Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 22

Question 210

A team uses CloudFormation to create a production storage bucket that already exists and contains important data. It now wants that bucket governed in a stack without deleting or recreating it. Which migration action should be considered?

Add a resource with the existing bucket physical name to a stack template and execute CreateStack without the supported resource-import operation.
Use supported CloudFormation resource import with the correct template, identifiers and drift review.
Use CloudFormation drift detection on a stack that does not yet own the bucket and assume the operation adopts it automatically.
Set only a stack termination-protection flag and assume it automatically imports the external bucket.

Explanation

Correct Answer

Resource import brings eligible existing resources under stack management without replacing the live data-bearing resource.

Incorrect Answers

Ordinary stack creation attempts to create a new resource; importing an existing physical bucket requires the resource import workflow.

Drift detection cannot register an unmanaged resource; a supported import step must establish stack ownership first.

Termination protection has no function for adopting a preexisting resource into a stack.

Question 211

An organization deploys new versions of a stateful ECS application. After replacement, its health checks pass but the app returns 500 errors because a required database schema migration has not run. What belongs in the deployment lifecycle?

Move database schema migration into ECS task initialization after the new tasks begin accepting production requests.
Add an explicit pre-traffic migration/validation step with backward-compatible schema sequencing and rollback constraints.
Rely only on passing container or ALB readiness checks and omit migration validation for the business SQL queries that changed.
Run a destructive column-drop migration before draining the old task set, with no compatibility window.

Explanation

Correct Answer

A healthy container is not sufficient if application schema dependencies are incompatible; deployment hooks and compatibility sequencing address the gap.

Incorrect Answers

Schema updates after traffic starts leave the new application incompatible and can cause errors before its prerequisites exist.

Container health checks do not guarantee database schema compatibility or successful business operations.

The old tasks may still depend on dropped schema and fail; migration needs a backward-compatible and reversible rollout sequence.

Question 212

An existing CodePipeline in us-east-1 already has correct cross-account deployment roles and a secure artifact bucket. The team adds a supported AWS deployment action in eu-west-1, but CloudFormation deployment fails because no action-Region artifact store or regional encryption key was configured. What regional pipeline design must be added while retaining the current account trust?

Add an artifact bucket and appropriate encryption key in each action Region, configure CodePipeline cross-Region artifactStores and let the pipeline replicate required action inputs.
Reuse the single us-east-1 S3 artifact bucket as the eu-west-1 action Region’s regional artifact store without any additional key or bucket.
Disable all CodePipeline artifact encryption to make the cross-Region action ignore the missing regional artifact-store requirement.
Expand cross-account KMS trust in the pipeline’s home Region but continue using no regional artifact bucket for the remote action.

Explanation

Correct Answer

CodePipeline cross-Region actions require per-Region artifact storage and regional encryption configuration, separate from existing IAM cross-account permissions.

Incorrect Answers

A supported cross-Region action needs its own regional artifact store; an S3 bucket in the pipeline Region alone is insufficient.

Removing encryption violates the authorized artifact security design and does not satisfy required cross-Region artifact location settings.

Cross-account key permissions do not eliminate the requirement for the action Region artifact store and appropriate encryption key.

Question 213

A financial application runs on an Aurora MySQL cluster in one AWS Region. The business wants near-real-time replicated database state in a second Region and an explicit, tested procedure for application and database failover after a regional outage. Which TWO architectural actions address both requirements?

Use Aurora Global Database to establish a secondary cluster in another Region and validate its replication lag against the required RPO.
Configure a same-Region Aurora Multi-AZ reader with automatic failover and treat its AZ independence as full regional disaster recovery.
Plan, exercise, and automate as appropriate the secondary Region's database promotion and application endpoint or traffic changes.
Take automated daily cross-Region database snapshots and assume the restoration lag always meets a few-minute RPO without ongoing replication.
Configure Route 53 failover to the secondary application endpoint but omit rehearsed secondary cluster promotion and client writes.

Explanation

Correct Answer

Aurora Global Database supports cross-Region database replication with low typical replication lag; observed lag and recovery tests must be checked rather than assuming a guaranteed zero-data-loss recovery.

A secondary data copy is not a full DR plan; rehearsed promotion and endpoint/traffic switching are required to restore the application safely after a Region outage.

Incorrect Answers

Cross-AZ availability within one Region does not provide a database copy in a second Region after full-Region loss.

Periodic snapshots may be useful for backups but cannot alone substantiate near-real-time replication and the required small recovery-point gap.

Traffic routing alone is not a proven database recovery procedure; a read-only secondary requires explicit promotion/switchover and app endpoint validation.

Question 214

A checkout service uses a DynamoDB table in us-east-1. The business requires writes accepted in either of two Regions during a regional disruption; application conflicts will be handled by the application design. Which DynamoDB capability fits?

Enable DynamoDB point-in-time recovery in the primary Region and plan to restore a table in the second Region during every outage.
Configure DynamoDB global tables across both Regions and implement application-level conflict and failover handling appropriate to their replication semantics.
Use a strongly consistent read request in us-east-1 and assume it makes all writes synchronously available in a second Region.
Use DynamoDB Streams with a Lambda replicator that performs best-effort remote writes, while assuming it automatically provides managed global table failover and conflict semantics.

Explanation

Correct Answer

Global tables support multi-Region replicated tables with local reads and writes; applications must handle replication lag and conflict behavior.

Incorrect Answers

PITR supports recovery but does not provide an already writable replica for immediate regional continuity and explicit conflict handling.

Regional strong read consistency does not create a replicated writable table or cross-Region failover capability.

A custom stream consumer can copy changes but adds its own reliability and conflict handling; it does not provide the managed bidirectional global-table capability requested.

Question 215

A compliance archive stores immutable S3 objects. A disaster recovery policy requires copies in a separate Region and account with a clear understanding that replication is asynchronous. What architecture should the team deploy?

Use a scheduled S3 Batch Replication job once per month as the only copy mechanism, omitting replication of new objects between jobs.
Enable versioning and suitable S3 replication rules to a destination bucket in the disaster recovery account, with IAM and encryption permissions configured.
Create a second S3 bucket with versioning enabled but use only DNS redirects from the primary bucket to the secondary bucket.
Enable S3 Cross-Region Replication without bucket versioning or source/destination replication IAM and KMS permissions.

Explanation

Correct Answer

S3 replication supports asynchronous object copying when source/destination configuration and replication IAM/KMS permissions are correctly set.

Incorrect Answers

Batch replication supports copying existing eligible objects, not the continuously configured source-to-destination rule required for new objects under the policy.

Versioning and DNS do not physically replicate object content; a configured replication rule with destination and role permissions is still required.

S3 replication depends on supported versioning and authorized replication roles/encryption configuration; a bare regional bucket choice is insufficient.

Question 216

An application stores user-uploaded files in a regional EFS filesystem. The team needs a recoverable read-only copy in a second Region that can be promoted under a documented disaster procedure. Which EFS-related solution is most appropriate?

Configure supported Amazon EFS replication to a secondary-region file system and test the promotion and client remount procedure.
Configure extra EFS mount targets in each Availability Zone of the source Region, treating cross-AZ availability as cross-Region disaster recovery.
Use AWS Backup to copy EFS recovery points daily and assume a snapshot archive is a continually replicated read-only filesystem ready for promotion.
Deploy EFS One Zone in the secondary Region and change DNS to it without copying file contents or validating disaster remounts.

Explanation

Correct Answer

EFS replication maintains a target file system for disaster recovery; applications still need a deliberate failover and mount transition.

Incorrect Answers

Regional EFS mount targets support access within a Region; they do not create a secondary-Region filesystem or a procedure to promote its replica.

Backups provide restore points rather than a running EFS replication destination; recovery from them adds restore operations and may not meet the specified replica workflow.

An empty filesystem and a DNS change cannot recover existing files. EFS replication and an explicit failover process are required.

Question 217

A recovery drill restores an encrypted database snapshot in another AWS account and Region. The snapshot was copied but the destination team cannot decrypt it because the source key will be unavailable after disaster isolation. What design gap should be corrected?

Grant the destination account permissions to describe the encrypted snapshot but exclude use of the source KMS key for the copy operation.
Create a multi-Region key alias matching the source alias in the destination Region, but leave the snapshot encrypted by the original regional key.
Re-encrypt the copied snapshot under a customer-managed KMS key controlled and authorized in the destination Region and account, then verify restoration.
Grant the disaster recovery role broad S3 read access but do not test the destination KMS decrypt path for the restored DB.

Explanation

Correct Answer

A recoverable encrypted copy must use key material accessible in the recovery environment, with correct regional key policy and IAM rights.

Incorrect Answers

Snapshot metadata access is not sufficient for decrypting and copying ciphertext; the workflow needs source-key permissions and re-encryption into destination-controlled keys.

Aliases are names, not transferable key material. Merely matching aliases does not re-encrypt a recovery snapshot or make its source key independently reachable.

S3 permission does not resolve cryptographic authorization for encrypted database snapshots. The exact KMS keys, copy steps and isolated restore require validation.

Question 218

A cross-Region failover drill promotes the database replica correctly, but application startup fails because the recovery Region has no usable copy of a secret encrypted with a Region-specific KMS key. Recovery time is otherwise within target. Which dependency must be designed explicitly?

Replicate the Secrets Manager metadata but keep the only usable ciphertext under the primary Region KMS key, assuming promotion alone makes it portable.
Replicate or provision the required secret in the recovery Region with a destination-authorized KMS key and test application retrieval during failover.
Use AWS KMS multi-Region key replicas but do not replicate or reprovision the actual Secrets Manager secret value.
Give the secondary database promotion role more permissions and assume it implicitly receives secretsmanager:GetSecretValue on any secret.

Explanation

Correct Answer

Cross-Region recovery requires the application to retrieve secrets encrypted under keys usable in the destination; data replication does not provision that dependency.

Incorrect Answers

Regional secrets must be encrypted by a usable destination key with appropriate policies, not solely by an unavailable primary-Region key.

Related key material may help applications that explicitly use it, but no recovery secret exists for the application to retrieve without proper replication/provisioning.

Database promotion and secret retrieval are independent authorizations; additional database privileges do not create the missing Regional secret or its KMS grants.

Question 219

A new financial DynamoDB workload has no existing data and must serve strongly consistent reads across two supported AWS Regions with zero replication RPO; the team accepts cross-Region write latency and can configure an eligible third Region as a witness. Default eventually consistent multi-Region replication does not satisfy the data-loss requirement. Which table design is appropriate to evaluate?

Use MREC global tables with conditional writes on each local replica and assume independent regional conditions guarantee global linearizability and zero replication lag.
Create a Multi-Region Strong Consistency (MRSC) global table using supported Region combinations with two replicas plus a witness, and validate cross-Region latency and quotas.
Use three MREC writable replicas and place the third in a low-latency Region, assuming the additional replica converts asynchronous writes into a quorum.
Use a single DynamoDB table with strongly consistent reads, plus DynamoDB Streams in the second Region but no global table replica.

Explanation

Correct Answer

MRSC global tables support synchronous multi-Region replication with strongly consistent cross-Region reads, subject to supported Regions, replica/witness topology and latency.

Incorrect Answers

Conditions in an MREC replica evaluate local item state. Its asynchronous replication cannot deliver the specified zero-RPO, globally strong read semantics.

MREC does not become synchronously consistent simply by adding replicas; strong multi-Region behavior requires selecting MRSC mode and eligible topology.

Strong reads of one Region do not enable reads/writes from a usable second regional replica and streams alone do not create a globally consistent table.

Question 220

A recovery team has two replicated S3 buckets in different Regions. Its source bucket uses a KMS key in Region A, and the copied recovery objects must be decryptable when Region A cannot be contacted. Which encryption design is needed?

Replicate SSE-KMS objects with the source key ARN referenced at both ends, expecting key policies in Region A to remain usable after its isolation.
Use destination S3 Bucket Keys alone as the encryption recovery strategy, without configuring destination-region KMS key access for objects.
Configure destination-region encryption under a destination-authorized KMS key and verify decryption during isolated recovery drills.
Copy the original KMS key policy JSON to a new Region but do not create a usable destination key or re-encrypt the destination objects.

Explanation

Correct Answer

Recovery must not depend solely on source-region cryptographic resources; destination key and principal permissions must support restoration.

Incorrect Answers

KMS keys are Region-scoped unless a supported replica strategy is explicitly configured. The recovery bucket needs decryptability from destination-accessible key material.

S3 Bucket Keys can reduce some KMS calls but are not an independent decryption mechanism. Destination key policy, role permissions and actual restore tests remain necessary.

Policy JSON is not cryptographic key material and cannot decrypt a snapshot or S3 object. A real Region-local key and authorized re-encryption are needed.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 210

Explanation

Correct Answer

Incorrect Answers

Question 211

Explanation

Correct Answer

Incorrect Answers

Question 212

Explanation

Correct Answer

Incorrect Answers

Question 213

Explanation

Correct Answer

Incorrect Answers

Question 214

Explanation

Correct Answer

Incorrect Answers

Question 215

Explanation

Correct Answer

Incorrect Answers

Question 216

Explanation

Correct Answer

Incorrect Answers

Question 217

Explanation

Correct Answer

Incorrect Answers

Question 218

Explanation

Correct Answer

Incorrect Answers

Question 219

Explanation

Correct Answer

Incorrect Answers

Question 220

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests