View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 341

A company wants to provide a centralized event bus that can receive events from applications running in multiple AWS accounts. Which approach is appropriate?

1. Create separate S3 buckets for every account
2. Use an EventBridge event bus with cross-account permissions
3. Use a single SQS queue without resource policies
4. Use CloudWatch alarms in each account

Correct Answer: 2

Explanation

Amazon EventBridge supports cross-account event delivery by allowing event buses to grant permissions to specified AWS accounts or organizations. A centralized event bus can receive events from multiple application accounts and route them to appropriate targets using event rules. This design simplifies event-driven integration while maintaining account boundaries. S3 buckets are not event buses, a single SQS queue without appropriate permissions cannot provide the required cross-account design, and CloudWatch alarms are primarily monitoring resources. Therefore, a cross-account EventBridge event bus is appropriate.

Question 342

A workload requires temporary, high-performance block storage for EC2 instances, but the data can be recreated if the instance stops. Which storage should be considered?

1. Amazon EBS
2. Amazon S3
3. EC2 Instance Store
4. Amazon EFS

Correct Answer: 3

Explanation

EC2 Instance Store provides temporary block-level storage physically associated with the host running an EC2 instance. It can deliver very high performance and low latency, making it useful for caches, temporary processing data, and scratch workloads. However, data stored on Instance Store can be lost when an instance is stopped, terminated, or when underlying hardware fails. EBS provides persistent block storage, EFS provides shared file storage, and S3 provides object storage. Therefore, Instance Store is suitable when data can safely be recreated.

Question 343

A company wants to ensure that an application can continue operating if its primary database Region becomes unavailable. The company requires a low RPO and fast recovery. Which architecture should be evaluated?

1. Aurora Global Database
2. Amazon EBS snapshots copied once per month
3. S3 Glacier Deep Archive
4. Manual database exports stored locally

Correct Answer: 1

Explanation

Amazon Aurora Global Database can maintain secondary database clusters in additional AWS Regions with replication from the primary Region. This architecture can support cross-Region disaster recovery with lower recovery point objectives and faster recovery than approaches based on infrequent backups. Monthly EBS snapshots or manual exports would generally provide much slower recovery and potentially greater data loss. Glacier Deep Archive is designed for long-term archival rather than rapid database recovery. Therefore, Aurora Global Database should be evaluated for low-RPO, cross-Region database disaster recovery.

Question 344

Which AWS service can automatically identify security findings across multiple AWS services and provide a centralized security view?

1. AWS Backup
2. AWS Security Hub
3. Amazon Athena
4. AWS CodeBuild

Correct Answer: 2

Explanation

AWS Security Hub provides a centralized view of security findings from AWS services and supported third-party security products. It can aggregate findings, normalize them, and help security teams manage issues across multiple AWS accounts and Regions. This is particularly useful in organizations with centralized security operations. AWS Backup manages backups, Athena analyzes data using SQL, and CodeBuild compiles and tests source code. Therefore, Security Hub is the appropriate service for consolidating security findings into a centralized security posture view.

Question 345

A company needs to migrate an on-premises NFS file system to Amazon EFS while transferring large amounts of data over the network. Which service should be used?

1. AWS DataSync
2. Amazon SNS
3. Amazon CloudFront
4. AWS WAF

Correct Answer: 1

Explanation

AWS DataSync is designed to automate and accelerate data transfers between on-premises storage and AWS storage services such as Amazon EFS. It supports file-system protocols including NFS and can perform recurring or one-time transfers while providing monitoring and verification capabilities. SNS is a messaging service, CloudFront distributes content to users, and WAF protects web applications. Therefore, DataSync is the appropriate service for efficiently migrating large amounts of data from an on-premises NFS environment to Amazon EFS.

Question 346

A company needs to ensure that a Lambda function can handle a predictable number of concurrent requests without cold-start delays. Which feature should be configured?

1. Lambda reserved concurrency only
2. Lambda provisioned concurrency
3. S3 Transfer Acceleration
4. API Gateway caching

Correct Answer: 2

Explanation

Lambda provisioned concurrency keeps a specified number of execution environments initialized and ready to respond to requests. This helps reduce cold-start latency for workloads that require predictable response times. Reserved concurrency primarily establishes a concurrency limit and protects capacity for a function but does not by itself keep execution environments initialized. S3 Transfer Acceleration improves object transfers, while API Gateway caching addresses response caching. Therefore, provisioned concurrency is the appropriate Lambda feature when minimizing cold-start latency is a requirement.

Question 347

A company wants to provide users with access to a desktop application without requiring the company to manage physical desktop computers. Which AWS service should be evaluated?

1. Amazon WorkSpaces
2. Amazon SQS
3. Amazon Neptune
4. AWS Snowball

Correct Answer: 1

Explanation

Amazon WorkSpaces provides managed virtual desktops that users can access remotely. Organizations can provision desktops for employees without maintaining traditional physical desktop infrastructure. This can be useful for remote workers, contractors, and organizations that want centrally managed desktop environments. SQS provides message queuing, Neptune is a graph database, and Snowball is designed for physical data transfer. Therefore, Amazon WorkSpaces should be evaluated when the requirement is to provide managed cloud-based desktop environments to users.

Question 348

A company wants to protect a web application against SQL injection and other common HTTP-based attacks. Which service should be deployed?

1. AWS Shield
2. AWS WAF
3. Amazon Inspector
4. AWS Config

Correct Answer: 2

Explanation

AWS WAF provides configurable web application firewall controls that can inspect HTTP and HTTPS requests and block or allow traffic according to defined rules. Managed rules and custom rules can help protect applications from common threats such as SQL injection and cross-site scripting. AWS Shield primarily provides DDoS protection, Inspector identifies vulnerabilities, and Config evaluates resource configurations. Therefore, AWS WAF is the appropriate service for filtering malicious web requests and protecting an application against common HTTP-based attacks.

Question 349

A company wants to analyze application logs centrally across many AWS accounts and retain them for security investigations. Which architecture is appropriate?

1. Store logs only on individual EC2 instances
2. Centralize CloudWatch Logs and export retained data to a dedicated S3 bucket
3. Disable logging after troubleshooting
4. Store logs in Route 53 hosted zones

Correct Answer: 2

Explanation

A centralized logging architecture can collect application and service logs through CloudWatch Logs and export or stream them to centralized S3 storage for longer-term retention. Organizations can use dedicated logging accounts and appropriate resource policies to separate log storage from application accounts. This improves durability, centralized access control, and investigation capabilities. Keeping logs only on individual instances creates availability and retention risks. Route 53 hosted zones are unrelated to log storage. Therefore, centralized CloudWatch Logs with durable S3 retention is appropriate.

Question 350

Which service allows an organization to create a private certificate authority and issue certificates for internal applications?

1. AWS Private Certificate Authority
2. Amazon CloudFront
3. AWS Cost Explorer
4. Amazon GuardDuty

Correct Answer: 1

Explanation

AWS Private Certificate Authority provides managed private certificate authority capabilities that organizations can use to issue and manage certificates for internal applications and resources. It is useful for private PKI requirements where certificates do not need to be trusted by the public internet certificate ecosystem. CloudFront provides content delivery, Cost Explorer analyzes AWS spending, and GuardDuty provides threat detection. Therefore, AWS Private CA is appropriate when an organization needs centralized management of certificates for private services.

Question 351

A company wants to use a central networking account to inspect traffic from multiple VPCs before allowing it to reach external networks. Which architecture can support this requirement?

1. Centralized inspection VPC using AWS Transit Gateway and network security appliances
2. Separate internet gateways with no routing controls
3. Public S3 buckets for network traffic
4. CloudWatch dashboards without network routing

Correct Answer: 1

Explanation

A centralized inspection architecture can use AWS Transit Gateway to connect multiple VPCs and route traffic through a dedicated inspection VPC. Network security appliances or AWS Network Firewall can then inspect traffic before it proceeds toward other destinations. This design provides centralized security controls and can simplify governance across many VPCs. Independent internet gateways do not provide centralized inspection, while S3 and CloudWatch do not perform network traffic enforcement. Therefore, Transit Gateway combined with an inspection VPC is suitable for centralized network security.

Question 352

A company wants to reduce the cost of running compute workloads that are interruptible and can restart from checkpoints. Which option should be evaluated?

1. Dedicated Hosts
2. Spot Instances
3. On-Demand Instances
4. Reserved IP addresses

Correct Answer: 2

Explanation

Amazon EC2 Spot Instances use spare AWS compute capacity and can provide substantial discounts compared with On-Demand pricing. Because AWS can reclaim Spot capacity when needed, they are best suited to fault-tolerant or interruptible workloads that can tolerate interruptions and restart from checkpoints. Dedicated Hosts address physical host requirements, while On-Demand Instances provide flexible capacity without long-term commitments but generally at higher rates. Therefore, Spot Instances should be evaluated for interruptible workloads where cost reduction is important.

Question 353

A company wants to automatically identify unusual API activity that may indicate compromised AWS credentials. Which service should be considered?

1. Amazon GuardDuty
2. Amazon EFS
3. AWS Glue
4. Amazon SES

Correct Answer: 1

Explanation

Amazon GuardDuty continuously analyzes AWS account activity and other supported data sources to identify potentially malicious or suspicious behavior. It can detect indicators associated with compromised credentials, unusual API activity, and other threats. GuardDuty provides findings that security teams can investigate and integrate with broader security workflows. EFS provides file storage, Glue supports data integration and analytics preparation, and SES provides email delivery. Therefore, GuardDuty should be considered when an organization needs managed threat detection for suspicious AWS activity.

Question 354

A company needs a managed file system optimized for high-performance computing workloads that use Linux and require parallel access to large datasets. Which service should be evaluated?

1. Amazon FSx for Lustre
2. Amazon FSx for Windows File Server
3. Amazon S3 Glacier
4. Amazon RDS

Correct Answer: 1

Explanation

Amazon FSx for Lustre provides a managed high-performance file system designed for workloads requiring high throughput and low-latency parallel access to data. It is commonly suited to high-performance computing, machine learning, media processing, and other compute-intensive workloads. FSx for Windows File Server is optimized for Windows-based file workloads, Glacier is an archival object-storage class, and RDS provides relational databases. Therefore, FSx for Lustre should be evaluated when Linux-based workloads require high-performance shared file storage.

Question 355

A company wants to give a partner access to a private application service without exposing the service through the public internet. The partner uses a separate AWS account. Which service is most appropriate?

1. Amazon CloudFront
2. AWS PrivateLink
3. Amazon Route 53 public hosted zone
4. AWS Internet Gateway

Correct Answer: 2

Explanation

AWS PrivateLink allows a service provider to publish a service privately through an endpoint service while consumers in other AWS accounts connect through interface endpoints. This avoids exposing the service directly to the public internet and reduces the need for full network-level connectivity such as VPC peering. CloudFront is primarily a content delivery service, public hosted zones provide internet DNS, and internet gateways enable internet connectivity. Therefore, PrivateLink is appropriate for privately exposing an application service to a partner account.

Question 356

A company wants to automatically discover configuration changes to AWS resources and evaluate those changes against compliance requirements. Which combination is most suitable?

1. AWS Config and Config Rules
2. Amazon SNS and SQS
3. CloudFront and Route 53
4. AWS Backup and DataSync

Correct Answer: 1

Explanation

AWS Config records resource configuration changes and maintains configuration history. Config Rules can evaluate resources against compliance requirements and identify noncompliant configurations. Together, these capabilities allow organizations to detect configuration changes and continuously assess whether resources meet defined policies. SNS and SQS provide messaging, CloudFront and Route 53 support content delivery and DNS, while Backup and DataSync address data protection and transfer. Therefore, AWS Config combined with Config Rules is the appropriate solution for configuration compliance monitoring.

Question 357

A company wants to run a workload on AWS Outposts because the application must remain physically close to on-premises systems while using AWS infrastructure and services. What is the primary purpose of Outposts?

1. Extend AWS infrastructure and services into an on-premises location
2. Replace all internet connectivity with CloudFront
3. Provide object storage only
4. Automatically migrate every database to Aurora

Correct Answer: 1

Explanation

AWS Outposts extends AWS infrastructure, APIs, and selected services into customer premises. It is useful when applications have requirements such as low latency to on-premises systems, local data processing, or specific data residency constraints. Outposts allows organizations to use familiar AWS management models while keeping selected workloads physically within their facilities. It is not a replacement for CloudFront, is not limited to object storage, and does not automatically migrate databases to Aurora. Therefore, extending AWS infrastructure into an on-premises location is the primary purpose.

Question 358

A company wants to automatically process files uploaded to S3 by triggering a workflow that performs validation, transformation, and notification. Which architecture is appropriate?

1. S3 event notification connected to an event-driven workflow
2. Manual EC2 polling every hour
3. Route 53 health checks
4. EBS snapshots triggered by DNS queries

Correct Answer: 1

Explanation

S3 can generate event notifications when objects are created or changed. These events can initiate downstream processing through services such as EventBridge, Lambda, SQS, or Step Functions. A workflow can then validate the file, transform it, and send notifications without requiring continuous polling infrastructure. Manual EC2 polling introduces unnecessary operational overhead and delays. Route 53 health checks and EBS snapshots are unrelated to object-processing workflows. Therefore, an S3 event-driven architecture is appropriate for automated file processing.

Question 359

A company wants to manage software licenses and track license usage across its AWS environment. Which AWS service should be considered?

1. AWS License Manager
2. Amazon Macie
3. AWS Glue
4. Amazon CloudFront

Correct Answer: 1

Explanation

AWS License Manager helps organizations manage software licenses and track usage across AWS environments. It can support license configurations and usage controls for software that has licensing requirements, helping organizations improve visibility and reduce the risk of noncompliance or unexpected licensing costs. Macie focuses on sensitive data discovery, Glue supports data integration and analytics preparation, and CloudFront provides content delivery. Therefore, AWS License Manager should be considered when an organization needs centralized visibility and management of software licensing.

Question 360

A company needs to collect evidence automatically for audits against supported compliance frameworks. Which AWS service is designed for this purpose?

1. Amazon Detective
2. AWS Audit Manager
3. AWS WAF
4. Amazon ElastiCache

Correct Answer: 2

Explanation

AWS Audit Manager helps automate evidence collection and organize evidence for audits against supported compliance frameworks. It can continuously gather relevant information from AWS environments and present evidence in a structured manner, reducing the manual effort required during audit preparation. Detective is designed for security investigations, WAF protects web applications, and ElastiCache provides in-memory caching. Therefore, AWS Audit Manager is the appropriate service when an organization needs automated evidence collection and centralized preparation for compliance audits.