Courseiva

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 601–675

1660 questions total · 23pages · All types, answers revealed

Take a mock examExam hub
Page 8

Page 9 of 23

Page 10
601
MCQhard

A multinational company is implementing a multi-account strategy using AWS Organizations. The security team needs to ensure that all newly created accounts automatically have a specific baseline CloudTrail trail and a set of AWS Config rules applied. The company also wants to enforce that no account can disable these controls. Which solution should be used?

A.Create an SCP that denies actions to disable CloudTrail and AWS Config, and use AWS CloudFormation StackSets to deploy the baseline resources to all accounts in the organization.
B.Use IAM roles with a trust policy that allows the management account to deploy CloudTrail and AWS Config, and use AWS Lambda to monitor for changes.
C.Use AWS Control Tower to set up the baseline and enforce it via preventive guardrails.
D.Use AWS Organizations to create an SCP that deploys AWS Config rules and CloudTrail via AWS CloudFormation StackSets.
AnswerA

SCPs enforce prevention, and StackSets automate deployment.

Why this answer

It combines an SCP that denies actions to disable CloudTrail and AWS Config (e.g., `cloudtrail:StopLogging`, `config:DeleteConfigRule`) with AWS CloudFormation StackSets to deploy the baseline resources across all accounts in the organization. The SCP enforces that no account (including root users) can disable the controls, while StackSets automatically deploy the CloudTrail trail and Config rules to new accounts as they join the organization. This meets both the automatic deployment and enforcement requirements.

Exam trap

The trap here is that candidates confuse SCPs with deployment mechanisms—SCPs only deny or allow actions, they cannot create resources, so StackSets (or similar) are required for deployment, and Control Tower guardrails are often mistaken for being able to deploy custom resources when they only enforce pre-defined policies.

How to eliminate wrong answers

Option B is wrong because IAM roles with a trust policy from the management account can deploy resources, but they do not prevent accounts from disabling CloudTrail or Config; they only allow the management account to deploy, not enforce. Option C is wrong because AWS Control Tower guardrails can enforce preventive controls (e.g., disallow disabling CloudTrail), but Control Tower does not automatically deploy custom CloudTrail trails or custom Config rules; it only provides pre-defined guardrails and cannot deploy arbitrary baseline resources. Option D is wrong because an SCP cannot deploy resources; SCPs only define permission boundaries and cannot create CloudTrail trails or Config rules—StackSets must be used separately, and the option incorrectly states that the SCP itself deploys the resources.

Full explanation →
602
Multi-Selectmedium

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

Select 2 answers
A.Create an AWS WAF web ACL and attach it to the Lambda function
B.Configure API Gateway to require an API key and associate WAF with the usage plan
C.Associate an AWS WAF web ACL with the API Gateway HTTP API
D.Associate an AWS WAF web ACL with the API Gateway REST API stage
E.Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint
AnswersC, D

WAF can be associated with HTTP APIs.

Why this answer

AWS WAF can be directly associated with an API Gateway HTTP API to filter and monitor HTTP requests based on rules in a web ACL. Option D is correct because AWS WAF can also be directly associated with a specific stage of an API Gateway REST API, providing granular security at the API stage level.

Exam trap

The trap here is that candidates may think WAF must be attached to a CloudFront distribution or a Lambda function, but AWS WAF directly supports association with both API Gateway REST API stages and HTTP APIs without requiring CloudFront.

Full explanation →
603
Multi-Selecteasy

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to implement a change management process that requires approval before stack updates can proceed. Which TWO approaches can achieve this?

Select 2 answers
A.Use AWS CloudFormation StackSets to deploy updates across multiple accounts.
B.Create a service role with specific IAM policies and require that updates be initiated with that role.
C.Manually review all template changes before uploading to S3.
D.Configure a stack policy to prevent updates to critical resources.
E.Use CloudFormation change sets to review proposed changes before executing them.
AnswersB, E

By controlling who can assume the service role, you can enforce approval workflows.

Why this answer

Options B and E are correct. Using a service role with specific IAM policies (B) ensures that only authorized roles can initiate stack updates, enforcing an approval workflow. CloudFormation change sets (E) allow the operations team to review proposed changes before executing them, providing a mechanism for approval.

Option A is incorrect because StackSets are used for deploying across multiple accounts and regions, not for approval workflows. Option C is incorrect because manually reviewing template changes before uploading to S3 is not a built-in CloudFormation mechanism for change management. Option D is incorrect because stack policies protect specific resources from being updated or deleted, but they do not enforce an approval process for updates.

Full explanation →
604
MCQeasy

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

A.S3 Object Lock
B.S3 Transfer Acceleration
C.S3 Event Notifications
D.S3 Inventory
AnswerC

S3 can send events to Lambda on object creation.

Why this answer

S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Exam trap

The trap here is that candidates may confuse S3 Event Notifications with S3 Inventory or S3 Object Lock, thinking any S3 feature that 'tracks' or 'protects' objects can trigger code, but only Event Notifications provide real-time, push-based triggers to Lambda.

How to eliminate wrong answers

Option A is wrong because S3 Object Lock is a write-once-read-many (WORM) feature that prevents objects from being deleted or overwritten for a fixed retention period; it does not trigger Lambda functions. Option B is wrong because S3 Transfer Acceleration uses AWS edge locations to speed up uploads over long distances via optimized network paths; it has no event triggering capability. Option D is wrong because S3 Inventory provides scheduled CSV/Parquet reports listing objects and their metadata for auditing or lifecycle management; it does not generate real-time events to invoke Lambda.

Full explanation →
605
MCQmedium

An administrator attempts to start an EC2 instance that was previously stopped. The instance fails to start. The administrator runs the CLI command shown in the exhibit. What is the most likely cause of the failure?

A.The instance is in the 'stopped' state and needs to be started.
B.The instance ID is incorrect.
C.The instance is in 'pending' state and will start automatically.
D.The instance has been terminated.
AnswerA

The State is 'stopped', so the administrator needs to start it.

Why this answer

The instance is in 'stopped' state (Code 80), not 'running'. Option B is wrong because the state is stopped, not pending. Option C is wrong because there is no error in the output.

Option D is wrong because the output shows the instance exists.

Full explanation →
606
MCQeasy

A company is migrating a legacy Windows application to AWS. The application requires a shared file system accessible from multiple EC2 instances. Which AWS storage solution should the company use?

A.Amazon Elastic File System (EFS)
B.Amazon FSx for Windows File Server
C.Amazon Elastic Block Store (EBS) with multi-attach enabled
D.Amazon Simple Storage Service (S3)
AnswerB

FSx provides native SMB file sharing for Windows instances.

Why this answer

Amazon FSx for Windows File Server provides a fully managed native Windows file system that supports the SMB protocol, which is required for legacy Windows applications to access shared file systems. Amazon EFS uses NFS, which is not natively supported by Windows. EBS with multi-attach is limited to a small number of instances and not ideal for file sharing.

S3 is object storage and does not provide a traditional file system interface.

Full explanation →
607
MCQhard

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

A.Use Amazon RDS Proxy with a single database
B.Use a separate Amazon RDS instance for each microservice
C.Use Amazon DynamoDB for all microservices
D.Use a single Amazon RDS instance shared across all microservices
AnswerB

Database-per-service pattern ensures loose coupling.

Why this answer

A microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Exam trap

The trap here is that candidates may assume a single shared database (Option D) is simpler and sufficient for high availability, overlooking the critical microservices principle of decentralized data management and the operational overhead of tight coupling.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Proxy is a connection pooling service that does not address the need for database isolation; sharing a single database across microservices creates tight coupling and a single point of failure. Option C is wrong because Amazon DynamoDB is a NoSQL database that does not natively support complex relational queries (e.g., multi-table joins, subqueries) required by the existing application, making it unsuitable for this migration. Option D is wrong because using a single Amazon RDS instance shared across all microservices reintroduces the monolithic database bottleneck, violates the principle of database per service, and increases the risk of contention and cascading failures.

Full explanation →
608
MCQeasy

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

A.Amazon Kinesis Data Firehose, Amazon Redshift
B.Amazon SQS, AWS Lambda, Amazon RDS
C.AWS IoT Core, Amazon DynamoDB
D.Amazon Kinesis Data Streams, AWS Lambda, Amazon S3
AnswerD

Real-time ingestion, processing, and storage.

Why this answer

Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Exam trap

The trap here is that candidates often confuse Kinesis Data Firehose (which delivers near-real-time batches) with Kinesis Data Streams (which enables per-record real-time processing), leading them to pick Option A despite its lack of a real-time processing component.

How to eliminate wrong answers

Option A is wrong because Amazon Redshift is a data warehouse for analytics, not a real-time processing engine, and Kinesis Data Firehose delivers data in batches, not per-record processing. Option B is wrong because Amazon SQS is a message queue for decoupling components, not designed for real-time streaming ingestion, and Amazon RDS is a relational database, not suitable for high-throughput streaming data storage. Option C is wrong because AWS IoT Core ingests IoT messages but DynamoDB is a NoSQL database for low-latency queries, not a long-term analytics store like S3, and this combination lacks a real-time processing step.

Full explanation →
609
MCQmedium

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

A.Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.
B.Use an SCP to require that all IAM roles trust the corporate IdP.
C.Create IAM roles in each account with a trust policy that allows the corporate IdP.
D.Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.
AnswerA

IAM Identity Center centralizes federation and role management.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.

Exam trap

The trap here is that candidates often confuse SCPs as a mechanism to enforce trust policies, but SCPs cannot modify IAM role trust relationships; they only control the maximum permissions for IAM users and roles within an account.

How to eliminate wrong answers

Option B is wrong because Service Control Policies (SCPs) can restrict permissions but cannot enforce trust policy conditions on IAM roles; SCPs operate at the account level to control which AWS services and actions are allowed, not to modify or mandate the content of IAM role trust policies. Option C is wrong because manually creating IAM roles in each account with a trust policy for the corporate IdP is operationally complex, error-prone, and does not leverage the centralized management capabilities of IAM Identity Center; it also does not automatically synchronize role creation across accounts. Option D is wrong because while AWS CloudFormation StackSets can deploy IAM roles with a specific trust policy to multiple accounts, this approach still requires manual definition and maintenance of the trust policy and does not integrate with IAM Identity Center's automatic role provisioning and lifecycle management.

Full explanation →
610
MCQmedium

A company is migrating an application that uses an S3 bucket to store user uploads. The IAM policy above is attached to the application's IAM role. The application is experiencing permission errors when trying to list objects in the bucket. What is the most likely cause?

A.The policy allows ListBucket but the application is trying to list objects in a prefix that requires additional permissions.
B.The resource ARN for the s3:ListBucket action is incorrect. It should be arn:aws:s3:::example-bucket/*.
C.The policy is missing the s3:GetObject action on the bucket itself.
D.The policy needs a condition to restrict access to specific IP addresses.
AnswerA

Correct. The policy allows ListBucket, but if a condition restricts listing to a specific prefix, the application's attempt to list a different prefix will fail with a permission error.

Why this answer

The policy grants s3:ListBucket on the bucket resource, but it may include a condition that restricts listing to a specific prefix (e.g., s3:prefix). If the application is trying to list objects in a different prefix, the request fails with a permission error. Listing objects requires the s3:ListBucket permission on the bucket, and if the policy has a prefix condition, the application must use the allowed prefix.

Therefore, the most likely cause is that the application is attempting to list objects in a prefix that is not permitted by the policy's conditions.

Exam trap

Candidates often think that listing objects requires s3:GetObject on the bucket, but in reality, s3:GetObject is an object-level permission. However, a common trap is that the ListBucket permission may be restricted by prefix conditions, and attempting to list a different prefix causes permission errors.

Full explanation →
611
Multi-Selecteasy

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

Select 3 answers
A.An approval action in the CodePipeline stage.
B.A CloudWatch Events rule to trigger the approval action.
C.An IAM role for CodePipeline to publish to the SNS topic.
D.An AWS Lambda function to process approval requests.
E.An Amazon SNS topic to send approval notifications.
AnswersA, C, E

Required for manual approval.

Why this answer

To add a manual approval step before deployment to production, you need: an approval action in the CodePipeline stage (A), an Amazon SNS topic to send approval notifications (E), and an IAM role for CodePipeline to publish to the SNS topic (C). The approval action pauses the pipeline and sends a notification via SNS. A CloudWatch Events rule (B) is not required because the approval action itself triggers the notification, not an event.

An AWS Lambda function (D) is not needed because the approval process is handled natively by CodePipeline with SNS.

Full explanation →
612
MCQmedium

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

A.Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.
B.Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.
C.Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.
D.Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.
AnswerB

This combines prevention with SCP and remediation with Config auto-remediation.

Why this answer

It combines a Service Control Policy (SCP) to proactively deny any PutBucketEncryption action that does not specify SSE-KMS, preventing non-compliant buckets from being created, and AWS Config with a custom rule and automatic remediation via Lambda to detect and fix existing non-compliant buckets. This dual approach ensures both prevention and remediation across all accounts in the AWS Organization, meeting the security team's enforcement requirement.

Exam trap

The trap here is that candidates often confuse SCPs as a tool for retroactive remediation, when in fact SCPs only deny or allow API actions at the time of the request and cannot modify existing resources, making AWS Config with automatic remediation necessary for fixing non-compliant buckets.

How to eliminate wrong answers

Option A is wrong because AWS Resource Access Manager (RAM) can share a KMS key, but enabling default encryption in each account's S3 settings is a manual, per-account action that does not enforce compliance across all accounts and does not automatically remediate non-compliant buckets. Option C is wrong because AWS Config can detect non-compliant buckets, but a Service Control Policy (SCP) cannot enforce encryption on existing buckets—SCPs only control API actions at the time of the request and do not retroactively modify resources. Option D is wrong because AWS CloudTrail monitors API calls but does not automatically trigger remediation; while a Lambda function could be invoked via CloudTrail events, this approach only addresses new buckets and does not handle existing non-compliant buckets, nor does it prevent creation of non-compliant buckets in the first place.

Full explanation →
613
MCQmedium

A company is migrating an on-premises Microsoft SQL Server database to Amazon RDS for SQL Server. They need to minimize downtime and ensure data consistency. Which AWS service should they use for the migration?

A.AWS DataSync
B.AWS Schema Conversion Tool (SCT)
C.AWS Database Migration Service (DMS)
D.AWS Glue
AnswerC

AWS Database Migration Service (DMS) supports heterogeneous migrations with minimal downtime using continuous replication.

Why this answer

(AWS DMS) is correct because it supports homogeneous migrations with minimal downtime using continuous replication. Option A (DataSync) is for file-based data. Option B (SCT) only provides schema conversion.

Option D (Glue) is for ETL jobs.

Full explanation →
614
MCQhard

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

A.Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling
B.Use Amazon SQS standard queues with Lambda function and a dead-letter queue
C.Use Amazon SQS FIFO queues with Lambda function
D.Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue
AnswerD

Kinesis preserves order within shards; Lambda processes records sequentially; DLQ handles failures.

Why this answer

Amazon Kinesis Data Streams preserves the order of records within a shard, which maps to each device's stream when using a partition key like device ID. The Lambda function processes records from the stream, and a dead-letter queue captures any records that fail after the retry policy is exhausted, ensuring no data loss. This combination meets the requirements for ordered processing per device and fault tolerance without data loss.

Exam trap

The trap here is that candidates often assume SQS FIFO queues are the only way to guarantee ordering, but they overlook the throughput limitations and the fact that Kinesis Data Streams is designed for high-throughput, ordered stream processing with Lambda, making it the better fit for IoT-scale workloads.

How to eliminate wrong answers

Option A is wrong because Amazon Kinesis Data Firehose does not guarantee record ordering within a stream and is designed for near-real-time delivery to destinations like S3, not for ordered processing with Lambda; the SQS queue for error handling adds unnecessary complexity and does not solve the ordering requirement. Option B is wrong because Amazon SQS standard queues do not guarantee FIFO (first-in, first-out) delivery, so messages from the same device could be processed out of order, violating the ordering requirement. Option C is wrong because while Amazon SQS FIFO queues guarantee order within a message group, they have a throughput limit of 300 transactions per second (with batching) and do not natively support the high-throughput, ordered stream processing needed for thousands of IoT devices; Kinesis Data Streams scales better for this use case.

Full explanation →
615
MCQmedium

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

A.Amazon CloudFront and AWS Shield
B.AWS Global Accelerator and Amazon CloudFront
C.Amazon Route 53 and AWS Shield
D.AWS WAF and Amazon CloudFront
AnswerA

CloudFront caches content at edge, Shield protects against DDoS.

Why this answer

Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Exam trap

The trap here is that candidates often confuse AWS Global Accelerator with a CDN, but Global Accelerator does not cache content—it only optimizes network routing, making it unsuitable for content delivery without CloudFront.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator improves latency by directing traffic over the AWS global network to the optimal endpoint, but it does not provide content caching or DDoS protection at the edge; it is not a CDN. Option C is wrong because Amazon Route 53 is a DNS service that routes traffic but does not cache content or provide low-latency content delivery; AWS Shield alone does not offer CDN capabilities. Option D is wrong because AWS WAF is a web application firewall that filters HTTP/S requests but does not provide low-latency content caching or global edge distribution; it must be combined with CloudFront for CDN functionality, but the option omits Shield for DDoS protection.

Full explanation →
616
MCQhard

A company is designing a new global application that will serve users worldwide. The application uses an Application Load Balancer (ALB) in a single region. To reduce latency for users in other regions, the company wants to cache static content at edge locations. The dynamic content must still be served from the ALB. Which configuration should be used?

A.AWS Global Accelerator with the ALB as the endpoint
B.Amazon CloudFront with the ALB as the origin
C.Amazon CloudFront with multiple origins: S3 for static content and ALB for dynamic content
D.Amazon S3 Transfer Acceleration for static content
AnswerC

CloudFront can be configured with multiple origins. Static content is cached at edge locations from S3, and dynamic content is forwarded to the ALB. This reduces latency for static content.

Why this answer

It uses Amazon CloudFront with multiple origins: an S3 bucket for static content (cached at edge locations) and the ALB for dynamic content (forwarded to the origin). This configuration meets the requirement to reduce latency for static assets via edge caching while ensuring dynamic requests are always served from the ALB, avoiding stale or incorrect responses.

Exam trap

The trap here is that candidates often assume CloudFront with a single ALB origin can handle both static and dynamic content by simply enabling caching, but they overlook that caching dynamic content can lead to serving stale data; the correct solution requires separate origins and path-based routing to isolate caching behavior.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network but does not cache content at edge locations; it only optimizes network path and provides static IP addresses, not content caching. Option B is wrong because using CloudFront with only the ALB as the origin would cache both static and dynamic content at the edge, which can cause stale dynamic responses and violates the requirement that dynamic content must be served from the ALB (unless you configure cache behaviors to bypass caching for dynamic paths, but the option does not specify this and is not the best practice for mixed content). Option D is wrong because Amazon S3 Transfer Acceleration only speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache content for delivery to end users; it is a transfer optimization feature, not a content delivery network.

Full explanation →
617
MCQhard

A large enterprise is migrating to AWS and wants to implement a multi-account strategy with centralized network connectivity. The company has multiple VPCs in various accounts that need to communicate with each other and with on-premises resources. The solution must be scalable and minimize operational overhead. Which design should be used?

A.Use AWS PrivateLink to connect VPCs via interface endpoints.
B.Create a VPC peering connection between each pair of VPCs that need to communicate.
C.Set up a VPN connection from each VPC to the on-premises network and use routing to enable inter-VPC communication.
D.Use an AWS Transit Gateway in a central network account and attach all VPCs from the various accounts.
AnswerD

Transit Gateway provides scalable, transitive connectivity.

Why this answer

AWS Transit Gateway acts as a central hub for interconnecting VPCs and on-premises networks, enabling scalable, low-operational-overhead connectivity across multiple accounts. By placing the Transit Gateway in a central network account and using AWS Resource Access Manager to share it with other accounts, the enterprise can avoid the complexity of managing many individual connections while supporting transitive routing and centralized control.

Exam trap

The trap here is that candidates often confuse AWS PrivateLink (which is for service-to-service communication) with a hub-and-spoke solution, or assume VPC peering can scale linearly, ignoring the lack of transitive routing and the operational burden of managing a full mesh.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink is designed for private access to specific services or endpoints, not for transitive routing between multiple VPCs or connecting to on-premises networks; it does not replace a hub-and-spoke architecture. Option B is wrong because VPC peering does not support transitive routing, requiring a full mesh of connections (O(n²)) that becomes unscalable and operationally heavy as the number of VPCs grows. Option C is wrong because establishing individual VPN connections from each VPC to on-premises does not enable inter-VPC communication without additional routing complexity and fails to provide a centralized, scalable hub for multi-account connectivity.

Full explanation →
618
MCQeasy

A company is using AWS Lambda functions to process files uploaded to an S3 bucket. Recently, the processing time has increased significantly. A solutions architect notices that the Lambda functions are using the default VPC configuration. What is the MOST likely cause of the performance degradation?

A.Lambda function is using too much memory.
B.Lambda function is attached to a VPC, causing network latency for S3 API calls.
C.S3 bucket has versioning enabled, causing extra overhead.
D.S3 bucket is in a different region.
AnswerB

Lambda in a VPC uses ENIs and routes through NAT for internet access, adding latency.

Why this answer

Lambda functions in a VPC use an Elastic Network Interface (ENI) in a private subnet, which can add latency for internet-bound requests. Options A, C, and D do not directly cause increased processing time.

Full explanation →
619
MCQmedium

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

A.Amazon S3 Intelligent-Tiering
B.Amazon S3 Glacier Deep Archive
C.Amazon S3 Glacier with expedited retrieval
D.Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year
AnswerB

Lowest cost, retrieval within 12 hours, suitable for 7-year retention.

Why this answer

Amazon S3 Glacier Deep Archive is the most cost-effective storage class for data that must be retained for 7 years and retrieved within 24 hours, as it offers the lowest storage cost among AWS storage options while supporting retrieval times of 12–24 hours via standard retrieval. The 10 TB/year volume (70 TB total) and 24-hour retrieval window align perfectly with Glacier Deep Archive's design for long-term archival data that is rarely accessed.

Exam trap

The trap here is that candidates confuse 'retrievable within 24 hours' with 'needs fast retrieval' and choose Glacier with expedited retrieval (Option C), failing to recognize that Glacier Deep Archive's standard retrieval (12–24 hours) meets the requirement at a fraction of the cost.

How to eliminate wrong answers

Option A is wrong because S3 Intelligent-Tiering is designed for data with unknown or changing access patterns and incurs monitoring and automation fees that make it more expensive than Glacier Deep Archive for purely archival data with no frequent access needs. Option C is wrong because S3 Glacier with expedited retrieval (1–5 minutes) is significantly more expensive per GB than Glacier Deep Archive, and the 24-hour retrieval requirement does not justify the premium cost of expedited access. Option D is wrong because storing data in S3 Standard for the first year before transitioning to Glacier is more expensive than storing directly in Glacier Deep Archive from day one, as S3 Standard costs roughly 10x more per GB than Glacier Deep Archive, and the lifecycle transition itself incurs additional per-object costs.

Full explanation →
620
MCQmedium

A company is migrating a monolithic application to AWS. The application consists of a web server, an application server, and a MySQL database. The web server and application server run on the same EC2 instance. The company wants to minimize changes during migration. Which migration strategy should the architect recommend?

A.Refactor the application into microservices on Amazon ECS
B.Replatform by migrating the database to Amazon RDS
C.Rehost using AWS Application Migration Service (AWS MGN)
D.Retire the application and replace it with a SaaS solution
AnswerC

Rehosting moves the application with minimal changes, which aligns with the requirement to minimize changes.

