{"id":15458,"date":"2026-09-18T05:21:00","date_gmt":"2026-09-18T05:21:00","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=15458"},"modified":"2026-09-18T05:21:00","modified_gmt":"2026-09-18T05:21:00","slug":"amazon-aws-certified-solutions-architect-professional-sap-c02-practice-test-questions-and-exam-dumps-part15-q281-300","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/amazon-aws-certified-solutions-architect-professional-sap-c02-practice-test-questions-and-exam-dumps-part15-q281-300\/","title":{"rendered":"Amazon AWS Certified Solutions Architect – Professional SAP-C02 Practice Test Questions and Exam Dumps Part15 Q281-300"},"content":{"rendered":"

<\/h1>\n

View Full <\/b>Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/h2>\n

 <\/p>\n

Question 281<\/b><\/h3>\n

A company needs to automatically scale a DynamoDB table based on application traffic while avoiding manual capacity adjustments. Which capacity mode should be considered?<\/b><\/p>\n

    \n
  1. Provisioned capacity<\/span><\/li>\n
  2. On-demand capacity<\/span><\/li>\n
  3. Reserved capacity<\/span><\/li>\n
  4. Dedicated capacity<\/span><\/li>\n<\/ol>\n

    Correct Answer: 2<\/b><\/p>\n

    Explanation<\/b><\/p>\n

    DynamoDB on-demand capacity automatically accommodates changing request traffic without requiring the company to specify read and write capacity units in advance. It is useful for applications with unpredictable workloads or rapidly changing traffic patterns. Provisioned capacity can also scale through auto scaling, but it requires capacity planning and configuration. Reserved and dedicated capacity are not DynamoDB capacity modes for this purpose. Therefore, on-demand capacity is appropriate when the application needs automatic handling of unpredictable traffic without manual capacity planning.<\/span><\/p>\n

    Question 282<\/b><\/h3>\n

    A company wants to establish a dedicated connection from its data center to AWS and use BGP for dynamic route exchange. Which solution is appropriate?<\/b><\/p>\n

      \n
    1. AWS Direct Connect<\/span><\/li>\n
    2. AWS Site-to-Site VPN<\/span><\/li>\n
    3. VPC Peering<\/span><\/li>\n
    4. NAT Gateway<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1<\/b><\/p>\n

      Explanation<\/b><\/p>\n

      AWS Direct Connect provides a dedicated network connection between an on-premises environment and AWS. It supports Border Gateway Protocol for dynamic routing and can provide more consistent network performance than internet-based connectivity. Site-to-Site VPN creates encrypted tunnels over the internet, VPC Peering connects VPCs, and NAT Gateway provides outbound connectivity for private resources. Direct Connect can also be combined with VPN for additional security or resilience. Therefore, Direct Connect is appropriate when dedicated connectivity and dynamic BGP routing are required.<\/span><\/p>\n

      Question 283<\/b><\/h3>\n

      An organization wants to prevent users in member accounts from disabling CloudTrail logging. Which approach provides a centralized preventive control?<\/b><\/p>\n

        \n
      1. IAM password policy<\/span><\/li>\n
      2. Security group rules<\/span><\/li>\n
      3. Service control policy<\/span><\/li>\n
      4. S3 Lifecycle rule<\/span><\/li>\n<\/ol>\n

        Correct Answer: 3<\/b><\/p>\n

        Explanation<\/b><\/p>\n

        A service control policy can establish an organization-wide permission boundary that prevents member accounts from performing specific actions, including selected CloudTrail management operations. SCPs do not grant permissions themselves, but they can restrict the maximum permissions available within affected accounts. Password policies control IAM password requirements, security groups regulate network traffic, and S3 Lifecycle rules manage object transitions and expiration. Therefore, an SCP is an appropriate centralized preventive control for restricting sensitive actions across multiple AWS accounts.<\/span><\/p>\n

        Question 284<\/b><\/h3>\n

        A company runs a stateless web application and wants to distribute traffic while supporting path-based routing such as \/orders and \/payments. Which load balancer should be used?<\/b><\/p>\n

          \n
        1. Network Load Balancer<\/span><\/li>\n
        2. Gateway Load Balancer<\/span><\/li>\n
        3. Classic Load Balancer<\/span><\/li>\n
        4. Application Load Balancer<\/span><\/li>\n<\/ol>\n

          Correct Answer: 4<\/b><\/p>\n

          Explanation<\/b><\/p>\n

          An Application Load Balancer supports Layer 7 HTTP and HTTPS routing features, including path-based routing. This allows organizations to route requests such as \/orders and \/payments to different target groups based on application paths. Network Load Balancers are designed primarily for high-performance Layer 4 traffic, while Gateway Load Balancers are intended for deploying network virtual appliances. Classic Load Balancer is an older option with fewer modern application-routing capabilities. Therefore, an Application Load Balancer is appropriate for path-based web traffic routing.<\/span><\/p>\n

          Question 285<\/b><\/h3>\n

          A company wants to give an EC2 instance access to S3 without storing long-term AWS access keys on the server. Which solution should be used?<\/b><\/p>\n

            \n
          1. Attach an IAM role to the EC2 instance<\/span><\/li>\n
          2. Store an access key in environment variables<\/span><\/li>\n
          3. Create a root account access key<\/span><\/li>\n
          4. Store credentials in a configuration file<\/span><\/li>\n<\/ol>\n

            Correct Answer: 1<\/b><\/p>\n

            Explanation<\/b><\/p>\n

            An IAM role attached to an EC2 instance provides temporary credentials to applications through the instance metadata mechanism. This eliminates the need to store long-term access keys on the server and allows administrators to apply least-privilege permissions. Storing access keys in environment variables or configuration files creates credential-management risks, while root access keys should never be used for normal application access. Therefore, assigning an IAM role with the required S3 permissions is the recommended architecture.<\/span><\/p>\n

            Question 286<\/b><\/h3>\n

            A company needs to migrate a large number of physical or virtual servers to AWS with minimal changes to the applications. Which service should be evaluated?<\/b><\/p>\n

              \n
            1. AWS DataSync<\/span><\/li>\n
            2. AWS Application Migration Service<\/span><\/li>\n
            3. Amazon AppFlow<\/span><\/li>\n
            4. AWS Storage Gateway<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2<\/b><\/p>\n

              Explanation<\/b><\/p>\n

              AWS Application Migration Service helps organizations migrate physical, virtual, and cloud servers to AWS with minimal application changes. It continuously replicates source servers and can launch them as EC2 instances in AWS. This supports lift-and-shift migration strategies while reducing the need to redesign applications before migration. DataSync focuses on data transfer, AppFlow integrates SaaS and AWS applications, and Storage Gateway provides hybrid storage connectivity. Therefore, Application Migration Service is appropriate for large-scale server migrations with minimal application modification.<\/span><\/p>\n

              Question 287<\/b><\/h3>\n

              A company wants to inspect traffic entering and leaving a VPC to troubleshoot unexpected network behavior. Which feature should be enabled?<\/b><\/p>\n

                \n
              1. AWS CloudTrail<\/span><\/li>\n
              2. AWS Config<\/span><\/li>\n
              3. VPC Flow Logs<\/span><\/li>\n
              4. Amazon Macie<\/span><\/li>\n<\/ol>\n

                Correct Answer: 3<\/b><\/p>\n

                Explanation<\/b><\/p>\n

                VPC Flow Logs capture information about network traffic flowing to and from network interfaces in a VPC. They can help administrators troubleshoot connectivity problems, investigate security events, and understand traffic patterns. Flow Logs do not capture packet contents; instead, they record metadata about accepted or rejected traffic. CloudTrail records API activity, Config tracks resource configuration, and Macie identifies sensitive data. Therefore, VPC Flow Logs are the appropriate feature for analyzing network traffic behavior within a VPC.<\/span><\/p>\n

                Question 288<\/b><\/h3>\n

                Which AWS service is designed to provide a managed environment for deploying applications without requiring developers to manage the underlying infrastructure directly?<\/b><\/p>\n

                  \n
                1. Amazon Elastic Beanstalk<\/span><\/li>\n
                2. Amazon Route 53<\/span><\/li>\n
                3. AWS Artifact<\/span><\/li>\n
                4. Amazon Macie<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 1<\/b><\/p>\n

                  Explanation<\/b><\/p>\n

                  AWS Elastic Beanstalk provides a managed application deployment environment where developers can upload application code while AWS handles many underlying infrastructure tasks. It can provision resources such as EC2 instances, load balancers, and Auto Scaling components based on the selected environment configuration. Route 53 provides DNS services, Artifact provides compliance documentation, and Macie focuses on sensitive data discovery. Therefore, Elastic Beanstalk is appropriate when developers want a simplified application deployment platform while retaining access to underlying AWS resources.<\/span><\/p>\n

                  Question 289<\/b><\/h3>\n

                  A company needs to analyze streaming data in real time before sending it to downstream applications. Which AWS service should be considered?<\/b><\/p>\n

                    \n
                  1. Amazon S3<\/span><\/li>\n
                  2. Amazon Kinesis Data Streams<\/span><\/li>\n
                  3. Amazon EBS<\/span><\/li>\n
                  4. AWS Snowball<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 2<\/b><\/p>\n

                    Explanation<\/b><\/p>\n

                    Amazon Kinesis Data Streams is designed to collect and process streaming data in real time. Applications can continuously ingest records and process them as they arrive, making the service suitable for use cases such as real-time analytics, application monitoring, clickstream processing, and event-driven systems. S3 provides object storage, EBS provides block storage, and Snowball is designed for physical data transfer. Therefore, Kinesis Data Streams is appropriate when an organization needs real-time ingestion and processing of continuously generated data.<\/span><\/p>\n

                    Question 290<\/b><\/h3>\n

                    A company wants to provide a single entry point for several internal microservices and route requests based on API paths. Which service can perform this function?<\/b><\/p>\n

                      \n
                    1. Amazon S3<\/span><\/li>\n
                    2. AWS Batch<\/span><\/li>\n
                    3. Amazon API Gateway<\/span><\/li>\n
                    4. Amazon EBS<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 3<\/b><\/p>\n

                      Explanation<\/b><\/p>\n

                      Amazon API Gateway can provide a centralized API entry point and route requests to different backend services based on configured API resources and paths. It can integrate with Lambda functions, HTTP services, and other supported targets while providing capabilities such as authorization, throttling, monitoring, and request handling. S3 and EBS are storage services, while AWS Batch is designed for batch computing. Therefore, API Gateway is appropriate when multiple backend services need to be exposed through a managed API layer.<\/span><\/p>\n

                      Question 291<\/b><\/h3>\n

                      A company wants to reduce the operational burden of running a PostgreSQL-compatible relational database while gaining improved performance. Which service should be considered?<\/b><\/p>\n

                        \n
                      1. Amazon DynamoDB<\/span><\/li>\n
                      2. Amazon Redshift<\/span><\/li>\n
                      3. Amazon Aurora<\/span><\/li>\n
                      4. Amazon OpenSearch Service<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 3<\/b><\/p>\n

                        Explanation<\/b><\/p>\n

                        Amazon Aurora is a managed relational database engine compatible with PostgreSQL and MySQL. It is designed for high performance and availability while reducing many database administration tasks. Aurora integrates with AWS features such as automated backups, replication, monitoring, and managed scaling capabilities depending on the configuration. DynamoDB is a NoSQL database, Redshift is a data warehouse, and OpenSearch is designed for search and analytics. Therefore, Aurora is appropriate for organizations seeking a managed PostgreSQL-compatible relational database with strong performance characteristics.<\/span><\/p>\n

                        Question 292<\/b><\/h3>\n

                        A company needs to run security-sensitive workloads on physical servers dedicated to its AWS account. Which EC2 option should be selected?<\/b><\/p>\n

                          \n
                        1. Spot Instances<\/span><\/li>\n
                        2. Dedicated Hosts<\/span><\/li>\n
                        3. Reserved Instances<\/span><\/li>\n
                        4. Savings Plans<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 2<\/b><\/p>\n

                          Explanation<\/b><\/p>\n

                          Amazon EC2 Dedicated Hosts provide physical servers dedicated to a single customer account. They are useful for workloads with specific licensing requirements, compliance needs, or requirements for dedicated physical infrastructure. Spot Instances use spare capacity and can be interrupted, while Reserved Instances and Savings Plans primarily provide pricing benefits for committed usage rather than dedicated physical hosts. Therefore, Dedicated Hosts are appropriate when the workload requires physical server isolation or specific licensing and compliance arrangements.<\/span><\/p>\n

                          Question 293<\/b><\/h3>\n

                          A company wants to automatically run infrastructure updates after a successful code deployment. Which AWS service can coordinate these deployment-related workflows?<\/b><\/p>\n

                            \n
                          1. AWS Step Functions<\/span><\/li>\n
                          2. Amazon S3<\/span><\/li>\n
                          3. Amazon Route 53<\/span><\/li>\n
                          4. Amazon Macie<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 1<\/b><\/p>\n

                            Explanation<\/b><\/p>\n

                            AWS Step Functions can coordinate multiple AWS services and application steps into an automated workflow. A workflow can invoke deployment-related actions, wait for results, branch based on conditions, and retry failed operations. This makes Step Functions useful for complex deployment automation and operational processes that involve multiple services. S3 provides object storage, Route 53 provides DNS capabilities, and Macie discovers sensitive data. Therefore, Step Functions is appropriate when deployment activities need coordinated, stateful workflow automation.<\/span><\/p>\n

                            Question 294<\/b><\/h3>\n

                            A company wants to analyze logs using search, visualization, and near-real-time analytics. Which AWS service is suitable?<\/b><\/p>\n

                              \n
                            1. Amazon Neptune<\/span><\/li>\n
                            2. Amazon OpenSearch Service<\/span><\/li>\n
                            3. Amazon RDS<\/span><\/li>\n
                            4. Amazon DynamoDB<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 2<\/b><\/p>\n

                              Explanation<\/b><\/p>\n

                              Amazon OpenSearch Service provides managed search and analytics capabilities that can be used for log analysis, application monitoring, and operational dashboards. It supports indexing and querying large volumes of data and can integrate with visualization tools such as OpenSearch Dashboards. Neptune is a graph database, RDS is a managed relational database service, and DynamoDB is a NoSQL database. Therefore, OpenSearch Service is suitable for workloads requiring searchable logs, analytics, and near-real-time operational visibility.<\/span><\/p>\n

                              Question 295<\/b><\/h3>\n

                              A company wants to protect a database password from being exposed in application source code and needs automatic rotation. Which service is most appropriate?<\/b><\/p>\n

                                \n
                              1. AWS Secrets Manager<\/span><\/li>\n
                              2. Amazon CloudWatch<\/span><\/li>\n
                              3. AWS Config<\/span><\/li>\n
                              4. Amazon GuardDuty<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 1<\/b><\/p>\n

                                Explanation<\/b><\/p>\n

                                AWS Secrets Manager securely stores sensitive information such as database credentials and supports automatic rotation for supported secrets. Applications can retrieve secrets at runtime instead of storing passwords directly in source code or configuration files. CloudWatch provides monitoring, Config evaluates resource configurations, and GuardDuty detects security threats. Secrets Manager also integrates with IAM and KMS to provide controlled access and encryption. Therefore, Secrets Manager is the appropriate service for protecting database passwords and automating supported credential rotation.<\/span><\/p>\n

                                Question 296<\/b><\/h3>\n

                                A company needs to transfer data between an on-premises NFS file server and Amazon EFS on a recurring schedule. Which service is appropriate?<\/b><\/p>\n

                                  \n
                                1. AWS DataSync<\/span><\/li>\n
                                2. AWS CloudFormation<\/span><\/li>\n
                                3. Amazon EventBridge<\/span><\/li>\n
                                4. Amazon Cognito<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 1<\/b><\/p>\n

                                  Explanation<\/b><\/p>\n

                                  AWS DataSync is designed for automated data transfers between on-premises storage and AWS storage services, including Amazon EFS. It supports recurring transfers, scheduling, monitoring, and data integrity validation, making it suitable for ongoing synchronization or migration workloads. CloudFormation manages infrastructure deployment, EventBridge routes events and schedules actions, and Cognito manages application identities. Therefore, DataSync is the appropriate service for recurring transfers between an on-premises NFS file system and EFS.<\/span><\/p>\n

                                  Question 297<\/b><\/h3>\n

                                  A company wants to allow applications in private subnets to access the internet for software updates without allowing unsolicited inbound internet connections. Which solution should be used?<\/b><\/p>\n

                                    \n
                                  1. Internet Gateway directly on the private subnet<\/span><\/li>\n
                                  2. NAT Gateway in a public subnet<\/span><\/li>\n
                                  3. VPC Peering<\/span><\/li>\n
                                  4. AWS PrivateLink<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 2<\/b><\/p>\n

                                    Explanation<\/b><\/p>\n

                                    A NAT Gateway deployed in a public subnet allows resources in private subnets to initiate outbound internet connections while preventing unsolicited inbound connections from the internet. The private subnet route table sends appropriate traffic to the NAT Gateway, which uses an Internet Gateway for internet access. Directly placing an Internet Gateway route on a private subnet would expose resources differently and does not provide the intended NAT behavior. VPC Peering and PrivateLink address private connectivity rather than general outbound internet access.<\/span><\/p>\n

                                    Question 298<\/b><\/h3>\n

                                    A company wants to centrally identify security vulnerabilities across EC2 instances and container images. Which service should be evaluated?<\/b><\/p>\n

                                      \n
                                    1. Amazon Inspector<\/span><\/li>\n
                                    2. AWS Artifact<\/span><\/li>\n
                                    3. Amazon Route 53<\/span><\/li>\n
                                    4. Amazon SNS<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 1<\/b><\/p>\n

                                      Explanation<\/b><\/p>\n

                                      Amazon Inspector provides automated vulnerability assessment for supported AWS workloads, including EC2 instances and container images. It can identify software vulnerabilities and other security issues and produce findings that security teams can investigate. Artifact provides compliance documentation, Route 53 provides DNS services, and SNS provides messaging. Inspector is therefore appropriate when an organization needs centralized visibility into vulnerabilities affecting compute workloads and container images. It can help security teams prioritize remediation based on identified findings and workload exposure.<\/span><\/p>\n

                                      Question 299<\/b><\/h3>\n

                                      A company needs to provide a reliable queue for tasks that must be processed exactly once in order for each message group. Which SQS feature should be used?<\/b><\/p>\n

                                        \n
                                      1. Standard queue<\/span><\/li>\n
                                      2. Dead-letter queue only<\/span><\/li>\n
                                      3. FIFO queue<\/span><\/li>\n
                                      4. Delay queue only<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 3<\/b><\/p>\n

                                        Explanation<\/b><\/p>\n

                                        Amazon SQS FIFO queues are designed for workloads that require message ordering and deduplication. Messages within a message group are processed in order, while FIFO behavior helps prevent duplicate processing under supported conditions. Standard queues provide higher throughput but do not guarantee strict ordering and offer at-least-once delivery. Dead-letter queues are used to isolate messages that repeatedly fail processing, while delay queues postpone message availability. Therefore, an SQS FIFO queue is appropriate when ordered processing and deduplication are required.<\/span><\/p>\n

                                        Question 300<\/b><\/h3>\n

                                        A company wants to manage multiple AWS accounts under one organization and receive a consolidated AWS bill. Which service provides this capability?<\/b><\/p>\n

                                          \n
                                        1. AWS Organizations<\/span><\/li>\n
                                        2. AWS Systems Manager<\/span><\/li>\n
                                        3. Amazon CloudWatch<\/span><\/li>\n
                                        4. AWS Certificate Manager<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 1<\/b><\/p>\n

                                          Explanation<\/b><\/p>\n

                                          AWS Organizations allows companies to centrally manage multiple AWS accounts and supports consolidated billing. Organizations can group accounts into organizational units, apply service control policies, and establish centralized governance structures. Systems Manager manages operational resources, CloudWatch provides monitoring and observability, and Certificate Manager handles SSL\/TLS certificates. Consolidated billing allows usage from member accounts to be combined for billing purposes and can simplify financial management. Therefore, AWS Organizations is the appropriate service for centralized account management and consolidated billing.<\/span><\/p>\n

                                           <\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Amazon AWS Certified Solutions Architect – Professional SAP-C02 Exam Dumps and Practice Test Dumps.   Question 281 A company needs to automatically scale a DynamoDB table based on application traffic while avoiding manual capacity adjustments. Which capacity mode should be considered? Provisioned capacity On-demand capacity Reserved capacity Dedicated capacity Correct Answer: 2 Explanation […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15458"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=15458"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15458\/revisions"}],"predecessor-version":[{"id":15473,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/15458\/revisions\/15473"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=15458"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=15458"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=15458"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}