Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 24

Question 230

An enterprise uses S3 Cross-Region Replication for new objects, but a large dataset uploaded before the rule was created is missing in the disaster recovery bucket. The copy target and permissions now work for new writes. How should it backfill the old dataset?

Modify the existing live S3 replication rule to specify the same destination and assume it automatically backfills every older eligible version.
Use S3 Inventory reports as the migration mechanism and assume listing old keys transfers the corresponding object bytes.
Use S3 Batch Replication for eligible existing objects while retaining the ongoing live replication rule for new changes.
Delete the source bucket and recreate it so the replication rule treats every old object as a new write.

Explanation

Correct Answer

Batch Replication can copy eligible older objects separately from the ongoing rule that handles new writes.

Incorrect Answers

An ordinary live replication rule primarily handles new eligible changes; already existing objects require supported batch replication/backfill.

Inventory identifies objects and can supply manifests, but does not itself replicate historic object content without a Batch Replication job.

Deleting production data for backfill is destructive and not necessary to replicate existing objects.

Question 231

A company has a destination S3 bucket in another account and Region. Object replication succeeds except for objects encrypted under a customer-managed KMS key; the replication role lacks appropriate cryptographic permissions. Which repair is required?

Add s3:GetObjectVersion permission for the replication role but leave KMS source decrypt and destination encrypt policies unchanged.
Disable versioning on the destination bucket to simplify replication of encrypted object versions.
Enable S3 Batch Replication without repairing the missing cryptographic authorization for source and destination KMS keys.
Authorize the replication role on the relevant source and destination KMS keys and configure the rule to replicate SSE-KMS objects.

Explanation

Correct Answer

Cross-Region SSE-KMS replication requires explicit support and role authorization to decrypt source data and encrypt destination copies.

Incorrect Answers

S3 object read authorization alone cannot decrypt and re-encrypt objects protected with SSE-KMS customer keys.

S3 replication requires versioning and the missing issue is key authorization.

A batch replay cannot succeed on encrypted objects if the replication principal still lacks required KMS operations.

Question 232

A company requires active-region object uploads to be available to clients after regional failover without forcing clients to change a bucket-specific hostname. The S3 data is replicated to two Regions. Which multi-Region S3 access pattern is appropriate?

Configure ordinary S3 cross-Region replication but keep application clients hard-coded to the primary regional bucket endpoint.
Evaluate S3 Multi-Region Access Points with properly configured regional buckets, routing and failover controls.
Use a Route 53 latency record pointed only to the primary regional bucket endpoint, without any second-region access-routing configuration.
Create one static redirect to the primary bucket and assume it redirects itself after the primary Region fails.

Explanation

Correct Answer

An MRAP can provide a global endpoint for supported access while regional replication and failover controls sustain secondary data availability.

Incorrect Answers

Replication preserves content, but one fixed regional hostname is not a fault-tolerant global S3 access endpoint for client failover.

DNS latency alone to one bucket does not provide the managed multi-Region S3 request routing and failover control requested.

A fixed redirect is not a health-aware global access endpoint or a tested failover mechanism.

Question 233

A recovery team has S3 Multi-Region Access Point configured across two Regions. A regional cutover must direct requests away from a degraded bucket, but traffic policy remains unchanged after the outage. Which control is relevant?

Use the supported S3 Multi-Region Access Point failover controls and validate the intended region routing state before resuming writes.
Enable or change S3 cross-Region replication priority rules but leave the MRAP routing control state directing traffic to the degraded bucket.
Use Route 53 hosted-zone alias changes for each client instead of applying the configured Multi-Region Access Point failover controls.
Create a new Multi-Region Access Point alias but leave its regional traffic controls in the same degraded state.

Explanation

Correct Answer

Failover routing controls govern which regional bucket receives global endpoint traffic during recovery.

Incorrect Answers

Replication direction determines data movement; the MRAP failover routing control determines how global clients are directed.

Client DNS changes introduce another failover layer but do not correct the specifically unchanged MRAP regional routing state.

A new alias alone does not set the required regional failover control and may complicate existing application requests.

