Knowledge + Practice

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 526–600

1660 questions total · 23pages · All types, answers revealed

Take a mock exam Exam hub

Page 8 of 23

526

MCQhard

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

A.Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.

B.Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

C.Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

D.Use AWS Config rules to detect non-compliant instances and automatically terminate them.

AnswerA

Preventive at the API level and works for CloudFormation deployments.

Why this answer

SCPs provide preventive, account-level enforcement that blocks unauthorized EC2 instance launches before they occur, while CloudFormation hooks add a second layer of preventive control at the infrastructure-as-code level. This combination is the most scalable for 500+ accounts because SCPs are applied centrally via AWS Organizations and CloudFormation hooks operate at deployment time, ensuring no non-compliant instance is ever created.

Exam trap

The trap here is that candidates often choose reactive options like AWS Config or Lambda-based termination because they seem simpler, but the question asks for the 'MOST scalable and effective enforcement,' which requires preventive controls (SCPs and CloudFormation hooks) that block non-compliant launches entirely, rather than cleaning up after the fact.

How to eliminate wrong answers

Option B is wrong because CloudTrail-triggered Lambda is a reactive, post-launch mechanism that incurs cost and latency, and it cannot prevent the initial creation of non-compliant instances, making it less effective than preventive controls. Option C is wrong because Systems Manager scanning and tagging is purely detective and does not enforce compliance; it only identifies non-compliant instances after they exist, without any automatic remediation or prevention. Option D is wrong because AWS Config rules are detective and can trigger auto-remediation (e.g., termination), but they are reactive and may allow non-compliant instances to run for a period, whereas SCPs and CloudFormation hooks block the action at the point of request.

Full explanation →

527

MCQmedium

A company is designing a new serverless application using AWS Lambda to process high-resolution images uploaded to Amazon S3. Each image can be up to 500 MB. The processing must complete within 5 minutes. What is the MOST cost-effective and scalable design to meet these requirements?

A.Use S3 event notifications to send the image to an Amazon SQS queue, then process it with a Lambda function.

B.Use AWS Fargate to run a containerized image processing service triggered by S3 event notifications.

C.Configure S3 event notifications to invoke a Lambda function that processes the image in memory and writes the result to another S3 bucket.

D.Use AWS Step Functions to orchestrate a Lambda function and an EC2 instance for processing.

AnswerC

Lambda can handle up to 10 GB of memory and 15-minute timeout, suitable for 500 MB images. Direct S3 trigger is simple and cost-effective.

Why this answer

Lambda can directly process images up to 500 MB within its 15-minute timeout (5 minutes is well within limits), and processing in memory avoids the latency and cost of intermediate storage or compute. S3 event notifications invoke Lambda synchronously, making this the most cost-effective and scalable design for serverless image processing.

Exam trap

The trap here is that candidates assume Lambda cannot handle large files or long-running tasks, leading them to choose more complex and costly options like SQS, Fargate, or EC2, when in fact Lambda's 15-minute timeout and S3 GetObject support easily accommodate 500 MB images processed within 5 minutes.

How to eliminate wrong answers

Option A is wrong because adding an SQS queue introduces unnecessary latency and cost without benefit, as Lambda can be invoked directly by S3 events and the 500 MB payload exceeds SQS's 256 KB message size limit, requiring S3 presigned URLs or separate metadata handling. Option B is wrong because AWS Fargate is a container-based compute service that incurs higher cost and operational overhead compared to Lambda for this use case, and it does not natively integrate with S3 events without additional components like EventBridge or SQS. Option D is wrong because using Step Functions to orchestrate a Lambda function and an EC2 instance adds complexity and cost, and EC2 requires manual scaling and management, which is less cost-effective and scalable than a pure serverless approach.

Full explanation →

528

Multi-Selectmedium

Which TWO AWS services can be used to implement a centralized logging solution across multiple AWS accounts?

Select 2 answers

A.Amazon CloudWatch Logs with cross-account log groups.

B.Amazon SQS.

C.Amazon S3 with a centralized bucket and appropriate bucket policies.

D.AWS CloudFormation.

E.Amazon Kinesis Data Firehose.

AnswersA, C

CloudWatch Logs can aggregate logs from multiple accounts.

Why this answer

Amazon CloudWatch Logs supports cross-account log groups, allowing you to stream log data from multiple AWS accounts into a centralized CloudWatch Logs account. This is achieved by configuring destination policies and subscription filters that forward log events across accounts, enabling unified monitoring and alerting without needing to aggregate logs into a single bucket.

Exam trap

The trap here is that candidates may think Amazon S3 alone is insufficient for centralized logging, but with proper bucket policies and cross-account permissions, it is a valid and commonly used solution, while Amazon Kinesis Data Firehose is often mistakenly chosen because it handles streaming data, but it is not a logging destination itself.

Full explanation →

529

MCQeasy

A company is designing a cost-effective solution to store and serve large media files (e.g., videos) to users globally. The files are frequently accessed initially but become rarely accessed after 30 days. The company needs millisecond retrieval for the first 30 days and can tolerate retrieval times of minutes after that. What storage solution should the company use?

A.Amazon S3 Standard for all files, with lifecycle policy to delete after 30 days.

B.Amazon S3 Standard-IA for first 30 days, then transition to S3 Glacier Flexible Retrieval.

C.Amazon S3 Intelligent-Tiering with automatic tiering.

D.Amazon S3 Glacier Instant Retrieval for all files.

AnswerB

Standard-IA provides low cost with millisecond retrieval; Glacier is cheap for archival.

Why this answer

S3 Standard-IA is cost-effective for infrequent access but still provides millisecond retrieval for the first 30 days, and transition to Glacier after 30 days. Option A is too expensive. Option C provides millisecond retrieval but is expensive.

Option D is for archival only.

Full explanation →

530

MCQeasy

A company is migrating workloads to AWS using AWS Application Migration Service (AWS MGN). The source servers are running on VMware vSphere. After installing the AWS Replication Agent on the source servers, the migration waves are set up. However, during a test cutover, the test instance fails to launch with an error 'Insufficient IP address space in the target VPC'. What is the most likely cause?

A.The replication settings specify a subnet with an incorrect CIDR block

B.The IAM role for AWS MGN does not have permissions to create network interfaces

C.The target VPC subnet does not have enough available IP addresses

D.The AWS MGN service is not enabled in the target AWS Region

AnswerC

The test instance requires an available IP in the target subnet; insufficient IPs cause launch failure.

Why this answer

The error 'Insufficient IP address space in the target VPC' indicates that the subnet used for test instances does not have enough available IP addresses to launch the instance. AWS MGN allocates IP addresses from the specified subnet during instance launch. Option A is incorrect because a CIDR mismatch would cause a different error, typically related to subnet configuration.

Option B is incorrect because IAM permission issues would result in an access denied error, not an IP space error. Option D is incorrect because the service not being enabled would produce a different error (e.g., service not available). Therefore, the most likely cause is insufficient available IP addresses in the target VPC subnet.

Full explanation →

531

MCQhard

A company is migrating a legacy PHP application running on a single on-premises server to AWS. The application stores session data locally on the server's filesystem. The company wants to achieve high availability and elasticity for the application on AWS. What should the company do to handle session state in the new architecture?

A.Configure an Application Load Balancer with sticky sessions enabled

B.Store session data in Amazon ElastiCache for Redis

C.Use Amazon EFS to share the session files across multiple EC2 instances

D.Refactor the application to use Amazon Cognito for session management

AnswerB

Correct. ElastiCache provides a centralized, fast session store for distributed applications.

Why this answer

Using ElastiCache for session storage decouples session state from individual servers, allowing the application to scale horizontally. Sticky sessions with an ALB ties a user to a specific instance, which reduces availability if that instance fails. Storing sessions on EFS is possible but slower than ElastiCache.

Re-architecting to use Cognito is unnecessary for session state.

Full explanation →

532

MCQeasy

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to be notified immediately if any instance fails a status check. What is the simplest solution?

A.Configure an ELB health check and monitor the unhealthy host count.

B.Use AWS Systems Manager Automation to check instance status periodically.

C.Create a CloudWatch alarm on the StatusCheckFailed metric with an SNS action.

D.Enable AWS CloudTrail and create a metric filter for EC2 instance failures.

AnswerC

StatusCheckFailed metric is available and can trigger alarms.

Why this answer

CloudWatch can monitor the EC2 StatusCheckFailed metric and trigger an SNS notification when an instance fails a status check. This is the simplest solution because it uses built-in metrics and requires no custom scripting. Option A uses ELB health checks which monitor load balancer target health, not instance status checks.

Option B uses Systems Manager Automation which is not real-time. Option D uses CloudTrail which logs API calls, not status checks.

Full explanation →

533

MCQmedium

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

A.The function is experiencing cold starts due to high concurrency.

B.The function is hitting the maximum concurrent execution limit.

C.The function needs to be attached to a public subnet.

D.The function does not have a NAT gateway or VPC endpoints to access external resources.

AnswerD

Lambda in a VPC needs a route to the internet for external calls, otherwise requests hang.

Why this answer

The most likely cause of the timeout is that the Lambda function is attached to a VPC but does not have a NAT gateway or VPC endpoints to access external resources (Option D). When a Lambda function is configured to run in a VPC, it loses default internet access. To access external services (such as an external database or API), the function needs a NAT gateway in a public subnet or VPC endpoints for the specific services.

Without this, the function will timeout when trying to reach external resources. Option A is incorrect because cold starts cause latency but not consistent timeouts. Option B is incorrect because hitting the concurrent execution limit would cause throttling (HTTP 429 or 500 errors), not timeouts.

Option C is incorrect because attaching to a public subnet would not help; Lambda functions cannot have public IPs in a VPC by default, and a public subnet does not provide internet access without an internet gateway and route table updates.

Full explanation →

534

MCQhard

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

A.Use a NAT instance to perform SSL termination and redirect.

B.Install the certificate on each EC2 instance and configure the web server to redirect HTTP to HTTPS.

C.Configure the environment’s load balancer to listen on port 443 with the ACM certificate and port 80 with a redirect rule.

D.Deploy a CloudFront distribution with the ACM certificate and redirect HTTP to HTTPS at the distribution level.

AnswerC

The load balancer can terminate HTTPS and redirect HTTP to HTTPS.

Why this answer

Elastic Beanstalk environments using a load balancer (ALB or CLB) can be configured to listen on port 443 with the ACM certificate for HTTPS termination, and simultaneously define a listener on port 80 with a redirect action that sends HTTP traffic to HTTPS. This is the simplest and most scalable approach, as it offloads SSL termination and redirection to the load balancer, eliminating the need to manage certificates or redirection logic on individual instances.