Why this answer

Rehosting (lift-and-shift) moves the application as-is to EC2, requiring minimal changes. Replatforming would involve changes like using RDS. Refactoring would require code changes.

Retiring is not applicable as the application is still needed.

Full explanation →
621
MCQhard

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

A.Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.
B.Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.
C.Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.
D.Share the EC2 console credentials of each account with the DevOps team.
AnswerA

Cross-account IAM roles allow centralized management without sharing credentials.

Why this answer

It uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Exam trap

The trap here is that candidates often confuse Service Control Policies (SCPs) with IAM policies, thinking SCPs can grant permissions, when in fact SCPs only provide a guardrail by denying or allowing permissions that are then further restricted by IAM policies.

How to eliminate wrong answers

Option B is wrong because installing the Systems Manager agent alone does not provide cross-account management; IAM roles are required to authenticate and authorize actions across accounts, and without them, the central account cannot interact with instances in other accounts. Option C is wrong because Service Control Policies (SCPs) are used to restrict permissions across accounts in an organization, not to grant permissions; they cannot be assigned to an IAM role and do not allow actions by themselves. Option D is wrong because sharing EC2 console credentials violates the principle of least privilege and security best practices, and it does not use Systems Manager for centralized management; it also gives direct access to target accounts, which the requirement explicitly forbids.

Full explanation →
622
MCQhard

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

A.Use Amazon ECS with Fargate launch type, defining services across multiple AZs.
B.Use AWS Lambda functions for each microservice, triggered by API Gateway.
C.Deploy each microservice on Amazon EC2 instances in an Auto Scaling group across AZs.
D.Use Amazon EKS with worker nodes on EC2, and deploy microservices as Kubernetes pods.
AnswerA

Fargate manages containers serverlessly, reducing overhead and enabling multi-AZ deployment.

Why this answer

Amazon ECS with Fargate is the best choice because it provides serverless container orchestration, automatically managing infrastructure and scaling. By deploying services across multiple Availability Zones, it ensures high availability and low-latency communication without the operational overhead of managing EC2 instances or Kubernetes control planes. AWS Lambda introduces cold start latency and a 15-minute execution limit, making it unsuitable for strict latency requirements and long-running microservices.

EC2 instances and EKS require more operational overhead for patching and scaling. Fargate minimizes that overhead while meeting latency and multi-AZ requirements.

Exam trap

The trap here is that candidates often choose Lambda for its serverless simplicity, but fail to consider the cold start latency and 15-minute execution limit that make it unsuitable for strict latency requirements and long-running microservices.

How to eliminate wrong answers

Option B is wrong because AWS Lambda functions have a maximum execution timeout of 15 minutes and are not designed for long-running or stateful microservices; they also introduce cold start latency that can violate strict latency requirements. Option C is wrong because managing EC2 instances in an Auto Scaling group requires significant operational overhead for patching, scaling, and capacity planning, which does not minimize operational overhead. Option D is wrong because Amazon EKS with worker nodes on EC2 requires managing the Kubernetes control plane and worker node lifecycle, adding operational complexity that contradicts the requirement to minimize operational overhead.

Full explanation →
623
Multi-Selectmedium

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

Select 2 answers
A.Amazon EFS
B.AWS Storage Gateway (File Gateway)
C.AWS Snowball Edge
D.AWS Direct Connect
E.Amazon S3
AnswersB, E

Provides low-latency access to S3 from on-premises.

Why this answer

AWS Storage Gateway (File Gateway) provides a low-latency, on-premises cache for frequently accessed data while asynchronously uploading the underlying data to Amazon S3 for durable backup. This hybrid architecture allows applications to access data with local file-system performance while leveraging S3 as the backup target, meeting both the low-latency and backup requirements.

Exam trap

The trap here is that candidates often confuse AWS Storage Gateway (File Gateway) with Amazon EFS, thinking EFS can serve as a hybrid cache, but EFS lacks the on-premises caching component required for low-latency hybrid access.

Full explanation →
624
MCQhard

A company is designing a new cloud-native application that will be deployed across multiple AWS Regions for high availability. The application uses Amazon Aurora Global Database for its primary data store. The company needs to ensure that in the event of a regional failure, the secondary region can be promoted to primary with minimal data loss. Which configuration should be used?

A.Use Aurora Serverless v2 with data replication across regions using Database Migration Service (DMS).
B.Deploy Aurora Multi-AZ in the primary region and use a secondary region as a warm standby.
C.Use Aurora Global Database with one primary region and one secondary region. Enable managed failover with a Recovery Point Objective (RPO) of 1 second.
D.Configure Aurora Cross-Region Read Replicas and use Amazon Route 53 for DNS failover.
AnswerC

Aurora Global Database provides cross-region replication with low RPO and managed failover.

Why this answer

Amazon Aurora Global Database is specifically designed for cross-region disaster recovery with a typical RPO of 1 second and RTO of less than 1 minute when managed failover is enabled. It uses a storage-based replication layer that replicates data from the primary to secondary regions with minimal latency, ensuring that in a regional failure, the secondary region can be promoted to primary with very little data loss.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have higher replication lag and require manual promotion) with Aurora Global Database's managed failover (which provides sub-second RPO and automated promotion), leading them to choose option D instead of C.

How to eliminate wrong answers

Option A is wrong because Aurora Serverless v2 does not support cross-region replication natively, and AWS Database Migration Service (DMS) is a migration tool, not a real-time replication solution for high availability; it introduces significant latency and potential data loss. Option B is wrong because Aurora Multi-AZ provides high availability within a single region, not across regions, and using a secondary region as a warm standby without global database replication would require manual backup restore or other mechanisms, resulting in higher RPO and RTO. Option D is wrong because Aurora Cross-Region Read Replicas use asynchronous replication with a typical RPO of seconds to minutes, and while Route 53 can handle DNS failover, the replication lag is not guaranteed to be as low as 1 second, and promoting a read replica to primary is a manual process that can take several minutes, leading to higher data loss.

Full explanation →
625
Multi-Selectmedium

A company is deploying a web application that uses an Application Load Balancer and an Auto Scaling group of EC2 instances. The application must be able to handle sudden spikes in traffic. Which TWO actions should the Solutions Architect take to improve scalability and reduce latency? (Choose two.)

Select 2 answers
A.Enable HTTP/2 on the Application Load Balancer.
B.Increase the default cooldown period for the Auto Scaling group.
C.Use larger EC2 instance types for the Auto Scaling group.
D.Configure the Auto Scaling group to use a predictive scaling policy.
E.Increase the health check interval on the Application Load Balancer.
AnswersA, D

HTTP/2 allows multiplexing, reducing latency and improving throughput.

Why this answer

Options A and D are correct. Option A: Enabling HTTP/2 on the ALB reduces latency through multiplexing and connection reuse. Option D: Using a predictive scaling policy helps prepare for traffic spikes by scaling based on forecasted demand.

Option B is incorrect because increasing the cooldown period delays scaling response. Option C is incorrect because using larger instances is vertical scaling, which does not improve horizontal scalability and may increase cost. Option E is incorrect because increasing the health check interval delays detection of unhealthy instances.

Full explanation →
626
MCQmedium

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

A.Amazon SQS, AWS Lambda, Amazon S3
B.Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3
C.Amazon MQ, AWS Lambda, Amazon RDS
D.Amazon Kinesis Data Streams, AWS Lambda, Amazon S3
AnswerD

Kinesis Data Streams ingests streaming data, Lambda processes it, S3 stores it.

Why this answer

Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Exam trap

The trap here is that candidates confuse Amazon SQS with Kinesis Data Streams for real-time streaming, but SQS is a pull-based queue with no ordered replay or shard-level parallelism, making it unsuitable for high-throughput IoT data ingestion.

How to eliminate wrong answers

Option A is wrong because Amazon SQS is a message queue for decoupled communication, not designed for real-time streaming ingestion from thousands of IoT devices; it lacks the shard-based parallelism and ordered replay capabilities needed for streaming data. Option B is wrong because Amazon Redshift is a data warehouse for analytics, not a low-latency processing target; using Kinesis Data Firehose with Redshift adds unnecessary latency and cost for real-time processing, and the requirement specifies storing in S3, not Redshift. Option C is wrong because Amazon MQ is a managed message broker for JMS-compatible applications, not optimized for high-throughput streaming from IoT devices; Amazon RDS is a relational database, not suitable for storing streaming data for analytics in S3.

Full explanation →
627
MCQmedium

A company runs a critical web application on EC2 instances in an Auto Scaling group across three Availability Zones. The application uses an Application Load Balancer (ALB) with a target group that has health checks configured. Recently, the operations team noticed that during a deployment, the ALB started routing traffic to a new instance before it was ready to serve requests, causing a brief period of errors. The team wants to ensure that new instances are fully initialized and ready before receiving traffic. The application takes about 30 seconds to start up. Current health check settings: health check protocol HTTP, path /, interval 30 seconds, timeout 5 seconds, healthy threshold 2, unhealthy threshold 2. The deployment uses the Auto Scaling group's instance refresh feature. Which of the following is the MOST effective way to prevent traffic from being sent to instances that are not ready?

A.Implement a lifecycle hook in the Auto Scaling group that waits for the instance to signal readiness. Also, configure the target group health check with a longer interval and a higher healthy threshold to ensure the instance is fully operational.
B.Increase the health check interval to 60 seconds and the healthy threshold to 5.
C.Use the Auto Scaling group's instance refresh feature with a warm-up time of 60 seconds.
D.Use AWS Global Accelerator to pre-warm the endpoints before directing traffic.
AnswerA

Lifecycle hooks can pause the instance launch until the application signals that it is ready, and the health check can be tuned to match the startup time.

Why this answer

It uses a lifecycle hook to pause the instance until it signals readiness (e.g., via a custom script that completes initialization), and then configures the target group health check with a longer interval and higher healthy threshold to ensure the instance is fully operational before receiving traffic. This prevents the ALB from routing traffic to an instance that is not yet ready. Option B is wrong because simply increasing the health check interval and threshold does not guarantee the instance has finished its startup process; it may still fail if the application is not ready when the first health check occurs (if the instance takes 30 seconds and interval is 60, the first check is at 60 seconds, but the threshold of 5 means it needs 5 consecutive successes, which delays traffic but doesn't ensure the instance is fully functional from the start).

Option C is wrong because the instance refresh warm-up time only delays the start of the refresh process, not the time before an instance receives traffic; it does not integrate with application readiness. Option D is wrong because AWS Global Accelerator does not pre-warm endpoints; it provides static IP addresses and improves performance but does not handle application readiness checks.

Full explanation →
628
MCQmedium

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

A.Amazon SNS
B.Amazon Kinesis Data Streams
C.AWS Step Functions
D.Amazon SQS
AnswerD

SQS provides a reliable, scalable, and fully managed message queue that decouples web and application tiers.

Why this answer

Amazon SQS is the correct choice because it provides a fully managed message queuing service that enables asynchronous communication between decoupled application tiers. The web tier can send messages to an SQS queue, and the application tier can poll and process those messages independently, which improves scalability and resilience by allowing each tier to scale and fail independently.

Exam trap

The trap here is that candidates often confuse SNS (pub/sub push model) with SQS (queue pull model) for decoupling tiers, but SNS does not provide the buffering and independent consumption needed for asynchronous decoupling between a web tier and an application tier.

How to eliminate wrong answers

Option A is wrong because Amazon SNS is a pub/sub messaging service that pushes messages to subscribers, not a queue for point-to-point asynchronous decoupling; it does not provide the buffering and independent consumption that SQS offers. Option B is wrong because Amazon Kinesis Data Streams is designed for real-time streaming of large data volumes, not for simple message queuing between application tiers, and it introduces unnecessary complexity and cost for this use case. Option C is wrong because AWS Step Functions is a serverless orchestration service for coordinating multiple AWS services into workflows, not a message queue for decoupling tiers; it is used for state machines, not for basic asynchronous message passing.

Full explanation →
629
MCQhard

A company is migrating a legacy Java-based customer relationship management (CRM) system from on-premises to AWS. The application currently runs on a single physical server with a monolithic architecture. The application stores data in an Oracle database on a separate server. The company has purchased a third-party migration tool that can convert Oracle stored procedures to Amazon Aurora PostgreSQL-compatible code. The migration team has successfully migrated the database to Aurora PostgreSQL using AWS DMS with ongoing CDC. The application now runs on a single EC2 instance in a test environment. However, during load testing, the application experiences high latency and intermittent timeouts when accessing the database. The team notices that the application makes many short-lived database connections and uses a connection pool that was configured for the on-premises environment. The team has also observed that the application logs show a high number of connection timeouts. The company wants to modernize the application to be highly available and scalable on AWS. Which combination of actions should the team take to resolve the performance issues and achieve the company's goals?

A.Deploy the application on Amazon ECS with Fargate, and use Amazon RDS Proxy to manage database connections efficiently. Refactor the application to separate components into multiple microservices.
B.Use Amazon ElastiCache to cache database query results and reduce the number of direct database connections. Keep the application on a single EC2 instance but use an Auto Scaling group with a minimum of one instance.
C.Increase the connection pool size in the application configuration to handle more concurrent requests. Then deploy the application on a larger EC2 instance to handle the load.
D.Migrate the application to run on AWS Lambda with a connection pool managed by the Lambda function. Use Amazon RDS Proxy to handle the database connections.
AnswerA

Correct. RDS Proxy reduces connection overhead, and microservices enable scalability and HA.

Why this answer

The issue is likely due to the connection pool being inefficient for the cloud environment and the monolithic architecture not scaling. Deploying the application as microservices on containers with an RDS Proxy for connection pooling addresses both performance and high availability. Simply increasing connection pool size may overwhelm the database.

Using Lambda would require significant refactoring. Vertical scaling does not provide high availability.

Full explanation →
630
MCQmedium

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

A.Amazon S3 bucket mounted using s3fs
B.Amazon FSx for Lustre
C.Amazon EBS volume
D.Amazon EFS file system
AnswerD

EFS provides a shared file system that can be mounted by multiple containers.

Why this answer

Amazon EFS provides a shared, persistent, and scalable NFS file system that can be mounted concurrently by multiple containers within the same ECS task using Fargate. EFS supports the NFSv4.1 protocol, enabling simultaneous read/write access from multiple containers, which meets the requirement for shared persistent storage across containers in the same task.

Exam trap

The trap here is that candidates often confuse Amazon EBS with a shared storage solution, but EBS volumes are zonal and single-instance attachable, making them incompatible with multi-container sharing in Fargate, whereas EFS is the only AWS-native, shared, persistent file system that works seamlessly with Fargate.

How to eliminate wrong answers

Option A is wrong because Amazon S3 mounted via s3fs is an object storage solution that does not provide true POSIX file system semantics, and s3fs is a third-party FUSE implementation that can introduce performance and consistency issues, making it unsuitable for shared persistent storage across containers in a Fargate task. Option B is wrong because Amazon FSx for Lustre is designed for high-performance computing workloads with low-latency access to data, but it is not natively integrated with ECS Fargate and requires a managed Lustre client, which is not supported in the Fargate environment. Option C is wrong because Amazon EBS volumes are block-level storage that can only be attached to a single EC2 instance at a time; they cannot be shared across multiple containers in the same ECS task, and Fargate does not support direct EBS volume attachments.

Full explanation →
631
MCQeasy

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

A.Configure each account's CloudTrail to send logs to a central CloudWatch Logs group
B.Create a CloudTrail trail in each account and deliver logs to the same S3 bucket
C.Create an organization trail in the management account that is enabled for all accounts
D.Use S3 replication to copy logs from individual account buckets to a central bucket
AnswerC

Organization trails automatically apply to all accounts in the organization.

Why this answer

AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Exam trap

The trap here is that candidates may think individual trails per account (Option B) are necessary or simpler, but AWS Organizations provides a native, centralized mechanism that automatically includes all accounts without per-account configuration.

How to eliminate wrong answers

Option A is wrong because CloudTrail cannot send logs directly to a CloudWatch Logs group; it can send events to CloudWatch Logs, but the question specifies centralizing logs into a single S3 bucket, not a CloudWatch Logs group. Option B is wrong because creating individual trails in each account and delivering to the same S3 bucket would require manual setup per account, does not leverage AWS Organizations integration, and may cause permission issues or log duplication without centralized management. Option D is wrong because S3 replication copies objects after they are written, but it does not address the initial delivery of CloudTrail logs from multiple accounts; each account would still need its own trail and bucket, adding complexity and cost.

Full explanation →
632
Multi-Selecthard

A company is replatforming a legacy application to use AWS managed services. The application consists of a web server, an application server, and a MySQL database. Which THREE AWS services should the company use to modernize the architecture? (Choose THREE.)

Select 3 answers
A.Amazon ElastiCache
B.Amazon EBS
C.Elastic Load Balancing
D.Amazon Route 53
E.Amazon EC2
.Amazon RDS for MySQL
AnswersA, C

ElastiCache provides managed caching.

Why this answer

To modernize the legacy application to use AWS managed services, the company should use Amazon RDS for MySQL to replace the self-managed MySQL database, Elastic Load Balancing to distribute traffic across web/application servers, and Amazon ElastiCache to add caching for improved performance. Amazon EBS is a block storage service, not a managed compute or database service. Amazon Route 53 is a DNS service and not relevant to the application architecture modernization in this context.

Amazon EC2 is an unmanaged compute service, which does not align with the goal of using managed services.

Full explanation →
633
MCQeasy

A company uses a single AWS account for development and production workloads. To improve security and cost allocation, the company decides to separate environments into multiple accounts. What is the PRIMARY benefit of using multiple accounts?

A.Reducing overall compute costs by sharing reserved instances across environments.
B.Simplifying backup and disaster recovery procedures.
C.Decreasing network latency between development and production environments.
D.Enabling centralized security controls and consolidated billing.
AnswerD

Multiple accounts allow SCPs and consolidated billing through AWS Organizations.

Why this answer

Separating environments into multiple AWS accounts provides a strong security boundary (via AWS Organizations SCPs) and enables consolidated billing with cost allocation tags. This allows centralized security controls (e.g., guardrails, IAM policies) across accounts while aggregating usage for volume discounts, which is the primary benefit for improving security and cost allocation.

Exam trap

The trap here is that candidates confuse the secondary benefit of cost savings (shared RIs) with the primary benefit of security isolation and centralized governance, which is the core reason for multi-account strategies in the SAP-C02 exam.

How to eliminate wrong answers

Option A is wrong because sharing Reserved Instances across accounts is possible with consolidated billing, but this is a cost-saving benefit, not the primary security and cost allocation benefit of multi-account separation. Option B is wrong because backup and disaster recovery procedures are not inherently simplified by multiple accounts; they often require cross-account replication and additional orchestration. Option C is wrong because network latency between environments is not decreased by separate accounts; in fact, inter-account traffic typically adds latency compared to intra-VPC communication within a single account.

Full explanation →
634
Multi-Selecteasy

A company wants to centrally manage IAM users across multiple AWS accounts using AWS IAM Identity Center (successor to AWS Single Sign-On). Which of the following are true? (Choose TWO.)

Select 2 answers
A.Users can be granted access to multiple accounts from a central location.
B.Users must be IAM users in each account.
C.Identity Center requires an on-premises Active Directory.
D.Permission sets are assigned to IAM roles in the management account.
E.Users can be created in the Identity Center directory.
AnswersA, E

Identity Center provides centralized access management.

Why this answer

AWS IAM Identity Center provides a central location where you can create users and groups, and then grant them single sign-on access to multiple AWS accounts and business applications. This eliminates the need to manage separate IAM users in each account, as permissions are assigned centrally through permission sets that map to IAM roles in the target accounts.

Exam trap

The trap here is that candidates often confuse permission sets with IAM roles in the management account, but permission sets are actually applied to roles created in the member accounts, not the management account.

Full explanation →
635
Multi-Selecthard

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

Select 2 answers
A.Use Auto Scaling groups to automatically replace unhealthy instances.
B.Deploy application across multiple Availability Zones.
C.Manually create EBS snapshots every day.
D.Store data in a single Amazon S3 bucket in one Region.
E.Use a single large EC2 instance to simplify management.
AnswersA, B

Auto Scaling helps maintain desired capacity.

Why this answer

Auto Scaling groups can automatically replace unhealthy EC2 instances by performing health checks and launching new instances to maintain desired capacity, which is a core principle of fault-tolerant design. Option B is correct because deploying across multiple Availability Zones ensures that if one AZ fails, the application continues to operate from another AZ, providing high availability and fault tolerance.

Exam trap

The trap here is that candidates often confuse data backup strategies (like EBS snapshots) with high availability design, or they mistakenly believe that a single large instance or a single-region storage approach is sufficient for fault tolerance, ignoring the need for redundancy and automated recovery.

Full explanation →
636
MCQeasy

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

A.AWS Systems Manager
B.AWS Config
C.Amazon ECS
D.AWS OpsWorks
AnswerA

Systems Manager Run Command and Session Manager can target instances across accounts.

Why this answer

AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Exam trap

The trap here is that candidates may confuse AWS Config's compliance and auditing capabilities with Systems Manager's operational command execution, or mistakenly think OpsWorks (which also uses agents) is suitable for cross-account command execution, but OpsWorks lacks native cross-account centralized command features and is more focused on application lifecycle management.

How to eliminate wrong answers

Option B (AWS Config) is wrong because AWS Config is a service for evaluating, auditing, and recording resource configurations and compliance over time, not for executing commands on EC2 instances. Option C (Amazon ECS) is wrong because Amazon ECS is a container orchestration service for running Docker containers, not a tool for managing EC2 instances or running commands on them. Option D (AWS OpsWorks) is wrong because AWS OpsWorks is a configuration management service that uses Chef or Puppet, but it is designed for managing stacks and applications, not for centralized cross-account command execution on EC2 instances; it also requires agents and is more complex for simple command execution.

Full explanation →
637
MCQmedium

A company is designing a new solution to host a static website with global audience. The website content includes HTML, CSS, JavaScript, and images. The company wants to minimize latency for users worldwide and reduce the load on the origin server. The origin server is an Amazon S3 bucket configured for static website hosting. Which solution should be used to achieve these goals?

A.Use AWS Global Accelerator to route traffic to the S3 bucket.
B.Use AWS Lambda@Edge to serve content from edge locations.
C.Use Amazon CloudFront as a content delivery network (CDN) in front of the S3 bucket.
D.Enable S3 Transfer Acceleration on the bucket.
AnswerC

CloudFront caches content at edge locations, reducing latency and origin load.

Why this answer

Amazon CloudFront is a global content delivery network (CDN) that caches static content (HTML, CSS, JavaScript, images) at edge locations worldwide, significantly reducing latency for a global audience. By placing CloudFront in front of an S3 bucket configured for static website hosting, it offloads requests from the origin server, reducing load and improving performance. CloudFront also supports features like custom SSL, geo-restriction, and origin shield to further optimize delivery.

Exam trap

The trap here is confusing content delivery (CloudFront) with network acceleration (Global Accelerator) or upload acceleration (S3 Transfer Acceleration), leading candidates to pick options that improve network routing but do not cache or serve static content at edge locations.

How to eliminate wrong answers

Option A is wrong because AWS Global Accelerator improves performance by routing traffic over the AWS global network to the optimal regional endpoint, but it does not cache content at edge locations; it is designed for TCP/UDP traffic and dynamic content, not for reducing load on an S3 static website origin. Option B is wrong because AWS Lambda@Edge runs custom code at CloudFront edge locations to modify requests/responses, but it is not a content delivery service itself; it requires CloudFront to be in place and cannot serve static content directly from edge locations without a CDN. Option D is wrong because S3 Transfer Acceleration speeds up uploads to S3 over long distances using AWS edge locations, but it does not cache or serve content to end users; it is designed for uploads, not for reducing latency for a global audience downloading static website content.

Full explanation →
638
MCQeasy

A company uses AWS Organizations with multiple accounts. The network team wants to centrally manage Amazon VPC IP addresses using Amazon VPC IP Address Manager (IPAM). They have enabled IPAM in the management account and delegated an administrator account. However, the delegated administrator account cannot create IPAM pools. What is the most likely cause?

A.The delegated administrator account does not have the required IAM permissions to manage IPAM
B.IPAM must be used only from the management account and cannot be delegated
C.IPAM is not supported in the AWS Region where the delegated administrator account operates
D.An SCP in the organization denies IPAM actions for all accounts
AnswerA

IAM permissions are necessary for the delegated account to perform IPAM actions.

Why this answer

When you delegate an administrator account for IPAM in AWS Organizations, that account still requires explicit IAM permissions to perform IPAM actions such as creating pools. The delegation only allows the account to manage IPAM resources on behalf of the organization; it does not automatically grant the necessary IAM permissions. Without a policy that allows actions like `ec2:CreateIpamPool`, the delegated administrator will receive an authorization error.

Exam trap

The trap here is that candidates often assume delegation in AWS Organizations automatically grants full administrative permissions, but in reality, IAM policies are still required for the delegated account to perform specific actions.

How to eliminate wrong answers

Option B is wrong because IPAM does support delegation to a member account within AWS Organizations; it is not restricted to the management account only. Option C is wrong because IPAM is available in multiple AWS Regions, and the question does not indicate that the Region is unsupported; the issue is permissions, not regional availability. Option D is wrong because while an SCP could deny IPAM actions, the question states that the delegated administrator cannot create pools, which is most commonly due to missing IAM permissions rather than an SCP, and SCPs affect all accounts in the organization uniformly, not just the delegated administrator.

Full explanation →
639
MCQmedium

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

A.Enable CloudWatch Logs for Lambda and create a metric filter to trigger an alarm.
B.Use Amazon EventBridge to capture Lambda errors and route them to a recovery function.
C.Configure an SQS queue as the Lambda event source with a dead-letter queue for failed messages.
D.Publish failed invocation details to an SNS topic and subscribe a Lambda function to process them.
AnswerC

SQS provides reliable message delivery and retries; dead-letter queue captures messages that exceed retry attempts.

Why this answer

An SQS queue configured as a Lambda event source provides reliable invocation with retry logic, and a dead-letter queue (DLQ) captures messages that fail after all retries, preventing loss. Option A is wrong because CloudWatch Logs capture logs but do not capture or retry failed invocations. Option B is wrong because EventBridge can capture errors but does not provide built-in retry or a DLQ for Lambda throttling.

Option D is wrong because SNS publishes messages but does not store them for retry; if the subscriber fails, the message is lost unless additional mechanisms are implemented.

Exam trap

Candidates often confuse EventBridge with SQS for managing retries, but SQS with a DLQ is the standard pattern for reliable invocation and failure handling in Lambda.

Full explanation →
640
Multi-Selecteasy

A company is planning to migrate a large .NET application to AWS. The application uses IIS and SQL Server. Which TWO AWS services can be used to rehost the application with minimal changes?

Select 2 answers
A.Amazon Aurora
B.Amazon EC2 with Windows Server
C.AWS Elastic Beanstalk
D.Amazon RDS for SQL Server
E.AWS Lambda
AnswersB, D

EC2 can host IIS with minimal changes.

Why this answer

(Amazon EC2 with Windows Server) and Option D (Amazon RDS for SQL Server) are correct. EC2 allows rehosting the web server, and RDS for SQL Server provides a managed database. Option A (Amazon Aurora) is not SQL Server compatible.

Option C (AWS Elastic Beanstalk) may require changes. Option E (AWS Lambda) is for serverless.

Full explanation →
641
MCQeasy

A company is migrating a critical application to AWS and wants to ensure business continuity during the cutover. The migration plan includes a pilot light strategy. Which of the following BEST describes the pilot light pattern?

A.Take regular backups and restore them in AWS during cutover.
B.Run a scaled-down but fully functional version of the environment in AWS at all times.
C.Replicate data to AWS and run a minimal version of the application that can be scaled up during cutover.
D.Run the application simultaneously in both environments and route traffic to both.
AnswerC

Correct definition of pilot light.

Why this answer

The pilot light pattern is a disaster recovery strategy where core data is continuously replicated to AWS, and a minimal version of the application (e.g., a small EC2 instance running the application stack) is kept running. During cutover, this minimal environment is rapidly scaled up to full production capacity. This matches option C, as it describes replicating data and running a minimal version that can be scaled up.

Exam trap

The trap here is confusing the pilot light pattern with the warm standby pattern, as both involve a running environment in AWS, but pilot light uses a minimal stack that is not fully functional until scaled up, whereas warm standby runs a fully functional scaled-down version.

How to eliminate wrong answers

Option A is wrong because taking regular backups and restoring them is a backup-and-restore strategy, not a pilot light pattern; it has a higher recovery time objective (RTO) and does not maintain a running environment. Option B is wrong because running a scaled-down but fully functional version at all times describes the warm standby pattern, not the pilot light; pilot light keeps only the core data and a minimal application stack, not a fully functional environment. Option D is wrong because running the application simultaneously in both environments and routing traffic to both describes a multi-site active-active pattern, which is not the pilot light pattern.

Full explanation →
642
Matchingmedium

Match each AWS migration service to its function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts
Matches

Track migration progress across multiple tools

Automate migration of on-premises servers to AWS

Migrate databases to AWS with minimal downtime

Rehost applications from physical or virtual servers

Simplify, automate, and accelerate moving data to AWS

Why these pairings

AWS Migration Hub centralizes tracking, SMS automates server replication, DMS handles database migration, and Application Discovery Service discovers on-premises assets.

Full explanation →
643
MCQhard

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

A.Network Load Balancer (NLB) with target group stickiness.
B.Application Load Balancer (ALB) with stickiness and SSL termination.
C.Classic Load Balancer (CLB) with SSL termination at the instance.
D.AWS Lambda with API Gateway.
AnswerA

NLB supports TLS termination and sticky sessions via target group stickiness (source IP affinity). This makes it a valid option for the requirements.

Why this answer

Network Load Balancer (NLB) supports TLS termination at the listener level and provides sticky sessions through target group stickiness (source IP affinity). This meets the requirements for containerized microservices on Amazon ECS with Fargate. Application Load Balancer (ALB) also supports sticky sessions and SSL termination, but NLB is more cost-effective for high-throughput scenarios and works well with Fargate.

Options C and D are incorrect because Classic Load Balancer is legacy and lacks advanced features, while AWS Lambda with API Gateway is not a load balancer and cannot directly provide sticky sessions.

Exam trap

Many assume that only ALB can provide sticky sessions and SSL termination. However, NLB supports both: TLS termination at the listener and target group stickiness via source IP. NLB is often the better choice for performance-sensitive workloads.

Full explanation →
644
MCQhard

A company is migrating a critical application to AWS. The application must be highly available across two Availability Zones. The migration plan includes rehosting the application on EC2 instances in an Auto Scaling group behind an ALB. Which configuration ensures that the application remains available during an Availability Zone failure?

A.Use an Auto Scaling group with a minimum of 2 across two Availability Zones, with a distribution strategy of 'balanced best effort'
B.Use an Auto Scaling group with a minimum of 1 and maximum of 10 across two AZs
C.Launch instances in a single Availability Zone with multiple subnets
D.Launch instances in two Availability Zones but place all instances in the same subnet
AnswerA

Auto Scaling group with minimum 2 across two AZs ensures at least one instance per AZ.

Why this answer

It uses a minimum of 2 instances across two Availability Zones with the 'balanced best effort' distribution strategy. This ensures that instances are evenly distributed across AZs, with at least one instance per AZ. If one AZ fails, the other AZ still has an instance to serve traffic.

Option B is incorrect because a minimum of 1 and maximum of 10 does not guarantee at least one instance per AZ; the Auto Scaling group could place all instances in one AZ. Option C is incorrect because a single AZ is a single point of failure; if that AZ fails, all instances are lost. Option D is incorrect because placing all instances in the same subnet (which is in a single AZ) does not provide AZ-level fault tolerance.

Full explanation →
645
MCQmedium

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

A.Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.
B.Use the AWS Config aggregator to manually enable the rule in each account.
C.Use AWS CloudFormation StackSets to deploy a Config rule template to each account.
D.Create an SCP that requires all accounts to enable AWS Config.
AnswerA

Conformance packs can be deployed organization-wide.

Why this answer

AWS Config conformance packs can be deployed across all accounts in an AWS Organization using the AWS Organizations integration. Conformance packs allow you to deploy a collection of AWS Config rules and remediation actions consistently. Option B is incorrect because the AWS Config aggregator only provides a central view of compliance status; it does not automatically enable rules in member accounts.

Option C is incorrect: while CloudFormation StackSets can deploy Config rules, conformance packs are the recommended and more straightforward method for deploying Config rules across an organization. Option D is incorrect because SCPs (Service Control Policies) are used to manage permissions and cannot directly enforce AWS Config rules.

Full explanation →
646
Multi-Selectmedium

A company is migrating a multi-tier application to AWS and wants to modernize by using containers and serverless technologies. The application consists of a Node.js frontend, a Java backend, and a PostgreSQL database. The company wants to reduce operational overhead and improve scalability. Which TWO strategies should the company use? (Choose two.)

Select 2 answers
A.Refactor the Node.js frontend to run on AWS Lambda with Amazon API Gateway
B.Migrate the database to Amazon RDS for PostgreSQL
C.Migrate the database to Amazon DynamoDB
D.Deploy the Java backend on Amazon ECS with AWS Fargate
E.Deploy the Java backend on Amazon EC2 with Auto Scaling
AnswersB, D

RDS reduces operational overhead compared to managing PostgreSQL on EC2.

Why this answer

Amazon RDS for PostgreSQL reduces operational overhead by managing backups, patching, and replication, while providing scalability through read replicas and storage auto-scaling. This aligns with the goal of modernizing the database layer without changing the database engine, avoiding the need to refactor the application to use a NoSQL database like DynamoDB.

Exam trap

The trap here is that candidates often assume that any use of containers or serverless must involve Lambda, but for stateful or long-running Java backends, ECS with Fargate is more appropriate than Lambda, and DynamoDB is not a drop-in replacement for PostgreSQL without significant application changes.

Full explanation →
647
MCQhard

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

A.Use AWS Config rules with auto-remediation using SSM Automation.
B.Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.
C.Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.
D.Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.
AnswerD

This option uses a service control policy (SCP) to deny the s3:PutBucketEncryption action unless encryption is set. This proactively prevents the creation of non-compliant buckets and requires minimal ongoing maintenance.

Why this answer

A service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly.

Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.

Full explanation →
648
MCQeasy

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

A.Amazon RDS for MySQL
B.Amazon ElastiCache
C.Amazon Aurora
D.Amazon DynamoDB
AnswerD

DynamoDB is a fully managed NoSQL database with low latency and auto-scaling.

Why this answer

Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports auto-scaling of read/write capacity based on traffic patterns, enabling the application to handle sudden spikes in read traffic without manual intervention.

Exam trap

The trap here is that candidates may confuse Amazon ElastiCache (a caching layer) with a primary NoSQL database, or assume that Amazon Aurora's MySQL compatibility makes it a NoSQL option, when in fact DynamoDB is the only fully managed NoSQL service among the choices that meets the latency and auto-scaling requirements.

How to eliminate wrong answers

Option A is wrong because Amazon RDS for MySQL is a relational database, not a NoSQL database, and it requires manual scaling or configuration of read replicas to handle traffic spikes. Option B is wrong because Amazon ElastiCache is an in-memory caching service, not a primary database; it is used to accelerate access to data stored elsewhere, not as a fully managed NoSQL database with its own persistence. Option C is wrong because Amazon Aurora is a relational database engine compatible with MySQL and PostgreSQL, not a NoSQL database, and while it offers auto-scaling storage, it does not natively auto-scale read capacity for sudden spikes without manual provisioning of Aurora Replicas.

Full explanation →
649
MCQmedium

A company uses AWS Organizations with a multi-account strategy. The security team wants to restrict the use of specific instance types across all accounts. What is the MOST effective way to enforce this policy?

A.Create an IAM policy in each account that denies launching non-approved instance types.
B.Use AWS Config rules to detect non-compliant instances and trigger an AWS Lambda function to terminate them.
C.Create a Service Control Policy (SCP) that denies ec2:RunInstances for all users and then attach it to the root OU.
D.Create a Service Control Policy (SCP) that denies ec2:RunInstances if the instance type is not allowed, and attach it to the root organizational unit.
AnswerD

SCPs apply to all accounts in the OU.

Why this answer

A Service Control Policy (SCP) attached to the root organizational unit (OU) can centrally deny the ec2:RunInstances action for non-approved instance types across all member accounts without requiring per-account configuration. SCPs act as a permission guardrail that applies to all IAM users, roles, and root users in the affected accounts, making them the most effective mechanism for enforcing organization-wide restrictions on instance types.

Exam trap

The trap here is confusing SCPs with IAM policies or detective controls; candidates often pick Option B (AWS Config) because it seems automated, but SCPs are the only preventive, centrally managed mechanism that blocks the action before it occurs.

How to eliminate wrong answers

Option A is wrong because creating an IAM policy in each account is not centrally managed; it requires manual effort per account, can be bypassed by the root user, and does not prevent a user with full administrative privileges from launching any instance type. Option B is wrong because AWS Config rules are detective, not preventive; they detect non-compliant instances after launch and rely on a Lambda function to terminate them, which introduces latency and potential cost from running instances before termination. Option C is wrong because it denies ec2:RunInstances for all users unconditionally, which would block all instance launches entirely, not just non-approved types; it lacks the condition to allow approved instance types.

Full explanation →
650
MCQmedium

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the logging account. The logging account's S3 bucket policy allows CloudTrail to write logs from other accounts. The CloudTrail trail in each account is configured to deliver to the centralized bucket. However, logs from some accounts are not appearing. The security team has verified that the IAM permissions for CloudTrail are correct. What is the most likely reason for the missing logs?

A.CloudTrail cannot deliver logs to a bucket in a different AWS account
B.The S3 bucket policy does not include a condition for aws:SourceOrgID
C.The S3 bucket policy does not grant CloudTrail write access from the source accounts
D.The accounts need to enable VPC endpoints for S3 to communicate with the logging account
AnswerC

The bucket policy must allow the CloudTrail service principal from each source account to write logs.

Why this answer

The most likely reason for missing logs is that the S3 bucket policy in the logging account does not explicitly grant CloudTrail write access from the source accounts. Even though the bucket policy allows CloudTrail to write logs, it must include a principal that identifies the source account's CloudTrail service (e.g., `AWS:SourceAccount` or `AWS:SourceArn`) to authorize cross-account writes. Without this, CloudTrail from other accounts cannot deliver logs to the centralized bucket, regardless of correct IAM permissions in the source accounts.

Exam trap

The trap here is that candidates often assume IAM permissions in the source account are sufficient, but they overlook that cross-account S3 access requires explicit permission in the destination bucket's resource-based policy, not just the source's identity-based policy.

How to eliminate wrong answers

Option A is wrong because CloudTrail can deliver logs to an S3 bucket in a different AWS account when the bucket policy grants the necessary cross-account permissions; this is a supported feature. Option B is wrong because `aws:SourceOrgID` is an optional condition key used for additional security (e.g., to prevent confused deputy issues) but is not required for basic cross-account log delivery; its absence would not prevent logs from appearing. Option D is wrong because VPC endpoints for S3 are not required for CloudTrail log delivery across accounts; CloudTrail communicates with S3 over the public internet or via AWS PrivateLink, but the issue here is policy-based, not network connectivity.

Full explanation →
651
MCQhard

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

A.Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.
B.Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.
C.Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.
D.Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.
AnswerD

Aurora Global Database offers sub-second replication; Route 53 failover routing provides fast DNS failover.

Why this answer

Amazon Aurora Global Database provides cross-region replication with a typical lag of under 1 second, meeting the RPO requirement, and supports failover in under 1 minute, satisfying the RTO of less than 5 minutes. Combined with Route 53 failover routing and a health check on port 8080, this architecture enables rapid, automated traffic redirection to the secondary region without additional compute or storage costs beyond the Aurora storage and I/O.

Exam trap

The trap here is that candidates often confuse cross-region read replicas (which have asynchronous replication and manual failover) with Aurora Global Database (which provides near-synchronous replication and automated failover), leading them to choose Option C despite its inability to meet the strict RPO and RTO requirements.

How to eliminate wrong answers

Option A is wrong because Amazon RDS Multi-AZ is a single-region, high-availability feature; it does not provide cross-region disaster recovery, so it cannot meet the multi-region requirement. Option B is wrong because DynamoDB global tables are for NoSQL workloads, not for an Amazon Aurora MySQL database, and Application Load Balancers do not support health checks on custom TCP port 8080 (ALB only supports HTTP/HTTPS health checks). Option C is wrong because Amazon RDS for MySQL cross-region read replicas use asynchronous replication with a replication lag that can exceed 1 second, failing the RPO requirement, and failover requires manual promotion of the read replica, which cannot achieve a 5-minute RTO.

Full explanation →
652
MCQmedium

A company is migrating a Windows-based .NET application to AWS. The application uses SQL Server for its database and stores documents on a Windows file share. The company wants to adopt a hybrid model initially, where the application runs on AWS but still connects to on-premises resources for legacy integration. The migration must use a phased approach: first move the compute to AWS, then the database, and finally the file storage. The company has high latency to the internet and wants to optimize data transfer. You have set up a Direct Connect connection. During the first phase, you migrate the web and application servers to Amazon EC2 Windows instances. You need to ensure that the EC2 instances can access the on-premises SQL Server and file share securely. Which combination of actions should be taken?

A.Place the EC2 instances in a private subnet. Create a VPN connection or use Direct Connect virtual interface to connect to on-premises. Configure security groups to allow traffic to on-premises SQL Server and file share.
B.Place the EC2 instances in a private subnet with a NAT gateway. Use VPC peering to on-premises.
C.Place the EC2 instances in a public subnet. Use an internet gateway and configure security groups to allow inbound traffic from on-premises IPs.
D.Use Amazon EC2-Classic and link the instances to on-premises via ClassicLink.
AnswerA

Provides secure, low-latency access via Direct Connect.

Why this answer

Placing EC2 instances in a private subnet and using a Direct Connect virtual interface (or VPN) provides a secure, low-latency connection to on-premises resources. Security groups can be configured to allow traffic only to the necessary on-premises SQL Server and file share. Option B is wrong because VPC peering is used to connect VPCs within AWS, not for on-premises connectivity; a NAT gateway is for outbound internet access from private subnets, not for secure access to on-premises resources.

Option C is wrong because placing instances in a public subnet with an internet gateway exposes them to internet traffic, which is less secure and does not leverage the Direct Connect connection. Option D is wrong because ClassicLink is a legacy feature that was used for linking EC2-Classic instances to a VPC, but EC2-Classic is no longer available, and it does not provide on-premises connectivity.

Full explanation →
653
Multi-Selectmedium

A company is planning to migrate a three-tier web application to AWS. The application consists of a web server, an application server, and a MySQL database. The company wants to minimize operational overhead and improve scalability. Which THREE AWS services should the company use to modernize the architecture? (Choose THREE.)

Select 3 answers
A.AWS Lambda
B.Elastic Load Balancing (ELB)
C.Amazon EC2 instances
D.Amazon ECS with Fargate
E.Amazon RDS for MySQL
AnswersB, D, E

ELB distributes traffic to improve availability.

Why this answer

(Elastic Load Balancing) distributes incoming traffic across multiple targets, improving scalability and availability. Option D (Amazon ECS with Fargate) runs containers without managing servers, reducing operational overhead. Option E (Amazon RDS for MySQL) manages the MySQL database with automated backups, patching, and scaling, minimizing administrative tasks.

Option A (AWS Lambda) is not suitable for long-running application servers due to execution time limits and stateless nature. Option C (Amazon EC2 instances) requires manual management of instances, increasing operational overhead.

Full explanation →
654
MCQmedium

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

A.Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.
B.Set up AWS Direct Connect gateway and route all traffic through the security account.
C.Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.
D.Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.
AnswerD

Correct: Centrally managed and scales well.

Why this answer

AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Exam trap

The trap here is that candidates often choose VPC peering (Option C) because it is familiar, but they overlook the requirement to avoid route table manipulation and the lack of transitive routing, which makes peering unsuitable for centralized inspection across multiple accounts.

How to eliminate wrong answers

Option A is wrong because AWS PrivateLink interface endpoints are used for private connectivity to specific services, not for routing all inter-VPC traffic through a firewall; they do not support traffic inspection between VPCs. Option B is wrong because AWS Direct Connect gateway is a managed service for connecting on-premises networks to multiple VPCs, not for routing traffic between VPCs in different accounts, and it does not inherently force traffic through a centralized firewall. Option C is wrong because VPC peering connections require explicit route table entries in every VPC to direct traffic through the firewall, which violates the requirement to minimize complexity and avoid route table manipulation; peering also does not support transitive routing, so you would need a full mesh of peering connections.

Full explanation →
655
MCQmedium

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

A.The trail is not a multi-region trail
B.The trail does not include global service events
C.The trail has log file validation enabled, which prevents cross-account delivery
D.The trail is not an organization trail
AnswerD

Only organization trails automatically capture events from all accounts in the organization.

Why this answer

The exhibit shows that the CloudTrail trail 'my-trail' is not configured as an organization trail. In AWS Organizations, a trail must be explicitly created as an organization trail to automatically log management events from all member accounts. Without this setting, the trail only captures events from the management account, not the entire organization.

Exam trap

The trap here is that candidates may assume a trail created in the management account automatically covers all organization accounts, but CloudTrail requires explicit organization trail configuration to enable cross-account logging.

How to eliminate wrong answers

Option A is wrong because the exhibit does not indicate whether the trail is multi-region; even if it were single-region, that would not prevent cross-account delivery—it would only limit regional coverage. Option B is wrong because the question specifically asks about capturing management events from all accounts, and global service events (like IAM) are a subset of management events; excluding them would not prevent delivery from other accounts. Option C is wrong because log file validation is a security feature that ensures log integrity and does not block cross-account delivery; it is unrelated to organization trail configuration.

Full explanation →
656
Multi-Selecteasy

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Select 2 answers
A.Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.
B.Configure reserved concurrency for the Lambda function to limit its maximum concurrency.
C.Increase the concurrency limit for the Lambda function to allow more parallel executions.
D.Switch the DynamoDB table to on-demand capacity mode.
E.Enable DynamoDB auto scaling for the table to adjust read/write capacity automatically.
AnswersD, E

On-demand mode eliminates throttling by scaling automatically.

Why this answer

Switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Exam trap

The trap here is that candidates often choose to increase Lambda concurrency or shards, thinking more parallelism will improve processing, but they fail to recognize that the bottleneck is DynamoDB capacity, and increasing Lambda concurrency only worsens the throttling.

Full explanation →
657
MCQmedium

A company runs a critical application on Amazon RDS for PostgreSQL. The database performance has degraded over time. The Solutions Architect notices that read queries are slow and the DB instance's ReadIOPS metric is consistently high. Which action would improve read performance with minimal operational overhead?

A.Increase the allocated storage of the DB instance.
B.Enable Multi-AZ deployment for the DB instance.
C.Migrate the database to Amazon Aurora with PostgreSQL compatibility.
D.Create an RDS read replica and redirect read queries to it.
AnswerD

Creating an RDS read replica distributes read queries to a separate instance, directly reducing ReadIOPS on the primary and improving read performance with minimal overhead.

Why this answer

Creating an RDS read replica (Option D) offloads read traffic from the primary instance, reducing ReadIOPS and improving read query performance. This requires minimal operational overhead because Amazon RDS manages the replica. Option A is incorrect: increasing storage can help with IOPS limits but does not directly reduce read load.

Option B is incorrect: Multi-AZ provides high availability, not read scalability. Option C is incorrect: migrating to Aurora involves more effort and is not the simplest solution.

Full explanation →
658
MCQmedium

A company is migrating a legacy on-premises application to AWS. The application uses a proprietary database that is not supported by Amazon RDS. The migration must minimize downtime and require minimal changes to the application. Which migration strategy should the company use?

A.Migrate the database to Amazon RDS with a compatible engine and modify connection strings.
B.Rehost the application on Amazon EC2 instances and migrate the database using AWS Database Migration Service (DMS) with ongoing replication.
C.Refactor the application to use Amazon Aurora and modify the code to use the Aurora query interface.
D.Replace the database with Amazon DynamoDB and rewrite database access layer.
AnswerB

Rehosting on EC2 allows the same database engine, and DMS with replication minimizes downtime.

Why this answer

Rehosting (lift-and-shift) the application on Amazon EC2 allows the proprietary database to run without modification. Using AWS Database Migration Service (DMS) with ongoing replication minimizes downtime by keeping the database synchronized until cutover. Option A is incorrect because the proprietary database is not supported by Amazon RDS, so migrating to RDS is not feasible without changing the database engine.

Option C is incorrect because refactoring to Amazon Aurora would require modifying the application code to use Aurora's query interface, resulting in significant changes. Option D is incorrect because replacing the database with Amazon DynamoDB would necessitate rewriting the entire database access layer, which is not minimal change.

Full explanation →
659
MCQmedium

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

A.Enable AWS CloudTrail to log role assumptions and send alerts when external assumptions occur.
B.Use AWS Config to detect roles with external trust relationships and automatically delete them.
C.Modify the trust policy of each IAM role to allow only principals from the organization.
D.Attach a service control policy (SCP) that denies sts:AssumeRole if the aws:PrincipalOrgID condition is not set.
AnswerD

SCPs with aws:PrincipalOrgID condition can restrict role assumption to principals within the organization.

Why this answer

A service control policy (SCP) can centrally enforce that all IAM role trust policies in member accounts require the `aws:PrincipalOrgID` condition key. This condition ensures that only principals within the organization can assume roles, blocking any external user from assuming a role even if the role's trust policy is misconfigured. SCPs apply to all accounts in an OU or organization, providing a preventive control that cannot be overridden by account administrators.

Exam trap

The trap here is that candidates often choose Option C (modifying trust policies) because it seems direct, but they overlook that SCPs provide a centralized, scalable, and preventive control that enforces the policy across all accounts without requiring per-role changes.

How to eliminate wrong answers

Option A is wrong because AWS CloudTrail is a logging service that records events but does not prevent external role assumptions; it only provides visibility after the fact. Option B is wrong because AWS Config can detect roles with external trust relationships but cannot automatically delete them; it can trigger remediation actions via Systems Manager Automation, but deletion is not a native Config action and would require custom logic, and this approach is reactive rather than preventive. Option C is wrong because modifying the trust policy of each IAM role individually is impractical at scale across many accounts and roles, and it does not prevent a future role from being created with an overly permissive trust policy; it also lacks centralized enforcement.

Full explanation →
660
MCQeasy

A company is migrating its on-premises Oracle database to Amazon RDS for Oracle. The database is 2 TB in size and has a 100 Mbps internet connection. The migration must be completed within a week and have minimal downtime. Which AWS service should the company use to transfer the initial database dump to AWS?

A.Upload the database dump directly to an S3 bucket using multipart upload.
B.Use AWS Database Migration Service (DMS) with ongoing replication to migrate the data with minimal downtime.
C.Use AWS Snowball Edge to transfer the data offline.
D.Use S3 Transfer Acceleration to speed up the upload of the dump file.
AnswerB

DMS can perform a full load and then continuously replicate changes, allowing a cutover with minimal downtime.

Why this answer

AWS DMS with ongoing replication (change data capture) is the correct choice because it allows the initial full load of the 2 TB database to be migrated while continuously capturing and applying changes from the source Oracle database. This minimizes downtime to a brief cutover window, meeting the requirement of minimal downtime. The 100 Mbps internet connection is sufficient for the initial load over a week (2 TB at 100 Mbps ≈ 2.3 days theoretical), and DMS handles the schema conversion and data transfer natively without requiring manual dump files.

Exam trap

The trap here is that candidates often assume a direct upload to S3 or Snowball is faster for large datasets, but they overlook the critical requirement of minimal downtime, which only DMS with ongoing replication can satisfy by keeping the source database online during migration.

How to eliminate wrong answers

Option A is wrong because uploading a database dump directly to S3 via multipart upload does not provide ongoing replication or minimize downtime; the application would need to be offline for the entire duration of the dump and upload, which could exceed the allowed downtime window. Option C is wrong because AWS Snowball Edge is designed for offline transfer of large datasets over slow or unreliable connections, but here the 100 Mbps connection is adequate for the 2 TB within a week, and Snowball introduces additional shipping and processing delays that would likely exceed the one-week deadline. Option D is wrong because S3 Transfer Acceleration only speeds up uploads over long distances by using AWS edge locations, but it does not address the need for minimal downtime or ongoing replication; the application would still need to be offline during the dump and upload process.

Full explanation →
661
Multi-Selecteasy

A company is planning to migrate a workload to AWS and needs to estimate the total cost of ownership (TCO) compared to on-premises. Which TWO AWS tools can be used to perform this analysis?

Select 2 answers
A.AWS Pricing Calculator
B.AWS Organizations
C.AWS Cost Explorer
D.AWS TCO Calculator
E.AWS Budgets
AnswersA, D

Estimates monthly costs for AWS services.

Why this answer

Options A and D are correct. AWS Pricing Calculator estimates costs of AWS services. AWS TCO Calculator compares on-premises costs to AWS.

Option B (AWS Organizations) is wrong because it is for managing multiple AWS accounts, not cost analysis. Option C (AWS Cost Explorer) is wrong because it analyzes existing AWS spending, not TCO. Option E (AWS Budgets) is wrong because it tracks spending against budgets, not TCO comparison.

Full explanation →
662
MCQmedium

A global company uses AWS Organizations with multiple business units. Each business unit has its own OU and VPCs that need to communicate with a central shared services VPC. The network team wants to minimize latency and maximize throughput. Which design should they use?

A.Create a VPN connection from each business unit VPC to the shared services VPC.
B.Deploy an AWS Transit Gateway and attach all VPCs (business unit and shared services) to it.
C.Use AWS PrivateLink to connect services in the shared services VPC to the business unit VPCs.
D.Set up VPC peering between each business unit VPC and the shared services VPC.
AnswerB

Transit Gateway acts as a hub for transitive routing, simplifying network management and providing high bandwidth.

Why this answer

AWS Transit Gateway acts as a hub-and-spoke router, allowing all VPCs (business units and shared services) to connect through a single gateway. This minimizes latency by using the AWS global network backbone and maximizes throughput with up to 50 Gbps per VPC attachment, scaling horizontally across multiple attachments. It simplifies management compared to mesh peering and avoids the bandwidth limitations of VPN or PrivateLink for inter-VPC routing.

Exam trap

The trap here is that candidates often choose VPC peering (D) due to its simplicity and zero additional cost, overlooking the management overhead and lack of transitive routing when scaling across many VPCs, while Transit Gateway provides a centralized, high-performance solution that aligns with the requirements for minimizing latency and maximizing throughput.

How to eliminate wrong answers

Option A is wrong because VPN connections introduce encryption overhead, higher latency, and throughput limits (typically up to 1.25 Gbps per tunnel), making them unsuitable for minimizing latency and maximizing throughput. Option C is wrong because AWS PrivateLink is designed for exposing specific services (e.g., via NLB) rather than full IP-level routing between VPCs, and it adds per-connection costs and does not support transitive routing or high-throughput bulk data transfer. Option D is wrong because VPC peering requires a full mesh of connections (each business unit VPC must peer individually with the shared services VPC), does not support transitive routing, and can hit the default limit of 125 peering connections per VPC, creating management overhead and potential scaling issues.

Full explanation →
663
Multi-Selecteasy

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

Select 2 answers
A.Use Spot Instances for compute.
B.Purchase Reserved Instances (RI) for a 1-year term.
C.Configure Auto Scaling to scale out during the job and scale in after.
D.Use On-Demand Instances to ensure availability.
E.Use Dedicated Hosts for compliance.
AnswersA, C

Spot Instances are cost-effective and suitable for fault-tolerant batch jobs.

Why this answer

Spot Instances (Option A) are ideal for this batch processing job because the job can tolerate interruptions and requires significant compute power for only a few hours nightly. Spot Instances offer up to 90% cost savings compared to On-Demand Instances by leveraging unused AWS EC2 capacity, making them the most cost-effective choice for fault-tolerant, time-flexible workloads.

Exam trap

The trap here is that candidates often choose Reserved Instances (Option B) thinking they are always cheaper for recurring workloads, but they fail to recognize that the low utilization (a few hours per night) makes On-Demand or Spot more cost-effective than a 1-year commitment.

Full explanation →
664
Multi-Selectmedium

A company runs a production AWS environment with Amazon EC2 instances managed by Auto Scaling groups. The operations team notices that after a recent deployment, the application is returning higher error rates. Which TWO steps should the team take to enable a quick rollback and improve future deployments?

Select 2 answers
A.Configure Auto Scaling lifecycle hooks to automatically terminate new instances if health checks fail.
B.Implement canary deployments using AWS CodeDeploy to shift traffic gradually and monitor error rates.
C.Use AWS CloudFormation change sets to automatically roll back failed deployments.
D.Use AWS Elastic Beanstalk to perform a blue/green deployment, swapping the environment URL after testing.
E.Enable AWS CloudTrail to track deployment API calls and automatically revert if errors exceed a threshold.
AnswersB, D

Canary deployments allow early detection and rollback if errors increase.

Why this answer

Implement canary deployments using AWS CodeDeploy to shift traffic gradually and monitor error rates. This allows a gradual rollout, reducing blast radius, and enables quick rollback by stopping traffic to unhealthy instances. Option D: Use AWS Elastic Beanstalk to perform a blue/green deployment, swapping the environment URL after testing.

This provides a full rollback by swapping back to the old environment. Option A (lifecycle hooks) is for custom actions during instance lifecycle, not for rollback of deployments. Option C (CloudFormation change sets) allows previewing changes but does not automatically roll back on failure.

Option E (CloudTrail) is for auditing API calls, not for deployment rollback.

Full explanation →
665
MCQeasy

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

A.Increase the memory allocation for the Lambda function.
B.Use an SQS queue to buffer the S3 events.
C.Use AWS Step Functions to orchestrate the processing.
D.Increase the Lambda function timeout.
AnswerD

Increasing timeout allows the function to run longer without timing out.

Why this answer

The default Lambda timeout is 3 seconds, which is insufficient for processing that can take longer. Increasing the timeout allows the function to complete without incurring additional costs. Option A is wrong because increasing memory also increases cost and does not directly address timeouts; it may improve performance but at higher cost.

Option B is wrong because SQS buffering does not resolve timeout issues; it only decouples event sources. Option C is wrong because Step Functions add complexity and cost; a simpler solution is to adjust the timeout.

Full explanation →
666
MCQmedium

A security engineer created the above bucket policy on the central-logging-bucket in account 111111111111. They want account 222222222222 to deliver CloudTrail logs to this bucket. What is missing?

A.The prefix AWSLogs/111111111111 is incorrect; it should use the source account ID 222222222222.
B.The role CrossAccountRole does not exist in account 222222222222.
C.The bucket policy must grant s3:PutObject to the CloudTrail service principal, not to a role.
D.The bucket must be in the same account as CloudTrail.
AnswerC

CloudTrail uses its own service principal to write logs.

Why this answer

CloudTrail delivers logs to S3 buckets by assuming a service-linked role, but the bucket policy must explicitly grant the `s3:PutObject` permission to the CloudTrail service principal (`cloudtrail.amazonaws.com`) rather than to an IAM role in the target account. This is because CloudTrail uses its own service principal to write logs, not a cross-account IAM role. Without this permission, the CloudTrail delivery will fail with an access denied error.

Exam trap

The trap here is that candidates often assume cross-account access requires an IAM role, but CloudTrail uses a service principal instead, making the role-based option (B) a distractor.

How to eliminate wrong answers

Option A is wrong because the prefix `AWSLogs/111111111111` is correct—it represents the bucket owner's account ID (the account that owns the bucket), not the source account ID. Option B is wrong because CloudTrail does not require a cross-account IAM role; it uses the CloudTrail service principal to write logs, so the role `CrossAccountRole` is unnecessary. Option D is wrong because CloudTrail can deliver logs to a bucket in a different account as long as the bucket policy grants the necessary permissions to the CloudTrail service principal.

Full explanation →
667
MCQhard

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket with versioning enabled and a DeletionPolicy of Retain. The stack is deleted. What happens to the bucket and its objects?

A.The bucket and all its objects are deleted
B.The bucket and its objects are retained
C.The bucket is deleted only if it is empty
D.The bucket is deleted, but versioning information is retained
AnswerB

Correct. The bucket and all its objects are retained due to DeletionPolicy: Retain.

Why this answer

When a CloudFormation stack is deleted, the resource with DeletionPolicy set to Retain is preserved. Since the S3 bucket has DeletionPolicy: Retain, the bucket and all its objects (including versioned objects) are retained. Option A is incorrect because the bucket is not deleted.

Option C is incorrect because DeletionPolicy overrides stack deletion behavior regardless of contents. Option D is incorrect because versioning information is also retained along with the bucket.

Full explanation →
668
MCQeasy

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

A.Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.
B.Create a service control policy that allows the member account to manage IAM Identity Center.
C.Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.
D.Set up AWS Config rules to enforce IAM Identity Center settings in the member account.
AnswerA

This is the standard process to delegate administration.

Why this answer

To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Exam trap

The trap here is that candidates often confuse service control policies (SCPs) with delegation mechanisms, assuming an SCP can grant administrative rights, when in fact SCPs only deny or allow existing permissions and cannot delegate IAM Identity Center administration.

How to eliminate wrong answers

Option B is wrong because service control policies (SCPs) can only deny or allow actions at the account level, but they cannot delegate administrative permissions for IAM Identity Center; delegation requires explicit registration via the management account. Option C is wrong because AWS CloudFormation StackSets can deploy resources across accounts but cannot register a delegated administrator for IAM Identity Center, which is a management-plane operation. Option D is wrong because AWS Config rules can only evaluate and enforce compliance of resource configurations, not grant administrative delegation or manage IAM Identity Center settings.

Full explanation →
669
Multi-Selecthard

A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Select 2 answers
A.Configure the ALB to use HTTPS listeners and the target group to use HTTPS.
B.Place the EC2 instances in private subnets and use a NAT gateway for outbound internet access.
C.Attach an Internet Gateway to the VPC and route traffic through it.
D.Enable VPC Flow Logs on the private subnets.
E.Configure network ACLs to deny all inbound traffic from the internet.
AnswersA, B

This encrypts traffic between the client and ALB, and between ALB and EC2 instances if the target group uses HTTPS.

Why this answer

Configuring the ALB with HTTPS listeners and the target group with HTTPS ensures that traffic between the ALB and EC2 instances is encrypted using TLS. This meets the security team's requirement for encrypted traffic end-to-end, as the ALB terminates the client HTTPS connection and re-encrypts traffic to the targets.

Exam trap

The trap here is the distinction between 'direct internet access' and 'indirect internet access'. Candidates may incorrectly assume that having any internet access (even via a NAT gateway) violates the requirement. However, the requirement explicitly states 'no direct internet access', which means no public IP and no route to an internet gateway.

A NAT gateway provides outbound-only internet access from private subnets, which is indirect and does not allow inbound connections. This is permissible and often necessary for patching and updates.

Full explanation →
670
MCQeasy

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

A.Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.
B.Set S3 Object Ownership to BucketOwnerPreferred.
C.Configure the S3 bucket policy to allow public read access.
D.Generate CloudFront key pairs and require signed URLs for all content.
AnswerA

Restricts direct access.

Why this answer

Using CloudFront Origin Access Control (OAC) restricts access to the S3 bucket so that only the CloudFront distribution can access objects. The bucket policy must be updated to grant CloudFront access. Option B is incorrect because S3 Object Ownership does not restrict access.

Option C is incorrect because allowing public read access would enable direct S3 access. Option D is incorrect because CloudFront key pairs and signed URLs control access through CloudFront but do not prevent direct S3 bucket access.

Full explanation →
671
MCQeasy

A company is migrating a web application to AWS and wants to use a containerized architecture. The application consists of multiple microservices that communicate via REST APIs. The company needs a solution that minimizes operational overhead for managing containers and orchestrating microservices. Which AWS service should the company use?

A.Amazon EKS with managed node groups.
B.AWS Lambda functions for each microservice.
C.Amazon EC2 with Docker installed on each instance.
D.Amazon ECS with AWS Fargate launch type.
AnswerD

Fargate is serverless and reduces overhead.

Why this answer

Amazon ECS with the Fargate launch type is the correct choice because it allows you to run containers without managing the underlying servers or cluster, thus minimizing operational overhead. Fargate is a serverless compute engine for containers, perfectly suited for microservices requiring minimal management. Option A (EKS with managed node groups) still requires management of worker nodes and is more complex.

Option B (Lambda) is for functions, not containerized microservices. Option C (EC2 with Docker) involves significant operational overhead for managing instances and Docker.

Full explanation →
672
MCQeasy

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

A.Amazon ECS
B.AWS Lambda
C.Amazon EC2
D.AWS Fargate
AnswerB

Lambda is event-driven and serverless.

Why this answer

AWS Lambda is the correct choice because it is a serverless compute service that executes code in response to events, such as S3 object creation, with sub-millisecond startup times. It automatically scales and requires no server management, making it ideal for this use case.

Exam trap

The trap here is that candidates often confuse AWS Fargate as a serverless compute option for event-driven workloads, but Fargate is designed for containerized applications with longer runtimes and higher latency, not for sub-millisecond event responses.

How to eliminate wrong answers

Option A is wrong because Amazon ECS is a container orchestration service that requires managing a cluster or using Fargate, and it does not natively trigger from S3 events without additional components like EventBridge or Lambda. Option C is wrong because Amazon EC2 involves provisioning and managing virtual servers, which contradicts the requirement for no server management and millisecond execution. Option D is wrong because AWS Fargate is a serverless compute engine for containers, but it still requires defining tasks and has a startup latency of seconds, not milliseconds, and does not directly integrate with S3 events without a Lambda intermediary.

Full explanation →
673
MCQmedium

A company is using AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts have a specific AWS Config rule enabled and that any drift is automatically remediated. Which approach should be used?

A.Use EC2 Auto Scaling to apply the Config rule to all accounts.
B.Use AWS Control Tower lifecycle events and customizations to deploy the Config rule and set up automatic remediation.
C.Use AWS CloudTrail to monitor for accounts without the Config rule and trigger a Lambda function to add it.
D.Use AWS Config to create a conformance pack that applies the rule, and use an SCP to require it.
AnswerB

Control Tower provides governance and drift detection.

Why this answer

AWS Control Tower provides lifecycle events and customizations (via AWS Control Tower Lifecycle Events and Customizations for AWS Control Tower) that allow you to automatically deploy and remediate AWS Config rules across all accounts in the organization. This approach ensures that the Config rule is applied consistently when new accounts are created or when drift is detected, meeting the security team's requirement for automatic remediation without manual intervention.

Exam trap

The trap here is that candidates may confuse AWS Config conformance packs with enforcement mechanisms, assuming SCPs can mandate Config rules, when in fact SCPs only restrict permissions and cannot enforce the presence of specific AWS services or configurations.

How to eliminate wrong answers

Option A is wrong because EC2 Auto Scaling is designed to manage compute capacity, not to deploy or enforce AWS Config rules across accounts; it has no mechanism to apply Config rules or remediate drift. Option C is wrong because AWS CloudTrail logs API activity but does not monitor for the absence of Config rules or trigger remediation; using CloudTrail to detect missing rules would require custom, unreliable logic and does not provide automatic drift remediation. Option D is wrong because while a conformance pack can apply Config rules, using an SCP (Service Control Policy) cannot require a Config rule to be enabled; SCPs control permissions and cannot enforce the presence of specific AWS Config rules or trigger remediation.

Full explanation →
674
MCQhard

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

A.Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.
B.Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.
C.Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.
D.Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.
AnswerA

NLB can handle TCP traffic and route based on port to different services.

Why this answer

A Network Load Balancer (NLB) with a TCP listener can forward traffic based on destination port to different target groups, allowing the legacy client using a proprietary binary protocol over TCP to reach distinct microservices without any client-side changes. This preserves the existing TCP connection semantics and binary protocol, which an Application Load Balancer (HTTP/HTTPS only) or API Gateway (HTTP/REST) cannot handle.

Exam trap

The trap here is that candidates often assume an Application Load Balancer or API Gateway can handle any protocol because of their advanced routing features, but they forget that ALB and API Gateway are strictly Layer 7 (HTTP/HTTPS) and cannot process raw TCP or proprietary binary protocols.

How to eliminate wrong answers

Option B is wrong because AWS Global Accelerator uses endpoint groups for routing traffic to regional endpoints, but it does not support port-based routing to different target groups within a single listener; it relies on the underlying NLB or ALB for that granularity, adding unnecessary complexity without solving the port-based routing need. Option C is wrong because an Application Load Balancer operates at Layer 7 (HTTP/HTTPS) and cannot handle proprietary binary protocols over TCP; it requires HTTP-based routing, which would force changes to the client. Option D is wrong because Amazon API Gateway only supports HTTP/REST and WebSocket APIs, not raw TCP or proprietary binary protocols, and would require the client to send HTTP requests, breaking the existing protocol.

Full explanation →
675
Multi-Selectmedium

A company uses AWS Organizations and wants to establish a central logging solution. They need to collect CloudTrail logs from all accounts and store them in a central S3 bucket in the management account. Which TWO steps are required to achieve this?

Select 2 answers
A.Create an AWS Config rule to monitor CloudTrail configuration.
B.Apply a service control policy (SCP) to enforce CloudTrail logging.
C.Create a new CloudTrail trail in the management account with organization trail enabled.
D.Configure the trail to deliver logs to a central S3 bucket in the management account.
E.Enable CloudTrail in each member account individually.
AnswersC, D

Correct. Creating an organization trail in the management account automatically enables CloudTrail across all member accounts.

Why this answer

To centrally collect CloudTrail logs from all accounts in an AWS Organization, create an organization trail in the management account (C) which automatically enables CloudTrail in all member accounts and logs management events. Then configure that trail to deliver logs to a central S3 bucket in the management account (D). No individual account CloudTrail enablement is required because the organization trail handles it automatically.

Exam trap

The trap is thinking that individual CloudTrail enablement in each member account is necessary. In reality, creating an organization trail in the management account automatically enables CloudTrail in all accounts.

Full explanation →
Page 8

Page 9 of 23

Page 10

All pages

1234567891011121314151617181920212223

Practice SAP-C02 by domain

Target a specific domain to shore up weak areas.

Design Solutions for Organizational ComplexityDesign for New SolutionsContinuous Improvement for Existing SolutionsAccelerate Workload Migration and Modernization
See all domains with question counts →