AWS Solutions Architect Professional (SAP-C02) Exam Review

Comprehensive practice flashcards covering complex multi-account governance, hybrid networking, disaster recovery, security, database scaling, and serverless architectures from the AWS Certified Solutions Architect - Professional (SAP-C02) course material.

How can an enterprise design a network architecture that allows thousands of AWS accounts to autonomously manage route tables while enforcing centralized and controlled outbound internet traffic?

Deploy a shared AWS Transit Gateway to which each account VPC attaches, and route outbound internet traffic through a centralized egress VPC hosting a fleet of VPN-attached firewall appliances.

For a legacy application with an average processing time of $90\text{ seconds}$ and strict client timeout requirements of under $10\text{ seconds}$, which architecture improves availability and durability while minimizing costs?

Expose an Amazon API Gateway REST API using a service proxy to enqueue requests into an Amazon SQS queue, and deploy worker code on smaller Amazon EC2 instances within an Auto Scaling group that scales dynamically based on SQS queue depth.

How can a three-tier application (web, application, Amazon RDS for MySQL) achieve cross-Region disaster recovery with an RPO of $5\text{ minutes}$ without lengthy database restore delays?

Use Amazon EC2 Image Builder to pre-replicate application AMIs to the DR Region, establish a cross-Region read replica of the RDS DB instance, and promote the read replica to master while deploying compute stacks via AWS CloudFormation during a disaster.

What solution enables an on-premises data center connected via AWS Direct Connect (DX) to privately expose a sensitive TCP service to other AWS accounts without traversing the public internet?

Create an AWS PrivateLink VPC Endpoint Service that accepts TCP traffic, host it behind a Network Load Balancer (NLB), and make the service available over the Direct Connect connection.

How can a solutions architect remediate unencrypted data at rest in an existing Amazon RDS for MySQL DB instance and resolve unrotated credentials in an AWS Lambda function?

Configure the Lambda function to retrieve database credentials from AWS Secrets Manager with automatic rotation enabled; take a snapshot of the existing RDS DB instance, encrypt a copy of the snapshot, and restore a new encrypted DB instance from that snapshot.

What is the recommended design to securely allow hundreds of application VPCs across multiple accounts to access a centralized Amazon S3 data lake privately with least privilege?

Create S3 access points for each application in the bucket owner account restricted to the application's VPC (enforcing access points in the bucket policy), and create an S3 gateway endpoint in each application's VPC configured with an endpoint policy allowing access to the S3 access point.

Why does an Amazon RDS for MySQL DB instance with General Purpose SSD ($\text{gp2}$) storage suddenly encounter high query latency during traffic spikes despite CPU, memory, and disk space being under $50\%$ utilization?

The DB instance exhausted its initial I/O credit balance ($5.4\text{ million credits}$) due to low initial provisioned disk storage ($100\text{ GB}$), throttling throughput down to the baseline rate of $3\text{ IOPS/GB}$.

How can multiple business unit VPCs with overlapping CIDR blocks connect privately to a central application hosted behind a Network Load Balancer in a shared VPC?

Configure an AWS PrivateLink VPC endpoint service on the centralized NLB with endpoint acceptance required, and create interface VPC endpoints in each business unit VPC.

What steps remediate an 'Error 403: Access Denied' message when Amazon CloudFront attempts to serve website content from an Amazon S3 website endpoint origin?

Remove the S3 Block Public Access settings from the S3 bucket and disable the Requester Pays configuration on the bucket.

How can production and development VPC traffic attached to a central AWS Transit Gateway be completely isolated from each other?

Create separate transit gateway route tables for production and development traffic, remove all attachments from the default route table, and associate/propagate development VPCs and production VPCs strictly to their respective dedicated route tables.

How can a company eliminate a single point of failure on an AWS Direct Connect connection terminating at a Direct Connect gateway carrying IPSec traffic?

Create an AWS Transit Gateway, attach the application VPCs to the transit gateway, connect the transit gateway to the Direct Connect gateway, and establish an AWS Site-to-Site VPN connection terminating directly at the transit gateway.

When deploying this Service Control Policy (SCP) to an OU to restrict developer access to Amazon EC2, Amazon DynamoDB, and Amazon S3, why can IAM users in the member accounts still access other services?

The default AWS-managed FullAWSAccess SCP is still attached to the OU or account; to implement an allowlist model, FullAWSAccess must be detached so that non-listed actions are implicitly denied.

When implementing client-side encryption for objects uploaded to Amazon S3 using an AWS KMS customer master key, which action is missing from this IAM policy if PutObject attempts fail with an access forbidden error?

The kms:GenerateDataKey permission must be added to allow the client to generate data encryption keys for new object encryption.

What is the most operationally efficient KMS encryption approach for a centralized S3 log repository collecting encrypted logs from multiple business unit accounts that must be rotated every $365\text{ days}$?

Create a customer-managed KMS key in the central logging account, configure the key policy to grant cross-account access to the member accounts, and enable automatic key rotation.

How can an application mitigate database connection exhaustion caused by bursts of AWS Lambda invocations connecting to an Amazon RDS or Aurora database?

Deploy Amazon RDS Proxy in front of the database to maintain and pool persistent database connections across Lambda executions.

How can direct internet traffic to an Application Load Balancer (ALB) be prevented when the application must be accessed exclusively through an Amazon CloudFront distribution?

Configure CloudFront to inject a secret custom HTTP header on origin requests, and associate an AWS WAF web ACL (or ALB listener rule) with the ALB to deny any request lacking the custom header.

What database architecture reduces failover outage time from $40\text{ seconds}$ to less than $20\text{ seconds}$ for a relational database application?

Migrate the database to an Amazon Aurora MySQL DB cluster with an Aurora Replica and deploy Amazon RDS Proxy in front of the cluster.

What CloudFormation stack policy statement must be added to this configuration to prevent developers from accidentally deleting or replacing Amazon RDS DB instances during stack updates?

Add a second statement specifying "Effect": "Deny", "Action": ["Update:Delete", "Update:Replace"] for all logical RDS database resources.

What architecture provides high availability and cross-Region routing between two on-premises Direct Connect locations and multiple VPCs across two AWS Regions (eu-west-1 and us-east-1)?

Create transit VIFs from each Direct Connect connection into a single Direct Connect gateway, associate both regional transit gateways with that Direct Connect gateway, and peer the two transit gateways together.

How can a company enforce that engineers must use Multi-Factor Authentication (MFA) when executing AWS CLI commands against an Amazon S3 bucket?

Attach an IAM policy to the group denying S3 actions unless aws:MultiFactorAuthPresent evaluates to true, and instruct engineers to use aws sts get-session-token with their MFA device to obtain temporary session credentials.

What is the recommended architecture to implement centralized rule-based egress inspection for all outbound internet traffic from hundreds of VPCs across Availability Zones?

Create a centralized inspection VPC with an AWS Network Firewall or Gateway Load Balancer (GWLB), forward egress traffic from workload VPCs through an AWS Transit Gateway with appliance mode enabled, and direct routes through the firewall endpoints.

How can a multi-tenant SaaS application on AWS Lambda and Amazon DynamoDB allocate DynamoDB costs to individual tenants with the least operational overhead?

Configure the Lambda functions to log tenant IDs along with consumed RCUs and WCUs to Amazon CloudWatch Logs, and run a scheduled Lambda function to calculate per-tenant costs using the logged metrics and the AWS Cost Explorer API.

How should a CI/CD pipeline on GitHub Actions authenticate to AWS to deploy resources without using long-lived IAM access keys?

Configure an IAM OpenID Connect (OIDC) identity provider for GitHub Actions in AWS IAM, create an IAM role with a trust policy allowing sts:AssumeRoleWithWebIdentity from the GitHub repository, and update the workflow to assume this role.

How can a multinational company enforce that European Union (EU) customer content is processed and stored exclusively within EU AWS Regions?

Deploy independent EU and non-EU processing stacks using Amazon Route 53 geolocation routing, store data solely in EU Regional services (such as Amazon S3 and DynamoDB), and apply AWS Organizations SCPs to deny infrastructure and service deployment outside approved EU Regions.

For a highly regulated banking application, how can an organization enforce data residency to approved Regions while retaining control of the cryptographic root of trust in on-premises HSMs?

Use an AWS KMS External Key Store (XKS) backed by in-country on-premises HSMs for all encryption operations, and enforce an AWS Control Tower Region deny control across member OUs.

When deploying an autonomous AI agent on Amazon Bedrock AgentCore Runtime that accesses downstream services without user interaction, how should authentication and auditing be configured?

Register the agent as a workload identity in an Amazon Bedrock AgentCore Identity directory, configure resource credential providers using the OAuth 2.0 client credentials grant flow, and allow downstream services and audit systems to verify the agent's dedicated identity.