View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 241

A company needs to securely share an S3 object with an external user for a limited period without making the bucket public. Which solution should be used?

1. S3 bucket ACL
2. S3 static website hosting
3. S3 presigned URL
4. S3 Transfer Acceleration

Correct Answer: 3

Explanation

An S3 presigned URL provides temporary access to a specific S3 object without requiring the recipient to have AWS credentials. The URL is generated with an expiration time and uses the permissions of the identity that created it. This makes it suitable for securely sharing private objects for a limited period. A bucket ACL does not provide the same temporary access model, static website hosting is unrelated to private sharing, and Transfer Acceleration improves transfer performance. Therefore, a presigned URL is the appropriate solution.

Question 242

Which AWS service can automatically detect and respond to changes in AWS resource configurations?

1. AWS Config
2. Amazon EventBridge
3. AWS CloudTrail
4. AWS Organizations

Correct Answer: 2

Explanation

Amazon EventBridge can receive events generated by AWS services, including events related to changes in resources and service activity. Rules can match specific events and invoke targets such as Lambda functions, Step Functions, or SNS. This enables automated responses when defined events occur. AWS Config focuses on recording configurations and evaluating compliance, while CloudTrail records API activity and Organizations manages accounts. Therefore, EventBridge is appropriate when a company needs event-driven automation in response to AWS resource or service changes.

Question 243

A workload requires a database that can automatically scale to handle unpredictable traffic without database server management. Which service is a strong choice?

1. Amazon RDS
2. Amazon Aurora
3. Amazon DynamoDB
4. Amazon Redshift

Correct Answer: 3

Explanation

Amazon DynamoDB is a fully managed NoSQL database designed for highly scalable workloads. It can automatically handle changing traffic when configured with suitable capacity modes and can scale throughput according to application requirements. DynamoDB removes the need to manage database servers, operating systems, or traditional database infrastructure. RDS and Aurora are relational database services, while Redshift is designed primarily for analytics and data warehousing. Therefore, DynamoDB is a strong choice for workloads requiring scalable NoSQL storage without database server administration.

Question 244

A company wants to route users to the AWS Region with the lowest network latency. Which Route 53 routing policy should be used?

1. Failover routing
2. Weighted routing
3. Latency-based routing
4. Geolocation routing

Correct Answer: 3

Explanation

Amazon Route 53 latency-based routing directs DNS requests to the Region that provides the lowest network latency from the user’s location based on AWS latency measurements. This can improve application responsiveness for globally distributed applications. Failover routing is intended for primary and secondary endpoints, weighted routing distributes traffic according to assigned weights, and geolocation routing uses the geographic location of users or resources. Therefore, latency-based routing is the appropriate choice when the objective is to route users toward the lowest-latency AWS Region.

Question 245

A company needs to create an isolated testing environment that can be quickly reproduced from a predefined infrastructure configuration. Which approach is most suitable?

1. Manually configure every resource
2. Use AWS CloudFormation templates
3. Create resources only through the console
4. Use CloudTrail event history

Correct Answer: 2

Explanation

AWS CloudFormation enables infrastructure to be defined as code using templates. A template can describe networking, compute, databases, security resources, and other infrastructure components. The same template can then be deployed repeatedly to create consistent environments for development, testing, and production. Manual configuration can introduce differences and requires more administrative effort. CloudTrail records API activity but does not provide infrastructure deployment templates. Therefore, CloudFormation is the most suitable approach for creating reproducible testing environments.

Question 246

An organization wants to prevent an IAM user from receiving permissions beyond a predefined maximum, even if additional policies are attached later. Which IAM feature should be used?

1. IAM permissions boundary
2. IAM group
3. IAM access key
4. IAM password policy

Correct Answer: 1

Explanation

An IAM permissions boundary defines the maximum permissions that an IAM user or role can receive. Even if identity-based policies grant additional permissions, actions outside the boundary cannot be performed. This is useful for delegating permission management while maintaining organizational guardrails. IAM groups organize users and attach policies, access keys provide programmatic authentication, and password policies control password requirements. Therefore, a permissions boundary is the appropriate feature when administrators need to restrict the maximum permissions available to an identity.

Question 247

A company stores critical data in S3 and wants protection against accidental deletion while maintaining multiple historical versions of objects. Which configuration should be used?

1. S3 Transfer Acceleration
2. S3 Versioning
3. S3 Select
4. S3 Access Points

Correct Answer: 2

Explanation

S3 Versioning maintains multiple versions of objects in a bucket. If an object is overwritten or deleted, previous versions can remain available, helping recover from accidental changes or deletions. Versioning is also required for several S3 features, including certain replication and Object Lock configurations. Transfer Acceleration improves transfer speed, S3 Select retrieves portions of object data, and Access Points provide alternative access endpoints. Therefore, enabling S3 Versioning is appropriate when historical object versions and recovery from accidental changes are required.

Question 248

Which AWS service can provide a managed private certificate authority for issuing certificates to internal applications?

1. AWS Certificate Manager
2. AWS Private CA
3. AWS Secrets Manager
4. AWS KMS

Correct Answer: 2

Explanation

AWS Private Certificate Authority provides a managed private certificate authority that organizations can use to issue and manage certificates for internal applications and private resources. It supports use cases such as internal TLS, device authentication, and private application communication. AWS Certificate Manager manages public and private certificates but Private CA provides the certificate authority infrastructure and issuance capabilities. Secrets Manager stores secrets, while KMS manages encryption keys. Therefore, AWS Private CA is appropriate when an organization needs a managed private certificate authority.

Question 249

A company wants to move an existing VMware-based data center workload to AWS with minimal application changes. Which service should be evaluated?

1. AWS Application Migration Service
2. VMware Cloud on AWS
3. AWS DataSync
4. AWS Database Migration Service

Correct Answer: 2

Explanation

VMware Cloud on AWS allows organizations to run VMware-based workloads on AWS infrastructure using familiar VMware technologies. It can be useful when companies want to extend or migrate existing VMware environments while minimizing changes to applications and operational processes. Application Migration Service is designed for server migration, DataSync focuses on data transfer, and DMS targets database migration. Therefore, VMware Cloud on AWS should be evaluated when an organization wants to move VMware workloads while preserving much of its existing virtualization environment.

Question 250

A company needs to send a notification to many subscribers whenever an application event occurs. Which service is designed for this publish-subscribe pattern?

1. Amazon SQS
2. Amazon SNS
3. AWS Batch
4. Amazon EBS

Correct Answer: 2

Explanation

Amazon Simple Notification Service supports a publish-subscribe messaging model in which publishers send messages to a topic and multiple subscribers can receive them. Subscribers can include SQS queues, Lambda functions, HTTP endpoints, and other supported destinations. SQS is primarily a message queue where consumers retrieve messages, while Batch handles batch jobs and EBS provides block storage. SNS is therefore appropriate when one application event needs to be distributed to multiple independent subscribers.

Question 251

A company needs to analyze petabytes of structured data using complex SQL queries and business intelligence workloads. Which service is most appropriate?

1. Amazon Athena
2. Amazon Redshift
3. Amazon DynamoDB
4. Amazon ElastiCache

Correct Answer: 2

Explanation

Amazon Redshift is a managed cloud data warehouse designed for large-scale analytics and complex SQL workloads. It can process substantial volumes of structured and semi-structured data and integrate with business intelligence tools. Athena is useful for serverless SQL queries directly against data in S3, but Redshift is better suited to persistent data warehouse workloads requiring repeated complex analytics. DynamoDB is a NoSQL database, while ElastiCache provides in-memory caching. Therefore, Amazon Redshift is the appropriate service for large-scale analytical data warehousing.

Question 252

A company wants to protect an API from excessive requests by limiting the number of requests a client can make within a period. Which capability should be considered?

1. API Gateway throttling
2. S3 Lifecycle policies
3. Route 53 health checks
4. EBS snapshots

Correct Answer: 1

Explanation

Amazon API Gateway provides throttling capabilities that can control the rate at which clients invoke APIs. Throttling helps protect backend services from excessive request volumes and can be configured according to API requirements. It can also work alongside usage plans and quotas for supported API configurations. S3 Lifecycle policies manage object transitions and expiration, Route 53 health checks monitor endpoints, and EBS snapshots provide block-storage backups. Therefore, API Gateway throttling is appropriate for controlling excessive API request rates.

Question 253

A company wants to ensure that an S3 bucket can only be accessed through a specific VPC endpoint. Which mechanism should be used?

1. Security group only
2. IAM password policy
3. S3 bucket policy with a VPC endpoint condition
4. Route 53 private hosted zone

Correct Answer: 3

Explanation

An S3 bucket policy can restrict access based on the VPC endpoint through which requests are made. Conditions such as the appropriate VPC endpoint identifier can be included in the policy to deny requests that do not originate through the approved endpoint. Security groups do not directly control S3 bucket access, password policies govern IAM passwords, and private hosted zones provide DNS functionality. Therefore, an S3 bucket policy using a VPC endpoint condition is an effective way to enforce private access through a designated endpoint.

Question 254

A company needs to transfer files securely using SFTP while storing the transferred data in Amazon S3. Which service should be used?

1. AWS Transfer Family
2. AWS DataSync
3. Amazon AppFlow
4. AWS Snowball

Correct Answer: 1

Explanation

AWS Transfer Family provides managed file transfer services that support protocols such as SFTP, FTPS, and FTP. It can integrate with Amazon S3, allowing organizations to provide familiar file-transfer workflows while storing the resulting data in AWS storage. DataSync is intended for high-speed data movement between supported storage environments, AppFlow focuses on application data integration, and Snowball provides physical data transfer. Therefore, AWS Transfer Family is the appropriate solution for managed SFTP access to S3.

Question 255

A company wants to automatically move infrequently accessed S3 objects to lower-cost storage based on access patterns. Which feature should be evaluated?

1. S3 Intelligent-Tiering
2. S3 Object Lock
3. S3 Access Points
4. S3 Transfer Acceleration

Correct Answer: 1

Explanation

S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, helping optimize storage costs without requiring the organization to predict when objects will become infrequently accessed. It is useful for data with uncertain or changing access frequency. Object Lock provides retention protection, Access Points simplify access management, and Transfer Acceleration improves data transfer performance. Therefore, S3 Intelligent-Tiering is the appropriate feature when an organization wants automatic storage-cost optimization based on object access behavior.

Question 256

A company wants applications in multiple AWS accounts to access a centrally managed service without creating complex VPC peering relationships. Which solution is appropriate?

1. AWS PrivateLink endpoint service
2. Internet Gateway
3. NAT Gateway
4. VPC Flow Logs

Correct Answer: 1

Explanation

AWS PrivateLink can expose a service through an endpoint service, allowing consumers in other VPCs or accounts to connect privately without requiring direct VPC peering. This approach helps service providers offer controlled private connectivity to multiple consumers while limiting network exposure. Internet Gateway provides internet connectivity, NAT Gateway supports outbound internet access from private subnets, and VPC Flow Logs record network traffic information. Therefore, PrivateLink is appropriate for privately sharing a centrally managed service across multiple accounts.

Question 257

A company needs to automatically run a Lambda function every day at a specific time. Which AWS service can schedule this invocation?

1. Amazon SQS
2. Amazon EventBridge Scheduler
3. AWS Config
4. Amazon Inspector

Correct Answer: 2

Explanation

Amazon EventBridge Scheduler allows organizations to create scheduled invocations for supported AWS targets, including Lambda functions. It can use one-time or recurring schedules and supports flexible scheduling requirements. This makes it useful for tasks such as daily processing, periodic maintenance, and scheduled automation. SQS provides message queues, Config evaluates resource configurations, and Inspector performs vulnerability assessment. Therefore, EventBridge Scheduler is the appropriate service for invoking a Lambda function automatically at a defined time.

Question 258

A company wants to encrypt EBS volumes and snapshots while maintaining control over the encryption key. Which solution should be selected?

1. Amazon Macie
2. AWS Shield
3. AWS KMS customer managed key
4. Amazon GuardDuty

Correct Answer: 3

Explanation

Amazon EBS integrates with AWS Key Management Service to encrypt volumes and snapshots. Using a customer managed KMS key gives an organization greater control over key policies, permissions, lifecycle management, and auditing than relying solely on AWS-managed encryption keys. Macie focuses on sensitive data discovery, Shield provides DDoS protection, and GuardDuty detects threats. Therefore, an AWS KMS customer managed key is appropriate when EBS encryption is required together with organizational control over the encryption key.

Question 259

A company wants to maintain a warm standby application in another AWS Region for disaster recovery. Which approach is appropriate?

1. Store only application documentation in the secondary Region
2. Maintain a scaled-down but functional environment in the secondary Region
3. Delete all resources until a disaster occurs
4. Use only a local Availability Zone backup

Correct Answer: 2

Explanation

A warm standby disaster recovery strategy maintains a scaled-down but operational version of the application in another Region. During a disaster, the organization can scale the environment and redirect traffic to the secondary Region. This generally provides faster recovery than rebuilding the entire environment from scratch, although it costs more than a backup-and-restore approach because infrastructure remains active. A local Availability Zone backup does not protect against a Region-wide outage. Therefore, maintaining a functional secondary environment is appropriate for warm standby recovery.

Question 260

A company wants to improve security by requiring users to authenticate with more than one factor when accessing AWS resources. Which feature should be enabled?

1. IAM MFA
2. S3 Versioning
3. AWS Config
4. VPC Flow Logs

Correct Answer: 1

Explanation

IAM multi-factor authentication adds an additional authentication factor to the login process, helping reduce the risk associated with compromised passwords. MFA can be particularly important for privileged users and sensitive operations. S3 Versioning protects object versions, Config monitors resource configurations, and VPC Flow Logs record network traffic metadata. MFA strengthens identity security by requiring users to provide an additional verification factor beyond their password or primary credential. Therefore, IAM MFA is the appropriate feature for strengthening AWS authentication security.