View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.

 

Question 21

A company needs to run a database that requires high availability and automatic storage growth without manually provisioning storage. Which Amazon Aurora capability is most suitable?

1. Aurora Auto Scaling
2. Aurora Serverless
3. Aurora automated backups
4. Aurora Global Database

Correct Answer: 2

Explanation

Amazon Aurora Serverless is designed for workloads where database capacity needs can change over time. It can automatically adjust database capacity based on application demand, reducing the need to manually provision compute capacity. This makes it useful for variable or intermittent workloads. Aurora automated backups provide backup and recovery capabilities, while Aurora Global Database is designed primarily for globally distributed applications and cross-Region disaster recovery. Aurora Auto Scaling is associated with automatically adjusting Aurora Replicas for read capacity. Therefore, Aurora Serverless is the most appropriate option when database capacity needs fluctuate significantly.

Question 22

Which AWS service can centrally manage policies across multiple AWS accounts?

1. AWS Control Tower
2. AWS Organizations
3. AWS IAM Identity Center
4. AWS Resource Access Manager

Correct Answer: 2

Explanation

AWS Organizations allows companies to centrally manage multiple AWS accounts and apply organizational policies. Service control policies can establish permission guardrails that affect accounts or organizational units. This is useful for enterprises that need consistent governance across many accounts. AWS Control Tower helps establish and govern a multi-account environment but is built around AWS Organizations. IAM Identity Center manages workforce access, while Resource Access Manager shares supported resources across accounts. Therefore, AWS Organizations is the core service for centralized multi-account management and policy governance.

Question 23

A workload requires temporary access to AWS resources without storing long-term access keys. Which IAM capability should be used?

1. IAM groups
2. IAM policies
3. IAM roles
4. IAM users

Correct Answer: 3

Explanation

IAM roles provide temporary security credentials that can be assumed by trusted users, applications, and AWS services. Using roles avoids embedding long-term access keys in applications and reduces the risk associated with permanent credentials. IAM groups are used to organize users and assign permissions, while IAM policies define what actions are allowed or denied. IAM users can have long-term credentials depending on configuration. Therefore, IAM roles are the preferred mechanism when workloads need temporary AWS permissions without relying on long-term access keys.

Question 24

A company wants to encrypt data at rest in Amazon EBS volumes using centrally managed encryption keys. Which service provides the required key management?

1. AWS KMS
2. AWS Secrets Manager
3. AWS Certificate Manager
4. AWS CloudHSM

Correct Answer: 1

Explanation

AWS Key Management Service, or AWS KMS, provides managed cryptographic keys that can be used to encrypt AWS resources such as EBS volumes. KMS integrates with many AWS services and provides centralized control over key policies, permissions, and usage auditing. Secrets Manager is intended for storing application secrets, while Certificate Manager manages certificates used for TLS and related services. CloudHSM provides dedicated hardware security modules for specialized cryptographic requirements. Therefore, AWS KMS is the appropriate managed key service for encrypting EBS volumes.

Question 25

Which service allows an organization to share supported AWS resources across multiple VPCs and accounts?

1. AWS PrivateLink
2. AWS Resource Access Manager
3. AWS Transit Gateway
4. AWS Organizations

Correct Answer: 2

Explanation

AWS Resource Access Manager, or RAM, allows organizations to share supported AWS resources across AWS accounts and, where supported, organizational units. Resources such as Transit Gateways and certain network configurations can be shared to simplify multi-account architectures. AWS PrivateLink provides private service connectivity, Transit Gateway provides centralized network routing, and Organizations manages accounts and governance. RAM is specifically designed for controlled resource sharing rather than general account administration. Therefore, AWS Resource Access Manager is the appropriate service for sharing supported AWS resources across accounts and environments.

Question 26

A company needs to run containers without managing EC2 servers. Which option is most appropriate?

1. Amazon ECS with AWS Fargate
2. Amazon ECS on EC2
3. Amazon EKS on EC2
4. AWS Batch on EC2

Correct Answer: 1

Explanation

AWS Fargate provides serverless compute for containers, allowing organizations to run Amazon ECS or Amazon EKS workloads without managing the underlying EC2 instances. AWS handles the infrastructure provisioning and management while the customer focuses on container configuration and application workloads. ECS on EC2 requires customers to manage the underlying instances, and EKS on EC2 similarly involves infrastructure management. AWS Batch can manage batch workloads but does not provide the same straightforward serverless container model. Therefore, ECS with AWS Fargate is an appropriate choice for running containers without managing servers.

Question 27

A company has a legacy application that requires a block storage volume with very high IOPS and low latency. Which EBS volume type should be considered?

1. Cold HDD
2. Throughput Optimized HDD
3. Provisioned IOPS SSD
4. General Purpose SSD

Correct Answer: 3

Explanation

Provisioned IOPS SSD volumes are designed for workloads that require high and consistent IOPS performance with low latency. They are commonly used for demanding transactional databases and other applications with intensive and predictable I/O requirements. General Purpose SSD volumes provide a balance of price and performance for many workloads, while Throughput Optimized HDD and Cold HDD are intended for different storage patterns and are generally unsuitable for workloads requiring very high IOPS. Therefore, Provisioned IOPS SSD is the appropriate EBS option for applications with demanding I/O performance requirements.

Question 28

Which AWS service provides a managed relational database compatible with PostgreSQL and MySQL while offering high performance?

1. Amazon Redshift
2. Amazon DynamoDB
3. Amazon Aurora
4. Amazon Neptune

Correct Answer: 3

Explanation

Amazon Aurora is a managed relational database engine compatible with MySQL and PostgreSQL. It is designed to provide high performance, availability, and durability while reducing many administrative tasks associated with database management. Amazon Redshift is designed primarily for data warehousing and analytics, DynamoDB is a NoSQL database, and Neptune is designed for graph workloads. Aurora supports features such as automated backups, replication, and high availability. Therefore, Amazon Aurora is the appropriate service for a managed relational database compatible with MySQL and PostgreSQL.

Question 29

A company wants to prevent an EC2 instance from being accidentally terminated during an administrative operation. Which setting should be enabled?

1. Termination protection
2. Stop protection
3. Instance recovery
4. Detailed monitoring

Correct Answer: 1

Explanation

EC2 termination protection helps prevent an instance from being accidentally terminated through the AWS Management Console, CLI, or API. When enabled, the instance cannot be terminated until the protection is disabled. This is useful for important workloads where accidental termination could cause service disruption. Stop protection addresses stopping rather than termination. Instance recovery is designed to recover supported instances from certain underlying hardware failures, while detailed monitoring provides more frequent metrics. Therefore, termination protection is the correct setting when the primary concern is accidental EC2 termination.

Question 30

Which AWS service provides managed Apache Kafka clusters?

1. Amazon MQ
2. Amazon MSK
3. Amazon Kinesis
4. Amazon SQS

Correct Answer: 2

Explanation

Amazon Managed Streaming for Apache Kafka, or Amazon MSK, is a fully managed service for running Apache Kafka clusters on AWS. It reduces the operational effort required to provision, configure, and maintain Kafka infrastructure. Amazon MQ is a managed message broker service supporting traditional messaging technologies, while Amazon Kinesis provides AWS-native streaming services. SQS is a managed message queue rather than a Kafka platform. Therefore, Amazon MSK is the appropriate service when an organization specifically requires managed Apache Kafka infrastructure.

Question 31

A company needs to automatically discover sensitive information such as personally identifiable information stored in Amazon S3. Which service should be used?

1. Amazon Macie
2. Amazon Inspector
3. AWS Config
4. Amazon GuardDuty

Correct Answer: 1

Explanation

Amazon Macie is designed to discover and help protect sensitive data stored in Amazon S3. It can identify sensitive information such as personally identifiable information by using automated data discovery and analysis capabilities. Amazon Inspector focuses on software vulnerabilities and unintended network exposure, AWS Config evaluates resource configurations, and GuardDuty provides threat detection. Macie is therefore the service specifically aligned with discovering sensitive information in S3. Organizations can use its findings to identify potentially exposed or improperly stored sensitive data and improve data protection controls.

Question 32

A company needs a centralized service to collect logs from applications and AWS resources for analysis. Which service should be used?

1. AWS CloudFormation
2. Amazon CloudWatch Logs
3. AWS Organizations
4. Amazon Route 53

Correct Answer: 2

Explanation

Amazon CloudWatch Logs provides centralized collection and management of log data from AWS resources and applications. Logs can be stored in log groups, searched, monitored, and used with other CloudWatch capabilities such as metrics and alarms. This makes CloudWatch Logs useful for troubleshooting, operational monitoring, and application analysis. CloudFormation manages infrastructure as code, Organizations manages multiple AWS accounts, and Route 53 provides DNS services. Therefore, CloudWatch Logs is the appropriate service for collecting and analyzing application and AWS resource logs.

Question 33

A company wants to migrate a large database to AWS while minimizing downtime. Which AWS service is designed for this purpose?

1. AWS Snowball
2. AWS Database Migration Service
3. AWS DataSync
4. AWS Transfer Family

Correct Answer: 2

Explanation

AWS Database Migration Service, or AWS DMS, is designed to migrate databases to AWS while helping minimize application downtime. It supports homogeneous and heterogeneous database migrations and can use ongoing replication to keep the target database synchronized while migration activities occur. Snowball is primarily used for large-scale data transfer, DataSync is designed for file and object data transfers, and Transfer Family supports managed file transfer protocols. Therefore, AWS DMS is the appropriate service when migrating a database while maintaining application availability for most of the migration process.

Question 34

Which service provides a managed in-memory cache compatible with Redis and Memcached?

1. Amazon ElastiCache
2. Amazon Neptune
3. Amazon DocumentDB
4. Amazon OpenSearch Service

Correct Answer: 1

Explanation

Amazon ElastiCache is a managed in-memory caching service supporting engines such as Redis and Memcached. It can improve application performance by storing frequently accessed data in memory, reducing the need to repeatedly query backend databases. Neptune is a graph database, DocumentDB is a document database service compatible with MongoDB workloads, and OpenSearch Service is designed for search and analytics. ElastiCache is therefore appropriate when an application requires a managed high-performance cache to reduce database load and improve response times.

Question 35

A company wants to run SQL queries directly against data stored in Amazon S3 without loading it into a database. Which service can provide this capability?

1. Amazon Athena
2. Amazon RDS
3. Amazon Neptune
4. Amazon ElastiCache

Correct Answer: 1

Explanation

Amazon Athena is a serverless interactive query service that can analyze data stored in Amazon S3 using SQL. Because Athena queries data directly from S3, organizations do not need to provision a database infrastructure solely for many analytical query workloads. This makes it useful for ad hoc analysis and querying data lakes. Amazon RDS is a managed relational database service, Neptune is a graph database, and ElastiCache provides in-memory caching. Therefore, Amazon Athena is the appropriate choice for running SQL queries directly against S3 data.

Question 36

Which AWS service is designed for centralized security findings across multiple AWS security services and accounts?

1. AWS Security Hub
2. Amazon Inspector
3. AWS Shield
4. Amazon Detective

Correct Answer: 1

Explanation

AWS Security Hub provides centralized visibility into security findings from multiple AWS services and supported third-party products. It can aggregate findings and help organizations assess their security posture across accounts and workloads. Amazon Inspector focuses on vulnerability assessment, AWS Shield provides DDoS protection, and Amazon Detective assists with security investigations. Security Hub is therefore particularly useful in multi-account environments where security teams need a centralized view of findings and compliance-related security checks. It helps consolidate information rather than requiring administrators to inspect every security service independently.

Question 37

A company needs to protect its application against large-scale distributed denial-of-service attacks. Which AWS service provides dedicated DDoS protection?

1. AWS Shield
2. AWS WAF
3. Amazon GuardDuty
4. AWS Firewall Manager

Correct Answer: 1

Explanation

AWS Shield is a managed DDoS protection service designed to help protect AWS applications against distributed denial-of-service attacks. AWS Shield Standard provides automatic protection for common network and transport-layer attacks, while Shield Advanced provides additional capabilities for more sophisticated protection requirements. AWS WAF focuses on filtering web requests, GuardDuty detects threats and suspicious activity, and Firewall Manager centrally manages firewall policies. Therefore, AWS Shield is the service specifically designed to provide DDoS protection for AWS workloads.

Question 38

A company needs to transfer millions of files from an on-premises NFS server to Amazon S3. Which service is designed for online data transfer?

1. AWS DataSync
2. AWS DMS
3. AWS Snowball Edge
4. Amazon Kinesis

Correct Answer: 1

Explanation

AWS DataSync is designed to automate and accelerate data transfers between on-premises storage systems and AWS storage services. It supports file systems such as NFS and can transfer data to destinations including Amazon S3, EFS, and FSx. DataSync is suitable for online migrations and recurring transfers where network connectivity is available. AWS DMS is designed for databases, Snowball Edge is useful for physical data transfer when network transfer is impractical, and Kinesis is designed for streaming data. Therefore, AWS DataSync is the appropriate solution for transferring large numbers of files from NFS to S3.

Question 39

Which service allows an application in one VPC to privately access a service hosted in another VPC without requiring VPC peering?

1. AWS PrivateLink
2. AWS Transit Gateway
3. Internet Gateway
4. NAT Gateway

Correct Answer: 1

Explanation

AWS PrivateLink enables private connectivity to supported services without requiring direct network connectivity between the consumer and provider VPCs. It commonly uses interface VPC endpoints, allowing consumers to access services through private IP addresses. This architecture can reduce exposure to the public internet and avoid the need for full VPC peering. Transit Gateway provides centralized routing between networks, while internet and NAT gateways serve different connectivity purposes. Therefore, AWS PrivateLink is the appropriate choice when an application needs private access to a service hosted in another VPC.

Question 40

A company needs to deploy the same infrastructure repeatedly across several AWS accounts. Which AWS service should be used to define the infrastructure as code?

1. AWS CloudFormation
2. AWS CloudTrail
3. AWS Config
4. AWS Trusted Advisor

Correct Answer: 1

Explanation

AWS CloudFormation allows organizations to define AWS infrastructure using templates and deploy that infrastructure repeatedly and consistently. Templates can describe resources such as VPCs, subnets, EC2 instances, security groups, databases, and other services. This infrastructure-as-code approach reduces manual configuration and helps maintain consistency across environments and accounts. CloudTrail records API activity, Config evaluates resource configurations, and Trusted Advisor provides recommendations. Therefore, AWS CloudFormation is the appropriate service for repeatedly deploying standardized infrastructure across multiple AWS environments.