Prepare for the SAP-C02 AWS Certified Solutions Architect - Professional Exam

Free SAP-C02 Practice Questions (With Answers)

5 real questions from the SAP-C02 bank, with the full explanation for each answer. No sign-up needed to read them.

1. Question 1Design for Organizational Complexity [Hybrid DNS Strategy]

   A company has a large on-premises data center connected to an AWS VPC in `us-east-1` via a primary 10 Gbps AWS Direct Connect connection, with an AWS Site-to-Site VPN as a backup. The on-premises network uses an internal DNS server for resolving `corp.internal` hostnames. Applications on EC2 instances in the VPC need to resolve both public domains and the internal `corp.internal` hostnames. On-premises servers also need to resolve hostnames of EC2 instances in the VPC. Which combination of services provides the MOST resilient and manageable solution for this hybrid DNS requirement?

   • A.Configure the VPC's DHCP options set to use the on-premises DNS server. Create a secondary Direct Connect connection for DNS query resilience.
   • B.Use Amazon Route 53 private hosted zones for the VPC resources. Manually update the on-premises DNS server with A records for all EC2 instances.
   • C.Deploy a fleet of EC2 instances running a third-party DNS software in the VPC. Configure these instances to forward queries to either the on-premises DNS or public resolvers.
   • D.Deploy Amazon Route 53 Resolver inbound and outbound endpoints. Configure forwarding rules to direct queries for `corp.internal` to the on-premises DNS server, and configure the on-premises DNS server to forward queries for VPC resources to the inbound endpoint.
   Show answer and explanation

   Correct answer: D

   Correct. This solution leverages the purpose-built AWS service for hybrid DNS. The fundamental principle is to create a secure, two-way bridge. An outbound endpoint allows VPC resources to resolve on-premises names by conditionally forwarding queries, while an inbound endpoint allows on-premises to resolve cloud resources. This is a resilient, manageable, and centrally controlled architecture.

   Why the other options are wrong

   A. Incorrect. The first principle of a resilient hybrid architecture is to avoid making cloud resources dependent upon on-premises components. Pointing the entire VPC to an on-premises DNS server creates a single point of failure; if the Direct Connect link or the on-premises server fails, DNS resolution for all VPC resources would be compromised.

   B. Incorrect. A core principle of cloud operational excellence is automation. Manually updating DNS records for ephemeral cloud resources like EC2 instances is not a scalable or manageable solution. This approach is prone to human error and would result in stale records, violating best practices.

   C. Incorrect. A first principle of cloud architecture is to prefer managed services to reduce undifferentiated heavy lifting. Managing a fleet of EC2 instances for DNS introduces operational overhead for patching, scaling, and high availability, which a managed service like Route 53 Resolver handles automatically.

2. Question 2Cost Control [Multi-Account Governance]

   A company is establishing a new, large-scale AWS environment and wants to enforce a strong governance model from the start. The requirements are to automate the creation of a secure, multi-account structure with a predefined set of organizational units (OUs), establish centralized logging and auditing, and apply preventive guardrails to all accounts to block non-compliant actions (e.g., disabling CloudTrail or making S3 buckets public). Which AWS service is designed to automate the setup of this entire well-architected landing zone?

   • A.AWS Organizations with manually configured Service Control Policies (SCPs).
   • B.AWS CloudFormation StackSets to deploy resources across multiple accounts.
   • C.AWS Service Catalog to provide pre-approved products for developers.
   • D.AWS Control Tower.
   Show answer and explanation

   Correct answer: D

   Correct. The fundamental purpose of AWS Control Tower is to automate the setup of a secure, compliant, multi-account AWS environment (a 'landing zone'). It orchestrates services like Organizations, IAM Identity Center, and Config to provide a turnkey solution with pre-configured OUs, centralized logging, and guardrails, perfectly aligning with the requirement for an automated, well-architected start.

   Why the other options are wrong

   A. Incorrect. While Organizations and SCPs are the foundational components, the principle of operational excellence favors automation over manual configuration. Manually setting up OUs, logging, and guardrails across multiple services is complex and error-prone.

   B. Incorrect. StackSets is a tool for deploying resources *into* an existing account structure. It does not create the foundational OUs, centralized logging accounts, or orchestrate the various governance services into a cohesive landing zone.

   C. Incorrect. Service Catalog governs what can be deployed *within* accounts. It does not establish the foundational multi-account environment or its overarching guardrails. It is a tool used within a landing zone, not the tool that creates it.

3. Question 3Design for Organizational Complexity [Resource Sharing Model]

   A company has a central networking account that contains shared resources, including a Transit Gateway and specific subnets intended for shared services like Active Directory. They need to allow other AWS accounts within their AWS Organization to attach their VPCs to the central Transit Gateway and launch resources into the shared subnets. What is the most secure and scalable way to enable this resource sharing?

   • A.Create IAM cross-account roles in the networking account to allow other accounts to access the resources.
   • B.Use VPC Peering to connect each VPC to the central networking VPC.
   • C.Use AWS Resource Access Manager (RAM).
   • D.Configure a VPC endpoint service in the networking account and have other accounts connect to it.
   Show answer and explanation

   Correct answer: C

   Correct. The fundamental purpose of AWS RAM is to enable secure sharing of AWS resources across accounts. It is the standard, purpose-built service for sharing a Transit Gateway and VPC subnets, allowing other accounts to use these resources as if they were their own, in a managed and scalable way.

   Why the other options are wrong

   A. Incorrect. The fundamental purpose of IAM roles is to grant permissions to perform API actions. They do not provide the mechanism for one account's VPC to attach to another account's Transit Gateway or for an EC2 instance to be launched into another account's subnet.

   B. Incorrect. VPC Peering would not allow other accounts to launch resources *into* the shared subnets of the central VPC. Also, Transit Gateway is already in place, making peering a redundant and less scalable option.

   D. Incorrect. The fundamental purpose of a VPC endpoint service is to privately expose a *service* (like an application on an NLB) to other VPCs. It is not used for sharing foundational network infrastructure like a Transit Gateway or subnets.

4. Question 4Design for Organizational Complexity [Disaster Recovery with AWS DRS]

   A company is running a business-critical application on-premises and needs to establish a disaster recovery site in AWS. The RTO is 15 minutes, and the RPO is less than 1 minute. The application consists of several servers that must be recovered together in a consistent state. The company wants a managed AWS service that minimizes the operational burden of the DR process. Which AWS service is MOST suitable for this use case?

   • A.AWS Backup with cross-region copy.
   • B.AWS Application Migration Service (MGN).
   • C.AWS Elastic Disaster Recovery (DRS).
   • D.Manually scripting the replication of servers using EBS direct APIs and Lambda.
   Show answer and explanation

   Correct answer: C

   Correct. The fundamental purpose of AWS DRS is to provide managed disaster recovery for physical, virtual, and cloud-based servers into AWS. It uses continuous, block-level replication to achieve RPOs of seconds and automates recovery to achieve RTOs of minutes, directly matching the requirements for a low RTO/RPO, managed DR solution.

   Why the other options are wrong

   A. Incorrect. The fundamental purpose of AWS Backup is data protection, not rapid system recovery. Its RTO/RPO capabilities are measured in hours, not minutes, making it unsuitable for this requirement.

   B. Incorrect. The fundamental purpose of MGN is *migration* (a one-way trip to AWS). While it uses similar technology, it is not designed or priced for ongoing disaster recovery readiness.

   D. Incorrect. This violates the principle of using managed services to reduce undifferentiated heavy lifting. A custom solution would be complex, less reliable, and difficult to maintain.

5. Question 5Cost Control [Cost and Usage Monitoring]

   A company stores petabytes of data across hundreds of Amazon S3 buckets in many accounts. Storage costs are high, and the CTO wants organization-wide visibility into usage and activity—by bucket, prefix, and storage class—to find cold data and cost-saving opportunities. **Constraints:** (1) organization-wide visibility across hundreds of buckets and many accounts; (2) drill-down by bucket/prefix/storage class with activity and cost insights; (3) a managed dashboard, not a custom-built one.

   • A.Enable Amazon Macie on every bucket to classify the data and infer which objects are cold and can be moved to cheaper storage classes.
   • B.Enable S3 Storage Lens with advanced metrics across the organization to get dashboards and drill-down analytics by bucket, prefix, and storage class.
   • C.Enable S3 server access logging on every bucket and write custom Athena queries over the logs to compute per-bucket usage and cost.
   • D.Turn on S3 Inventory reports for each bucket and manually compile the object listings into a spreadsheet for the CTO to review.
   Show answer and explanation

   Correct answer: B

   Correct. S3 Storage Lens provides organization-wide, account- and bucket-level visibility with advanced metrics, surfacing cold data, retrieval patterns, and cost-optimization opportunities in a managed dashboard—exactly the cross-account analysis the CTO wants.

   Why the other options are wrong

   A. Incorrect. Macie discovers and classifies sensitive data for security and privacy; it is not a storage-cost and usage analytics service and would be an expensive, ill-fitting tool for cost optimization.

   C. Incorrect. Server access logs plus custom Athena queries is a high-effort, build-it-yourself approach; the requirement asks for a managed dashboard, which Storage Lens provides natively.

   D. Incorrect. S3 Inventory lists objects and metadata but provides no usage/activity analytics or cross-account dashboards, and manual spreadsheet compilation does not scale to hundreds of buckets.