Practice for the AWS Certified Solutions Architect Professional (SAP-C02) exam with 15 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: A multinational investment bank has a hybrid cloud architecture that uses a single 1 Gbps AWS Direct Connect connection . Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the AWS Certified Solutions Architect Professional (SAP-C02) practice test →
What you will practice
- A multinational investment bank has a hybrid cloud architecture that uses a single 1 Gbps AWS Direct Connect…
- A company wants to launch its online shopping website to give customers an easy way to purchase the products…
- A company uses computer simulations for modeling weather patterns in a certain country. The simulations gener…
- A multinational financial company has a suite of web applications hosted in multiple VPCs in various AWS regi…
- A company is hosting its production environment on its on-premises servers. Most of the applications are pack…
- A company has production, development, and test environments in its software development department, and each…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. A multinational investment bank has a hybrid cloud architecture that uses a single 1 Gbps AWS Direct Connect connection to integrate its on-premises network to AWS Cloud. The bank has a total of 10 VPCs, which are all connected to its on-p…
Answer: C. Establish VPN tunnels from your on-premises data center to each of the 10 VPCs. Terminate each VPN tunnel connection at the virtual private gateway (VGW) of the respective VPC. Configure BGP for route management.
Establishing Site-to-Site VPN tunnels from your data center to the virtual private gateways provides a highly available, lower-cost backup. BGP manages routing, automatically failing over if the Direct Connect link drops. Provisioning a second Direct Connect is expensive and often unnecessary for simple failover.
Q2. A company wants to launch its online shopping website to give customers an easy way to purchase the products they need. The proposed setup is to host the application on an AWS Fargate cluster, utilize a Load Balancer to distribute traffic…
Answer: C. Register the domain name on Route 53 and enable DNSSEC validation for all public hosted zones to ensure that all DNS requests have not been tampered with during transit. Use AWS Certificate Manager (ACM) to generate a valid TLS/SSL certificate for the domain name. Configure the Application Load Balancer with an HTTPS listener to use the ACM TLS/SSL certificate. Use Server Name Identification and HTTP to HTTPS redirection on CloudFront.
Enabling Route 53 DNSSEC signing and validation protects against DNS spoofing by ensuring responses have not been tampered with in transit. Using an AWS Certificate Manager certificate on the Application Load Balancer prevents SSL hijacking by encrypting the connection. Avoid third-party DNS providers since Route 53 natively supports DNSSEC.
Q3. A company uses computer simulations for modeling weather patterns in a certain country. The simulations generate terabytes of data, which is stored in a MySQL 8.0 database that runs in an Amazon EC2 instance. A Ruby on Rails application is…
Answer: A. Configure your application tier to run on an Auto Scaling group of smaller sized EC2 instances behind an Application Load Balancer. Purchase Reserved EC2 instances for fixed capacity and let the Auto Scaling instances run on demand. Migrate the MySQL database to Amazon Aurora. Create a read-replica on another Availability Zone of the Aurora instance for high availability.
Migrating to Amazon Aurora provides automatic storage scaling up to 128 tebibytes, easily accommodating the database growth. Combining reserved instances for baseline capacity with on-demand instances in an Auto Scaling group optimizes compute costs while maintaining high availability. Managing databases on EC2 requires excessive manual overhead.
Q4. A multinational financial company has a suite of web applications hosted in multiple VPCs in various AWS regions. As part of their security compliance, the company's Solutions Architect has been tasked to set up a logging solution to track…
Answer: D. Create a new AWS CloudTrail trail in a new S3 bucket using the AWS CLI and also pass both the –is-multi-region-trail and –include-global-service-events parameters then encrypt log files using KMS encryption. Enable Multi-Factor Authentication (MFA) Delete on the S3 bucket and ensure that only authorized users can access the logs by configuring the bucket policies.
Creating a multi-region AWS CloudTrail trail captures regional service events across all specified regions for accounting systems. Including global service events ensures that actions from global services like IAM and CloudFront are logged. Encrypting the S3 bucket with KMS and enabling MFA Delete secures the log data.
Q5. A company is hosting its production environment on its on-premises servers. Most of the applications are packed as Docker containers that are manually run on self-managed virtual machines. The web servers are using the latest commercial Or…
Answer: C. Re-platform the environment on the AWS Cloud platform by running the Docker containers on Amazon ECS. Test the new OpenJDK Docker containers and upload them on Amazon Elastic Container Registry. Migrate the MySQL database to Amazon RDS using AWS Database Migration Service.
Replatforming shifts existing Docker containers to Amazon ECS and the database to Amazon RDS, achieving cloud agility without fundamentally altering the architecture. Refactoring to Lambda or DynamoDB is incorrect because it violates the requirement to avoid major application changes.
Q6. A company has production, development, and test environments in its software development department, and each environment contains tens to hundreds of EC2 instances, along with other AWS services. Recently, Ubuntu released a series of secu…
Answer: A. Tag each instance based on its environment and OS. Create a patch baseline in AWS Systems Manager Patch Manager for each environment. Categorize EC2 instances based on their tags using Patch Groups and apply the patches specified in the corresponding patch baseline to each Patch Group.
AWS Systems Manager Patch Manager uses patch groups based on resource tags to selectively apply different patch baselines across environments. This natively isolates production instances from development and test servers without writing custom Run Command scripts.
Q7. A company has just launched a new central employee registry application that contains all of the public employee registration information of each staff of the company. The application has a microservices architecture running in Docker in a…
Answer: D. Link each of the teams' VPCs to the central VPC using VPC Peering. Create VPC Flow Logs on each VPC to capture rejected traffic requests, including the source IPs, that will be delivered to an Amazon CloudWatch Logs group. Set up a CloudWatch Logs subscription that streams the log data to the IT Security account.
VPC peering provides a private, fully isolated route directly between the departmental VPCs and the central application. VPC Flow Logs then records rejected traffic and source IPs for CloudWatch to alert the security team without using a VPN.
Q8. A telecommunications company is planning to host a WordPress website on an Amazon ECS Cluster which uses the Fargate launch type. For security purposes, the database credentials should be provided to the WordPress image by using environmen…
Answer: C. Store the database credentials using the AWS Secrets Manager and then encrypt them using AWS KMS. Create an IAM Role for your Amazon ECS task execution role and reference it with your task definition which allows access to both KMS and AWS Secrets Manager. Within your container definition, specify secrets with the name of the environment variable to set in the container and the full ARN of the Secrets Manager secret which contains the sensitive data, to present to the container.
AWS Secrets Manager directly integrates with ECS task definitions to securely inject credentials as environment variables during task startup. It also natively provides the requested lifecycle management and automated rotation, unlike Systems Manager Parameter Store.
Q9. A government agency has multiple VPCs in various AWS regions across the United States that need to be linked up to an on-premises central office network in Washington, D.C. The central office requires inter-region VPC access over a private…
Answer: D. Utilize AWS Direct Connect Gateway for inter-region VPC access. Create a virtual private gateway in each VPC, then create a private virtual interface for each AWS Direct Connect connection to the Direct Connect gateway.
An AWS Direct Connect gateway easily links a dedicated on-premises connection to multiple regional VPCs via private virtual interfaces. This setup guarantees traffic avoids the public internet while minimizing BGP management overhead across regions.
Q10. A startup is building a web app that lets users post photos of good deeds in their neighborhood with a 143-character caption/article. The developers decided to write the application in ReactJS, a popular javascript framework so that it wou…
Answer: C. Register the web application with a Web Identity Provider such as Google, Facebook, Amazon, or from any other popular social sites and use the AssumeRoleWithWebIdentity API of STS to generate temporary credentials. Create an IAM role for that web provider and set up permissions for the IAM role to allow GET and PUT operations in Amazon S3 and DynamoDB. Serve your web app out of an S3 bucket enabled as a website.
Hosting a React application in Amazon S3 provides a highly scalable and cost-effective static frontend. Using web identity federation to assume an IAM role grants the browser temporary credentials to securely write directly to DynamoDB.
Q11. A print media company has a popular web application hosted on an on-premises network that allows anyone around the globe to search its back catalog and retrieve individual newspaper pages. The company scanned the old newspapers into PNG im…
Answer: A. Create a new Amazon S3 bucket to store and serve the scanned image files using an Amazon CloudFront web distribution. Launch a new AWS Elastic Beanstalk environment to host the website across multiple Availability Zones and set up an Amazon OpenSearch Service for query processing, which the website can use. Use Amazon Textract to detect and recognize text from scanned old newspapers.
Using Amazon S3 with CloudFront and Elastic Beanstalk provides a scalable, highly available web tier. Amazon Textract replaces the expiring optical character recognition software, and OpenSearch handles the full-text search queries. Avoid options that rely on unsupported image searches or migrating the expiring software.
Q12. A multinational financial firm plans to do a multi-regional deployment of its cryptocurrency trading application that is heavily used in the US and in Europe. The containerized application uses Kubernetes and has Amazon DynamoDB Global Tab…
Answer: E. Set up an AWS Global Accelerator, which has several endpoint groups that target specific endpoints and ALBs on the required AWS Regions. Create a public alias record in Amazon Route 53 that points your custom domain name to the DNS name assigned to your accelerator.
AWS Global Accelerator routes traffic to the regional Application Load Balancers over the AWS global network, providing static IPs and high availability. You then create an Amazon Route 53 alias record pointing your apex domain to the accelerator DNS. Remember that Transit Gateway does not route public internet traffic to ALBs.
Q13. A company processes several petabytes of images submitted by users on their photo hosting site every month. Each month, the images are processed in its on-premises data center by a High-Performance Computing (HPC) cluster with a capacity o…
Answer: B. Utilize AWS Batch with Managed Compute Environments to create a fleet using Spot Instances. Store the raw data on an Amazon S3 bucket. Create jobs on AWS Batch Job Queues that will pull objects from the Amazon S3 bucket and temporarily store them to the EC2 EBS volumes for processing. Send the processed images back to another Amazon S3 bucket.
AWS Batch with managed compute environments automatically provisions Spot Instances, dynamically scaling to process thousands of parallel jobs efficiently. Storing raw and processed images in Amazon S3 provides the necessary durability with minimal management overhead. Avoid custom autoscaling setups that require extensive infrastructure maintenance.
Q14. A company needs a deployment solution for its application that is hosted on the AWS cloud. The company has the following requirements for the application: – The instances must have 500GB worth of static dataset that is accessible for the a…
Answer: H. Install OS patches and create a new AMI using AWS Systems Manager. Use this new AMI for the Auto Scaling group of EC2 instances and replace the existing instances. Deploy the new version of the application to the instances using AWS CodeDeploy. Mount an Amazon EFS volume containing the static dataset on the instances upon boot up.
Using AWS Systems Manager to patch instances and create a fresh Amazon Machine Image ensures rapid, compliant deployments within the Auto Scaling group. Mounting an Amazon EFS volume provides shared, immediate access to the large static dataset. Downloading massive datasets from S3 during boot increases startup times and costs.
Q15. An accounting firm hosts a mix of Windows and Linux Amazon EC2 instances in its AWS account. The solutions architect has been tasked with conducting a monthly performance check on all production instances. There are more than 200 On-Demand…
Answer: D. Set up and configure a unified Amazon CloudWatch Logs agent in each On-Demand EC2 instance that will automatically collect and push data to CloudWatch Logs. Analyze the log data with CloudWatch Logs Insights.
The unified CloudWatch agent collects both system metrics and logs from Windows and Linux servers for centralized analysis. CloudWatch Logs Insights then interactively queries this log data to troubleshoot issues effectively. Avoid custom scripts when Systems Manager can deploy the managed agent natively.
More AWS Certified Solutions Architect Professional (SAP-C02) drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.