Exam trap

The trap here is that candidates often assume SSL termination must happen on the EC2 instances (Option B) or that a separate service like CloudFront (Option D) is required, when in fact the Elastic Beanstalk load balancer can natively handle both HTTPS termination and HTTP-to-HTTPS redirection with minimal configuration.

How to eliminate wrong answers

Option A is wrong because a NAT instance is used for outbound traffic from private subnets, not for SSL termination or HTTP-to-HTTPS redirection; it does not support load balancing or certificate management. Option B is wrong because installing the certificate on each EC2 instance and configuring the web server to redirect HTTP to HTTPS is inefficient, requires manual certificate renewal, and does not leverage Elastic Beanstalk's managed load balancer for centralized SSL termination. Option D is wrong because while CloudFront can redirect HTTP to HTTPS, it adds unnecessary complexity and cost for a simple single-region web app; the question specifically asks about configuring the Elastic Beanstalk environment, not an external CDN.

Full explanation →

535

Multi-Selecthard

A company has multiple AWS accounts and wants to ensure that all resources are tagged with a cost center tag. Which THREE steps should they take to enforce this?

Select 3 answers

A.Use AWS Organizations to define a tag policy that mandates the cost center tag.

B.Use AWS Config rules to detect untagged resources and trigger a Lambda function to add the tag.

C.Use AWS CloudFormation templates that enforce tagging and use StackSets to deploy across accounts.

D.Create a service control policy (SCP) that denies resource creation if the required tag is not present, for supported services.

E.Enable AWS Cost Explorer to report on untagged resources.

AnswersA, C, D

Tag policies can enforce tags on resources during creation and prevent non-compliant resource creation.

Why this answer

AWS Organizations tag policies allow you to define rules for tagging resources across accounts in your organization. By specifying the cost center tag as mandatory in a tag policy, you can enforce that all resources must have this tag, and any non-compliant resources can be reported or prevented from being created, depending on the policy's enforcement mode.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config rules) with preventive controls (like tag policies or SCPs), and may select option B thinking it enforces tagging, when it only remediates after the fact.

Full explanation →

536

MCQeasy

A company is modernizing a legacy application by breaking it into microservices. The application has a complex set of dependencies and requires gradual migration. Which design pattern should the company use?

A.Blue/Green deployment pattern

B.Saga pattern

C.Strangler Fig pattern

D.Circuit Breaker pattern

AnswerC

Strangler Fig allows gradually replacing monolith components with microservices.

Why this answer

(Strangler Fig pattern) because it allows incremental replacement of legacy system functionality with microservices, enabling gradual migration despite complex dependencies. Option A (Blue/Green deployment) is a deployment strategy, not a migration pattern. Option B (Saga pattern) is for managing distributed transactions, not incremental replacement.

Option D (Circuit Breaker) is a fault-tolerance pattern.

Full explanation →

537

MCQhard

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

A.Migrate the database to Amazon DynamoDB Global Tables.

B.Create one or more RDS read replicas and direct read queries to the replica endpoint.

C.Implement Amazon ElastiCache in front of the database to cache query results.

D.Increase the DB instance class to a larger size with more vCPUs.

AnswerB

Offloads reads, minimal changes.

Why this answer

The most appropriate solution is to create one or more RDS read replicas and direct read queries to the replica endpoint. Read replicas offload read traffic from the primary Multi-AZ instance, improving read latency with minimal application changes (only the read endpoint needs to be updated). Option A (DynamoDB Global Tables) would require a complete database migration and application rewrite, which is not minimal.

Option C (ElastiCache) would require application code changes to cache queries, and may not be as effective for complex joins. Option D (increasing instance size) is vertical scaling that may only provide limited improvement and does not directly address read-heavy workloads; it also incurs higher cost without truly scaling out read capacity.

Full explanation →

538

MCQeasy

A company is migrating a critical application to AWS and needs to ensure business continuity during the migration. The application must remain available with minimal downtime. Which AWS service should be used to replicate data continuously?

A.AWS Direct Connect

B.AWS Database Migration Service (DMS) with ongoing replication

C.Amazon S3 Transfer Acceleration

D.AWS Snowball Edge

AnswerB

DMS supports continuous replication to minimize downtime.

Why this answer

AWS Database Migration Service (DMS) with ongoing replication can keep source and target databases in sync, allowing for minimal downtime during migration. Option A is wrong because AWS Direct Connect provides a dedicated network connection, not a replication service. Option C is wrong because Amazon S3 Transfer Acceleration is for faster uploads to S3, not for database replication.

Option D is wrong because AWS Snowball Edge is an offline data transfer device, not a continuous replication tool.

Full explanation →

539

MCQmedium

A company has a multi-account AWS environment with a central logging account. All VPC Flow Logs are published to a central S3 bucket in the logging account. The security team needs to analyze these logs using Amazon Athena, but they want to minimize costs by reducing the amount of data scanned. Which partitioning strategy is MOST effective?

A.Partition by region and date.

B.Partition by account ID only.

C.Partition by account ID and region.

D.Partition by date and account ID.

AnswerD

Common queries filter by date range and account, so this minimizes scanned data.

Why this answer

Partitioning by date and account ID is most effective because the security team's queries will typically filter by time range and specific accounts. This minimizes data scanned by Athena, which charges per query based on the amount of data read. Partitioning by date first leverages natural time-based access patterns, while account ID further narrows scans when investigating incidents in specific accounts.

Exam trap

The trap here is that candidates often choose region-based partitioning (Option A or C) thinking it's important for geographic filtering, but in a multi-account logging scenario, account-level filtering is more frequent and cost-effective than region-level partitioning.

How to eliminate wrong answers

Option A is wrong because partitioning by region and date ignores the account ID, which is a primary filter for multi-account environments; queries for a specific account would still scan all regions' data for that date. Option B is wrong because partitioning by account ID only lacks a date partition, forcing Athena to scan all historical data for an account even when querying a specific time range. Option C is wrong because partitioning by account ID and region still misses the date partition, so queries filtered by time would scan all dates, increasing cost.

Full explanation →

540

MCQmedium

A company uses Amazon DynamoDB as a data store for a mobile application. The application experiences throttling errors during peak hours. The table has a provisioned read capacity of 5000 RCUs and write capacity of 2000 WCUs. The throttling is on writes. What is the MOST cost-effective solution?

A.Enable DynamoDB Accelerator (DAX) to offload writes.

B.Switch to on-demand capacity mode.

C.Increase write capacity to 4000 WCUs.

D.Enable auto scaling for DynamoDB write capacity.

AnswerD

Auto scaling adjusts capacity based on traffic, reducing throttling and cost.

Why this answer

DynamoDB Accelerator (DAX) is a read cache, not for writes. The most cost-effective solution is to use DynamoDB auto scaling for writes to handle peak loads without over-provisioning.

Full explanation →

541

Multi-Selectmedium

A company uses AWS Organizations and wants to implement a least-privilege model for IAM roles. The security team needs to ensure that no IAM role can be created without an approval workflow. Which THREE steps should the company take?

Select 3 answers

A.Create an AWS Lambda function that is triggered by CloudTrail events to automatically tag approved roles.

B.Use a service control policy (SCP) to deny iam:CreateRole unless a specific tag (e.g., 'Approved') is present.

C.Use AWS CloudFormation StackSets to deploy IAM roles across accounts.

D.Enable AWS CloudTrail to log all IAM role creation events.

E.Use AWS Config rules to detect roles without the 'Approved' tag and mark them as non-compliant.

AnswersA, B, E

Automates tagging after approval.

Why this answer

An AWS Lambda function triggered by CloudTrail events can automatically tag newly created IAM roles with an 'Approved' tag as part of an approval workflow. This ensures that only roles that have gone through the approval process receive the required tag, enabling downstream enforcement via SCPs or AWS Config.

Exam trap

The trap here is that candidates often confuse auditing (CloudTrail) with enforcement, or assume that deployment automation (CloudFormation StackSets) inherently includes approval workflows, when in fact neither provides the required preventive control.

Full explanation →

542

MCQeasy

A company needs to store configuration data for multiple applications in a centralized, secure, and versioned manner. The configuration must be encrypted at rest and automatically rotated. Which AWS service should they use?

A.AWS CloudFormation

B.AWS Secrets Manager

C.AWS AppConfig

D.AWS Systems Manager Parameter Store

AnswerC

AppConfig supports versioned configuration, encryption, and automatic rotation.

Why this answer

AWS AppConfig supports versioned configuration, encryption at rest, and automatic rotation. Option A (AWS CloudFormation) is for infrastructure as code, not for storing application configuration. Option B (AWS Secrets Manager) is designed for managing secrets (e.g., passwords, API keys), not general configuration data.

Option D (AWS Systems Manager Parameter Store) can store configuration but does not support automatic rotation of configuration values.

Full explanation →

543

MCQeasy

A company uses AWS CloudFormation to deploy infrastructure. A Solutions Architect needs to update a stack that includes an RDS DB instance. The update requires modifying the DB instance's storage type from gp2 to io1. What change should be made to the CloudFormation template to minimize downtime?

A.Modify the StorageType property in the CloudFormation template and perform a stack update.

B.Add an UpdateReplacePolicy attribute to the RDS resource.

C.Create a new stack with the updated storage type and migrate data.

D.Set the DeletionPolicy to Retain for the RDS resource.

AnswerA

Changing StorageType from gp2 to io1 is a supported modification that can be done without replacement, minimizing downtime.

Why this answer

Modifying the StorageType property of an RDS DB instance (e.g., from gp2 to io1) can be done without replacing the resource. When the CloudFormation stack is updated with this change, AWS performs an in-place modification that typically causes only a brief downtime (a few minutes). This is the standard approach to minimize downtime.

Option B is incorrect because UpdateReplacePolicy is not a valid CloudFormation attribute; the correct attribute is UpdatePolicy, but it does not apply to RDS storage type changes. Option C is incorrect because creating a new stack and migrating data would cause significantly more downtime and effort. Option D is incorrect because DeletionPolicy controls what happens when a resource is deleted from the stack, not during an update.

Full explanation →

544

Multi-Selecthard

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Select 3 answers

A.Manually create and copy AMIs to the secondary region weekly

B.Create a CloudFormation template to provision the infrastructure in the secondary region

C.Use AWS Backup to automate cross-region EBS snapshot copies

D.Enable cross-region replication on the Amazon S3 buckets containing application data

E.Configure the EC2 instances in a Multi-AZ Auto Scaling group

AnswersB, C, D

CloudFormation allows rapid deployment of infrastructure in the DR region.

Why this answer

AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Exam trap

The trap here is that candidates often confuse Multi-AZ (which provides high availability within a single Region) with cross-region disaster recovery, leading them to incorrectly select Option E despite it not addressing regional isolation.

Full explanation →

545

MCQeasy

Refer to the exhibit. A company deploys this CloudFormation template. After deployment, they enable S3 Transfer Acceleration on the bucket. Later, they update the stack. What happens to the Transfer Acceleration setting?

A.CloudFormation enables Transfer Acceleration because it is a best practice.

B.The update fails because of a conflict between the template and the manual change.

C.CloudFormation removes the Transfer Acceleration setting because it is not defined in the template.

D.The Transfer Acceleration setting remains unchanged after the update.

AnswerD

Manual changes persist unless the template manages that property.

Why this answer

CloudFormation drift detection does not automatically revert manual changes. The Transfer Acceleration setting is a property of the bucket; if not defined in the template, CloudFormation may not manage it, but typically manual changes are not overwritten unless the template explicitly defines them. However, best practice is to define all settings in the template to avoid drift.

Option A is wrong because CloudFormation does not automatically disable it. Option B is wrong because CloudFormation does not automatically enable it. Option C is wrong because updates do not reset to default.

Full explanation →

546

MCQmedium

A company has a production AWS Lambda function that processes orders. The function's execution time has increased, causing timeouts. The team wants to troubleshoot without affecting production traffic. What should they do?

A.Enable detailed CloudWatch Logs for the production function and analyze them.

B.Create a new Lambda function with a different name to test the code changes.

C.Use a Lambda alias to route a percentage of traffic to a new version with increased timeout.

D.Increase the timeout of the production Lambda function temporarily.

AnswerB

A separate function isolates testing from production.

Why this answer

Creating a separate Lambda function with the same code but a different name allows testing and debugging without impacting the production function. Option A is wrong because version aliases can route traffic but still affect production. Option C is wrong because CloudWatch Logs will show the production function's logs.

Option D is wrong because changing the timeout directly on the production function could break the SLA.

Full explanation →

547

MCQmedium

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

A.Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

B.Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

C.Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.

D.Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

AnswerC

Automated solution reduces operational overhead.

Why this answer

The AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Exam trap

The trap here is that candidates often overestimate the simplicity of manual cross-account log delivery (Option A) or confuse AWS Glue's cataloging capabilities with log collection, while underestimating the operational overhead of building and maintaining such a solution from scratch versus using a purpose-built, managed solution like AWS Centralized Logging with OpenSearch Service.

How to eliminate wrong answers

Option A is wrong because while cross-account permissions can send logs to a central bucket, this approach requires manually configuring each account's log delivery (e.g., VPC Flow Logs, CloudTrail, DNS logs) and managing cross-account KMS key policies, which introduces significant operational overhead and does not provide a centralized, automated solution. Option B is wrong because creating separate S3 buckets for each log type and using AWS Glue to crawl and catalog logs adds unnecessary complexity and cost; Glue is for data cataloging and ETL, not for log collection or cross-account aggregation, and this approach does not address the requirement to capture logs from multiple accounts. Option D is wrong because S3 default encryption uses SSE-S3, not a customer-managed KMS key, and S3 Cross-Region Replication only replicates objects after they are stored, it does not capture logs from multiple accounts or handle the initial log delivery from various AWS services.

Full explanation →

548

MCQmedium

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

A.Use AWS Config conformance packs to deploy rules across accounts.

B.Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

C.Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.

D.Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

AnswerC

StackSets automatically deploy stacks to specified accounts and regions, including new accounts added to the organization.

Why this answer

AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Exam trap

The trap here is that candidates often confuse AWS Config conformance packs (which only handle Config rules) with the broader infrastructure deployment capability of CloudFormation StackSets, leading them to choose Option A even though it cannot deploy CloudTrail trails.

How to eliminate wrong answers

Option A is wrong because AWS Config conformance packs only deploy AWS Config rules and remediation actions, but they cannot deploy an AWS CloudTrail trail, which is a separate service requiring a stack or custom resource. Option B is wrong because using Lambda functions triggered by CloudTrail events to create stacks introduces additional complexity, latency, and potential failure points compared to the native StackSets automatic deployment feature; it also requires managing Lambda code, IAM roles, and event rules. Option D is wrong because AWS Service Catalog portfolios require users to manually launch products from the portfolio; they do not automatically deploy stacks to new accounts, so this would not meet the requirement for automatic enforcement.

Full explanation →

549

MCQmedium

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

A.Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.

B.Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

C.Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

D.Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

AnswerA

Correct: StackSets automate deployment across accounts; the resource creates the detector.

Why this answer

AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Exam trap

The trap here is that candidates often choose the Config + Lambda option (D) thinking it is fully automated, but they overlook that it is reactive and incurs ongoing evaluation costs, whereas StackSets provide a proactive, single-deployment solution with lower operational overhead.

How to eliminate wrong answers

Option B is wrong because AWS Service Catalog requires account owners to manually launch the product, which does not meet the requirement for automatic enabling and adds operational overhead. Option C is wrong because an SCP that denies delete and update actions does not enable GuardDuty; it only prevents modifications after manual enabling, which still requires manual action per account. Option D is wrong because AWS Config rules and Lambda functions are reactive (detect and remediate after the fact) and incur additional complexity and cost compared to a proactive, declarative StackSets deployment.

Full explanation →

550

MCQeasy

A company has deployed a web application behind an Application Load Balancer (ALB) with an Auto Scaling group. Users report that the application is slow during peak hours. The CPU utilization of the EC2 instances is consistently below 40%, but the ALB's request count per target is high. Which action would MOST improve performance?

A.Increase the instance size (e.g., from t3.medium to t3.large)

B.Increase the desired capacity of the Auto Scaling group

C.Configure the Auto Scaling group to scale based on CPU utilization

D.Change the ALB routing algorithm to least outstanding requests

AnswerB

Adding more instances reduces request count per target.

Why this answer

High request count per target with low CPU utilization suggests the application is I/O bound or waiting on external calls. Adding more instances by increasing the desired capacity distributes the load across more targets, reducing queueing and improving performance. Option A is wrong because the bottleneck is not CPU, so increasing instance size is unlikely to help.

Option C is wrong because scaling based on CPU utilization would not trigger since CPU is low. Option D is wrong because changing the ALB routing algorithm to least outstanding requests might help distribute load more evenly but does not add capacity; increasing desired capacity directly addresses the high request count per target.

Full explanation →

551

MCQmedium

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

A.Enable AWS Cost Explorer and use default groupings

B.Create AWS Budgets for each department

C.Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags

D.Use the consolidated billing feature to view costs per account

AnswerC

Tags enable granular cost tracking by department.

Why this answer

Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Exam trap

The trap here is that candidates often confuse the account-level aggregation of consolidated billing (Option D) with the resource-level granularity needed for department tracking, or they assume AWS Budgets (Option B) provide visibility rather than just alerts.

How to eliminate wrong answers

Option A is wrong because AWS Cost Explorer's default groupings (e.g., by service or linked account) do not provide department-level granularity unless custom tags or cost categories are used; relying on default groupings alone cannot break down costs by department. Option B is wrong because AWS Budgets are used to set spending thresholds and send alerts, not to provide granular visibility into historical or current cost breakdowns by department; they are a cost control mechanism, not a reporting or analysis tool. Option D is wrong because the consolidated billing feature aggregates costs at the account level, not at the department level; it cannot distinguish costs for resources within a single account that belong to different departments.

Full explanation →

552

MCQhard

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

A.The application is not using the VPC endpoint

B.The bucket policy does not allow encryption in transit

C.The application is using HTTP instead of HTTPS

D.The application is missing the required x-amz-server-side-encryption header

AnswerC

The Deny statement blocks requests without SecureTransport, i.e., HTTP. The application may be using HTTP.

Why this answer

The bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Exam trap

The trap here is that candidates often confuse encryption in transit (HTTPS) with encryption at rest (SSE headers) or assume that using a VPC Gateway Endpoint automatically secures the connection, when in fact the bucket policy's `aws:SecureTransport` condition independently enforces HTTPS.

How to eliminate wrong answers

Option A is wrong because the application is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678), which is explicitly specified in the bucket policy's `aws:SourceVpce` condition; the policy allows access from that endpoint, so the endpoint is being used. Option B is wrong because the bucket policy does not explicitly deny encryption in transit; rather, it likely requires it via the `aws:SecureTransport` condition, and the failure is due to using HTTP, not a lack of encryption-in-transit allowance. Option D is wrong because the `x-amz-server-side-encryption` header is for server-side encryption at rest, not for transport security; the error is about HTTPS (encryption in transit), not encryption at rest.

Full explanation →

553

Multi-Selectmedium

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Select 2 answers

A.Attach a bucket policy to each bucket that denies PutObject without encryption.

B.Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.

C.Create an IAM policy that denies s3:PutObject unless encryption is specified.

D.Enable S3 Block Public Access at the organization level.

E.Use AWS Config rules to detect S3 buckets without encryption and automatically apply encryption.

AnswersB, E

Prevents creation of unencrypted buckets.

Why this answer

A service control policy (SCP) can be applied at the organization, organizational unit (OU), or account level to deny the s3:CreateBucket action unless the request includes the x-amz-bucket-object-lock-enabled header or the bucket is created with default encryption enabled. This enforces encryption at rest for all new S3 buckets across the entire organization. Option E is correct because AWS Config rules can evaluate existing S3 buckets for encryption compliance and trigger an automatic remediation action, such as enabling default encryption via AWS Systems Manager Automation, ensuring both new and existing buckets are encrypted.

Exam trap

The trap here is that candidates often confuse SCPs with IAM policies or bucket policies, thinking they can enforce encryption on existing objects or buckets, when in fact SCPs only affect future API calls (like CreateBucket) and AWS Config is needed for ongoing compliance of existing resources.

Full explanation →

554

MCQeasy

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

A.Enable default encryption on each S3 bucket.

B.Create an IAM policy that denies s3:PutObject unless encryption headers are present.

C.Use an S3 bucket policy to deny PutObject without encryption.

D.Use AWS Config to automatically remediate noncompliant buckets.

AnswerA

Default encryption ensures all new objects are encrypted.

Why this answer

Enabling default encryption on each S3 bucket ensures that all objects uploaded to that bucket are automatically encrypted, enforcing the policy across existing and future buckets. Option B is wrong because an IAM policy that denies s3:PutObject without encryption headers only applies when the request includes encryption headers; it does not enforce encryption for all objects, and it depends on the caller including the headers. Option C is wrong because while an S3 bucket policy can deny PutObject without encryption, it requires a policy per bucket and does not automatically remediate existing buckets.

Option D is wrong because AWS Config can detect noncompliant buckets but requires a custom remediation action to enable encryption; it does not automatically enforce encryption without additional setup.

