2 and maximum of 10 instances. CloudWatch metrics show that CPU utilization rarely exceeds 30%. What is the MOST likely cause of the 503 errors?

A.The ALB connection draining is enabled with a very short timeout, causing in-flight connections to be dropped.
B.The EC2 instances are running out of memory.
C.The Auto Scaling group launch configuration uses an AMI that is not compatible with the instance type.
D.The ALB health check is misconfigured, causing healthy instances to be marked unhealthy.
AnswerA

Connection draining with a short timeout can cause 503 errors when the ALB stops sending traffic to an instance before in-flight requests complete.

Why this answer

The 503 errors are likely due to the ALB connection draining setting. If connection draining is enabled and the drain timeout is too short, in-flight requests may be terminated, causing 503 errors. Low CPU utilization suggests the instances are not overloaded.

Full explanation →
405
Multi-Selectmedium

A company has a web application running on EC2 instances in an Auto Scaling group. The application experiences unpredictable traffic spikes. The company wants to ensure that the application can scale out quickly and scale in to reduce costs. Which TWO actions should the solutions architect recommend?

Select 2 answers
A.Configure a lifecycle hook to delay instance termination during scale-in.
B.Manually increase the desired capacity during peak times.
C.Create a target tracking scaling policy based on Average CPU Utilization.
D.Create a simple scaling policy with a step adjustment to add instances when CPU exceeds 80%.
E.Use a scheduled scaling policy to add instances during expected peak hours.
AnswersC, D

Target tracking dynamically adjusts capacity to maintain a target metric.

Why this answer

Options C and D are correct. A target tracking scaling policy (C) automatically adjusts capacity based on a specified metric like CPU utilization, providing dynamic scaling for unpredictable spikes. A simple scaling policy with a step adjustment (D) allows you to define specific thresholds (e.g., CPU > 80%) to add instances quickly.

Option A is wrong because a lifecycle hook delays termination during scale-in, which would increase costs by keeping instances running longer. Option B is wrong because manually adjusting capacity is not automated and does not respond quickly to spikes. Option E is wrong because scheduled scaling is for predictable patterns, not unpredictable traffic spikes.

Full explanation →
406
Multi-Selectmedium

A company is designing a multi-account architecture using AWS Organizations. The company wants to enforce that all Amazon S3 buckets across all accounts must have server-side encryption (SSE) enabled. Which TWO actions should be taken to enforce this requirement?

Select 2 answers
A.Create a service control policy (SCP) that denies s3:PutBucket* actions unless encryption is specified.
B.Set the default encryption on each bucket to disable encryption.
C.Enable AWS CloudTrail to log all S3 API calls and trigger a Lambda function to remediate.
D.Create an IAM policy with a global condition for SSE and attach it to all users and roles.
E.Use AWS Config rules to detect S3 buckets without encryption and automatically remediate.
AnswersA, E

SCPs can deny actions that do not meet conditions, such as requiring encryption.

Why this answer

A service control policy (SCP) can be applied at the AWS Organizations root, OU, or account level to deny S3 bucket operations that do not include encryption. By using a condition key like `s3:x-amz-server-side-encryption` in the SCP, you can enforce that any `s3:PutBucket*` action must specify encryption, preventing the creation or modification of buckets without SSE. This provides a preventive, centralized control that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules with auto-remediation) with preventive controls (like SCPs), but the question specifically asks to 'enforce' the requirement, which demands a preventive approach that blocks non-compliant actions before they occur.

Full explanation →
407
MCQmedium

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon ECS with Fargate. The compliance team requires that all data in transit between the application and the database must be encrypted. The database is an Amazon RDS for PostgreSQL instance. The application connects to the database using a connection string that includes the database endpoint. The security team has enabled encryption in transit on the RDS instance using a certificate. The application is currently failing to connect to the database with an error related to SSL/TLS. The development team verified that the connection string includes the sslmode=require parameter. What is the most likely cause of the connection failure?

A.The RDS instance is using a public certificate that is not trusted by the application.
B.The security group for the RDS instance does not allow inbound traffic on port 443.
C.The Fargate task does not have the necessary SSL libraries installed.
D.The RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1.
AnswerD

The rds.force_ssl parameter must be set to enforce SSL connections.

Why this answer

The most likely cause is that the RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1. Even though the application uses sslmode=require in the connection string, the RDS instance must enforce SSL connections by setting this parameter. Without it, the RDS instance may not require SSL, leading to a connection failure when the client attempts to negotiate SSL.

Option A is incorrect because RDS uses certificates signed by a trusted CA; the issue is not about trust. Option B is incorrect because the database port is 5432, not 443. Option C is incorrect because Fargate containers include necessary SSL libraries by default.

Full explanation →
408
MCQeasy

A company uses AWS Organizations with a management account and several member accounts. The security team needs to centrally manage IAM users and roles across all accounts. Which AWS service should the company use?

A.AWS Directory Service for Microsoft Active Directory.
B.AWS Identity and Access Management (IAM) in the management account.
C.AWS IAM Identity Center (AWS SSO).
D.Amazon Cognito user pools.
AnswerC

Provides centralized access management across accounts.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is the correct service because it provides a centralized place to manage user identities and permissions across multiple AWS accounts within an AWS Organization. It allows the security team to create or connect users and groups, and assign them fine-grained permissions to accounts, roles, and applications from a single pane of glass, eliminating the need to create IAM users in each account.

Exam trap

The trap here is that candidates often confuse IAM Identity Center with simply using IAM in the management account, failing to realize that IAM is account-scoped and cannot centrally manage identities across multiple accounts without additional federation or automation.

How to eliminate wrong answers

Option A is wrong because AWS Directory Service for Microsoft Active Directory is a managed Microsoft AD service used for identity federation and directory-aware workloads, not for centrally managing IAM users and roles across AWS accounts. Option B is wrong because IAM in the management account can only manage users and roles within that single account; it cannot natively manage identities across member accounts without complex cross-account role assumptions and manual duplication. Option D is wrong because Amazon Cognito user pools are designed for customer-facing identity and access management for web and mobile applications, not for managing workforce identities or AWS account access.

Full explanation →
409
MCQmedium

A company is migrating a legacy on-premises .NET application to AWS. The application uses a SQL Server database and requires full control over the operating system for compliance. Which migration strategy should the solutions architect recommend to minimize rework while meeting compliance requirements?

A.Rehost the application on EC2 instances and use RDS Custom for SQL Server.
B.Replace the database with Amazon DynamoDB and refactor the application.
C.Replatform the application to use RDS for SQL Server and deploy the application on EC2 instances.
D.Refactor the application to run on Amazon ECS using Docker containers.
AnswerA

Minimal changes, OS-level control via RDS Custom meets compliance.

Why this answer

Rehosting (lift-and-shift) with EC2 and RDS Custom for SQL Server allows the company to move the application and database with minimal changes while retaining OS-level control for compliance. RDS Custom provides OS access (SSH, patching) unlike standard RDS, meeting the compliance requirement. Option B (DynamoDB) would require significant application refactoring.

Option C (RDS for SQL Server without Custom) lacks OS access. Option D (ECS with containers) adds containerization rework and does not inherently provide OS-level control.

Full explanation →
410
MCQmedium

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

A.The ALB's idle timeout is set too low.
B.The security group for the ALB does not allow inbound traffic on the listener port.
C.The ALB's target group health check settings are misconfigured.
D.The deployment removed the health check path from the application.
AnswerD

If the health check path is removed, health checks fail, causing targets to be marked unhealthy, and ALB returns 503.

Why this answer

If the deployment removed the health check path from the application, the health checks would fail for any instance that was updated. Since the application runs behind an ALB, the target group health check would mark those instances as unhealthy, causing intermittent 503 errors as traffic is routed only to remaining healthy instances. Even if not all instances are updated simultaneously, the gradual roll-out could lead to periods where all instances become unhealthy temporarily.

Option A is incorrect because a low idle timeout would cause timeout errors, not 503s. Option B is incorrect because security groups were not changed. Option C is incorrect because misconfigured health check settings would cause consistent failures, not intermittent.

Exam trap

Candidates may confuse 503 errors with timeout or capacity issues. In this scenario, the normal TargetResponseTime and increased RequestCount suggest the load balancer is working, but targets are being marked unhealthy due to a missing health check path.

Full explanation →
411
MCQeasy

A company runs a web application on AWS Elastic Beanstalk. The application experiences periodic traffic spikes that cause the environment to scale out. However, the scaling is slow, leading to increased latency during spikes. The operations team wants to improve the responsiveness of the Auto Scaling group. The application is stateless and runs on a single instance type. What should a solutions architect recommend?

A.Configure the Auto Scaling group to use multiple instance types.
B.Use scheduled scaling to add capacity before expected spikes.
C.Decrease the Auto Scaling group's cooldown period.
D.Change the instance type to a larger size.
AnswerC

Shorter cooldown allows more frequent scaling decisions, improving responsiveness.

Why this answer

Decrease the Auto Scaling group's cooldown period. Decreasing the cooldown period allows the Auto Scaling group to launch new instances more quickly after a scaling activity, reducing the time it takes to respond to traffic spikes. This directly improves responsiveness.

Option A is incorrect because using multiple instance types does not speed up scaling decisions. Option B (scheduled scaling) is proactive but does not help with unexpected spikes. Option D (larger instance type) addresses capacity per instance but not the speed of scaling out.

Full explanation →
412
MCQhard

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and integrates with on-premises Active Directory. The company wants to use AWS Managed Microsoft AD to reduce administrative overhead. However, after migration, the application fails to authenticate users. What is the most likely cause?

A.The security group for the application servers does not allow inbound traffic on port 389.
B.AWS Managed Microsoft AD does not support LDAP queries.
C.The application is not configured to use the correct DNS servers for the AWS Managed Microsoft AD domain.
D.The application is using NTLM authentication, which is not supported by AWS Managed Microsoft AD without a trust relationship.
AnswerD

NTLM requires a trust, and without it, authentication fails.

Why this answer

The application likely uses NTLM or Kerberos authentication, which requires proper trust relationships between the AWS Managed Microsoft AD and the on-premises AD. Option A is wrong because security groups do not affect authentication protocols. Option B is wrong because AWS Managed Microsoft AD supports LDAP.

Option C is wrong because DNS resolution is not the root cause.

Full explanation →
413
Multi-Selecteasy

A company is designing a new static website hosted on Amazon S3. They want to use Amazon CloudFront as a content delivery network (CDN) to serve the website globally with low latency. The website content must be encrypted in transit. Which configurations should they use? (Choose TWO.)

Select 2 answers
A.Enable default encryption on the S3 bucket using AES-256.
B.Enable S3 Transfer Acceleration on the bucket.
C.Configure the S3 bucket policy to deny requests that do not use HTTPS.
D.Configure CloudFront to require HTTPS for viewer requests.
E.Use CloudFront signed URLs to restrict access.
AnswersC, D

This ensures CloudFront uses HTTPS to fetch objects from S3.

Why this answer

Configuring the S3 bucket policy to deny requests that do not use HTTPS ensures that all traffic to the S3 origin is encrypted in transit, preventing data exposure during transit between CloudFront and S3. Option D is correct because configuring CloudFront to require HTTPS for viewer requests enforces encryption between end users and CloudFront, fulfilling the requirement for encryption in transit for the entire delivery path.

Exam trap

The trap here is that candidates often confuse encryption at rest (S3 default encryption) with encryption in transit, or they assume that CloudFront's default HTTPS support automatically secures the S3 origin connection without needing a bucket policy to enforce it.

Full explanation →
414
MCQmedium

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

A.Yes, because the request matches the Allow condition and the Deny condition does not apply.
B.No, because the Deny statement explicitly denies all actions.
C.Yes, because the IP address is within the allowed range.
D.No, because the Deny statement overrides the Allow statement.
AnswerA

HTTPS satisfies SecureTransport true, so Deny is not triggered.

Why this answer

The first statement allows GET from the specified IP range. The second statement denies all actions if not using HTTPS. Since the request uses HTTPS (SecureTransport true), the Deny condition does not apply, so the Allow takes effect.

Full explanation →
415
MCQmedium

A company is migrating data to Amazon S3 and requires that all objects uploaded to the bucket 'my-bucket' are encrypted with SSE-S3. The above IAM policy is attached to an IAM user. An application using the user's credentials attempts to upload an object without specifying the x-amz-server-side-encryption header. What will happen?

A.The upload succeeds because the Allow statement grants permission.
B.The upload fails because the bucket policy overrides the IAM policy.
C.The upload fails because the Deny statement denies the request when encryption is not AES256.
D.The upload succeeds because the object is encrypted with the default SSE-S3.
AnswerC

The Deny statement explicitly denies PutObject if encryption is not AES256, and without the header, it is considered not AES256.

Why this answer

The IAM policy includes a Deny statement that denies the upload if the x-amz-server-side-encryption header is not set to AES256. Since the application does not include this header, the Deny condition is triggered and the upload fails. Option A is incorrect because the Deny statement overrides the Allow statement when the condition is met.

Option B is incorrect because the scenario only involves an IAM policy, not a bucket policy. Option D is incorrect because the absence of the encryption header means the Deny statement applies, so the upload does not proceed even though SSE-S3 is the default.

Full explanation →
416
Multi-Selectmedium

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Select 3 answers
A.License configurations
B.Subnets
C.Transit gateways
D.VPC peering connections
E.Security groups
AnswersA, B, C

License Manager configurations can be shared via RAM.

Why this answer

AWS License Manager configurations can be shared across accounts using AWS Resource Access Manager (RAM), enabling centralized management of software licenses. This allows organizations to enforce license usage limits and rules consistently across multiple accounts in an AWS Organization.

Exam trap

The trap here is that candidates often assume VPC peering connections can be shared via RAM because they are a networking construct, but RAM only supports sharing of resources that can be centrally managed and attached to multiple accounts, not point-to-point connections like VPC peering.

Full explanation →
417
MCQhard

A company is migrating a large-scale batch processing workload from on-premises to AWS. The workload runs on a schedule and processes data files from an FTP server. The company wants to use AWS services that are serverless and event-driven to reduce operational overhead. The data files will be uploaded to an Amazon S3 bucket. Which solution meets these requirements?

A.Use Amazon S3 Event Notifications to invoke an AWS Batch job that processes the file
B.Use Amazon S3 Event Notifications to invoke an AWS Lambda function that processes the file
C.Use AWS Glue to crawl the S3 bucket and run an ETL job on a schedule
D.Use Amazon S3 Event Notifications to start an AWS Step Functions workflow that runs processing on Amazon EC2
AnswerB

Lambda is serverless, event-driven, and processes the file upon upload, reducing overhead.

Why this answer

Amazon S3 Event Notifications can directly invoke an AWS Lambda function to process the file upon upload. This is serverless and event-driven, meeting the requirements to reduce operational overhead. Option A (AWS Batch) is not serverless because it requires provisioning compute resources and does not directly trigger from S3 events in a serverless manner.

Option C (AWS Glue) is designed for ETL and crawling, not for general batch processing of files. Option D (Step Functions) is used for orchestrating workflows, but the actual processing would still need a compute resource like EC2 or Lambda; using it with EC2 adds overhead and is not fully serverless.

Full explanation →
418
Multi-Selecthard

A company is migrating a batch processing workload to AWS. The workload runs nightly and takes approximately 2 hours on a single on-premises server. The company wants to reduce the processing time to under 30 minutes. Which THREE steps should the solutions architect recommend?

Select 3 answers
A.Split the workload into smaller batches and run them in parallel on multiple EC2 instances.
B.Use a larger, compute-optimized EC2 instance type.
C.Use EBS io2 volumes with high IOPS for the instance.
D.Use EC2 Spot Instances to reduce cost.
E.Use AWS Batch with multiple compute environments to orchestrate parallel processing.
AnswersA, B, E

Parallel processing reduces overall time significantly.

Why this answer

Using a larger instance (compute optimized) can speed up processing. Parallel processing by splitting the workload across multiple EC2 instances reduces time. Using a distributed processing framework like AWS Batch with multiple compute environments enables parallel execution.

EBS io2 volumes improve I/O but may not reduce time by 75%. Spot Instances can reduce cost but not processing time directly.

Full explanation →
419
Multi-Selecthard

A company is running a critical microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the team noticed that the ALB's 5xx error rate has increased. The error is HTTP 503. The team suspects the target group is unhealthy. Which THREE steps should the team take to diagnose and resolve the issue?

Select 3 answers
A.Verify the ECS service's desired count and compare with the number of healthy tasks in the target group.
B.Replace the ALB with a Network Load Balancer (NLB) to bypass health checks.
C.Check the ECS service events and task status to ensure tasks are running and passing health checks.
D.Verify that sticky sessions (session affinity) are enabled on the target group.
E.Check the ALB access logs and health check settings for the target group.
AnswersA, C, E

Checks the ECS service's desired count and compares it with the number of healthy tasks in the target group, ensuring sufficient capacity.

Why this answer

And Option E are correct. Option A checks the ECS service's desired count and compares it with the number of healthy tasks in the target group, ensuring sufficient capacity. Option C checks ECS service events and task status to confirm tasks are running and passing health checks.

Option E checks ALB access logs and health check settings for the target group to identify health check failures or misconfigurations. Option B (replacing ALB with NLB) is a major architectural change and not a diagnostic step. Option D (enabling sticky sessions) is unrelated to 503 errors.

Full explanation →
420
MCQhard

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

A.Create a Change Set for the stack to preview the changes and identify the conflict.
B.Review the stack's 'Events' tab in the AWS Management Console to find the error message.
C.Use AWS CloudFormation StackSets to deploy the update across multiple accounts.
D.Run a drift detection operation on the stack to identify manual changes.
AnswerA

Change Sets allow you to see the impact and errors before applying.

Why this answer

A Change Set allows you to preview the changes that will be made during a stack update, including any potential errors or resource conflicts, before executing the update. This helps identify the specific resource causing the failure. Option B is wrong because the Events tab shows past events but does not provide a preview of planned changes or conflicts.

Option C is wrong because StackSets are used for deploying stacks across multiple accounts and regions, not for troubleshooting a single stack update. Option D is wrong because drift detection compares the current stack resources with the template to identify manual changes, not update conflicts.

Full explanation →
421
MCQhard

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

A.The AWS CLI is configured to use a different region than where the stack was deployed.
B.The stack was deleted after creation.
C.The stack name is case-sensitive and should be 'MyApp'.
D.The '--query' parameter is incorrectly formatted.
AnswerA

Stack names are unique per region; querying the wrong region returns 'stack does not exist'.

Why this answer

The CLI command is querying the wrong region. The stack was created in us-east-1 but the CLI default region might be different. Option B is wrong because the stack was created successfully.

Option C is wrong because outputs are returned correctly. Option D is wrong because the stack name is exactly as used.

Full explanation →
422
MCQmedium

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

A.Use an internet gateway and route traffic through a NAT gateway.
B.Enable S3 Transfer Acceleration on the bucket.
C.Create a VPC endpoint for S3 and attach it to the VPC.
D.Use a NAT gateway and update the route table to direct S3 traffic to the NAT.
AnswerC

VPC endpoint enables private connectivity to S3 without internet.

Why this answer

Using a VPC endpoint for S3 (Gateway or Interface) ensures traffic stays within the AWS network. Option A is wrong because internet traffic goes over the public internet. Option B is wrong because a NAT gateway is for outbound internet, not private access to S3.

Option D is wrong because S3 Transfer Acceleration uses the internet.

Full explanation →
423
MCQhard

A company is designing a data processing pipeline for real-time analytics. The pipeline ingests data from IoT devices that send JSON messages via MQTT to AWS IoT Core. The messages must be processed in real-time to detect anomalies and the results must be stored in Amazon S3 for later analysis. The company currently uses a Lambda function to process each message, but as the number of devices grows, the Lambda function is being throttled due to concurrency limits. The company needs a solution that scales to handle thousands of devices per second without losing messages. The processed data must be available in S3 within 1 minute of ingestion. Which architecture should the company use?

A.Send the IoT messages to an Amazon SQS queue and have Lambda poll the queue in batches to reduce the number of concurrent invocations.
B.Store the raw messages in an S3 bucket and use S3 Select to query the data for anomalies periodically.
C.Ingest the messages into Amazon Kinesis Data Streams with multiple shards, and use a Lambda function to process records from the stream. Increase the Lambda concurrency limit.
D.Use AWS IoT Core rules to route messages to Amazon Kinesis Data Firehose, which writes raw data to S3. Then use Amazon Kinesis Data Analytics to read from S3 and perform real-time anomaly detection, writing results back to S3 via Firehose.
AnswerC

This is correct. Kinesis Data Streams can scale to thousands of shards to handle high throughput. Lambda can process records in real-time, and increasing concurrency limits (by requesting a limit increase or using reserved concurrency) addresses the throttling issue. The processed data can be written to S3 via the Lambda function.

Why this answer

The correct architecture is to ingest messages into Amazon Kinesis Data Streams with multiple shards to handle high throughput. Using a Lambda function to process records from the stream allows real-time anomaly detection. To address concurrency limits, the Lambda concurrency limit can be increased by requesting a limit increase from AWS Support, and you can use reserved concurrency to ensure processing capacity.

This solution scales elastically and can meet the 1-minute latency requirement. Option D is incorrect because Kinesis Data Analytics cannot read directly from S3 or from Kinesis Data Firehose; it requires a Kinesis data stream as its source. The architecture in D would not provide real-time processing as it relies on periodic S3 queries.

Full explanation →
424
MCQhard

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function writes results to a DynamoDB table. Over time, the function's execution time has increased, and some operations fail with ProvisionedThroughputExceededException. The function is configured with 1024 MB memory and a 5-minute timeout. The DynamoDB table has 1000 RCUs and 500 WCUs. The Lambda function performs reads and writes on the same table. What is the MOST cost-effective way to resolve the throttling without sacrificing performance?

A.Enable DynamoDB Accelerator (DAX) for the table
B.Use SQS to decouple the S3 trigger from the Lambda function and implement a batching strategy to DynamoDB
C.Increase DynamoDB write capacity units to 1000 WCUs
D.Increase the Lambda function memory to 2048 MB
AnswerB

SQS buffers requests, allowing batch writes and reducing throttling.

Why this answer

The most cost-effective solution because it uses SQS to decouple the S3 trigger from the Lambda function, allowing the Lambda to batch writes to DynamoDB. This reduces the frequency of writes, smooths out traffic spikes, and enables retries on throttling exceptions without scaling up capacity. Option A (DAX) only improves read performance, not writes.

Option C (increasing WCUs) increases cost significantly without addressing the root cause of bursty traffic. Option D (increasing memory) improves compute but not write throughput, and may increase cost without resolving throttling.

Full explanation →
425
MCQmedium

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

A.Amazon API Gateway
B.AWS App Mesh
C.AWS Transit Gateway
D.AWS Cloud Map
AnswerB

App Mesh is a service mesh that provides traffic management, observability, and security.

Why this answer

AWS App Mesh is a service mesh that provides application-level networking to manage service-to-service communication, observability (via metrics, logs, and traces), and security (via mTLS and fine-grained access policies) for microservices. It uses the Envoy proxy as a sidecar to intercept traffic, enabling features like traffic splitting, retries, and circuit breaking without modifying application code.

Exam trap

The trap here is that candidates often confuse a service mesh (App Mesh) with an API gateway (API Gateway), but API Gateway is designed for external-facing API management, not for internal service-to-service traffic control and observability within a microservices mesh.

How to eliminate wrong answers

Option A is wrong because Amazon API Gateway is a fully managed API gateway for creating, publishing, and securing REST/HTTP/WebSocket APIs at the edge, not a service mesh for internal service-to-service communication within a microservices architecture. Option C is wrong because AWS Transit Gateway is a network transit hub that connects VPCs and on-premises networks via a central router, operating at Layer 3, not at the application layer required for service mesh capabilities like traffic splitting and observability. Option D is wrong because AWS Cloud Map is a cloud resource discovery service that allows services to register and discover instances via DNS or API calls, but it does not provide traffic management, observability, or security features inherent to a service mesh.

Full explanation →
426
Drag & Dropmedium

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps
Order
1Step 1
2Step 2
3Step 3
4Step 4

Why this order

First navigate to snapshots, restore, configure settings, wait for completion, then update application endpoint.

Full explanation →
427
MCQmedium

A company is designing a new serverless application that uses Amazon API Gateway and AWS Lambda. The application must authenticate users using a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The company wants to offload authentication to the API Gateway. Which solution should the architect recommend?

A.Use an API Gateway COGNITO_USER_POOLS authorizer with Cognito configured as an OIDC client to the third-party IdP
B.Use an API Gateway COGNITO_USER_POOLS authorizer
C.Use an API Gateway Lambda authorizer
D.Use an API Gateway IAM authorizer
AnswerA

Cognito can federate with OIDC IdPs, and API Gateway validates the Cognito token.

Why this answer

It uses Amazon Cognito as an OIDC client to the third-party IdP, allowing API Gateway's COGNITO_USER_POOLS authorizer to validate tokens from the IdP without custom code. This offloads authentication entirely to API Gateway, as the authorizer checks the JWT token against the Cognito user pool, which trusts the IdP's OIDC tokens. The architecture meets the requirement of using a third-party IdP while keeping the serverless application simple and managed.

Exam trap

The trap here is that candidates often assume a Lambda authorizer is required for any third-party IdP, missing that Cognito can act as an OIDC client to offload token validation to API Gateway's native authorizer.

How to eliminate wrong answers

Option B is wrong because a COGNITO_USER_POOLS authorizer alone requires users to authenticate directly against a Cognito user pool, not a third-party IdP; it does not support federated OIDC without additional configuration. Option C is wrong because a Lambda authorizer requires custom code to validate the OIDC token, which adds complexity and maintenance overhead, contradicting the goal to offload authentication to API Gateway. Option D is wrong because an IAM authorizer uses AWS Signature Version 4 for signing requests, which is incompatible with OIDC tokens from a third-party IdP; it is designed for AWS IAM-based access control, not federated identity.

Full explanation →
428
MCQmedium

A company deployed the above CloudFormation template. An EC2 instance launched in the PrivateSubnet needs to access the internet for software updates. Which action is required?

A.Create a VPC Peering connection to a public VPC
B.Add a NAT Gateway in the PublicSubnet and update the PrivateSubnet's route table to point to the NAT Gateway
C.Add an Internet Gateway to the VPC and route the private subnet's route table to it
D.Modify the PrivateSubnet to assign public IP addresses on launch
AnswerB

NAT Gateway enables outbound internet for private instances.

Why this answer

A NAT Gateway placed in a public subnet with an Internet Gateway attached allows instances in private subnets to initiate outbound traffic to the internet (e.g., for software updates) while preventing inbound connections from the internet. The private subnet's route table must have a default route (0.0.0.0/0) pointing to the NAT Gateway. This is the standard AWS pattern for outbound-only internet access from private subnets.

Exam trap

The trap here is that candidates often confuse a NAT Gateway with an Internet Gateway, thinking that routing a private subnet directly to an Internet Gateway is sufficient, but this would expose instances to inbound traffic and require public IPs, defeating the purpose of a private subnet.

How to eliminate wrong answers

Option A is wrong because VPC Peering does not provide internet access; it only connects two VPCs privately, and neither VPC inherently has internet access without an Internet Gateway. Option C is wrong because routing a private subnet directly to an Internet Gateway would allow inbound internet traffic, violating the security model of a private subnet; Internet Gateways require public IP addresses and are used with public subnets. Option D is wrong because assigning public IP addresses to instances in a private subnet does not grant internet access; the subnet still lacks a route to an Internet Gateway, and public IPs alone cannot reach the internet without a gateway.

Full explanation →
429
MCQhard

A company is migrating a critical application to AWS. The migration plan includes a pilot light strategy. The company has set up a small replica of the environment in AWS. During a disaster, the company wants to quickly provision the full production environment. Which AWS service is best suited for this purpose?

A.AWS OpsWorks
B.AWS Elastic Beanstalk
C.AWS CloudFormation
D.AWS CodeDeploy
AnswerC

CloudFormation templates can quickly launch the full environment.

Why this answer

AWS CloudFormation is the best service for this scenario because it allows you to define the entire infrastructure as code in templates, which can be stored and then quickly executed to provision the full production environment during a disaster. This aligns with the pilot light strategy, where a small replica is already running and CloudFormation can rapidly scale it up. Option A (OpsWorks) is wrong because it is configuration management service for Chef/Puppet, not for quickly provisioning full environments.

Option B (Elastic Beanstalk) is wrong because it is designed for deploying web applications, not for provisioning custom infrastructure. Option D (CodeDeploy) is wrong because it handles application deployments, not infrastructure provisioning.

Full explanation →
430
Multi-Selecthard

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Configure Amazon EBS encryption using AWS KMS with a customer managed key
B.Enable Amazon S3 default encryption with SSE-C
C.Use AWS CloudHSM to generate and store encryption keys
D.Create an AWS KMS custom key store backed by AWS CloudHSM
E.Store encryption keys in AWS Certificate Manager (ACM)
AnswersC, D

CloudHSM provides dedicated HSM appliances in AWS that can be part of a company's HSM infrastructure.

Why this answer

AWS CloudHSM provides dedicated, single-tenant HSM instances that the company can use to generate and store encryption keys in its own HSM, meeting the requirement that keys be managed by the company's own HSM in an on-premises data center (though CloudHSM is in AWS, it is customer-controlled). Option D is correct because creating an AWS KMS custom key store backed by AWS CloudHSM allows the company to use KMS for encryption operations while the key material is stored in the CloudHSM cluster, satisfying the need for customer-managed HSM-backed keys.

Exam trap

The trap here is that candidates often assume 'customer managed key' in AWS KMS (Option A) satisfies the requirement for keys to be managed by the company's own HSM, but KMS customer managed keys are still stored in AWS KMS, not in a customer-controlled HSM, unless a custom key store backed by CloudHSM is used.

Full explanation →
431
MCQhard

A retail company is migrating its on-premises e-commerce platform to AWS. The platform consists of a load-balanced web tier, an application tier, and a MySQL database. The company wants to modernize the database by migrating to Amazon Aurora MySQL. The migration must have minimal downtime and support rollback. The database is 2 TB in size and has high write activity. The company has set up an AWS Direct Connect connection. Which approach should the company take to migrate the database with minimal downtime?

A.Use AWS SCT to convert the schema, then use AWS DMS with a full load task to migrate the data.
B.Use AWS SCT to convert the schema, then use AWS DMS with a full load and ongoing replication (CDC) task to keep the target in sync until cutover.
C.Use mysqldump to export the database, transfer the dump via AWS Direct Connect, and import into Aurora MySQL.
D.Use the AWS Schema Conversion Tool (SCT) to convert the schema, then set up an Aurora Replica from the on-premises source using native MySQL replication.
AnswerB

Full load plus CDC provides continuous replication, minimizing downtime. Cutover is quick and rollback is possible by stopping replication.

Why this answer

AWS DMS with a full load and ongoing change data capture (CDC) task enables continuous replication of high-write activity from the on-premises MySQL database to Amazon Aurora MySQL, minimizing downtime by keeping the target synchronized until cutover. The CDC component captures incremental changes after the full load, allowing a near-zero downtime migration with the ability to roll back by stopping replication and reverting to the source.

Exam trap

The trap here is that candidates may assume native MySQL replication (Option D) is the simplest approach, but AWS DMS is the recommended managed service for heterogeneous or homogeneous migrations with minimal downtime, as it handles schema conversion, ongoing replication, and rollback seamlessly.

How to eliminate wrong answers

Option A is wrong because a full load task only migrates the data at a point in time, failing to capture ongoing writes during the migration, which would cause significant downtime and data loss. Option C is wrong because mysqldump is a logical export tool that requires taking the source database offline or locking tables to ensure consistency, resulting in downtime, and it does not support ongoing replication for high-write environments. Option D is wrong because Aurora Replicas are read replicas within Amazon Aurora, not a feature for replicating from an on-premises MySQL source; native MySQL replication to Aurora is possible but requires manual setup and does not provide the managed CDC and rollback capabilities of AWS DMS.

Full explanation →
432
MCQhard

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

A.The user cannot describe instances or terminate instances.
B.The user can terminate instances and describe instances.
C.The user can describe instances but cannot terminate instances in any region.
D.The user can describe instances but cannot terminate any instances.
AnswerC

The Deny resource uses a wildcard for instance ID, effectively denying termination of any instance in the account in us-east-1.

Why this answer

The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Exam trap

The trap here is that candidates may assume that a Deny on a specific action (terminate) also blocks related read actions (describe), but IAM evaluates each action independently, so describe is still allowed.

How to eliminate wrong answers

Option A is wrong because the user can describe instances, as the policy grants ec2:DescribeInstances permission; the user is not blocked from describing instances. Option B is wrong because the user cannot terminate instances; the policy explicitly denies ec2:TerminateInstances, so termination will fail. Option D is wrong because it states the user cannot terminate 'any instances' but does not specify the region limitation; the correct answer clarifies that the denial applies to all regions, which is already implied by the policy's effect, but Option D is incomplete and less precise than Option C.

Full explanation →
433
MCQhard

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

A.The user is using an incorrect CLI command syntax.
B.The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.
C.The policy does not specify the instance ID in the Resource field.
D.A service control policy (SCP) or a resource-based policy is denying the action.
AnswerD

A service control policy (SCP) or resource-based policy can deny actions even if the user's IAM policy allows them. This is the most likely cause of the 'AccessDenied' error.

Why this answer

The 'AccessDenied' error despite having the StopInstances permission indicates that something else is denying the action. The most likely cause is a service control policy (SCP) attached at the account or organizational level, or a resource-based policy on the EC2 instance itself that explicitly denies the action. Option A is wrong because incorrect CLI syntax would cause a different error.

Option B is wrong because the policy may not have a tag-based condition; the issue is not about missing tag permissions. Option C is wrong because the policy can use a wildcard for the Resource field, so not specifying an instance ID does not cause AccessDenied. Option D correctly identifies that an SCP or resource-based policy is denying the action.

Full explanation →
434
MCQeasy

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

A.Store session state in Amazon DynamoDB
B.Store session state on the local instance store of each EC2 instance
C.Store session state in Amazon S3
D.Store session state in Amazon ElastiCache for Redis
AnswerD

ElastiCache provides a centralized, highly available session store.

Why this answer

Amazon ElastiCache for Redis is the best choice for handling session state in a highly available, auto-scaling web application because it provides a centralized, in-memory data store that is external to the EC2 instances. This ensures that session data persists independently of instance lifecycle events (e.g., scaling in/out or failures), and Redis offers sub-millisecond latency, replication, and automatic failover, which are critical for maintaining session continuity across the fleet.

Exam trap

The trap here is that candidates often choose DynamoDB (Option A) because it is a managed, highly available database, but they overlook the latency and cost implications for session state, which is a classic in-memory caching use case where ElastiCache for Redis is the optimal AWS service.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB, while highly available and scalable, is a NoSQL database designed for document and key-value storage with higher latency compared to in-memory caches; it is not optimized for the low-latency, high-throughput session state access patterns required by web applications, and its cost per operation is typically higher than ElastiCache for this use case. Option B is wrong because storing session state on the local instance store of each EC2 instance ties session data to a specific instance; if the instance is terminated, replaced, or scaled in, all session data is lost, breaking high availability and user experience. Option C is wrong because Amazon S3 is an object storage service with significantly higher latency (typically tens to hundreds of milliseconds) compared to in-memory stores, and it is not designed for frequent, low-latency read/write operations required for session management; additionally, S3 lacks native session expiration and atomic operations needed for session handling.

Full explanation →
435
MCQhard

A company is migrating a web application to AWS. The application runs on EC2 instances behind an Application Load Balancer. The exhibit shows the current running instances. The company wants to ensure high availability across multiple Availability Zones. Which action should the company take?

A.Launch additional m5.large instances in us-east-1a.
B.Change the m5.xlarge instance in us-east-1c to an m5.large in us-east-1c or move it to another AZ.
C.Terminate the m5.xlarge instance in us-east-1c and launch an m5.large in the same AZ.
D.Place all instances in a single AZ and use an Auto Scaling group.
AnswerB

Balancing instance types and ensuring even distribution across AZs improves HA.

Why this answer

The current instance distribution shows an m5.large in us-east-1b (or similar) and an m5.xlarge in us-east-1c, which is inconsistent. To ensure high availability across multiple Availability Zones, the company should either change the m5.xlarge to an m5.large to match instance types, or move it to a different AZ to better distribute instances. This avoids a single point of failure and ensures balanced capacity.

Option A is incorrect because adding more instances to us-east-1a does not improve AZ diversity. Option C is incorrect because terminating the m5.xlarge and launching an m5.large in the same AZ does not change the AZ distribution. Option D is incorrect because placing all instances in a single AZ eliminates high availability.

Full explanation →
436
MCQmedium

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and stores session state in-memory. The company wants to minimize code changes and use AWS managed services. Which combination of AWS services should the company use to modernize the application's authentication and session management?

A.AWS Directory Service for Microsoft Active Directory (AD Connector) and Amazon RDS
B.Amazon Cognito and Amazon DynamoDB
C.AWS IAM and Amazon DynamoDB
D.AWS Managed Microsoft AD and Amazon ElastiCache for Redis
AnswerD

Managed Microsoft AD provides native Windows authentication; ElastiCache for Redis supports session management with minimal code changes.

Why this answer

AWS Managed Microsoft AD allows the application to continue using Windows authentication with minimal code changes, and Amazon ElastiCache for Redis provides a distributed, high-performance session store that can replace in-memory session state. Option A is incorrect because AD Connector only proxies authentication requests to an on-premises Active Directory, not providing a managed AD service, and Amazon RDS is not designed for session storage. Option B is incorrect because Amazon Cognito is intended for external identity federation (e.g., social logins), not Windows authentication.

Option C is incorrect because AWS IAM is for managing access to AWS resources, not for application-level Windows authentication.

Full explanation →
437
MCQeasy

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

A.Use AWS Config rules to detect unencrypted objects and remediate with Lambda.
B.Enable default encryption on each bucket with SSE-KMS.
C.Create an IAM policy that requires kms:Encrypt permission for all S3 operations.
D.Use an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is not present.
AnswerD

A bucket policy that denies PutObject unless the x-amz-server-side-encryption-aws-kms-key-id header is present ensures that all objects uploaded must use SSE-KMS, providing a strong preventive control that cannot be bypassed by the user.

Why this answer

The most secure way to enforce SSE-KMS across all S3 buckets is to use an S3 bucket policy that denies PutObject if the required encryption header is not present. This ensures that any upload attempts without SSE-KMS are rejected, providing a preventive control. Option A is incorrect because AWS Config rules can only detect and remediate after the fact, not prevent non-compliant uploads.

Option B is incorrect because default encryption can be overridden by specifying a different encryption header in the request. Option C is incorrect because IAM policies control permissions for API calls but cannot enforce specific encryption parameters on object uploads.

Full explanation →
438
MCQhard

A company is designing a data lake on AWS using Amazon S3. The data lake will store sensitive customer data that must be encrypted at rest. The company requires that the encryption keys be managed by the company's own hardware security module (HSM) and rotated every 90 days. Which solution meets these requirements?

A.Use SSE-S3 (Amazon S3 managed keys) and configure a lifecycle policy to re-encrypt objects every 90 days
B.Use SSE-KMS with a customer managed key and configure automatic key rotation every 90 days
C.Use client-side encryption with keys stored in AWS CloudHSM and rotate the keys using CloudHSM key rotation
D.Use SSE-C (customer-provided keys) and provide the key with each PUT request, rotating the key every 90 days
AnswerC

CloudHSM provides dedicated HSMs under your control. You can store keys in CloudHSM and rotate them as needed.

Why this answer

The company requires encryption keys to be managed by its own HSM and rotated every 90 days. AWS CloudHSM provides a dedicated HSM appliance that the customer fully controls, and client-side encryption ensures that the encryption keys never leave the customer's HSM environment. The customer can implement key rotation within CloudHSM using its native key management capabilities, meeting both the HSM control and 90-day rotation requirements.

Exam trap

The trap here is that candidates often confuse SSE-KMS with customer managed keys as meeting the 'own HSM' requirement, but KMS is a shared service and does not provide a dedicated HSM under the customer's exclusive control, unlike CloudHSM.

How to eliminate wrong answers

Option A is wrong because SSE-S3 uses Amazon S3 managed keys, which are not managed by the customer's own HSM, and lifecycle policies cannot re-encrypt objects with new keys — they only manage object transitions or deletions. Option B is wrong because SSE-KMS with a customer managed key uses AWS KMS, not the customer's own HSM; automatic key rotation in KMS is fixed at yearly (365 days), not 90 days, and cannot be configured to a custom interval. Option D is wrong because SSE-C requires the customer to provide the encryption key with each PUT request, but the keys are not stored or managed by the customer's own HSM — they are ephemeral and must be supplied per operation, and rotating keys every 90 days would require re-encrypting all objects, which is impractical and not a managed rotation solution.

Full explanation →
439
MCQmedium

A company is migrating a large .NET application from Windows Server on-premises to AWS. The application uses a SQL Server database. The company wants to reduce licensing costs by using open-source alternatives where possible. However, the application code heavily uses SQL Server-specific features like CLR integration, linked servers, and T-SQL stored procedures. What is the most cost-effective migration strategy?

A.Rehost both application and database on Amazon EC2 with SQL Server licenses brought to AWS
B.Refactor the application to use a microservices architecture with separate databases
C.Rehost the application on Amazon EC2 Windows Server and use Amazon RDS for SQL Server with a license-included option
D.Replatform the database to Amazon Aurora PostgreSQL and rewrite the database code to be compatible
AnswerC

Correct. This reduces operational costs and retains SQL Server features.

Why this answer

Replatforming the database to Amazon RDS for SQL Server retains the SQL Server-specific features while reducing operational overhead. Moving to Aurora PostgreSQL or MySQL would require significant code changes. Rehosting on EC2 SQL Server does not reduce licensing costs.

Full explanation →
440
MCQhard

A company uses AWS Organizations with a hierarchical OU structure. The security OU has an SCP that denies all actions except those explicitly allowed. The development OU has an SCP that allows all actions. A developer account in the development OU tries to launch an EC2 instance but receives an access denied error. The IAM user in the developer account has full administrator permissions. What is the most likely cause?

A.An SCP at the root level denies EC2 actions.
B.The SCP at the development OU level denies EC2 actions.
C.The IAM user does not have MFA enabled, and an SCP requires MFA.
D.An SCP at the root level requires encryption on EC2 instances, which is not satisfied.
AnswerA

A restrictive SCP at the root would override the permissive development OU SCP.

Why this answer

The most likely cause is an SCP at the root level that denies EC2 actions. In AWS Organizations, SCPs are evaluated hierarchically: an explicit deny at the root level overrides any allow from a lower-level OU or account-level policy. Even though the development OU has an SCP that allows all actions, the root-level SCP (which denies all actions except those explicitly allowed) will block EC2 actions unless EC2 is explicitly allowed in that root SCP.

The IAM user's full administrator permissions are irrelevant because SCPs act as a permission boundary that cannot be bypassed by account-level IAM policies.

Exam trap

The trap here is that candidates assume the development OU's 'allow all' SCP overrides the root-level SCP, but in AWS Organizations, an explicit deny at any level (especially the root) takes precedence over any allow, and SCPs are not additive—they are evaluated as a union of all applicable SCPs with explicit denies taking priority.

How to eliminate wrong answers

Option B is wrong because the development OU SCP allows all actions, so it does not deny EC2 actions. Option C is wrong because there is no mention of an MFA requirement in the scenario, and even if an SCP required MFA, the error message would typically indicate an MFA issue, not a generic access denied. Option D is wrong because an SCP that requires encryption on EC2 instances would not cause an access denied error on launch; it would either allow the launch (if encryption is configured) or fail at a later stage (e.g., during instance configuration), but the SCP itself would not block the API call unless it explicitly denies the action.

Full explanation →
441
MCQmedium

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application experiences intermittent high latency due to CPU spikes on some instances. The company wants to automatically replace unhealthy instances and optimize costs. What should a solutions architect do?

A.Configure a target tracking scaling policy based on average CPU utilization.
B.Use a lifecycle hook to perform a health check and terminate unhealthy instances.
C.Use an AWS Lambda function to terminate instances with high CPU.
D.Implement a scheduled scaling policy to increase instances during peak hours.
AnswerA

A target tracking policy scales the group to maintain CPU utilization at a target value and works with ALB health checks to replace unhealthy instances.

Why this answer

A target tracking scaling policy dynamically adjusts the number of instances based on average CPU utilization, which addresses intermittent CPU spikes. The Auto Scaling group also automatically replaces instances that fail ALB health checks, ensuring unhealthy instances are replaced. This optimizes costs by scaling down during low usage.

Option B is incorrect: lifecycle hooks are for custom actions during instance launch or termination, not for replacing unhealthy instances. Option C is incorrect: terminating instances with high CPU via Lambda does not integrate with Auto Scaling and could cause instability. Option D is incorrect: scheduled scaling is for predictable traffic patterns, not intermittent spikes.

Exam trap

Candidates may think that lifecycle hooks are needed to replace unhealthy instances, but ALB health checks integrated with Auto Scaling already handle this automatically.

Full explanation →
442
Multi-Selectmedium

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Select 2 answers
A.Use AWS Config to record IAM role changes and stream to CloudWatch Logs.
B.Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.
C.Create an SCP that denies IAM role creation and modification.
D.Enable CloudTrail management events with CloudWatch Logs integration in all accounts.
E.Enable IAM Access Analyzer to monitor IAM role usage.
AnswersB, D

Metric filters can parse logs and trigger alarms.

Why this answer

A CloudWatch Logs metric filter can parse CloudTrail logs for specific API calls (e.g., CreateRole, UpdateAssumeRolePolicy) and trigger an alarm when IAM role creation or modification events occur. Option D is correct because enabling CloudTrail management events with CloudWatch Logs integration in all accounts ensures that all IAM role API calls are captured in a centralized log group, which is a prerequisite for the metric filter and alarm to work.

Exam trap

The trap here is that candidates often confuse AWS Config (which records configuration changes) with CloudTrail (which records API calls), leading them to select Option A instead of the correct combination of CloudTrail and CloudWatch Logs metric filters.

Full explanation →
443
MCQmedium

A company has a AWS Organizations setup with 100 accounts. The security team requires that all IAM users across all accounts must have multi-factor authentication (MFA) enabled. Currently, there is no central enforcement. The company wants to implement a solution that automatically detects IAM users without MFA and disables their access keys. The solution must be centrally managed from the management account. Which solution meets these requirements?

A.Create an SCP that denies all API calls if the user does not have an MFA device.
B.Deploy an AWS Config rule across all accounts using AWS Organizations that checks for IAM users without MFA, and use AWS Config custom remediation to disable the user's access keys.
C.Use IAM Access Analyzer to generate findings for users without MFA and automatically disable access keys.
D.Use AWS IAM Identity Center to enforce MFA and automatically disable access keys for existing IAM users.
AnswerB

Config can detect and remediate across accounts.

Why this answer

Deploying an AWS Config rule across all accounts using AWS Organizations allows centralized detection of IAM users without MFA, and using AWS Config custom remediation can automatically disable their access keys. This meets the requirement for central management from the management account. Option A is incorrect because SCPs can deny API calls if MFA is not present, but they cannot disable access keys.

Option C is incorrect because IAM Access Analyzer is used for analyzing access policies and does not have the capability to enforce MFA or disable keys. Option D is incorrect because AWS IAM Identity Center is designed for workforce identity and access management, not for managing existing IAM users in member accounts.

Full explanation →
444
MCQhard

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

A.The trust policy does not include the correct service principal for EC2
B.The IAM role name already exists in the account
C.The template does not have the required IAM capabilities
D.The role does not have an instance profile
AnswerB

IAM role names must be unique within an account.

Why this answer

The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Exam trap

The trap here is that candidates often confuse 'Resource creation cancelled' with permission or policy errors, but it specifically indicates a conflict or failure during resource creation, such as a duplicate name, rather than a missing capability or incorrect trust policy.

How to eliminate wrong answers

Option A is wrong because an incorrect trust policy would cause a different error, such as 'Invalid principal in policy' or a validation failure, not 'Resource creation cancelled'. Option C is wrong because missing IAM capabilities (like CAPABILITY_IAM) would result in an explicit error message stating that the template requires IAM capabilities, not a 'Resource creation cancelled' error. Option D is wrong because an instance profile is not required for creating an IAM role; it is only needed when associating the role with an EC2 instance, and its absence would not cause the role creation to fail.

