Courseiva
← Back to AWS Certified Solutions Architect Professional SAP-C02 questions

Scenario-based practice

Refer to the Exhibit Practice Questions

Practise AWS Certified Solutions Architect Professional SAP-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice testRead exam guide
15
scenario questions
SAP-C02
exam code
Amazon Web Services
vendor

Scenario guide

How to approach refer to the exhibit practice questions

Practise exhibit-style questions that ask you to read a topology, table, command output or diagram before choosing the best answer.

Quick answer

Exhibit-style questions test whether you can read a topology, command output, diagram or table before choosing the best answer.

How to extract the relevant detail from an exhibit.

How topology, command output or routing information affects the answer.

How to avoid answering from memory before reading the evidence.

How to map the exhibit back to the exam objective.

Related practice questions

Related SAP-C02 topic practice pages

Scenario questions usually connect to one or more exam topics. Use these links to review the underlying concepts behind the scenario.

Design Solutions for Organizational Complexity practice questions

Design Solutions for Organizational Complexity practice questions for SAP-C02.

Design for New Solutions practice questions

Design for New Solutions practice questions for SAP-C02.

Continuous Improvement for Existing Solutions practice questions

Work through SAP-C02 questions on Continuous Improvement for Existing Solutions.

Accelerate Workload Migration and Modernization practice questions

Sharpen your SAP-C02 knowledge of Accelerate Workload Migration and Modernization.

SAA-C03 VPC practice questions

Work through SAP-C02 questions on SAA-C03 VPC.

SAA-C03 S3 lifecycle policy questions

Practise SAP-C02 questions linked to SAA-C03 S3 lifecycle policy questions.

SAA-C03 RDS Multi-AZ questions

SAA-C03 RDS Multi-AZ questions practice questions for SAP-C02.

SAA-C03 IAM policy practice questions

Sharpen your SAP-C02 knowledge of SAA-C03 IAM policy.

SAA-C03 Route 53 failover questions

Targeted SAP-C02 practice covering SAA-C03 Route 53 failover questions.

SAA-C03 CloudFront practice questions

Practise SAP-C02 questions linked to SAA-C03 CloudFront.

SAA-C03 NAT gateway questions

Work through SAP-C02 questions on SAA-C03 NAT gateway questions.

SAA-C03 VPC endpoint questions

SAA-C03 VPC endpoint questions practice questions for SAP-C02.

Practice set

Practice scenarios

Question 1easymultiple choice
Full question →

Refer to the exhibit. A company deploys this CloudFormation template. After deployment, they enable S3 Transfer Acceleration on the bucket. Later, they update the stack. What happens to the Transfer Acceleration setting?

Exhibit

Refer to the exhibit.

```
# CloudFormation template snippet
Resources:
  MyBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: my-app-data-bucket
      VersioningConfiguration:
        Status: Enabled
```
Question 2mediummultiple choice
Review the full subnetting walkthrough →

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Network Topology
aws cloudformation describe-stacksstack-name my-stackquery "Stacks[0].Outputs"Refer to the exhibit."OutputKey": "VPCId","OutputValue": "vpc-12345678"},"OutputKey": "SubnetIds","OutputValue": "subnet-11111111,subnet-22222222"
Question 3mediummultiple choice
Full question →

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

Exhibit

Refer to the exhibit.
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/*"
        },
        {
            "Effect": "Deny",
            "Action": "s3:GetObject",
            "Resource": "arn:aws:s3:::my-bucket/confidential/*"
        }
    ]
}
Question 4hardmultiple choice
Review the full subnetting walkthrough →

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Network Topology
$ aws ec2 describe-vpcsregion us-east-1query 'Vpcs[0].VpcId'$ aws ec2 describe-subnetsfilters Name=vpc-idRefer to the exhibit."vpc-0abcd1234""Subnets": ["SubnetId": "subnet-11111111","CidrBlock": "10.0.1.0/24","MapPublicIpOnLaunch": false},"SubnetId": "subnet-22222222","CidrBlock": "10.0.2.0/24",
Question 5hardmultiple choice
Full question →

Refer to the exhibit. A company attached the above SCP to an OU in AWS Organizations. The SCP is intended to allow only t3.micro and t3.small EC2 instances. However, users in accounts within that OU are still able to launch other instance types. What is the most likely reason?

Exhibit

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ec2:RunInstances"
      ],
      "Resource": "arn:aws:ec2:*:*:instance/*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": [
            "t3.micro",
            "t3.small"
          ]
        }
      }
    }
  ]
}
Question 6mediummultiple choice
Full question →

Refer to the exhibit. A solutions architect runs the CLI command and gets the output shown. What does the state 'running' indicate about the instance?

Network Topology
aws ec2 describe-instancesregion us-east-1query "Reservations[0].Instances[0].State"Refer to the exhibit."Code": 16,"Name": "running"
Question 7hardmultiple choice
Review the full subnetting walkthrough →

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Network Topology
$ aws ec2 describe-route-tablesfilters Name=vpc-idRefer to the exhibit."RouteTables": ["RouteTableId": "rtb-11111","VpcId": "vpc-12345","Routes": ["DestinationCidrBlock": "10.0.0.0/16","GatewayId": "local","Origin": "CreateRouteTable","State": "active"},"DestinationCidrBlock": "0.0.0.0/0","NatGatewayId": "nat-12345","Origin": "CreateRoute",],"Associations": ["Main": false,"RouteTableAssociationId": "rtbassoc-22222","SubnetId": "subnet-11111"
Question 8mediummultiple choice
Full question →

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeInstances",
        "ec2:StartInstances",
        "ec2:StopInstances"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "ec2:ResourceTag/Environment": "production"
        }
      }
    }
  ]
}
Question 9mediummultiple choice
Full question →

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Network Topology
$ aws ec2 describe-instancesinstance-ids i-1234567890abcdef0Refer to the exhibit.```# AWS CLI command output"Reservations": ["Groups": [],"Instances": ["InstanceId": "i-1234567890abcdef0","InstanceType": "t2.micro","State": {"Name": "running"},"Monitoring": {"State": "disabled""NetworkInterfaces": ["Association": {"IpOwnerId": "amazon","PublicIp": "54.123.45.67""Attachment": {"DeviceIndex": 0,"Status": "attached"],"Tags": ["Key": "Name","Value": "WebServer"
Question 10hardmultiple choice
Full question →

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Exhibit

Refer to the exhibit.
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringNotEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
Question 11easymultiple choice
Full question →

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

Network Topology
$ aws ec2 describe-instancesfilters Name=tag:Environmentquery 'Reservations[].Instances[?State.Name==`running`].[InstanceIdoutput table+Refer to the exhibit.Output:| DescribeInstances |
Question 12easymultiple choice
Full question →

A company has an S3 bucket policy as shown in the exhibit. The bucket 'my-bucket' is owned by account 111111111111. What access does this policy grant to account 123456789012?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:root"
      },
      "Action": "s3:*",
      "Resource": [
        "arn:aws:s3:::my-bucket",
        "arn:aws:s3:::my-bucket/*"
      ]
    }
  ]
}
Question 13hardmultiple choice
Full question →

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

Network Topology
aws cloudformation describe-stacksstack-name myappquery "Stacks[0].Outputs"Refer to the exhibit."OutputKey": "BucketName","OutputValue": "myapp-bucket-123456","Description": "S3 bucket name"},"OutputKey": "LambdaFunctionArn","OutputValue": "arn:aws:lambda:us-east-1:123456789012:function:myapp-function","Description": "Lambda function ARN"
Question 14mediummultiple choice
Full question →

Refer to the exhibit. A company has created a CloudTrail trail named 'my-trail' in the management account of AWS Organizations. The trail is configured to deliver logs to a central S3 bucket. The security team wants to capture all management events from all accounts in the organization. Based on the exhibit, what is the most likely issue?

Network Topology
aws cloudtrail describe-trailstrail-name-list my-trail"trailList": ["Name": "my-trail","S3BucketName": "central-logs-bucket","IncludeGlobalServiceEvents": true,"IsMultiRegionTrail": false,"HomeRegion": "us-east-1","TrailARN": "arn:aws:cloudtrail:us-east-1:123456789012:trail/my-trail","LogFileValidationEnabled": true,"IsOrganizationTrail": false
Question 15mediummultiple choice
Full question →

Refer to the exhibit. A company attaches this SCP to the root of an AWS Organization. What is the effect?

Exhibit

Refer to the exhibit.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": "*",
            "Resource": "*",
            "Condition": {
                "StringNotEquals": {
                    "aws:PrincipalOrgID": "o-exampleorgid"
                }
            }
        }
    ]
}

These SAP-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SAP-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.