Full explanation →

555

Multi-Selectmedium

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Select 2 answers

A.Use AWS CloudFormation StackSets to deploy GuardDuty in each account

B.Enable GuardDuty manually in each member account by logging into each account

C.Create a service control policy to force GuardDuty to be enabled

D.Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization

E.Designate a member account as the GuardDuty delegated administrator

AnswersD, E

Delegated administrator can enable GuardDuty across all accounts via API.

Why this answer

AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Exam trap

The trap here is that candidates often confuse service control policies (SCPs) with proactive enforcement, but SCPs only restrict permissions and cannot automatically enable a service; they also overlook that CloudFormation StackSets cannot enable a service like GuardDuty, which requires a specific API action rather than resource deployment.

Full explanation →

556

MCQmedium

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

A.Create an IAM policy in each account that requires the CostCenter tag.

B.Use AWS Config rules to identify untagged resources and automatically tag them.

C.Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.

D.Use an SCP to deny resource creation if the CostCenter tag is missing.

AnswerC

Tag policies centrally enforce tagging rules across all accounts.

Why this answer

AWS Organizations tag policies allow you to define rules for tagging resources across all accounts in the organization, including enforcement of required tags like 'CostCenter'. Tag policies are evaluated at resource creation and can prevent non-compliant resources from being created, ensuring consistent cost allocation tagging without requiring individual account-level IAM changes.

Exam trap

The trap here is confusing SCPs with tag policies; candidates often think SCPs can enforce tag requirements on resource creation, but SCPs only deny actions based on existing tags, not enforce tag presence at creation time, whereas tag policies provide native enforcement for tag-on-create APIs.

How to eliminate wrong answers

Option A is wrong because IAM policies control permissions for users and roles, not resource creation; they cannot enforce tags on resources created by other services or by users with different permissions. Option B is wrong because AWS Config rules can detect untagged resources but cannot automatically tag them; they only trigger evaluations and can invoke remediation actions via Systems Manager Automation, but the question asks for enforcement, not detection. Option D is wrong because SCPs can deny actions based on conditions like missing tags, but they cannot require a tag on resource creation; SCPs are permission boundaries that deny API calls, but they cannot enforce tag presence at the moment of resource creation because the tag condition is evaluated after the resource exists, leading to a potential race condition.

Full explanation →

557

MCQhard

Refer to the exhibit. A company has an SCP named 'DenyOutsideRegions' attached to the root OU. The SCP is intended to deny all actions outside us-east-1 and eu-west-1. However, users in a member account are still able to launch EC2 instances in ap-southeast-1. What is the most likely reason?

A.The SCP is not applied to the root user of the member account.

B.The SCP cannot restrict actions based on region.

C.The SCP policy document does not contain a Deny statement for the regions.

D.The SCP is overridden by an Allow policy attached to the account.

AnswerC

The exhibit only shows the policy metadata, not the content.

Why this answer

The SCP policy document must explicitly include a Deny statement with a condition that restricts actions to only us-east-1 and eu-west-1. Without a Deny statement, the SCP is effectively permissive (Allow) by default, meaning it does not block actions in other regions. The SCP in the exhibit likely only has Allow statements for the two allowed regions, which does not prevent actions in ap-southeast-1.

Exam trap

The trap here is that candidates assume SCPs work like IAM policies where an explicit Allow is required, but SCPs require an explicit Deny to block actions; otherwise, they are permissive by default.

How to eliminate wrong answers

Option A is wrong because SCPs apply to all IAM users and roles in the account, including the root user, unless explicitly excluded; the root user is not exempt from SCPs. Option B is wrong because SCPs can restrict actions based on region using the 'aws:RequestedRegion' condition key in a Deny statement, so the statement that SCPs cannot restrict actions by region is false. Option D is wrong because SCPs are not overridden by Allow policies; SCPs set the maximum permissions boundary, and an Allow policy attached to an account cannot grant permissions that an SCP denies.

Full explanation →

558

Multi-Selectmedium

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Select 2 answers

A.Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.

B.Use AWS Service Catalog to enforce tagging on EC2 products.

C.Use AWS Resource Access Manager to share a tagging policy across accounts.

D.Apply a service control policy (SCP) that denies ec2:RunInstances if the required tags are not specified.

E.Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

AnswersA, D

Config rules can enforce tagging compliance.

Why this answer

AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Exam trap

The trap here is that candidates often confuse AWS Service Catalog's tagging enforcement as a global solution, not realizing it only applies to products launched through the catalog, not to direct EC2 API calls across accounts.

Full explanation →

559

Matchingmedium

Match each AWS disaster recovery strategy to its description.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Lowest cost, RPO in hours, RTO in hours to days

Core services run in standby, ready to scale

Scaled-down production environment, ready to scale up

Both sites serve traffic, failover is immediate

One site active, other on standby

Why these pairings

AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Full explanation →

560

MCQhard

A company is migrating a 10 TB SQL Server database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is running on-premises with a 1 Gbps network link to AWS. Which strategy should be used to reduce the migration downtime?

A.Use AWS Database Migration Service (DMS) with full load and ongoing replication.

B.Take a full backup of the SQL Server database, upload it to Amazon S3, and restore to Aurora.

C.Use AWS Schema Conversion Tool (SCT) to convert the schema, then export data to flat files and upload to S3.

D.Create an Amazon Aurora read replica from the on-premises database.

AnswerA

DMS supports both full load and continuous replication, minimizing cutover downtime.

Why this answer

AWS Database Migration Service (DMS) is the correct choice because it combines a full load of the existing data with ongoing replication to capture incremental changes, minimizing downtime. Option A allows the target Aurora database to stay in sync with the source SQL Server until a cutover. Option B (backup/restore) requires significant downtime to take and restore the backup, and does not support ongoing replication.

Option C (SCT) only converts the schema and exports data, missing the replication needed for minimal downtime. Option D is incorrect because an Aurora read replica can only be created from another Aurora DB instance, not from an on-premises database.

Full explanation →

561

MCQeasy

A startup is building a serverless application using AWS Lambda. They need to store session state that can be shared across multiple Lambda invocations. Which AWS service should they use?

A.Amazon ElastiCache for Redis

B.Amazon S3

C.Amazon DynamoDB

D.Amazon CloudFront

AnswerA

Provides low-latency in-memory caching for session state.

Why this answer

Amazon ElastiCache for Redis is the correct choice because it provides a low-latency, in-memory data store that can be shared across multiple Lambda invocations. Redis supports data structures like strings, hashes, and lists, making it ideal for storing session state that needs to be accessed and updated quickly by concurrent serverless functions.

Exam trap

The trap here is that candidates often choose DynamoDB because it is a common serverless database, but they overlook that the question specifically asks for shared session state across invocations, which demands in-memory caching for performance, not a persistent database.

How to eliminate wrong answers

Option B (Amazon S3) is wrong because S3 is an object storage service with higher latency and eventual consistency for read-after-write, making it unsuitable for real-time session state that requires sub-millisecond access and strong consistency. Option C (Amazon DynamoDB) is wrong because while DynamoDB can store session state, it is a NoSQL database with higher latency compared to in-memory caching, and it is not optimized for the extremely low-latency, high-throughput session lookups that ElastiCache provides. Option D (Amazon CloudFront) is wrong because CloudFront is a content delivery network (CDN) that caches static and dynamic content at edge locations, not a session store; it cannot be used to store or share mutable session state across Lambda invocations.

Full explanation →

562

MCQmedium

A company is designing a new microservices architecture on AWS. Each service needs to store and retrieve small amounts of configuration data (under 10 KB per item) with low latency. The data is accessed frequently and must be highly available across multiple Availability Zones. Which AWS service should be used?

A.Amazon S3

B.Amazon ElastiCache for Memcached

C.Amazon RDS for MySQL

D.Amazon DynamoDB

AnswerD

DynamoDB offers low latency, high availability, and is suitable for small configuration data.

Why this answer

Amazon DynamoDB is the correct choice because it is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale, making it ideal for frequently accessed configuration data under 10 KB. It provides built-in high availability and durability by automatically replicating data across three Availability Zones in an AWS Region, meeting the requirement for multi-AZ resilience without manual setup.

Exam trap

The trap here is that candidates often choose Amazon S3 for any 'storage' need without considering latency requirements, or they pick ElastiCache thinking it provides durable storage, when in fact DynamoDB is the only option that combines low latency, high availability across AZs, and native persistence for small configuration items.

How to eliminate wrong answers

Option A is wrong because Amazon S3 is an object storage service designed for larger objects (minimum 0 bytes, but optimal for >128 KB) and while it can store small items, its latency is higher (typically tens to hundreds of milliseconds) and it is not optimized for frequent, low-latency reads of sub-10 KB configuration data. Option B is wrong because Amazon ElastiCache for Memcached is an in-memory cache that does not provide native persistence or high availability across multiple Availability Zones without additional configuration (e.g., using a cluster with replication, which Memcached does not support natively); it is intended for caching, not as a durable data store for configuration. Option C is wrong because Amazon RDS for MySQL is a relational database that introduces overhead from SQL parsing, connection management, and schema design, and while it can be made multi-AZ, it is overkill for simple key-value configuration data and does not offer the single-digit millisecond latency of DynamoDB for this use case.

Full explanation →

563

MCQmedium

A company uses AWS CloudTrail to log API activity. The compliance team requires that logs be stored for 7 years and be immediately accessible for the first 90 days, after which access can take up to 12 hours. Which storage solution meets these requirements cost-effectively?

A.Store logs in Amazon S3 Standard for 90 days, then transition to Amazon S3 Glacier for the remainder.

B.Store logs in Amazon S3 One Zone-Infrequent Access for 90 days, then delete.

C.Store logs in Amazon S3 Standard for 90 days, then transition to Amazon S3 Glacier Deep Archive.

D.Store logs in Amazon S3 Standard-Infrequent Access for 90 days, then transition to Amazon S3 Standard.

AnswerC

Deep Archive offers low cost with 12-hour retrieval.

Why this answer

S3 Standard provides immediate access for the first 90 days, and then transitioning to S3 Glacier Deep Archive (retrieval time up to 12 hours) meets the 7-year retention requirement at the lowest cost. Option A is wrong: while S3 Glacier can also provide retrieval within 12 hours (via its Bulk retrieval option), S3 Glacier Deep Archive is more cost-effective for long-term archival with comparable retrieval times. Option B is wrong: S3 One Zone-Infrequent Access is not durable enough for compliance (single Availability Zone) and deleting after 90 days does not satisfy the 7-year retention requirement.

Option D is wrong: S3 Standard-Infrequent Access is for infrequent access but transitioning to S3 Standard is more expensive, and the lifecycle policy does not achieve the 7-year retention.

Exam trap

The key trap is confusing the cost and retrieval time trade-offs between S3 Glacier and S3 Glacier Deep Archive. While both can achieve up to 12 hours retrieval (Glacier via Bulk, Deep Archive via Standard retrieval), Deep Archive is significantly cheaper for long-term storage, making it the most cost-effective choice when such retrieval times are acceptable.

Full explanation →

564

MCQhard

A company is designing a new application on AWS that uses Amazon API Gateway and AWS Lambda to expose a RESTful API. The API must authenticate requests using OAuth 2.0 with an external identity provider (IdP). The company wants to offload the authentication logic to the API Gateway. Which API Gateway feature should they use?

A.Use API Gateway's WebSocket API.

B.Enable API Gateway's VPC Link.

C.Configure a Lambda authorizer to validate the OAuth 2.0 token.

D.Use usage plans with API keys.

AnswerC

Lambda authorizer can call the IdP to validate tokens and return an IAM policy.

Why this answer

A Lambda authorizer (formerly known as a custom authorizer) allows API Gateway to call a Lambda function that validates the OAuth 2.0 token (e.g., JWT) from the external IdP. This offloads authentication logic from the backend Lambda to API Gateway, enabling centralized token validation before the request reaches the integration.

Exam trap

The trap here is that candidates confuse API keys (which identify the client application) with OAuth 2.0 tokens (which authenticate the end user), leading them to incorrectly select usage plans with API keys.

How to eliminate wrong answers

Option A is wrong because WebSocket APIs are used for bidirectional, stateful communication (e.g., real-time chat), not for RESTful API authentication with OAuth 2.0. Option B is wrong because VPC Link enables private integration between API Gateway and resources inside a VPC (e.g., an internal NLB), but it has nothing to do with authentication or token validation. Option D is wrong because usage plans with API keys are for rate limiting and API monetization, not for authenticating users via OAuth 2.0 tokens; API keys identify the client application, not the end user.

Full explanation →

565

Multi-Selecthard

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Select 3 answers

A.AWS Certificate Manager (ACM)

B.Amazon Route 53

C.AWS Direct Connect

D.AWS App Mesh

E.AWS Cloud Map

AnswersA, D, E

ACM provides certificates for mTLS.

Why this answer

AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Exam trap

The trap here is that candidates often confuse Amazon Route 53's public DNS capabilities with the internal service discovery provided by AWS Cloud Map, or they assume Direct Connect is needed for secure communication, overlooking that mTLS is handled at the application layer by App Mesh and ACM.

Full explanation →

566

Multi-Selecthard

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Select 3 answers

A.AWS Organizations

B.AWS Config

C.AWS IAM Access Analyzer

D.AWS CloudTrail

E.Amazon GuardDuty

AnswersA, C, D

Organizations provides a central view and management of all accounts.

Why this answer

AWS Organizations is correct because it provides a centralized governance framework for managing multiple AWS accounts, enabling the security team to apply service control policies (SCPs) that centrally restrict IAM permissions across all member accounts. This allows the security account to enforce permission boundaries and audit IAM actions at the organizational level.

Exam trap

The trap here is that candidates often confuse AWS Config's compliance evaluation with IAM permission management, but Config does not enforce or audit IAM permissions across accounts—it only checks resource configurations against rules.

Full explanation →

567

MCQmedium

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

A.Use AWS Config rules to detect missing flow logs and send alerts to the security team.

B.Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.

C.Use an SCP to require that VPC flow logs be enabled.

D.Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

AnswerB

StackSets automate deployment across accounts and regions.

Why this answer

AWS CloudFormation StackSets can deploy a VPC flow log configuration across multiple accounts and regions in an AWS Organization, and the central S3 bucket policy must allow cross-account delivery from all accounts. This approach automates the deployment for new accounts as they are added to the organization, meeting the requirement for centralized management and automation.

Exam trap

The trap here is that candidates may think SCPs can enforce resource configurations like enabling flow logs, but SCPs only control permissions and cannot create or configure resources; they must be combined with automation tools like StackSets or AWS Config rules with auto-remediation.

How to eliminate wrong answers

Option A is wrong because AWS Config rules can detect missing flow logs and send alerts, but they do not automatically enable flow logs or deliver them to a central S3 bucket; they only provide compliance monitoring and notifications. Option C is wrong because Service Control Policies (SCPs) can restrict actions but cannot directly enable VPC flow logs or configure their delivery to a central S3 bucket; SCPs are for permission boundaries, not resource configuration. Option D is wrong because manually enabling flow logs in each account and region is not automated and does not scale for new accounts added to the organization, violating the automation requirement.

Full explanation →

568

MCQmedium

A company uses Amazon CloudFront with an S3 origin to serve static content. They recently updated the content in S3, but users still see the old files. What is the MOST likely reason?

A.The CloudFront distribution's cache TTL is too long

B.S3 versioning is enabled and the objects are not updated

C.CloudFront is not configured to forward the Cache-Control header

D.S3 Transfer Acceleration is disabled

AnswerA

CloudFront caches content; long TTL prevents immediate updates.

Why this answer

CloudFront caches objects at edge locations based on TTL; if the TTL has not expired, users will get cached old content. Option B is wrong because S3 versioning does not affect cache invalidation. Option C is wrong because CloudFront does not have a 'Cache-Control' header by default; it's set by the origin.

Option D is wrong because S3 Transfer Acceleration is irrelevant to caching.

Full explanation →

569

MCQmedium

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

A.Create a read replica and offload read traffic.

B.Modify the RDS instance to use a larger instance type with higher IOPS.

C.Enable Multi-AZ deployment for the RDS instance.

D.Change the DB parameter group to optimize for write operations.

AnswerB

Larger instance types with higher IOPS reduce write latency.

Why this answer

Upgrading to a larger instance type with higher IOPS directly increases the I/O capacity of the RDS instance, improving write performance without requiring application changes. Option A is incorrect because read replicas are used to offload read traffic, not to improve write latency. Option C is incorrect because Multi-AZ deployment provides high availability and automatic failover, but does not directly improve write performance.

Option D is incorrect because modifying DB parameter groups can tune certain database settings but does not increase the underlying IOPS provided by the instance type.

Full explanation →

570

Multi-Selectmedium

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Select 3 answers

A.AWS Glue

B.S3 Object Lock

C.AWS CloudTrail

D.Amazon S3

E.Amazon Kinesis Data Streams

AnswersB, C, D

Prevents deletion or overwriting of logs.

Why this answer

S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Exam trap

The trap here is that candidates may confuse Kinesis Data Streams as a storage service for logs, but it is a streaming ingestion layer with no built-in immutability or long-term retention, while Glue is mistakenly chosen for its data cataloging capabilities rather than for log storage.

Full explanation →

571

MCQmedium

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

A.Enable CloudTrail log file validation and use IAM policies to limit access.

B.Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.

C.Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

D.Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

AnswerB

SCP enforces encryption, and bucket policy restricts access to the required role.

Why this answer

Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Exam trap

The trap here is that candidates often confuse enabling default encryption (which only applies to new objects if no encryption header is provided) with enforcing encryption via policy, or they overlook that SCPs can enforce encryption requirements across all accounts in an organization, not just within a single account.

How to eliminate wrong answers

Option A is wrong because CloudTrail log file validation only provides integrity verification (detecting if logs were modified), not encryption at rest or access control; IAM policies alone cannot enforce encryption requirements. Option C is wrong because SSE-S3 provides encryption at rest but does not allow the security team to control key management or enforce encryption via policy; a bucket policy alone cannot prevent unauthorized access if IAM roles are not properly scoped. Option D is wrong because while using a customer managed key with KMS is good, attaching an SCP to prevent key deletion does not enforce encryption on S3 put operations or restrict access to the bucket; it only protects the key from deletion, not the logs themselves.

Full explanation →

572

Multi-Selectmedium

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Select 2 answers

A.Use IAM roles in each account with cross-account trust from a central identity provider, granting only required permissions.

B.Apply SCPs to deny high-risk actions across all accounts.

C.Generate long-term access keys for each user in the central account.

D.Share the root user credentials of each account with the central team.

E.Create IAM users in each account with full administrator access for all users.

AnswersA, B

Roles allow temporary credentials with limited permissions.

Why this answer

Using IAM roles with cross-account trust from a central identity provider (e.g., AWS IAM Identity Center or an external IdP) allows users to assume roles in each account with only the permissions required for their tasks. This eliminates the need for long-term credentials and enables centralized access management while adhering to least-privilege principles. Option B is correct because Service Control Policies (SCPs) are applied at the AWS Organizations level to deny high-risk actions across all accounts, providing a guardrail that enforces least-privilege by preventing even privileged users from performing dangerous operations.

Exam trap

The trap here is that candidates often confuse SCPs with IAM permissions policies, thinking SCPs grant access rather than acting as a deny-only guardrail, or they mistakenly believe long-term access keys or shared root credentials are acceptable for cross-account access when they are explicitly anti-patterns for least-privilege.

Full explanation →

573

MCQmedium

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

A.Amazon Simple Notification Service (SNS)

B.AWS Secrets Manager

C.AWS Systems Manager Parameter Store

D.CloudFormation cross-stack references using Export and ImportValue

AnswerD

Exports allow passing outputs to other stacks.

Why this answer

CloudFormation cross-stack references using the `Export` output attribute and the `Fn::ImportValue` intrinsic function allow you to pass output values from one stack as parameters to another stack within the same AWS account and region. This is the native, recommended mechanism for sharing stack outputs without introducing external services or additional complexity.

Exam trap

The trap here is that candidates may confuse Parameter Store (a general-purpose parameter store) with CloudFormation's native cross-stack reference feature, overlooking that the question explicitly asks for passing outputs between CloudFormation stacks, which is directly solved by `Export` and `ImportValue`.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service used for notifications and event-driven workflows, not for storing or passing CloudFormation stack outputs as parameters. Option B is wrong because AWS Secrets Manager is designed to securely store and rotate secrets (e.g., database credentials, API keys), not to pass CloudFormation outputs between stacks. Option C is wrong because AWS Systems Manager Parameter Store can store configuration data and secrets, but it is not the native CloudFormation mechanism for cross-stack references; using it would require custom logic to write outputs to Parameter Store and then read them in the other stack, adding unnecessary overhead and violating the principle of using built-in CloudFormation features.

Full explanation →

574

MCQmedium

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

A.Access is allowed because the Principal is "*".

B.Access is denied because the bucket is not public.

C.Access is allowed because the policy does not explicitly deny.

D.Access is denied because the IP is not allowed.

AnswerD

The policy restricts access to the specified IP range.

Why this answer

The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Exam trap

The trap here is that candidates often assume a bucket policy with Principal '*' automatically allows all access, ignoring the condition block that can restrict access based on IP address or other attributes.

How to eliminate wrong answers

Option A is wrong because the Principal '*' in the policy does not grant access unconditionally; the policy includes a condition that restricts access to a specific IP address range, and the user's IP (198.51.100.5) is not in that range. Option B is wrong because the bucket policy itself can grant access without making the bucket publicly accessible; the bucket's block public access settings are not mentioned, and the policy's explicit deny is the reason for denial, not the bucket's public status. Option C is wrong because the policy does explicitly deny access via the condition block; the 'Effect' is 'Deny' for requests that do not match the allowed IP range, so the lack of an explicit deny statement is incorrect.

Full explanation →

575

Multi-Selecteasy

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Select 2 answers

A.Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.

B.Create a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present.

C.Use Amazon GuardDuty to monitor S3 data access patterns.

D.Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

E.Enable AWS CloudTrail to log all S3 API calls.

AnswersA, B

Config rules can enforce and remediate non-compliant resources.

Why this answer

AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.

Exam trap

The trap here is that candidates often confuse detective controls (like AWS Config or CloudTrail) with preventive controls (like SCPs), or they mistakenly think that IAM roles or GuardDuty can enforce encryption policies, when in fact only SCPs and bucket policies with condition keys can deny unencrypted uploads at the API level.

Full explanation →

576

Multi-Selectmedium

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Select 2 answers

A.Create a manual snapshot and copy it to another Region.

B.Enable automated backups and copy them to another Region.

C.Use S3 cross-Region replication for the database.

D.Configure a cross-Region read replica.

E.Enable Multi-AZ deployment.

AnswersB, D

Cross-Region backup copy enables restore in another region.

Why this answer

The correct answers are B and D. Option B enables automated backups of the RDS instance and copies them to another region, allowing point-in-time restoration in a different region for disaster recovery. Option D creates a cross-Region read replica, which serves as a standby database in another region for DR and also offloads read traffic.

Option A (manual snapshot) requires manual effort and scheduling, not automated. Option C (S3 cross-Region replication) does not apply to RDS database backups. Option E (Multi-AZ) provides high availability within a single region but not across regions.

Full explanation →

577

Multi-Selectmedium

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

Select 2 answers

A.Use On-Demand Instances for all nodes.

B.Right-size the cluster by analyzing resource utilization metrics.

C.Purchase Reserved Instances for the cluster.

D.Use Dedicated Instances to improve performance.

E.Use Spot Instances for task nodes.

AnswersB, E

Right-sizing prevents over-provisioning and reduces cost.

Why this answer

Spot Instances are ideal for fault-tolerant, interruptible workloads like batch processing, significantly reducing costs (Option E). Right-sizing the cluster by analyzing resource utilization ensures that you are not over-provisioning, which directly lowers costs (Option B). On-Demand Instances (A) are more expensive and unnecessary given fault tolerance.

Reserved Instances (C) are for steady-state workloads, not nightly batch jobs. Dedicated Instances (D) add cost and do not improve performance for this use case.

Full explanation →

578

MCQeasy

A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?

A.The instance does not have a public IP address.

B.The instance is failing system status checks.

C.The security group is not attached to the instance.

D.The subnet's network ACL is blocking inbound SSH traffic.

AnswerD

Network ACLs are stateless and can block traffic even if the security group allows it. If the inbound rule for port 22 is missing or denied in the network ACL, SSH connections will be dropped.

Why this answer

The most likely cause is that the subnet's network ACL is blocking inbound SSH traffic. While the security group allows SSH from anywhere (0.0.0.0/0), network ACLs operate at the subnet level and can override security group rules. If the network ACL denies inbound traffic on port 22, SSH connections will be blocked.

Option A is less likely because even without a public IP, the instance could be reached via private IP from within the VPC; the scenario implies external SSH access. Option B is incorrect because system status checks indicate underlying hardware issues, not connectivity problems. Option C is incorrect because the security group is attached by default when launching an instance, and the question confirms it allows SSH.

Full explanation →

579

MCQmedium

A company has a multi-tier application running on AWS. The web tier uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The application tier runs on a separate Auto Scaling group of EC2 instances. The database tier uses Amazon RDS for MySQL. During a recent load test, the application became unresponsive. Monitoring showed that the database's CPU utilization was at 100% and the number of database connections was at the maximum limit. The application tier instances were healthy, but the web tier instances were returning 503 errors. The Solutions Architect determined that the application tier was making too many database connections because each request opened a new connection and did not close it properly. The team wants to fix the issue with minimal changes to the application code. Which solution should the Solutions Architect recommend?

A.Migrate the database from RDS MySQL to Amazon Aurora MySQL with read replicas.

B.Increase the max_connections parameter in the RDS parameter group to allow more connections.

C.Scale the application tier horizontally by increasing the desired capacity of the Auto Scaling group.

D.Configure Amazon RDS Proxy to pool database connections from the application tier.

AnswerD

RDS Proxy manages connection pooling, reducing the number of connections and CPU usage with minimal code changes.

Why this answer

Amazon RDS Proxy provides connection pooling, allowing the application to reuse existing connections rather than opening new ones. This reduces the number of simultaneous connections to the database, alleviating CPU and connection limit pressure. It requires minimal code changes.

Option A is incorrect because migrating to Aurora does not address the connection management problem; it may still require RDS Proxy. Option B is incorrect because increasing max_connections does not fix the root cause of unclosed connections and can lead to resource contention. Option C is incorrect because scaling the application tier horizontally would increase the number of connections, worsening the issue.

Full explanation →

580

Multi-Selectmedium

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

Select 2 answers

A.Set Lambda reserved concurrency to a value that matches the expected peak load.

B.Increase the Lambda function timeout to 15 minutes.

C.Enable usage plans and throttling in API Gateway to limit requests.

D.Use Amazon SQS to buffer requests and decouple the frontend.

E.Configure Lambda provisioned concurrency to pre-warm instances.

AnswersA, C

Reserved concurrency limits the maximum concurrent executions, preventing throttling and uncontrolled scaling.

Why this answer

Lambda reserved concurrency guarantees a fixed number of concurrent executions for the function, preventing it from being throttled by other functions in the account. By setting reserved concurrency to match the expected peak load, the application ensures that all requests during the flash sale can be processed without hitting account-level concurrency limits.

Exam trap

The trap here is that candidates often confuse provisioned concurrency (which reduces cold starts) with reserved concurrency (which guarantees capacity and prevents throttling), leading them to select Option E instead of Option A.

Full explanation →

581

MCQhard

A company attaches the IAM policy shown in the exhibit to an IAM user. The user tries to upload an object to my-bucket using the AWS CLI without the --ssl flag (i.e., using HTTP). What will happen?

A.The upload fails with an implicit denial because the Allow condition is not met.

B.The upload succeeds because the Allow statement grants s3:PutObject.

C.The upload fails with an explicit deny because of the Deny statement.

D.The upload succeeds because there is no explicit Deny for s3:PutObject.

AnswerC

The Deny statement blocks non-HTTPS requests explicitly.

Why this answer

The Deny statement with aws:SecureTransport=false explicitly denies non-HTTPS requests. Option A is wrong because the Allow statement requires HTTPS. Option B is wrong because the Deny is explicit.

Option D is wrong because the Deny is explicit.

Full explanation →

582

MCQmedium

A company uses AWS Organizations with a central logging account. They want to ensure that all VPC Flow Logs from member accounts are published to a central S3 bucket in the logging account. Which steps are required?

A.Configure VPC Flow Logs in each member account to deliver to a central S3 bucket using a bucket policy.

B.Use Amazon Kinesis Data Firehose to stream logs to the central bucket.

C.Create a CloudWatch Logs subscription in the central account that receives logs from all accounts.

D.Create a CloudWatch Logs log group in each member account and use a subscription filter to forward to a central S3 bucket via Kinesis.

AnswerA

Flow Logs can deliver to S3, and bucket policy allows cross-account delivery.

Why this answer

VPC Flow Logs can be published directly to an S3 bucket in a different account by configuring the destination S3 bucket with a bucket policy that grants the required permissions (e.g., `AWS:SourceAccount` and `AWS:SourceArn`) to the member account's VPC Flow Logs service. This allows each member account to write flow logs directly to the central logging account's S3 bucket without needing intermediate services, aligning with AWS Organizations' centralized logging best practices.

Exam trap

The trap here is that candidates often assume VPC Flow Logs must go through CloudWatch Logs or Kinesis for cross-account delivery, but AWS directly supports publishing to a cross-account S3 bucket with the correct bucket policy, making intermediate services unnecessary.

How to eliminate wrong answers

Option B is wrong because Amazon Kinesis Data Firehose is not a native destination for VPC Flow Logs; VPC Flow Logs can only be published to CloudWatch Logs or S3 directly, and using Firehose would require an unnecessary intermediate step and additional cost. Option C is wrong because a CloudWatch Logs subscription in the central account cannot receive logs from member accounts directly; subscriptions must be set up in each member account to forward logs to a central destination, and the central account cannot initiate the subscription. Option D is wrong because VPC Flow Logs cannot be sent to a CloudWatch Logs log group and then forwarded to S3 via a subscription filter and Kinesis; VPC Flow Logs can only be delivered to CloudWatch Logs or S3 directly, and the described pipeline is not supported without custom solutions.

Full explanation →

583

MCQeasy

Refer to the exhibit. A company is using AWS Migration Hub to track migrations. The above IAM policy is attached to an IAM role used by the migration tool. The migration tool reports that it cannot register the migration task with Migration Hub. Which action should the company add to the policy to fix the issue?

A.mgh:ImportMigrationTask

B.mgh:AssociateDiscoveredResource

C.mgh:CreateHomeRegion

D.mgh:GetHomeRegion

AnswerA

The migration tool needs mgh:ImportMigrationTask to register a migration task.

Why this answer

The migration tool needs mgh:ImportMigrationTask to register a migration task. Option B (AssociateDiscoveredResource) is for associating resource data, not registering tasks. Option C (CreateHomeRegion) is not needed.

Option D (GetHomeRegion) is read-only.

Full explanation →

584

MCQmedium

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

A.AWS CloudHSM

B.AWS Identity and Access Management (IAM) roles

C.AWS Systems Manager Parameter Store

D.AWS Secrets Manager

AnswerD

Secrets Manager provides built-in automatic rotation for RDS, Redshift, and DocumentDB credentials.

Why this answer

AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing the lifecycle of database credentials. It integrates natively with Amazon ECS and Fargate via task role permissions, allowing containers to retrieve secrets at runtime without hardcoding them. Secrets Manager also supports automatic rotation of credentials for Amazon RDS, Aurora, and other databases, which directly addresses the requirement for credential rotation.

Exam trap

The trap here is that candidates often confuse AWS Systems Manager Parameter Store (which can store secrets) with AWS Secrets Manager, but Parameter Store lacks native automatic rotation and is not designed for managing database credential lifecycles, making Secrets Manager the correct choice for this specific requirement.

How to eliminate wrong answers

Option A is wrong because AWS CloudHSM provides hardware-based cryptographic key storage and cryptographic operations, not a service for storing or rotating database credentials; it lacks built-in automatic rotation and secret management features. Option B is wrong because IAM roles provide temporary credentials for AWS API access but cannot store or rotate database credentials; they are used for authorization, not secret storage. Option C is wrong because AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation of database credentials; it requires custom solutions (e.g., Lambda functions) to implement rotation, whereas Secrets Manager provides built-in rotation.

Full explanation →

585

MCQhard

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

A.The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.

B.The bucket policy requires an explicit Deny for all principals except the root user.

C.A service control policy (SCP) is denying access to the S3 bucket.

D.The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.

AnswerD

When a user assumes a role, the principal becomes the role's ARN, not the root user.

Why this answer

The bucket policy explicitly grants access to the member account's root user ARN (e.g., `arn:aws:iam::123456789012:root`). When a developer assumes an IAM role in the member account, the resulting session has a different ARN (e.g., `arn:aws:sts::123456789012:assumed-role/DevRole/session`). Because the bucket policy's Principal is restricted to the root user ARN, the role session is not recognized as a matching principal, and access is denied.

This is a common misconfiguration when mixing root user grants with assumed-role access.

Exam trap

The trap here is that candidates often assume that granting access to a member account's root user automatically grants access to all IAM users and roles in that account, but in reality, root user ARN is a specific principal that does not cover assumed-role sessions or IAM users unless explicitly included.

How to eliminate wrong answers

Option A is wrong because the question states the bucket policy allows access only from the member accounts' root user, and there is no mention of KMS encryption or a KMS key permission issue; the problem is purely about principal matching in the bucket policy. Option B is wrong because an explicit Deny for all principals except the root user would still not allow the role session to access the bucket, but the question describes a bucket policy that 'allows access only from the member accounts' root user' — this is an Allow with a specific principal, not an explicit Deny, and the core issue is the principal mismatch, not an explicit Deny statement. Option C is wrong because while an SCP could deny access, the question asks for the 'most likely cause' given the specific bucket policy configuration; the direct and most common cause is the principal mismatch between the root user ARN in the policy and the assumed-role ARN used by the developers.

Full explanation →

586

MCQmedium

A media company delivers video content to a global audience using Amazon CloudFront, AWS Lambda@Edge, and Amazon S3. The origin is an S3 bucket that stores video files. Recently, users in Asia-Pacific report slow load times. The operations team checks CloudFront metrics and sees a high cache miss rate for content popular in that region. The team wants to improve performance for all users without significantly increasing costs. The application uses a single CloudFront distribution with a default cache behavior. The S3 bucket is in us-east-1. Which solution should the team implement?

A.Enable S3 Transfer Acceleration on the S3 bucket and update CloudFront to use the accelerated endpoint.

B.Create separate CloudFront distributions for each geographic region and use Route 53 latency-based routing.

C.Use Lambda@Edge to redirect requests to the nearest S3 bucket based on the viewer's location.

D.Set up multiple origin groups in the existing CloudFront distribution with one S3 bucket per region, and configure cache behaviors based on geographic headers.

AnswerC

Lambda@Edge can redirect requests to the nearest regional S3 bucket based on viewer location, reducing latency and cache misses efficiently.

Why this answer

Using Lambda@Edge to redirect requests to the nearest S3 bucket based on viewer location reduces latency for global users by serving content from a regional S3 bucket. This approach improves performance for all users without significantly increasing costs, as it leverages existing Lambda@Edge and S3 infrastructure. Option D is incorrect because CloudFront origin groups are designed for failover, not geographic routing, and using geographic headers for origin selection is not a native feature.

Exam trap

The trap is that origin groups are often mistakenly thought to support geographic routing, but they only provide failover between origins. Right answer uses Lambda@Edge for location-based redirection.

Full explanation →

587

MCQmedium

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

A.Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.

B.Request a service quota increase for Lambda concurrent executions.

C.Set a reserved concurrency of 500 for the Lambda function.

D.Increase the Lambda function timeout to more than 30 seconds.

AnswerA

Each shard is processed by a single Lambda instance; if processing takes too long, the iterator age grows and records may expire.

Why this answer

The primary consideration is to ensure that the Lambda function processes each batch within the Kinesis stream's iterator age (default 7 days). With 5,000 records/sec across 10 shards, each shard receives 500 records/sec. If each record takes 30 seconds to process, the Lambda function must process records faster than they arrive to avoid falling behind and exceeding the iterator age, which would cause data loss.

The iterator age metric tracks how far behind the consumer is, and if it grows unbounded, records will expire before being processed.

Exam trap

The trap here is that candidates focus on Lambda's concurrency limits or timeouts, but the real bottleneck is the iterator age and the inability to process records faster than they arrive per shard, which is a fundamental scaling constraint in Kinesis-Lambda integrations.

How to eliminate wrong answers

Option B is wrong because requesting a service quota increase for Lambda concurrent executions is not the primary consideration; the default concurrent execution quota (1,000) is sufficient for this workload (10 shards × 5 concurrent batches per shard = 50 concurrent executions, well under the limit). Option C is wrong because setting a reserved concurrency of 500 would artificially cap the function's scaling and could cause throttling, as the function needs to scale dynamically based on shard throughput, not be limited to a fixed number. Option D is wrong because increasing the Lambda function timeout to more than 30 seconds does not address scaling; the timeout only affects how long a single invocation can run, not the ability to handle the sustained load of 5,000 records/sec across 10 shards.

Full explanation →

588

MCQmedium

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

A.Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, Amazon Kinesis Data Firehose

B.Amazon SQS, AWS Lambda, Amazon S3

C.Amazon Kinesis Data Streams, Amazon Redshift, Amazon S3

D.Amazon IoT Core, AWS Lambda, Amazon DynamoDB

AnswerA

Correct. Amazon Kinesis Data Streams can ingest millions of messages per second, Kinesis Data Analytics performs real-time processing, and Kinesis Data Firehose delivers the processed data to S3 with low latency.

Why this answer

Kinesis Data Streams ingests high-throughput data, Kinesis Data Analytics processes it in real-time, and Kinesis Data Firehose delivers the results to S3. Option B uses SQS, which is not designed for millions of messages per second, and Lambda may throttle under high load. Option C uses Redshift, which is a data warehouse; while streaming data can be loaded into Redshift, it is not a real-time streaming destination and typically requires Firehose.

Option D uses IoT Core for ingestion, but DynamoDB is not optimized for storing large analytical results; S3 would be more appropriate.

Full explanation →

589

MCQmedium

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

A.Add a manual approval action in the pipeline stage with an SNS topic for notification.

B.Use Amazon CloudWatch Events to trigger an SNS topic for approval.

C.Create a custom action using AWS CodeDeploy.

D.Add a Lambda function that sends an email and pauses the pipeline until a token is provided.

AnswerA

Correct. CodePipeline includes a native manual approval action that integrates with SNS for notifications.

Why this answer

AWS CodePipeline provides a built-in manual approval action that can be added to a pipeline stage, which sends an SNS notification to approvers. Option B is incorrect because CloudWatch Events is used for event-driven automation, not for manual approvals. Option C is incorrect because AWS CodeDeploy is a deployment service, not for approval steps.

Option D is incorrect because while a Lambda function could be used, CodePipeline has a native approval action that is simpler and more appropriate.

Full explanation →

590

MCQmedium

A company is migrating a critical application to AWS using a lift-and-shift approach. The application runs on two on-premises servers: a web server and a database server running SQL Server. The company has deployed the web server on an EC2 instance behind an Application Load Balancer, and the database on an RDS for SQL Server Multi-AZ instance. After migration, users report that the application is noticeably slower compared to on-premises. The application uses a large number of database transactions, and latency between the web server and database has increased. The web server is in us-east-1a, and the RDS primary instance is in us-east-1b. The solutions architect verifies that the application is using the RDS endpoint, not the IP address. What should the architect do to reduce latency?

A.Enable Multi-AZ on the web server EC2 instance.

B.Move the web server EC2 instance to the same Availability Zone as the RDS primary instance.

C.Upgrade the web server EC2 instance to a larger instance type with enhanced networking.

D.Deploy Amazon CloudFront in front of the web server to cache responses.

AnswerB

Same-AZ placement eliminates cross-AZ network latency.

Why this answer

Colocating the web server and RDS primary in the same Availability Zone minimizes network latency. RDS Multi-AZ automatically manages failover, and the web server should be in the same AZ as the primary to avoid cross-AZ latency. Enabling Multi-AZ on the web server does not help.

Using a larger instance does not reduce latency. CloudFront is for content delivery, not database latency.

Full explanation →

591

MCQmedium

A multinational company is adopting AWS Organizations to manage multiple accounts across business units. The security team requires that specific IAM roles be automatically deployed to all existing and future member accounts. Which solution should the company use?

A.Use AWS Config rules to enforce the role creation in each account.

B.Use AWS CloudFormation StackSets with automatic deployment enabled in the organization.

C.Use AWS Service Catalog to create a portfolio with the IAM role product and share it with all accounts.

D.Use AWS Lambda functions triggered by AWS CloudTrail events to create the role in each account.

AnswerB

StackSets can deploy stacks across accounts and automatically to new accounts.

Why this answer

AWS CloudFormation StackSets with automatic deployment enabled allows you to deploy IAM roles across all accounts in an AWS Organization, including future accounts, by specifying the organization root or OUs as targets. This ensures consistent role creation without manual intervention, as StackSets automatically provisions stacks in new accounts as they join the organization.

Exam trap

The trap here is that candidates often confuse AWS Config's remediation actions with direct resource creation, or they assume Service Catalog's sharing mechanism automatically deploys resources, when in fact only CloudFormation StackSets with automatic deployment provides native, organization-wide, and future-proof resource deployment.

How to eliminate wrong answers

Option A is wrong because AWS Config rules are for evaluating resource compliance, not for creating or deploying resources; they can trigger remediation actions via Lambda or Systems Manager, but they do not directly create IAM roles across accounts. Option C is wrong because AWS Service Catalog allows users to provision products from a portfolio, but it does not automatically deploy roles to all accounts; it requires users to manually launch the product in each account. Option D is wrong because while Lambda functions triggered by CloudTrail events could create roles, this approach is event-driven and reactive, requiring custom code and handling for future accounts, and lacks the native, automated, and scalable deployment mechanism that StackSets provides for organizations.

Full explanation →

592

MCQhard

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic to tasks. The company has configured an Auto Scaling target tracking policy based on average CPU utilization. During a marketing campaign, traffic spikes cause the ALB to return 503 errors. The ECS service dashboard shows that the number of tasks scaled out to the maximum allowed but the CPU utilization remained high. What is the MOST likely cause of the 503 errors?

A.The ECS service scaled out to the maximum number of tasks, but the new tasks are not yet registered as healthy with the ALB, or the existing tasks are overwhelmed.

B.The target tracking scaling policy takes too long to trigger, and the service cannot scale quickly enough.

C.The Fargate tasks have exhausted their elastic network interface (ENI) limits.

D.The ALB connection limit has been exceeded due to the traffic spike.

AnswerA

When max tasks is reached and CPU is high, tasks may be overwhelmed; also, if health check grace period is too short, new tasks may be considered unhealthy and dropped.

Why this answer

When ECS tasks scale out to the maximum allowed, the ALB may still return 503 errors if the new tasks are not yet registered as healthy (health check grace period or delayed registration) or if the existing tasks are already overwhelmed. The scaling policy reached its maximum, but the tasks cannot handle the traffic, leaving the ALB with no healthy targets to serve requests. Option B is incorrect because target tracking scaling policies typically respond within minutes, but the issue here is that the maximum number of tasks was reached and CPU remained high, not that scaling was too slow.

Option C is incorrect because ENI limits for Fargate tasks are per-task and unlikely to cause ALB 503 errors. Option D is incorrect because ALB connection limits are very high and rarely the bottleneck; the error stems from lack of healthy targets.

Full explanation →

593

Multi-Selecthard

A company is implementing a data lake on AWS using Amazon S3 as the storage layer. The data lake must support multiple consumer accounts within the organization. The security team requires that data is encrypted at rest using AWS KMS with customer-managed keys (CMKs) and that access to the keys is strictly controlled. Which THREE steps should be taken to meet these requirements?

Select 3 answers

A.Create a customer-managed KMS key with a key policy that allows the consumer accounts to use the key.

B.Grant cross-account access to the S3 bucket using bucket policies.

C.Configure the S3 bucket policy to deny uploads that do not use the required KMS key.

D.Use an SCP to require that all S3 buckets use server-side encryption with KMS.

E.Create IAM roles in each consumer account that grant access to the KMS key.

AnswersA, B, C

Allows cross-account decryption.

Why this answer

Creating a customer-managed KMS key (CMK) with a key policy that explicitly grants the consumer accounts permission to use the key (e.g., via the `kms:Decrypt` and `kms:GenerateDataKey` actions) is required for cross-account encryption. This ensures that the S3 bucket can encrypt objects with the CMK, and consumer accounts can decrypt them using their own IAM permissions, meeting the security team's requirement for strict key control.

Exam trap

The trap here is that candidates often confuse SCPs with resource-based policies, thinking an SCP can enforce cross-account encryption access, when in reality SCPs only set permission boundaries and cannot grant the specific KMS key usage permissions required for cross-account decryption.

Full explanation →

594

MCQhard

A company has multiple business units, each with its own AWS account. They want to enforce that all EC2 instances launched across accounts use only approved AMIs. The AMIs are stored in a central account. What is the MOST scalable and secure way to enforce this?

A.Tag approved AMIs and use IAM policies to require that tag.

B.Use an IAM policy in each account to allow only specific AMI IDs.

C.Use AWS Config rules to check AMI IDs against a parameter store and auto-remediate.

D.Use an SCP to deny ec2:RunInstances unless the AMI ID matches an approved list.

AnswerC

Config rules can evaluate resources and trigger remediation, scalable across accounts.

Why this answer

AWS Config rules can evaluate EC2 instances against a centrally managed list of approved AMI IDs stored in AWS Systems Manager Parameter Store, and auto-remediate non-compliant instances (e.g., by terminating or stopping them). This approach is scalable across multiple accounts via AWS Config aggregator and cross-account IAM roles, and it is secure because it enforces compliance continuously without relying on client-side IAM policies that can be bypassed.

Exam trap

The trap here is that candidates often assume SCPs can enforce resource-level conditions like AMI IDs, but SCPs only support service-level condition keys (e.g., aws:SourceAccount) and cannot evaluate instance-specific attributes, making AWS Config with auto-remediation the correct scalable and secure solution.

How to eliminate wrong answers

Option A is wrong because tagging approved AMIs and using IAM policies to require that tag is not enforceable — IAM policies cannot condition on resource tags at launch time for the ec2:RunInstances action in a way that prevents an unapproved AMI from being used; the tag condition only applies after the instance exists, so a user could launch an unapproved AMI and then tag it. Option B is wrong because using an IAM policy in each account to allow only specific AMI IDs is not scalable — it requires manual updates to every account's policy whenever an AMI is added or deprecated, and it does not prevent users from launching instances from AMIs copied or shared from outside the central account. Option D is wrong because an SCP that denies ec2:RunInstances unless the AMI ID matches an approved list is not feasible — SCPs cannot evaluate the AMI ID parameter in the ec2:RunInstances action because AMI IDs are not a supported condition key for SCPs; SCPs can only deny based on service-level conditions like aws:SourceAccount, not resource-specific attributes like AMI IDs.

Full explanation →

595

Matchingmedium

Match each AWS service to its primary use case.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Centrally manage multiple AWS accounts

Connect VPCs and on-premises networks

Dedicated private network connection to AWS

Secure connection over the internet to AWS

Privately access services across VPCs

Why these pairings

Correct matches: AWS Organizations for account management, AWS Direct Connect for dedicated private connection, AWS VPN for encrypted internet connection, AWS Transit Gateway for hub-and-spoke network interconnection. Common confusions include swapping Direct Connect and VPN, or misattributing account management to networking services.

Full explanation →

596

MCQmedium

A company uses AWS Elastic Beanstalk to deploy a web application. They want to update the environment's configuration to use a larger instance type without any downtime. Which update policy supports this?

A.All at once

B.Blue/Green

C.Immutable

D.Rolling

AnswerD

Rolling update updates instances in batches, ensuring the environment remains available throughout the process.

Why this answer

(Rolling) is correct because Rolling update with batch size updates instances in batches, keeping the environment running and avoiding downtime. Option A is wrong because All at once replaces all instances simultaneously, causing downtime. Option B is wrong because Blue/Green is not a built-in Elastic Beanstalk update policy; it's a manual approach.

Option C is wrong because Immutable update launches new instances in a separate ASG and then swaps, which causes a brief downtime during the swap.

Full explanation →

597

MCQmedium

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use for message brokering?

A.Amazon Simple Queue Service (SQS)

B.Amazon Simple Notification Service (SNS)

C.Amazon Kinesis Data Streams

D.AWS Step Functions

AnswerA

SQS provides fully managed message queues for async communication.

Why this answer

Option A (Amazon SQS) is correct because SQS provides a fully managed message queuing service for asynchronous communication between microservices, enabling decoupling. Option B (Amazon SNS) is a pub/sub notification service, not a queue. Option C (Amazon Kinesis Data Streams) is for real-time streaming data.

Option D (AWS Step Functions) is for workflow orchestration.

Full explanation →

598

Multi-Selectmedium

Which TWO actions improve the security of an Amazon S3 bucket that stores sensitive data?

Select 2 answers

A.Enable CORS (Cross-Origin Resource Sharing).

B.Enable S3 server access logging.

C.Enable S3 Block Public Access.

D.Enable S3 Transfer Acceleration.

E.Use a bucket policy that denies access to all principals except the root user.

AnswersB, C

Provides audit trail for access requests.

Why this answer

Enabling S3 Block Public Access (Option C) is a critical security control that prevents any public access to the bucket, regardless of bucket policies or object ACLs, effectively eliminating the risk of unintended data exposure. Enabling S3 server access logging (Option B) records all requests made to the bucket, providing an audit trail that can be used to detect unauthorized access attempts, troubleshoot security events, and meet compliance requirements. Both actions directly enhance the security posture of a bucket storing sensitive data.

Exam trap

The SAP-C02 exam often tests the misconception that enabling S3 Transfer Acceleration or CORS improves security, when in fact they are performance and cross-origin features respectively, not security controls.

Full explanation →

599

MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

A.Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

B.Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

C.Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

D.Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.

AnswerD

SCPs can centrally enforce restrictions across all accounts in the organization.

Why this answer

An SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Exam trap

The trap here is that candidates often choose AWS Config (option A) because it is a common detective control, but they overlook that SCPs are the only preventive control that works centrally across all accounts with zero per-account setup.

How to eliminate wrong answers

Option A is wrong because AWS Config rules only detect and report non-compliant resources after they exist; they do not prevent the creation of public buckets, so operational overhead remains for remediation. Option B is wrong because IAM roles assigned to users cannot prevent actions performed by services (e.g., AWS Lambda, CloudFormation) or root users, and managing roles across many accounts adds significant overhead. Option C is wrong because applying bucket policies to existing buckets is a reactive, per-bucket manual process that does not prevent new public buckets from being created, and AWS Config detection still requires remediation effort.

Full explanation →

600

MCQhard

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

A.Objects are locked indefinitely until the lock is manually removed.

B.Objects can be deleted immediately because versioning is enabled.

C.Objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

D.Objects can be deleted only by the root user.

AnswerC

Object Lock with GOVERNANCE mode and 365-day retention prevents deletion.

Why this answer

The configuration shown enables S3 Object Lock in governance mode with a retention period of 365 days. In governance mode, an object cannot be deleted or overwritten until the retention period expires, unless the user has special permissions such as s3:BypassGovernanceRetention. This is why option C is correct: objects cannot be deleted or overwritten for 365 days unless special permissions are granted.

Exam trap

The trap here is that candidates often assume the root user can bypass any S3 lock, but in compliance mode, even the root user is restricted, making option D a common distractor.

How to eliminate wrong answers

Option A is wrong because objects are not locked indefinitely; they are locked for a specific retention period of 365 days, after which the lock expires and the object can be deleted or overwritten normally. Option B is wrong because even with versioning enabled, S3 Object Lock in compliance mode prevents deletion of any version of the object during the retention period; versioning does not override the lock. Option D is wrong because the root user is also subject to compliance mode locks; no user, including the root user, can delete or overwrite the object during the retention period.

Full explanation →

Page 8 of 23

All pages

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational Complexity Design for New Solutions Continuous Improvement for Existing Solutions Accelerate Workload Migration and Modernization

See all domains with question counts →