Full explanation →
445
MCQeasy

A company runs a static website on Amazon S3 behind Amazon CloudFront. The website uses a custom domain and SSL certificate from AWS Certificate Manager (ACM). Users report that they sometimes see an older version of the website after updates. What should the company do to ensure users always see the latest content?

A.Disable and re-enable the CloudFront distribution after each update.
B.Enable S3 bucket versioning and use version IDs in URLs.
C.Reduce the CloudFront TTL to 0 seconds for all objects.
D.Create a CloudFront invalidation for the updated files.
AnswerD

Invalidation removes cached objects, forcing refresh.

Why this answer

Creating a CloudFront invalidation removes cached objects, forcing CloudFront to fetch the latest content from the origin. Option A is wrong because disabling and re-enabling the distribution is disruptive and unnecessary. Option B is wrong because bucket versioning controls object versions but does not invalidate CloudFront cache.

Option C is wrong because reducing TTL to 0 affects future caching but does not clear existing cache.

Full explanation →
446
MCQmedium

A company is migrating a monolithic .NET application to AWS. The application uses a SQL Server database with complex stored procedures and tightly coupled components. The migration team wants to minimize refactoring and reduce licensing costs. Which migration strategy should the team use?

A.Refactor the application to .NET Core and use Amazon RDS for MySQL to eliminate Windows licensing.
B.Rehost the application on Amazon EC2 and the database on EC2 with SQL Server using Bring Your Own License (BYOL).
C.Rearchitect the application to microservices and use Amazon DynamoDB for the database.
D.Replatform the database to Amazon Aurora with PostgreSQL compatibility to reduce licensing costs.
AnswerB

This minimizes changes and leverages existing licenses.

Why this answer

Rehosting (lift-and-shift) the monolithic .NET application on Amazon EC2 and the SQL Server database on EC2 with BYOL minimizes refactoring effort and reduces licensing costs by leveraging existing SQL Server licenses. This strategy avoids the complexity of rewriting stored procedures or decoupling tightly coupled components, which is critical for a migration focused on speed and cost reduction.

Exam trap

The trap here is that candidates often choose replatforming (Option D) thinking it reduces licensing costs, but they overlook the need to refactor SQL Server-specific stored procedures for PostgreSQL compatibility, which violates the 'minimize refactoring' requirement.

How to eliminate wrong answers

Option A is wrong because refactoring to .NET Core and switching to Amazon RDS for MySQL would require significant code changes, including rewriting complex stored procedures incompatible with MySQL, and does not minimize refactoring as stated in the question. Option C is wrong because rearchitecting to microservices and using DynamoDB would require extensive refactoring of the monolithic application and stored procedures, contradicting the goal to minimize refactoring. Option D is wrong because replatforming the database to Amazon Aurora with PostgreSQL compatibility would still require modifying the SQL Server stored procedures and potentially the application code, increasing refactoring effort and not reducing licensing costs as effectively as BYOL.

Full explanation →
447
Multi-Selecteasy

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Select 3 answers
A.Create an IAM role in each member account that allows CloudFormation to create resources.
B.Create an SCP that allows CloudFormation to create S3 buckets.
C.Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.
D.Create a CloudFormation StackSet in the management account.
E.Configure the StackSet with the target accounts and regions, and specify an IAM role for execution.
AnswersC, D, E

The template defines the resources to be created.

Why this answer

The CloudFormation template must define the S3 bucket resource with default encryption enabled (e.g., using the `BucketEncryption` property with `AES256` or `aws:kms`) to meet the requirement. Without this configuration in the template, the deployed bucket would not have default encryption, failing the central team's objective.

Exam trap

The trap here is that candidates confuse SCPs with IAM policies, assuming SCPs can grant permissions to CloudFormation, when in fact SCPs only restrict permissions and the actual execution relies on an IAM role assumed by StackSets.

Full explanation →
448
Multi-Selectmedium

A company wants to use AWS IAM Identity Center (successor to AWS SSO) to provide single sign-on access to multiple AWS accounts. They have an existing Microsoft Active Directory and want to synchronize users and groups. Which TWO actions should be taken to set this up?

Select 2 answers
A.Create an IAM Identity Center identity store and manually import users from Active Directory.
B.Set up AWS Managed Microsoft AD in the management account and configure IAM Identity Center to use it as the identity source.
C.Install the AWS Directory Service AD Connector and point it to the on-premises Active Directory.
D.Create permission sets in IAM Identity Center for each job function and assign them to groups.
E.Configure AWS CloudTrail to log all sign-in events.
AnswersB, D

Managed AD integrates with IAM Identity Center.

Why this answer

AWS IAM Identity Center can use AWS Managed Microsoft AD as its identity source, enabling seamless synchronization of users and groups from an existing on-premises Active Directory via a two-way forest trust. This eliminates the need for manual import and provides a managed, highly available directory service that integrates directly with IAM Identity Center for single sign-on across multiple AWS accounts.

Exam trap

The trap here is that candidates often confuse AD Connector (which only proxies authentication) with AWS Managed Microsoft AD (which provides a full directory that can be synchronized with IAM Identity Center), leading them to incorrectly select option C as a valid identity source for IAM Identity Center.

Full explanation →
449
MCQmedium

A company is migrating a containerized application to Amazon ECS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which storage solution should they use?

A.Amazon FSx for Lustre
B.Amazon EBS
C.Amazon EFS
D.Amazon S3
AnswerC

EFS provides a shared file system for multiple instances.

Why this answer

Amazon EFS provides a shared file system that can be accessed by multiple EC2 instances concurrently, making it ideal for persistent storage shared across containers in Amazon ECS. Option A (Amazon FSx for Lustre) is designed for high-performance computing workloads and is not intended for general shared container storage. Option B (Amazon EBS) volumes are block-level storage that can only be attached to a single EC2 instance at a time, so they cannot be shared across multiple instances.

Option D (Amazon S3) is object storage, not a file system, and does not provide a standard file system interface that containers require.

Full explanation →
450
MCQmedium

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

A.Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.
B.Use AWS Config rules to enforce the IAM role creation in each account.
C.Manually create the IAM role in each account using the AWS Management Console.
D.Use AWS Organizations to create the IAM role via a service control policy (SCP).
AnswerA

StackSets automate deployment across multiple accounts.

Why this answer

AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Exam trap

The trap here is confusing AWS Config rules (detective control) with proactive resource creation, or assuming SCPs can create IAM roles when they only enforce permission boundaries.

How to eliminate wrong answers

Option B is wrong because AWS Config rules can only detect non-compliance (e.g., missing IAM role) and trigger remediation actions, but they do not directly create the IAM role; they require a separate automation (e.g., Lambda) to create it, making it less efficient than StackSets. Option C is wrong because manually creating the IAM role in each account using the AWS Management Console is inefficient, error-prone, and does not scale for multi-account environments. Option D is wrong because AWS Organizations service control policies (SCPs) are used to restrict permissions, not to create IAM roles; SCPs cannot create resources like IAM roles.

Full explanation →
Page 5

Page 6 of 23

Page 7

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →