View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 361

A company wants to share centrally managed AWS resources with accounts in the same AWS Organization. Which service should it use?

1. AWS Resource Access Manager
2. Amazon Inspector
3. AWS CloudTrail
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Resource Access Manager allows supported AWS resources to be shared with other AWS accounts or organizational units. This can reduce duplication and simplify centralized management of resources such as subnets, Transit Gateways, and certain other supported services. Sharing can be controlled through AWS Organizations and resource-based permissions. Inspector focuses on vulnerability management, CloudTrail records API activity, and Route 53 provides DNS capabilities. Therefore, AWS RAM is the appropriate service when an organization needs controlled resource sharing across multiple AWS accounts.

Question 362

An application must maintain user sessions across multiple EC2 instances behind an Application Load Balancer. Which approach provides a highly scalable session-management architecture?

1. Store session data only in instance memory
2. Store session state in a shared external data store
3. Use EC2 Instance Store for permanent sessions
4. Store session data in the ALB itself

Correct Answer: 2

Explanation

Storing session state in an external shared data store allows any application instance to retrieve the user’s session regardless of which instance receives the request. Services such as Amazon ElastiCache or DynamoDB can be used depending on the application’s consistency and access requirements. Keeping sessions only in instance memory creates dependency on a specific server and can cause users to lose sessions when instances are replaced. Instance Store is temporary, and an ALB does not function as a session database. Therefore, external session storage provides better scalability and resilience.

Question 363

A company wants to enforce security policies consistently across AWS accounts for resources such as security groups and WAF configurations. Which service should be considered?

1. AWS Firewall Manager
2. Amazon Athena
3. AWS DataSync
4. Amazon EFS

Correct Answer: 1

Explanation

AWS Firewall Manager provides centralized management of firewall and security policies across AWS accounts and resources in an AWS Organization. It can help administrators apply consistent policies for services such as AWS WAF, AWS Shield Advanced, security groups, and other supported protections. Athena provides serverless SQL analytics, DataSync transfers data, and EFS provides shared file storage. Firewall Manager is therefore appropriate when security policies need to be centrally defined and consistently applied across multiple accounts.

Question 364

A company wants applications in a VPC to access S3 without routing traffic through a NAT Gateway or public internet path. Which option should be selected?

1. Internet Gateway
2. NAT Gateway
3. S3 gateway VPC endpoint
4. Public IP address on every instance

Correct Answer: 3

Explanation

An S3 gateway VPC endpoint allows resources in a VPC to access Amazon S3 using private AWS networking without requiring a NAT Gateway or internet gateway for the S3 traffic. Gateway endpoints can be associated with route tables, allowing private subnet resources to reach S3 directly. This can improve security and reduce NAT Gateway processing costs for S3 access. An internet gateway provides internet connectivity, while a NAT Gateway translates outbound private traffic. Therefore, an S3 gateway endpoint is the appropriate solution.

Question 365

A company needs to ingest high-volume streaming data and allow multiple independent applications to consume records from the stream at their own pace. Which service is most suitable?

1. Amazon SQS
2. Amazon Kinesis Data Streams
3. Amazon SES
4. AWS Batch

Correct Answer: 2

Explanation

Amazon Kinesis Data Streams is designed for real-time streaming data that must be collected and processed by multiple consumers. Records remain available for a configurable retention period, allowing different applications to independently read and process the same stream. SQS is primarily a message queue, SES handles email delivery, and AWS Batch manages batch computing jobs. Kinesis Data Streams is therefore appropriate when an organization needs durable, high-throughput streaming ingestion with multiple independent consumers.

Question 366

A company wants to automatically scale a web application’s EC2 fleet based on the number of requests arriving through its load balancer. Which scaling approach should be used?

1. Target tracking based on an ALB request-per-target metric
2. Manual modification of desired capacity
3. S3 Lifecycle rules
4. CloudTrail event filtering

Correct Answer: 1

Explanation

EC2 Auto Scaling target tracking can use an Application Load Balancer request-count-per-target metric to automatically adjust the number of instances based on application demand. This is more representative of web workload pressure than relying only on CPU utilization because request volume can increase even when CPU usage does not immediately reflect the load. Manual scaling requires operational intervention, while S3 Lifecycle and CloudTrail are unrelated to compute scaling. Therefore, target tracking based on ALB request metrics is appropriate for automatically scaling the web tier.

Question 367

A company wants to protect a static website hosted privately in S3 while delivering it globally through CloudFront. Which architecture is recommended?

1. Public S3 bucket with anonymous object access
2. Private S3 bucket with CloudFront Origin Access Control
3. S3 website endpoint with public permissions
4. EC2 instance acting as a public file server

Correct Answer: 2

Explanation

A private S3 bucket combined with CloudFront Origin Access Control allows CloudFront to retrieve objects while preventing direct public access to the S3 bucket. The bucket policy can permit access specifically from the CloudFront distribution. This architecture improves security while still providing global content delivery and caching. Public bucket access exposes objects directly, while an EC2 file server introduces unnecessary infrastructure. Therefore, using a private S3 bucket with CloudFront OAC is the appropriate architecture.

Question 368

A company wants to execute a function at a scheduled time without maintaining a dedicated server. Which solution is most appropriate?

1. EventBridge Scheduler invoking Lambda
2. EC2 instance running cron continuously
3. EBS snapshot schedule
4. Route 53 health check

Correct Answer: 1

Explanation

Amazon EventBridge Scheduler can invoke supported AWS targets, including Lambda functions, according to one-time or recurring schedules. This provides a serverless scheduling mechanism without requiring an always-running EC2 instance. It can be useful for periodic maintenance, report generation, data processing, or application tasks. Running cron on EC2 introduces unnecessary infrastructure management, while EBS snapshots and Route 53 health checks serve different purposes. Therefore, EventBridge Scheduler invoking Lambda is the appropriate solution for serverless scheduled execution.

Question 369

A company is migrating a large Oracle database to AWS and needs to convert the database schema and code objects to a PostgreSQL-compatible format. Which service should be evaluated?

1. AWS Database Migration Service
2. AWS Schema Conversion Tool
3. Amazon Athena
4. AWS Storage Gateway

Correct Answer: 2

Explanation

AWS Schema Conversion Tool, or AWS SCT, helps convert database schemas and application code from one database engine to another when migrating to a different database platform. For example, it can assist with converting Oracle database structures and code for PostgreSQL-compatible targets. AWS DMS is primarily used for data migration and replication rather than comprehensive schema conversion. Athena provides SQL analytics, while Storage Gateway provides hybrid storage integration. Therefore, AWS SCT should be evaluated for heterogeneous database schema conversion.

Question 370

A company wants to provide a managed application streaming environment so users can access desktop applications without installing them locally. Which service should be evaluated?

1. Amazon AppStream 2.0
2. Amazon SQS
3. AWS Glue
4. Amazon RDS

Correct Answer: 1

Explanation

Amazon AppStream 2.0 is a fully managed application streaming service that allows users to access desktop applications from a supported browser without installing the applications locally. Applications run on AWS infrastructure while users interact with them remotely. This can simplify centralized application management and support remote users. SQS provides message queuing, Glue supports data integration and analytics preparation, and RDS provides managed relational databases. Therefore, AppStream 2.0 should be evaluated for browser-based application streaming.

Question 371

A company wants to prevent an IAM administrator from granting permissions beyond an approved maximum, even if the administrator attaches broader identity policies. Which IAM feature should be used?

1. IAM permissions boundary
2. AWS Organizations tag policy
3. Security group
4. Route 53 Resolver rule

Correct Answer: 1

Explanation

An IAM permissions boundary establishes the maximum permissions that an IAM principal can receive. Even if identity-based policies grant additional permissions, the effective permissions cannot exceed the permissions allowed by the boundary. This is useful in delegated administration scenarios where administrators need authority to create or modify IAM roles but must remain within organizational limits. Tag policies control tagging behavior, security groups control network traffic, and Resolver rules control DNS forwarding. Therefore, an IAM permissions boundary is appropriate for limiting delegated IAM permissions.

Question 372

A company requires a disaster recovery environment in another Region that is partially operational and can be scaled quickly after a regional failure. Which strategy best matches this requirement?

1. Backup and restore
2. Pilot light
3. Warm standby
4. No recovery environment

Correct Answer: 3

Explanation

A warm standby disaster recovery strategy maintains a scaled-down but operational version of the application environment in another Region. During a disaster, resources can be scaled up to handle production traffic, resulting in faster recovery than rebuilding the environment from backups. Backup and restore generally requires more time to provision infrastructure and restore data. Pilot light maintains only essential components and typically requires more activation steps. Therefore, warm standby best matches a requirement for a partially operational environment that can be expanded quickly.

Question 373

A company wants to reduce database connection pressure from thousands of concurrent Lambda invocations accessing an RDS database. Which architecture should be considered?

1. RDS Proxy between Lambda and the database
2. Additional S3 buckets
3. CloudFront caching of database connections
4. Route 53 weighted routing

Correct Answer: 1

Explanation

RDS Proxy can pool and reuse database connections between Lambda functions and supported relational databases. This reduces the number of direct database connections created during bursts of Lambda activity and can improve database scalability and availability. It is particularly useful for serverless applications where many concurrent executions can otherwise create excessive connection overhead. S3 does not manage database connections, CloudFront is a content delivery service, and Route 53 controls DNS routing. Therefore, RDS Proxy is appropriate for managing connection pressure.

Question 374

A company needs to protect objects in S3 from accidental deletion while still allowing authorized users to access them. Which feature should be considered?

1. S3 Object Lock
2. S3 Transfer Acceleration
3. S3 Select
4. S3 Inventory

Correct Answer: 1

Explanation

Amazon S3 Object Lock can prevent objects from being deleted or overwritten for a defined retention period or under legal hold conditions. It supports compliance and governance requirements where data must remain immutable. Object Lock can be configured with retention modes that provide different levels of protection. Transfer Acceleration improves transfer speeds, S3 Select filters object contents, and S3 Inventory provides object metadata reports. Therefore, S3 Object Lock is appropriate when objects must be protected against accidental or unauthorized deletion.

Question 375

A company wants to use AWS Organizations to prevent member accounts from disabling specific security services. Which control should be considered?

1. Service Control Policy
2. Security group rule
3. S3 Lifecycle policy
4. Route 53 routing policy

Correct Answer: 1

Explanation

Service Control Policies, or SCPs, allow organizations to establish permission guardrails across member accounts. An SCP can deny actions such as disabling or modifying specific security services, provided the affected API actions are covered by the policy. SCPs do not grant permissions themselves; instead, they define the maximum available permissions within an account or organizational unit. Security groups control network traffic, S3 Lifecycle manages object transitions, and Route 53 policies manage DNS routing. Therefore, an SCP is appropriate for enforcing organization-wide restrictions.

Question 376

A company wants to automatically detect sensitive information such as personally identifiable information stored in S3. Which service should be used?

1. Amazon Macie
2. Amazon GuardDuty
3. AWS Network Firewall
4. AWS CloudFormation

Correct Answer: 1

Explanation

Amazon Macie uses automated data discovery and analysis capabilities to identify sensitive information in Amazon S3. It can help organizations discover and monitor data such as personally identifiable information and understand potential security risks associated with sensitive datasets. GuardDuty focuses on threat detection, Network Firewall controls network traffic, and CloudFormation provisions infrastructure. Therefore, Macie is the appropriate service when an organization needs to discover sensitive data stored in S3.

Question 377

A company has workloads in several VPCs and wants to simplify connectivity between them without creating a large number of individual VPC peering connections. Which architecture should be considered?

1. AWS Transit Gateway
2. Separate NAT Gateways
3. Internet Gateway peering
4. Amazon CloudFront

Correct Answer: 1

Explanation

AWS Transit Gateway provides a centralized network hub through which multiple VPCs and supported network connections can communicate. Instead of creating many individual VPC peering relationships, organizations can attach VPCs to the Transit Gateway and manage routing centrally. This hub-and-spoke architecture can simplify network management as the number of VPCs grows. NAT Gateways provide outbound internet access, internet gateways connect VPCs to the internet, and CloudFront provides content delivery. Therefore, Transit Gateway is appropriate for scalable multi-VPC connectivity.

Question 378

A company wants to automatically send messages from an SNS topic only to subscribers whose attributes match specific filtering criteria. Which feature should be used?

1. SNS message filtering
2. SQS FIFO ordering
3. CloudTrail event history
4. Route 53 health checks

Correct Answer: 1

Explanation

Amazon SNS message filtering allows subscribers to receive only messages that match attributes or filtering policies associated with their subscriptions. This prevents every subscriber from receiving every published message and reduces unnecessary downstream processing. For example, subscribers can filter messages based on event type, environment, or application attributes. SQS FIFO provides ordering and deduplication, CloudTrail records API activity, and Route 53 health checks monitor endpoint health. Therefore, SNS message filtering is the appropriate feature for selective message delivery.

Question 379

A company wants to reduce storage costs for S3 objects with unpredictable access patterns while maintaining automatic movement between appropriate storage tiers. Which storage class should be considered?

1. S3 Standard
2. S3 Intelligent-Tiering
3. S3 Glacier Deep Archive
4. S3 One Zone-IA

Correct Answer: 2

Explanation

S3 Intelligent-Tiering is designed for data with changing or unpredictable access patterns. It automatically moves eligible objects between access tiers based on observed access patterns, helping optimize storage costs without requiring the organization to predict when objects will become infrequently accessed. S3 Standard is intended for frequently accessed data, Glacier Deep Archive is designed for long-term archival with slower retrieval, and One Zone-IA stores data in a single Availability Zone. Therefore, Intelligent-Tiering is appropriate for unpredictable access patterns.

Question 380

A company wants to collect compliance evidence from AWS resources and organize it for an external audit. Which service is designed specifically for this task?

1. AWS Audit Manager
2. Amazon Detective
3. Amazon CloudFront
4. AWS Elastic Beanstalk

Correct Answer: 1

Explanation

AWS Audit Manager helps organizations collect and organize evidence related to compliance requirements. It can continuously gather evidence from AWS services and arrange it according to supported frameworks and controls, making audit preparation more efficient. Detective is designed for security investigations, CloudFront provides global content delivery, and Elastic Beanstalk simplifies application deployment. Therefore, AWS Audit Manager is specifically designed for collecting and organizing audit evidence and is the appropriate choice for this requirement.