View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 61

Which AWS service provides a managed message broker supporting protocols such as AMQP, MQTT, and STOMP?

1. Amazon Kinesis
2. Amazon EventBridge
3. Amazon MQ
4. Amazon SQS

Correct Answer: 3

Explanation

Amazon MQ is a managed message broker service designed for applications that use traditional messaging technologies and protocols. It supports popular brokers such as ActiveMQ and RabbitMQ, making it useful when migrating existing applications that depend on messaging protocols rather than redesigning them for cloud-native services. Amazon Kinesis is designed for streaming data, EventBridge provides event routing, and SQS provides managed queues. Therefore, Amazon MQ is the appropriate choice when an organization requires a managed broker with compatibility for established messaging protocols and applications.

Question 62

A company wants to run code automatically in response to events without managing servers. Which service should be used?

1. AWS Lambda
2. Amazon EC2
3. Amazon ECS
4. AWS Batch

Correct Answer: 1

Explanation

AWS Lambda provides serverless compute that runs code in response to events without requiring customers to provision or manage servers. Lambda can be triggered by services such as Amazon S3, EventBridge, API Gateway, SQS, and many others. Customers generally pay based on the compute resources and execution time used by their functions. EC2 requires instance management, ECS provides container orchestration, and AWS Batch is designed for batch workloads. Therefore, AWS Lambda is the most appropriate choice for event-driven applications that do not require direct server management.

Question 63

Which AWS service provides a private, dedicated connection from an on-premises environment to AWS?

1. AWS VPN
2. AWS Direct Connect
3. AWS PrivateLink
4. Amazon CloudFront

Correct Answer: 2

Explanation

AWS Direct Connect establishes a dedicated network connection between an organization’s on-premises infrastructure and AWS. It can provide more predictable bandwidth and network performance than internet-based connectivity. Direct Connect is commonly used in hybrid architectures where applications or databases need consistent private connectivity to AWS resources. A VPN uses encrypted tunnels over existing network connections, PrivateLink provides private access to supported services, and CloudFront is a content delivery network. Therefore, AWS Direct Connect is the appropriate option when dedicated connectivity between an on-premises environment and AWS is required.

Question 64

A company wants to prevent public access to an S3 bucket. Which configuration should be enabled?

1. S3 Versioning
2. S3 Lifecycle
3. S3 Transfer Acceleration
4. S3 Block Public Access

Correct Answer: 4

Explanation

S3 Block Public Access provides controls that help prevent Amazon S3 buckets and objects from becoming publicly accessible through certain bucket policies, access control lists, or other public configurations. It is an important security control for organizations that do not require public access to their S3 data. Versioning maintains multiple object versions, Lifecycle rules manage object transitions and expiration, and Transfer Acceleration improves transfer performance. Therefore, S3 Block Public Access is the appropriate configuration for reducing the risk of accidental public exposure.

Question 65

Which service can centrally manage encryption keys used by multiple AWS services?

1. AWS KMS
2. AWS WAF
3. AWS Shield
4. AWS Config

Correct Answer: 1

Explanation

AWS Key Management Service provides centralized creation and management of cryptographic keys used by many AWS services. Organizations can control key access through key policies and IAM permissions and can monitor key usage for security and compliance purposes. KMS integrates with services such as S3, EBS, RDS, and many others. AWS WAF protects web applications, Shield provides DDoS protection, and Config evaluates resource configurations. Therefore, AWS KMS is the appropriate service when an organization requires centralized management of encryption keys across multiple AWS services.

Question 66

A company needs to send large volumes of real-time streaming data to multiple consumers. Which service is most appropriate?

1. Amazon SQS
2. Amazon SNS
3. Amazon Kinesis Data Streams
4. Amazon MQ

Correct Answer: 3

Explanation

Amazon Kinesis Data Streams is designed to collect and process large volumes of real-time streaming data. It can ingest events continuously from applications, devices, and other sources while allowing multiple consumers to process the same stream. This makes it suitable for telemetry, clickstream analytics, real-time monitoring, and similar workloads. SQS provides queue-based messaging, SNS provides publish-subscribe notifications, and Amazon MQ supports traditional message brokers. Therefore, Kinesis Data Streams is the appropriate service when applications need scalable real-time data streaming with multiple consumers.

Question 67

Which Route 53 routing policy is useful for distributing traffic between endpoints according to assigned percentages?

