View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 121

Which AWS service provides a managed service for deploying and operating Kubernetes clusters?

1. Amazon ECS
2. AWS Fargate
3. Amazon EKS
4. AWS Batch

Correct Answer: 3

Explanation

Amazon Elastic Kubernetes Service, or Amazon EKS, is a managed Kubernetes service that simplifies running Kubernetes clusters on AWS. AWS manages the Kubernetes control plane while customers can choose appropriate compute options for their workloads. Amazon ECS is AWS’s own container orchestration service, Fargate provides serverless compute for containers, and AWS Batch is designed for batch processing. Therefore, Amazon EKS is the appropriate service when an organization specifically requires Kubernetes for container orchestration and wants AWS to manage the Kubernetes control plane.

Question 122

A company wants to reduce the cost of running EC2 workloads that can tolerate interruptions. Which purchasing option should it consider?

1. Spot Instances
2. Dedicated Hosts
3. On-Demand Instances
4. Reserved Instances

Correct Answer: 1

Explanation

Amazon EC2 Spot Instances allow organizations to use spare AWS compute capacity at significantly reduced prices compared with On-Demand Instances. However, Spot Instances can be interrupted when AWS needs the capacity back, so they are best suited for fault-tolerant workloads such as batch processing, distributed workloads, and flexible data processing jobs. Dedicated Hosts are intended for specific licensing or compliance requirements, On-Demand Instances provide flexible standard pricing, and Reserved Instances offer discounts for committed usage. Therefore, Spot Instances are appropriate for interruptible workloads where cost optimization is important.

Question 123

Which AWS service provides a dedicated physical server for workloads with specific licensing requirements?

1. Dedicated Instance
2. Dedicated Host
3. Spot Instance
4. Reserved Instance

Correct Answer: 2

Explanation

An EC2 Dedicated Host provides a physical server dedicated to a single customer. It is useful for workloads that have specific server-bound software licensing requirements or organizational compliance needs. Dedicated Instances also run on hardware dedicated to a customer but do not provide the same level of visibility and control over physical host allocation. Spot Instances focus on discounted spare capacity, while Reserved Instances provide pricing benefits based on commitment. Therefore, Dedicated Hosts are the appropriate option when physical server visibility and dedicated host control are required.

Question 124

A company needs to migrate a large number of virtual machines to AWS while minimizing manual conversion work. Which service can help automate server migration?

1. AWS DataSync
2. AWS Database Migration Service
3. AWS Application Migration Service
4. AWS Transfer Family

Correct Answer: 3

Explanation

AWS Application Migration Service helps organizations migrate physical, virtual, and cloud servers to AWS. It provides continuous replication and supports automated conversion and launch processes, reducing the manual work involved in large-scale server migrations. DataSync is designed for transferring files and objects, DMS focuses on database migration, and Transfer Family provides managed file transfer protocols. Therefore, AWS Application Migration Service is the appropriate choice when an organization needs to migrate many servers or virtual machines to AWS efficiently.

Question 125

Which service allows a company to run code at AWS edge locations closer to users?

1. AWS Lambda@Edge
2. Amazon RDS
3. AWS Batch
4. Amazon EBS

Correct Answer: 1

Explanation

AWS Lambda@Edge allows Lambda functions to run at CloudFront edge locations. This can reduce latency for certain request-processing tasks because the code executes closer to end users. It is useful for scenarios such as request manipulation, authorization logic, and dynamic content customization associated with CloudFront distributions. Amazon RDS provides relational databases, AWS Batch handles batch computing, and EBS provides block storage. Therefore, Lambda@Edge is the appropriate service when application logic needs to execute closer to geographically distributed users.

Question 126

Which AWS service provides centralized governance for encryption keys, certificates, and other security controls across accounts?

1. AWS Control Tower
2. AWS Organizations
3. AWS Security Hub
4. AWS IAM Identity Center

Correct Answer: 1

Explanation

AWS Control Tower helps establish and govern multi-account AWS environments using centralized controls and guardrails. It provides a structured approach for setting up accounts and enforcing organizational policies consistently. Organizations provides the underlying multi-account management capabilities, Security Hub centralizes security findings, and IAM Identity Center manages workforce access. Control Tower can integrate with these services to establish broader governance. Therefore, among the listed options, AWS Control Tower is the most appropriate choice for centralized multi-account governance and standardized security controls.

Question 127

A workload requires a consistent high network bandwidth connection between EC2 instances in the same cluster. Which EC2 feature should be considered?