Question 234

An active-active application uses Amazon EventBridge global endpoints to accept business events through two Regions. During a Regional event service disruption, published events should be routed to the secondary Region according to monitored health. What else must the design handle?

Enable replication between the two EventBridge buses but omit the global endpoint health-check and failover routing setup.
Configure the global endpoint with appropriate health checks and validate event replication, bus policies and idempotent consumers across Regions.
Assume creating two EventBridge buses alone automatically establishes a globally health-routed publishing endpoint.
Configure only Route 53 DNS failover around producer EC2 instances while continuing to publish to a hard-coded Region-specific EventBridge bus API.

Explanation

Correct Answer

Global endpoint failover depends on monitored health and regional buses; duplicates and replay semantics need explicit application handling.

Incorrect Answers

Event replication supplies copies but does not automatically direct new PutEvents requests to a healthy Region without global endpoint controls.

Separate event buses do not automatically create a global endpoint, health check or cross-Region event policy.

Producer DNS routing does not redirect an EventBridge PutEvents call still using the unavailable regional endpoint.

Question 235

An application uses Amazon ElastiCache for Redis as a durable session cache across multiple Availability Zones. Its single node fails and every user must sign in again, although the database still works. Which cache availability improvement should be considered?

Enable ElastiCache read replicas but do not configure supported automatic failover or application reconnection after the primary node fails.
Use supported Multi-AZ replication with automatic failover and evaluate whether authoritative session state must live in a durable store.
Increase cache node size in the same single Availability Zone and assume larger RAM prevents node failure.
Take periodic ElastiCache snapshots only and require manual cache reconstruction after each primary node loss while promising uninterrupted session availability.

Explanation

Correct Answer

Replication and failover reduce cache-node loss; critical session continuity should not rely on an unreplicated ephemeral node.

Incorrect Answers

Read replication alone does not assure automatic promotion and client recovery when the single writer node fails.

More memory does not provide redundant capacity in another failure domain.

Snapshots help restore state but do not offer live Multi-AZ automatic failover or prevent session disruption.

Question 236

A team designed its RDS disaster recovery process around a standby in another Availability Zone of the same Region. The business now requires continuity through a full Region outage. What architectural scope change is needed?

Add tested cross-Region database backup or replication and a secondary application environment aligned to the RTO/RPO targets.
Use the existing same-Region standby and declare it sufficient for any full-Region failure.
Enable RDS storage autoscaling and enlarge the same-region Multi-AZ DB, without adding any recoverable secondary Region state.
Deploy another Multi-AZ DB standby in a different Availability Zone of the same Region and assume Region-wide resilience is achieved.

Explanation

Correct Answer

Multi-AZ protects against AZ failure within a Region but does not provide independent regional recovery.

Incorrect Answers

Both writer and standby remain subject to an entire regional service outage.

Storage headroom cannot address complete Region loss; replication or backup copies and runnable applications must exist outside the Region.

More AZs provide intra-Region fault tolerance but do not create a cross-Region recovery path.

Question 237

A regulated financial firm already copies protected recovery points to a standard backup vault in a dedicated security account with appropriate retention and key permissions. It now requires a secondary AWS Backup vault whose data is protected by service-owned isolation, compliance-mode Vault Lock and controlled restore access from a designated recovery account through AWS RAM. Which supported backup-vault type should it evaluate for eligible resources and Regions?

Use an unlocked standard AWS Backup vault with cross-account copy access and assume ordinary IAM backup retention rules cannot be changed by administrators.
Use a standard backup vault with a governance-mode Vault Lock and expect it to be an AWS service-owned air-gapped vault that supports RAM vault sharing.
A logically air-gapped AWS Backup vault, with its eligibility, encryption, automatic compliance-mode lock and cross-account restore sharing tested.
Apply S3 Object Lock compliance retention to exported backup metadata only and treat it as an AWS Backup logically air-gapped vault with RAM restores.

Explanation

Correct Answer

AWS Backup logically air-gapped vaults offer a specialized vault with compliance-mode Vault Lock and supported cross-account restoration through AWS RAM.

Incorrect Answers

A standard unlocked vault relies on authorization controls and lacks the specified service-owned isolation, automatic compliance-mode lock and RAM cross-account restore model.

