AWS Certified Solutions Architect — Professional (SAP-C02) practice questions and exam guide

A firm managing 100+ AWS accounts needs uniform guardrails, centralized logging, and enterprise SSO. Which combination BEST meets all three?

1. AWS Organizations with Control Tower guardrails, IAM Identity Center, and a dedicated Log Archive account
2. AWS Organizations with per-account IAM users, individually configured CloudTrail, and local audit logs
3. A single shared AWS account with strict IAM policies, tag-based isolation, and one CloudTrail trail
4. Multiple independent AWS Organizations federated through a shared SAML identity provider

Answer: A — AWS Organizations with Control Tower guardrails, IAM Identity Center, and a dedicated Log Archive account

A) Control Tower provisions Landing Zone guardrails, Identity Center centralizes SSO, and a Log Archive account aggregates CloudTrail. B) Per-account IAM users scale poorly and duplicate logs. C) A single account fails isolation and blast-radius requirements. D) Multiple Organizations fragment billing and governance.

A data platform requires fine-grained cross-account governance over an S3 data lake including row and column controls. Which is BEST?

1. AWS Lake Formation with row-level and column-level permissions on the Glue Data Catalog
2. Amazon S3 bucket policies with prefix-level access lists managed per consumer account
3. AWS IAM identity-based policies on each Athena workgroup listing all allowed columns
4. AWS Glue Data Catalog resource policies alone without any Lake Formation registration

Answer: A — AWS Lake Formation with row-level and column-level permissions on the Glue Data Catalog

A) Lake Formation is AWS's fine-grained lake governance including row/column. B) S3 policies cannot enforce column filtering. C) Athena workgroup policies do not scale to fine-grained governance. D) Bare Glue catalog policies lack row/column controls.

Sandbox accounts must allow arbitrary EC2 launches but stop all provisioning once a $500 monthly spend is breached, automatically. Which is BEST?

1. An SCP that denies ec2:RunInstances unconditionally after 72 hours of account life to bound spend indirectly
2. A daily Lambda function that queries Cost Explorer and revokes Identity Center permission sets per account manually
3. Tag-based billing plus a CloudWatch alarm that emails the developer team when spend exceeds the monthly threshold
4. AWS Budgets with Budget Action attaching a deny IAM policy to all roles on threshold breach plus Cost Anomaly Detection

Answer: D — AWS Budgets with Budget Action attaching a deny IAM policy to all roles on threshold breach plus Cost Anomaly Detection

D) Budget Actions are purpose-built to attach a deny policy on breach. A) Time-based deny does not reflect spend. B) Custom and slow. C) Email alerts are detective-only.

200 analysts need ad-hoc SQL over a 5 PB S3 data lake with cost controls and cross-account data sharing. Which approach is BEST?

1. A dedicated EMR cluster per analyst so query isolation is preserved and cost is attributable to individual users directly
2. Athena with per-team workgroups for cost controls, Glue Catalog as metastore, Lake Formation cross-account sharing, and Parquet partitions
3. Loading the entire 5 PB into Redshift RA3 nodes to give analysts a single warehouse for ad-hoc SQL access
4. Federated queries routing every analyst SQL statement to an RDS PostgreSQL instance holding the entire data lake

Answer: B — Athena with per-team workgroups for cost controls, Glue Catalog as metastore, Lake Formation cross-account sharing, and Parquet partitions

B) Athena + Lake Formation + Glue + Parquet is the canonical serverless lakehouse pattern with workgroup cost controls. A) A cluster per analyst is wildly expensive. C) 5 PB into Redshift is overkill for ad-hoc. D) Postgres cannot hold 5 PB.

Every S3 bucket in 100 accounts must have BPA enabled, default KMS encryption, and access logging with drift auto-remediation. Which is BEST?

1. Config conformance pack with S3 best-practice rules deployed Org-wide plus account BPA plus SSM Automation remediation
2. IAM permission boundaries on every user with bucket-administration permissions across every account in the Org
3. A quarterly manual audit of each account's S3 buckets with remediation performed by the account owner as needed
4. An SCP denying s3:PutBucketPolicy Org-wide to prevent misconfiguration of the S3 buckets across the Organization

Answer: A — Config conformance pack with S3 best-practice rules deployed Org-wide plus account BPA plus SSM Automation remediation

A) Config conformance pack + BPA + SSM remediation is the AWS-prescriptive S3 governance stack. B) Boundaries don't cover encryption/logging. C) Quarterly misses drift. D) Denying PutBucketPolicy is over-broad.

An IoT platform ingests 200000 msgs/s with sub-200 ms anomaly-detection and batch analytics. Which architecture is BEST?

1. IoT Core → SQS → Lambda handling both real-time anomaly detection and batch loads into a shared analytics warehouse
2. IoT Core → Kinesis Data Streams → Managed Service for Apache Flink for anomaly detection, plus Firehose to S3/Redshift
3. API Gateway + Lambda ingest with DynamoDB state and a nightly export to Redshift for the analytics workload
4. MQTT through an NLB-fronted EC2 fleet running a custom broker with Glue jobs reading EBS snapshots for analytics

Answer: B — IoT Core → Kinesis Data Streams → Managed Service for Apache Flink for anomaly detection, plus Firehose to S3/Redshift

B) IoT Core + Kinesis + Flink + Firehose is the canonical IoT real-time + batch stack. A) SQS is not stream-analytics; sub-200ms is unlikely. C) API GW lacks MQTT. D) Custom broker is heavy ops.

A microservices platform needs distributed tracing, correlated logs, and per-service metrics with minimal code changes. Which combination is BEST?

1. Application-level printf logs written to local instance disks and inspected via SSH
2. A single CloudWatch alarm per service that emails engineers whenever it breaches
3. Amazon S3 access logs alone as the tracing and metrics source across every service
4. AWS X-Ray for tracing with CloudWatch Logs Insights and metrics via Container Insights

Answer: D — AWS X-Ray for tracing with CloudWatch Logs Insights and metrics via Container Insights

D) X-Ray + Logs Insights + Container Insights is the AWS observability stack. A) Local logs do not correlate across services. B) One alarm per service is not tracing or metrics. C) S3 access logs cover S3 only.

Blue/Green deployment on AWS is BEST characterized as:

1. Rolling in-place updates across each instance one at a time without a parallel environment
2. Deploying new versions to a small percentage of traffic and increasing gradually over hours
3. Running two production-like environments and shifting traffic to the new one after tests
4. Redeploying only during scheduled maintenance windows without traffic-shifting capability

Answer: C — Running two production-like environments and shifting traffic to the new one after tests

C) Blue/Green runs a parallel environment then shifts traffic. A) That is rolling deployment. B) That is canary. D) That describes a maintenance-window approach, not blue/green.

RTO must drop from 8 h to 1 h and RPO from 24 h to 5 min for a Single-Region RDS+EC2 app at reasonable cost. Which DR strategy is BEST?

1. Pilot light in a second Region with cross-Region Aurora/RDS replica, pre-baked AMIs, and Route 53 health-check failover automation
2. Backup and restore in a second Region using nightly RDS snapshots and rebuilding EC2 from an untested Terraform template on demand
3. Multi-site active-active across four Regions with global traffic manager and continuous cross-Region write replication for consistency
4. Add a second AZ to the same Region and rely on Multi-AZ RDS with Auto Scaling groups as the sole recovery strategy for the app

Answer: A — Pilot light in a second Region with cross-Region Aurora/RDS replica, pre-baked AMIs, and Route 53 health-check failover automation

A) Pilot light hits 1-hr RTO / 5-min RPO at moderate cost. B) Backup/restore is hours RTO. C) Active/active is over-budget. D) Same-Region does not survive Regional failure.

AWS Storage Gateway is BEST described as:

1. A CDN with edge caches, signed URLs, and Lambda@Edge for programmable request handling
2. A hybrid service exposing File, Volume, and Tape gateways backed by S3 and Glacier
3. A managed elastic block-storage service providing volumes attached to EC2 instances
4. A network attached storage service providing NFS filesystems within a single VPC

Answer: B — A hybrid service exposing File, Volume, and Tape gateways backed by S3 and Glacier

B) Storage Gateway provides File/Volume/Tape hybrid gateways. A) That is CloudFront. C) That is EBS. D) That is EFS.

A stateful PHP app with session affinity must move to AWS and incrementally modernize. Which sequence is BEST?

1. Drop session affinity immediately on cutover and accept the temporary user-visible breakage during the migration wave
2. Migrate directly to AWS Lambda for every request handler before externalizing session state to any shared cache tier
3. Lift-and-shift to EC2 behind ALB with sticky sessions, externalize sessions to ElastiCache Redis, then move to Fargate
4. Use an NLB without an ALB so cookie-based HTTP sticky sessions no longer factor into the load-balancing configuration

Answer: C — Lift-and-shift to EC2 behind ALB with sticky sessions, externalize sessions to ElastiCache Redis, then move to Fargate

C) Lift-shift with sticky → externalize to Redis → Fargate is canonical incremental modernization for stateful PHP. A) Breaks users. B) Skips externalization. D) NLB uses IP stickiness, not cookies.

A team is migrating Oracle to Aurora PostgreSQL with a target cutover window of under one hour. Which combination is BEST?

1. AWS Schema Conversion Tool for schema plus AWS DMS full-load and change data capture
2. Full mysqldump export followed by manual reload during a scheduled maintenance window
3. AWS DataSync configured to copy the Oracle datafiles directly into an Aurora storage volume
4. Snowball Edge devices shipped to AWS containing the full Oracle backup for one-time import

Answer: A — AWS Schema Conversion Tool for schema plus AWS DMS full-load and change data capture

A) SCT converts heterogeneous schema; DMS full-load + CDC minimizes downtime. B) Long dump/restore misses the window. C) DataSync does not migrate live database engines. D) Snowball offline transfer alone does not deliver CDC.

AWS Distro for OpenTelemetry (ADOT)?

Open-source telemetry collector. Sends to X-Ray, CloudWatch, others.

Storage Gateway?

Hybrid storage. File, Volume, Tape Gateway. On-prem accesses S3/Glacier.

AWS SAP-C02 exam structure?

75 questions, 180 minutes, $300. Pass at 750/1000.

Amazon Timestream?

Managed time-series database. IoT, logs, telemetry.

EC2 Spot interrupted handling?

2-min warning. Drain connections, save state. Use SQS for work-queue.

Site-to-Site VPN?

IPsec tunnel between on-prem and VPC. Cheaper than DX, less reliable.