How many Troubleshooting Scenario Questions questions are on this page?

This page has 8 Troubleshooting Scenario Questions scenario questions for the SAP-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SAP-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Solutions Architect Professional SAP-C02 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified Solutions Architect Professional SAP-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SAP-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A company is using AWS Organizations with a set of member accounts that need to access a shared Amazon S3 bucket in the master account. The bucket policy allows access only from the member accounts' root user. However, developers in member accounts are unable to access the bucket even when they assume an IAM role. What is the most likely cause?

A
The bucket is encrypted with an AWS KMS key that the role does not have permissions to use.
Why wrong: No encryption is mentioned; the issue is likely the principal in the bucket policy.
B
The bucket policy requires an explicit Deny for all principals except the root user.
Why wrong: Bucket policies do not require explicit Deny; they can allow specific principals.
C
A service control policy (SCP) is denying access to the S3 bucket.
Why wrong: No SCP is mentioned; SCPs would affect all actions, not just bucket access.
D
The bucket policy grants access to the member account root user ARN, but the role session has a different ARN.
When a user assumes a role, the principal becomes the role's ARN, not the root user.

Full breakdown with real-world context →

Question 2hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Network Topology

A
The subnet's auto-assign public IP setting is disabled
MapPublicIpOnLaunch is false, so instances lack public IPs.
B
The internet gateway is not attached to the VPC
Why wrong: The exhibit implies it is attached.
C
The subnet needs a NAT gateway for internet access
Why wrong: A NAT gateway is needed for private subnets, but this subnet can be public if it assigns public IPs.
D
The subnet's route table does not have a route to the internet gateway
Why wrong: The exhibit states the route exists.

Full breakdown with real-world context →

Question 3hardmultiple choice

Full question →

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

A
Remove the SCP from the root.
Why wrong: This would remove security controls entirely.
B
Modify the bucket policy to allow s3:PutObject without tags.
Why wrong: The SCP denies at the organization level, overriding the bucket policy.
C
Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.
This allows the logging services to write logs while still requiring tags for other PutObject calls.
D
Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.
Why wrong: This is a temporary workaround and does not address the root cause; also requires reconfiguring all accounts.

Full breakdown with real-world context →

Question 4easymulti select

Full question →

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

A
Amazon Inspector.
Why wrong: Security vulnerability assessment.
B
AWS CloudTrail.
Why wrong: Records API activity, not network traffic.
C
AWS Config.
Why wrong: Monitors resource configuration changes.
D
VPC Reachability Analyzer.
Tests network paths between resources.
E
VPC Flow Logs.
Captures network traffic metadata.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Network Topology

A
The instance does not have an IAM role that allows sending metrics to CloudWatch.
Why wrong: While an IAM role is needed, the exhibit does not show IAM information; this is a possible cause but not the most likely given the monitoring state.
B
The instance's security group is blocking outbound traffic to CloudWatch endpoints.
Why wrong: The instance has internet connectivity, so security group is likely not the issue.
C
The instance is in the wrong AWS region for CloudWatch.
Why wrong: The region is not shown, but CloudWatch is region-specific; however, the instance would still send metrics to its own region.
D
The CloudWatch agent is not installed or running on the instance.
The monitoring state is 'disabled', indicating detailed monitoring is off, but even with basic monitoring, the CloudWatch agent is needed for system-level metrics.

Full breakdown with real-world context →

Question 6mediummultiple choice

Full question →

A company is migrating its application stack from on-premises to AWS using a rehost strategy. The stack includes a web server, an application server, and a MySQL database. The company wants to automate the migration using AWS Application Migration Service (MGN). After configuring MGN, the web server test instance fails to start because the boot volume is missing the boot sector. What is the most likely cause?

A
The EBS volume size is smaller than the source volume.
Why wrong: MGN preserves volume size.
B
The source volume was not shut down cleanly before replication.
Dirty shutdown can corrupt boot sector.
C
The source web server uses an unsupported instance type.
Why wrong: Instance type doesn't affect boot sector.
D
The source OS is not supported by MGN.
Why wrong: MGN supports many OSes.

Full breakdown with real-world context →

Question 7easymultiple choice

Full question →

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

A
The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.
The role needs explicit write permissions to the S3 bucket.
B
The S3 bucket policy denies access from the pipeline's AWS account.
Why wrong: The pipeline uses a role in the same account, so account-level denial is unlikely.
C
The CodeBuild project does not have the necessary environment variables.
Why wrong: Environment variables are not related to S3 permissions.
D
The S3 bucket does not have versioning enabled.
Why wrong: Versioning is not required for PutObject.

Full breakdown with real-world context →

Question 8hardmultiple choice

Full question →

A company is using a multi-account strategy with AWS Organizations. The security team discovers that an SCP intended to block access to non-compliant AWS regions is not working. The SCP is attached to the root OU. When a user in a member account attempts to launch an EC2 instance in a blocked region, the request succeeds. What is the most likely cause?

A
The IAM policy of the user overrides the SCP.
Why wrong: SCPs set boundaries; IAM policies cannot override a deny.
B
The SCP is not attached to the member account's OU.
Why wrong: The SCP is attached to the root OU, which applies to all accounts.
C
The SCP is missing an explicit allow statement for the regions.
Why wrong: SCPs deny actions; they do not require explicit allows.
D
The user belongs to the management account, and SCPs do not apply to the management account.
SCPs do not affect the management account.

Full breakdown with real-world context →

These SAP-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SAP-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SAP-C02 topic practice pages

Design Solutions for Organizational Complexity practice questions

Design for New Solutions practice questions

Continuous Improvement for Existing Solutions practice questions

Accelerate Workload Migration and Modernization practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Practice scenarios

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?