View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 301

A company wants to deploy an application across multiple Availability Zones and automatically route traffic only to healthy instances. Which architecture is most appropriate?

1. Amazon S3 with CloudFront
2. Application Load Balancer with EC2 Auto Scaling
3. Route 53 Resolver with NAT Gateway
4. AWS Direct Connect with Transit Gateway

Correct Answer: 2

Explanation

An Application Load Balancer can distribute traffic across multiple EC2 instances and perform health checks to identify unhealthy targets. EC2 Auto Scaling can maintain the required number of instances across Availability Zones and replace unhealthy instances. Together, these services provide improved availability, scalability, and automatic recovery for stateless applications. S3 and CloudFront are primarily used for object storage and content delivery, while Direct Connect and Transit Gateway address network connectivity. Therefore, an Application Load Balancer combined with EC2 Auto Scaling is appropriate.

Question 302

Which AWS service allows an organization to create a centralized audit trail of management API activity across multiple AWS accounts?

1. AWS CloudTrail
2. Amazon Inspector
3. AWS Config
4. Amazon Macie

Correct Answer: 1

Explanation

AWS CloudTrail records API activity across AWS environments and can be configured to deliver logs to a centralized S3 bucket. In multi-account environments, organizations can use an organization trail to provide consistent logging across accounts. These records are valuable for security investigations, auditing, governance, and operational troubleshooting. Inspector focuses on vulnerability assessment, Config tracks resource configurations, and Macie discovers sensitive data. Therefore, CloudTrail is the appropriate service for establishing a centralized record of AWS management API activity.

Question 303

A company wants to deploy containers but requires complete control over the underlying operating system and EC2 instances. Which option is most appropriate?

1. AWS Fargate
2. Amazon ECS on EC2
3. AWS Lambda
4. Amazon S3

Correct Answer: 2

Explanation

Amazon ECS running on EC2 provides container orchestration while allowing the organization to manage the underlying EC2 instances. This is useful when workloads require specific operating systems, instance configurations, specialized hardware, or greater control over compute infrastructure. Fargate removes the need to manage the underlying servers, Lambda is designed for serverless functions, and S3 provides object storage. Therefore, ECS on EC2 is appropriate when the organization needs container orchestration while retaining control over the host infrastructure.

Question 304

A company wants to restrict access to an S3 bucket so that only a specific IAM role can access its objects. Which mechanism should be used?

1. S3 bucket policy
2. Route 53 routing policy
3. CloudWatch alarm
4. VPC route table

Correct Answer: 1

Explanation

An S3 bucket policy can explicitly allow or deny access based on IAM principals, including a specific IAM role. This provides resource-based access control directly on the bucket. The policy can also include conditions related to encryption, source networks, or other request attributes. Route 53 controls DNS routing, CloudWatch alarms monitor metrics, and route tables determine network paths. Therefore, an S3 bucket policy is the appropriate mechanism for restricting bucket access to a specified IAM role.

Question 305

A workload requires a persistent shared file system that supports Linux-based EC2 instances across multiple Availability Zones. Which service should be selected?

1. Amazon EBS
2. Amazon S3
3. Amazon EFS
4. EC2 Instance Store

Correct Answer: 3

Explanation

Amazon EFS provides a managed elastic file system that can be mounted concurrently by multiple Linux-based EC2 instances. It is designed for shared file access and can support instances across multiple Availability Zones within a Region. EBS provides block storage that is generally associated with individual instances, S3 provides object storage, and Instance Store provides temporary local storage. Therefore, EFS is the appropriate choice for applications that require shared, persistent file storage across multiple EC2 instances.

Question 306

A company wants to automatically execute a Lambda function whenever a specific event occurs in AWS. Which service can route the event to Lambda?

1. AWS EventBridge
2. Amazon EBS
3. AWS Storage Gateway
4. Amazon Neptune

Correct Answer: 1

Explanation

Amazon EventBridge is an event-routing service that can receive events from AWS services, applications, and supported external sources. Rules can match specific event patterns and invoke targets such as Lambda functions. This enables event-driven architectures in which applications respond automatically to changes or activities without continuously polling. EBS provides block storage, Storage Gateway supports hybrid storage, and Neptune is a graph database. Therefore, EventBridge is the appropriate service for routing events to Lambda.

Question 307

A company needs to securely store API keys and application secrets and retrieve them programmatically at runtime. Which service is appropriate?

1. Amazon CloudWatch
2. AWS Secrets Manager
3. AWS Config
4. Amazon Route 53

Correct Answer: 2

Explanation

AWS Secrets Manager is designed to securely store sensitive information such as API keys, database credentials, and application secrets. Applications can retrieve secrets programmatically at runtime instead of embedding them in source code or configuration files. Secrets Manager supports encryption through AWS KMS and can provide automatic rotation for supported secret types. CloudWatch handles monitoring, Config evaluates resource configurations, and Route 53 provides DNS services. Therefore, Secrets Manager is the appropriate service for secure application secret storage.

Question 308

Which AWS service can provide a managed queue that supports message deduplication and strict ordering?

1. Amazon SNS
2. Amazon SQS Standard
3. Amazon SQS FIFO
4. Amazon EventBridge

Correct Answer: 3

Explanation

Amazon SQS FIFO queues provide message ordering and deduplication capabilities for workloads where processing order is important. FIFO queues can use message groups to preserve order within each group while allowing multiple groups to be processed concurrently. Standard SQS queues provide higher throughput but do not guarantee strict ordering. SNS provides publish-subscribe messaging, while EventBridge focuses on event routing. Therefore, SQS FIFO is the appropriate choice when an application requires ordered and deduplicated message processing.

Question 309

A company wants to analyze large datasets stored in S3 using SQL without provisioning database servers. Which service should be used?

1. Amazon Athena
2. Amazon RDS
3. Amazon Neptune
4. Amazon EBS

Correct Answer: 1

Explanation

Amazon Athena is a serverless interactive query service that allows organizations to use SQL to analyze data stored in Amazon S3. It eliminates the need to provision or manage database servers for these queries and can work with various structured and semi-structured data formats. RDS provides managed relational databases, Neptune provides graph database capabilities, and EBS provides block storage. Therefore, Athena is appropriate when analysts need serverless SQL querying against data stored in S3.

Question 310

A company wants to automatically create a new EC2 instance image with the latest operating system patches and approved software. Which service should be used?

1. AWS Systems Manager
2. EC2 Image Builder
3. AWS CloudTrail
4. Amazon Inspector

Correct Answer: 2

Explanation

EC2 Image Builder automates the creation, testing, and management of customized Amazon Machine Images. Organizations can define image pipelines that install operating system updates, applications, configuration settings, and security software before producing a standardized image. This helps create consistent and repeatable EC2 deployments while reducing manual image maintenance. Systems Manager supports operational management, CloudTrail records API activity, and Inspector identifies vulnerabilities. Therefore, EC2 Image Builder is the appropriate service for automatically producing updated standardized AMIs.

Question 311

A company wants to improve application availability by deploying a database read workload to a secondary Region. Which database architecture should be considered for supported Aurora workloads?

1. Amazon Aurora Global Database
2. Amazon RDS Multi-AZ only
3. Amazon DynamoDB local secondary indexes
4. Amazon ElastiCache

Correct Answer: 1

Explanation

Amazon Aurora Global Database is designed for globally distributed relational database workloads. It provides a primary Aurora cluster in one Region and read-only secondary clusters in other Regions, supporting cross-Region disaster recovery and geographically distributed read workloads. RDS Multi-AZ primarily improves availability within a Region, DynamoDB indexes address NoSQL access patterns, and ElastiCache provides caching. Therefore, Aurora Global Database is appropriate when an organization needs cross-Region database replication and secondary-region read capability.

Question 312

A company wants to automatically detect whether resources comply with organizational configuration requirements. Which AWS service should be used?

1. Amazon GuardDuty
2. AWS Config
3. AWS Shield
4. Amazon SES

Correct Answer: 2

Explanation

AWS Config provides configuration history and can evaluate AWS resources against predefined or custom compliance rules. Organizations can use Config rules to determine whether resources meet requirements such as encryption, approved security settings, or network configurations. GuardDuty detects threats, Shield provides DDoS protection, and SES provides email delivery. Config is therefore appropriate when the organization needs continuous evaluation of resource configurations against defined compliance requirements.

Question 313

A company wants to allow users to upload large files directly to S3 without routing the file through its application server. Which approach is appropriate?

1. S3 presigned URL
2. NAT Gateway
3. VPC Peering
4. AWS WAF

Correct Answer: 1

Explanation

An S3 presigned URL can provide temporary permission for a user or application to upload an object directly to a private S3 bucket. This reduces the workload on application servers because the file does not need to pass through the application’s infrastructure. The URL can be restricted to a particular object operation and expiration period. NAT Gateway provides outbound internet access, VPC Peering connects VPCs, and WAF protects web applications. Therefore, a presigned URL is appropriate for controlled direct uploads to S3.

Question 314

A company has a serverless application that requires authentication for users accessing APIs. Which AWS service can provide managed user authentication and authorization features?

1. Amazon Cognito
2. AWS CloudTrail
3. Amazon Inspector
4. AWS Batch

Correct Answer: 1

Explanation

Amazon Cognito provides identity capabilities for applications, including user sign-up, sign-in, authentication, and token-based authorization. It can integrate with API-based applications and support user pools and identity pools for different application identity requirements. CloudTrail records API activity, Inspector assesses vulnerabilities, and Batch manages batch computing workloads. Therefore, Amazon Cognito is appropriate when a serverless application requires managed authentication and identity capabilities for its users.

Question 315

A company wants to reduce the cost of predictable EC2 usage over several years while maintaining flexibility across instance types and Regions. Which purchasing option should be evaluated?

1. Savings Plans
2. Spot Instances
3. On-Demand Instances
4. Dedicated Hosts

Correct Answer: 1

Explanation

AWS Savings Plans provide discounted compute pricing in exchange for a commitment to a consistent amount of compute usage over a defined term. Depending on the selected Savings Plan type, organizations can receive flexibility across instance families, sizes, operating systems, or Regions. Spot Instances can offer larger discounts but are interruptible, On-Demand pricing has no long-term commitment, and Dedicated Hosts address physical isolation requirements. Therefore, Savings Plans should be evaluated for predictable compute usage where pricing flexibility is also important.

Question 316

A company needs to send application events to multiple consumers while allowing each consumer to process messages independently. Which architecture is most suitable?

1. Amazon SNS topic with multiple SQS queues
2. One SQS queue shared by every consumer
3. One EC2 instance processing all events
4. Amazon EBS attached to multiple applications

Correct Answer: 1

Explanation

An SNS topic with multiple SQS queue subscriptions provides a reliable fanout architecture. When a message is published to the SNS topic, each subscribed SQS queue can receive its own copy. Independent consumers can then process their queues at different rates without affecting other consumers. A single SQS queue distributes messages among consumers rather than delivering every message to each consumer. EBS is block storage and is unrelated to event distribution. Therefore, SNS combined with multiple SQS queues is appropriate for independent event processing.

Question 317

A company wants to establish centralized access for workforce users across multiple AWS accounts using an external identity provider. Which service should be considered?

1. Amazon Cognito
2. IAM Identity Center
3. Amazon GuardDuty
4. AWS DataSync

Correct Answer: 2

Explanation

AWS IAM Identity Center provides centralized workforce access to multiple AWS accounts and applications. It can integrate with an organization’s identity provider and allows administrators to assign users or groups access to accounts through permission sets. Cognito is primarily intended for application end users rather than workforce access to AWS accounts. GuardDuty provides threat detection, while DataSync transfers data. Therefore, IAM Identity Center is appropriate for centrally managing workforce access across multiple AWS accounts.

Question 318

A company needs to expose a service privately to customers in other VPCs without requiring direct network connectivity between the VPCs. Which AWS service should be used?

1. AWS PrivateLink
2. Internet Gateway
3. NAT Gateway
4. AWS Shield

Correct Answer: 1

Explanation

AWS PrivateLink allows service providers to expose supported services through endpoint services while consumers connect privately through interface VPC endpoints. The consumer VPC does not need direct VPC peering with the provider VPC. This creates a controlled private connectivity model and limits exposure of the service network. Internet Gateway provides internet access, NAT Gateway provides outbound translation, and Shield protects against DDoS attacks. Therefore, PrivateLink is appropriate for privately exposing services to consumers in other VPCs.

Question 319

A company needs to maintain an audit record showing which IAM identity made a particular AWS API request. Which service provides this information?

1. Amazon CloudWatch
2. AWS CloudTrail
3. AWS Config
4. Amazon Macie

Correct Answer: 2

Explanation

AWS CloudTrail records AWS API activity and includes information about the identity that made an API request, along with details such as the event time, source, action, and affected resources. This information is valuable for security investigations, compliance auditing, and operational troubleshooting. CloudWatch focuses on monitoring and logs, Config records resource configurations, and Macie discovers sensitive data. Therefore, CloudTrail is the appropriate service for determining which identity performed a particular AWS API operation.

Question 320

A company wants to automatically send an alert when an EC2 instance’s CPU utilization remains above a defined threshold. Which configuration should be used?

1. AWS Config rule
2. CloudTrail trail
3. CloudWatch alarm
4. S3 Lifecycle policy

Correct Answer: 3

Explanation

Amazon CloudWatch alarms can monitor EC2 metrics such as CPU utilization and trigger actions when a metric remains above or below a configured threshold for a specified evaluation period. The alarm can send notifications or integrate with other automated actions depending on the architecture. Config evaluates resource configurations, CloudTrail records API activity, and S3 Lifecycle policies manage object storage transitions and expiration. Therefore, a CloudWatch alarm is the appropriate configuration for monitoring sustained high CPU utilization and generating an alert.