1. Elastic IP
2. Enhanced networking
3. NAT gateway
4. Internet gateway

Correct Answer: 2

Explanation

EC2 enhanced networking provides higher network bandwidth and lower network latency by using supported network interfaces and virtualization technologies. It is particularly useful for compute-intensive and network-intensive applications such as high-performance computing, distributed analytics, and large-scale data processing. Elastic IP addresses provide static public addresses, NAT gateways provide outbound internet connectivity, and internet gateways connect VPC resources to the internet. Therefore, enhanced networking is the appropriate EC2 capability when applications require high network throughput and low latency between compute resources.

Question 128

Which AWS service provides centralized policy-based management of EC2 image creation and sharing?

1. Amazon Inspector
2. EC2 Image Builder
3. AWS Config
4. AWS Systems Manager

Correct Answer: 2

Explanation

EC2 Image Builder automates the creation, testing, and distribution of customized machine images. Organizations can define image pipelines that install software, apply configuration settings, perform tests, and distribute approved images across supported AWS environments. This helps maintain consistent and secure operating system images while reducing manual image preparation. Inspector focuses on vulnerability assessment, Config evaluates resource configurations, and Systems Manager provides operational management capabilities. Therefore, EC2 Image Builder is the appropriate service for automated creation and distribution of standardized EC2 images.

Question 129

A company wants to connect its on-premises network to AWS using encrypted tunnels over the internet. Which service should it use?

1. AWS Direct Connect
2. AWS PrivateLink
3. AWS Site-to-Site VPN
4. Amazon CloudFront

Correct Answer: 3

Explanation

AWS Site-to-Site VPN creates encrypted tunnels between an on-premises network and an Amazon VPC over the internet. It is commonly used for hybrid connectivity when dedicated connectivity such as Direct Connect is not required or as a backup connection. Direct Connect provides a dedicated network connection, PrivateLink provides private access to supported services, and CloudFront distributes content globally. Therefore, AWS Site-to-Site VPN is the appropriate solution for establishing encrypted network connectivity between an on-premises environment and AWS over the internet.

Question 130

Which AWS service can automatically create and maintain a fleet of EC2 instances based on a desired capacity?

1. AWS Batch
2. Amazon EC2 Auto Scaling
3. AWS Systems Manager
4. AWS CloudFormation

Correct Answer: 2

Explanation

Amazon EC2 Auto Scaling maintains the desired number of instances in an Auto Scaling group and can automatically launch replacement instances when existing instances become unhealthy. It can also adjust capacity according to scaling policies based on workload demand. AWS Batch manages batch jobs, Systems Manager provides operational management, and CloudFormation deploys infrastructure from templates. Auto Scaling is specifically designed to maintain compute capacity and adapt it according to defined requirements. Therefore, Amazon EC2 Auto Scaling is the appropriate service for maintaining an EC2 fleet based on desired capacity.

Question 131

A company needs a global database with cross-Region replication and fast local reads. Which Aurora feature should be considered?

1. Aurora Serverless
2. Aurora Replicas
3. Aurora Global Database
4. Aurora automated backups

Correct Answer: 3

Explanation

Amazon Aurora Global Database is designed for applications that require databases distributed across multiple AWS Regions. It uses dedicated replication between Regions and allows applications to serve read workloads closer to users in different geographic locations. This can reduce read latency and improve disaster recovery capabilities. Aurora Serverless focuses on automatically adjusting capacity, Aurora Replicas provide additional read instances within an Aurora deployment, and automated backups support recovery. Therefore, Aurora Global Database is the appropriate feature for cross-Region replication and geographically distributed read access.

Question 132

Which service can automatically discover and recommend rightsizing opportunities for EC2 workloads?

1. AWS Compute Optimizer
2. AWS CloudTrail
3. Amazon GuardDuty
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Compute Optimizer analyzes AWS resource utilization and provides recommendations that can help organizations select more appropriate resource configurations. For supported EC2 workloads, it can identify potential rightsizing opportunities based on observed utilization patterns. This can help reduce unnecessary costs or improve performance when resources are incorrectly sized. CloudTrail records API activity, GuardDuty detects threats, and Macie discovers sensitive information. Therefore, AWS Compute Optimizer is the appropriate service when an organization wants automated recommendations for optimizing EC2 resource configurations.

Question 133

A company needs to control outbound traffic from private subnets using domain-based firewall rules. Which service should be considered?

1. AWS WAF
2. AWS Network Firewall
3. Amazon GuardDuty
4. AWS Shield

Correct Answer: 2

Explanation

AWS Network Firewall provides stateful and stateless network traffic inspection capabilities and can be used to enforce centralized network security policies. It supports rules for controlling network traffic and can be integrated into VPC architectures to inspect traffic flowing through designated firewall endpoints. AWS WAF focuses on web application requests, GuardDuty detects threats, and Shield provides DDoS protection. Therefore, AWS Network Firewall is the appropriate service for enforcing network-level outbound traffic controls within a VPC architecture.

