View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 141

A company needs to execute a workflow that contains several Lambda functions in a specific sequence. Which service should be used?

1. Amazon EventBridge
2. AWS Step Functions
3. Amazon SQS
4. Amazon SNS

Correct Answer: 2

Explanation

AWS Step Functions is a managed workflow service that coordinates multiple tasks and services into defined state machines. It can invoke Lambda functions sequentially or in parallel and supports branching, retries, error handling, and workflow status tracking. This makes it useful for complex application workflows without requiring developers to implement orchestration logic inside individual functions. EventBridge routes events, SQS provides message queues, and SNS provides publish-subscribe notifications. Therefore, Step Functions is the appropriate choice when multiple Lambda functions must execute as part of an organized workflow.

Question 142

Which AWS service allows applications to publish messages that can be delivered to multiple subscribers?

1. Amazon SNS
2. Amazon EBS
3. Amazon EFS
4. Amazon RDS

Correct Answer: 1

Explanation

Amazon Simple Notification Service provides a publish-subscribe messaging model in which publishers send messages to an SNS topic and multiple subscribers can receive those messages. Subscribers can include Lambda functions, SQS queues, HTTP endpoints, email destinations, and other supported targets. This design is useful when one event needs to trigger multiple independent processing systems. EBS and EFS provide storage, while RDS provides managed relational databases. Therefore, Amazon SNS is the appropriate service for distributing published messages to multiple subscribers.

Question 143

A company wants to decouple application components by placing messages in a durable queue. Which service should be selected?

1. Amazon EventBridge
2. Amazon SNS
3. Amazon SQS
4. AWS Step Functions

Correct Answer: 3

Explanation

Amazon Simple Queue Service provides managed message queues that allow application components to communicate asynchronously. Producers can place messages in a queue while consumers process them independently, reducing direct dependencies between components. SQS queues can retain messages until consumers are ready to process them, helping applications handle traffic spikes and temporary processing failures. EventBridge focuses on event routing, SNS provides publish-subscribe messaging, and Step Functions orchestrates workflows. Therefore, Amazon SQS is the appropriate service for durable queue-based application decoupling.

Question 144

Which AWS service can provide centralized application configuration data without storing it directly in source code?

1. AWS Systems Manager Parameter Store
2. Amazon CloudFront
3. AWS Shield
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration values and parameters. Applications can retrieve configuration data at runtime instead of embedding environment-specific settings directly into source code. Parameters can include strings, configuration values, and sensitive information when appropriate protection mechanisms are used. CloudFront provides content delivery, Shield provides DDoS protection, and Route 53 provides DNS services. Therefore, Systems Manager Parameter Store is an appropriate solution for centrally managing application configuration values across environments.

Question 145

A workload requires a globally distributed key-value database with low-latency reads and writes. Which option should be considered?

1. Amazon Aurora Global Database
2. Amazon DynamoDB global tables
3. Amazon RDS Multi-AZ
4. Amazon Redshift

Correct Answer: 2

Explanation

DynamoDB global tables provide a multi-Region database architecture for applications requiring low-latency access from geographically distributed users. Data can be replicated across selected AWS Regions, allowing applications to read and write locally while maintaining replicated data across Regions. Aurora Global Database is designed for relational database workloads, RDS Multi-AZ primarily improves availability within a Region, and Redshift is an analytics warehouse. Therefore, DynamoDB global tables are appropriate for globally distributed key-value or document workloads requiring low-latency access.

Question 146

Which AWS service can provide a managed message queue with FIFO ordering?

1. Amazon SQS
2. Amazon SNS
3. Amazon Kinesis Data Firehose
4. Amazon EventBridge

Correct Answer: 1

Explanation

Amazon SQS supports FIFO queues that preserve message ordering and provide deduplication capabilities. FIFO queues are useful when applications must process messages in a controlled sequence or avoid processing duplicate messages under supported configurations. SNS provides pub-sub messaging, Kinesis Data Firehose delivers streaming data to destinations, and EventBridge routes events based on rules. Therefore, Amazon SQS FIFO queues are the appropriate choice when an application requires managed queueing with message ordering and deduplication capabilities.

Question 147

A company wants to ingest streaming data and automatically deliver it to Amazon S3 without managing consumers. Which service is suitable?

1. Amazon Kinesis Data Streams
2. Amazon Kinesis Data Firehose
3. Amazon SQS
4. Amazon EventBridge

Correct Answer: 2

Explanation

Amazon Kinesis Data Firehose is a managed delivery service that can ingest streaming data and deliver it to supported destinations such as Amazon S3, Amazon Redshift, and Amazon OpenSearch Service. It handles much of the infrastructure required for buffering and delivery, reducing the need to develop custom consumer applications. Kinesis Data Streams provides more direct control over stream consumption, SQS provides queues, and EventBridge provides event routing. Therefore, Kinesis Data Firehose is the appropriate service when streaming data needs to be delivered automatically to S3.

Question 148

A company needs to encrypt data stored on EBS volumes. Which service provides the encryption keys?

1. Amazon GuardDuty
2. AWS KMS
3. AWS Config
4. Amazon Inspector

Correct Answer: 2

Explanation

AWS Key Management Service provides managed cryptographic keys that can be used to encrypt Amazon EBS volumes and snapshots. EBS encryption helps protect data at rest and can be enabled using AWS managed or customer managed KMS keys depending on organizational requirements. GuardDuty provides threat detection, Config monitors resource configurations, and Inspector performs vulnerability assessments. KMS integrates with many AWS services and provides centralized control over encryption key usage. Therefore, AWS KMS is the appropriate service for managing keys used with EBS encryption.

Question 149

A company wants to prevent an EC2 instance from receiving traffic directly from the internet while allowing it to receive requests from a load balancer. Which design is appropriate?

1. Place the instance in a private subnet and allow traffic from the load balancer security group
2. Assign a public IP and allow all inbound traffic
3. Place the instance in a public subnet without a security group
4. Use an internet gateway as the only security control

Correct Answer: 1

Explanation

Placing application instances in private subnets helps prevent direct internet exposure. A security group can then allow inbound traffic only from the security group associated with the load balancer. This creates a layered architecture in which users communicate with the public load balancer while backend instances remain privately accessible. Assigning a public IP would increase exposure, and an internet gateway alone does not provide application-level access control. Therefore, using private subnets with security-group-based access from the load balancer is the appropriate design.

Question 150

Which AWS service provides centralized management of multiple AWS accounts under one organization?

1. AWS Organizations
2. AWS Control Tower
3. AWS IAM
4. AWS Artifact

Correct Answer: 1

Explanation

AWS Organizations enables centralized management of multiple AWS accounts. It allows organizations to create organizational units, apply service control policies, consolidate billing, and manage account relationships. Control Tower builds on Organizations to provide additional landing-zone and governance capabilities, while IAM manages identities and permissions within accounts. Artifact provides access to compliance reports and agreements. Therefore, AWS Organizations is the foundational service for centrally managing multiple AWS accounts and implementing organization-wide account governance.

Question 151

A company wants to restrict AWS service usage across member accounts using organization-wide permissions boundaries. Which feature should be used?

1. IAM policies
2. Service control policies
3. Security groups
4. Route tables

Correct Answer: 2

Explanation

Service control policies, or SCPs, are used with AWS Organizations to establish permission guardrails across member accounts. SCPs do not grant permissions themselves; instead, they define the maximum available permissions that IAM users and roles can exercise within affected accounts. IAM policies grant permissions to identities, security groups control network traffic, and route tables control network paths. Therefore, SCPs are appropriate when an organization needs centralized restrictions on which AWS services or actions accounts can use.

Question 152

Which AWS service can help detect sensitive information stored in Amazon S3?

1. Amazon Macie
2. Amazon GuardDuty
3. AWS Shield
4. AWS WAF

Correct Answer: 1

Explanation

Amazon Macie is a managed data security and privacy service that uses machine learning and pattern matching to discover and help protect sensitive data stored in Amazon S3. It can identify certain types of personally identifiable information and other sensitive content and provide findings that help organizations investigate potential exposure. GuardDuty focuses on threat detection, Shield protects against DDoS attacks, and WAF filters web requests. Therefore, Amazon Macie is the appropriate service for discovering sensitive information in S3.

Question 153

A company needs to allow users to access AWS accounts using their existing corporate identities. Which service should be considered?

1. AWS IAM Identity Center
2. Amazon Cognito
3. AWS Secrets Manager
4. Amazon Macie

Correct Answer: 1

Explanation

AWS IAM Identity Center supports workforce access to AWS accounts and applications using centralized identities. It can integrate with an organization’s existing identity provider and allows administrators to assign users and groups to AWS accounts through permission sets. Amazon Cognito is primarily intended for application end users, Secrets Manager stores credentials and secrets, and Macie discovers sensitive data. Therefore, IAM Identity Center is the appropriate service when employees need centralized access to multiple AWS accounts using corporate identities.

Question 154

Which AWS service can continuously assess resources against security best practices and provide recommendations?

1. AWS Trusted Advisor
2. Amazon ECR
3. Amazon SQS
4. AWS Transfer Family

Correct Answer: 1

Explanation

AWS Trusted Advisor provides recommendations across several categories, including security, cost optimization, performance, fault tolerance, and service limits. It can identify certain configuration conditions and suggest actions that may improve an AWS environment. ECR stores container images, SQS provides message queues, and Transfer Family supports managed file transfers. Trusted Advisor is therefore useful when organizations want AWS recommendations that can highlight potential improvements across their infrastructure. Its recommendations can complement, but do not replace, detailed security assessments and monitoring.

Question 155

A company needs to encrypt a large amount of data before storing it in S3 while retaining control over encryption keys. Which option is suitable?

1. S3 server-side encryption with customer managed KMS keys
2. S3 public access
3. S3 Transfer Acceleration
4. S3 Lifecycle rules

Correct Answer: 1

Explanation

S3 server-side encryption with AWS KMS keys, commonly called SSE-KMS, allows organizations to encrypt objects stored in S3 while using KMS-managed encryption keys. Customer managed KMS keys provide greater control over key policies, permissions, rotation settings, and auditing than AWS managed keys. Public access settings do not provide encryption, Transfer Acceleration improves data transfer performance, and Lifecycle rules manage object transitions and expiration. Therefore, SSE-KMS with customer managed keys is appropriate when an organization requires encrypted S3 data and direct control over the encryption keys.

Question 156

Which AWS service can automatically distribute applications across multiple Availability Zones using an Auto Scaling group?

1. Amazon EC2 Auto Scaling
2. AWS CloudTrail
3. Amazon Inspector
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon EC2 Auto Scaling can maintain application capacity across multiple Availability Zones by launching instances according to the configured Auto Scaling group settings. If an Availability Zone or individual instance experiences a failure, the group can replace unhealthy capacity and maintain the desired number of instances. CloudTrail records API activity, Inspector assesses vulnerabilities, and Artifact provides compliance documentation. Therefore, EC2 Auto Scaling is the appropriate service for maintaining distributed compute capacity and improving application resilience across Availability Zones.

Question 157

A company wants to provide users with temporary access to an AWS role without creating long-term IAM credentials. Which approach is appropriate?

1. IAM role assumption
2. IAM user access keys
3. Root user credentials
4. Static application passwords

Correct Answer: 1

Explanation

IAM role assumption provides temporary security credentials that expire after a defined period. Users, applications, and AWS services can assume roles when authorized, allowing access without requiring long-term access keys. This approach supports least privilege and reduces the risk associated with permanent credentials. IAM user access keys are long-term credentials unless rotated or otherwise managed, root credentials should not be used for routine access, and static passwords are not an appropriate AWS authorization mechanism. Therefore, assuming an IAM role is the appropriate approach for temporary AWS access.

Question 158

Which AWS service can replicate S3 objects automatically between buckets in different AWS Regions?

1. S3 Cross-Region Replication
2. AWS DataSync
3. Amazon CloudFront
4. AWS Backup

Correct Answer: 1

Explanation

S3 Cross-Region Replication automatically copies eligible objects from a source S3 bucket to a destination bucket in another AWS Region. It can support use cases such as disaster recovery, compliance requirements, geographic data distribution, and maintaining secondary copies of important objects. DataSync provides broader data transfer capabilities, CloudFront caches content at edge locations, and AWS Backup provides centralized backup management for supported services. Therefore, S3 Cross-Region Replication is the appropriate option for automatically replicating S3 objects between Regions.

Question 159

A company needs to route private traffic between many VPCs and on-premises networks through a central network hub. Which service should be used?

1. AWS Transit Gateway
2. VPC peering
3. Internet gateway
4. NAT gateway

Correct Answer: 1

Explanation

AWS Transit Gateway acts as a centralized network hub that can connect multiple VPCs and on-premises networks through a single gateway architecture. It simplifies network management compared with creating numerous individual VPC peering connections. Transit Gateway can also integrate with VPN and Direct Connect for hybrid network connectivity. Internet gateways provide internet connectivity, NAT gateways provide outbound internet access, and VPC peering connects individual VPC pairs. Therefore, Transit Gateway is the appropriate solution for centralized private connectivity across many VPCs and external networks.

Question 160

Which service provides managed centralized storage for application artifacts generated during CI/CD workflows?

1. AWS CodeArtifact
2. Amazon S3
3. AWS CodeBuild
4. AWS CodeDeploy

Correct Answer: 1

Explanation

AWS CodeArtifact is designed to store and manage software packages and dependencies used by development workflows. It supports private repositories and can integrate with build and deployment pipelines. CodeBuild compiles and tests source code, CodeDeploy automates application deployment, and S3 provides general object storage. When the requirement specifically involves managing software packages and dependencies across development teams, CodeArtifact provides purpose-built repository functionality. Therefore, AWS CodeArtifact is the appropriate service for centralized application artifact and package management in supported software development workflows.