1. Failover routing
2. Weighted routing
3. Geolocation routing
4. Latency-based routing

Correct Answer: 2

Explanation

Amazon Route 53 weighted routing distributes DNS traffic among multiple resources according to configured weights. For example, an organization can assign 90% of traffic to one endpoint and 10% to another. This capability can be useful for gradual application releases, testing, and controlled traffic distribution. Failover routing is intended for primary and secondary endpoints, geolocation routing directs users according to geographic location, and latency-based routing uses network latency measurements. Therefore, weighted routing is the appropriate choice when traffic needs to be distributed according to configured percentages.

Question 68

A company wants to deploy a web application globally with edge caching and HTTPS support. Which service should be used?

1. Amazon CloudFront
2. Amazon S3 Glacier
3. AWS Transit Gateway
4. Amazon EBS

Correct Answer: 1

Explanation

Amazon CloudFront is a global content delivery network that caches content at edge locations closer to users. It supports HTTPS and can integrate with origins such as Amazon S3, Application Load Balancers, and other supported endpoints. CloudFront can improve performance by reducing the distance between users and frequently requested content. S3 Glacier is an archival storage service, Transit Gateway provides network connectivity, and EBS provides block storage. Therefore, CloudFront is the appropriate service for globally distributing web content while benefiting from edge caching and HTTPS support.

Question 69

Which AWS service can detect suspicious activity and potential threats across AWS accounts?

1. Amazon Inspector
2. AWS Config
3. Amazon GuardDuty
4. AWS Trusted Advisor

Correct Answer: 3

Explanation

Amazon GuardDuty is a managed threat detection service that continuously analyzes supported AWS data sources to identify suspicious activity and potential security threats. It can detect findings involving unusual API behavior, compromised credentials, malicious network activity, and other indicators of compromise. Inspector focuses on vulnerability assessment, Config evaluates resource configurations, and Trusted Advisor provides recommendations across areas such as cost and security. Therefore, GuardDuty is the appropriate service when an organization needs managed threat detection across its AWS environment.

Question 70

A company needs to authenticate workforce users to multiple AWS accounts from one centralized location. Which service should be considered?

1. IAM Access Analyzer
2. AWS IAM Identity Center
3. AWS Secrets Manager
4. Amazon Cognito

Correct Answer: 2

Explanation

AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts and supported applications. Organizations can manage users and groups and assign access to accounts using permission sets. This simplifies authentication and authorization in multi-account environments because users do not need separate IAM users in every account. IAM Access Analyzer helps identify unintended access, Secrets Manager stores sensitive credentials, and Amazon Cognito is primarily designed for application users. Therefore, IAM Identity Center is the appropriate solution for centralized workforce access across multiple AWS accounts.

Question 71

Which service can provide DNS records and domain name resolution for AWS resources?

1. Amazon Route 53
2. AWS CloudFormation
3. Amazon CloudWatch
4. AWS IAM

Correct Answer: 1

Explanation

Amazon Route 53 is a scalable managed DNS service that can host DNS zones and resolve domain names to resources and endpoints. It supports several routing policies, health checks, domain registration, and DNS management capabilities. CloudFormation is used for infrastructure deployment, CloudWatch provides monitoring and observability, and IAM manages identities and permissions. Route 53 can be used for both public DNS and private DNS within VPC environments. Therefore, Amazon Route 53 is the correct service for managing DNS records and domain name resolution.

Question 72

A company needs to distribute an application across multiple EC2 instances and perform HTTP path-based routing. Which load balancer should be used?

1. Network Load Balancer
2. Gateway Load Balancer
3. Application Load Balancer
4. Classic Load Balancer

Correct Answer: 3

Explanation

An Application Load Balancer operates at the application layer and supports advanced HTTP and HTTPS routing capabilities. It can route requests based on information such as URL paths, hostnames, HTTP headers, and other request attributes. This makes it particularly suitable for modern web applications and microservices architectures. Network Load Balancer is designed for high-performance Layer 4 traffic, Gateway Load Balancer is used for network appliances, and Classic Load Balancer is a legacy option. Therefore, an Application Load Balancer is the correct choice for HTTP path-based routing.

Question 73

Which service provides managed protection against common distributed denial-of-service attacks?

1. AWS Shield
2. Amazon Macie
3. AWS Secrets Manager
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS Shield provides managed DDoS protection for applications running on AWS. Shield Standard automatically protects against many common network and transport-layer attacks, while Shield Advanced provides additional capabilities for organizations with more advanced DDoS protection requirements. Macie focuses on sensitive data discovery, Secrets Manager protects application secrets, and Inspector performs vulnerability assessments. Therefore, AWS Shield is the appropriate service when the primary requirement is protection against distributed denial-of-service attacks affecting AWS applications and resources.

Question 74

A company wants to create isolated public and private network segments within a VPC. Which component provides this segmentation?

1. Route tables
2. Security groups
3. Subnets
4. Internet gateways

Correct Answer: 3

Explanation

Subnets divide a VPC’s IP address range into smaller network segments. Organizations can create public subnets for resources that need routes to the internet and private subnets for resources that should not have direct inbound internet access. Route tables determine how traffic is routed, security groups provide instance-level stateful traffic controls, and internet gateways provide connectivity between a VPC and the internet. Therefore, subnets are the primary component used to create separate network segments within a VPC.

Question 75

Which AWS service provides centralized management of firewall policies across multiple AWS accounts and resources?

1. AWS Firewall Manager
2. AWS WAF
3. AWS Shield
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Firewall Manager provides centralized management of firewall and security policies across AWS accounts and resources in an organization. It can help administrators apply consistent AWS WAF, Shield Advanced, security group, and related policies across multiple accounts. AWS WAF itself filters web requests but does not provide the same centralized multi-account policy management capability. Shield focuses on DDoS protection, while GuardDuty provides threat detection. Therefore, AWS Firewall Manager is the appropriate choice for centrally managing security policies across a multi-account AWS environment.

Question 76

Which storage service provides highly durable object storage with virtually unlimited scalability?

1. Amazon EFS
2. Amazon EBS
3. Amazon S3
4. Amazon FSx

Correct Answer: 3

Explanation

Amazon S3 provides highly durable object storage designed to scale to very large amounts of data. It is suitable for backups, media files, data lakes, application assets, logs, and many other object-based workloads. S3 offers multiple storage classes to support different access and cost requirements. EFS provides shared file storage, EBS provides block storage for compute workloads, and FSx provides managed file systems for specific use cases. Therefore, Amazon S3 is the appropriate service when an organization requires scalable and highly durable object storage.

Question 77

A company needs to analyze application logs and create visual dashboards from log-derived metrics. Which service is most appropriate?

1. Amazon CloudWatch
2. AWS Organizations
3. AWS Direct Connect
4. AWS Certificate Manager

Correct Answer: 1

Explanation

Amazon CloudWatch provides monitoring, logging, metrics, alarms, and dashboards for AWS resources and applications. CloudWatch Logs can collect application logs, while metric filters can convert matching log patterns into metrics that can be displayed through CloudWatch dashboards. This allows operations teams to monitor application behavior and identify trends or problems. Organizations manages AWS accounts, Direct Connect provides dedicated connectivity, and Certificate Manager handles certificates. Therefore, Amazon CloudWatch is the most appropriate service for analyzing logs and creating monitoring dashboards.

Question 78

Which AWS service can provide a managed PostgreSQL-compatible relational database with high availability?

1. Amazon DynamoDB
2. Amazon Aurora PostgreSQL
3. Amazon Neptune
4. Amazon OpenSearch Service

Correct Answer: 2

Explanation

Amazon Aurora PostgreSQL is a managed relational database engine compatible with PostgreSQL. Aurora provides features designed for high availability, including replication and automated failover capabilities. It also reduces many database administration tasks by providing managed backups, patching, and infrastructure operations. DynamoDB is a NoSQL database, Neptune is designed for graph workloads, and OpenSearch Service is intended for search and analytics. Therefore, Aurora PostgreSQL is the appropriate choice when an organization needs a managed PostgreSQL-compatible relational database with high availability capabilities.

Question 79

Which AWS service helps identify unintended access to resources by analyzing resource policies?

1. Amazon GuardDuty
2. AWS IAM Access Analyzer
3. AWS Security Hub
4. Amazon Inspector

Correct Answer: 2

Explanation

IAM Access Analyzer helps identify resources that are accessible from outside their intended trust boundaries by analyzing resource-based policies. It can help organizations detect unintended external access to resources such as S3 buckets, IAM roles, and other supported resources. GuardDuty focuses on threat detection, Security Hub centralizes security findings, and Inspector evaluates vulnerabilities. Access Analyzer is therefore particularly useful when security teams want to understand whether resource policies grant access to external accounts or principals unexpectedly. This supports least-privilege and secure access management practices.

Question 80

A company needs a service that can provide temporary, secure credentials to AWS resources without embedding access keys in application code. Which option is best?

1. IAM roles
2. IAM users
3. IAM groups
4. IAM password policies

Correct Answer: 1

Explanation

IAM roles provide temporary security credentials that applications and AWS services can use to access required resources. Applications can assume roles through supported AWS mechanisms rather than storing long-term access keys in source code. This improves security and supports the principle of least privilege because the role can contain only the permissions required by the workload. IAM users are intended for identities, groups organize users, and password policies control password requirements. Therefore, IAM roles are the best option for securely providing temporary credentials to AWS workloads.