Question 134

Which storage option is best for an EC2 instance requiring temporary high-speed local storage?

1. Amazon S3
2. Amazon EBS
3. EC2 Instance Store
4. Amazon EFS

Correct Answer: 3

Explanation

EC2 Instance Store provides temporary block-level storage physically associated with the host computer running an EC2 instance. It can offer very high I/O performance and low latency, making it useful for temporary data such as caches, buffers, and scratch files. However, instance store data is ephemeral and can be lost when the instance is stopped, terminated, or moved depending on the situation. EBS provides persistent block storage, EFS provides shared file storage, and S3 provides object storage. Therefore, Instance Store is appropriate for temporary high-speed data.

Question 135

Which service provides managed, highly available file storage that can be accessed concurrently by Linux instances?

1. Amazon EFS
2. Amazon EBS
3. Amazon S3
4. Amazon FSx for Windows File Server

Correct Answer: 1

Explanation

Amazon Elastic File System provides managed file storage that can be mounted by multiple Linux-based compute resources concurrently. EFS is designed to scale automatically as files are added or removed and can support access from resources across Availability Zones. EBS provides block storage primarily associated with individual EC2 instances, S3 provides object storage, and FSx for Windows File Server is optimized for Windows-based workloads. Therefore, Amazon EFS is the appropriate solution for shared, highly available file storage for Linux applications.

Question 136

A company wants to restrict access to an S3 bucket to requests originating from a specific VPC endpoint. Which mechanism should be used?

1. Security group
2. IAM password policy
3. S3 bucket policy
4. Route table

Correct Answer: 3

Explanation

An S3 bucket policy can use policy conditions to restrict access based on characteristics such as the VPC endpoint through which requests are made. This allows organizations to enforce access boundaries for private S3 access architectures. Security groups control network traffic to supported resources, IAM password policies govern password requirements, and route tables determine network paths. Bucket policies provide resource-level authorization controls for S3 and can work with VPC endpoint conditions. Therefore, an S3 bucket policy is the appropriate mechanism for restricting bucket access to a specific VPC endpoint.

Question 137

Which AWS service helps organizations centrally manage software patching across EC2 instances?

1. AWS Systems Manager
2. Amazon Inspector
3. AWS CloudFormation
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Systems Manager provides operational management capabilities for AWS and hybrid infrastructure. Its Patch Manager capability can help organizations define patch baselines, schedule patching operations, and monitor patch compliance across supported managed instances. Inspector identifies vulnerabilities but does not replace a centralized patch management workflow, CloudFormation deploys infrastructure, and GuardDuty detects threats. Therefore, AWS Systems Manager is the appropriate service for centrally managing operating system patches across EC2 instances and other supported managed nodes.

Question 138

A company wants to distribute read-only copies of an RDS database to multiple applications for read scaling. Which feature should be used?

1. RDS Multi-AZ
2. RDS Read Replicas
3. RDS automated backups
4. RDS parameter groups

Correct Answer: 2

Explanation

RDS Read Replicas create read-only copies of a database that can serve additional read traffic. They are designed primarily for read scalability and can help reduce the workload on the primary database. RDS Multi-AZ deployments focus on high availability and failover rather than primarily scaling read traffic. Automated backups provide recovery capabilities, while parameter groups control database configuration settings. Therefore, RDS Read Replicas are the appropriate feature when applications need additional read capacity without directing all queries to the primary database.

Question 139

Which AWS service provides a managed service for securely storing and processing data in a data lake?

1. Amazon S3
2. Amazon EBS
3. Amazon EFS
4. Amazon FSx

Correct Answer: 1

Explanation

Amazon S3 is commonly used as the foundational storage layer for AWS data lakes because it provides highly durable, scalable object storage and supports many data formats. Data can be stored centrally and accessed by analytics services such as Athena, Redshift, EMR, and other AWS services. EBS provides block storage, EFS provides file storage, and FSx provides specialized managed file systems. Therefore, Amazon S3 is the appropriate foundational storage service for a scalable data lake architecture.

Question 140

A company wants to deploy a new application version gradually while keeping the existing version available. Which deployment strategy is suitable?

1. Recreate deployment
2. Blue/green deployment
3. Big-bang migration
4. Manual deployment

Correct Answer: 2

Explanation

A blue/green deployment maintains two application environments: the existing environment and the new version. Traffic can be shifted from the old environment to the new environment after validation, allowing organizations to reduce deployment risk and quickly return traffic to the previous version if problems occur. A recreate deployment generally replaces the existing version, while a big-bang migration changes the workload all at once. Manual deployment does not provide the same controlled release mechanism. Therefore, blue/green deployment is appropriate for gradually moving production traffic to a new application version.