View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 1

A web application runs on EC2 instances across multiple Availability Zones and experiences unpredictable traffic. Which solution provides automatic scaling and high availability?

1. A single large EC2 instance
2. Auto Scaling group with an Application Load Balancer
3. EC2 instance with an EBS snapshot
4. Amazon S3

Correct Answer: 2

Explanation

An Auto Scaling group can automatically add or remove EC2 instances based on application demand. Deploying instances across multiple Availability Zones improves availability if one Zone becomes unavailable. An Application Load Balancer distributes incoming requests across healthy instances and can also perform health checks. A single large instance creates a single point of failure and requires manual scaling. EBS snapshots provide backups rather than automatic application scaling. Amazon S3 provides object storage and is not a replacement for scalable backend compute. Therefore, an Auto Scaling group behind an Application Load Balancer is the appropriate architecture.

Question 2

How can EC2 instances in a private subnet access Amazon S3 without using the public internet?

1. Internet gateway
2. NAT gateway
3. S3 gateway VPC endpoint
4. Site-to-Site VPN

Correct Answer: 3

Explanation

An Amazon S3 gateway VPC endpoint provides private connectivity between resources in a VPC and Amazon S3. Traffic can remain within the AWS network instead of traveling through the public internet. Gateway endpoints are configured through VPC route tables and do not require a NAT gateway for S3 access. An internet gateway provides general internet connectivity, while a NAT gateway allows private resources to access external destinations through a public IP. A Site-to-Site VPN is intended for connectivity between networks. Therefore, an S3 gateway VPC endpoint is the most suitable solution.

Question 3

Which Amazon RDS feature provides automatic failover to another Availability Zone?

1. Read replica
2. Multi-AZ deployment
3. Automated backup
4. Parameter group

Correct Answer: 2

Explanation

Amazon RDS Multi-AZ deployment maintains a standby database in another Availability Zone and supports automatic failover if the primary database becomes unavailable. This capability is designed primarily for high availability and improved database resilience. A read replica is mainly used to scale read workloads and does not provide the same automatic failover architecture as a Multi-AZ deployment. Automated backups support recovery, while parameter groups control database configuration settings. Therefore, RDS Multi-AZ is the correct choice when automatic database failover is required.

Question 4

A global website stores images and videos in S3. Which service can reduce latency for users worldwide?

1. Amazon CloudFront
2. AWS Direct Connect
3. Amazon EFS
4. AWS DMS

Correct Answer: 1

Explanation

Amazon CloudFront is AWS’s content delivery network and uses globally distributed edge locations to cache content closer to users. When static objects such as images, videos, JavaScript files, and other supported content are cached at edge locations, users can retrieve them from a nearby location instead of repeatedly accessing the origin S3 bucket. This reduces network latency and can improve application performance. Direct Connect provides dedicated connectivity, EFS provides shared file storage, and AWS DMS supports database migration. Therefore, CloudFront is the appropriate service for global content delivery.

Question 5

Which AWS service provides a dedicated private connection between an on-premises data center and AWS?

1. AWS Client VPN
2. NAT Gateway
3. AWS Direct Connect
4. Amazon CloudFront

Correct Answer: 3

Explanation

AWS Direct Connect provides a dedicated network connection between an organization’s on-premises environment and AWS. It can provide more consistent network performance and predictable bandwidth compared with internet-based connectivity. Direct Connect is commonly used in hybrid architectures where organizations need reliable connectivity between data centers and AWS workloads. AWS Client VPN provides client-based VPN access, NAT Gateway provides outbound connectivity for private subnet resources, and CloudFront is a content delivery service. Therefore, AWS Direct Connect is the appropriate choice for a dedicated connection between an on-premises environment and AWS.

Question 6

Which S3 feature automatically moves objects to cheaper storage classes based on age or access patterns?

1. Versioning
2. Object Lock
3. Lifecycle rules
4. Transfer Acceleration

Correct Answer: 3

Explanation

Amazon S3 Lifecycle rules allow organizations to automatically transition objects between storage classes or delete objects after defined periods. This can reduce storage costs when data becomes less frequently accessed. For example, objects can transition from a frequently accessed storage class to a lower-cost archival class after a specified number of days. Versioning maintains multiple versions, Object Lock protects objects from deletion or modification during retention periods, and Transfer Acceleration improves transfer speeds. Therefore, S3 Lifecycle rules are the appropriate feature for automating storage transitions based on object age or other conditions.

Question 7

Which service is commonly used to decouple application components with a message queue?

1. Amazon SQS
2. Amazon Route 53
3. Amazon EFS
4. AWS Secrets Manager

Correct Answer: 1

Explanation

Amazon Simple Queue Service, or SQS, provides managed message queues that allow application components to communicate asynchronously. A producer can place messages into a queue while consumers process those messages independently. This reduces direct dependencies between components and allows applications to absorb temporary traffic spikes. Route 53 provides DNS services, EFS provides shared file storage, and Secrets Manager stores sensitive credentials. SQS is particularly useful with services such as Lambda, where queued messages can trigger asynchronous processing. Therefore, Amazon SQS is the appropriate service for decoupling application components through a message queue.

Question 8

A company requires a multi-Region, active-active NoSQL database. Which service should it use?

1. Amazon RDS
2. Amazon Redshift
3. DynamoDB global tables
4. Amazon Aurora

Correct Answer: 3

Explanation

Amazon DynamoDB global tables provide a multi-Region, multi-active database architecture. Applications can read and write data in different AWS Regions while DynamoDB automatically replicates changes across participating Regions. This supports low-latency global applications and improves resilience against regional failures. Amazon RDS and Aurora are relational database services, while Amazon Redshift is primarily designed for analytics and data warehousing. Therefore, DynamoDB global tables are the appropriate solution for a globally distributed NoSQL workload requiring active-active replication across multiple AWS Regions.

Question 9

Where should an application securely store database passwords and API keys?

1. Amazon S3
2. AWS Secrets Manager
3. Amazon CloudWatch
4. AWS Artifact

Correct Answer: 2

Explanation

AWS Secrets Manager provides secure storage for sensitive information such as database credentials, API keys, and other application secrets. Applications can retrieve secrets programmatically instead of storing credentials directly in source code or configuration files. Secrets Manager also supports automatic rotation for supported credentials, reducing the risk associated with long-lived passwords. Amazon S3 is object storage, CloudWatch provides monitoring and observability, and AWS Artifact provides access to compliance documentation. Therefore, AWS Secrets Manager is the appropriate service for securely storing and managing application credentials.

Question 10

Which Route 53 policy routes users to the Region with the lowest network latency?

1. Failover
2. Weighted
3. Simple
4. Latency-based

Correct Answer: 4

Explanation

Route 53 latency-based routing directs users to the AWS Region that provides the lowest latency among configured resources. This is useful for applications deployed across multiple Regions where user experience depends on network responsiveness. Failover routing is intended for primary and secondary resources, weighted routing distributes traffic according to assigned weights, and simple routing provides basic DNS responses. Latency-based routing instead uses AWS latency measurements to determine the most suitable endpoint for a request. Therefore, latency-based routing is the correct choice for directing users toward the lowest-latency Region.

Question 11

Which AWS service protects web applications from SQL injection and cross-site scripting attacks?

1. AWS WAF
2. Amazon Inspector
3. AWS Config
4. AWS CloudTrail

Correct Answer: 1

Explanation

AWS WAF is a web application firewall that helps protect applications from common web-based attacks. Administrators can create rules to inspect incoming HTTP and HTTPS requests and block traffic that matches conditions associated with malicious activity. WAF can help address threats such as SQL injection and cross-site scripting when appropriate rules are configured. Amazon Inspector focuses on vulnerability management, AWS Config evaluates resource configurations, and CloudTrail records API activity. Therefore, AWS WAF is the appropriate AWS service for protecting a public web application from common application-layer attacks.

Question 12

Which service records AWS API calls for auditing and security investigations?

1. Amazon GuardDuty
2. Amazon Macie
3. AWS CloudTrail
4. AWS Trusted Advisor

Correct Answer: 3

Explanation

AWS CloudTrail records API activity performed within an AWS environment. It can provide information about actions performed by users, roles, and AWS services, making it valuable for auditing, compliance, troubleshooting, and security investigations. Organizations can configure trails and deliver logs to appropriate storage locations for longer-term analysis. GuardDuty provides threat detection, Macie helps discover sensitive data in S3, and Trusted Advisor provides recommendations related to areas such as security and cost optimization. Therefore, AWS CloudTrail is the correct service for recording AWS API activity.

Question 13

Multiple Linux EC2 instances in different Availability Zones need shared file storage. Which service is appropriate?

1. Amazon EBS
2. Amazon EFS
3. Amazon S3 Glacier
4. DynamoDB

Correct Answer: 2

Explanation

Amazon Elastic File System provides managed file storage that can be accessed concurrently by multiple supported compute resources. EFS is designed for shared file system workloads and can support access from resources across Availability Zones within a Region. This makes it useful for applications that require a common file system rather than independent block storage. Amazon EBS is primarily block storage attached to individual instances, S3 Glacier is intended for archival object storage, and DynamoDB is a NoSQL database. Therefore, Amazon EFS is the appropriate solution for shared multi-AZ file storage.

Question 14

Which load balancer is best suited for high-throughput TCP traffic?

1. Application Load Balancer
2. Network Load Balancer
3. Gateway Load Balancer
4. Classic Load Balancer

Correct Answer: 2

Explanation

A Network Load Balancer operates at the transport layer and is designed for high-performance TCP, UDP, and related traffic. It can support very high throughput and low-latency connections, making it suitable for applications that require efficient Layer 4 load balancing. Application Load Balancers are designed primarily for HTTP and HTTPS traffic with advanced application-layer routing. Gateway Load Balancers are intended for deploying virtual network appliances, while Classic Load Balancer is a legacy option. Therefore, Network Load Balancer is the most appropriate choice for high-throughput TCP workloads.

Question 15

Which Aurora feature distributes read traffic across multiple database instances?

1. Aurora Replicas
2. S3 Lifecycle
3. DynamoDB Streams
4. Amazon SQS

Correct Answer: 1

Explanation

Aurora Replicas provide additional read-only database instances that can handle read requests and reduce the workload on the primary writer instance. Applications can use the Aurora reader endpoint to distribute read traffic among available replicas. This improves read scalability and can also provide additional resilience within the Aurora architecture. S3 Lifecycle manages object storage transitions, DynamoDB Streams captures changes to DynamoDB items, and SQS provides asynchronous messaging. Therefore, Aurora Replicas are the appropriate feature for distributing read workloads across multiple Aurora database instances.

Question 16

Which AWS service supports DNS health checks and traffic routing to healthy endpoints?

1. Amazon CloudFront
2. AWS Transit Gateway
3. Amazon Route 53
4. AWS Direct Connect

Correct Answer: 3

Explanation

Amazon Route 53 provides managed DNS functionality along with health checks and several routing policies. Health checks can be used with routing configurations to help direct DNS responses toward healthy resources and away from unhealthy endpoints. This capability is useful for highly available applications and disaster recovery architectures. CloudFront provides content delivery, Transit Gateway provides centralized network connectivity, and Direct Connect provides dedicated connections to AWS. Therefore, Amazon Route 53 is the appropriate service for DNS-based routing that incorporates endpoint health information.

Question 17

An application event must be delivered to several independent subscribers. Which AWS service provides a publish-subscribe model?

1. Amazon SQS
2. Amazon SNS
3. Amazon EBS
4. Amazon RDS

Correct Answer: 2

Explanation

Amazon Simple Notification Service, or SNS, provides a publish-subscribe messaging model. A publisher sends a message to an SNS topic, and multiple subscribers can receive that message through supported subscription mechanisms. This architecture allows applications to distribute the same event to multiple independent consumers without tightly coupling the publisher to each consumer. SQS provides queue-based messaging, EBS provides block storage, and RDS provides managed relational databases. Therefore, Amazon SNS is the appropriate service when an event needs to be distributed to multiple subscribers.

Question 18

Which S3 feature prevents objects from being deleted or overwritten during a required retention period?

1. Transfer Acceleration
2. Object Lock
3. Intelligent-Tiering
4. Access Points

Correct Answer: 2

Explanation

S3 Object Lock helps protect objects from deletion or modification during a configured retention period. It is particularly useful for compliance, records management, and workloads that require protection against accidental or intentional changes. Object Lock can be configured with retention controls appropriate to the organization’s requirements. Transfer Acceleration improves object transfer speeds, Intelligent-Tiering optimizes storage costs based on access patterns, and Access Points provide dedicated access configurations for S3 data. Therefore, S3 Object Lock is the appropriate feature when objects must remain protected for a defined retention period.

Question 19

An enterprise has many VPCs and wants centralized network connectivity. Which service can provide a central network hub?

1. AWS Transit Gateway
2. Amazon S3
3. AWS WAF
4. Amazon CloudWatch

Correct Answer: 1

Explanation

AWS Transit Gateway acts as a centralized network hub that can connect multiple VPCs and supported external networks. Instead of maintaining numerous individual connections between every network, organizations can use Transit Gateway to simplify routing and network management. It can also integrate with services such as AWS Direct Connect and Site-to-Site VPN for hybrid connectivity. Amazon S3 provides object storage, AWS WAF protects web applications, and CloudWatch provides monitoring. Therefore, AWS Transit Gateway is the appropriate solution for creating centralized connectivity across multiple VPCs.

Question 20

Which AWS service monitors metrics and can trigger alarms when a threshold is exceeded?

1. AWS CloudFormation
2. AWS CloudWatch
3. AWS CloudTrail
4. AWS Organizations

Correct Answer: 2

Explanation

Amazon CloudWatch provides monitoring and observability for AWS resources and applications. It collects metrics and logs and can create alarms when monitored values cross configured thresholds. For example, an administrator can create an alarm when EC2 CPU utilization remains above a defined percentage. CloudFormation is used to deploy infrastructure through templates, CloudTrail records API activity, and AWS Organizations manages multiple AWS accounts. Therefore, Amazon CloudWatch is the correct service for monitoring metrics and triggering threshold-based alarms.