Question 690
A subscription SaaS product accepts a cancellation request now but must send one reminder exactly seven days before the recorded end date, even if no application server is running at that time. The request may be rescheduled or canceled, and each reminder needs an audit trail. What managed design fits?
- Create a one-time Amazon EventBridge Scheduler schedule per subscription reminder, point it at an authorized target and update or delete it when the deadline changes.
- Use a recurring daily Scheduler rule for every subscription and let the reminder fire on all dates, ignoring the one-time end-date requirement.
- Configure a CloudFront cache invalidation and assume it invokes the reminder at the subscription deadline.
- Keep the reminder deadline only in an EC2 instance memory timer for the next year, assuming it survives instance replacement and rescheduling.
Explanation
Correct Answer
A:EventBridge Scheduler supports one-time time-based invocations with target authorization, configurable retry and schedule lifecycle; the application should handle idempotency and record delivery results.
Incorrect Answers
B:A recurring schedule does not correspond to a one-time reminder relative to each subscriber-specific termination date.
C:A CDN invalidation manages cached content, not arbitrary future business reminders and their cancellation state.
D:An in-process timer is not durable or centrally editable after instance failures or cancellation.
Question 691
A billing account needs to send selected events to an EventBridge bus in a separate security account. The receiving account must limit event publication to the approved source principal and deliver different categories to independently owned targets. Which TWO controls together establish publication authorization and selective routing?
- Configure a resource-based policy on the receiving event bus granting PutEvents to the approved source principal, and grant the sender appropriate identity permissions.
- Create event-bus rules matching the accepted detail types and route matches to authorized target services with suitable target permissions.
- Configure a matching event rule in the destination account but omit the cross-account event-bus resource policy and sender PutEvents authorization.
- Grant the source account events:PutEvents in its own identity policy but omit any required destination event-bus resource-based permission.
- Add EventBridge archives on both event buses and assume archives themselves establish principal authorization and selective target routing.
Explanation
Correct Answer
A:A receiving event bus policy is necessary to authorize the intended cross-account publication path; the publisher also needs IAM permission for its PutEvents operation.
B:Rules match and deliver the published events to the intended targets; the target policies and roles must allow the matched delivery.
Incorrect Answers
C:A receiving event rule cannot grant an unapproved external sender the permission to publish to the destination bus.
D:For cross-account publishing, a source identity allow by itself is insufficient if the receiving bus does not authorize that principal.
E:An archive retains events for replay and does not replace publisher trust or matching target rules.
Question 692
A modernization project must forward a small subset of well-formed domain events to an external SaaS REST endpoint. The SaaS requires an OAuth client-credentials connection, imposes a known request-rate limit, and the team wants managed event matching rather than custom polling workers. What should the architect evaluate?
- Use an ordinary EventBridge rule target pointing directly to a vendor URL without an API Destination connection for OAuth credentials or invocation rate configuration.
- Use EventBridge API Destinations with an authorized connection, matching rules, configured invocation-rate controls, and explicit retry/dead-letter handling.
- Configure an API Destination with an API key when the vendor requires OAuth client credentials and refuse to manage the appropriate secret connection.
- Use SQS message retention as the only delivery mechanism, without an HTTP target or consumer that can authenticate to the SaaS endpoint.
Explanation
Correct Answer
B:EventBridge API Destinations support invoking HTTPS APIs through managed connections and rate configuration; an explicit failure destination and DLQ/retry strategy are needed for durable operations.
Incorrect Answers
A:API Destinations provide the managed outbound HTTP integration, connection authentication and invocation rate controls missing from a plain unsupported URL target.
C:The authentication method must match the SaaS OAuth requirement, and its connection must handle credentials safely.
D:A durable queue can buffer events, but on its own cannot invoke an OAuth-protected external HTTP endpoint without a worker or managed destination integration.
Question 693
An asynchronously invoked Lambda function completes most media-metadata jobs successfully. Compliance now requires a downstream EventBridge bus to receive a structured record of each SUCCESSFUL invocation containing both the original request payload and function response context, without changing the function handler or making the client wait synchronously. A dead-letter queue for failures already exists. Which Lambda configuration directly supplies successful results?
- Configure the function’s asynchronous OnSuccess invocation destination to an authorized EventBridge event bus, and monitor destination delivery errors.
- Use a Lambda dead-letter queue as the only target because DLQs contain full response metadata for every successful invocation.
- Set OnFailure to an S3 bucket and assume it captures every successfully processed invocation and its response.
- Increase Lambda reserved concurrency while leaving asynchronous destination configuration empty, expecting concurrency settings to publish result events.
Explanation
Correct Answer
A:Lambda asynchronous destinations can emit success records containing request and response context to a supported EventBridge bus, subject to the function role’s events:PutEvents permission.
Incorrect Answers
B:A DLQ covers discarded/failed asynchronous invocations and does not publish success records or their response context.
C:OnFailure handles failed events; S3 destinations are failure-only and cannot replace an OnSuccess result notification.
D:Concurrency changes invocation capacity, not downstream delivery of successful invocation result records.
Question 694
A migrated fraud-screening workflow launches tens of thousands of small independent state transitions each minute, completes each execution within two minutes, and tolerates at-least-once step execution. Its team wants pay-per-use orchestration with lower per-transition overhead than a months-long auditable approval workflow. What is a suitable Step Functions option to evaluate?
- Use a Step Functions Standard workflow solely to persist each short, very high-rate fraud check for a year of idle duration, despite no long wait requirement.
- Choose a Step Functions Standard workflow solely because this high-volume short-duration workload requires executions to last for one year.
- Choose Express with non-idempotent payment charges while assuming asynchronous at-least-once step execution prevents duplicate effects automatically.
- Evaluate a Step Functions Express workflow, confirm at-least-once behavior and duration limits, and implement idempotency for nonrepeatable effects.
Explanation
Correct Answer
D:Express workflows fit high-volume short-lived orchestration with their own semantics and limits; idempotency protects side effects that might be executed more than once.
Incorrect Answers
A:Standard is durable but its long-running semantics and pricing may be unnecessary for the specified high-rate short execution workload.
B:Standard workflows are useful for durable long-running executions, but the stated high-volume short-running throughput profile favors evaluating the Express model rather than using longevity that is not needed.
C:Express workflows require idempotency where steps may run more than once; the scenario expressly tolerates that after safeguards.
Question 695
A warehouse sends a single shipment-created notification, and three independent microservices each need their own durable copy. Each service already uses SQS workers and wants to subscribe or unsubscribe without modifying the publisher. Payload content filtering is limited to stable message attributes. What low-complexity fan-out design fits?
- Publish the notification to SNS with three SQS subscriptions and appropriate topic and queue policies, optionally using subscription filter policies.
- Use a single shared SQS queue with three competing consumer groups and assume each consumer receives a separate copy of every notification.
- Write each notification to a single EC2 ephemeral file and let every service poll an unreplicated local directory.
- Use SNS direct subscriptions to only one shared SQS queue, expecting all three worker services to receive individual message copies from that queue.
Explanation
Correct Answer
A:SNS fan-out to separately subscribed SQS queues gives each independent service its own durable delivery path; policy and subscription filtering can control recipients.
Incorrect Answers
B:Workers reading one queue compete for individual messages rather than each independent service receiving its own copy.
C:An instance-local file is neither a managed event bus nor a reliable per-service queue, and loses availability during host replacement.
D:Fan-out to independent workers requires distinct subscribed queues, not one competing-consumer queue.
Question 696
A team is modernizing a batch PDF renderer into Lambda. Most files are small, but a small set requires 4 GiB of temporary writable scratch space for decompression during an invocation; the scratch data does not need to survive execution. The runtime duration remains within Lambda limits. Which configuration directly addresses the storage requirement?
- Increase Lambda deployment package size but leave the function ephemeral /tmp storage limit at its current smaller allocation.
- Configure Lambda ephemeral storage for /tmp to the necessary supported size and confirm memory, duration, and cost requirements.
- Place the files in the handler source-code directory and assume Lambda deployment packages are freely writable across requests.
- Mount an EFS filesystem solely for ephemeral scratch data that the function must not share or retain, without first evaluating supported /tmp sizing.
Explanation
Correct Answer
B:Lambda supports configurable ephemeral storage at /tmp, suitable for per-execution temporary working data within supported limits; encrypted scratch persists only with the execution environment lifecycle, not as durable business state.
Incorrect Answers
A:Deployment package size governs code distribution, not the configured writable scratch filesystem required at runtime.
C:Lambda's deployed code filesystem is not a general large writable location for scratch processing and cannot meet the 4 GiB temporary write requirement.
D:EFS is a supported alternative in some designs but adds persistent network file storage and mounting complexity unnecessary for transient 4-GiB scratch.
Question 697
A payments service currently treats a Redis-compatible in-memory data store as its authoritative ledger of unprocessed transaction-state objects. A standard cache is not sufficient: an AZ failure must not erase acknowledged state, the service needs multi-AZ durable recovery and compatible Valkey/Redis data structures with low-latency writes. Operators do not want to build a separate durable RDS source of truth just to recover lost cache entries. Which managed in-memory datastore should it evaluate?
- Use ElastiCache as a disposable cache and assume an evicted or failed cache node never loses acknowledged business records even without another source of truth.
- Store the ledger only in an EC2 process-memory map and rely on Auto Scaling to preserve its bytes after task termination.
- Use Amazon MemoryDB with a Valkey/Redis-compatible engine and Multi-AZ transactional durability, validating required API and recovery semantics.
- Use CloudFront edge caches as the authoritative writable Redis command log for transaction state in each AWS Region.
Explanation
Correct Answer
C:MemoryDB is designed as a durable Redis/Valkey-compatible in-memory primary database, with cross-AZ transaction-log durability and managed recovery.
Incorrect Answers
A:ElastiCache is normally selected as a cache backed by another authoritative source; relying on volatile cache semantics alone does not establish this ledger’s durability requirement.
B:Process memory is lost with the instance or task and supplies no multi-AZ durable transactional state store.
D:CloudFront optimizes delivery of supported cached HTTP content and is not a writable Redis/Valkey-compatible transactional database.
Question 698
A publishing platform currently runs video transcodes synchronously behind an API. Some transcodes take 45 minutes and rely on a large native media toolkit; request threads time out. The task is containerized and may need a GPU-capable worker. What modernization best decouples the web endpoint without forcing the 45-minute work into a Lambda invocation?
- Run a synchronous API Gateway integration until the 45-minute transcode finishes, assuming request timeout settings can accommodate any duration.
- Wrap every transcode in a Lambda invocation even when it exceeds the function's maximum execution duration.
- Run the GPU-dependent transcode in ECS Fargate and assume unsupported GPU task-definition parameters become available by setting a longer task timeout.
- Acknowledge after durable SQS enqueue and process with ECS container workers on appropriate EC2 capacity (GPU if required), recording status and retries separately.
Explanation
Correct Answer
D:SQS separates request acceptance from worker availability; ECS on compatible EC2 instances supports long-running, specialized/GPU workloads without Lambda duration limits.
Incorrect Answers
A:API request handling is not suited for the long batch duration and requires durable off-path work dispatch.
B:Lambda has a bounded maximum invocation duration and should not be used for a 45-minute task requiring a specialized long-running runtime.
C:ECS Fargate does not expose the required GPU parameters; GPU-capable EC2 container instances are a suitable ECS worker target.
Question 699
A marketplace migrated its source transaction data into S3 as compressed Parquet. Product analysts want occasional SQL joins and partition-filtered reports over the files, but the team does not want to run an always-on relational reporting cluster. Which modernization minimizes permanently provisioned analytics servers?
- Catalog the S3 dataset and run ad hoc SQL using Amazon Athena, applying partition pruning and suitable file layouts.
- Use provisioned Amazon Redshift clusters running continuously even though the workload is sporadic and source files are already Athena-readable Parquet in S3.
- Configure an S3 static website endpoint and send SQL JOIN commands to it through browser requests.
- Use an RDS transactional instance to import every Parquet object and process a few ad hoc reporting queries with a continuously running SQL server.
Explanation
Correct Answer
A:Athena queries supported S3 formats through a metastore without a permanently managed SQL server; partition and columnar layout help control scan cost.
Incorrect Answers
B:A managed warehouse can be useful, but permanent provisioned compute conflicts with the stated infrequent S3 lake query pattern.
C:S3 static website hosting returns objects rather than executing SQL semantics, query planning or joins.
D:Moving the whole lake into an always-on OLTP database is unnecessary for partition-pruned occasional Athena SQL.
Question 700
A mobile application uploads 2-GiB videos. The current API proxies every byte through EC2, creating bandwidth costs and timeouts. The new design must authorize each client only for its own object, prevent anonymous bucket writes, and keep newly uploaded objects unavailable to viewers until malware scanning succeeds. Which THREE controls form the appropriate direct-to-S3 architecture?
- Have the trusted API authenticate the caller and issue short-lived S3 presigned upload requests scoped to permitted object keys and operations, using multipart upload when appropriate.
- Keep the destination bucket private with restrictive bucket and identity policies, allowed encryption and key constraints, and server-side validation of object metadata and size where needed.
- On object creation, trigger asynchronous scanning and release or promote an object to a readable area only after a clean verdict, handling retries and failures.
- Allow presigned upload URLs for arbitrary bucket keys with no caller-specific key scoping, trusting the client not to overwrite another user’s objects.
- Make new uploads directly readable to the viewer distribution before scanning and rely only on later malware alerts to revoke risky files.
- Keep the bucket private but place permanent unrestricted IAM upload credentials in the mobile binary instead of issuing caller-scoped short-lived requests.
Explanation
Correct Answer
A:Scoped presigned requests offload the API data path while constraining each permitted operation; multipart and retries can accommodate large objects without long synchronous API proxy sessions.
B:Private bucket controls and correctly constrained uploads prevent arbitrary writes; client claims about content type, size or security cannot be trusted without enforceable policy and post-upload verification.
C:Event-driven scanning with quarantine prevents unvalidated uploads from being served and isolates scanner failures from the upload acknowledgment path.
Incorrect Answers
D:A valid signature without authorized object-key scoping can allow a user to upload to other tenants’ keys; the trusted API must scope each request.
E:Post-publication detection violates the explicit requirement to withhold viewer access until clean scanning results exist.
F:Embedded long-lived credentials can be extracted and reused broadly, defeating per-client upload authorization and credential containment.
AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests