View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 181

A company needs to share a file system across multiple EC2 instances in different Availability Zones. Which service is most suitable?

1. Amazon EBS
2. Amazon EFS
3. Amazon S3
4. EC2 Instance Store

Correct Answer: 2

Explanation

Amazon Elastic File System provides a managed file system that can be mounted concurrently by multiple EC2 instances. EFS is designed for shared file access and can be accessed by resources across Availability Zones within a Region. This makes it useful for applications where multiple servers need access to the same files. EBS volumes are generally attached to individual instances, S3 provides object storage, and Instance Store provides temporary local storage. Therefore, Amazon EFS is the appropriate choice for shared file storage across multiple EC2 instances.

Question 182

Which AWS service provides a managed service mesh for microservices?

1. AWS App Mesh
2. Amazon SQS
3. Amazon ECR
4. AWS DataSync

Correct Answer: 1

Explanation

AWS App Mesh provides application-level networking for microservices, allowing organizations to control communication between services. It can provide features such as traffic routing, observability, and consistent network behavior across supported services and container environments. SQS provides message queues, ECR stores container images, and DataSync transfers data between storage systems. App Mesh can help organizations implement consistent service-to-service communication without placing all networking logic inside application code. Therefore, AWS App Mesh is the appropriate service for managing communication within microservice architectures.

Question 183

A company wants to protect an internet-facing application from common SQL injection attacks. Which service should be configured?

1. AWS WAF
2. Amazon Inspector
3. AWS Shield
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS WAF is a web application firewall that can inspect HTTP and HTTPS requests and block traffic based on configured rules. Managed rules and custom rules can help protect applications from common web exploits, including SQL injection and cross-site scripting. Inspector focuses on vulnerability assessment, Shield provides DDoS protection, and GuardDuty detects suspicious activity and threats. WAF can be associated with supported services such as Application Load Balancers, CloudFront, and API Gateway. Therefore, AWS WAF is the appropriate service for filtering malicious web requests.

Question 184

Which AWS service can provide DDoS protection for applications running on AWS?

1. AWS Shield
2. AWS WAF
3. Amazon Macie
4. AWS Config

Correct Answer: 1

Explanation

AWS Shield is a managed DDoS protection service designed to help protect AWS applications from distributed denial-of-service attacks. Shield Standard provides automatic protection for supported AWS services, while Shield Advanced provides additional capabilities and enhanced protection for eligible workloads. AWS WAF focuses on filtering web requests, Macie discovers sensitive data, and Config evaluates resource configurations. Therefore, AWS Shield is the appropriate service when the primary requirement is protection against DDoS attacks affecting internet-facing AWS applications.

Question 185

A company needs to provide temporary credentials to an application running on an EC2 instance. Which solution is recommended?

1. Store access keys in the application code
2. Attach an IAM role to the EC2 instance
3. Create a root user access key
4. Store permanent credentials in a text file

Correct Answer: 2

Explanation

Attaching an IAM role to an EC2 instance allows applications running on that instance to obtain temporary security credentials automatically through the instance metadata service. This avoids embedding long-term access keys in application code or configuration files. IAM roles also support least-privilege permissions because administrators can grant only the actions the application requires. Root credentials should not be used for application access. Therefore, attaching an appropriate IAM role to the EC2 instance is the recommended and more secure approach.

Question 186

Which AWS service can continuously record configuration changes to supported AWS resources?

1. AWS Config
2. AWS CloudTrail
3. Amazon CloudWatch
4. AWS Artifact

Correct Answer: 1

Explanation

AWS Config records resource configurations and configuration changes for supported AWS resources. It can maintain configuration history, evaluate resources against rules, and help organizations identify whether resources comply with defined requirements. CloudTrail primarily records API activity, CloudWatch provides monitoring and observability, and Artifact provides access to compliance documentation. AWS Config is particularly useful when organizations need to determine how resource configurations changed over time. Therefore, AWS Config is the appropriate service for recording and evaluating configuration changes.

Question 187

A company wants to automatically detect suspicious API activity across its AWS environment. Which service should be used?

1. Amazon GuardDuty
2. AWS Config
3. Amazon Macie
4. AWS Artifact

Correct Answer: 1

Explanation

Amazon GuardDuty is a managed threat detection service that continuously analyzes relevant AWS data sources to identify suspicious activity and potential security threats. It can detect certain unusual API behavior, compromised credentials, malicious network activity, and other indicators of compromise. Config focuses on resource configuration compliance, Macie focuses on sensitive data discovery, and Artifact provides compliance reports. Therefore, GuardDuty is the appropriate service for automated threat detection involving suspicious activity across an AWS environment.

Question 188

Which AWS service provides managed DNS failover based on endpoint health checks?

1. Amazon Route 53
2. Amazon CloudFront
3. AWS Global Accelerator
4. AWS Transit Gateway

Correct Answer: 1

Explanation

Amazon Route 53 supports DNS-based failover routing and health checks. When a primary endpoint becomes unhealthy, Route 53 can respond to DNS queries with an alternate healthy endpoint according to the configured routing policy. This can improve application availability by directing users away from failed resources. CloudFront is a content delivery service, Global Accelerator improves application availability and performance through static anycast IP addresses, and Transit Gateway provides network connectivity. Therefore, Route 53 is appropriate when DNS-based health checks and failover are required.

Question 189

A company wants to accelerate global application traffic using AWS-managed network infrastructure rather than relying only on public internet routing. Which service is appropriate?

1. AWS Global Accelerator
2. Amazon Route 53
3. Amazon S3
4. AWS DataSync

Correct Answer: 1

Explanation

AWS Global Accelerator improves application availability and performance by using static anycast IP addresses and routing user traffic through the AWS global network toward healthy application endpoints. This can reduce the impact of internet routing variability and provide faster, more consistent connectivity for supported applications. Route 53 provides DNS services, S3 provides object storage, and DataSync transfers data. Therefore, Global Accelerator is the appropriate choice when an organization needs global traffic acceleration through the AWS network.

Question 190

Which AWS service can securely store database passwords and automatically rotate supported secrets?

1. AWS Secrets Manager
2. AWS Systems Manager Parameter Store
3. AWS KMS
4. Amazon Macie

Correct Answer: 1

Explanation

AWS Secrets Manager is designed to securely store sensitive information such as database credentials, API keys, and other secrets. It supports automated rotation for supported secret types and integrates with AWS services and applications. Parameter Store can also store configuration values and some sensitive parameters, but Secrets Manager provides purpose-built secret management and rotation capabilities. KMS manages encryption keys, while Macie discovers sensitive data. Therefore, AWS Secrets Manager is the appropriate service for securely storing and rotating database credentials.

Question 191

A company needs to migrate large amounts of data from on-premises storage to Amazon S3 over a network connection. Which service should be considered?

1. AWS DataSync
2. AWS DMS
3. Amazon AppFlow
4. AWS CodeDeploy

Correct Answer: 1

Explanation

AWS DataSync is designed to accelerate and automate data transfers between on-premises storage and AWS storage services. It can transfer large datasets to Amazon S3 and other supported storage destinations while providing scheduling, monitoring, and data integrity features. DMS focuses on database migration, AppFlow moves data between supported SaaS applications and AWS services, and CodeDeploy handles application deployments. Therefore, AWS DataSync is the appropriate service for moving large amounts of file or object data from on-premises storage to Amazon S3.

Question 192

A company requires a highly available relational database with automatic failover within one AWS Region. Which configuration should be selected?

1. Amazon RDS Multi-AZ
2. Amazon RDS Read Replica
3. Amazon DynamoDB global tables
4. Amazon ElastiCache

Correct Answer: 1

Explanation

Amazon RDS Multi-AZ provides high availability by maintaining a standby database in another Availability Zone and supporting managed failover. It is designed to improve database availability and resilience against infrastructure failures within a Region. Read Replicas are primarily used to scale read workloads, DynamoDB global tables support multi-Region NoSQL architectures, and ElastiCache provides in-memory caching. Therefore, RDS Multi-AZ is the appropriate configuration when a relational database requires automatic failover and high availability within a single AWS Region.

Question 193

A company wants to send email notifications from an application at large scale. Which AWS service is designed for this purpose?

1. Amazon SES
2. Amazon SQS
3. Amazon SNS
4. Amazon EventBridge

Correct Answer: 1

Explanation

Amazon Simple Email Service is a managed email service designed for sending transactional and bulk email. Applications can use SES to send messages such as account notifications, password resets, alerts, and marketing communications, subject to applicable sending requirements. SQS provides queues, SNS provides general publish-subscribe notifications, and EventBridge routes events. SES is specifically designed for email delivery and provides features for managing sending identities, templates, and email-related operations. Therefore, Amazon SES is the appropriate service for application-driven email delivery.

Question 194

Which AWS service provides a managed relational database compatible with PostgreSQL?

1. Amazon DynamoDB
2. Amazon RDS
3. Amazon OpenSearch Service
4. Amazon Neptune

Correct Answer: 2

Explanation

Amazon RDS supports PostgreSQL as one of its managed relational database engines. RDS handles many administrative tasks, including infrastructure provisioning, backups, patching, and supported high-availability configurations. DynamoDB is a NoSQL database, OpenSearch Service is designed for search and analytics, and Neptune is a graph database service. Therefore, Amazon RDS is the appropriate choice when an organization needs a managed PostgreSQL relational database without operating the underlying database infrastructure manually.

Question 195

A company wants to distribute application traffic across multiple EC2 instances. Which service should be used?

1. Elastic Load Balancing
2. AWS CloudTrail
3. AWS Config
4. Amazon Macie

Correct Answer: 1

Explanation

Elastic Load Balancing distributes incoming application traffic across multiple targets such as EC2 instances, containers, and IP addresses. Load balancers can perform health checks and direct traffic only to healthy targets, improving availability and scalability. CloudTrail records API activity, Config tracks resource configurations, and Macie discovers sensitive data. Depending on application requirements, organizations can select Application Load Balancers, Network Load Balancers, or Gateway Load Balancers. Therefore, Elastic Load Balancing is the appropriate service for distributing traffic across multiple application instances.

Question 196

Which service can provide private access to supported AWS services from a VPC without requiring an internet gateway?

1. AWS PrivateLink
2. Amazon CloudFront
3. AWS Global Accelerator
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS PrivateLink enables private connectivity between VPC resources and supported services through interface VPC endpoints. Traffic remains within the AWS network rather than requiring access through an internet gateway or public IP addresses. PrivateLink is useful for securely accessing AWS services and endpoint services provided by other organizations. CloudFront provides content delivery, Global Accelerator improves global application traffic routing, and Route 53 provides DNS services. Therefore, AWS PrivateLink is the appropriate solution for private service access from a VPC.

Question 197

A company needs to automatically apply different storage classes to S3 objects based on age. Which feature should be used?

1. S3 Lifecycle rules
2. S3 Access Points
3. S3 Object Lock
4. S3 Inventory

Correct Answer: 1

Explanation

S3 Lifecycle rules allow organizations to automatically transition objects between storage classes or expire objects based on defined conditions such as object age. For example, frequently accessed data can remain in S3 Standard before moving to a lower-cost storage class after a specified period. Access Points simplify access management, Object Lock provides retention protection, and Inventory generates reports about stored objects. Therefore, S3 Lifecycle rules are the appropriate feature for automating storage-class transitions based on object age.

Question 198

A company needs immutable S3 objects that cannot be deleted or overwritten during a defined retention period. Which feature should be enabled?

1. S3 Object Lock
2. S3 Transfer Acceleration
3. S3 Intelligent-Tiering
4. S3 Access Points

Correct Answer: 1

Explanation

S3 Object Lock helps protect objects from deletion or overwrite for a defined retention period. It supports retention modes such as Governance and Compliance and can be used with versioned S3 buckets. This capability is useful for workloads requiring write-once-read-many protection, regulatory retention, and protection against accidental or intentional deletion. Transfer Acceleration improves transfer speeds, Intelligent-Tiering optimizes storage costs based on access patterns, and Access Points provide specialized access controls. Therefore, S3 Object Lock is the appropriate feature for immutable object retention.

Question 199

Which AWS service can provide a centralized inventory of resources across multiple AWS accounts and Regions?

1. AWS Resource Explorer
2. Amazon CloudWatch
3. AWS CloudTrail
4. AWS WAF

Correct Answer: 1

Explanation

AWS Resource Explorer helps users search for and discover AWS resources across accounts and Regions using resource metadata and search capabilities. It can simplify resource inventory and identification in environments containing many AWS resources. CloudWatch focuses on monitoring, CloudTrail records API activity, and WAF protects web applications. Resource Explorer is particularly useful for locating resources when administrators need a centralized discovery mechanism rather than manually checking individual service consoles. Therefore, AWS Resource Explorer is the appropriate service for resource discovery and inventory.

Question 200

A company wants to automatically deploy infrastructure consistently across multiple environments using templates. Which AWS service should be used?

1. AWS CloudFormation
2. AWS CloudTrail
3. Amazon GuardDuty
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS CloudFormation enables infrastructure as code by allowing organizations to define AWS resources in templates and deploy them consistently. Templates can describe networks, compute resources, databases, security configurations, and many other AWS components. This approach improves repeatability and reduces configuration differences between development, testing, and production environments. CloudTrail records API activity, GuardDuty detects threats, and Inspector assesses vulnerabilities. Therefore, AWS CloudFormation is the appropriate service for consistently deploying infrastructure across multiple environments using templates.