Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 19

Question 180

A company wants storage-wide visibility into S3 object distribution, age and activity across dozens of accounts, rather than merely seeing S3 dollars in the billing console. The analytics team needs aggregation to identify excessive incomplete multipart uploads and unused storage classes. Which visibility service fits?

Use S3 Inventory reports for individual bucket object metadata but assume they also provide an organization-wide summarized incomplete multipart storage dashboard by themselves.
Inspect only AWS Cost Explorer S3 charges without storage-class, object-age and incomplete-multipart-uploads metrics across all buckets.
Use S3 Storage Lens with the appropriate organization/dashboard scope and selected metrics or exports.
Use only CloudTrail Event History, assuming it reports every bucket size and incomplete multipart upload trend by object age.

Explanation

Correct Answer

Storage Lens aggregates object storage usage and activity metrics to identify storage efficiency opportunities beyond raw billing totals.

Incorrect Answers

S3 Inventory can catalog specified object metadata but is not the combined cross-account Storage Lens metrics and activity analysis requested.

Cost totals are not the storage-specific object composition and trends that Storage Lens is designed to summarize.

API event history is not a purpose-built organization-wide storage analytics dataset.

Question 181

A business allocates charges to different product departments using AWS Cost Categories, but several costs cannot be matched to an activated resource tag or exact account. Finance wants a transparent policy for shared overhead rather than assigning it randomly. What should be implemented?

Apply new Cost Category tagging rules only for directly attributed accounts but omit split charge rules for Shared-Platform allocations.
Charge all shared costs to a common payer Cost Category and exclude them permanently from product reporting.
Distribute the shared expenses equally between departments without modeling the approved proportional allocation.
Define deliberate Cost Category rules and supported split charge rules for shared expenses, and reconcile unmatched costs in the CUR.

Explanation

Correct Answer

Rule-driven allocation helps finance apportion shared costs consistently while maintaining visibility into categories that remain unallocated.

Incorrect Answers

Direct rule assignment does not allocate shared overhead across product targets according to a documented split.

A shared bucket of costs avoids inaccurate attribution but does not satisfy the requested transparent product-level overhead allocation.

An arbitrary equal split is not the documented business allocation rule for departments with different cost drivers.

Question 182

An organization needs to forecast the monthly impact of growing AWS data transfer charges and alert the network engineering team before spending exceeds a realistic budget. The team has invoice details and planned traffic growth figures. Which reporting workflow fits?

Rely only on a once-a-year total cloud bill and assume it detects monthly inter-AZ data transfer spikes promptly.
Use VPC Flow Logs alone to estimate future data transfer spend without incorporating service-specific billed GB rates or budgets.
Configure CloudWatch alarms for instance network bytes only and assume they represent all regional data transfer billed line items.
Model data transfer usage and cost forecasts from CUR or Cost Explorer with AWS Budgets alerts, then validate the actual network paths against that baseline.

Explanation

Correct Answer

Forecasting uses billed usage and projected growth; alerts prompt investigation before a threshold is exceeded.

Incorrect Answers

Annual aggregate costs conceal individual transfer paths and unexpected monthly growth.

Flow logs can help investigate network paths, but billing forecasts require charged usage/pricing and an alerting threshold.

Instance network counters do not necessarily correspond to chargeable inter-AZ, inter-Region and internet transfer dimensions or a finance budget.

Question 183

A team releases a Lambda-based payment endpoint through a deployment pipeline. New code must reach a small percentage of users first, and the deployment must automatically reverse if the error rate climbs above an alarm threshold. Which deployment configuration is best suited?

Use a weighted Lambda alias to send 10% of invocations to the new version, but rely on an operator to monitor metrics and manually reset alias weights after an error alarm.
Use AWS CodeDeploy for a Lambda canary deployment with traffic shifting and a CloudWatch alarm configured to stop and roll back the deployment.
Use provisioned concurrency for the candidate Lambda version and direct all API traffic to it, with no configured canary traffic weights.
Create separate Lambda versions and use Route 53 weighted DNS records to shift traffic, assuming DNS health checks automatically roll back API Gateway invocation aliases.

Explanation

Correct Answer

CodeDeploy supports Lambda traffic shifting between versions through aliases and can roll back based on associated CloudWatch alarms, satisfying the specified deployment risk control.

Incorrect Answers

Weighted aliases support gradual routing, but this choice omits the specified deployment-integrated CloudWatch alarm rollback and requires manual intervention.

Provisioned concurrency mitigates startup latency; it does not supply staged version exposure or alarm-driven rollback of a failing release.

Weighted DNS operates at endpoint selection, not Lambda alias/invocation deployment control; it does not provide the specified CodeDeploy alarm-driven version rollback.

Question 184

A platform team deploys CloudFormation-managed production stacks. A proposed template edit changes RDS properties that may replace a database instance. The deployment process must reveal that impact before any production resource is modified. What step is essential?

Run drift detection against the current production stack and infer that its report predicts every resource replacement caused by the new template.
Validate the new template syntax and run CloudFormation lint, treating a valid template as confirmation no RDS replacement will occur.
Use an AWS Config compliance rule to check the RDS engine version before applying the CloudFormation update, without creating a change set.
Create and review a CloudFormation change set for the target stack and approve it only after assessing resource replacement and data impact.

Explanation

Correct Answer

Change sets preview proposed resource additions, modifications, deletions and replacement behavior before execution, letting operators assess destructive change risk.

Incorrect Answers

Drift detection compares deployed resources with the currently declared stack; it does not preview changes from a proposed future template the way a change set does.

Syntax validation is necessary but does not evaluate the resource-update semantics and replacement of a live RDS instance. Review the actual stack change set.

Configuration compliance can detect policy issues but does not preview the update-specific replacement actions for each stack resource.

Question 185

An organization needs the same baseline infrastructure stack deployed automatically to 60 AWS accounts in multiple Regions under centralized governance. Local account credentials must not be embedded into every pipeline definition. Which approach fits?

Run a management-account CloudFormation template that creates roles and VPC resources locally, then use shared IAM group access to represent the sixty other accounts.
Use CloudFormation StackSets with an appropriate Organizations-enabled or otherwise authorized deployment model across target accounts and Regions.
Use CloudFormation StackSets in self-managed mode but omit administration and execution roles in the target accounts.
Use AWS RAM to share selected VPC subnets and assume the share automatically installs identical IAM, logging and monitoring resources in every member Region.

Explanation

Correct Answer

StackSets coordinates stack deployment and updates across accounts and Regions while using supported delegated/service-managed permissions.

Incorrect Answers

A regular stack deploys to its own account and Region; shared identities are not the cross-account/Region stack-instance lifecycle provided by StackSets.

Self-managed StackSets require the prescribed role trust/execution setup. Organizations-integrated service-managed permissions avoid embedding long-lived member credentials.

RAM resource sharing is not an infrastructure deployment engine; it cannot instantiate the entire authorized baseline stack across accounts and Regions.

Question 186

A REST API runs behind an Application Load Balancer with EC2 Auto Scaling. Each production release must test a new fleet before switching users and preserve the old fleet for quick rollback. Which deployment model fits the requirement?

Use blue/green delivery with a separate replacement Auto Scaling fleet and controlled load-balancer traffic switch using an appropriate deployment orchestrator.
Use CodeDeploy in-place rolling updates on the original Auto Scaling group and rely on redeployment if a new version fails.
Create an ALB weighted target group on the existing Auto Scaling fleet without deploying a distinct green environment.
Create a temporary second fleet but terminate the blue fleet as soon as the green health checks start, before full acceptance tests.

Explanation

Correct Answer

Blue/green keeps old and new environments distinct so smoke tests and traffic cutover can happen before the old fleet is terminated.

Incorrect Answers

In-place deployment may retain capacity but does not create and preserve the separately validated old and replacement fleets required for immediate rollback.

Traffic weights do not by themselves provide a separate validated fleet with an independently preserved blue release. Both environments must exist for this rollout.

Early deletion loses the explicitly required quick rollback path. Blue/green keeps the prior healthy fleet until the new release is validated and retained for the rollback window.

Question 187

A production EKS deployment is updated to a new container image. The application needs 30 seconds to initialize a database client; requests routed before initialization fail. What Kubernetes rollout condition should protect customer traffic?

Increase the liveness probe initial delay but omit a readiness probe, allowing traffic immediately when each container is running.
Configure readiness probes that reflect application ability to serve and use a rolling update strategy respecting unavailable and surge capacity.
Configure only a Kubernetes startup probe that delays liveness checking, but leave the Service ready as soon as the container starts.
Set maxSurge to zero and maxUnavailable to all replicas, assuming updating all Pods at once eliminates early traffic to uninitialized code.

Explanation

Correct Answer

Readiness governs whether a pod receives Service traffic, while rolling update parameters constrain temporary available capacity.

Incorrect Answers

Liveness can restart a failed process but does not keep an initialized yet unready Pod out of Service endpoints. A real readiness condition must gate traffic.

Startup probes prevent premature liveness failure during initialization; they do not replace application-specific readiness for when customer requests can be served.

Removing all old ready replicas during rollout increases outage risk; surge/unavailable tuning should preserve serving capacity while readiness gates new Pods.

Question 188

A release pipeline in a development account must deploy a stack into a separate production account without storing long-term production IAM keys. The artifact is encrypted with a KMS key in an artifacts account. What should be configured?

Grant the development account an IAM permission policy naming production resources, without a role trust policy in production.
Share the S3 artifact with the production account and assume access to the object grants the deployment role KMS decrypt on the tooling key.
Use an IAM role in production with broad wildcard trust for every development-account principal and leave artifact KMS policy unchanged.
Use a scoped production deployment role assumable by the pipeline and grant the deployment path necessary cross-account artifact-bucket and KMS-key access.

Explanation

Correct Answer

Cross-account role assumption provides short-lived deployment credentials; artifact storage and the KMS key also require explicit access authorization.

Incorrect Answers

An identity policy in development cannot independently authorize cross-account production operations. A target-account role that trusts the scoped pipeline identity is required.

S3 resource permission and KMS cryptographic authorization are distinct. The pipeline and deployment path need both explicitly permitted.

A production role must trust only approved actors, and unmodified KMS permissions can still block artifact decryption even after assuming the role.

Question 189

A CloudFormation stack contains a production RDS database and several replaceable application resources. An application team should be allowed to update the instances but not accidentally replace or delete the database during normal stack updates. What AWS control directly protects the database within the stack?

Add a CloudFormation DeletionPolicy: Retain to the RDS resource and assume it forbids replacement during every stack update.
Enable a CloudFormation change set but let the deployment job execute any replacement it reports without a protective boundary.
Enable stack termination protection but leave stack policies empty and allow arbitrary resource updates.
Attach a CloudFormation stack policy that denies update and replacement actions on the protected database logical resource.

Explanation

Correct Answer

A stack policy controls allowed resource updates and can protect a stateful resource from destructive stack updates unless explicitly changed.

Incorrect Answers

Retain protects physical resource deletion in selected operations, but is not the stack-policy authorization barrier that blocks protected updates or replacement attempts.

A change set previews destructive effects but does not independently prohibit the update from executing against a protected resource.

Termination protection blocks stack deletion, not update or replacement of a protected resource during normal UpdateStack.

Question 190

An ECS service on Fargate uses rolling deployments. A new container starts but then fails the target-group health check repeatedly. The business wants a supported automated rollback rather than leaving the service stuck in a failed deployment. What should be configured?

Configure ECS tasks to restart forever without notifying deployment status or preserving the previous task set.
Enable the ECS deployment circuit breaker with rollback and validate health-check failure detection.
Set minimum healthy percent to zero and disable all target health checks to make every new task appear successful.
Enable ECS service auto scaling on CPU only and assume that scale-out rolls back a failed application deployment automatically.

Explanation

Correct Answer

The ECS deployment circuit breaker can mark a rollout failed and roll back to a previously completed deployment when configured to do so.

Incorrect Answers

Infinite restarts hide failure symptoms and do not guarantee an automatic safe return to the earlier service version.

Suppressing readiness evidence risks sending users to broken containers and cannot satisfy health-driven rollback.

Service auto scaling changes desired task count but does not automatically restore the previous deployment after new tasks fail health checks.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 180

Explanation

Correct Answer

Incorrect Answers

Question 181

Explanation

Correct Answer

Incorrect Answers

Question 182

Explanation

Correct Answer

Incorrect Answers

Question 183

Explanation

Correct Answer

Incorrect Answers

Question 184

Explanation

Correct Answer

Incorrect Answers

Question 185

Explanation

Correct Answer

Incorrect Answers

Question 186

Explanation

Correct Answer

Incorrect Answers

Question 187

Explanation

Correct Answer

Incorrect Answers

Question 188

Explanation

Correct Answer

Incorrect Answers

Question 189

Explanation

Correct Answer

Incorrect Answers

Question 190

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests