Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 53

Question 520

An EventBridge rule already has an SQS standard dead-letter queue for failures delivering audit events to Lambda. During a drill, the target fails as expected but the encrypted DLQ receives nothing; metrics indicate failed DLQ delivery. The queue is in the rule Region and uses a customer-managed KMS key, and the team has not configured its queue resource policy or KMS service permissions. What configuration repair is required?

Grant the EventBridge service scoped sqs:SendMessage access in the DLQ resource policy and the required KMS data-key/decrypt use on the customer-managed key, then retest failed deliveries.
Allow sqs:SendMessage to Lambda’s execution role alone, leaving the EventBridge service principal unable to deliver to the encrypted DLQ.
Convert the target DLQ to FIFO without changing access policies, because EventBridge always requires FIFO DLQs for ordered replay.
Use an AWS-managed SQS key on a different queue while leaving the actual configured customer-key-encrypted rule DLQ policy unchanged.

Explanation

Correct Answer

A rule-target DLQ requires a queue policy permitting EventBridge delivery and, when encrypted with a customer-managed KMS key, suitable KMS permissions for the service principal.

Incorrect Answers

The EventBridge service, not the target function execution role, sends the failed invocation to the rule DLQ and needs access to SQS and KMS.

EventBridge rule target dead-letter queues use standard SQS queues, and changing queue type would not fix missing SQS or KMS authorization.

Fixing another queue does not grant EventBridge permission to write or encrypt messages in the intended dead-letter queue.

Question 521

A critical microservice depends on a downstream API that begins returning errors for several minutes. The calling pool rapidly consumes all its threads as concurrent clients wait and retry. Which fault-containment feature is best to prevent cascading failures?

Implement a circuit breaker with bounded timeouts and fallback behavior so repeated downstream failures fail fast.
Increase the caller timeout to several hours and allow every request to occupy a thread indefinitely.
Disable all dependency error metrics and let clients retry continuously without any admission limits.
Increase the downstream service’s security-group ingress range while preserving unbounded caller retries and threads waiting on failing requests.

Explanation

Correct Answer

A circuit breaker limits repeated calls to an unavailable dependency and keeps caller resources available for other work.

Incorrect Answers

Unbounded waiting magnifies resource exhaustion and spreads the downstream failure.

Without bounded attempts or visibility, retries can saturate both the caller and downstream recovery.

Opening more network paths does not contain a logical downstream outage or bound thread and retry amplification.

Question 522

A public application creates temporary files exclusively on EC2 instance store and tells users uploads are complete immediately. Auto Scaling termination routinely destroys files that have not been copied. Which workflow change ensures accepted files remain recoverable?

Persist the file to a durable service such as S3 before confirming acceptance, with verification and retriable processing.
Increase the local instance-store volume size but keep the same acknowledge-before-persist behavior.
Disable EC2 Auto Scaling and assume hardware never fails or needs replacement.
Enable CloudTrail file event auditing while leaving the only accepted upload bytes on instance store before acknowledging completion.

Explanation

Correct Answer

Instance store is tied to the instance lifecycle; a durable commit point before acknowledgment eliminates the observed loss window.

Incorrect Answers

Larger ephemeral space still disappears when an instance is terminated or its host fails.

Avoiding ordinary scale-in does not provide durable accepted uploads across host failures.

Audit logs cannot reconstruct uploaded contents that were never committed durably before host replacement.

Question 523

A team deploys an NLB in two AZs with targets in both zones, but target groups and routing assumptions leave some clients stranded when one AZ fails. The application requires surviving endpoints to carry traffic after impairments. Which configuration should be validated?

Deploy all NLB nodes and all backend targets in the AZ known to be the least stable.
Validate NLB cross-zone behavior, healthy target routing, regional availability, and application client retry semantics under AZ failure.
Set all target health checks to success regardless of whether a target accepts application connections.
Enable the NLB access logs and assume logs themselves automatically cross-zone route existing connections away from impaired nodes.

Explanation

Correct Answer

NLB zone and target health settings determine available backends during impairments; measured failover is needed for correct client continuity.

Incorrect Answers

Concentrating service resources in a single fault domain defeats the requested AZ-resilient design.

Faking health permits traffic to continue toward failed services rather than healthy remaining zones.

Logs can assist diagnosis but do not configure supported cross-zone balancing, target health or client reconnect behavior.

Question 524

A payment settlement workflow currently uses Step Functions Express. A new compliance design must allow a human-dispute step to remain open for several hours, retain auditable execution history and avoid the at-least-once execution semantics of asynchronous Express for a non-idempotent external charge. Which state-machine type should the architect use for the revised workflow?

Create a Step Functions Standard workflow and design appropriate task retry and idempotency safeguards around external payment effects.
Keep an asynchronous Express workflow with the existing five-minute duration ceiling and assume a several-hour wait will be retained.
Configure Express at-least-once behavior as a payment guarantee and ignore any possibility of task re-execution during transient failures.
Attach detailed CloudWatch execution logging to the existing Express state machine and assume logs change its five-minute execution-duration limit.

Explanation

Correct Answer

Standard workflows support long-running, auditable executions and an exactly-once workflow execution model, unlike asynchronous Express at-least-once semantics; external actions still require explicit retry and idempotency design.

Incorrect Answers

Express workflow execution duration is limited to five minutes, which conflicts with the stated hours-long human-dispute step.

The asynchronous Express at-least-once processing model can repeat work and is not suitable as a substitute for non-idempotent payment control.

More logging cannot extend the service execution limit or change the state-machine processing guarantees needed for human approval.

Question 525

A service stores order state in an Aurora database and promotes a secondary Region cluster during a disaster. Application instances still write against a hard-coded old writer hostname and fail after promotion. What failover dependency should be built into the design?

Adjust DNS TTL alone while leaving clients hard-coded to the old primary cluster hostname and never publishing the promoted writer endpoint.
Increase Aurora reader replica count in the failed original Region but leave disaster recovery clients pointed at its prior writer.
Provide a tested endpoint-switch mechanism and connection retry/re-resolution behavior for the promoted writer before declaring recovery complete.
Increase EBS IOPS on the old Region writer and keep all application connections fixed to its unavailable endpoint.

Explanation

Correct Answer

Database promotion does not automatically update every client configuration or long-lived connection that targets the old writer.

Incorrect Answers

Lower DNS TTL cannot switch a literal stale hostname to the new regional writer without configuration and reconnection handling.

New readers in the unavailable Region do not update application connection targets after cross-Region writer promotion.

Old Region storage performance cannot restore reachability to the new Region writer.

Question 526

An AWS Organizations platform requires a second Region to take over scheduled batch jobs after complete primary Region failure. The standby Region holds data but its IAM role and event schedule are absent. Which operational design makes failover genuinely runnable?

Increase the primary Region scheduled task frequency and ignore the missing secondary Region trigger.
Replicate business objects into the standby Region and assume S3 replication provisions approved IAM roles, EventBridge schedules and target retry permissions.
Deploy tested application roles, scheduling resources and prerequisites in the standby Region using controlled infrastructure as code.
Use only cross-Region S3 replication and assume it automatically creates IAM roles and EventBridge schedules.

Explanation

Correct Answer

Recoverable data alone is insufficient; identity, triggers and permissions form part of the executable failover path.

Incorrect Answers

Running more jobs in the source Region does not prepare a distinct regional recovery path.

Data replication does not create the execution dependencies or account-level IAM and scheduling configuration required in the recovery Region.

Object replication does not provision scheduling or account-level identity infrastructure.

Question 527

A scheduled production job uses EventBridge Scheduler. During a brief target outage jobs fail even though the business requires eventual completion and replay. The job owner wants explicit retention and a recoverable failed-invocation queue. Which scheduler configuration fits?

Increase the number of schedule names and assume each failed invocation automatically gets a new target.
Increase the event target Lambda reserved concurrency while omitting Scheduler retry windows and a dead-letter queue for exhausted target invocations.
Configure Scheduler retry policy and maximum event age with a supported SQS dead-letter queue for exhausted deliveries.
Turn off retries and publish each failed job only to CloudWatch metrics without storing its payload.

Explanation

Correct Answer

Scheduler retries cover transient target failures while a DLQ holds failed target invocations that exceed supported limits.

Incorrect Answers

More schedule resources do not preserve or redrive failed invocations.

More concurrency may reduce throttling but does not satisfy the explicit durable failure replay and retention controls.

Metrics can alert but cannot serve as the durable job input required for replay.

Question 528

An event-processing application receives an SQS message containing a malformed JSON field. The consumer fails only after it has already performed a partial update in a separate database, leaving the two systems inconsistent. Which change addresses this reliability boundary?

Ignore schema errors and acknowledge each record as successful even when its database mutation was partial.
Increase the SQS maximum message retention period but continue applying database side effects before JSON schema validation.
Validate the full message contract before side effects and use transactional/idempotent recovery or compensating action for partially applied operations.
Increase the SQS retention period while allowing malformed inputs to execute partial database updates first.

Explanation

Correct Answer

Validating before mutation and planning cross-system compensation prevent a poison input from leaving inconsistent committed side effects.

Incorrect Answers

Acknowledging failed work hides inconsistency and removes the message needed for safe recovery.

Longer queue retention preserves inputs for retry but cannot prevent the irreversible partial database write made from a malformed payload.

Longer retention makes redrive possible but does not prevent or repair inconsistent mutations in the consumer.

Question 529

A fleet of private-subnet applications downloads many S3 objects from buckets in the same AWS Region. The CUR identifies large NAT gateway data-processing charges attributable to those S3 requests. Security wants to keep the instances private. Which network change most directly reduces this spend?

Create an S3 interface endpoint but route in-Region S3 downloads through the same NAT gateway without adjusting private subnet routes or DNS.
Move the S3 bucket to another Region while preserving the NAT gateway path and making every request cross-Region.
Create an S3 gateway VPC endpoint and update the relevant subnet route tables to send in-Region S3 traffic through the endpoint.
Reduce NAT gateway hours by attaching additional Elastic IP addresses, leaving the data-processing bytes unchanged.

Explanation

Correct Answer

S3 gateway endpoints provide a private regional route for S3 from VPC subnets without using NAT for that traffic; route-table and endpoint policy scope must match the data flow.

Incorrect Answers

An unused endpoint cannot reduce NAT processing costs. The supported S3 gateway endpoint route is the direct low-overhead private path for same-Region S3.

This could add inter-Region transfer costs and does not remove the NAT charge driver for same-Region private-subnet S3 downloads.

Additional addresses do not reduce per-byte NAT processing; a gateway endpoint bypasses the NAT path for eligible S3 traffic.

Question 530

Cost Explorer shows months of charges for unattached gp2 EBS volumes left after test instance deletion. The data owner has confirmed the volumes are obsolete. What is the cost-corrective action?

Detach the already-unattached volumes again and retain them indefinitely as a precaution despite recorded data-owner approval.
Switch the obsolete unattached gp2 volumes to gp3 while leaving every unneeded volume allocated.
Enable AWS Data Lifecycle Manager to create new snapshots of the unused volumes and omit deletion of the existing orphan storage.
Inventory and validate unused volumes and snapshots, then delete the approved unattached volumes and apply lifecycle governance to prevent recurrence.

Explanation

Correct Answer

Unattached EBS volumes continue to incur provisioned storage charges; reviewed deletion removes the measured idle resource cost.

Incorrect Answers

Detached EBS volumes continue incurring storage charges; deletion after verified data-retention approval is needed to stop costs.

gp3 may reduce some unit cost but the stale volumes still accrue charges; delete confirmed obsolete volumes.

Snapshot lifecycle can help recoverability but adds more stored data and does not eliminate the known orphaned volume charge.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 520

Explanation

Correct Answer

Incorrect Answers

Question 521

Explanation

Correct Answer

Incorrect Answers

Question 522

Explanation

Correct Answer

Incorrect Answers

Question 523

Explanation

Correct Answer

Incorrect Answers

Question 524

Explanation

Correct Answer

Incorrect Answers

Question 525

Explanation

Correct Answer

Incorrect Answers

Question 526

Explanation

Correct Answer

Incorrect Answers

Question 527

Explanation

Correct Answer

Incorrect Answers

Question 528

Explanation

Correct Answer

Incorrect Answers

Question 529

Explanation

Correct Answer

Incorrect Answers

Question 530

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests