Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 451–525

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 6

Page 7 of 23

Page 8
451
Multi-Selectmedium

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?

Select 2 answers
A.Configure the Application Load Balancer with an HTTP listener that redirects to HTTPS.
B.Use a Network Load Balancer with TCP listener.
C.Place an Amazon CloudFront distribution in front of the ALB.
D.Install an SSL/TLS certificate on the Application Load Balancer.
E.Configure the Application Load Balancer with an HTTPS listener.
AnswersD, E

SSL/TLS certificate is required for HTTPS termination.

Why this answer

Installing an SSL/TLS certificate on the Application Load Balancer (ALB) is required to terminate HTTPS connections and enable encryption of traffic between clients and the ALB. Option E is correct because configuring the ALB with an HTTPS listener is necessary to accept encrypted traffic on port 443 and use the installed certificate for decryption. Together, these actions ensure that traffic to the application is encrypted in transit from the client to the load balancer.

Exam trap

The trap here is that candidates may think an HTTP-to-HTTPS redirect alone (Option A) is sufficient to encrypt traffic, but the redirect only changes the protocol; the actual encryption requires an HTTPS listener with a certificate installed.

Full explanation →
452
Multi-Selectmedium

A company has a consolidated billing setup with AWS Organizations. The finance team needs to track costs at the department level. Each department has its own AWS account. Which THREE steps should be taken to achieve detailed cost allocation? (Choose THREE.)

Select 3 answers
A.Enable detailed billing reports in the management account.
B.Enable the RI discount sharing feature in the management account.
C.Activate cost allocation tags in the Billing and Cost Management console.
D.Enable AWS Cost and Usage Reports (CUR) for each member account.
E.Define and enforce a tagging strategy using AWS Organizations tag policies.
AnswersB, C, E

RI sharing allows cost benefits to be shared across accounts.

Why this answer

Enabling RI discount sharing in the management account allows all accounts in the AWS Organization to benefit from Reserved Instance discounts, which is essential for accurate cost allocation across departments. Without this, RI discounts would only apply to the purchasing account, skewing department-level cost tracking.

Exam trap

The trap here is that candidates often think detailed billing reports or per-account CUR are needed for granular cost tracking, but AWS Organizations requires CUR and tag policies to be configured at the management account level for consolidated, department-level cost allocation.

Full explanation →
453
Multi-Selecthard

A company has a multi-account AWS environment with a central security account for AWS GuardDuty, AWS Security Hub, and AWS IAM Access Analyzer. The security team wants to aggregate findings from all member accounts into the security account. Which THREE steps should be taken?

Select 3 answers
A.Use AWS Config aggregator in the security account to collect configuration items from all accounts.
B.Enable AWS Security Hub in the security account and designate it as the administrator account for the organization.
C.Enable Amazon GuardDuty in the security account and add member accounts via the GuardDuty API.
D.Enable AWS IAM Access Analyzer in the security account with the organization as the zone of trust.
E.Configure GuardDuty in the security account to monitor all regions by using a single detector.
AnswersB, C, D

Security Hub administrator account aggregates findings.

Why this answer

AWS Security Hub supports multi-account management by designating a central administrator account (the security account) that aggregates findings from all member accounts across the organization. This is done through AWS Organizations integration, enabling automatic enrollment of all accounts and regions without manual setup.

Exam trap

The trap here is that candidates may confuse AWS Config aggregator (which aggregates configuration data) with security finding aggregation, or think that simply enabling a service in the security account automatically pulls findings from member accounts without explicitly designating the administrator account or adding members.

Full explanation →
454
MCQeasy

A company has a decentralized IT structure where each business unit manages its own AWS account. The central security team needs visibility into all IAM user activities across accounts. What is the MOST scalable solution to aggregate CloudTrail logs?

A.Enable CloudTrail Insights in each account and review separately.
B.Use AWS Config aggregator to collect IAM user activity.
C.Set up Amazon Kinesis Data Streams in each account and stream to a central Kinesis Data Firehose.
D.Configure CloudTrail in each account to deliver logs to a single S3 bucket in the security account.
AnswerD

This centralizes logs without additional tooling.

Why this answer

CloudTrail can be configured in each account to deliver log files to a centralized S3 bucket in the security account. This approach aggregates all IAM user activities into a single location without requiring additional streaming infrastructure, and it scales automatically as new accounts are added. The central security team can then use Amazon Athena or AWS Lake Formation to query the logs across all accounts efficiently.

Exam trap

The trap here is that candidates may overcomplicate the solution by choosing Kinesis (Option C) because they assume streaming is required for scalability, but CloudTrail's native S3 delivery is the most scalable and cost-effective aggregation method for IAM user activity logs.

How to eliminate wrong answers

Option A is wrong because reviewing CloudTrail Insights separately in each account does not aggregate logs; it requires manual per-account access and lacks a centralized view, making it unscalable for decentralized IT structures. Option B is wrong because AWS Config aggregator is designed to collect resource configuration changes and compliance history, not IAM user activity logs; CloudTrail is the service that records API activity, not AWS Config. Option C is wrong because setting up Kinesis Data Streams in each account and streaming to a central Kinesis Data Firehose introduces unnecessary complexity, cost, and operational overhead compared to the simpler S3 bucket delivery method; CloudTrail can directly deliver to S3 without needing Kinesis.

Full explanation →
455
Multi-Selecthard

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Select 3 answers
A.Enable Enhanced Monitoring to view OS-level metrics such as CPU and memory usage.
B.Increase the instance size to provisioned IOPS to handle the load.
C.Enable Amazon RDS Performance Insights to identify the queries consuming the most CPU.
D.Review Amazon RDS events to check for any recent maintenance or failover activities.
E.Enable Multi-AZ deployment for automatic failover.
AnswersA, C, D

Enhanced Monitoring provides detailed OS metrics.

Why this answer

Options A, C, and D are correct. Enabling Enhanced Monitoring provides OS-level metrics like CPU and memory usage, helping to identify resource bottlenecks. Performance Insights helps identify the specific queries consuming the most CPU, enabling targeted optimization.

Reviewing RDS events can reveal recent maintenance activities or failovers that might impact performance. Option B is incorrect because increasing instance size or IOPS is a remedial action, not a diagnostic step. Option E is incorrect because Multi-AZ is for high availability, not performance diagnosis.

Full explanation →
456
Multi-Selecthard

Which THREE of the following are common challenges when migrating a monolithic application to a microservices architecture on AWS? (Choose three.)

Select 3 answers
A.Managing distributed transactions across multiple services
B.Single database bottleneck when all services share the same database
C.Increased network latency due to inter-service communication
D.Ensuring data consistency between services that own their own databases
E.Difficulty in scaling individual services independently
AnswersA, C, D

Distributed transactions require patterns like saga.

Why this answer

Distributed transactions, data consistency, and network latency are well-known challenges. Autoscaling is a benefit. Single database bottleneck can be solved with polyglot persistence.

Full explanation →
457
MCQeasy

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The application needs to store session state. Which AWS service provides a fully managed, highly scalable solution for session state management?

A.Amazon DynamoDB
B.Amazon ElastiCache for Redis
C.Amazon S3
D.Amazon RDS for MySQL
AnswerB

ElastiCache for Redis is a fully managed, highly scalable, in-memory data store ideal for session state.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for session state management. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it highly scalable and durable for session data. The Application Load Balancer can be configured with stickiness (session affinity) to route requests to the same EC2 instance, but using ElastiCache for Redis decouples session state from the compute layer, enabling stateless application tiers and seamless scaling.

Exam trap

The trap here is that candidates often choose Amazon DynamoDB because it is fully managed and scalable, but they overlook the fact that session state requires extremely low latency and automatic TTL expiration, which are native strengths of Redis but require additional configuration (e.g., DynamoDB TTL) and still cannot match Redis's in-memory performance.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database that, while fully managed and scalable, is not optimized for session state management due to higher latency compared to in-memory caches and lack of native TTL (time-to-live) expiration for session data without additional configuration. Option C is wrong because Amazon S3 is an object storage service designed for large-scale data blobs, not for low-latency, high-throughput session state access; it lacks in-memory performance and introduces significant latency and cost overhead for frequent read/write operations. Option D is wrong because Amazon RDS for MySQL is a relational database that, while fully managed, is not designed for high-speed session state operations; it incurs higher latency due to disk-based storage and ACID transaction overhead, and it is not optimized for the ephemeral, high-frequency access patterns of session data.

Full explanation →
458
MCQhard

A company is migrating a critical database server to Amazon EC2. The root volume (EBS) is configured with DeleteOnTermination=false. After migration, the company needs to ensure that if the EC2 instance fails, a new instance can be quickly launched using the same data. The company takes regular snapshots of the volume. Which statement is correct regarding the root volume's behavior?

A.The root volume cannot be used as a boot volume for a new instance.
B.The root volume will be automatically deleted when the instance is terminated.
C.The root volume will persist after instance termination and can be attached to another instance.
D.Snapshots of the volume will be automatically deleted when the instance is terminated.
AnswerC

The volume remains and can be attached to a new instance for recovery.

Why this answer

When DeleteOnTermination is set to false, the root volume persists after the EC2 instance is terminated. This allows the volume to be attached to another instance, enabling quick recovery. Option A is incorrect because the root volume can be used as a boot volume for a new instance when attached.

Option B is incorrect because the volume is not automatically deleted; deletion only occurs when DeleteOnTermination is true. Option D is incorrect because snapshots are independent of the DeleteOnTermination setting and are not automatically deleted upon instance termination.

Full explanation →
459
MCQhard

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

A.Use a Lambda function in each account to copy logs to the central bucket
B.Set up S3 cross-account replication from each account's bucket to the central bucket
C.Configure VPC Flow Logs in each account to directly deliver to the central bucket
D.Use CloudWatch Logs subscription filter to stream logs to the central account
AnswerB

Replication is automated and efficient.

Why this answer

S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Exam trap

The trap here is that candidates assume VPC Flow Logs can be delivered directly to a cross-account S3 bucket (Option C), but AWS restricts delivery to the same account, making replication the only native, serverless way to centralize logs across accounts.

How to eliminate wrong answers

Option A is wrong because using a Lambda function in each account to copy logs introduces unnecessary complexity, potential for execution timeouts, and additional cost per invocation, making it less efficient than a managed replication service. Option C is wrong because VPC Flow Logs can only deliver to an S3 bucket in the same account as the VPC; direct delivery to a cross-account bucket is not supported by the VPC Flow Logs service. Option D is wrong because CloudWatch Logs subscription filters are designed to stream logs to a central CloudWatch Logs account or to other destinations like Lambda or Kinesis, not directly to an S3 bucket, and would require additional transformation steps to land in S3.

Full explanation →
460
MCQeasy

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

A.Use an AWS Config aggregator to deploy rules across accounts.
B.Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.
C.Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.
D.Use AWS Config to create a custom rule in each account manually.
AnswerC

Conformance packs allow consistent deployment of rules across accounts and regions.

Why this answer

AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Exam trap

The trap here is that candidates confuse the purpose of an AWS Config aggregator (which only aggregates compliance data) with the ability to deploy rules, leading them to select Option A, while Option B seems plausible but misses that conformance packs are the purpose-built, more maintainable solution for deploying a common set of rules at scale.

How to eliminate wrong answers

Option A is wrong because an AWS Config aggregator is used to aggregate compliance data from multiple accounts and Regions into a single view; it does not deploy or manage Config rules across accounts. Option B is wrong because while CloudFormation StackSets can deploy individual Config rules, conformance packs are the recommended service for deploying a common set of rules with built-in support for organization-wide management, parameterization, and remediation actions, making them more maintainable than deploying individual rules. Option D is wrong because manually creating custom rules in each account is not scalable, introduces human error, and violates the principle of infrastructure as code and centralized management.

