This is the free Amazon SAP-C02 practice question bank —
260 of 513 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-04.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company in the United States (US) has acquired a company in Europe. Both companies use the AWS Cloud. The US company has built a new application with a microservices architecture. The US company is hosting the application across five VPCs in the us-east-2 Region. The application must be able to access resources in one VPC in the eu-west-1 Region.
However, the application must not be able to access any other VPCs.
The VPCs in both Regions have no overlapping CIDR ranges. All accounts are already consolidated in one organization in AWS Organizations.
Which solution will meet these requirements MOST cost-effectively?
A. Create one transit gateway in eu-west-1. Attach the VPCs in us-east-2 and the VPC in eu-west-1 to the transit gateway. Create the necessary route entries in each VPC so that the traffic is routed through the transit gateway.
B. Create one transit gateway in each Region. Attach the involved subnets to the regional transit gateway. Create the necessary route entries in the associated route tables for each subnet so that the traffic is routed through the regional transit gateway. Peer the two transit gateways.
C. Create a full mesh VPC peering connection configuration between all the VPCs. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.
D. Create one VPC peering connection for each VPC in us-east-2 to the VPC in eu-west-1. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.
Show Answer
Correct Answer: D
Explanation: Inter-Region VPC peering supports connectivity between VPCs in different AWS Regions. The requirement is for five VPCs in us-east-2 to access exactly one VPC in eu-west-1 and no others. Creating one inter-Region VPC peering connection from each of the five US VPCs to the single Europe VPC satisfies this while preserving isolation. Transit Gateway would add unnecessary cost and complexity, and a full mesh of peerings would create connectivity beyond what is required.
Question 1
A company is currently in the design phase of an application that will need an RPO of less than 5 minutes and an RTO of less than 10 minutes. The solutions architecture team is forecasting that the database will store approximately 10 TB of data. As part of the design, they are looking for a database solution that will provide the company with the ability to fail over to a secondary Region.
Which solution will meet these business requirements at the LOWEST cost?
A. Deploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. Once a snapshot is complete, copy the snapshot to a secondary Region to serve as a backup in the event of a failure.
B. Deploy an Amazon RDS instance with a cross-Region read replica in a secondary Region. In the event of a failure, promote the read replica to become the primary.
C. Deploy an Amazon Aurora DB cluster in the primary Region and another in a secondary Region. Use AWS DMS to keep the secondary Region in sync.
D. Deploy an Amazon RDS instance with a read replica in the same Region. In the event of a failure, promote the read replica to become the primary.
Show Answer
Correct Answer: B
Explanation: A cross-Region Amazon RDS read replica provides continuous asynchronous replication to a secondary Region, allowing promotion during a regional failure. This is the lowest-cost option that satisfies the requirement for cross-Region failover with an RPO under a few minutes in typical operation and an RTO under 10 minutes. Snapshot copy/restore is too slow for a 10 TB database, Aurora plus DMS is more expensive than needed, and a same-Region read replica does not provide cross-Region failover.
Question 2
A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and packages in a .zip file. The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket.
The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs. A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities. The code scans must occur only for selected Lambda functions, not all the Lambda functions.
Which combination of actions will meet these requirements? (Choose three.)
A. Activate Amazon Inspector. Start automated CVE scans.
B. Activate Lambda standard scanning and Lambda code scanning in Amazon Inspector.
C. Enable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.
D. Enable scanning in the Monitor settings of the Lambda functions that need code scans.
E. Tag Lambda functions that do not need code scans. In the tag, include a key of InspectorCodeExclusion and a value of LambdaCodeScanning.
F. Use Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the Lambda layer .zip file for code scans.
Show Answer
Correct Answer: A, B, E
Explanation: Amazon Inspector must be activated to perform Lambda vulnerability assessments. Enable both Lambda standard scanning (to identify CVEs in Lambda functions and layers) and Lambda code scanning (to detect issues such as hardcoded secrets and potential data leaks). Because only a subset of functions should receive code scanning, exclude the others by tagging them with InspectorCodeExclusion=LambdaCodeScanning. GuardDuty Lambda Protection is for runtime threat detection, not CVE/code scanning. Lambda Monitor settings are not how Inspector code scanning is selectively enabled. Inspector does not perform Lambda code scanning by scanning the S3 bucket that stores deployment packages.
Question 2
A company is migrating an application from on-premises infrastructure to the AWS Cloud. During migration design meetings, the company expressed concerns about the availability and recovery options for its legacy Windows file server. The file server contains sensitive business-critical data that cannot be recreated in the event of data corruption or data loss. According to compliance requirements, the data must not travel across the public internet. The company wants to move to AWS managed services where possible.
The company decides to store the data in an Amazon FSx for Windows File Server file system. A solutions architect must design a solution that copies the data to another AWS Region for disaster recovery (DR) purposes.
Which solution will meet these requirements?
A. Create a destination Amazon S3 bucket in the DR Region. Establish connectivity between the FSx for Windows File Server file system in the primary Region and the S3 bucket in the DR Region by using Amazon FSx File Gateway. Configure the S3 bucket as a continuous backup source in FSx File Gateway.
B. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC the primary Region and the VPC in the DR Region by using AWS Site-to-Site VPN. Configure AWS DataSync to communicate by using VPN endpoints.
C. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using VPC peering. Configure AWS DataSync to communicate by using interface VPC endpoints with AWS PrivateLink.
D. Create an FSx for Windows File Server file system in the DR Region. Establish connectivity between the VPC in the primary Region and the VPC in the DR Region by using AWS Transit Gateway in each Region. Use AWS Transfer Family to copy files between the FSx for Windows File Server file system in the primary Region and the FSx for Windows File Server file system in the DR Region over the private AWS backbone network.
Show Answer
Correct Answer: C
Explanation: The best match is to deploy a second Amazon FSx for Windows File Server in the DR Region and use AWS DataSync for replication. Cross-Region VPC peering provides private connectivity between the VPCs, and DataSync can use interface VPC endpoints (AWS PrivateLink) so data stays on the AWS network rather than traversing the public internet. The other options misuse services (FSx File Gateway, Transfer Family), rely on unnecessary VPNs, or do not represent the recommended architecture.
Question 3
A company is running a large containerized workload in the AWS Cloud. The workload consists of approximately 100 different services. The company uses Amazon Elastic Container Service (Amazon ECS) to orchestrate the workload.
Recently the company’s development team started using AWS Fargate instead of Amazon EC2 instances in the ECS cluster. In the past, the workload has come close to running the maximum number of EC2 instances that are available in the account.
The company is worried that the workload could reach the maximum number of ECS tasks that are allowed. A solutions architect must implement a solution that will notify the development team when Fargate reaches 80% of the maximum number of tasks.
What should the solutions architect do to meet this requirement?
A. Use Amazon CloudWatch to monitor the Sample Count statistic for each service in the ECS cluster. Set an alarm for when the math expression sample count/SERVICE_QUOTA(service)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
B. Use Amazon CloudWatch to monitor service quotas that are published under the AWS/Usage metric namespace. Set an alarm for when the math expression metric/SERVICE_QUOTA(metric)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
C. Create an AWS Lambda function to poll detailed metrics from the ECS cluster. When the number of running Fargate tasks is greater than 80, invoke Amazon Simple Email Service (Amazon SES) to notify the development team.
D. Create an AWS Config rule to evaluate whether the Fargate SERVICE_QUOTA is greater than 80. Use Amazon Simple Email Service (Amazon SES) to notify the development team when the AWS Config rule is not compliant.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch publishes AWS service usage metrics in the AWS/Usage namespace, which can be compared against Service Quotas by using the SERVICE_QUOTA metric math function. Creating a CloudWatch alarm on usage reaching 80% of the Fargate task quota and sending notifications through Amazon SNS is the native AWS solution. The other options either monitor the wrong metric, require unnecessary custom code, or misuse AWS Config for quota monitoring.
Question 3
An enterprise company is building an infrastructure services platform for its users. The company has the following requirements:
• Provide least privilege access to users when launching AWS infrastructure so users cannot provision unapproved services.
• Use a central account to manage the creation of infrastructure services.
• Provide the ability to distribute infrastructure services to multiple accounts in AWS Organizations.
• Provide the ability to enforce tags on any infrastructure that is started by users.
Which combination of actions using AWS services will meet these requirements? (Choose three.)
A. Develop infrastructure services using AWS CloudFormation templates. Add the templates to a central Amazon S3 bucket and add the IAM roles or users that require access to the S3 bucket policy.
B. Develop infrastructure services using AWS CloudFormation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the Organizations structure created for the company.
C. Allow user IAM roles to have AWSCloudFormationFullAccess and AmazonS3ReadOnlyAccess permissions. Add an Organizations SCP at the AWS account root user level to deny all services except AWS CloudFormation and Amazon S3.
D. Allow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an automation script to import the central portfolios to local AWS accounts, copy the TagOption, assign users access, and apply launch constraints.
E. Use the AWS Service Catalog TagOption Library to maintain a list of tags required by the company. Apply the TagOption to AWS Service Catalog products or portfolios.
F. Use the AWS CloudFormation Resource Tags property to enforce the application of tags to any CloudFormation templates that will be created for users.
Show Answer
Correct Answer: B, D, E
Explanation: AWS Service Catalog is designed to provide approved infrastructure products with least-privilege access. CloudFormation templates are packaged as Service Catalog products and shared through portfolios across AWS Organizations (B). End users should receive ServiceCatalogEndUserAccess, while launch constraints and portfolio sharing/import support centralized management and controlled provisioning across accounts (D). TagOption Library allows administrators to define and apply approved tags to products and portfolios, helping enforce tagging for provisioned resources (E). Options A and C bypass Service Catalog's governance model, and F only defines tags within templates rather than providing centralized enforcement for approved products.
Question 4
A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account.
The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet.
The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account.
Which solution will meet these requirements?
A. Create a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all subnets in the application account. In the application account and the core account, deploy one EC2 instance that runs a custom VPN server. Create a VPN tunnel to access the private VPC. Update the route table in the application account.
B. Create private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route table in the core account.
C. Create VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a VPC peering connection to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
D. Create a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all subnets in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
Show Answer
Correct Answer: C
Explanation: The application VPC must have no internet access, so removing the NAT gateway and using VPC endpoints for Systems Manager (interface endpoints) and Amazon S3 (gateway endpoint) provides private access to those AWS services. To reach the patch source repository hosted on EC2 instances in a private VPC in another account, private VPC connectivity is required. A VPC peering connection between the application VPC and the core VPC, with appropriate route table updates, satisfies this requirement. The other options rely on unnecessary or incorrect networking constructs (custom VPN, Direct Connect private VIFs) or do not provide the required private access to Systems Manager/S3.
Question 4
A company has a website that serves many visitors. The company deploys a backend service for the website in a primary AWS Region and a disaster recovery (DR) Region.
A single Amazon CloudFront distribution is deployed for the website. The company creates an Amazon Route 53 record set with health checks and a failover routing policy for the primary Region’s backend service. The company configures the Route 53 record set as an origin for the CloudFront distribution. The company configures another record set that points to the backend service's endpoint in the DR Region as a secondary failover record type. The TTL for both record sets is 60 seconds.
Currently, failover takes more than 1 minute. A solutions architect must design a solution that will provide the fastest failover time.
Which solution will achieve this goal?
A. Deploy an additional CloudFront distribution. Create a new Route 53 failover record set with health checks for both CloudFront distributions.
B. Set the TTL to 4 second for the existing Route 53 record sets that are used for the backend service in each Region.
C. Create new record sets for the backend services by using a latency routing policy. Use the record sets as an origin in the CloudFront distribution.
D. Create a CloudFront origin group that includes two origins, one for each backend service Region. Configure origin failover as a cache behavior for the CloudFront distribution.
Show Answer
Correct Answer: D
Explanation: CloudFront origin failover (origin groups) performs failover at the edge when the primary origin returns configured failure status codes or is unreachable, avoiding DNS TTL and Route 53 health check propagation delays. Lowering TTL alone does not eliminate health check detection time and increases DNS query volume. A second CloudFront distribution or latency routing does not provide faster origin failover for this architecture.
Question 5
A travel company built a web application that uses Amazon Simple Email Service (Amazon SES) to send email notifications to users. The company needs to enable logging to help troubleshoot email delivery issues. The company also needs the ability to do searches that are based on recipient, subject, and time sent.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
A. Create an Amazon SES configuration set with Amazon Data Firehose as the destination. Choose to send logs to an Amazon S3 bucket.
B. Enable AWS CloudTrail logging. Specify an Amazon S3 bucket as the destination for the logs.
C. Use Amazon Athena to query the logs in the Amazon S3 bucket for recipient, subject, and time sent.
D. Create an Amazon CloudWatch log group. Configure Amazon SES to send logs to the log group.
E. Use Amazon Athena to query the logs in Amazon CloudWatch for recipient, subject, and time sent.
Show Answer
Correct Answer: A, C
Explanation: Amazon SES event publishing uses a configuration set with a Kinesis Data Firehose destination to stream detailed email event data to Amazon S3. Amazon Athena can then query the data in S3 by fields such as recipient, subject, and timestamp. CloudTrail logs API activity rather than email delivery events, SES does not directly publish the required searchable event logs to CloudWatch Logs for this use case, and Athena queries S3 data rather than CloudWatch Logs natively for this scenario.
Question 5
A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for development accounts that developers use to experiment on AWS. The company has hundreds of developers, and each developer has an individual development account.
The company wants to optimize costs in these development accounts. Amazon EC2 instances and Amazon RDS instances in these accounts must be burstable. The company wants to disallow the use of other services that are not relevant.
What should a solutions architect recommend to meet these requirements?
A. Create a custom SCP in AWS Organizations to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the SCP to the development OU.
B. Create a custom detective control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
C. Create a custom preventive control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
D. Create an AWS Config rule in the AWS Control Tower account. Configure the AWS Config rule to allow the deployment of only burstable instances and to disallow services that are not relevant. Deploy the AWS Config rule to the development OU by using AWS CloudFormation StackSets.
Show Answer
Correct Answer: A
Explanation: AWS Control Tower does not support creating arbitrary custom preventive controls for this use case. Custom preventive governance is implemented by attaching your own SCPs to the development OU. An SCP can deny non-burstable EC2 instance types using condition keys and deny access to irrelevant services. AWS Config and detective controls are not preventive.
$19
Get all 513 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.