View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 321

A company needs a private, highly available connection between its on-premises data center and AWS. It wants to avoid relying on a single Direct Connect circuit. Which architecture is most appropriate?

1. Use one Direct Connect connection with a larger bandwidth
2. Use multiple Direct Connect connections in separate locations with redundant paths
3. Use only an internet gateway
4. Use an S3 gateway endpoint

Correct Answer: 2

Explanation

Using multiple AWS Direct Connect connections through separate locations can reduce dependency on a single physical connection or facility. The organization can design redundant connectivity and use BGP to exchange routes dynamically. Additional VPN connectivity can also provide backup during Direct Connect interruptions. A single larger circuit still represents a potential failure point, while an internet gateway does not provide private dedicated connectivity from an on-premises environment. S3 gateway endpoints are intended for private S3 access from VPCs. Therefore, redundant Direct Connect architecture is the appropriate approach.

Question 322

Which feature allows CloudFront to retrieve content from a secondary origin when the primary origin becomes unavailable?

1. Origin failover
2. Field-level encryption
3. Cache invalidation
4. Lambda@Edge

Correct Answer: 1

Explanation

CloudFront origin failover allows a distribution to use a secondary origin when requests to the primary origin result in configured failure conditions. This capability can improve application availability by providing an alternate content source during origin failures. Field-level encryption protects sensitive form fields, cache invalidation removes cached objects, and Lambda@Edge enables edge-based request or response processing. Origin failover is therefore the feature designed specifically to provide an alternate origin when the primary origin cannot successfully serve requests.

Question 323

A company wants applications in multiple AWS accounts to access a shared VPC subnet while maintaining centralized network ownership. Which service can support this design?

1. AWS Resource Access Manager
2. Amazon Route 53
3. AWS CloudTrail
4. AWS Secrets Manager

Correct Answer: 1

Explanation

AWS Resource Access Manager allows supported resources to be shared across AWS accounts or organizational units. A common architecture uses a shared VPC in which a central networking account owns the VPC while participating accounts deploy resources into shared subnets. This can simplify network administration and reduce duplicated infrastructure. Route 53 provides DNS services, CloudTrail records API activity, and Secrets Manager stores sensitive information. Therefore, AWS RAM is the appropriate service for sharing supported VPC resources across accounts.

Question 324

A database-backed application creates thousands of short-lived database connections. The company wants to reduce connection overhead without changing application code significantly. Which service should be considered?

1. Amazon RDS Proxy
2. Amazon S3
3. AWS Storage Gateway
4. Amazon CloudFront

Correct Answer: 1

Explanation

Amazon RDS Proxy provides a managed database connection pool between applications and supported relational databases. It can reuse established database connections, reducing the overhead caused by large numbers of short-lived connections. This is particularly useful for serverless applications where many concurrent function invocations can otherwise overwhelm a database’s connection capacity. S3 provides object storage, Storage Gateway supports hybrid storage, and CloudFront provides content delivery. Therefore, RDS Proxy should be considered when connection management is causing database scalability issues.

Question 325

A company runs a latency-sensitive application on EC2 instances that must communicate with each other as quickly as possible. Which placement group should be evaluated?

1. Spread placement group
2. Partition placement group
3. Cluster placement group
4. Dedicated Host

Correct Answer: 3

Explanation

A cluster placement group places compatible EC2 instances close together within an Availability Zone, supporting high network throughput and low network latency between instances. This makes it suitable for tightly coupled workloads such as high-performance computing and applications requiring rapid instance-to-instance communication. Spread placement groups are designed to reduce correlated hardware failures, while partition placement groups isolate groups of instances across partitions. Dedicated Hosts provide physical server allocation but do not specifically optimize network locality. Therefore, a cluster placement group is appropriate for this workload.

Question 326

A company wants to prevent administrators from accidentally deleting backups or modifying them before their required retention period expires. Which AWS Backup capability should be considered?

1. Backup Vault Lock
2. S3 Transfer Acceleration
3. CloudFront signed cookies
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS Backup Vault Lock helps protect recovery points from unauthorized or accidental deletion and modification during a defined retention period. It supports governance requirements where backups must remain immutable for a specified duration. This capability can help organizations implement stronger backup protection against accidental actions and certain destructive scenarios. S3 Transfer Acceleration improves object transfer performance, CloudFront signed cookies control access to content, and Inspector performs vulnerability assessments. Therefore, Backup Vault Lock is the appropriate capability for protected backup retention.

Question 327

Which service is designed to inspect network traffic centrally and apply stateful and stateless firewall rules across VPC architectures?

1. Amazon Athena
2. AWS Network Firewall
3. Amazon SES
4. AWS CodeArtifact

Correct Answer: 2

Explanation

AWS Network Firewall provides managed network firewall capabilities for controlling and inspecting traffic entering, leaving, or moving between network segments. It supports stateful and stateless rules and can be incorporated into centralized inspection architectures using appropriate routing. This makes it useful for organizations that require consistent network security controls across multiple VPCs. Athena provides SQL analytics, SES handles email delivery, and CodeArtifact stores software packages. Therefore, AWS Network Firewall is the appropriate service for centralized network traffic inspection.

Question 328

A company needs a managed Apache Kafka-compatible streaming platform and wants AWS to handle broker infrastructure and operational maintenance. Which service should it evaluate?

1. Amazon MSK
2. Amazon SQS
3. Amazon SNS
4. Amazon EventBridge Scheduler

Correct Answer: 1

Explanation

Amazon Managed Streaming for Apache Kafka, or Amazon MSK, provides managed Apache Kafka infrastructure in AWS. It is appropriate for organizations that need Kafka-compatible streaming capabilities while reducing the operational burden of managing Kafka brokers and related infrastructure. SQS provides message queues, SNS provides publish-subscribe messaging, and EventBridge Scheduler is designed for scheduled invocation of targets. Therefore, Amazon MSK should be evaluated when an application requires managed Kafka-compatible event streaming.

Question 329

A company has a Lambda function that experiences unpredictable bursts of traffic. It wants to prevent excessive concurrent executions from overwhelming downstream systems. Which feature can help control concurrency?

1. Lambda reserved concurrency
2. S3 Versioning
3. CloudFront origin groups
4. DynamoDB Streams

Correct Answer: 1

Explanation

AWS Lambda reserved concurrency establishes a dedicated concurrency limit for a function. It can prevent the function from consuming excessive account-level concurrency and can help protect downstream systems from uncontrolled invocation rates. Organizations can reserve an appropriate concurrency level based on the capacity of dependent services. S3 Versioning protects object versions, CloudFront origin groups support origin failover, and DynamoDB Streams capture item-level changes. Therefore, Lambda reserved concurrency is an appropriate mechanism for controlling function concurrency.

Question 330

A company processes large amounts of data using Spark but does not want to maintain long-running clusters. Which AWS service is suitable for running Spark jobs without managing persistent clusters?

1. Amazon EMR Serverless
2. Amazon RDS
3. Amazon EFS
4. AWS Direct Connect

Correct Answer: 1

Explanation

Amazon EMR Serverless allows organizations to run analytics applications such as Apache Spark without manually provisioning and managing long-running clusters. AWS handles the underlying infrastructure, while the organization specifies applications and job requirements. This can reduce operational overhead and is useful for workloads that run periodically or have variable resource requirements. RDS provides relational databases, EFS provides shared file storage, and Direct Connect provides dedicated network connectivity. Therefore, EMR Serverless is suitable for serverless Spark processing.

Question 331

A company wants to provide controlled access to S3 content through CloudFront while preventing users from directly accessing the S3 bucket. Which feature should be used?

1. CloudFront Origin Access Control
2. NAT Gateway
3. S3 Transfer Acceleration
4. Route 53 Resolver

Correct Answer: 1

Explanation

CloudFront Origin Access Control, or OAC, allows CloudFront to securely access an S3 origin while restricting direct access to the bucket. The S3 bucket policy can be configured to allow requests from the CloudFront distribution rather than permitting unrestricted public access. This creates a stronger architecture for delivering private S3 content through CloudFront. NAT Gateway provides outbound network translation, S3 Transfer Acceleration improves transfer performance, and Route 53 Resolver handles DNS queries. Therefore, CloudFront OAC is appropriate for this requirement.

Question 332

A company wants to reduce the operational effort required to manage a data lake while enforcing centralized permissions on datasets stored in S3. Which AWS service should be considered?

1. AWS Lake Formation
2. Amazon SES
3. Amazon ElastiCache
4. AWS Shield

Correct Answer: 1

Explanation

AWS Lake Formation helps organizations build and govern data lakes using centralized data access controls and permissions. It can simplify the process of ingesting, organizing, cataloging, and securing data stored in services such as Amazon S3. Fine-grained permissions can be applied to supported data resources, helping organizations manage access across analytical teams and accounts. SES provides email delivery, ElastiCache provides in-memory caching, and Shield provides DDoS protection. Therefore, Lake Formation should be considered for centralized data lake governance.

Question 333

A company needs to connect a private API Gateway API to services running inside a VPC. Which architecture can provide private connectivity to those services?

1. API Gateway private API with VPC connectivity mechanisms
2. Public API Gateway endpoint with an internet gateway
3. S3 website endpoint
4. CloudFront without an origin

Correct Answer: 1

Explanation

Amazon API Gateway supports private APIs that can be accessed through VPC endpoints, allowing API traffic to remain within private AWS networking. When backend services reside inside a VPC, appropriate connectivity such as VPC links can connect API Gateway integrations to private resources. This design avoids exposing internal services directly to the public internet. A public API endpoint does not provide the same private exposure model, while S3 website endpoints and CloudFront without an origin are unrelated. Therefore, a private API architecture is appropriate.

Question 334

A company wants DNS queries from VPCs to be forwarded to DNS servers in its on-premises network. Which Route 53 capability should be configured?

1. Route 53 Resolver outbound endpoint
2. Route 53 public hosted zone
3. Amazon CloudFront
4. AWS Global Accelerator

Correct Answer: 1

Explanation

A Route 53 Resolver outbound endpoint allows DNS queries originating in AWS VPCs to be forwarded to DNS resolvers outside AWS, such as on-premises DNS servers. Forwarding rules can determine which DNS namespaces should be sent through the endpoint. This supports hybrid DNS architectures where applications need to resolve internal corporate domains. Public hosted zones serve internet DNS resolution, CloudFront provides content delivery, and Global Accelerator improves application traffic routing. Therefore, a Resolver outbound endpoint is appropriate for forwarding VPC DNS queries to on-premises infrastructure.

Question 335

A company needs a database architecture where read traffic can automatically scale independently from the primary writer for a highly variable workload. Which Aurora capability should be evaluated?

1. Aurora Serverless v2
2. Amazon EBS Multi-Attach
3. Amazon S3 Glacier
4. AWS Storage Gateway

Correct Answer: 1

Explanation

Aurora Serverless v2 provides automatically adjustable database capacity for supported Aurora workloads, allowing compute capacity to scale based on application demand. It is useful for applications with variable or unpredictable database workloads because capacity can increase or decrease without requiring traditional instance resizing operations. EBS Multi-Attach addresses block storage access, Glacier provides archival storage, and Storage Gateway supports hybrid storage. Therefore, Aurora Serverless v2 should be evaluated when database capacity requirements fluctuate significantly.

Question 336

A company needs to process events from multiple AWS services and send matching events to different targets without writing custom polling logic. Which service is most appropriate?

1. Amazon EventBridge
2. Amazon EBS
3. AWS Snowball
4. Amazon FSx

Correct Answer: 1

Explanation

Amazon EventBridge provides event-driven routing based on event patterns. Organizations can create rules that match events from AWS services or applications and send those events to appropriate targets such as Lambda, Step Functions, SQS, or other supported destinations. This removes the need for applications to continuously poll individual services for changes. EBS provides block storage, Snowball supports large-scale data transfer, and FSx provides managed file systems. Therefore, EventBridge is appropriate for centralized event routing without custom polling logic.

Question 337

A company wants to execute recurring workflows that may run for several minutes or hours and require state tracking between multiple steps. Which Step Functions workflow type is generally more appropriate?

1. Express Workflows
2. Standard Workflows
3. Lambda extensions
4. EventBridge Scheduler

Correct Answer: 2

Explanation

AWS Step Functions Standard Workflows are designed for long-running, durable workflows that require execution history and state tracking across multiple steps. They are suitable for business processes and orchestration tasks that can run for extended periods. Express Workflows are optimized for high-volume, shorter-duration event processing and streaming-style workloads. Lambda extensions provide additional runtime capabilities, while EventBridge Scheduler handles scheduled invocation rather than complex stateful orchestration. Therefore, Standard Workflows are generally more appropriate for long-running workflows requiring durable execution state.

Question 338

A company wants to replicate S3 data across multiple Regions and provide applications with a single global endpoint for accessing replicated datasets. Which capability should be evaluated?

1. S3 Multi-Region Access Points
2. EBS snapshots
3. SQS FIFO
4. Amazon EFS One Zone

Correct Answer: 1

Explanation

Amazon S3 Multi-Region Access Points provide a global endpoint that can route requests to S3 buckets located in multiple AWS Regions. They can be used with replicated datasets to simplify application access to geographically distributed S3 data. This can help applications use a consistent access point while benefiting from regional routing and resilience. EBS snapshots are block-storage backups, SQS FIFO provides ordered messaging, and EFS One Zone is a file-storage option. Therefore, S3 Multi-Region Access Points are appropriate for this architecture.

Question 339

A company wants to automatically deploy CloudFormation stacks across multiple AWS accounts and Regions using a centrally managed template. Which capability is most suitable?

1. CloudFormation StackSets
2. AWS Config
3. IAM permissions boundaries
4. Amazon Inspector

Correct Answer: 1

Explanation

AWS CloudFormation StackSets enables organizations to deploy and manage CloudFormation stacks across multiple AWS accounts and Regions from a centralized administration model. This is useful for consistently deploying infrastructure such as logging, security controls, or standardized resources throughout an organization. Config evaluates resource configurations, permissions boundaries limit IAM permissions, and Inspector identifies software vulnerabilities. Therefore, CloudFormation StackSets is the appropriate capability for centrally deploying infrastructure templates across multiple accounts and Regions.

Question 340

A company wants to automatically adjust the number of ECS tasks based on application demand while using a mixture of Spot and On-Demand capacity. Which ECS capability should be considered?

1. ECS capacity providers
2. S3 Lifecycle rules
3. Route 53 health checks
4. AWS Audit Manager

Correct Answer: 1

Explanation

Amazon ECS capacity providers allow organizations to define how ECS tasks use available compute capacity, including EC2 and Fargate capacity types. Capacity provider strategies can help distribute workloads across different capacity sources, while ECS Service Auto Scaling can adjust task counts based on demand. This makes capacity providers useful when an organization wants to combine capacity options such as Spot and On-Demand while managing task placement. S3 Lifecycle manages objects, Route 53 performs DNS health checks, and Audit Manager supports evidence collection. Therefore, ECS capacity providers are appropriate.