View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 81

A company needs to protect an application from unauthorized inbound traffic at the instance level. Which VPC feature should be configured?

1. Route table
2. Security group
3. NAT gateway
4. Internet gateway

Correct Answer: 2

Explanation

A security group acts as a virtual firewall for supported resources such as EC2 instances. It controls inbound and outbound traffic using rules based on protocols, ports, and source or destination addresses. Security groups are stateful, meaning return traffic for an allowed connection is automatically permitted. Route tables control traffic paths, NAT gateways provide outbound internet connectivity for private resources, and internet gateways connect VPCs to the internet. Therefore, a security group is the appropriate VPC feature for controlling instance-level network access.

Question 82

Which AWS service provides centralized secrets storage with automatic rotation capabilities?

1. AWS Secrets Manager
2. AWS KMS
3. AWS Certificate Manager
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Secrets Manager is designed to securely store sensitive information such as database passwords, API credentials, and application secrets. It can integrate with supported services to automatically rotate credentials, reducing the need for administrators to manually change passwords. AWS KMS manages encryption keys, Certificate Manager manages certificates, and Macie helps discover sensitive information in S3. Secrets Manager can also provide applications with secrets programmatically, avoiding the need to hard-code credentials. Therefore, AWS Secrets Manager is the appropriate service for centralized secrets management and automated rotation.

Question 83

A company wants to deploy resources in a second AWS Region for disaster recovery. Which approach provides the most automated infrastructure deployment?

1. Manually recreate every resource
2. Use AWS CloudFormation templates
3. Copy EC2 instance screenshots
4. Use CloudWatch dashboards

Correct Answer: 2

Explanation

AWS CloudFormation allows infrastructure to be defined as code and deployed consistently in multiple AWS Regions. Templates can describe networking, compute, databases, security controls, and other resources required by an application. This makes disaster recovery deployments more repeatable and reduces manual configuration errors. Manually recreating resources can be slow and inconsistent, screenshots do not contain infrastructure configuration, and CloudWatch dashboards are used for monitoring rather than deployment. Therefore, CloudFormation templates provide an effective automated approach for recreating infrastructure in a secondary Region.

Question 84

Which service can automatically distribute incoming HTTPS requests across multiple healthy targets?

1. Amazon Route 53
2. AWS Direct Connect
3. Application Load Balancer
4. AWS Transit Gateway

Correct Answer: 3

Explanation

An Application Load Balancer distributes HTTP and HTTPS traffic across registered targets such as EC2 instances, containers, and IP addresses. It performs health checks and can route requests only to healthy targets. It also supports advanced routing based on hostnames, URL paths, and other HTTP attributes. Route 53 provides DNS routing, Direct Connect provides dedicated network connectivity, and Transit Gateway connects networks. Therefore, an Application Load Balancer is the appropriate service for distributing HTTPS application traffic across multiple healthy targets.

Question 85

A company stores frequently accessed objects in S3 and wants the storage class to automatically move objects between access tiers based on changing usage. Which option should be selected?

1. S3 Glacier Deep Archive
2. S3 Intelligent-Tiering
3. S3 One Zone-IA
4. S3 Standard

Correct Answer: 2

Explanation

S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns. This helps organizations optimize storage costs without manually predicting when individual objects will become less frequently accessed. It is useful when access patterns are unpredictable or change over time. Glacier Deep Archive is intended for long-term archival, One Zone-IA is designed for infrequently accessed data stored in a single Availability Zone, and S3 Standard is intended for frequently accessed data. Therefore, S3 Intelligent-Tiering is the most appropriate choice for automatic tier optimization.

Question 86

Which service can provide centralized visibility into security findings from multiple AWS security services?

1. AWS Security Hub
2. Amazon S3
3. AWS Config
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Security Hub aggregates security findings from supported AWS security services and third-party products into a centralized view. This helps security teams monitor their overall security posture across accounts and workloads. Security Hub can also evaluate supported security standards and provide findings that help organizations identify areas requiring attention. Amazon S3 provides object storage, Config evaluates resource configurations, and Route 53 provides DNS services. Therefore, AWS Security Hub is the appropriate service for centralized security finding visibility.

Question 87

A company requires a database that can automatically scale storage as data grows without manual volume expansion. Which service is a suitable choice?

1. Amazon DynamoDB
2. Amazon EBS
3. Amazon FSx
4. Amazon Neptune

Correct Answer: 1

Explanation

Amazon DynamoDB is a fully managed NoSQL database service designed to provide scalable storage and throughput without requiring customers to manage traditional database storage volumes. It can support workloads that need flexible scaling and predictable performance. EBS requires volume management and resizing for many storage growth scenarios, while FSx provides managed file systems and Neptune provides graph database capabilities. DynamoDB is particularly suitable for applications where data growth and request volume can vary significantly. Therefore, DynamoDB is an appropriate choice for a highly scalable managed database workload.

Question 88

Which service allows applications to securely expose APIs to clients while integrating with Lambda functions?

1. Amazon API Gateway
2. Amazon Route 53
3. AWS DataSync
4. Amazon EFS

Correct Answer: 1

Explanation

Amazon API Gateway is a managed service for creating, publishing, securing, monitoring, and managing APIs. It can integrate directly with AWS Lambda, allowing HTTP requests to invoke serverless functions without requiring the application to manage web servers. API Gateway supports features such as authentication, throttling, monitoring, and request handling. Route 53 provides DNS services, DataSync transfers data between storage environments, and EFS provides shared file storage. Therefore, API Gateway is the appropriate service for exposing managed APIs that integrate with Lambda-based applications.

Question 89

A company needs to run a relational database with automatic backups, patching, and managed infrastructure. Which service should it use?

1. Amazon DynamoDB
2. Amazon RDS
3. Amazon S3
4. Amazon OpenSearch Service

Correct Answer: 2

Explanation

Amazon Relational Database Service provides managed relational database engines and handles many administrative tasks, including infrastructure provisioning, automated backups, software patching, and certain high-availability configurations. This allows teams to focus more on database usage and application development rather than routine infrastructure management. DynamoDB is a NoSQL database, S3 provides object storage, and OpenSearch Service is designed for search and analytics workloads. Therefore, Amazon RDS is the appropriate service when an organization requires a managed relational database with automated operational capabilities.

Question 90

Which AWS service can automatically detect vulnerabilities in EC2 instances and container images?

1. Amazon Inspector
2. Amazon GuardDuty
3. AWS WAF
4. AWS Shield

Correct Answer: 1

Explanation

Amazon Inspector continuously assesses supported AWS workloads for software vulnerabilities and unintended network exposure. It can identify vulnerabilities in supported EC2 instances, container images, and other eligible resources. GuardDuty focuses on detecting suspicious activity and threats, WAF protects web applications from malicious requests, and Shield provides DDoS protection. Inspector is therefore the appropriate service when an organization needs automated vulnerability assessment rather than threat detection or traffic filtering. Its findings can help security teams prioritize remediation of discovered vulnerabilities.

Question 91

A company wants to use a private IP address to access a service hosted by another AWS account. Which technology is designed for this use case?

1. AWS PrivateLink
2. Amazon CloudFront
3. AWS Direct Connect
4. Amazon S3 Transfer Acceleration

Correct Answer: 1

Explanation

AWS PrivateLink enables private connectivity between consumers and supported services using private IP addresses. A service provider can expose an application through an endpoint service, while consumers create interface VPC endpoints to access that service without requiring direct VPC peering. This design is particularly useful when services are shared across accounts or organizations while maintaining network isolation. CloudFront provides content delivery, Direct Connect provides dedicated network connectivity, and S3 Transfer Acceleration improves S3 transfer performance. Therefore, AWS PrivateLink is the appropriate technology for private service access.

Question 92

Which AWS service can centrally manage compliance and governance controls for a multi-account environment?

1. Amazon Inspector
2. AWS Control Tower
3. Amazon Macie
4. AWS DataSync

Correct Answer: 2

Explanation

AWS Control Tower helps organizations establish and govern multi-account AWS environments using automated account provisioning, guardrails, and centralized governance capabilities. It builds on AWS Organizations and can help maintain consistent controls across accounts. Inspector focuses on vulnerability assessment, Macie focuses on sensitive data discovery, and DataSync transfers data between storage systems. Control Tower is particularly useful for enterprises that need standardized account structures and governance controls as their AWS environment grows. Therefore, AWS Control Tower is the appropriate service for centralized multi-account governance.

Question 93

A company needs to store billions of key-value records with very low-latency access. Which database is most appropriate?

1. Amazon RDS
2. Amazon Redshift
3. Amazon DynamoDB
4. Amazon Neptune

Correct Answer: 3

Explanation

Amazon DynamoDB is a managed NoSQL database designed to provide low-latency access at scale. It supports key-value and document data models and can handle very large workloads without requiring traditional database server management. RDS provides relational databases, Redshift is designed for analytical data warehousing, and Neptune is optimized for graph relationships. DynamoDB is particularly appropriate for applications such as gaming, retail, mobile applications, and high-volume transactional systems where predictable low-latency performance is required. Therefore, DynamoDB is the best choice for billions of key-value records requiring fast access.

Question 94

Which service should be used to centrally store audit logs for multiple AWS accounts?

1. AWS CloudTrail
2. Amazon CloudFront
3. AWS Lambda
4. Amazon EFS

Correct Answer: 1

Explanation

AWS CloudTrail records API activity and can be configured to deliver audit logs to centralized storage. In multi-account environments, organizations can create centralized logging architectures where activity from multiple accounts is collected for security monitoring, compliance, and investigations. CloudFront provides content delivery, Lambda provides serverless compute, and EFS provides shared file storage. CloudTrail can capture actions performed through the AWS Management Console, CLI, SDKs, and AWS services. Therefore, AWS CloudTrail is the appropriate service for centralized AWS API audit logging.

Question 95

A company wants to route users to different application versions using a percentage-based traffic split. Which Route 53 policy should be used?

1. Geolocation routing
2. Failover routing
3. Weighted routing
4. Simple routing

Correct Answer: 3

Explanation

Route 53 weighted routing allows DNS traffic to be distributed among multiple endpoints according to assigned weights. This makes it useful for scenarios such as blue-green deployments, gradual releases, and controlled testing of different application versions. For example, an organization can route a small percentage of users to a new version while keeping most users on the existing version. Geolocation routing uses user location, failover routing uses primary and secondary endpoints, and simple routing provides basic DNS responses. Therefore, weighted routing is the correct choice for percentage-based traffic distribution.

Question 96

Which AWS service provides a managed file system optimized for high-performance workloads using the Lustre file system?

1. Amazon FSx for Lustre
2. Amazon EFS
3. Amazon S3
4. Amazon FSx for Windows File Server

Correct Answer: 1

Explanation

Amazon FSx for Lustre provides a managed file system designed for high-performance computing workloads. Lustre is commonly used for applications requiring high throughput and fast access to large datasets, including machine learning, media processing, and scientific computing. EFS provides elastic file storage for general file-based workloads, S3 provides object storage, and FSx for Windows File Server provides Windows-compatible shared storage. Therefore, FSx for Lustre is the appropriate service when an application requires a high-performance managed file system based on Lustre.

Question 97

A company wants to monitor AWS resource configuration changes and determine whether resources comply with internal rules. Which service should be used?

1. AWS CloudTrail
2. AWS Config
3. Amazon GuardDuty
4. AWS Security Hub

Correct Answer: 2

Explanation

AWS Config records and evaluates the configuration of supported AWS resources. It can track configuration changes over time and use Config Rules to determine whether resources comply with defined requirements. This makes Config useful for governance, compliance monitoring, auditing, and configuration management. CloudTrail records API activity, GuardDuty detects suspicious activity, and Security Hub aggregates security findings. Therefore, AWS Config is the appropriate service when an organization needs to monitor resource configurations and evaluate compliance with internal or regulatory requirements.

Question 98

Which AWS service can provide a managed public certificate for an application using HTTPS?

1. AWS Certificate Manager
2. AWS KMS
3. AWS Secrets Manager
4. AWS CloudHSM

Correct Answer: 1

Explanation

AWS Certificate Manager, or ACM, provides managed SSL/TLS certificates that can be used with supported AWS services such as Application Load Balancers and CloudFront. ACM can simplify certificate provisioning and renewal, reducing the administrative work required to maintain HTTPS certificates. KMS manages encryption keys, Secrets Manager stores sensitive application information, and CloudHSM provides dedicated hardware security modules. Therefore, AWS Certificate Manager is the appropriate service for obtaining and managing certificates used to secure supported AWS applications with HTTPS.

Question 99

A company needs to transfer a very large dataset to AWS when network bandwidth is limited. Which solution should be considered?

1. AWS Snowball Edge
2. AWS DataSync
3. Amazon Kinesis
4. AWS Database Migration Service

Correct Answer: 1

Explanation

AWS Snowball Edge provides physical devices that can be used to transfer large amounts of data to and from AWS. It is useful when transferring the data over the network would take too long because of limited bandwidth or other connectivity constraints. DataSync is better suited for online network-based transfers, Kinesis handles streaming data, and DMS is designed primarily for database migration. Therefore, Snowball Edge is an appropriate solution when a large dataset must be moved to AWS and network connectivity is insufficient for practical online transfer.

Question 100

Which service can automatically rotate secrets used by an application?

1. AWS Config
2. AWS Secrets Manager
3. AWS CloudTrail
4. Amazon GuardDuty

Correct Answer: 2

Explanation

AWS Secrets Manager provides secure storage and management of sensitive information such as database credentials and API keys. It supports automated secret rotation for supported services and credential types, helping organizations reduce the risks associated with long-lived credentials. CloudTrail records API activity, Config monitors resource configurations, and GuardDuty detects potential threats. Applications can retrieve secrets programmatically without embedding credentials directly in code. Therefore, AWS Secrets Manager is the appropriate service when automatic credential rotation and secure application secret management are required.