How many Troubleshooting Scenario Questions questions are on this page?

This page has 6 Troubleshooting Scenario Questions scenario questions for the SAP-C02 exam, each with detailed explanations and wrong-answer analysis.

How should I approach SAP-C02 scenario questions?

Read the full scenario before looking at the answer options. Identify the constraint or requirement in the scenario, then eliminate options that are generally true but wrong for this specific case. Scenario questions reward careful reading over pattern matching.

← Back to AWS Certified Solutions Architect Professional SAP-C02 questions

Scenario-based practice

Troubleshooting Scenario Questions

Practise AWS Certified Solutions Architect Professional SAP-C02 practice questions — original exam-style scenarios covering every exam domain, with detailed explanations, wrong-answer analysis, and common exam traps.

Start full practice test Read exam guide

scenario questions

SAP-C02

exam code

Amazon Web Services

vendor

Scenario guide

How to approach troubleshooting scenario questions

These questions describe a network symptom and ask you to identify the root cause or the correct fix. They appear across all certification exams and reward systematic thinking over memorisation. The best candidates follow a consistent troubleshooting framework even under time pressure.

Quick answer

Troubleshooting Scenario Questions questions test whether you can apply the concept in context, not just recognise a definition.

How the topic appears in realistic exam-style scenarios.

Which detail in the question changes the correct answer.

How to eliminate plausible but wrong options.

How to connect the question back to the wider exam objective.

Practice scenarios

Question 1hardmultiple choice

Full question →

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole"
    },
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:PutItem"
      ],
      "Resource": "arn:aws:dynamodb:us-east-1:123456789012:table/Orders"
    }
  ]
}

A
The Lambda function does not have permission to create log groups.
Why wrong: Log permissions are granted, and missing log permissions would cause a different error.
B
The Lambda function is not in the same VPC as DynamoDB.
Why wrong: DynamoDB is accessible over the internet; VPC is not required.
C
The DynamoDB table 'Orders' does not exist.
Why wrong: The error is AccessDenied, not ResourceNotFoundException.
D
The IAM role lacks a trust policy that allows Lambda to assume it.
The exhibit shows only permission policies; the trust policy is missing.

Full breakdown with real-world context →

Question 2mediumdrag order

Full question →

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3hardmultiple choice

Review the full subnetting walkthrough →

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Network Topology

A
The subnet's auto-assign public IP setting is disabled
MapPublicIpOnLaunch is false, so instances lack public IPs.
B
The internet gateway is not attached to the VPC
Why wrong: The exhibit implies it is attached.
C
The subnet needs a NAT gateway for internet access
Why wrong: A NAT gateway is needed for private subnets, but this subnet can be public if it assigns public IPs.
D
The subnet's route table does not have a route to the internet gateway
Why wrong: The exhibit states the route exists.

Full breakdown with real-world context →

Question 4mediummultiple choice

Full question →

An IAM policy is attached to an IAM role that is assumed by an EC2 instance. The EC2 instance has an IP address of 10.0.1.15. The instance is unable to download objects from the S3 bucket 'example-bucket'. What is the MOST likely cause?

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "IpAddress": {
          "aws:SourceIp": "10.0.0.0/8"
        }
      }
    }
  ]
}
```

A
The S3 bucket policy denies access to the IAM role.
Why wrong: No bucket policy is shown; the issue is in the IAM policy.
B
The IAM role is not attached to the EC2 instance profile.
Why wrong: The exhibit shows the role has the policy; the issue is likely the condition.
C
The policy lacks permissions for s3:ListBucket.
Why wrong: The action is s3:GetObject, which is sufficient for downloading objects.
D
The EC2 instance is using a public IP address to access S3, which does not match the 'aws:SourceIp' condition.
The condition requires the source IP to be in the private range, but S3 access from EC2 uses public IPs unless using a VPC endpoint.

Full breakdown with real-world context →

Question 5mediummultiple choice

Full question →

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Network Topology

A
The instance does not have an IAM role that allows sending metrics to CloudWatch.
Why wrong: While an IAM role is needed, the exhibit does not show IAM information; this is a possible cause but not the most likely given the monitoring state.
B
The instance's security group is blocking outbound traffic to CloudWatch endpoints.
Why wrong: The instance has internet connectivity, so security group is likely not the issue.
C
The instance is in the wrong AWS region for CloudWatch.
Why wrong: The region is not shown, but CloudWatch is region-specific; however, the instance would still send metrics to its own region.
D
The CloudWatch agent is not installed or running on the instance.
The monitoring state is 'disabled', indicating detailed monitoring is off, but even with basic monitoring, the CloudWatch agent is needed for system-level metrics.

Full breakdown with real-world context →

Question 6mediummultiple choice

Review the full subnetting walkthrough →

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Network Topology

A
The subnet's route table does not have a route to the internet gateway.
Even with a public IP, the subnet must have a route to the internet gateway.
B
The instance does not have a public IP address.
Why wrong: The output shows a public IP: 54.123.45.67.
C
The instance is not in a running state.
Why wrong: The state is 'running'.
D
The security group is blocking outbound traffic.
Why wrong: The security group allows all outbound traffic.

Full breakdown with real-world context →

These SAP-C02 practice questions are part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style SAP-C02 questions with detailed explanations, topic-based practice, mock exams, readiness tracking, and study analytics.

Troubleshooting Scenario Questions

How to approach troubleshooting scenario questions

Quick answer

Related SAP-C02 topic practice pages

Design Solutions for Organizational Complexity practice questions

Design for New Solutions practice questions

Continuous Improvement for Existing Solutions practice questions

Accelerate Workload Migration and Modernization practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Practice scenarios

Exhibit

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

An IAM policy is attached to an IAM role that is assumed by an EC2 instance. The EC2 instance has an IP address of 10.0.1.15. The instance is unable to download objects from the S3 bucket 'example-bucket'. What is the MOST likely cause?

Exhibit

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?