Full explanation →
461
MCQeasy

A company uses Amazon RDS for MySQL for its database. The operations team notices that read queries are slow during peak hours. The application is read-heavy and can tolerate eventual consistency. Which solution would improve read performance with minimal application changes?

A.Increase the DB instance class to a larger size.
B.Enable Multi-AZ deployment for failover support.
C.Enable RDS Proxy to pool database connections.
D.Create an RDS read replica and direct read traffic to it.
AnswerD

Read replicas offload read queries and can be added without application changes.

Why this answer

Creating an RDS read replica allows read traffic to be offloaded from the primary DB instance, significantly improving read performance with minimal application changes, and the application can tolerate eventual consistency. Option A is incorrect because increasing the DB instance class may help but is more costly and does not scale reads independently. Option B is incorrect because Multi-AZ provides high availability and failover, not read scaling.

Option C is incorrect because RDS Proxy is for connection pooling and managing database connections, not for scaling reads.

Full explanation →
462
MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

A.Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.
B.Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.
C.Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.
D.Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.
AnswerC

SCPs can enforce conditions on API actions across all accounts in the organization.

Why this answer

A service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Exam trap

The trap here is that candidates often confuse detective controls (like CloudTrail and CloudWatch alarms) with preventive controls (like SCPs), or mistakenly think IAM policies can enforce request headers on API actions, when only SCPs can centrally enforce such conditions across multiple accounts.

How to eliminate wrong answers

Option A is wrong because an IAM role with a policy requiring encryption attached to all users does not prevent users from creating buckets without encryption—IAM policies control who can perform actions, but they cannot enforce request headers on the s3:CreateBucket action; users could still create unencrypted buckets by omitting the encryption header. Option B is wrong because configuring bucket policies on each existing bucket only affects access to those specific buckets, not the creation of new buckets; it cannot enforce encryption on newly created buckets. Option D is wrong because enabling CloudTrail and CloudWatch alarms is a detective control, not a preventive one—it only notifies after an unencrypted bucket is created, failing to enforce encryption at creation time.

Full explanation →
463
MCQmedium

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

A.Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.
B.Use AWS Systems Manager Automation to apply the baseline to new accounts.
C.Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.
D.Use AWS Config aggregators to apply the baseline controls to new accounts.
AnswerC

StackSets can deploy stacks across multiple accounts and regions, and can be set to automatically apply to new accounts.

Why this answer

AWS CloudFormation StackSets can automatically deploy a common baseline stack (containing CloudTrail, AWS Config rules, and other security controls) to all accounts in an AWS Organization, including new accounts as they are added. This approach ensures consistent, automated deployment of infrastructure-as-code across the entire organization without manual intervention.

Exam trap

The trap here is confusing SCPs (which only restrict permissions) with actual resource deployment mechanisms, leading candidates to incorrectly choose Option A because they think SCPs can 'enforce' the presence of services like CloudTrail.

How to eliminate wrong answers

Option A is wrong because Service Control Policies (SCPs) are used to define permission boundaries and restrict actions, not to deploy or enable services like CloudTrail or AWS Config rules; SCPs cannot create resources or enable services. Option B is wrong because AWS Systems Manager Automation is designed for operational tasks on existing instances or accounts, not for automatically provisioning baseline resources across new accounts as they join an organization. Option D is wrong because AWS Config aggregators only collect and aggregate compliance data from multiple accounts and regions; they do not deploy or enable Config rules or other security controls.

Full explanation →
464
MCQmedium

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

A.All principals outside the organization are denied all actions.
B.All principals are required to have MFA enabled.
C.All principals in the organization are allowed all actions.
D.All principals in the organization are denied all actions.
AnswerA

The condition denies when the org ID does not match, so external principals are blocked.

Why this answer

The SCP explicitly denies all actions (`ec2:*`, `s3:*`, etc.) to any principal outside the organization by using a `Condition` block with `aws:PrincipalOrgID` set to the organization's ID. This effectively blocks any request from an IAM user, role, or federated principal that is not a member of the specified AWS Organization. The `Deny` effect overrides any allow, so all actions are denied for external principals.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies, assuming SCPs grant permissions (like Option C) or apply to all principals equally (like Option D), when in fact SCPs only deny or allow permissions and are evaluated separately from IAM policies.

How to eliminate wrong answers

Option B is wrong because the SCP does not include any condition requiring MFA; it only denies actions based on the `aws:PrincipalOrgID` condition. Option C is wrong because the SCP does not grant any permissions; it only denies actions to external principals, and by default, SCPs do not allow actions—they only restrict them. Option D is wrong because the SCP only denies actions to principals outside the organization, not to principals inside the organization; internal principals are unaffected by this policy.

Full explanation →
465
MCQeasy

A solutions architect runs the AWS CLI command shown in the exhibit to troubleshoot a failed CloudFormation stack creation. What is the most likely cause of the failure?

A.The VPC configuration is incorrect, causing the Auto Scaling group to fail.
B.The LaunchConfigurationName property in the Auto Scaling group resource was not provided or was an incorrect type.
C.The Auto Scaling group resource type is not supported in the region.
D.The IAM role for the stack does not have permission to create Auto Scaling groups.
AnswerB

The error states that LaunchConfigurationName must be of type String, implying it was missing or wrong.

Why this answer

The error message indicates that the 'LaunchConfigurationName' property must be a string, meaning it was likely not provided or was of the wrong type. Option A is wrong because the error message does not mention any VPC configuration issues. Option C is wrong because the error specifically references the 'LaunchConfigurationName' property, not the resource type being unsupported in the region.

Option D is wrong because the error indicates a property validation issue, not a permissions problem.

Full explanation →
466
Multi-Selectmedium

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Select 2 answers
A.AWS Lambda
B.Amazon Kinesis Data Streams
C.Amazon SQS
D.Amazon Kinesis Data Analytics
E.Amazon Kinesis Data Firehose
AnswersA, B

Can process records from Kinesis streams in near real-time.

Why this answer

AWS Lambda is correct because it can process streaming data from Amazon Kinesis Data Streams with sub-second latency by subscribing to the stream as an event source. Lambda functions are invoked synchronously with each record, enabling real-time transformations or lightweight analytics before the data is stored.

Exam trap

The trap here is that candidates often confuse Amazon Kinesis Data Firehose (which has a 60-second minimum buffer) with Kinesis Data Streams for sub-second latency, or they mistakenly think SQS is suitable for streaming ingestion when it is designed for message queuing, not ordered, replayable stream processing.

Full explanation →
467
MCQhard

Refer to the exhibit. { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/Admin" }, "Action": [ "kms:Decrypt", "kms:GenerateDataKey" ], "Resource": "*", "Condition": { "StringEquals": { "kms:CallerAccount": "123456789012" } } }, { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::123456789012:role/Admin" }, "Action": [ "kms:Decrypt" ], "Resource": "*" } ] } A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?

A.The second statement does not include kms:GenerateDataKey, which is required for decryption.
B.The condition in the first statement restricts decryption to requests coming from account 123456789012, but the role might be used by a user from a different account.
C.There is an explicit deny statement elsewhere in the policy.
D.The condition key kms:CallerAccount is not a valid condition key for KMS key policies.
AnswerC

This is the most likely reason. Since the shown policy allows decryption via both statements, but the role still cannot decrypt, there must be an explicit deny statement elsewhere in the key policy that overrides these allows. Such a deny could be for the same actions or same principal.

Why this answer

The key policy shown does not contain any explicit deny statements, so the inability to decrypt must be due to an explicit deny elsewhere in the key policy (possibly not shown) or in an IAM policy attached to the role. Option B is incorrect because the kms:CallerAccount condition checks the AWS account ID of the principal making the request; when a role from account 123456789012 is assumed, the caller account is 123456789012, regardless of the user's origin. Therefore, the condition would pass, and the first statement would apply.

Since both statements allow decryption, the only remaining explanation is an explicit deny somewhere.

Full explanation →
468
MCQhard

A company has a centralized logging solution where all VPC Flow Logs from member accounts are delivered to a central S3 bucket in the logging account. The logs contain sensitive IP addresses that must be redacted before analysis. What is the MOST scalable approach?

A.Create a Lambda function in each member account to redact logs before delivery.
B.Use S3 Object Lambda to redact sensitive data when objects are read.
C.Use Amazon Athena with Lambda User-Defined Functions (UDFs) to redact data during query execution.
D.Use Amazon Kinesis Data Firehose to transform data before writing to S3.
AnswerC

Scalable and flexible; allows redaction on the fly without modifying stored data.

Why this answer

Amazon Athena with Lambda UDFs allows you to redact sensitive IP addresses at query time without modifying the underlying data in S3. This approach is highly scalable as it leverages Athena's serverless query engine and Lambda's stateless compute, enabling on-the-fly redaction across petabytes of VPC Flow Logs stored centrally in the logging account.

Exam trap

The trap here is that candidates often confuse S3 Object Lambda (which modifies data at read time for all access) with query-time redaction, failing to realize that Athena UDFs provide a more scalable and cost-effective solution for selective redaction during analysis without affecting other consumers of the data.

How to eliminate wrong answers

Option A is wrong because deploying a Lambda function in each member account to redact logs before delivery would require managing multiple functions and would not scale efficiently; it also violates the centralized logging design by altering data before it reaches the central S3 bucket. Option B is wrong because S3 Object Lambda redacts data when objects are read, but it applies to all read requests, which can introduce latency and cost overhead for every query, and it does not integrate natively with Athena for query-time redaction. Option D is wrong because Amazon Kinesis Data Firehose transforms data before writing to S3, but the VPC Flow Logs are already delivered directly to S3 from member accounts; inserting Firehose would require changing the delivery pipeline and adds complexity without addressing the need for query-time redaction.

Full explanation →
469
MCQmedium

An IAM policy allows a user to start and stop EC2 instances but denies terminating instances under a specific condition. Which action will the policy deny?

A.Terminating an EC2 instance in the eu-west-1 region
B.Starting an EC2 instance in the us-west-2 region
C.Stopping an EC2 instance in the eu-west-1 region
D.Terminating an EC2 instance in the us-east-1 region
AnswerA

The Deny statement denies terminating when the region is not us-east-1, so terminating in eu-west-1 is denied.

Why this answer

The Deny statement applies when the condition "StringNotEquals" is true, meaning the requested region is NOT us-east-1. So terminating an instance in a region other than us-east-1 is denied. Terminating in us-east-1 is allowed (since the condition is not met).

Starting and stopping are allowed by the first statement.

Full explanation →
470
MCQeasy

A solutions architect runs the above CLI command. What is the output format?

A.YAML formatted output.
B.A text table with columns.
C.A JSON array of strings.
D.A JSON object with keys.
AnswerC

The query returns a list of three values in JSON array format.

Why this answer

The CLI command shown is `aws ec2 describe-instances --query 'Reservations[].Instances[].InstanceId'`. The `--query` parameter uses JMESPath to extract a list of instance IDs, which results in a JSON array of strings (e.g., `["i-123", "i-456"]`). AWS CLI output defaults to JSON unless `--output` is specified, and the JMESPath expression here returns an array, not a single object or table.

Exam trap

The trap here is that candidates may confuse the `--query` output structure with the default JSON output format, assuming it always returns a JSON object with keys, when in fact JMESPath projections can return arrays of scalars or objects depending on the expression.

How to eliminate wrong answers

Option A is wrong because YAML output requires explicitly setting `--output yaml` in the command, which is not present; the default output format is JSON. Option B is wrong because a text table with columns is produced only with `--output table`, which is not specified, and the `--query` extracts a flat list of IDs, not structured columns. Option D is wrong because a JSON object with keys would result from a query that returns a dictionary (e.g., `{InstanceId: ...}`), but the given JMESPath expression `Reservations[].Instances[].InstanceId` returns an array of scalar values (strings), not key-value pairs.

Full explanation →
471
MCQhard

A company is designing a new solution to process a continuous stream of events from multiple sources. The events must be processed in real-time with exactly-once processing semantics. The solution should be able to handle replayed events without duplication. Which AWS service should be used for the event processing?

A.Amazon Kinesis Data Firehose
B.AWS Lambda with Kinesis trigger
C.Amazon Kinesis Data Analytics for Apache Flink
D.Amazon Simple Queue Service (SQS) with Lambda
AnswerC

Apache Flink provides exactly-once processing semantics.

Why this answer

(Amazon Kinesis Data Analytics for Apache Flink) is correct because it provides exactly-once processing semantics through Flink's checkpoints and state management. Option A (Kinesis Data Firehose) is wrong because it is designed for loading streaming data into data stores, not for real-time processing with exactly-once guarantees. Option B (AWS Lambda with Kinesis trigger) is wrong because Lambda processes records at-least-once, which can result in duplicates.

Option D (Amazon SQS with Lambda) is wrong because SQS standard queues are at-least-once, and FIFO queues are at-most-once, both unsuitable for exactly-once processing.

Full explanation →
472
MCQhard

A company uses AWS Organizations with several OUs. The security team wants to enforce that EC2 instances in production accounts cannot have public IP addresses. The solution must be preventive and should not rely on developers remembering to follow guidelines. What should the security team do?

A.Use the Amazon EC2 'Block public access' feature at the account level.
B.Create an IAM policy that denies ec2:RunInstances if the instance is launched with a public IP and attach it to all IAM roles in production accounts.
C.Use AWS Config to detect instances with public IPs and automatically terminate them.
D.Create a service control policy (SCP) that denies ec2:RunInstances if the request includes AssociatePublicIpAddress=true and attach it to the production OU.
AnswerD

SCPs are preventive and cannot be overridden by IAM policies within the account.

Why this answer

A service control policy (SCP) attached to the production OU can deny the ec2:RunInstances action when the request includes the AssociatePublicIpAddress=true parameter. This is a preventive control that applies to all accounts in the OU, regardless of IAM permissions, and does not rely on developer compliance.

Exam trap

The trap here is confusing detective controls (AWS Config) or account-level features (Block public access) with preventive controls, and underestimating that IAM policies can be circumvented by privileged users or service-linked roles, whereas SCPs apply to all principals in the account.

How to eliminate wrong answers

Option A is wrong because the Amazon EC2 'Block public access' feature is not a preventive control at the account level; it only applies to internet-facing load balancers and not to EC2 instances directly. Option B is wrong because an IAM policy attached to roles can be bypassed if developers create new roles or use other credentials, and it does not prevent actions taken by the root user or services that assume roles outside the policy scope. Option C is wrong because AWS Config is a detective control that triggers remediation after the fact, not a preventive control; it cannot stop the instance from being launched with a public IP.

Full explanation →
473
MCQhard

A company uses AWS SSO with an external identity provider. The security team needs to enforce that users in the finance department can only access the finance OU accounts. Which configuration is required?

A.Configure the external IdP to send a SAML attribute that AWS uses to enforce permissions.
B.Use AWS SSO to assign the finance group to the finance OU accounts only.
C.Create an SCP that denies access to non-finance accounts for users from the finance group.
D.Create IAM roles in each finance account and trust the IdP with a condition on the group attribute.
AnswerB

AWS SSO provides direct assignment of users/groups to accounts.

Why this answer

AWS SSO (now AWS IAM Identity Center) allows you to assign users or groups to specific AWS accounts and OUs directly. By assigning the finance group only to the finance OU accounts, you enforce that those users can only access those accounts via the SSO portal, without needing additional SAML attributes or SCPs. This is the simplest and most direct method for controlling account access based on group membership.

Exam trap

The trap here is that candidates often overcomplicate the solution by thinking they need to modify SAML attributes or create custom IAM roles, when AWS SSO's built-in group-to-account assignment is the simplest and most secure method for controlling access to specific OUs.

How to eliminate wrong answers

Option A is wrong because AWS SSO does not use SAML attributes from the external IdP to enforce permissions on which accounts a user can access; instead, it relies on group-to-account assignments within the SSO configuration. Option C is wrong because SCPs (Service Control Policies) apply to all principals in an account and cannot distinguish between users from different groups within the same account; they are used to restrict service actions, not to control which accounts a user can sign into. Option D is wrong because creating IAM roles in each finance account that trust the IdP with a condition on the group attribute would require managing roles across many accounts and does not leverage AWS SSO's centralized assignment model, making it more complex and less secure than the native SSO group assignment.

Full explanation →
474
Multi-Selectmedium

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all root user activities are monitored and alerted. Which TWO actions should the team take? (Choose TWO.)

Select 2 answers
A.Create an Amazon CloudWatch Events rule to detect root user login events and send an alert via Amazon SNS.
B.Use AWS Config rules to detect root user usage.
C.Create an IAM role for root user with limited permissions.
D.Enable AWS CloudTrail to log root user API calls in all accounts.
E.Attach a service control policy (SCP) to all accounts to deny root user actions.
AnswersA, D

Alerts on root user activity.

Why this answer

Amazon CloudTrail logs root user login events as 'RootLogin' events, which can be captured by an Amazon CloudWatch Events rule (now Amazon EventBridge). This rule can trigger an Amazon SNS notification to alert the security team in real time, ensuring immediate awareness of root activity. Option D is correct because AWS CloudTrail must be enabled in all accounts to record root user API calls; without CloudTrail, there is no audit trail for root actions, making monitoring impossible.

Exam trap

The trap here is that candidates may think SCPs can restrict root user actions, but AWS explicitly exempts the root user from SCPs, making option E ineffective for monitoring or prevention.

Full explanation →
475
MCQeasy

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

A.Amazon DynamoDB
B.Amazon RDS for MySQL
C.Amazon Redshift
D.Amazon Aurora
AnswerB

Amazon RDS is a managed relational database service that supports MySQL, reducing operational overhead.

Why this answer

Amazon RDS for MySQL is the correct choice because it provides a managed MySQL database service that minimizes operational overhead through automated backups, patching, and scaling. Each microservice can have its own RDS instance, enabling database-per-service isolation while offloading administrative tasks like replication and failover to AWS.

Exam trap

The trap here is that candidates may confuse Amazon Aurora with Amazon RDS for MySQL, but Aurora is a separate service with its own engine and pricing, and the question asks for a service to implement the database layer using MySQL, making RDS for MySQL the direct and simplest managed option.

How to eliminate wrong answers

Option A is wrong because Amazon DynamoDB is a NoSQL key-value and document database, not a relational MySQL database, and migrating a MySQL-based monolithic application to DynamoDB would require significant application redesign and schema changes. Option C is wrong because Amazon Redshift is a petabyte-scale data warehouse optimized for analytical queries, not for transactional microservice workloads requiring individual databases. Option D is wrong because Amazon Aurora is a MySQL-compatible relational database, but it is a separate service from RDS for MySQL; while Aurora offers higher performance and availability, the question specifically asks for a service to implement the database layer with minimal operational overhead, and RDS for MySQL is the standard managed MySQL service, whereas Aurora is a distinct offering with different cost and performance characteristics that may not be necessary for all microservices.

Full explanation →
476
MCQhard

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed because a resource exceeded a service quota. The team wants to be notified proactively when service limits are approaching. Which solution meets this requirement?

A.Use AWS CloudTrail to monitor API calls that indicate quota exhaustion.
B.Use AWS Config rules to check if resources are within limits.
C.Use AWS Trusted Advisor to check service limits regularly.
D.Use Amazon CloudWatch to monitor service quota usage metrics and set CloudWatch alarms.
AnswerD

Service quotas are available as CloudWatch metrics and can trigger alarms.

Why this answer

Amazon CloudWatch can monitor service quota usage metrics (published by AWS Service Quotas) and trigger alarms when thresholds are approached. Option A is wrong: AWS CloudTrail logs API calls, not quota utilization. Option B is wrong: AWS Config evaluates resource configurations against rules, not service limits.

Option C is wrong: AWS Trusted Advisor provides a dashboard view of service limits but does not natively support proactive alarms.

Full explanation →
477
MCQmedium

An IAM policy attached to an S3 bucket is shown. What is the net effect on requests to read objects from the bucket?

A.All HTTPS requests from any IP are allowed.
B.Only requests using HTTPS from any IP are allowed because the Deny is overridden.
C.Only requests using HTTPS from the IP range 192.0.2.0/24 are allowed.
D.All requests from the IP range 192.0.2.0/24 are allowed, regardless of protocol.
AnswerC

The Allow requires the IP, and the Deny blocks non-HTTPS.

Why this answer

The IAM policy includes a Deny statement that blocks all requests unless they use HTTPS and originate from the 192.0.2.0/24 IP range. The Allow statement grants read access to the bucket, but the Deny with a condition (aws:SecureTransport and aws:SourceIp) explicitly overrides the Allow for requests that do not meet both conditions. Therefore, only HTTPS requests from the specified IP range are permitted, making option C correct.

Exam trap

The trap here is that candidates often assume an Allow statement alone grants access, forgetting that an explicit Deny with conditions can restrict that Allow, leading them to overlook the combined effect of the Deny's conditions on both protocol and IP range.

How to eliminate wrong answers

Option A is wrong because the policy includes a Deny that blocks non-HTTPS requests and requests from IPs outside 192.0.2.0/24, so not all HTTPS requests from any IP are allowed. Option B is wrong because the Deny is not overridden; it explicitly denies requests that do not meet the conditions, and the Allow only applies to requests that satisfy both HTTPS and the IP range. Option D is wrong because the Deny requires aws:SecureTransport to be true, so HTTP requests from 192.0.2.0/24 are denied.

Full explanation →
478
MCQeasy

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

A.Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.
B.Use AWS Budgets to alert on untagged resources.
C.Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.
D.Create an AWS Lambda function that tags resources after they are created.
AnswerA

SCPs can enforce tag requirements proactively.

Why this answer

A service control policy (SCP) can be applied at the root, OU, or account level in AWS Organizations to deny the creation of resources that do not have the required cost allocation tags. This enforces tagging proactively at the API call level, preventing untagged resources from being created in the first place, which is the most effective approach for central enforcement.

Exam trap

The trap here is that candidates often choose reactive solutions (like AWS Config or Lambda) because they seem automated, but the question asks for the 'most effective' solution, which requires proactive enforcement via SCPs to prevent untagged resources from ever existing.

How to eliminate wrong answers

Option B is wrong because AWS Budgets can only send alerts based on cost or usage thresholds; it cannot enforce or prevent the creation of untagged resources. Option C is wrong because AWS Config rules are reactive — they detect non-compliant resources after creation and can trigger remediation, but they do not prevent the resource from being created, leaving a window for untagged resources to exist. Option D is wrong because a Lambda function that tags resources after creation is also reactive and cannot guarantee that all resources are tagged before they incur cost or are used, and it may fail if the resource type does not support post-creation tagging.

Full explanation →
479
MCQeasy

Refer to the exhibit. An IAM policy allows ec2:Describe* actions on all resources. A developer wants to also allow describing RDS instances. Which action must be added to the policy?

A.rds:List*
B.rds:Get*
C.rds:Describe*
D.ec2:DescribeRdsInstances
AnswerC

rds:Describe* covers all describe actions for RDS.

Why this answer

AWS IAM policies use the `rds:Describe*` action to grant permission to describe RDS instances, DB snapshots, DB parameter groups, and other RDS resources. The `ec2:Describe*` action only covers EC2 resources, not RDS resources, so a separate RDS-specific action is required. The wildcard `*` after `Describe` matches all RDS describe operations, including `rds:DescribeDBInstances`.

Exam trap

The trap here is that candidates assume `ec2:Describe*` covers all AWS describe operations across services, but IAM actions are scoped per service namespace (e.g., `ec2:`, `rds:`), and each service has its own set of actions.

How to eliminate wrong answers

Option A is wrong because `rds:List*` is not a valid IAM action prefix for RDS; RDS uses `Describe` actions for read operations, not `List`. Option B is wrong because `rds:Get*` is not a valid IAM action for RDS; AWS RDS API uses `Describe` actions (e.g., `DescribeDBInstances`) rather than `Get` actions. Option D is wrong because `ec2:DescribeRdsInstances` does not exist; EC2 and RDS are separate services with distinct action namespaces, and RDS actions must use the `rds:` prefix.

Full explanation →
480
MCQmedium

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

A.An SCP that allows only read-only billing actions.
B.An SCP that denies all billing-related actions except read-only.
C.An IAM policy attached to the root OU that denies billing modifications.
D.An SCP that denies the effect of actions that modify billing preferences.
AnswerD

An SCP can deny actions like 'aws-portal:ModifyAccount' and 'aws-portal:ModifyBilling'.

Why this answer

A Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Exam trap

The trap here is that candidates confuse SCPs with IAM policies, thinking an IAM policy can be attached to an OU, or they incorrectly assume that an Allow-only SCP is the simplest way to restrict actions, when in reality a targeted Deny SCP is more precise and maintainable for blocking specific modification actions while allowing all other billing read actions by default.

How to eliminate wrong answers

Option A is wrong because an SCP that allows only read-only billing actions would require an explicit Allow statement for every read-only action, which is brittle and could inadvertently block necessary read-only actions if the list is incomplete; moreover, SCPs are deny-by-default, so an Allow-only SCP would effectively deny all other actions, but it is not the most precise or maintainable approach for this requirement. Option B is wrong because an SCP that denies all billing-related actions except read-only would require an explicit Deny for every non-read-only action, which is cumbersome and error-prone; a Deny list approach is less scalable than using a Deny on specific modification actions as in Option D. Option C is wrong because an IAM policy cannot be attached to an OU; IAM policies are attached to IAM users, groups, or roles, not to organizational units in AWS Organizations, so this option is technically invalid.

Full explanation →
481
Multi-Selectmedium

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Select 2 answers
A.Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.
B.Increase the batch window to reduce the number of Lambda invocations.
C.Enable parallelization factor on the Lambda event source mapping.
D.Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.
E.Configure the Lambda function with a reserved concurrency of 1 per shard.
AnswersD, E

KCL with deduplication leverages sequence numbers and checkpointing to achieve exactly-once processing within a shard.

Why this answer

The correct options are D and E. Using the Kinesis Client Library (KCL) with deduplication logic ensures exactly-once processing and maintains per-shard ordering. Configuring the Lambda function with a reserved concurrency of 1 limits the function to a single concurrent execution, which can enforce sequential processing across shards and help preserve order, though it is not a scalable per-shard solution.

Option A is incorrect because SQS FIFO adds unnecessary complexity and does not preserve Kinesis shard ordering natively. Option B is incorrect because the batch window only affects invocation latency, not ordering or exactly-once semantics. Option C is incorrect because enabling parallelization factor allows concurrent batches per shard, breaking strict ordering.

Exam trap

The trap here is that candidates might think setting reserved concurrency to 1 per shard would maintain ordering, but reserved concurrency is a function-level limit and cannot be set per shard. The correct approach is to keep the default parallelization factor of 1 for each shard.

Full explanation →
482
MCQmedium

A company is migrating a containerized application from on-premises to AWS. The application runs on Kubernetes. The company wants to use Amazon EKS for orchestration. The migration must support high availability across multiple Availability Zones and integrate with AWS services like IAM, VPC, and CloudWatch. The company needs to minimize the operational overhead of managing the Kubernetes control plane. Which EKS configuration should the company use?

A.Use EKS with managed node groups using a mix of On-Demand and Spot Instances across three Availability Zones.
B.Use EKS with self-managed node groups using On-Demand instances in two Availability Zones.
C.Use EKS with a single managed node group using a single instance type in one Availability Zone.
D.Use EKS with Fargate launch type for all pods.
AnswerA

Managed node groups reduce overhead; multi-AZ and mixed instances provide HA and cost savings.

Why this answer

Using EKS with managed node groups reduces operational overhead as AWS manages the node provisioning, scaling, and patching. Deploying across three Availability Zones with a mix of On-Demand and Spot Instances provides high availability and cost optimization. Managed node groups integrate with EC2 Auto Scaling and support diverse instance types, which improves fault tolerance. This configuration meets the requirements for high availability across multiple AZs and integration with AWS services like IAM, VPC, and CloudWatch.

Option B is incorrect because self-managed node groups require manual management of EC2 instances, increasing operational overhead, contrary to the goal of minimizing control plane management.

Option C is incorrect because a single managed node group in one AZ does not provide high availability across multiple AZs.

Option D is incorrect because Fargate launches pods without managing EC2 instances, but it may be less cost-effective for long-running containers and does not support all customizations needed for standard Kubernetes features.

Full explanation →
483
Multi-Selectmedium

A company wants to centrally manage IAM permissions across multiple AWS accounts using AWS Organizations. They need to allow developers to launch EC2 instances but restrict the instance types to approved families (e.g., t3 and m5). Which TWO solutions meet this requirement?

Select 2 answers
A.Use AWS Service Catalog to create a product that launches approved instances, and require developers to launch only through Service Catalog.
B.Apply a service control policy (SCP) that denies ec2:RunInstances with an ec2:InstanceType condition key that does not match approved families.
C.Deploy an AWS Config rule that triggers a Lambda function to terminate unauthorized instances.
D.Create an IAM role in each account with a policy that restricts instance types, and require developers to use that role.
E.Use AWS CloudFormation StackSets to deploy an IAM policy across accounts that denies ec2:RunInstances for non-approved types.
AnswersB, E

Prevents unauthorized instance types at the organizational level.

Why this answer

A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny ec2:RunInstances for non-approved instance types using the ec2:InstanceType condition key. This enforces the restriction across all accounts without requiring per-account IAM changes, and SCPs act as a guardrail that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that IAM roles or Service Catalog alone can enforce restrictions across all access methods without additional guardrails.

Full explanation →
484
MCQhard

A company is migrating a large-scale on-premises Apache Kafka cluster to AWS. The cluster handles real-time streaming data from thousands of IoT devices. The company wants to reduce operational overhead and ensure high availability. Which AWS service should be used?

A.Amazon Managed Streaming for Apache Kafka (MSK)
B.Amazon Simple Notification Service (SNS)
C.Amazon Simple Queue Service (SQS)
D.Amazon Kinesis Data Streams
AnswerA

Amazon MSK provides a fully managed Apache Kafka service that reduces operational overhead and supports high availability for migrating existing Kafka clusters.

Why this answer

(Amazon MSK) is correct because Amazon MSK is a fully managed Apache Kafka service that reduces operational overhead and supports high availability. Option B (SNS) is wrong because Amazon SNS is a pub/sub messaging service, not a streaming platform compatible with Apache Kafka. Option C (SQS) is wrong because Amazon SQS is a queue service, not a streaming platform.

Option D (Kinesis Data Streams) is wrong because while it is a streaming service, it uses its own API and is not compatible with Apache Kafka, requiring significant re-architecture.

Full explanation →
485
Multi-Selectmedium

A company is migrating a legacy application that uses a proprietary binary protocol for communication. The application communicates over TCP/IP. The company wants to modernize the communication layer to use a RESTful API. Which TWO approaches should the company consider?

Select 2 answers
A.Replace the binary protocol with Amazon MQ.
B.Use Amazon API Gateway and AWS Lambda to create a REST API that translates requests to the legacy protocol.
C.Use AWS App Mesh to convert the binary protocol to HTTP.
D.Refactor the application to communicate over HTTP and use Amazon API Gateway.
E.Use Amazon CloudFront to cache the RESTful endpoints.
AnswersB, D

This allows the legacy protocol to be wrapped without modifying the backend.

Why this answer

Options B and D are correct. Option B: Using Amazon API Gateway and AWS Lambda allows the company to create a REST API that acts as a facade, translating RESTful calls into the legacy binary protocol, enabling gradual modernization without full application rewrite. Option D: Refactoring the application to communicate directly over HTTP and using Amazon API Gateway provides a modern, fully managed RESTful interface, which is the ideal long-term solution.

Option A (Amazon MQ) is a message broker and not designed for protocol translation to REST. Option C (AWS App Mesh) is a service mesh for observability and traffic control, not for protocol conversion. Option E (Amazon CloudFront) is a CDN and cannot translate protocols.

Full explanation →
486
MCQmedium

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

A.Use Amazon QuickSight to create dashboards from the flow logs.
B.Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.
C.Set up Amazon Kinesis Data Analytics to process the flow logs in real time.
D.Load the flow logs into Amazon Redshift and run SQL queries.
AnswerB

Athena is serverless and cost-effective for ad-hoc querying of S3 data.

Why this answer

Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Exam trap

The trap here is that candidates may choose Redshift or Kinesis because they associate 'analysis' with traditional data warehouses or real-time processing, overlooking that Athena's serverless, pay-per-query model is the most cost-effective and scalable for ad-hoc SQL analysis of data already in S3.

How to eliminate wrong answers

Option A is wrong because Amazon QuickSight is a visualization tool that requires a data source; it cannot directly analyze raw VPC flow logs in S3 without an intermediate query engine like Athena, and it incurs per-session costs that are not optimal for ad-hoc analysis. Option C is wrong because Amazon Kinesis Data Analytics processes streaming data in real time, which is unnecessary and more expensive for analyzing historical VPC flow logs already stored in S3; the requirement is for batch analysis of stored logs, not real-time processing. Option D is wrong because loading VPC flow logs into Amazon Redshift involves data ingestion, storage, and compute costs even when not querying, and it requires cluster management, making it less cost-effective and more complex than Athena's serverless approach for this use case.

Full explanation →
487
MCQeasy

A company wants to migrate its on-premises file server to AWS. The file server contains 10 TB of data that changes infrequently. The company has a limited bandwidth internet connection and needs to complete the migration within one week. Which AWS service should the company use for the initial data transfer?

A.Amazon S3 Transfer Acceleration
B.AWS Snowball Edge
C.AWS Database Migration Service (DMS)
D.AWS DataSync
AnswerB

Snowball Edge is a physical device that can be shipped, bypassing bandwidth limitations.

Why this answer

AWS Snowball Edge. This is the best option for migrating 10 TB of data over a limited bandwidth connection within a week, as it physically transfers the data via a portable storage device, bypassing the need for network bandwidth. Option A (Amazon S3 Transfer Acceleration) is incorrect because it still relies on internet bandwidth, which is insufficient for the given timeline.

Option C (AWS DMS) is for database migrations, not file servers. Option D (AWS DataSync) also requires network connectivity and bandwidth, making it unsuitable for the large initial transfer over a slow connection.

Full explanation →
488
Multi-Selecthard

A company is designing a new application that will use Amazon DynamoDB as its database. The application will have a heavy read workload with occasional write spikes. The company wants to minimize costs while ensuring that reads are eventually consistent and writes are not throttled. Which three options should the architect consider? (Choose THREE.)

Select 3 answers
A.Use DynamoDB Streams to asynchronously replicate data to a second table for reads
B.Use Auto Scaling for write capacity
C.Use eventually consistent reads for most queries
D.Use DynamoDB Accelerator (DAX) to cache read results
E.Use strongly consistent reads for all queries
AnswersB, C, D

Auto Scaling adjusts write capacity to handle spikes without throttling.

Why this answer

DynamoDB Auto Scaling adjusts the provisioned write capacity based on actual traffic, preventing throttling during write spikes while reducing capacity and cost during low-traffic periods. This meets the requirement to minimize costs and avoid write throttling without manual intervention.

Exam trap

The trap here is that candidates may confuse DynamoDB Streams with a caching solution, or incorrectly assume strongly consistent reads are always required, ignoring the cost implications of RCU consumption for read-heavy workloads.

Full explanation →
489
MCQeasy

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

A.Enable default encryption on the bucket.
B.Use S3 Batch Operations to encrypt existing objects.
C.Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set.
D.Enable AWS CloudTrail to monitor uploads without encryption.
AnswerC

This enforces encryption for all future uploads.

Why this answer

An S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones.

Option D is wrong because CloudTrail does not enforce encryption.

Full explanation →
490
Multi-Selecteasy

A company is designing a disaster recovery strategy for a critical application running on Amazon RDS for PostgreSQL. The primary database is in us-east-1. The company needs a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

Select 2 answers
A.Use AWS Database Migration Service (DMS) for continuous replication.
B.Configure a Multi-AZ deployment with a standby in a different AWS Region.
C.Create a cross-Region read replica and promote it during a disaster.
D.Take daily snapshots and copy them to another Region.
E.Enable automated backups with a retention period of 35 days.
AnswersA, C

Correct. DMS continuous replication can achieve sub-5-second RPO and sub-1-minute RTO when configured with a pre-provisioned target and automated promotion.

Why this answer

AWS DMS with ongoing replication (change data capture) can achieve sub-5-second RPO by continuously replicating changes to a target database in another Region. The RTO can be under 1 minute if the target is pre-provisioned and promotion is automated. Option C: A cross-Region read replica uses asynchronous replication, but when configured for maximum throughput, the typical lag is under 5 seconds, and promoting the replica takes less than a minute, meeting the RPO and RTO requirements.

Options B is incorrect because Multi-AZ deployments are limited to a single Region and do not support cross-Region synchronous replication. Option D: Daily snapshots have an RPO of up to 24 hours. Option E: Automated backups have an RPO of up to 5 minutes and an RTO longer than 1 minute.

Therefore, only A and C satisfy the required RPO and RTO.

Full explanation →
491
MCQhard

A global e-commerce company is designing a new recommendation engine on AWS. The engine processes user behavior data (clicks, purchases) from multiple sources in real time and updates recommendations stored in Amazon DynamoDB. The data stream can reach 100,000 events per second. The solution must be highly available and process events with minimal latency (< 1 second). The company wants to use a managed streaming service and a real-time processing framework. Which solution should a Solutions Architect recommend?

A.Use Amazon Kinesis Data Streams to ingest events, process them in real time with Amazon Kinesis Data Analytics using SQL, and write results to DynamoDB.
B.Use Amazon Kinesis Data Firehose to ingest events, transform data with Lambda, and deliver to DynamoDB.
C.Use Amazon Kinesis Data Streams to ingest events, use AWS Lambda to process each event, and write results to DynamoDB.
D.Use Amazon MSK (Managed Streaming for Apache Kafka) to ingest events, process them with Apache Spark Streaming on Amazon EMR, and write to DynamoDB.
AnswerA

Kinesis Data Analytics provides low-latency real-time processing; integrates well with Kinesis Streams and DynamoDB.

Why this answer

Amazon Kinesis Data Streams can ingest up to 100,000 events per second with shard-level scaling, and Kinesis Data Analytics (SQL) provides sub-second processing latency for real-time transformations. Writing directly to DynamoDB from the analytics application meets the <1 second latency requirement while maintaining high availability through Kinesis's built-in replication across three Availability Zones.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose's near-real-time delivery (60-second buffer) with true real-time streaming, or assume Lambda can handle high-throughput streaming workloads without considering concurrency and latency limitations.

How to eliminate wrong answers

Option B is wrong because Kinesis Data Firehose is a near-real-time delivery service with a minimum buffer interval of 60 seconds, which cannot achieve sub-second latency. Option C is wrong because AWS Lambda has a maximum concurrency limit and per-invocation duration constraints that make it unsuitable for processing 100,000 events per second with <1 second latency, and it lacks native streaming SQL capabilities. Option D is wrong because Apache Spark Streaming on Amazon EMR introduces higher startup and processing overhead (typically seconds of latency) compared to Kinesis Data Analytics SQL, and MSK requires more operational overhead for cluster management.

Full explanation →
492
MCQmedium

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions query an Amazon RDS for PostgreSQL database. Recently, the company has noticed increased latency and occasional timeouts during peak hours. A solutions architect needs to improve the performance and scalability of the database layer. Which solution will meet these requirements with the LEAST operational overhead?

A.Enable Amazon DynamoDB Accelerator (DAX) on the RDS instance.
B.Add a Multi-AZ RDS Read Replica and modify Lambda to use the Read Replica for queries.
C.Increase the instance size of the RDS database to handle more concurrent connections.
D.Implement Amazon RDS Proxy to manage connection pooling between Lambda and the RDS instance.
AnswerD

RDS Proxy handles connection pooling, reducing database load and improving scalability.

Why this answer

Amazon RDS Proxy manages connection pooling between Lambda functions and RDS, reducing the overhead of opening and closing connections, which helps avoid latency and timeouts during peak load. Option A is incorrect because DAX is a caching layer for DynamoDB, not RDS. Option B is incorrect because while Read Replicas can offload read traffic, they do not address connection management, and Lambda still creates many connections.

Option C is incorrect because increasing instance size is vertical scaling and does not solve the connection pooling issue; it may still lead to timeouts under high connection surges.

Full explanation →
493
MCQeasy

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

A.Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.
B.Create an origin access identity (OAI) and grant it read access to the S3 bucket.
C.Attach an IAM role to CloudFront distribution.
D.Configure CloudFront signed URLs.
AnswerB

OAI allows CloudFront to authenticate to S3.

Why this answer

Create an origin access identity (OAI) and grant it read access to the S3 bucket. An OAI is a special CloudFront user that allows CloudFront to access private S3 bucket content securely. Option A is incorrect because CloudFront does not have static public IP ranges; it uses a large dynamic range.

Option C is incorrect because IAM roles are not used directly for CloudFront to S3 access; OAI is the standard method. Option D is incorrect because signed URLs control end-user access, not origin access.

Full explanation →
494
MCQhard

A company is designing a new application that will run on Amazon EKS. The application must be able to scale based on custom metrics such as number of messages in an SQS queue. Which Kubernetes component should be used to achieve this?

A.Kubernetes Event-Driven Autoscaler (KEDA)
B.Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus
C.Kubernetes Cluster Autoscaler
D.AWS Auto Scaling with target tracking
AnswerA

KEDA is designed for event-driven scaling.

Why this answer

Kubernetes Event-Driven Autoscaler (KEDA) is the correct component because it is specifically designed to scale Kubernetes workloads based on external event sources like Amazon SQS queue depth. KEDA acts as a custom metrics adapter that integrates with the Kubernetes Horizontal Pod Autoscaler (HPA), allowing the application to scale pods dynamically based on the number of messages in the SQS queue, which is a custom metric not natively supported by the standard HPA.

Exam trap

The trap here is that candidates often confuse the standard Horizontal Pod Autoscaler (HPA) with the ability to scale based on any custom metric, but the HPA alone cannot ingest external metrics like SQS queue depth without a custom metrics adapter such as KEDA.

How to eliminate wrong answers

Option B is wrong because the standard Kubernetes Horizontal Pod Autoscaler (HPA) with Prometheus requires custom metrics to be exposed via the Kubernetes custom metrics API, but it does not natively support direct scaling based on SQS queue depth without additional components like KEDA or a custom metrics adapter. Option C is wrong because the Kubernetes Cluster Autoscaler is responsible for scaling the number of worker nodes in the cluster, not the number of pods based on application-level metrics like SQS queue depth. Option D is wrong because AWS Auto Scaling with target tracking is an AWS-native service for scaling EC2 instances or other AWS resources, not Kubernetes pods, and it cannot directly interpret Kubernetes custom metrics or scale pods within an EKS cluster.

Full explanation →
495
Multi-Selectmedium

A company has 100 AWS accounts in AWS Organizations. The security team wants to enforce that all Amazon S3 buckets have encryption enabled. Which TWO actions should the team take to meet this requirement? (Choose TWO.)

Select 2 answers
A.Create an SCP that denies s3:PutObject unless encryption headers are included.
B.Create an SCP that requires all objects to be uploaded with server-side encryption.
C.Enable S3 Block Public Access at the account level and use a service control policy to prevent disabling it.
D.Create an SCP that denies the s3:CreateBucket action to all accounts.
E.Use AWS Config rules to detect buckets without default encryption and auto-remediate with a Lambda function.
AnswersA, E

Correct. An SCP can deny s3:PutObject unless encryption headers are present using the condition key s3:x-amz-server-side-encryption, enforcing encryption on uploads across all accounts.

Why this answer

An SCP can deny the s3:PutObject action unless encryption headers are included, using the condition key s3:x-amz-server-side-encryption. This enforces server-side encryption on all object uploads across the organization. Option E is correct because AWS Config rules can detect S3 buckets without default encryption and trigger an auto-remediation Lambda function to enable it, ensuring compliance.

Option C is incorrect because S3 Block Public Access does not enforce encryption; it only prevents public access. Option B is incorrect because SCPs cannot 'require' encryption in the sense of enabling it; they can only deny non-compliant requests, making Option A the precise action. Option D is incorrect because denying CreateBucket does not enforce encryption on existing buckets.

Exam trap

A common trap is to think that S3 Block Public Access (Option C) enforces encryption, but it only blocks public access. Encryption must be explicitly required via SCPs or Config rules.

Full explanation →
496
MCQeasy

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

A.The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.
B.The S3 bucket policy denies access from the pipeline's AWS account.
C.The CodeBuild project does not have the necessary environment variables.
D.The S3 bucket does not have versioning enabled.
AnswerA

The role needs explicit write permissions to the S3 bucket.

Why this answer

The pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission.

Option D is wrong because versioning is not required for writes.

Full explanation →
497
MCQmedium

A company is designing a new application that will process sensitive financial data. The application must encrypt data at rest and in transit. The company wants to use AWS managed keys for encryption. Which AWS service should the company use to create and manage the encryption keys?

A.AWS CloudHSM
B.AWS Secrets Manager
C.AWS Key Management Service (KMS)
D.AWS Certificate Manager (ACM)
AnswerC

KMS is a fully managed service for creating and controlling encryption keys.

Why this answer

AWS Key Management Service (KMS) is the correct choice because it is a managed service that enables you to create, store, and control encryption keys used to encrypt data at rest and in transit. KMS integrates with other AWS services (e.g., S3, EBS, RDS) and supports envelope encryption, where a customer master key (CMK) encrypts data keys that perform the actual encryption. It also provides automatic key rotation and fine-grained access control via IAM policies and key policies, meeting the requirement for AWS-managed keys.

Exam trap

The trap here is that candidates often confuse AWS CloudHSM (which provides dedicated, customer-managed HSMs) with KMS (which provides fully managed, AWS-controlled keys), leading them to choose CloudHSM when the question explicitly requires 'AWS managed keys'.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides dedicated hardware security modules (HSMs) that you manage yourself, not AWS-managed keys; it requires you to handle key lifecycle and scaling, and does not offer the same level of integration with AWS services as KMS. Option B is wrong because AWS Secrets Manager is designed to securely store and rotate secrets (e.g., database credentials, API keys), not to create or manage encryption keys; it can use KMS to encrypt those secrets, but it is not a key management service itself. Option D is wrong because AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates for securing network traffic (in transit), but it does not create or manage encryption keys for data at rest; it relies on KMS for private key protection in some cases, but its primary function is certificate lifecycle management.

Full explanation →
498
MCQeasy

A company is migrating an on-premises application to AWS. The application requires low-latency access to a file system that can be mounted by multiple EC2 instances simultaneously. Which AWS storage service should they use?

A.Amazon EFS
B.Amazon S3
C.Amazon FSx for Windows File Server
D.Amazon EBS
AnswerA

EFS provides a shared file system for multiple instances.

Why this answer

Amazon EFS is a scalable, elastic file system for Linux-based workloads that can be mounted by multiple EC2 instances simultaneously, providing low-latency access. S3 is object storage, not a file system, so it does not support file-level mounts. Amazon EBS volumes (including multi-attach) are block storage typically attached to a single instance; while io1/io2 with multi-attach can be shared, it is limited and not designed as a general-purpose shared file system.

Amazon FSx for Windows File Server is a managed Windows file server, suitable for Windows workloads, but EFS is simpler and more cost-effective for Linux-based applications requiring shared file access.

Full explanation →
499
MCQeasy

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

A.Use Amazon CloudFront to enforce HTTPS.
B.Enable S3 default encryption on the bucket.
C.Require pre-signed URLs for all uploads.
D.Add a bucket policy that denies PutObject without the x-amz-server-side-encryption header.
AnswerD

An S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not present enforces encryption for all new objects.

Why this answer

An S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not present enforces encryption for all new objects. Option A is wrong because Amazon CloudFront enforces HTTPS for data in transit, not server-side encryption at rest. Option B is wrong because enabling S3 default encryption encrypts objects that do not specify encryption, but it does not deny uploads without encryption headers; objects can still be uploaded without explicitly setting encryption.

Option C is wrong because pre-signed URLs provide temporary access but do not enforce encryption requirements.

Full explanation →
500
MCQhard

A company uses AWS Organizations with 200 accounts. The security team wants to enforce that all EC2 instances launched in any account must use a specific Amazon Machine Image (AMI) ID that is approved by the security team. Which approach should be used?

A.Use IAM policies in each account to restrict the AMI ID
B.Use AWS Config rules with auto-remediation to stop non-compliant instances
C.Use a service control policy (SCP) that denies EC2 RunInstances unless the AMI ID matches the approved list
D.Use CloudFormation StackSets to enforce AMI IDs for all new instances
AnswerC

SCPs can centrally control which AMIs can be used across all accounts.

Why this answer

A service control policy (SCP) can centrally deny the EC2 RunInstances action across all accounts in an AWS Organization unless the request specifies an AMI ID from an approved list. SCPs act as a permission guardrail that cannot be overridden by account-level IAM policies, making them the only mechanism that enforces a mandatory AMI ID across 200 accounts without relying on post-launch detection or per-account configuration.

Exam trap

The trap here is that candidates confuse reactive compliance tools like AWS Config (which detects violations after the fact) with proactive preventive controls like SCPs (which block the action before it happens), leading them to choose Option B instead of C.

How to eliminate wrong answers

Option A is wrong because IAM policies in each account can be overridden by an account administrator with full administrative privileges, and managing 200 separate IAM policies is operationally unscalable and does not provide a centralized enforcement mechanism. Option B is wrong because AWS Config rules with auto-remediation are reactive—they detect non-compliant instances after launch and then attempt to stop them, which allows a window of non-compliance and can be bypassed if the remediation action fails or is delayed. Option D is wrong because CloudFormation StackSets can deploy templates that specify AMI IDs, but they cannot prevent users from launching EC2 instances outside of CloudFormation using the console, CLI, or SDK, so they do not enforce the AMI ID requirement universally.

Full explanation →
501
MCQhard

Refer to the exhibit. A solutions architect applies this IAM policy to a user. The user tries to upload an object to my-bucket using an unencrypted HTTP connection with SSE-S3 encryption. Will the upload succeed?

A.Yes, because the Deny statement only applies to non-encrypted requests.
B.Yes, because the request uses SSE-S3 encryption which satisfies the Allow statement.
C.No, because the Deny statement blocks all HTTP requests regardless of encryption.
D.No, because the Allow statement requires HTTPS transport.
AnswerC

The Deny condition is on SecureTransport false, so any HTTP request is denied.

Why this answer

The Deny statement in the policy explicitly blocks all HTTP requests (using `aws:SecureTransport`: false) regardless of whether the request uses SSE-S3 encryption. Since the user is uploading via an unencrypted HTTP connection, the Deny statement matches and overrides any Allow statement, causing the upload to fail. AWS IAM policy evaluation is explicit deny by default, so the Deny takes precedence.

Exam trap

The trap here is that candidates often focus on the encryption requirement (SSE-S3) and overlook the explicit Deny for HTTP transport, mistakenly thinking that encryption alone satisfies all conditions, when in fact the Deny for insecure transport takes precedence.

How to eliminate wrong answers

Option A is wrong because the Deny statement does not only apply to non-encrypted requests; it specifically blocks HTTP requests (non-HTTPS), and the request uses HTTP, so it is denied regardless of encryption. Option B is wrong because while the Allow statement permits requests with SSE-S3 encryption, the Deny statement for HTTP requests overrides it; IAM denies take precedence over allows. Option D is wrong because the Allow statement does not require HTTPS transport; it only requires SSE-S3 encryption and does not mention HTTPS, so the misconception is that HTTPS is required when it is not explicitly stated.

Full explanation →
502
MCQhard

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to upload an object to `s3://my-bucket/secret/data.txt` from an IP address in the 10.0.0.0/8 range. What will happen?

A.The upload succeeds because the Allow statement grants s3:PutObject.
B.The upload succeeds because the Deny statement only applies to GetObject, not PutObject.
C.The upload fails because the Deny statement denies all s3 actions unconditionally.
D.The upload fails because the Deny statement explicitly denies s3:PutObject for the prefix secret/ from the specified IP range.
AnswerD

Deny overrides Allow, and conditions match.

Why this answer

The Deny statement explicitly denies all s3 actions (s3:*) for objects with the prefix secret/ when the source IP is in the 10.0.0.0/8 range. Since the user's IP is in that range and the object path starts with secret/, the Deny applies and overrides the Allow statement. Therefore, the upload fails.

Options A and B claim success, which is incorrect. Option C says it fails because the Deny is unconditional, but the Deny is conditional on the IP range and prefix, so C is inaccurate. Option D correctly identifies the explicit Deny for s3:PutObject (which is included in s3:*) under the given conditions.

Full explanation →
503
MCQhard

A company is migrating a stateful application to AWS. The application uses sticky sessions (session affinity) on the current on-premises load balancer. The company wants to use an Application Load Balancer (ALB) in AWS. Which feature should be enabled?

A.Connection draining (deregistration delay).
B.Sticky sessions (session affinity) using a cookie generated by the load balancer.
C.Health checks to ensure only healthy instances receive traffic.
D.Cross-zone load balancing.
AnswerB

Ensures requests from the same client go to the same target.

Why this answer

ALB supports sticky sessions (session affinity) using a cookie generated by the load balancer, which meets the requirement to maintain session state from the on-premises environment. Option A (connection draining) is used to allow in-flight requests to complete during instance deregistration, not for session affinity. Option C (health checks) ensures traffic is only sent to healthy instances, but does not maintain session stickiness.

Option D (cross-zone load balancing) distributes traffic evenly across all availability zones, but does not affect session affinity.

Full explanation →
504
MCQmedium

A company is deploying a containerized application on Amazon ECS. The application must be highly available and scale automatically based on CPU utilization. The application also needs to be accessible from the internet via a single endpoint. Which combination of services should the solutions architect use?

A.Amazon ECS with an Application Load Balancer and ECS Service Auto Scaling with a target tracking policy based on average CPU utilization.
B.Amazon ECS with a Network Load Balancer and step scaling policies.
C.Amazon ECS with an Application Load Balancer and step scaling policies based on CPU utilization.
D.Amazon ECS with an Application Load Balancer and manual scaling.
AnswerA

ALB provides a single endpoint; target tracking auto scaling adjusts capacity based on CPU.

Why this answer

An Application Load Balancer (ALB) provides a single internet-facing endpoint and supports HTTP/HTTPS traffic, which is typical for containerized applications. ECS Service Auto Scaling with a target tracking policy based on average CPU utilization allows the service to automatically adjust the desired count of tasks to maintain a specified CPU utilization target, ensuring high availability and elasticity.

Exam trap

The trap here is that candidates often confuse step scaling with target tracking, assuming step scaling is required for CPU-based scaling, but target tracking is the simpler and more AWS-recommended approach for maintaining a specific utilization target.

How to eliminate wrong answers

Option B is wrong because a Network Load Balancer (NLB) operates at Layer 4 and does not support HTTP/HTTPS path-based routing or host-based routing, which are often needed for containerized applications; also, step scaling policies are less precise than target tracking for maintaining a specific CPU utilization metric. Option C is wrong because while it uses an ALB, step scaling policies are not the recommended approach for scaling based on CPU utilization—target tracking policies are simpler and more effective as they automatically adjust to maintain a target metric value. Option D is wrong because manual scaling does not provide automatic scaling based on CPU utilization, which is a requirement for the application to scale automatically.

Full explanation →
505
Multi-Selecthard

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Select 3 answers
A.Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.
B.Create a service control policy (SCP) that denies creation of VPCs with non-compliant CIDR blocks.
C.Create an IAM role in each account with permissions to manage VPCs.
D.Set up AWS Lambda functions to terminate noncompliant VPCs daily.
E.Use AWS Config rules to detect and report noncompliant VPCs.
AnswersA, B, E

Automates deployment of compliant infrastructure.

Why this answer

AWS CloudFormation StackSets allows you to deploy infrastructure as code across multiple accounts and Regions from a single administrative account. By defining a standard VPC and subnet configuration in a CloudFormation template and using StackSets, the central IT team can consistently provision compliant network resources in all accounts, ensuring adherence to the standard.

Exam trap

The trap here is that candidates may confuse detective controls (like AWS Config rules) with preventive controls (like SCPs), or assume that reactive termination via Lambda is an acceptable enforcement strategy, when the question specifically asks for steps to 'enforce' the standard, which requires preventive or proactive mechanisms.

Full explanation →
506
MCQhard

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

A.Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.
B.Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.
C.Use resource-based policies on all AWS resources to deny access from other regions.
D.Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.
AnswerB

SCPs prevent resource creation in disallowed regions; Config detects violations.

Why this answer

Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Exam trap

The trap here is that candidates often confuse network-level controls (like PrivateLink or VPC endpoints) with governance-level controls (like SCPs), mistakenly believing that restricting network traffic is sufficient to enforce data residency, when in fact only SCPs can prevent resource creation in disallowed regions at the API level.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink and VPC endpoints keep network traffic within the AWS network and can restrict traffic to a specific region, but they do not prevent users or services from creating resources in other regions; they only control data plane traffic, not the control plane actions that create resources. Option C is wrong because resource-based policies (e.g., S3 bucket policies, IAM role trust policies) can restrict access based on source IP or VPC endpoint, but they cannot deny the creation of resources in other regions; they only control access to existing resources, not the provisioning of new ones. Option D is wrong because AWS WAF and AWS Shield are security services focused on protecting web applications from common exploits and DDoS attacks; they do not provide any mechanism to enforce geographic data residency or restrict resource creation to specific regions.

Full explanation →
507
MCQhard

A company is designing a global application that requires low-latency read access to a database from multiple AWS regions. The database stores user profile data that is updated infrequently. The solution must ensure eventual consistency and minimize write conflicts. Which combination of AWS services should be used?

A.Amazon RDS Multi-AZ with read replicas in each region
B.Amazon DynamoDB global tables
C.Amazon Aurora Global Database
D.Amazon ElastiCache for Redis with global datastore
AnswerB

DynamoDB global tables replicate data across regions with eventual consistency and automatic conflict resolution.

Why this answer

DynamoDB global tables provide multi-region replication with eventual consistency and automatic conflict resolution. Option A is wrong because RDS Multi-AZ does not replicate across regions. Option C is wrong because Aurora Global Database provides strong consistency, not eventual.

Option D is wrong because ElastiCache is a cache, not a primary data store.

Full explanation →
508
MCQhard

A company has a production AWS Lambda function that processes data from an Amazon SQS queue. The function often experiences throttling errors. The company wants to implement a solution to reduce throttling and improve processing performance. Which solution meets these requirements?

A.Configure the SQS queue to use a higher concurrency limit.
B.Increase the reserved concurrency for the Lambda function.
C.Create additional SQS queues and distribute messages across them.
D.Increase the batch size of the Lambda event source mapping.
AnswerB

This ensures the function has enough concurrency to avoid throttling.

Why this answer

Increasing the reserved concurrency for the Lambda function guarantees that the function can process more invocations concurrently, reducing throttling errors. Option A is incorrect because SQS queues do not have a configurable concurrency limit; concurrency is managed at the Lambda function level. Option C is incorrect because distributing messages across multiple queues does not increase the function's concurrency; each queue invocation still counts toward the same reserved concurrency.

Option D, increasing the batch size, can improve throughput per invocation but does not reduce throttling caused by insufficient concurrency.

Full explanation →
509
MCQhard

A company is migrating a multi-tier application to AWS. The application has a web tier, application tier, and database tier. The company wants to use AWS services to improve scalability and reduce costs. Currently, the on-premises infrastructure is underutilized. What is the most cost-effective migration strategy?

A.Refactor the application to run on containers using Amazon EKS with Fargate.
B.Replatform the web tier to AWS Elastic Beanstalk and the database to Amazon RDS.
C.Rehost (lift-and-shift) to Amazon EC2 using AWS Application Migration Service, then right-size instances and purchase Reserved Instances.
D.Purchase compute-heavy EC2 instances to handle peak loads and use On-Demand pricing.
AnswerC

Lift-and-shift is fast, and reserved instances reduce costs.

Why this answer

The most cost-effective strategy for a migration with underutilized on-premises infrastructure is to lift-and-shift to EC2, right-size the instances to match actual usage, and purchase Reserved Instances to save costs. This approach minimizes changes and leverages AWS discounts. Options A and B involve rearchitecting or replatforming which are more costly and time-consuming.

Option D does not consider right-sizing and leads to overspending.

Full explanation →
510
MCQmedium

A company is migrating a stateful application to AWS. The application runs on a single on-premises server and uses local storage for persistent data. The company wants to achieve high availability and scalability. Which migration approach should the company use?

A.Use multiple EC2 instances behind an Application Load Balancer with sticky sessions.
B.Lift and shift to a single Amazon EC2 instance with an EBS volume.
C.Refactor the application to store state in Amazon ElastiCache or Amazon DynamoDB.
D.Use an EC2 Auto Scaling group with lifecycle hooks to persist state to EBS snapshots.
AnswerC

Refactoring to store state in Amazon ElastiCache or DynamoDB separates state from compute. This allows compute to scale in/out and instances to fail without data loss, achieving both HA and scalability.

Why this answer

The application is stateful and needs high availability and scalability. Refactoring to store state in managed services like Amazon ElastiCache or DynamoDB decouples state from compute, allowing compute to scale and be replaced without data loss. Option A is wrong: while an ALB with sticky sessions distributes traffic, it ties sessions to specific instances, making scaling and failover complex and not fully HA.

Option B is wrong: a single EC2 instance is a single point of failure and cannot scale. Option D is wrong: EBS snapshots are for backup/disaster recovery, not real-time HA or state persistence during scaling. Only option C properly addresses state management for HA and scalability.

Full explanation →
511
MCQeasy

A company is designing a new serverless application using AWS Lambda. The Lambda function needs to access an Amazon RDS database. The database is in a VPC without public internet access. What is the MOST secure way to allow the Lambda function to connect to the database?

A.Configure the Lambda function to access the VPC, and place it in the same subnets as the RDS instance.
B.Create a VPC endpoint for Amazon RDS and use it from Lambda.
C.Use an AWS Network Load Balancer in front of the RDS instance and connect Lambda to the NLB.
D.Create a public endpoint for the RDS instance and allow Lambda to connect over the internet.
AnswerA

Lambda can connect to resources in a VPC via an Elastic Network Interface (ENI) in the same subnets.

Why this answer

Placing the Lambda function in the same VPC subnets as the RDS instance allows it to communicate directly over private IP addresses using the VPC's internal routing. This eliminates exposure to the public internet and leverages security groups to control traffic at the instance level. Lambda functions must be configured with VPC access to connect to resources inside a VPC, and placing them in the same subnets ensures minimal latency and maximum security.

Exam trap

The trap here is that candidates often confuse VPC endpoints (used for API calls to AWS services) with database connectivity, leading them to incorrectly select Option B, or they overcomplicate the solution with a load balancer (Option C) when a direct VPC attachment is the simplest and most secure approach.

How to eliminate wrong answers

Option B is wrong because Amazon RDS does not support VPC endpoints (interface or gateway endpoints) for database connections; VPC endpoints are used for AWS service APIs (e.g., S3, DynamoDB), not for database traffic. Option C is wrong because placing a Network Load Balancer in front of RDS adds unnecessary complexity and cost, and the NLB still requires the Lambda function to be in the VPC to connect privately, making it redundant. Option D is wrong because creating a public endpoint for RDS exposes the database to the internet, violating the requirement for no public internet access and introducing significant security risks.

Full explanation →
512
MCQmedium

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

A.Use AWS PrivateLink to route traffic through the NGFW.
B.Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.
C.Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.
D.Set up AWS Direct Connect between all VPCs and the inspection VPC.
AnswerB

This forces all inter-VPC traffic to go through the inspection VPC.

Why this answer

It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Exam trap

The trap here is that candidates often assume VPC peering (Option C) can be used for transitive routing, but VPC peering does not support transitive routing, making it impossible to route traffic through an inspection VPC to other VPCs.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is designed for private connectivity to services via Network Load Balancers, not for routing inter-VPC traffic through a centralized NGFW; it does not support transitive routing or traffic inspection between VPCs. Option C is wrong because VPC peering does not support transitive routing, so you cannot route traffic from one peered VPC through another VPC to reach a third VPC; this would require a full mesh of peering connections and complex route tables, which is inefficient and not scalable. Option D is wrong because AWS Direct Connect is a dedicated network connection from on-premises to AWS, not a solution for routing traffic between VPCs; it does not provide inter-VPC routing capabilities and would add unnecessary cost and complexity.

Full explanation →
513
MCQmedium

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

A.Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.
B.Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.
C.Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.
D.In the source account, create a KMS key and allow the logging account to use it for encryption.
AnswerA

The service principal is 'delivery.logs.amazonaws.com' and needs both bucket and key permissions.

Why this answer

VPC Flow Logs can be published to an S3 bucket in a different account by using a resource-based bucket policy that grants the VPC Flow Logs service principal (delivery.logs.amazonaws.com) write access. Additionally, since the logs must be encrypted at rest with a KMS key in the logging account, the KMS key policy must also grant the same service principal the kms:Encrypt and kms:Decrypt permissions. This combination allows the cross-account delivery service to write encrypted objects directly into the logging account's bucket.

Exam trap

The trap here is that candidates often assume cross-account delivery requires an IAM role (Option B) or that the source account must own the encryption key (Option D), but the correct mechanism uses resource-based policies on the destination bucket and KMS key, not role assumption or source-side key ownership.

How to eliminate wrong answers

Option B is wrong because VPC Flow Logs delivery does not use IAM roles for cross-account access; it relies on resource-based policies (bucket policy and KMS key policy) rather than assuming a role. Option C is wrong because the source account's S3 bucket policy is irrelevant; VPC Flow Logs are delivered directly to the logging account's bucket, not written to a source bucket and then replicated. Option D is wrong because using a KMS key in the source account would not allow the logging account to control encryption; the requirement is that the KMS key resides in the logging account, and the source account's key cannot be used for cross-account delivery without additional complex cross-account key grants, which is not the standard approach.

Full explanation →
514
Multi-Selecthard

A company runs a web application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer. The operations team notices that the ALB returns 503 errors during peak traffic. Which TWO actions should the solutions architect take to resolve this issue?

Select 2 answers
A.Increase the idle timeout on the ALB.
B.Enable ECS service Auto Scaling to automatically adjust the number of tasks.
C.Increase the deregistration delay on the target group.
D.Review the ECS service events for task failures or health check issues.
E.Increase the task memory allocation in the task definition.
AnswersB, D

ECS service Auto Scaling adjusts the number of tasks based on demand, ensuring sufficient capacity to handle peak traffic and reducing 503 errors.

Why this answer

Options B and D are correct. 503 errors from ALB indicate the target group has no healthy targets. Enabling ECS service Auto Scaling (B) will increase the number of tasks to handle traffic. Reviewing ECS service events (D) can reveal why tasks are unhealthy.

Option A is wrong because increasing ALB idle timeout does not affect health. Option C is wrong because increasing deregistration delay might help but is not a primary fix. Option E is wrong because increasing task memory might not solve the health issue if it's due to capacity.

Full explanation →
515
MCQmedium

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

A.Use S3 bucket policies with condition keys for tags
B.Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies
C.Use AWS Lake Formation with column-level permissions
D.Use S3 Object Lambda with AWS CloudTrail
AnswerA

Correct. S3 bucket policies with condition keys (e.g., `s3:ExistingObjectTag`) can enforce tag-based access control. Combined with S3 default encryption and CloudTrail auditing, this meets all requirements.

Why this answer

The correct solution uses S3 bucket policies with condition keys based on tags. S3 bucket policies can use the `s3:ExistingObjectTag` condition key to enforce fine-grained access control based on object tags. Encryption at rest is achieved using S3's default encryption (SSE-S3) or other server-side encryption options, which are independent of the access control mechanism.

AWS CloudTrail with S3 data events can audit all access requests, providing the required audit trail. This combination meets all requirements: encryption at rest, tag-based fine-grained access control, and auditing.

Exam trap

A common trap is assuming that advanced services like AWS Lake Formation or S3 Object Lambda are required for tag-based access control, but S3 bucket policies with condition keys provide a simpler and more direct solution.

How to eliminate wrong answers

Option A is wrong because S3 bucket policies with condition keys for tags can enforce access control based on resource tags, but they do not provide the ability to audit access at the granularity required; CloudTrail is needed for auditing, and bucket policies alone cannot enforce column-level or tag-based fine-grained access control on the data content itself. Option B is wrong because SSE-C encrypts data at rest using customer-provided keys, but it does not provide any access control or auditing capabilities; bucket policies are separate and do not enable fine-grained tag-based access control or auditing. Option C is wrong because AWS Lake Formation with column-level permissions provides fine-grained access control at the table and column level, but it does not natively support tag-based access control on S3 objects and does not inherently provide auditing; CloudTrail would still be required for auditability, and Lake Formation is more suited for database-style permissions rather than S3 object tag-based policies.

Full explanation →
516
MCQeasy

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

A.Increase the Redis node type to handle the load and rely on the ElastiCache maintenance window.
B.Use a blue/green deployment strategy by creating a new Redis cluster and switching the application endpoint.
C.Deploy the Redis cluster with Multi-AZ and automatic failover enabled across two Availability Zones.
D.Deploy the Redis cluster as a single node in one Availability Zone and take regular snapshots.
AnswerC

Multi-AZ with automatic failover provides high availability during patching.

Why this answer

Deploying ElastiCache for Redis with Multi-AZ and automatic failover enabled ensures that if the primary node fails or requires patching, a read replica in a different Availability Zone is automatically promoted to primary, minimizing downtime. This aligns with the requirement for high availability during patching, as ElastiCache handles failover transparently without manual intervention.

Exam trap

The trap here is that candidates may confuse scaling (Option A) or manual migration strategies (Option B) with the native high-availability feature of ElastiCache Multi-AZ, which is specifically designed to handle patching and failures with minimal downtime.

How to eliminate wrong answers

Option A is wrong because increasing the node type only improves capacity and performance, not availability; it does not address downtime during patching, as the single node still experiences an outage during maintenance. Option B is wrong because a blue/green deployment for Redis would require manual endpoint switching and data synchronization, which is complex and introduces potential data loss or inconsistency; ElastiCache's built-in Multi-AZ failover is simpler and more reliable for patching. Option D is wrong because a single-node cluster in one Availability Zone has no redundancy; patching or any failure causes complete downtime, and snapshots only aid recovery, not high availability.

Full explanation →
517
MCQhard

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

A.Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.
B.Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.
C.Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.
D.Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.
AnswerD

This option combines StackSets' automatic drift detection and remediation to correct any drift across all accounts, along with an SCP to deny unauthorized VPC modifications. This ensures consistent configuration and prevents manual changes, making it the most efficient and secure solution.

Why this answer

The most efficient and secure solution because it uses StackSets drift detection with automatic remediation to continuously detect and correct any deviations from the intended VPC configuration across all accounts. Additionally, applying an SCP that denies VPC-related actions (e.g., ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute) unless performed by the StackSet's service role prevents unauthorized changes at the organization level. Option A is reactive and does not prevent drift; Option B requires manual provisioning and does not enforce consistent configuration automatically; Option C requires custom coding (Lambda function) and is less integrated than StackSets' built-in remediation.

Full explanation →
518
MCQeasy

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

A.Traffic is distributed evenly across the two availability zones.
B.Instances in us-east-1a receive 67% of traffic, us-east-1b receives 33%.
C.Each instance receives an equal share of traffic.
D.Traffic is sent to the instance with the least outstanding requests.
AnswerC

Cross-zone load balancing distributes traffic evenly across all instances.

Why this answer

With cross-zone load balancing enabled on an Application Load Balancer, traffic is distributed evenly across all registered targets regardless of the availability zone they reside in. Since there are three EC2 instances, each instance receives an equal share (33.3%) of the incoming traffic, ensuring balanced load across all instances.

Exam trap

The trap here is that candidates often confuse cross-zone load balancing with zone-level distribution, mistakenly thinking traffic is split by availability zone count rather than by individual instance count, or they incorrectly attribute the least outstanding requests algorithm to the Application Load Balancer.

How to eliminate wrong answers

Option A is wrong because cross-zone load balancing distributes traffic evenly across instances, not across availability zones; the ALB does not balance by zone when cross-zone is enabled. Option B is wrong because it incorrectly assumes a zone-based distribution proportional to instance count (2 instances in us-east-1a, 1 in us-east-1b), but cross-zone load balancing overrides zone-level weighting to give each instance an equal share. Option D is wrong because the Application Load Balancer uses a round-robin algorithm by default, not least outstanding requests; the least outstanding requests routing algorithm is used by the Network Load Balancer, not the ALB.

Full explanation →
519
Multi-Selectmedium

A company is migrating a large number of files from on-premises to Amazon S3. The files are in a network-attached storage (NAS) system with a 1 Gbps connection to the internet. The company has a 2-week deadline to complete the migration. Which TWO services should the company use to accelerate the migration? (Choose TWO.)

Select 2 answers
A.AWS DataSync
B.AWS Transfer Family
C.AWS Snowball Edge
D.AWS Database Migration Service
E.AWS Direct Connect
AnswersA, C

DataSync can accelerate online transfers over the network.

Why this answer

(AWS DataSync) is correct because it can accelerate online transfers using parallel multi-threading and compression, making it suitable for migrating large numbers of files over a 1 Gbps connection within 2 weeks. Option C (AWS Snowball Edge) is correct because it provides a physical storage device that can handle large data volumes offline, bypassing network bandwidth limitations. Option B (AWS Transfer Family) is incorrect as it is designed for managed file transfer protocols, not for accelerating bulk migration.

Option D (AWS Database Migration Service) is incorrect because it is intended for database migrations, not file migrations. Option E (AWS Direct Connect) is incorrect because it requires provisioning a dedicated connection, which may take longer than 2 weeks to set up and does not directly provide data migration acceleration.

Full explanation →
520
MCQhard

A security engineer created the S3 bucket policy shown in the exhibit. The policy is intended to allow the role MyAppRole to get objects only if they are encrypted with SSE-S3. However, the role is getting access denied errors when trying to get objects that are encrypted with SSE-S3. What is the most likely cause?

A.The Principal is incorrect; it should be the role name, not ARN.
B.The Resource ARN is incorrect; it should be 'arn:aws:s3:::my-bucket'.
C.The condition key is misspelled.
D.The condition key 's3:x-amz-server-side-encryption' checks the request header, not the object's encryption state.
AnswerD

The condition evaluates the request header, which may not be set when getting an already encrypted object.

Why this answer

The condition key `s3:x-amz-server-side-encryption` evaluates the `x-amz-server-side-encryption` request header sent by the client during the GET request, not the encryption state of the object stored in S3. Since the role is making GET requests without this header (or with a different value), the condition fails even though the object is encrypted with SSE-S3. To enforce that only objects encrypted with SSE-S3 can be retrieved, you must use a different approach, such as a bucket policy with `s3:ExistingObjectTag` or a pre-signed URL that includes the required header.

Exam trap

The trap here is that candidates assume `s3:x-amz-server-side-encryption` evaluates the object's stored encryption state, when in fact it only evaluates the request header, leading to a false sense of security and access denied errors when the header is missing.

How to eliminate wrong answers

Option A is wrong because the Principal field in an S3 bucket policy can accept an IAM role ARN (e.g., `arn:aws:iam::123456789012:role/MyAppRole`) and is syntactically correct; using the role name alone would be invalid. Option B is wrong because the Resource ARN `arn:aws:s3:::my-bucket/*` correctly specifies all objects within the bucket, and changing it to `arn:aws:s3:::my-bucket` would apply to the bucket itself, not its objects, which would not match the `s3:GetObject` action. Option C is wrong because the condition key `s3:x-amz-server-side-encryption` is spelled correctly; the issue is not a typo but a fundamental misunderstanding of what the key evaluates.

Full explanation →
521
Multi-Selecteasy

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which TWO components are required?

Select 2 answers
A.AWS Cloud Map
B.Network Load Balancer (NLB)
C.Amazon ECS Service Connect
D.Amazon Route 53
E.Application Load Balancer (ALB)
AnswersA, D

AWS Cloud Map is a managed service for service discovery, allowing services to register with DNS names and health checks.

Why this answer

Only AWS Cloud Map (A) and Amazon Route 53 (D) are required for DNS-based service discovery. AWS Cloud Map allows services to register with DNS names and health checks, while Route 53 can be configured with private hosted zones to resolve those DNS names within the VPC. An Application Load Balancer (E) is not required because service discovery can be achieved solely through Cloud Map and Route 53 without any load balancer.

ECS Service Connect (C) and Network Load Balancer (B) are also not required for basic DNS-based service discovery.

Exam trap

Candidates often assume an ALB is needed for service discovery due to its DNS name, but Cloud Map and Route 53 alone provide DNS-based discovery without a load balancer.

Full explanation →
522
Multi-Selecteasy

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

Select 3 answers
A.Launch EC2 instances in an Auto Scaling group across multiple Availability Zones.
B.Use a larger EC2 instance type to handle failures.
C.Configure health checks on the ALB target group to automatically replace unhealthy instances.
D.Configure the ALB to route traffic to instances in multiple Availability Zones.
E.Use a single Availability Zone to reduce latency.
AnswersA, C, D

Provides fault tolerance across AZs.

Why this answer

Launching EC2 instances in an Auto Scaling group across multiple Availability Zones ensures that the application can withstand the failure of an entire Availability Zone. The Auto Scaling group automatically maintains the desired instance count across the specified zones, providing fault tolerance and high availability.

Exam trap

The trap here is that candidates often confuse vertical scaling (larger instances) with horizontal scaling and fault tolerance, or mistakenly think that using a single Availability Zone can be compensated by other means, ignoring the fundamental requirement for multi-AZ deployment.

Full explanation →
523
MCQhard

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

A.Use a service control policy (SCP) to enforce the creation of the role.
B.Manually create the same IAM role in each account with a trust policy pointing to the security account.
C.Use IAM groups in the security account and grant permissions to the groups.
D.Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.
AnswerD

StackSets automate deployment across accounts and trusted access simplifies cross-account roles.

Why this answer

AWS CloudFormation StackSets allows you to deploy the same IAM role across multiple accounts in an AWS Organization in a single, automated operation. By enabling trusted access with AWS Organizations, the role can be centrally managed and automatically deployed to new accounts as they are added, ensuring the solution scales without manual intervention.

Exam trap

The trap here is that candidates may think SCPs can enforce resource creation (Option A) or that IAM groups can be used for cross-account access (Option C), but SCPs only deny or allow actions and IAM groups are account-scoped, not cross-account.

How to eliminate wrong answers

Option A is wrong because a service control policy (SCP) can only restrict permissions, not enforce the creation of a specific IAM role; SCPs cannot create resources. Option B is wrong because manually creating the same IAM role in each account does not scale to hundreds of accounts and introduces human error and maintenance overhead. Option C is wrong because IAM groups exist only within a single account and cannot grant cross-account access; cross-account access requires IAM roles with trust policies, not groups.

Full explanation →
524
Multi-Selecthard

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Select 3 answers
A.Allow each team to create their own VPCs and use VPC Peering to connect them.
B.Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.
C.Create a dedicated network account and use AWS Resource Access Manager to share subnets with other accounts.
D.Use AWS CloudFormation StackSets to deploy identical VPCs to each account.
E.Use AWS Firewall Manager to apply common security group rules across all accounts.
AnswersB, C, E

This allows central inspection and control of traffic between VPCs.

Why this answer

Deploying a centralized inspection VPC with AWS Network Firewall and using Transit Gateway to route traffic allows the company to centralize network administration and enforce common security rules across all VPCs. Transit Gateway acts as a hub for inter-VPC and on-premises connectivity, while AWS Network Firewall provides stateful inspection and filtering for all traffic passing through the hub, meeting the requirement for a common set of security rules.

Exam trap

The trap here is that candidates may confuse AWS CloudFormation StackSets (which only automates resource deployment) with centralized security enforcement, overlooking the need for a hub-and-spoke architecture with a centralized inspection point like AWS Network Firewall and Transit Gateway.

Full explanation →
525
MCQhard

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. Recently, a deployment failed because the new task definition referenced an ECR image that did not exist. The team wants to prevent this type of failure in the future. Which action should be taken?

A.Configure ECR scan on push to verify image integrity.
B.Add an ECR lifecycle policy to expire old images.
C.Add a validation step in CodePipeline to run a task definition dry-run.
D.Enable AWS CloudTrail to log ECR API calls.
AnswerC

Dry-run validates that the image exists and the task definition is valid before deployment.

Why this answer

Adding a validation step in CodePipeline that runs a task definition dry-run can verify the referenced ECR image exists before deployment, preventing failures. Option A is wrong because ECR scan on push only checks for vulnerabilities, not image existence. Option B is wrong because ECR lifecycle policies manage image retention, not validation.

Option D is wrong because CloudTrail logs API calls but does not prevent deployment failures.

Full explanation →
Page 6

Page 7 of 23

Page 8

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →