SAP-C02 practice questions and answers

Correct answer: A — An Amazon SQS FIFO queue with the customer ID as the message group ID

FIFO queues provide exactly-once processing and strict ordering within a message group, so grouping by customer preserves per-customer order while allowing parallelism across customers. Standard queues are at-least-once and unordered, standard SNS gives no ordering guarantee, and a scheduled rule is a timer rather than an ordered pipeline.

Correct answer: A — Store files in S3, trigger processing with S3 event notifications into SQS and a container or Lambda consumer

S3 with event notifications turns file arrival into an event, and a queue plus a serverless or container consumer gives durable, scalable processing without polling code. Both polling options carry the legacy pattern forward, and email is not a file processing pipeline.

Correct answer: A — Attach the function to private subnets and route outbound traffic through a NAT gateway

A VPC-attached Lambda has no public IP, so internet access must come from a NAT gateway reachable from the private subnets it uses. Placing the function in public subnets does not give it a public address, Lambda functions cannot be assigned Elastic IPs, and exposing the database publicly is unacceptable.

Correct answer: A — Introduce write sharding by appending a suffix to the hot partition key, and cache hot reads with DAX

Throttling on a few keys is a hot partition problem, so spreading writes across suffixed keys and absorbing hot reads in DAX fixes the distribution rather than the total. More capacity does not help a single partition's limits, an LSI shares the same partition key, and point-in-time recovery is a backup feature.

Correct answer: A — AWS Step Functions with a standard workflow

Standard workflows in Step Functions run up to a year, model branching and retries declaratively, support callback patterns for human approval, and record every state transition. A single Lambda is bounded by its 15 minute limit, a cron job carries no orchestration semantics, and a queue alone provides no workflow state.

Correct answer: A — AWS Mainframe Modernization with the replatform runtime

AWS Mainframe Modernization provides managed runtimes that let recompiled COBOL applications run on AWS, which is the replatform route off the mainframe. Application Migration Service targets x86 servers, DMS moves databases rather than application logic, and Dedicated Hosts are ordinary EC2 capacity with licensing controls.

Correct answer: A, B — Refactor · Replatform

Refactoring rearchitects the application and replatforming makes targeted changes such as swapping to a managed database, so both touch the workload. Rehosting moves it unchanged, retaining leaves it where it is, and retiring decommissions it.

Correct answer: A — Add gateway VPC endpoints for S3 and DynamoDB and route that traffic through them

Gateway endpoints for S3 and DynamoDB carry no hourly or per-gigabyte charge, so moving that traffic off the NAT gateway cuts both data processing and transfer cost. A second NAT gateway adds cost, public subnets weaken the security posture, and Flow Logs add expense without changing traffic paths.

Correct answer: A, B — Restrict the cache key to only the query strings that affect the response · Set appropriate Cache-Control max-age headers at the origin or via a cache policy

A narrower cache key means more requests collapse onto the same cached object, and explicit cache lifetimes let CloudFront keep objects instead of revalidating constantly. Forwarding everything fragments the cache further, compression settings do not change hit ratio, and price class only limits which edge locations are used.

Correct answer: A — AWS PrivateLink with an endpoint service fronted by a Network Load Balancer

PrivateLink exposes exactly one service through an interface endpoint in the consumer VPC, with no route between the networks and no overlapping CIDR concerns. Peering joins whole networks, an internet-facing balancer contradicts the private requirement, and NAT provides outbound internet access.

Correct answer: A — Amazon EventBridge with one rule per consumer and content-based event patterns

EventBridge routes one event to many targets, and each rule carries its own pattern filter, retry policy, and dead-letter queue, so consumers stay independent. A single queue makes consumers compete for the same messages, sequential invocation couples their failure modes, and a load balancer distributes rather than duplicates requests.

Correct answer: A — AWS Global Accelerator

Global Accelerator provides static anycast IPs, moves traffic onto the AWS backbone at the nearest edge, and shifts traffic between Regions within seconds on health check failure. CloudFront is optimised for cacheable content, DNS-based routing is bounded by TTL and resolver caching, and a single-Region balancer offers no global failover.

Correct answer: A — A service mesh such as AWS App Mesh or ECS Service Connect providing mTLS at the proxy layer

A sidecar proxy terminates and originates mutual TLS on behalf of the application, so encryption and identity are added without touching service code. Security groups control reachability without encrypting, NAT gateways handle outbound internet traffic, and S3 encryption applies to object storage.

Correct answer: A — Put Amazon RDS Proxy between Lambda and the database to pool and reuse connections

RDS Proxy multiplexes many short-lived Lambda connections onto a small pool of database connections, which is the designed fix for serverless connection storms. Raising max_connections consumes memory and postpones the problem, a larger instance treats a design issue with hardware, and replicas cannot accept writes.

Correct answer: A — AWS Batch on Spot Instances with a managed compute environment

Interruption-tolerant, parallelisable batch work is the textbook Spot use case, and AWS Batch handles queueing, retry, and capacity for it. Idle On-Demand capacity and year-long Dedicated Hosts are far more expensive, and serial processing on one instance wastes wall-clock time and money.

Correct answer: A — Presigned URLs with multipart upload, optionally with S3 Transfer Acceleration

Presigned URLs let the browser upload directly with scoped, time-limited permission, multipart upload is required for very large objects, and Transfer Acceleration improves long-distance throughput. Proxying through instances or API Gateway adds cost and hits payload limits, and anonymous write on a public bucket is a serious security defect.

Correct answer: A — Introduce RDS Proxy and have the application connect through the proxy endpoint

RDS Proxy pools and reuses database connections so a burst of application instances does not translate into a burst of database connections. Replicas cannot take writes, backup retention is unrelated to connections, and disabling Performance Insights removes visibility without changing connection behaviour.

Correct answer: A — Enable EC2 Auto Recovery or use an Auto Scaling group of one across zones with EBS-backed data on a separate volume

Auto Recovery replaces impaired hardware while preserving the instance identity and EBS data, and a single-instance Auto Scaling group provides replacement when the zone allows it. Twelve-hourly snapshots imply a long RPO and manual work, instance store loses data on failure, and disabling monitoring removes the signal that triggers recovery.

Correct answer: A — AWS Storage Gateway in File Gateway mode

File Gateway presents an NFS or SMB share on premises, caches hot data locally, and stores objects durably in S3. EFS is not intended to be mounted over the public internet for this pattern, Transfer Acceleration speeds transfers without caching, and an AWS-only FSx file system does not provide the local cache.

Correct answer: A — Amazon API Gateway with Lambda integration and appropriate concurrency settings

API Gateway and Lambda scale on demand and bill per request and per millisecond, so idle periods cost nothing. Fleets sized for peak pay continuously, a single instance cannot absorb that spike, and a fixed task count does not scale with load.

Correct answer: A — Set an aggressive downstream timeout with retries and jittered backoff, and return a degraded response when the dependency is unavailable

Failing fast with bounded retries and jitter, plus a graceful degradation path, keeps user-visible latency predictable when a dependency misbehaves. Longer timeouts make the bad experience worse, removing retries discards recoverable transient failures, and more instances do not shorten a slow downstream call.

Correct answer: A, B — Cell-based architecture that partitions tenants across independent stacks · Bulkheads and per-tenant throttling so one tenant cannot exhaust shared capacity

Cells isolate failures to a subset of tenants, and per-tenant limits stop a noisy neighbour consuming shared capacity. A single unpartitioned database and one unreserved function are shared fate designs, and disabling retries harms recoverability without containing blast radius.

Correct answer: A — Amazon DynamoDB with on-demand capacity

DynamoDB delivers consistent single-digit millisecond latency at any scale and on-demand mode removes capacity planning entirely. RDS requires instance sizing, Redshift is a data warehouse for analytics, and Neptune is a graph database for relationship queries.

Correct answer: A — Amazon Aurora Global Database

Aurora Global Database replicates at the storage layer with typical cross-Region lag under a second and supports secondary Regions serving reads. RDS cross-Region replicas use logical replication with higher and less predictable lag, DynamoDB global tables are not relational, and ElastiCache is a cache rather than a system of record.

Correct answer: A — Circuit breaker with timeouts and bounded concurrency for downstream calls

Timeouts, bounded concurrency, and a circuit breaker stop a slow dependency consuming the caller's resources and let it fail fast or degrade gracefully. Unbounded retries amplify the incident, synchronous chaining propagates the delay, and a bigger instance only postpones exhaustion.

Correct answer: A — S3 event notification to SQS, with idempotent processing keyed on the object version and a dead-letter queue

Delivery is at-least-once, so the durable answer is a queue for buffering and retry plus idempotent handling so a duplicate delivery is harmless, with a dead-letter queue for poison messages. Direct invocation with no error handling loses events, list polling is expensive and slow, and Transfer Acceleration is unrelated.

Correct answer: A — Route 53 Resolver inbound and outbound endpoints with forwarding rules

An inbound endpoint lets on-premises resolvers query AWS private zones and an outbound endpoint with rules forwards AWS queries to on-premises DNS, giving resolution in both directions. Public zones expose names to the internet, NAT gateways do not perform DNS forwarding, and CloudFront is a content delivery service.

Correct answer: A — A cross-account IAM role in each member account with a read-only policy, trusted by the security account and assumed on demand

Role assumption gives short-lived credentials scoped to a read-only policy and leaves nothing standing in the member accounts. Long-lived user keys spread secrets, root credentials are the highest-risk credential in an account, and blanket full access on every resource contradicts the read-only requirement.

Correct answer: A — AWS Directory Service AD Connector or a two-way trust with AWS Managed Microsoft AD

AD Connector proxies authentication to the existing directory and a trust with AWS Managed Microsoft AD gives a local directory in-Region while preserving on-premises identity, both of which keep one source of truth. Recreating users in IAM or Cognito duplicates the directory, and local password files are unmanageable and insecure.

Correct answer: A, B — Right-size to smaller instance types based on Compute Optimizer recommendations · Purchase Compute Savings Plans covering the steady baseline

Right-sizing removes waste and a Savings Plan discounts the steady baseline that remains, and the two compose well. Moving a steady production fleet entirely to Spot risks interruption, deleting the Auto Scaling group removes resilience, and detailed monitoring adds cost rather than reducing it.

Correct answer: A — Run controlled fault injection experiments with AWS Fault Injection Service against a defined steady state

Fault injection experiments deliberately create the failure under controlled conditions and measure whether the steady state holds, which is the only option that produces evidence. Diagram reviews and assumptions are not tests, and disabling health checks degrades the system rather than testing it.

Correct answer: A — A Transit Gateway per Region with inter-Region peering and a Direct Connect gateway association

Transit Gateways give a hub-and-spoke routing domain per Region, peer to each other across Regions, and attach to a Direct Connect gateway for on-premises reachability, so each VPC is configured once. Full mesh peering and full mesh VPN both scale quadratically and peering is not transitive, while NAT gateways send traffic over the internet rather than providing private routing.

Correct answer: A — Move to io2 Block Express or raise provisioned IOPS to match the workload

A sustained queue with IOPS pinned at the ceiling is a storage throughput limit, so raising provisioned IOPS or moving to a higher-performance volume type is the direct fix. More memory does not raise the IOPS cap, encryption is orthogonal, and shrinking the block size typically increases the number of operations required.

Correct answer: A — Deliver logs to an S3 bucket in a dedicated log archive account with Object Lock and a restrictive bucket policy

A separate log archive account removes the source account's ability to tamper, and Object Lock makes the objects immutable for the retention period. Logs kept locally can be deleted by the account, email summaries are not an archive, and DynamoDB is a poor fit for bulk log retention.

Correct answer: A, B — A hard data centre exit deadline that leaves no time for rearchitecting · The application is a vendor package that cannot be modified

Rehosting suits deadline pressure and unmodifiable third-party software, where changing the application is either impossible or too slow. An already serverless application needs no rehost, maximising cloud-native benefit argues for refactoring, and something being retired shortly argues for retiring rather than migrating it.

Correct answer: A — Run a test cutover into an isolated environment and replay representative traffic before the production cutover

A rehearsal in an isolated environment with realistic traffic surfaces integration and performance problems while rollback is still trivial. Cutting over blind, checking only boot status, or trusting a tool's exit code all defer discovery to production.

Correct answer: A — Amazon FSx for Lustre

FSx for Lustre is purpose-built for HPC with sub-millisecond latency and very high throughput, and it can link to S3 for data staging. Mountpoint exposes S3 with object semantics rather than full POSIX, EFS latency is higher, and EBS is block storage attached to individual instances.

Correct answer: A — A service control policy denying actions outside the approved Region using the aws:RequestedRegion condition

The aws:RequestedRegion condition in an SCP blocks API calls to unapproved Regions for every principal in the affected accounts. An alarm detects rather than prevents, a single IAM policy governs one identity, and cross-Region replication actively moves data out, which is the opposite of the requirement.

Correct answer: A — Configure an IAM OIDC identity provider for the CI system and assume a role with web identity

An OIDC trust lets the CI job exchange its workload identity token for short-lived AWS credentials, so no secret ever exists to leak. Rotation, encrypted storage in the repo, and IP restrictions all still depend on a long-lived key existing somewhere.

Correct answer: A — The strangler fig pattern, routing selected paths to new services behind the existing entry point

The strangler fig pattern peels functionality off behind a routing layer so each increment ships and can be reverted independently. A full rewrite carries enormous risk, containerising alone changes packaging rather than architecture, and splitting the data layer first usually breaks transactional assumptions the application still relies on.

Correct answer: A — Federate the identity provider into AWS IAM Identity Center and assign permission sets to accounts

IAM Identity Center federates the corporate directory once and grants access to accounts through permission sets that map to roles, avoiding per-employee IAM users entirely. Per-user IAM identities duplicate the directory, shared keys destroy attribution, and the root user must never be used for routine work.

Correct answer: A, B — Request latency stays within the target during scale-out events · Average target utilisation tracks close to the configured target without oscillation

A well-tuned policy holds latency during scaling and keeps utilisation near target without flapping between scale-out and scale-in. Security group counts, stack counts, and AMI size say nothing about scaling behaviour.

Correct answer: A — Amazon CloudWatch Synthetics canaries

Synthetics canaries run scripted browser or API checks on a schedule from outside the application and alarm on failure or latency regression. Config evaluates resource configuration, Inspector scans for vulnerabilities, and Trusted Advisor provides account-level best-practice checks.

Correct answer: A — AWS DataSync

DataSync provides scheduled, verified, throttled transfers between on-premises storage and AWS storage services with a managed agent. A CLI cron job lacks verification and scheduling features, Transfer Family exposes SFTP and FTPS endpoints for external partners, and Glue is an ETL service.

Correct answer: A — AWS Snowball Edge devices shipped to AWS

At 500 Mbps shared with production, 300 TB would take months, so physical transfer with Snowball Edge is the only option that meets the deadline. DataSync, Transfer Acceleration, and VPN all remain bound by the same constrained link.

Correct answer: A — Amazon Athena with a Glue Data Catalog table

Athena is serverless, queries S3 data in place through the Glue Data Catalog, and charges by bytes scanned, which partitioned Parquet minimises. RDS is not designed for petabyte-scale object storage scans, a continuously running EMR cluster contradicts the pay-per-query requirement, and DynamoDB is a key-value store rather than an ad hoc SQL engine.

Correct answer: A — A lifecycle rule transitioning objects to S3 Standard-Infrequent Access after 30 days

Standard-IA lowers storage price while keeping millisecond retrieval, which matches rarely read but instantly retrievable. Deep Archive retrieval takes hours, deletion loses the data, and Transfer Acceleration increases cost rather than reducing it.

Correct answer: A — Amazon ECS with AWS Fargate

Fargate runs containers without any instances to size, patch, or scale, and tasks can drop to zero when idle. Both fixed EC2 capacity and self-managed node groups require capacity management, and Dedicated Hosts are for licensing and isolation requirements.

Correct answer: A, B — A hard security and blast radius boundary that IAM alone does not provide · Independent service quotas and clearer cost attribution

Account separation gives the strongest isolation boundary AWS offers and gives each workload its own quotas and billing view. It does not change API latency, it does not replicate data, and IAM policies remain necessary inside every account.

Correct answer: A, B — Add read replicas and direct read-only traffic to them · Introduce a caching layer such as ElastiCache in front of hot queries

Replicas add read capacity and a cache removes repeated identical queries from the database entirely, which are the two standard levers for read-heavy load. Raising write concurrency addresses a different bottleneck, disabling backups risks data loss, and secret storage is a security practice with no performance effect.

Correct answer: A — A JWT authorizer validating the OIDC token and checking scopes per route

HTTP APIs support native JWT authorizers that validate the issuer and audience and enforce required scopes on each route. API keys identify callers for usage plans rather than authorising users, browser-side SigV4 requires distributing AWS credentials, and security groups do not apply to a regional API Gateway endpoint.

Correct answer: A — Associate the private hosted zone with the VPCs across accounts, or use Route 53 Profiles to share DNS configuration centrally

A private hosted zone can be associated with VPCs in other accounts, and Route 53 Profiles distribute DNS configuration across many VPCs and accounts from one place. Duplicated zones drift, hosts files are unmanageable at fleet scale, and publishing internal names publicly leaks information.

Correct answer: A — Activate cost allocation tags for an application tag and analyse in Cost Explorer or the Cost and Usage Report

Activated cost allocation tags let Cost Explorer and the Cost and Usage Report group spend by application regardless of which account the resources live in. Manual review does not scale, splitting organisations is a drastic structural change, and billing alarms only threshold total spend.

Correct answer: A — AWS Config rules with automatic remediation, deployed organisation-wide through a conformance pack

Config conformance packs deploy the rules everywhere and remediation actions close the finding automatically, giving continuous enforcement. Quarterly audits, reminders, and dashboards observe the problem without fixing it.

Correct answer: A — AWS Outposts

Outposts places AWS-managed racks in the customer's own facility so the same APIs and services run on premises. Local Zones and Wavelength are AWS-operated locations near metros and mobile networks rather than in the customer data centre, and CloudFront caches content at edge locations.

Correct answer: A — Move to incremental processing with partitioned data and job bookmarks so only new or changed partitions are processed

Processing only what changed decouples runtime from total dataset size, which is the only change here that scales as data grows. Bigger clusters and earlier start times buy time without addressing growth, and output compression does not reduce input scanned.

Correct answer: A — Amazon Quantum Ledger Database

QLDB maintains an append-only journal with a cryptographic hash chain so any change to history is detectable. Audit triggers and streams record changes but can be altered or bypassed by a privileged user, and Redshift is an analytics warehouse.

Correct answer: A — A bucket policy in B allowing the role in A, an IAM policy in A allowing the S3 and KMS actions, and a KMS key policy in B allowing the role in A

Cross-account access requires an allow on both sides, and because the objects are encrypted with a customer managed key the key policy must also permit the calling role to generate and use data keys. Either policy alone is insufficient, and making the bucket public is an unacceptable workaround.

Correct answer: A — AWS Porting Assistant for .NET to assess and port to cross-platform .NET running on Linux

Porting Assistant analyses .NET Framework code for incompatible API usage and helps move it to cross-platform .NET so it can run on Linux without Windows licences. License Manager tracks entitlements rather than removing the need for them, Backup protects data, and WorkSpaces delivers virtual desktops.

Correct answer: A — AWS Application Discovery Service

Application Discovery Service collects server inventory, performance data, and network dependencies from the on-premises estate to inform migration planning. Config tracks AWS resources, Inspector scans for vulnerabilities, and Compute Optimizer recommends sizing for resources already in AWS.

Correct answer: A — AWS Schema Conversion Tool for schema and code, then DMS with full load plus change data capture and a short cutover

Heterogeneous migration needs schema and stored code conversion first, then DMS ongoing replication so the target stays current until a brief cutover. A MySQL dump tool does not apply to Oracle, Snowball alone does not convert or replicate, and manual CSV export cannot keep pace with change during the copy.

Correct answer: A — Adopt automated canary deployments with CloudWatch alarms wired to automatic rollback

Canary deployments limit exposure and alarm-triggered automatic rollback removes the human latency that made recovery slow. Manual gates add delay without improving rollback, larger batches increase blast radius, and instance sizing does not affect deployment safety.

Correct answer: A — A CloudFormation StackSet with service-managed permissions and automatic deployment enabled for the target organisational units

Service-managed StackSets with automatic deployment target organisational units and roll the stack out to accounts as they join. Self-managed StackSets need explicit account lists, wiki instructions rely on humans, and a Config rule reports the gap without closing it.

Correct answer: A — Two Direct Connect connections at different locations, with a Site-to-Site VPN as backup

Resilience requires diverse paths, so two connections terminating at different Direct Connect locations remove the single point of failure, with VPN as a lower-bandwidth fallback. One connection is a single failure domain regardless of speed, two tunnels on one circuit share that circuit's fate, and Global Accelerator optimises internet routing rather than providing private capacity.

Correct answer: A — Amazon Kinesis Data Streams

Kinesis Data Streams keeps an ordered, replayable record per shard that many consumer applications can read independently at their own position. SQS deletes messages once consumed and gives no replay, SNS pushes without retention, and Amazon MQ targets existing JMS or AMQP applications rather than high-throughput streaming.

Correct answer: A — Enable distributed tracing with AWS X-Ray and propagate trace IDs across service boundaries

Distributed tracing stitches a single request across services so the slow hop is visible rather than inferred. Verbose logs on one service miss the cross-service picture, an invocation count alarm says nothing about where time goes, and S3 access logs cover a different subsystem.

Correct answer: A — A condition on sts:ExternalId in the role's trust policy

The external ID is designed for exactly this third-party scenario: the partner must pass the agreed value when assuming the role, which defeats the confused deputy problem. Source IP conditions restrict networks rather than identity, you cannot attach an SCP to an account outside your own organisation, and KMS grants delegate key usage rather than role assumption.

Correct answer: A, B — Choose managed serverless services where load is spiky or unpredictable · Right-size and use Graviton-based instances where the workload supports the architecture

Serverless matches spend to spiky demand, and Graviton typically delivers better price performance for compatible workloads. Provisioning for imagined peaks wastes money, long commitments before measurement lock in the wrong baseline, and ignoring storage class lifecycle leaves cold data on the most expensive tier.

Correct answer: A — AWS Resource Access Manager sharing subnets with the organisation

RAM shares VPC subnets across accounts so participants launch resources into a VPC owned and governed centrally. Peering and Transit Gateway connect separate VPCs rather than sharing one, and PrivateLink exposes a specific service endpoint rather than subnet capacity.

Correct answer: A — Invite the existing accounts to join the organisation and move them into the appropriate organisational unit

Existing accounts can be invited into an organisation and then placed in an OU, which brings governance without touching the workloads. Rebuilding everything is unnecessary effort, there is no organisation merge operation, and an account can belong to only one organisation at a time.

Correct answer: A — AWS Application Migration Service

Application Migration Service performs continuous block-level replication of source servers and cuts over with minimal downtime, which is the lift-and-shift path for large VM estates. DMS migrates databases, DataSync moves files, and Snowball Edge is for offline bulk data transfer.

Correct answer: A, B — An SCP never grants permissions; it only sets the maximum available permissions · SCPs do not apply to the organisation management account

SCPs are a permissions ceiling and the management account is exempt from them, which is why workloads should not run there. An SCP can never grant access, IAM policies are still required to allow anything, and SCPs govern principals inside the organisation rather than external ones.

Correct answer: A, B — A service control policy that denies resource creation when a required tag key is absent · A tag policy in AWS Organizations to standardise tag keys and values

SCPs with a condition on aws:RequestTag can block creation outright, and tag policies define and enforce the allowed keys and casing across accounts. Dashboards and email reports only observe, and an IAM group name has no bearing on resource tagging.

Correct answer: A — A service control policy denying the CloudTrail stop and delete actions, attached to the root or the relevant organisational units

An SCP defines the ceiling of permissions for every principal in an account, so a deny there cannot be overridden by any local administrator. Permissions boundaries must be attached to each identity and can be removed by an administrator, a Config rule only detects afterwards, and a bucket policy protects the log destination rather than the trail configuration.

Correct answer: A — IAM Identity Center permission sets with the AWS access portal and CLI integration

IAM Identity Center provides the access portal, maps permission sets to accounts, and issues short-lived credentials that the AWS CLI can consume directly. Stored static keys are the practice being replaced, instance profiles authorise EC2 workloads rather than humans, and Cognito is for application end users.