View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 221

A company needs to connect several VPCs and on-premises networks through a centralized network hub. Which AWS service should be used?

1. VPC Peering
2. AWS Transit Gateway
3. NAT Gateway
4. Internet Gateway

Correct Answer: 2

Explanation

AWS Transit Gateway acts as a centralized network hub that can connect multiple VPCs and on-premises networks. It simplifies network architecture by avoiding a large number of individual VPC peering connections. Transit Gateway can also integrate with VPN and Direct Connect connectivity, making it useful for hybrid and multi-account environments. VPC Peering provides point-to-point connectivity, while NAT Gateway and Internet Gateway serve different connectivity purposes. Therefore, Transit Gateway is appropriate when an organization needs centralized connectivity across multiple networks.

Question 222

Which AWS service allows an organization to create isolated virtual networks for its AWS resources?

1. Amazon VPC
2. Amazon Route 53
3. AWS Direct Connect
4. AWS Organizations

Correct Answer: 1

Explanation

Amazon Virtual Private Cloud allows organizations to create logically isolated networks within AWS. A VPC can contain subnets, route tables, security groups, network ACLs, and other networking components that control how resources communicate. Organizations can design public and private subnets and connect the VPC to on-premises environments or other networks. Route 53 provides DNS capabilities, Direct Connect provides dedicated connectivity, and Organizations manages AWS accounts. Therefore, Amazon VPC is the appropriate service for creating isolated virtual networks.

Question 223

A company needs to run a large number of independent batch jobs and wants AWS to provision compute resources automatically. Which service is most appropriate?

1. AWS Batch
2. Amazon SQS
3. AWS Lambda
4. Amazon Lightsail

Correct Answer: 1

Explanation

AWS Batch is designed to run batch computing workloads at scale. It automatically provisions and manages the required compute resources based on submitted jobs and configured environments. This makes it useful for workloads such as financial calculations, simulations, image processing, and large-scale data processing. SQS provides message queuing, Lambda executes event-driven functions, and Lightsail provides simplified application hosting. Therefore, AWS Batch is the appropriate service when an organization needs managed scheduling and execution of large numbers of batch jobs.

Question 224

An organization wants to prevent developers from launching resources outside approved AWS Regions. Which control should be considered?

1. IAM permissions boundaries
2. Service control policies
3. Security groups
4. Network ACLs

Correct Answer: 2

Explanation

Service control policies in AWS Organizations can establish permission guardrails across accounts, including restrictions on which AWS Regions can be used. An SCP does not directly grant permissions, but it can limit the maximum permissions available to identities within affected accounts. IAM permissions boundaries constrain permissions for individual identities, while security groups and network ACLs control network traffic. Therefore, an SCP is appropriate when an organization wants a centralized organizational restriction preventing resource usage in unapproved Regions.

Question 225

Which AWS storage service provides block storage that can be attached to an EC2 instance?

1. Amazon EFS
2. Amazon S3
3. Amazon EBS
4. AWS Storage Gateway

Correct Answer: 3

Explanation

Amazon Elastic Block Store provides persistent block-level storage volumes that can be attached to EC2 instances. EBS is commonly used for operating system disks, application data, and database workloads that require block storage. EFS provides managed file storage, S3 provides object storage, and Storage Gateway connects on-premises environments with AWS storage services. EBS volumes can offer different performance and cost characteristics depending on the selected volume type. Therefore, Amazon EBS is the appropriate choice for persistent block storage attached to EC2.

Question 226

A company needs a managed service for hosting a public or private API and wants built-in throttling and authorization capabilities. Which service should be used?

1. Amazon API Gateway
2. Amazon CloudFront
3. AWS App Mesh
4. Amazon Route 53

Correct Answer: 1

Explanation

Amazon API Gateway is a managed service for creating, publishing, securing, monitoring, and managing APIs. It supports capabilities such as throttling, authorization, request validation, and integration with services including Lambda and backend applications. CloudFront is primarily a content delivery service, App Mesh manages service-to-service communication, and Route 53 provides DNS services. API Gateway can support REST, HTTP, and WebSocket APIs depending on the required architecture. Therefore, API Gateway is the appropriate choice for managing APIs with integrated controls.

Question 227

A company wants to detect unauthorized or suspicious network activity against resources in its AWS environment. Which service provides managed threat detection?

1. AWS Config
2. Amazon GuardDuty
3. AWS Artifact
4. Amazon S3

Correct Answer: 2

Explanation

Amazon GuardDuty continuously analyzes relevant AWS data sources to identify potential security threats and suspicious activity. It can detect certain indicators such as unusual API behavior, compromised credentials, malicious network activity, and other threat signals. Config focuses on configuration compliance, Artifact provides compliance documentation, and S3 provides object storage. GuardDuty is designed specifically for managed threat detection rather than configuration management or data storage. Therefore, GuardDuty is the appropriate service for detecting suspicious activity within an AWS environment.

Question 228

A workload requires a relational database but the company wants AWS to handle backups, patching, and database infrastructure management. Which service is appropriate?

1. Amazon DynamoDB
2. Amazon RDS
3. Amazon S3
4. Amazon OpenSearch Service

Correct Answer: 2

Explanation

Amazon RDS is a managed relational database service that reduces the administrative work required to operate supported database engines. AWS handles tasks such as infrastructure provisioning, automated backups, software patching, and maintenance according to the selected configuration. DynamoDB is a NoSQL database, S3 provides object storage, and OpenSearch is intended for search and analytics workloads. RDS supports several relational database engines and provides features for high availability, scaling, and backup. Therefore, Amazon RDS is appropriate for managed relational database workloads.

Question 229

Which AWS service can provide a private connection between a VPC and an S3 bucket without routing traffic through the public internet?

1. Gateway VPC endpoint
2. NAT Gateway
3. Internet Gateway
4. AWS Global Accelerator

Correct Answer: 1

Explanation

A gateway VPC endpoint provides private connectivity from a VPC to supported AWS services such as Amazon S3 and DynamoDB. Traffic can remain within the AWS network instead of requiring an internet gateway or NAT Gateway. This architecture is particularly useful for private subnets that need access to S3 without public internet connectivity. NAT Gateway is generally used for outbound internet access, Internet Gateway provides internet connectivity, and Global Accelerator optimizes global application traffic. Therefore, a gateway VPC endpoint is appropriate for private S3 access.

Question 230

A company needs to run an application on Kubernetes while reducing the operational effort of managing the Kubernetes control plane. Which service should it use?

1. Amazon ECS
2. Amazon EKS
3. AWS Lambda
4. AWS Batch

Correct Answer: 2

Explanation

Amazon Elastic Kubernetes Service is a managed Kubernetes service that reduces the operational burden of running the Kubernetes control plane. EKS integrates with AWS networking, identity, monitoring, and other services while allowing organizations to use Kubernetes-compatible tooling and workloads. ECS is AWS’s container orchestration service but does not use Kubernetes, Lambda provides serverless functions, and Batch is designed for batch workloads. Therefore, EKS is appropriate when an organization requires Kubernetes while minimizing control-plane management responsibilities.

Question 231

Which AWS service provides centralized management of encryption keys used by AWS workloads?

1. AWS Secrets Manager
2. AWS Key Management Service
3. Amazon Macie
4. AWS Certificate Manager

Correct Answer: 2

Explanation

AWS Key Management Service allows organizations to create and control cryptographic keys used to protect data across AWS services and applications. KMS integrates with services such as S3, EBS, RDS, and many others, enabling encryption and controlled key usage through policies and permissions. Secrets Manager stores sensitive credentials and other secrets, Macie discovers sensitive data, and Certificate Manager manages certificates. Therefore, AWS KMS is the appropriate service for centralized encryption key management.

Question 232

A company wants to automatically discover underutilized EC2 resources and receive recommendations for rightsizing. Which service should be considered?

1. AWS Compute Optimizer
2. AWS CloudFormation
3. Amazon Inspector
4. AWS Artifact

Correct Answer: 1

Explanation

AWS Compute Optimizer analyzes resource utilization and provides recommendations that can help organizations select more appropriate resource configurations. It can identify potential rightsizing opportunities for supported AWS resources, helping reduce unnecessary costs while maintaining suitable performance. CloudFormation manages infrastructure deployment, Inspector focuses on security vulnerabilities, and Artifact provides compliance documentation. Compute Optimizer is therefore useful when an organization wants data-driven recommendations for improving resource efficiency and identifying potentially oversized resources.

Question 233

A company needs to store frequently accessed application data in memory to reduce database latency. Which service is most suitable?

1. Amazon S3
2. Amazon ElastiCache
3. Amazon Glacier
4. AWS Storage Gateway

Correct Answer: 2

Explanation

Amazon ElastiCache provides managed in-memory data stores that can be used to cache frequently accessed information and reduce database workload. By keeping commonly requested data in memory, applications can often achieve lower latency and higher throughput than repeatedly querying a database. S3 provides object storage, Glacier storage classes are designed for archival data, and Storage Gateway provides hybrid storage integration. Therefore, ElastiCache is the appropriate choice when an application needs a managed in-memory cache.

Question 234

Which AWS service can help an organization establish a multi-account landing zone with centralized governance?

1. AWS Control Tower
2. Amazon Cognito
3. Amazon Inspector
4. AWS DataSync

Correct Answer: 1

Explanation

AWS Control Tower helps organizations establish and govern a multi-account AWS environment using a landing zone approach. It provides mechanisms for account provisioning, organizational structure, guardrails, and centralized governance. This is particularly useful for enterprises that want standardized account configurations and controls while allowing individual teams or business units to operate separate accounts. Cognito manages application identities, Inspector performs vulnerability assessment, and DataSync transfers data. Therefore, AWS Control Tower is appropriate for establishing governed multi-account environments.

Question 235

A company wants to move large datasets to AWS when network connectivity is too slow or expensive for the initial transfer. Which solution should be considered?

1. Amazon CloudFront
2. AWS Snowball
3. AWS WAF
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Snowball provides physical data transfer appliances that can be used to move large amounts of data to or from AWS when network-based transfer would be impractical. Data is loaded onto the appliance and securely transported to AWS for ingestion. CloudFront accelerates content delivery, WAF protects web applications, and Route 53 provides DNS services. Snowball can be particularly useful when organizations have substantial datasets and limited bandwidth. Therefore, AWS Snowball is appropriate for large-scale offline data migration.

Question 236

A company needs to coordinate several AWS Lambda functions and manage retries and workflow state. Which service should be used?

1. Amazon EventBridge
2. AWS Step Functions
3. Amazon SQS
4. Amazon SNS

Correct Answer: 2

Explanation

AWS Step Functions provides workflow orchestration for distributed applications and serverless workloads. It allows organizations to define sequences of tasks, branching logic, retries, error handling, and workflow state. Lambda functions can be integrated into Step Functions workflows, making it useful for coordinating multiple functions without implementing complex orchestration logic inside application code. EventBridge routes events, SQS provides message queues, and SNS provides publish-subscribe messaging. Therefore, Step Functions is the appropriate service for orchestrating Lambda-based workflows.

Question 237

A company wants to automatically detect configuration changes and evaluate AWS resources against compliance requirements. Which service is appropriate?

1. AWS Config
2. AWS CloudTrail
3. Amazon GuardDuty
4. AWS Shield

Correct Answer: 1

Explanation

AWS Config continuously records supported resource configurations and can evaluate resources against compliance rules. Organizations can use Config rules to determine whether resources meet requirements such as encryption, approved configurations, or network restrictions. Config also maintains configuration history, which helps administrators investigate changes over time. CloudTrail records API activity, GuardDuty detects threats, and Shield protects against DDoS attacks. Therefore, AWS Config is the appropriate service for configuration monitoring and compliance evaluation.

Question 238

A company wants to distribute messages to several independent consumers so each consumer can process the same notification separately. Which architecture is appropriate?

1. Amazon SQS standard queue only
2. Amazon SNS topic with multiple SQS subscriptions
3. Amazon EBS with multiple volumes
4. AWS Direct Connect with multiple circuits

Correct Answer: 2

Explanation

An SNS topic with multiple SQS subscriptions supports a fanout architecture in which one published message can be delivered to multiple independent queues. Each consumer can then process its own copy of the message at its own pace. This approach provides decoupling and allows different applications to consume the same event independently. A single SQS queue distributes messages among consumers rather than giving every consumer a copy. Therefore, SNS combined with multiple SQS queues is appropriate for durable message fanout.

Question 239

A company wants to protect an S3 bucket from accidental deletion of objects while retaining the ability to manage retention policies. Which feature should be considered?

1. S3 Transfer Acceleration
2. S3 Object Lock
3. S3 Select
4. S3 Access Points

Correct Answer: 2

Explanation

S3 Object Lock can prevent objects from being deleted or overwritten for a configured retention period. It supports retention modes and legal holds for workloads that require stronger protection against accidental or intentional deletion. Transfer Acceleration improves data transfer performance, S3 Select allows applications to retrieve portions of object data, and Access Points simplify access management. Object Lock is especially relevant for compliance and immutable storage requirements. Therefore, S3 Object Lock is the appropriate feature for protecting objects from deletion during retention.

Question 240

A company wants to monitor application metrics and trigger an automated action when a metric crosses a defined threshold. Which AWS service should be configured?

1. AWS CloudTrail
2. Amazon CloudWatch
3. AWS Config
4. Amazon Macie

Correct Answer: 2

Explanation

Amazon CloudWatch can collect and monitor metrics from AWS resources and applications. CloudWatch alarms can evaluate metric values against configured thresholds and initiate actions when conditions are met. For example, an alarm can trigger an Auto Scaling policy or send a notification through an integrated service. CloudTrail records API activity, Config evaluates resource configurations, and Macie identifies sensitive data. Therefore, CloudWatch is the appropriate service for monitoring metrics and triggering automated responses based on threshold conditions.