A standard vault with governance-mode lock does not provide the special logically air-gapped vault's service-owned isolation and RAM sharing capability.

S3 Object Lock of exported metadata is not a logically air-gapped AWS Backup vault containing service-managed recovery points.

Question 238

A global SaaS workload uses an Aurora Global Database with a writable primary Region and read-only secondary clusters. A reporting service in Europe makes occasional supported DML updates but should keep connecting to its local secondary cluster endpoint without implementing application-level cross-Region write routing. There is no planned primary switchover. Which Aurora feature fits?

Make every secondary cluster an independent writable master and assume Aurora Global Database automatically resolves concurrent writes from separate primaries.
Use Route 53 latency records pointing directly to any secondary reader and assume read-only clusters will accept arbitrary writes without an enabled feature.
Enable supported Aurora Global Database write forwarding on the secondary cluster and validate engine/version, session consistency and forwarded write latency.
Use Aurora reader endpoints with read scaling only and assume SELECT traffic automatically makes a read-only global secondary accept DML writes.

Explanation

Correct Answer

Write forwarding can submit supported DML through a secondary reader endpoint while the primary cluster performs the authoritative write.

Incorrect Answers

Aurora Global Database normally has one primary writer; independent writable secondary masters are not created by default conflict resolution.

Geographic DNS selection does not change secondary Aurora write permissions or enable cross-Region SQL statement forwarding.

Reader endpoints route reads; DML on a global secondary requires supported write-forwarding configuration and consistent application behavior.

Question 239

A workload must restore a 30-TB EBS volume in another AWS Region after a regional disaster. Operations assumes cross-Region copy metadata proves that a restored instance will boot and attach required volumes within the recovery target. Which acceptance test is necessary?

Validate only snapshot copy completion and available KMS permissions without measuring restored volume initialization or boot time.
Enable fast snapshot restore without ever launching the recovery host or timing application dependencies after failover.
Perform an actual recovery rehearsal restoring the copied snapshot, attaching a volume, booting required hosts and measuring end-to-end application RTO.
Check only snapshot status available in the destination Region and declare the application RTO achieved.

Explanation

Correct Answer

Snapshot copy success is not equivalent to complete workload restoration; volume creation and application dependencies consume recovery time.

Incorrect Answers

Successful copy and decrypt authorization are prerequisites, but cannot establish actual volume readiness or application recovery time.

Fast snapshot restore may improve data block performance where supported, but does not verify end-to-end boot and application RTO.

Available backup metadata does not prove restore, attach, operating system startup or usable application service.

Question 240

An e-commerce platform has two regional application deployments and uses Route 53 health-check failover. After a successful switch, customers see authentication loops because session signing keys differ between Regions. Which non-data dependency must be coordinated?

Increase DNS TTL so clients use the old primary Region longer even though its application is unavailable.
Delete the secondary Region’s application identity configuration and rely on anonymous access.
Replicate only application binaries and database records to the second Region while keeping signing secrets unique and incompatible.
Provision compatible regional session signing material and authorization configuration through a controlled secrets/key distribution workflow.

Explanation

Correct Answer

Application traffic can fail after DNS routing if authentication keys and runtime security configuration are not recoverable in the target Region.

Incorrect Answers

Longer cached answers can delay failover and does not resolve mismatched regional session keys.

Removing authentication would violate the service’s access-control requirement.

Identical business data does not enable verification of tokens signed under a different Region’s unshared secret or key pair.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 230

Explanation

Correct Answer

Incorrect Answers

Question 231

Explanation

Correct Answer

Incorrect Answers

Question 232

Explanation

Correct Answer

Incorrect Answers

Question 233

Explanation

Correct Answer

Incorrect Answers

Question 234

Explanation

Correct Answer

Incorrect Answers

Question 235

Explanation

Correct Answer

Incorrect Answers

Question 236

Explanation

Correct Answer

Incorrect Answers

Question 237

Explanation

Correct Answer

Incorrect Answers

Question 238

Explanation

Correct Answer

Incorrect Answers

Question 239

Explanation

Correct Answer

Incorrect Answers

Question 240

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests