🔍

SAP-C02 — questions

Page 14 of 27 · 529 total questions.

SAP-C02 Question 261

Single page →
Topic 1 · Question 261 · Select all that apply

A company has many separate AWS accounts and uses no central billing or management. Each AWS account hosts services for different departments in the company. The company has a Microsoft Azure Active Directory that is deployed. A solutions architect needs to centralize billing and management of the company’s AWS accounts. The company wants to start using identity federation instead of manual user management. The company also wants to use temporary credentials instead of long-lived access keys. Which combination of steps will meet these requirements? (Choose three.)

  • ACreate a new AWS account to serve as a management account. Deploy an organization in AWS Organizations. Invite each existing AWS account to join the organization. Ensure that each account accepts the invitation. (correct answer)
  • BConfigure each AWS account's email address to be aws+@example.com so that account management email messages and invoices are sent to the same place.
  • CDeploy AWS IAM Identity Center (AWS Single Sign-On) in the management account. Connect IAM Identity Center to the Azure Active Directory. Configure IAM Identity Center for automatic synchronization of users and groups. (correct answer)
  • DDeploy an AWS Managed Microsoft AD directory in the management account. Share the directory with all other accounts in the organization by using AWS Resource Access Manager (AWS RAM).
  • ECreate AWS IAM Identity Center (AWS Single Sign-On) permission sets. Attach the permission sets to the appropriate IAM Identity Center groups and AWS accounts. (correct answer)
  • FConfigure AWS Identity and Access Management (IAM) in each AWS account to use AWS Managed Microsoft AD for authentication and authorization.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Create a new AWS account to serve as a management account. Deploy an organization in AWS Organizations. Invite each existing AWS account to join the organization. Ensure that each account accepts the invitation. Option C: Deploy AWS IAM Identity Center (AWS Single Sign-On) in the management account. Connect IAM Identity Center to the Azure Active Directory. Configure IAM Identity Center for automatic synchronization of users and groups. Option E: Create AWS IAM Identity Center (AWS Single Sign-On) permission sets. Attach the permission sets to the appropriate IAM Identity Center groups and AWS accounts.

Explanation

AWS IAM controls authenticated and authorized access to AWS resources with fine-grained policies. AWS Organizations centrally governs and secures multiple AWS accounts. AWS IAM Identity Center (SSO) centrally manages workforce access to multiple accounts and apps.

SAP-C02 Question 262

Single page →
Topic 1 · Question 262

A company wants to manage the costs associated with a group of 20 applications that are infrequently used, but are still business-critical, by migrating to AWS. The applications are a mix of Java and Node.js spread across different instance clusters. The company wants to minimize costs while standardizing by using a single deployment methodology. Most of the applications are part of month-end processing routines with a small number of concurrent users, but they are occasionally run at other times. Average application memory consumption is less than 1 GB. though some applications use as much as 2.5 GB of memory during peak processing. The most important application in the group is a billing report written in Java that accesses multiple data sources and often runs for several hours. Which is the MOST cost-effective solution?

  • ADeploy a separate AWS Lambda function for each application. Use AWS CloudTrail logs and Amazon CloudWatch alarms to verify completion of critical jobs.
  • BDeploy Amazon ECS containers on Amazon EC2 with Auto Scaling configured for memory utilization of 75%. Deploy an ECS task for each application being migrated with ECS task scaling. Monitor services and hosts by using Amazon CloudWatch. (correct answer)
  • CDeploy AWS Elastic Beanstalk for each application with Auto Scaling to ensure that all requests have sufficient resources. Monitor each AWS Elastic Beanstalk deployment by using CloudWatch alarms.
  • DDeploy a new Amazon EC2 instance cluster that co-hosts all applications by using EC2 Auto Scaling and Application Load Balancers. Scale cluster size based on a custom metric set on instance memory utilization. Purchase 3-year Reserved Instance reservations equal to the GroupMaxSize parameter of the Auto Scaling group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Deploy Amazon ECS containers on Amazon EC2 with Auto Scaling configured for memory utilization of 75%. Deploy an ECS task for each application being migrated with ECS task scaling. Monitor services and hosts by using...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon ECS orchestrates containers and integrates natively with AWS networking and IAM. This option delivers the requirement at the lowest cost.

SAP-C02 Question 263

Single page →
Topic 1 · Question 263

A solutions architect needs to review the design of an Amazon EMR cluster that is using the EMR File System (EMRFS). The cluster performs tasks that are critical to business needs. The cluster is running Amazon EC2 On-Demand Instances at all times for all task, primary, and core nodes. The EMR tasks run each morning, starting at 1:00 AM. and take 6 hours to finish running. The amount of time to complete the processing is not a priority because the data is not referenced until late in the day. The solutions architect must review the architecture and suggest a solution to minimize the compute costs. Which solution should the solutions architect recommend to meet these requirements?

  • ALaunch all task, primary, and core nodes on Spot Instances in an instance fleet. Terminate the cluster, including all instances, when the processing is completed.
  • BLaunch the primary and core nodes on On-Demand Instances. Launch the task nodes on Spot Instances in an instance fleet. Terminate the cluster, including all instances, when the processing is completed. Purchase Compute Savings Plans to cover the On-Demand Instance usage.
  • CContinue to launch all nodes on On-Demand Instances. Terminate the cluster, including all instances, when the processing is completed. Purchase Compute Savings Plans to cover the On-Demand Instance usage.
  • DLaunch the primary and core nodes on On-Demand Instances. Launch the task nodes on Spot Instances in an instance fleet. Terminate only the task node instances when the processing is completed. Purchase Compute Savings Plans to cover the On-Demand Instance usage. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Launch the primary and core nodes on On-Demand Instances. Launch the task nodes on Spot Instances in an instance fleet. Terminate only the task node instances when the processing is completed. Purchase Compute Savings...

Explanation

Spot Instances use spare capacity at a large discount, ideal for fault-tolerant or interruptible workloads. Savings Plans reduce cost for consistent compute usage in exchange for a usage commitment.

SAP-C02 Question 264

Single page →
Topic 1 · Question 264

A company has migrated a legacy application to the AWS Cloud. The application runs on three Amazon EC2 instances that are spread across three Availability Zones. One EC2 instance is in each Availability Zone. The EC2 instances are running in three private subnets of the VPC and are set up as targets for an Application Load Balancer (ALB) that is associated with three public subnets. The application needs to communicate with on-premises systems. Only traffic from IP addresses in the company's IP address range are allowed to access the on-premises systems. The company’s security team is bringing only one IP address from its internal IP address range to the cloud. The company has added this IP address to the allow list for the company firewall. The company also has created an Elastic IP address for this IP address. A solutions architect needs to create a solution that gives the application the ability to communicate with the on-premises systems. The solution also must be able to mitigate failures automatically. Which solution will meet these requirements?

  • ADeploy three NAT gateways, one in each public subnet. Assign the Elastic IP address to the NAT gateways. Turn on health checks for the NAT gateways. If a NAT gateway fails a health check, recreate the NAT gateway and assign the Elastic IP address to the new NAT gateway.
  • BReplace the ALB with a Network Load Balancer (NLB). Assign the Elastic IP address to the NLTurn on health checks for the NLIn the case of a failed health check, redeploy the NLB in different subnets.
  • CDeploy a single NAT gateway in a public subnet. Assign the Elastic IP address to the NAT gateway. Use Amazon CloudWatch with a custom metric to monitor the NAT gateway. If the NAT gateway is unhealthy, invoke an AWS Lambda function to create a new NAT gateway in a different subnet. Assign the Elastic IP address to the new NAT gateway. (correct answer)
  • DAssign the Elastic IP address to the ALB. Create an Amazon Route 53 simple record with the Elastic IP address as the value. Create a Route 53 health check. In the case of a failed health check, recreate the ALB in different subnets.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Deploy a single NAT gateway in a public subnet. Assign the Elastic IP address to the NAT gateway. Use Amazon CloudWatch with a custom metric to monitor the NAT gateway. If the NAT gateway is unhealthy, invoke an AWS L...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. A NAT gateway lets private subnet resources reach the internet for outbound traffic only. Amazon CloudWatch collects metrics, logs and alarms to monitor and react to operational health.

SAP-C02 Question 265

Single page →
Topic 1 · Question 265 · Select all that apply

A company uses AWS Organizations to manage more than 1,000 AWS accounts. The company has created a new developer organization. There are 540 developer member accounts that must be moved to the new developer organization. All accounts are set up with all the required information so that each account can be operated as a standalone account. Which combination of steps should a solutions architect take to move all of the developer accounts to the new developer organization? (Choose three.)

  • ACall the MoveAccount operation in the Organizations API from the old organization's management account to migrate the developer accounts to the new developer organization.
  • BFrom the management account, remove each developer account from the old organization using the RemoveAccountFromOrganization operation in the Organizations API. (correct answer)
  • CFrom each developer account, remove the account from the old organization using the RemoveAccountFromOrganization operation in the Organizations API.
  • DSign in to the new developer organization's management account and create a placeholder member account that acts as a target for the developer account migration.
  • ECall the InviteAccountToOrganization operation in the Organizations API from the new developer organization's management account to send invitations to the developer accounts. (correct answer)
  • FHave each developer sign in to their account and confirm to join the new developer organization. (correct answer)
Reveal answer & explanation
Correct answer: B, E, F

The correct answer is B, E, F. Option B: From the management account, remove each developer account from the old organization using the RemoveAccountFromOrganization operation in the Organizations API. Option E: Call the InviteAccountToOrganization operation in the Organizations API from the new developer organization's management account to send invitations to the developer accounts. Option F: Have each developer sign in to their account and confirm to join the new developer organization.

Explanation

AWS Organizations centrally governs and secures multiple AWS accounts.

SAP-C02 Question 266

Single page →
Topic 1 · Question 266

A company’s interactive web application uses an Amazon CloudFront distribution to serve images from an Amazon S3 bucket. Occasionally, third-party tools ingest corrupted images into the S3 bucket. This image corruption causes a poor user experience in the application later. The company has successfully implemented and tested Python logic to detect corrupt images. A solutions architect must recommend a solution to integrate the detection logic with minimal latency between the ingestion and serving. Which solution will meet these requirements?

  • AUse a Lambda@Edge function that is invoked by a viewer-response event.
  • BUse a Lambda@Edge function that is invoked by an origin-response event.
  • CUse an S3 event notification that invokes an AWS Lambda function. (correct answer)
  • DUse an S3 event notification that invokes an AWS Step Functions state machine.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use an S3 event notification that invokes an AWS Lambda function.

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed.

SAP-C02 Question 267

Single page →
Topic 1 · Question 267

A company has an application that runs on Amazon EC2 instances in an Amazon EC2 Auto Scaling group. The company uses AWS CodePipeline to deploy the application. The instances that run in the Auto Scaling group are constantly changing because of scaling events. When the company deploys new application code versions, the company installs the AWS CodeDeploy agent on any new target EC2 instances and associates the instances with the CodeDeploy deployment group. The application is set to go live within the next 24 hours. What should a solutions architect recommend to automate the application deployment process with the LEAST amount of operational overhead?

  • AConfigure Amazon EventBridge to invoke an AWS Lambda function when a new EC2 instance is launched into the Auto Scaling group. Code the Lambda function to associate the EC2 instances with the CodeDeploy deployment group.
  • BWrite a script to suspend Amazon EC2 Auto Scaling operations before the deployment of new code. When the deployment is complete, create a new AMI and configure the Auto Scaling group's launch template to use the new AMI for new launches. Resume Amazon EC2 Auto Scaling operations.
  • CCreate a new AWS CodeBuild project that creates a new AMI that contains the new code. Configure CodeBuild to update the Auto Scaling group’s launch template to the new AMI. Run an Amazon EC2 Auto Scaling instance refresh operation.
  • DCreate a new AMI that has the CodeDeploy agent installed. Configure the Auto Scaling group’s launch template to use the new AMI. Associate the CodeDeploy deployment group with the Auto Scaling group instead of the EC2 instances. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Create a new AMI that has the CodeDeploy agent installed. Configure the Auto Scaling group’s launch template to use the new AMI. Associate the CodeDeploy deployment group with the Auto Scaling group instead of the EC2...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 268

Single page →
Topic 1 · Question 268

A company has a website that runs on four Amazon EC2 instances that are behind an Application Load Balancer (ALB). When the ALB detects that an EC2 instance is no longer available, an Amazon CloudWatch alarm enters the ALARM state. A member of the company's operations team then manually adds a new EC2 instance behind the ALB. A solutions architect needs to design a highly available solution that automatically handles the replacement of EC2 instances. The company needs to minimize downtime during the switch to the new solution. Which set of steps should the solutions architect take to meet these requirements?

  • ADelete the existing ALB. Create an Auto Scaling group that is configured to handle the web application traffic. Attach a new launch template to the Auto Scaling group. Create a new ALB. Attach the Auto Scaling group to the new ALB. Attach the existing EC2 instances to the Auto Scaling group.
  • BCreate an Auto Scaling group that is configured to handle the web application traffic. Attach a new launch template to the Auto Scaling group. Attach the Auto Scaling group to the existing ALAttach the existing EC2 instances to the Auto Scaling group. (correct answer)
  • CDelete the existing ALB and the EC2 instances. Create an Auto Scaling group that is configured to handle the web application traffic. Attach a new launch template to the Auto Scaling group. Create a new ALB. Attach the Auto Scaling group to the new ALB. Wait for the Auto Scaling group to launch the minimum number of EC2 instances.
  • DCreate an Auto Scaling group that is configured to handle the web application traffic. Attach a new launch template to the Auto Scaling group. Attach the Auto Scaling group to the existing ALB. Wait for the existing ALB to register the existing EC2 instances with the Auto Scaling group.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Create an Auto Scaling group that is configured to handle the web application traffic. Attach a new launch template to the Auto Scaling group. Attach the Auto Scaling group to the existing ALAttach the existing EC2 in...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. Amazon EC2 provides resizable virtual servers when you need full control of the operating system. AWS Config tracks resource configuration changes and evaluates compliance. By spanning multiple Availability Zones / adding redundancy, this option provides the high availability and resilience required.

SAP-C02 Question 269

Single page →
Topic 1 · Question 269

A company wants to optimize AWS data-transfer costs and compute costs across developer accounts within the company's organization in AWS Organizations. Developers can configure VPCs and launch Amazon EC2 instances in a single AWS Region. The EC2 instances retrieve approximately 1 TB of data each day from Amazon S3. The developer activity leads to excessive monthly data-transfer charges and NAT gateway processing charges between EC2 instances and S3 buckets, along with high compute costs. The company wants to proactively enforce approved architectural patterns for any EC2 instance and VPC infrastructure that developers deploy within the AWS accounts. The company does not want this enforcement to negatively affect the speed at which the developers can perform their tasks. Which solution will meet these requirements MOST cost-effectively?

  • ACreate SCPs to prevent developers from launching unapproved EC2 instance types. Provide the developers with an AWS CloudFormation template to deploy an approved VPC configuration with S3 interface endpoints. Scope the developers' IAM permissions so that the developers can launch VPC resources only with CloudFormation.
  • BCreate a daily forecasted budget with AWS Budgets to monitor EC2 compute costs and S3 data-transfer costs across the developer accounts. When the forecasted cost is 75% of the actual budget cost, send an alert to the developer teams. If the actual budget cost is 100%, create a budget action to terminate the developers' EC2 instances and VPC infrastructure.
  • CCreate an AWS Service Catalog portfolio that users can use to create an approved VPC configuration with S3 gateway endpoints and approved EC2 instances. Share the portfolio with the developer accounts. Configure an AWS Service Catalog launch constraint to use an approved IAM role. Scope the developers' IAM permissions to allow access only to AWS Service Catalog. (correct answer)
  • DCreate and deploy AWS Config rules to monitor the compliance of EC2 and VPC resources in the developer AWS accounts. If developers launch unapproved EC2 instances or if developers create VPCs without S3 gateway endpoints, perform a remediation action to terminate the unapproved resources.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create an AWS Service Catalog portfolio that users can use to create an approved VPC configuration with S3 gateway endpoints and approved EC2 instances. Share the portfolio with the developer accounts. Configure an AW...

Explanation

Amazon EC2 provides resizable virtual servers when you need full control of the operating system. Amazon S3 provides durable, scalable object storage that is fully managed. An IAM role grants temporary, least-privilege permissions to AWS resources without long-term credentials. This option delivers the requirement at the lowest cost.

SAP-C02 Question 270

Single page →
Topic 1 · Question 270

A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions. Which solution will meet these requirements?

  • ACreate IAM roles for each account. Create IAM policies with conditional allow permissions that include only approved Regions for the accounts.
  • BCreate an organization in AWS Organizations. Create IAM users for each account. Attach a policy to each user to block access to Regions where an account cannot deploy infrastructure.
  • CLaunch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to run services outside of the approved Regions. (correct answer)
  • DEnable AWS Security Hub in each account. Create controls to specify the Regions where an account can deploy infrastructure.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Launch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to run services outside of the approved Regions.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do. AWS Control Tower sets up and governs a secure multi-account landing zone.

SAP-C02 Question 271

Single page →
Topic 1 · Question 271

A company wants to refactor its retail ordering web application that currently has a load-balanced Amazon EC2 instance fleet for web hosting, database API services, and business logic. The company needs to create a decoupled, scalable architecture with a mechanism for retaining failed orders while also minimizing operational costs. Which solution will meet these requirements?

  • AUse Amazon S3 for web hosting with Amazon API Gateway for database API services. Use Amazon Simple Queue Service (Amazon SQS) for order queuing. Use Amazon Elastic Container Service (Amazon ECS) for business logic with Amazon SQS long polling for retaining failed orders.
  • BUse AWS Elastic Beanstalk for web hosting with Amazon API Gateway for database API services. Use Amazon MQ for order queuing. Use AWS Step Functions for business logic with Amazon S3 Glacier Deep Archive for retaining failed orders.
  • CUse Amazon S3 for web hosting with AWS AppSync for database API services. Use Amazon Simple Queue Service (Amazon SQS) for order queuing. Use AWS Lambda for business logic with an Amazon SQS dead-letter queue for retaining failed orders. (correct answer)
  • DUse Amazon Lightsail for web hosting with AWS AppSync for database API services. Use Amazon Simple Email Service (Amazon SES) for order queuing. Use Amazon Elastic Kubernetes Service (Amazon EKS) for business logic with Amazon OpenSearch Service for retaining failed orders.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use Amazon S3 for web hosting with AWS AppSync for database API services. Use Amazon Simple Queue Service (Amazon SQS) for order queuing. Use AWS Lambda for business logic with an Amazon SQS dead-letter queue for reta...

Explanation

AWS Lambda runs code without provisioning servers and scales automatically, which minimizes operational overhead. Amazon S3 provides durable, scalable object storage that is fully managed. Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. This option decouples the components so they scale independently and absorb load spikes.

SAP-C02 Question 272

Single page →
Topic 1 · Question 272

A company hosts a web application on AWS in the us-east-1 Region. The application servers are distributed across three Availability Zones behind an Application Load Balancer. The database is hosted in a MySQL database on an Amazon EC2 instance. A solutions architect needs to design a cross-Region data recovery solution using AWS services with an RTO of less than 5 minutes and an RPO of less than 1 minute. The solutions architect is deploying application servers in us-west-2, and has configured Amazon Route 53 health checks and DNS failover to us-west-2. Which additional step should the solutions architect take?

  • AMigrate the database to an Amazon RDS for MySQL instance with a cross-Region read replica in us-west-2.
  • BMigrate the database to an Amazon Aurora global database with the primary in us-east-1 and the secondary in us-west-2. (correct answer)
  • CMigrate the database to an Amazon RDS for MySQL instance with a Multi-AZ deployment.
  • DCreate a MySQL standby database on an Amazon EC2 instance in us-west-2.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Migrate the database to an Amazon Aurora global database with the primary in us-east-1 and the secondary in us-west-2.

Explanation

Amazon Aurora is a high-performance managed relational database with built-in replication and failover.

SAP-C02 Question 273

Single page →
Topic 1 · Question 273

A company is using AWS Organizations to manage multiple accounts. Due to regulatory requirements, the company wants to restrict specific member accounts to certain AWS Regions, where they are permitted to deploy resources. The resources in the accounts must be tagged, enforced based on a group standard, and centrally managed with minimal configuration. What should a solutions architect do to meet these requirements?

  • ACreate an AWS Config rule in the specific member accounts to limit Regions and apply a tag policy.
  • BFrom the AWS Billing and Cost Management console, in the management account, disable Regions for the specific member accounts and apply a tag policy on the root.
  • CAssociate the specific member accounts with the root. Apply a tag policy and an SCP using conditions to limit Regions.
  • DAssociate the specific member accounts with a new OU. Apply a tag policy and an SCP using conditions to limit Regions. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Associate the specific member accounts with a new OU. Apply a tag policy and an SCP using conditions to limit Regions.

Explanation

Service Control Policies set guardrails on what accounts in an organization can do.

SAP-C02 Question 274

Single page →
Topic 1 · Question 274

A company has an application that generates reports and stores them in an Amazon S3 bucket. When a user accesses their report, the application generates a signed URL to allow the user to download the report. The company's security team has discovered that the files are public and that anyone can download them without authentication. The company has suspended the generation of new reports until the problem is resolved. Which set of actions will immediately remediate the security issue without impacting the application's normal workflow?

  • ACreate an AWS Lambda function that applies a deny all policy for users who are not authenticated. Create a scheduled event to invoke the Lambda function.
  • BReview the AWS Trusted Advisor bucket permissions check and implement the recommended actions.
  • CRun a script that puts a private ACL on all of the objects in the bucket.
  • DUse the Block Public Access feature in Amazon S3 to set the IgnorePublicAcIs option to TRUE on the bucket. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcIs option to TRUE on the bucket.

Explanation

Amazon S3 provides durable, scalable object storage that is fully managed.

SAP-C02 Question 275

Single page →
Topic 1 · Question 275 · Select all that apply

A company is planning to migrate an Amazon RDS for Oracle database to an RDS for PostgreSQL DB instance in another AWS account. A solutions architect needs to design a migration strategy that will require no downtime and that will minimize the amount of time necessary to complete the migration. The migration strategy must replicate all existing data and any new data that is created during the migration. The target database must be identical to the source database at completion of the migration process. All applications currently use an Amazon Route 53 CNAME record as their endpoint for communication with the RDS for Oracle DB instance. The RDS for Oracle DB instance is in a private subnet. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

  • ACreate a new RDS for PostgreSQL DB instance in the target account. Use the AWS Schema Conversion Tool (AWS SCT) to migrate the database schema from the source database to the target database. (correct answer)
  • BUse the AWS Schema Conversion Tool (AWS SCT) to create a new RDS for PostgreSQL DB instance in the target account with the schema and initial data from the source database.
  • CConfigure VPC peering between the VPCs in the two AWS accounts to provide connectivity to both DB instances from the target account. Configure the security groups that are attached to each DB instance to allow traffic on the database port from the VPC in the target account. (correct answer)
  • DTemporarily allow the source DB instance to be publicly accessible to provide connectivity from the VPC in the target account. Configure the security groups that are attached to each DB instance to allow traffic on the database port from the VPC in the target account.
  • EUse AWS Database Migration Service (AWS DMS) in the target account to perform a full load plus change data capture (CDC) migration from the source database to the target database. When the migration is complete, change the CNAME record to point to the target DB instance endpoint. (correct answer)
  • FUse AWS Database Migration Service (AWS DMS) in the target account to perform a change data capture (CDC) migration from the source database to the target database. When the migration is complete, change the CNAME record to point to the target DB instance endpoint.
Reveal answer & explanation
Correct answer: A, C, E

The correct answer is A, C, E. Option A: Create a new RDS for PostgreSQL DB instance in the target account. Use the AWS Schema Conversion Tool (AWS SCT) to migrate the database schema from the source database to the target database. Option C: Configure VPC peering between the VPCs in the two AWS accounts to provide connectivity to both DB instances from the target account. Configure the security groups that are attached to each DB instance to allow traffic... Option E: Use AWS Database Migration Service (AWS DMS) in the target account to perform a full load plus change data capture (CDC) migration from the source database to the target database. When the migration is complete, chang...

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. VPC peering privately connects two VPCs without a gateway. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 276

Single page →
Topic 1 · Question 276

A company has implemented an ordering system using an event-driven architecture. During initial testing, the system stopped processing orders. Further log analysis revealed that one order message in an Amazon Simple Queue Service (Amazon SQS) standard queue was causing an error on the backend and blocking all subsequent order messages. The visibility timeout of the queue is set to 30 seconds, and the backend processing timeout is set to 10 seconds. A solutions architect needs to analyze faulty order messages and ensure that the system continues to process subsequent messages. Which step should the solutions architect take to meet these requirements?

  • AIncrease the backend processing timeout to 30 seconds to match the visibility timeout.
  • BReduce the visibility timeout of the queue to automatically remove the faulty message.
  • CConfigure a new SQS FIFO queue as a dead-letter queue to isolate the faulty messages.
  • DConfigure a new SQS standard queue as a dead-letter queue to isolate the faulty messages. (correct answer)
Reveal answer & explanation
Correct answer: D

The correct answer is D. Option D: Configure a new SQS standard queue as a dead-letter queue to isolate the faulty messages.

Explanation

Amazon SQS is a fully managed message queue that decouples components and absorbs traffic spikes. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 277

Single page →
Topic 1 · Question 277 · Select all that apply

A company has automated the nightly retraining of its machine learning models by using AWS Step Functions. The workflow consists of multiple steps that use AWS Lambda. Each step can fail for various reasons, and any failure causes a failure of the overall workflow. A review reveals that the retraining has failed multiple nights in a row without the company noticing the failure. A solutions architect needs to improve the workflow so that notifications are sent for all types of failures in the retraining process. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

  • ACreate an Amazon Simple Notification Service (Amazon SNS) topic with a subscription of type "Email" that targets the team's mailing list. (correct answer)
  • BCreate a task named "Email" that forwards the input arguments to the SNS topic. (correct answer)
  • CAdd a Catch field to all Task, Map, and Parallel states that have a statement of "ErrorEquals": [ "States.ALL" ] and "Next”: "Email". (correct answer)
  • DAdd a new email address to Amazon Simple Email Service (Amazon SES). Verify the email address.
  • ECreate a task named "Email" that forwards the input arguments to the SES email address.
  • FAdd a Catch field to all Task, Map, and Parallel states that have a statement of "ErrorEquals": [ "States.Runtime" ] and "Next": "Email".
Reveal answer & explanation
Correct answer: A, B, C

The correct answer is A, B, C. Option A: Create an Amazon Simple Notification Service (Amazon SNS) topic with a subscription of type "Email" that targets the team's mailing list. Option B: Create a task named "Email" that forwards the input arguments to the SNS topic. Option C: Add a Catch field to all Task, Map, and Parallel states that have a statement of "ErrorEquals": [ "States.ALL" ] and "Next”: "Email".

Explanation

Amazon RDS is a managed relational database that handles patching, backups and failover. Amazon SNS is a managed pub/sub service for fan-out notifications to many subscribers.

SAP-C02 Question 278

Single page →
Topic 1 · Question 278

A company plans to deploy a new private intranet service on Amazon EC2 instances inside a VPC. An AWS Site-to-Site VPN connects the VPC to the company's on-premises network. The new service must communicate with existing on-premises services. The on-premises services are accessible through the use of hostnames that reside in the company.example DNS zone. This DNS zone is wholly hosted on premises and is available only on the company's private network. A solutions architect must ensure that the new service can resolve hostnames on the company.example domain to integrate with existing services. Which solution meets these requirements?

  • ACreate an empty private zone in Amazon Route 53 for company.example. Add an additional NS record to the company's on-premises company.example zone that points to the authoritative name servers for the new private zone in Route 53.
  • BTurn on DNS hostnames for the VPC. Configure a new outbound endpoint with Amazon Route 53 Resolver. Create a Resolver rule to forward requests for company.example to the on-premises name servers. (correct answer)
  • CTurn on DNS hostnames for the VPConfigure a new inbound resolver endpoint with Amazon Route 53 Resolver. Configur&the on-premises DNS server to forward requests for company.example to the new resolver.
  • DUse AWS Systems Manager to configure a run document that will install a hosts file that contains any required hostnames. Use an Amazon EventBridge rule to run the document when an instance is entering the running state.
Reveal answer & explanation
Correct answer: B

The correct answer is B. Option B: Turn on DNS hostnames for the VPC. Configure a new outbound endpoint with Amazon Route 53 Resolver. Create a Resolver rule to forward requests for company.example to the on-premises name servers.

Explanation

Amazon Route 53 provides DNS with health checks and routing policies for availability and latency. AWS Config tracks resource configuration changes and evaluates compliance.

SAP-C02 Question 279

Single page →
Topic 1 · Question 279

A company uses AWS CloudFormation to deploy applications within multiple VPCs that are all attached to a transit gateway. Each VPC that sends traffic to the public internet must send the traffic through a shared services VPC. Each subnet within a VPC uses the default VPC route table, and the traffic is routed to the transit gateway. The transit gateway uses its default route table for any VPC attachment. A security audit reveals that an Amazon EC2 instance that is deployed within a VPC can communicate with an EC2 instance that is deployed in any of the company's other VPCs. A solutions architect needs to limit the traffic between the VPCs. Each VPC must be able to communicate only with a predefined, limited set of authorized VPCs. What should the solutions architect do to meet these requirements?

  • AUpdate the network ACL of each subnet within a VPC to allow outbound traffic only to the authorized VPCs. Remove all deny rules except the default deny rule.
  • BUpdate all the security groups that are used within a VPC to deny outbound traffic to security groups that are used within the unauthorized VPCs.
  • CCreate a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs. (correct answer)
  • DUpdate the main route table of each VPC to route traffic only to the authorized VPCs through the transit gateway.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Create a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.

Explanation

AWS Transit Gateway centrally connects many VPCs and on-premises networks at scale.

SAP-C02 Question 280

Single page →
Topic 1 · Question 280

A company has a Windows-based desktop application that is packaged and deployed to the users' Windows machines. The company recently acquired another company that has employees who primarily use machines with a Linux operating system. The acquiring company has decided to migrate and rehost the Windows-based desktop application to AWS. All employees must be authenticated before they use the application. The acquiring company uses Active Directory on premises but wants a simplified way to manage access to the application on AWS for all the employees. Which solution will rehost the application on AWS with the LEAST development effort?

  • ASet up and provision an Amazon Workspaces virtual desktop for every employee. Implement authentication by using Amazon Cognito identity pools. Instruct employees to run the application from their provisioned Workspaces virtual desktops.
  • BCreate an Auto Scaling group of Windows-based Amazon EC2 instances. Join each EC2 instance to the company’s Active Directory domain. Implement authentication by using the Active Directory that is running on premises. Instruct employees to run the application by using a Windows remote desktop.
  • CUse an Amazon AppStream 2.0 image builder to create an image that includes the application and the required configurations. Provision an AppStream 2.0 On-Demand fleet with dynamic Fleet Auto Scaling policies for running the image. Implement authentication by using AppStream 2.0 user pools. Instruct the employees to access the application by starting browser-based AppStream 2.0 streaming sessions. (correct answer)
  • DRefactor and containerize the application to run as a web-based application. Run the application in Amazon Elastic Container Service (Amazon ECS) on AWS Fargate with step scaling policies. Implement authentication by using Amazon Cognito user pools. Instruct the employees to run the application from their browsers.
Reveal answer & explanation
Correct answer: C

The correct answer is C. Option C: Use an Amazon AppStream 2.0 image builder to create an image that includes the application and the required configurations. Provision an AppStream 2.0 On-Demand fleet with dynamic Fleet Auto Scaling policies for runni...

Explanation

Auto Scaling adjusts capacity automatically to match demand, improving availability and cost efficiency. AWS Config tracks resource configuration changes and evaluates compliance. This option needs the least custom development effort.

Showing questions 261–280 of 529 · Page 14 of 27