This is the free Amazon SAP-C02 practice question bank —
260 of 516 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company in the United States (US) has acquired a company in Europe. Both companies use the AWS Cloud. The US company has built a new application with a microservices architecture. The US company is hosting the application across five VPCs in the us-east-2 Region. The application must be able to access resources in one VPC in the eu-west-1 Region.
However, the application must not be able to access any other VPCs.
The VPCs in both Regions have no overlapping CIDR ranges. All accounts are already consolidated in one organization in AWS Organizations.
Which solution will meet these requirements MOST cost-effectively?
A. Create one transit gateway in eu-west-1. Attach the VPCs in us-east-2 and the VPC in eu-west-1 to the transit gateway. Create the necessary route entries in each VPC so that the traffic is routed through the transit gateway.
B. Create one transit gateway in each Region. Attach the involved subnets to the regional transit gateway. Create the necessary route entries in the associated route tables for each subnet so that the traffic is routed through the regional transit gateway. Peer the two transit gateways.
C. Create a full mesh VPC peering connection configuration between all the VPCs. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.
D. Create one VPC peering connection for each VPC in us-east-2 to the VPC in eu-west-1. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.
Show Answer
Correct Answer: D
Explanation: The requirement is selective connectivity: five VPCs in us-east-2 must access exactly one VPC in eu-west-1 and no others, with the lowest cost. Inter-Region VPC peering supports direct connectivity between two VPCs in different Regions with non-overlapping CIDRs and has no hourly attachment cost (only data transfer charges). Creating one peering connection from each US VPC to the single EU VPC meets the access restriction naturally and avoids unnecessary connectivity. Transit Gateway options (A and B) add extra hourly and data processing costs and provide broader connectivity than required. A full mesh peering (C) is unnecessary and more complex. Therefore, D is the most cost-effective and appropriate solution.
Question 1
A company is designing a new website that hosts static content. The website will give users the ability to upload and download large files. According to company requirements, all data must be encrypted in transit and at rest. A solutions architect is building the solution by using Amazon S3 and Amazon CloudFront.
Which combination of steps will meet the encryption requirements? (Choose three.)
A. Turn on S3 server-side encryption for the S3 bucket that the web application uses.
B. Add a policy attribute of "aws:SecureTransport": "true" for read and write operations in the S3 ACLs.
C. Create a bucket policy that denies any unencrypted operations in the S3 bucket that the web application uses.
D. Configure encryption at rest on CloudFront by using server-side encryption with AWS KMS keys (SSE-KMS).
E. Configure redirection of HTTP requests to HTTPS requests in CloudFront.
F. Use the RequireSSL option in the creation of presigned URLs for the S3 bucket that the web application uses.
Show Answer
Correct Answer: A, C, E
Explanation: Data must be encrypted at rest and in transit. Enabling S3 server-side encryption ensures encryption at rest in the bucket. A bucket policy that denies unencrypted operations (for example, requiring encryption headers and secure transport) enforces compliance. Redirecting HTTP to HTTPS in CloudFront ensures data is encrypted in transit between users and CloudFront. Other options are incorrect or unnecessary (ACLs don’t enforce transport security, CloudFront doesn’t provide SSE-KMS at rest for origin data, and presigned URL RequireSSL is not applicable).
Question 2
A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and packages in a .zip file. The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket.
The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs. A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities. The code scans must occur only for selected Lambda functions, not all the Lambda functions.
Which combination of actions will meet these requirements? (Choose three.)
A. Activate Amazon Inspector. Start automated CVE scans.
B. Activate Lambda standard scanning and Lambda code scanning in Amazon Inspector.
C. Enable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.
D. Enable scanning in the Monitor settings of the Lambda functions that need code scans.
E. Tag Lambda functions that do not need code scans. In the tag, include a key of InspectorCodeExclusion and a value of LambdaCodeScanning.
F. Use Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the Lambda layer .zip file for code scans.
Show Answer
Correct Answer: A, B, E
Explanation: Amazon Inspector is the AWS service that provides automated vulnerability management for Lambda, including CVE detection, so it must be activated (A). To meet both requirements—CVE identification for Lambda functions and layers, and code analysis for issues such as data leaks—Amazon Inspector’s Lambda standard scanning (for dependencies and layers) and Lambda code scanning must be enabled (B). Because only a subset of Lambda functions should receive code scans, exclusion tags are used: tagging functions with InspectorCodeExclusion=LambdaCodeScanning prevents code scanning on those functions, allowing selective scanning rather than scanning all functions (E).
Question 2
A manufacturing company is building an inspection solution for its factory. The company has IP cameras at the end of each assembly line. The company has used Amazon SageMaker to train a machine learning (ML) model to identify common defects from still images.
The company wants to provide local feedback to factory workers when a defect is detected. The company must be able to provide this feedback even if the factory’s internet connectivity is down. The company has a local Linux server that hosts an API that provides local feedback to the workers.
How should the company deploy the ML model to meet these requirements?
A. Set up an Amazon Kinesis video stream from each IP camera to AWS. Use Amazon EC2 instances to take still images of the streams. Upload the images to an Amazon S3 bucket. Deploy a SageMaker endpoint with the ML model. Invoke an AWS Lambda function to call the inference endpoint when new images are uploaded. Configure the Lambda function to call the local API when a defect is detected.
B. Deploy AWS IoT Greengrass on the local server. Deploy the ML model to the Greengrass server. Create a Greengrass component to take still images from the cameras and run inference. Configure the component to call the local API when a defect is detected.
C. Order an AWS Snowball device. Deploy a SageMaker endpoint the ML model and an Amazon EC2 instance on the Snowball device. Take still images from the cameras. Run inference from the EC2 instance. Configure the instance to call the local API when a defect is detected.
D. Deploy Amazon Monitron devices on each IP camera. Deploy an Amazon Monitron Gateway on premises. Deploy the ML model to the Amazon Monitron devices. Use Amazon Monitron health state alarms to call the local API from an AWS Lambda function when a defect is detected.
Show Answer
Correct Answer: B
Explanation: The solution must run ML inference locally and continue operating when internet connectivity is unavailable. AWS IoT Greengrass is designed for edge deployments and supports offline operation, local ML inference, and direct integration with models trained in Amazon SageMaker. Deploying the model on the local Greengrass server allows the system to capture images, run defect detection on premises, and call the local API immediately when defects are detected, fully meeting the low-latency and offline requirements.
Question 3
A company is running a large containerized workload in the AWS Cloud. The workload consists of approximately 100 different services. The company uses Amazon Elastic Container Service (Amazon ECS) to orchestrate the workload.
Recently the company’s development team started using AWS Fargate instead of Amazon EC2 instances in the ECS cluster. In the past, the workload has come close to running the maximum number of EC2 instances that are available in the account.
The company is worried that the workload could reach the maximum number of ECS tasks that are allowed. A solutions architect must implement a solution that will notify the development team when Fargate reaches 80% of the maximum number of tasks.
What should the solutions architect do to meet this requirement?
A. Use Amazon CloudWatch to monitor the Sample Count statistic for each service in the ECS cluster. Set an alarm for when the math expression sample count/SERVICE_QUOTA(service)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
B. Use Amazon CloudWatch to monitor service quotas that are published under the AWS/Usage metric namespace. Set an alarm for when the math expression metric/SERVICE_QUOTA(metric)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
C. Create an AWS Lambda function to poll detailed metrics from the ECS cluster. When the number of running Fargate tasks is greater than 80, invoke Amazon Simple Email Service (Amazon SES) to notify the development team.
D. Create an AWS Config rule to evaluate whether the Fargate SERVICE_QUOTA is greater than 80. Use Amazon Simple Email Service (Amazon SES) to notify the development team when the AWS Config rule is not compliant.
Show Answer
Correct Answer: B
Explanation: Amazon CloudWatch publishes service usage and quota metrics under the AWS/Usage namespace, including ECS Fargate task usage. By creating a CloudWatch alarm that compares the current usage metric to the corresponding service quota (using a math expression) and triggering at 80%, the company can be proactively notified. Using Amazon SNS for notifications is the standard, fully managed approach and directly meets the requirement without custom code.
Question 4
A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account.
The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet.
The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account.
Which solution will meet these requirements?
A. Create a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all subnets in the application account. In the application account and the core account, deploy one EC2 instance that runs a custom VPN server. Create a VPN tunnel to access the private VPC. Update the route table in the application account.
B. Create private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route table in the core account.
C. Create VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a VPC peering connection to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
D. Create a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all subnets in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
Show Answer
Correct Answer: C
Explanation: The company must eliminate internet access while still allowing EC2 instances to reach AWS services and a private patch repository. VPC interface/gateway endpoints for AWS Systems Manager and Amazon S3 allow private connectivity without a NAT gateway or internet access. Deleting the NAT gateway prevents outbound internet traffic. A VPC peering connection provides private, non-internet connectivity from the application account to the core account VPC hosting the patch source repository, with route table updates in both accounts to enable traffic flow. Other options either still rely on internet access, use inappropriate constructs (private VIFs), or do not satisfy the connectivity requirements.
Question 5
A travel company built a web application that uses Amazon Simple Email Service (Amazon SES) to send email notifications to users. The company needs to enable logging to help troubleshoot email delivery issues. The company also needs the ability to do searches that are based on recipient, subject, and time sent.
Which combination of steps should a solutions architect take to meet these requirements? (Choose two.)
A. Create an Amazon SES configuration set with Amazon Data Firehose as the destination. Choose to send logs to an Amazon S3 bucket.
B. Enable AWS CloudTrail logging. Specify an Amazon S3 bucket as the destination for the logs.
C. Use Amazon Athena to query the logs in the Amazon S3 bucket for recipient, subject, and time sent.
D. Create an Amazon CloudWatch log group. Configure Amazon SES to send logs to the log group.
E. Use Amazon Athena to query the logs in Amazon CloudWatch for recipient, subject, and time sent.
Show Answer
Correct Answer: A, C
Explanation: Amazon SES email delivery and event details (recipient, subject, timestamps, delivery status) are captured by using an SES configuration set with an event destination such as Amazon Kinesis Data Firehose, which can deliver the logs to Amazon S3. Once the logs are stored in S3, Amazon Athena can query them using SQL to search by recipient, subject, and time sent. CloudTrail logs API calls only, and CloudWatch event publishing does not provide the required searchable email-level details for this use case.
Question 6
A company migrated to AWS and uses AWS Business Support. The company wants to monitor the cost-effectiveness of Amazon EC2 instances across AWS accounts. The EC2 instances have tags for department, business unit, and environment. Development EC2 instances have high cost but low utilization.
The company needs to detect and stop any underutilized development EC2 instances. Instances are underutilized if they had 10% or less average daily CPU utilization and 5 MB or less network I/O for at least 4 of the past 14 days.
Which solution will meet these requirements with the LEAST operational overhead?
A. Configure Amazon CloudWatch dashboards to monitor EC2 instance utilization based on tags for department, business unit, and environment. Create an Amazon EventBridge rule that invokes an AWS Lambda function to stop underutilized development EC2 instances.
B. Configure AWS Systems Manager to track EC2 instance utilization and report underutilized instances to Amazon CloudWatch. Filter the CloudWatch data by tags for department, business unit, and environment. Create an Amazon EventBridge rule that invokes an AWS Lambda function to stop underutilized development EC2 instances.
C. Create an Amazon EventBridge rule to detect low utilization of EC2 instances reported by AWS Trusted Advisor. Configure the rule to invoke an AWS Lambda function that filters the data by tags for department, business unit, and environment and stops underutilized development EC2 instances.
D. Create an AWS Lambda function to run daily to retrieve utilization data for all EC2 instances. Save the data to an Amazon DynamoDB table. Create an Amazon QuickSight dashboard that uses the DynamoDB table as a data source to identify and stop underutilized development EC2 instances.
Show Answer
Correct Answer: C
Explanation: AWS Trusted Advisor already provides a built-in cost optimization check for low-utilization EC2 instances using exactly the criteria described (≤10% average daily CPU and ≤5 MB network I/O for at least 4 of the past 14 days). Because the company has AWS Business Support, Trusted Advisor is available without additional setup. Integrating Trusted Advisor with Amazon EventBridge to trigger an AWS Lambda function allows automatic detection and stopping of underutilized development instances, with only minimal custom logic for tag filtering. This approach avoids building custom metrics analysis, dashboards, alarms, or data pipelines, resulting in the least operational overhead.
Question 7
A company is hosting an application on AWS for a project that will run for the next 3 years. The application consists of 20 Amazon EC2 On-Demand Instances that are registered in a target group for a Network Load Balancer (NLB). The instances are spread across two Availability Zones. The application is stateless and runs 24 hours a day, 7 days a week.
The company receives reports from users who are experiencing slow responses from the application. Performance metrics show that the instances are at 10% CPU utilization during normal application use. However, the CPU utilization increases to 100% at busy times, which typically last for a few hours.
The company needs a new architecture to resolve the problem of slow responses from the application.
Which solution will meet these requirements MOST cost-effectively?
A. Create an Auto Scaling group. Attach the Auto Scaling group to the target group of the NLB. Set the minimum capacity to 20 and the desired capacity to 28. Purchase Reserved Instances for 20 instances.
B. Create a Spot Fleet that has a request type of request. Set the TotalTargetCapacity parameter to 20. Set the DefaultTargetCapacityType parameter to On-Demand. Specify the NLB when creating the Spot Fleet.
C. Create a Spot Fleet that has a request type of maintain. Set the TotalTargetCapacity parameter to 20. Set the DefaultTargetCapacityType parameter to Spot. Replace the NLB with an Application Load Balancer.
D. Create an Auto Scaling group. Attach the Auto Scaling group to the target group of the NLB. Set the minimum capacity to 4 and the maximum capacity to 28. Purchase Reserved Instances for four instances.
Show Answer
Correct Answer: D
Explanation: The application is stateless, runs continuously, and experiences short peak periods. Auto Scaling resolves the latency by adding capacity only during busy hours. With normal load at ~10% CPU across 20 instances, the baseline capacity can be reduced to about 4 instances without impacting steady-state performance. Purchasing Reserved Instances only for this always-on baseline minimizes long-term cost, while scaling up to a higher maximum during peaks uses On-Demand capacity only for a few hours. This is more cost-effective over 3 years than reserving all 20 instances or relying primarily on On-Demand or Spot capacity.
Question 8
Accompany is building an application to collect and transmit sensor data from a factory. The application will use AWS IoT Core to send data from hundreds of devices to an Amazon S3 data lake. The company must enrich the data before loading the data into Amazon S3.
The application will transmit the sensor data every 5 seconds. New sensor data must be available in Amazon S3 less than 30 minutes after the application collects the data. No other applications are processing the sensor data from AWS IoT Core.
Which solution will meet these requirements MOST cost-effectively?
A. Create a topic in AWS IoT Core to ingest the sensor data. Create an AWS Lambda function to enrich the data and to write the data to Amazon S3. Configure an AWS IoT rule action to invoke the Lambda function.
B. Use AWS IoT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Firehose. Set the Kinesis Data Firehose buffering interval to 900 seconds. Use Kinesis Data Firehose to invoke an AWS Lambda function to enrich the data, Configure Kinesis Data Firehose to deliver the data to Amazon S3.
C. Create a topic in AWS IoT Core to ingest the sensor data. Configure an AWS IoT rule action to send the data to an Amazon Timestream table. Create an AWS Lambda, function to read the data from Timestream. Configure the Lambda function to enrich the data and to write the data to Amazon S3.
D. Use AWS loT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Streams. Create a consumer AWS Lambda function to process the data from Kinesis Data Streams and to enrich the data. Call the S3 PutObject API operation from the Lambda function to write the data to Amazon S3.
Show Answer
Correct Answer: B
Explanation: The most cost-effective solution is to use AWS IoT Core Basic Ingest with Amazon Kinesis Data Firehose and Lambda for enrichment. Basic Ingest reduces IoT messaging costs when no other applications consume the data. Kinesis Data Firehose is fully managed, automatically scales, batches records, and minimizes S3 PUT requests and Lambda invocations, which significantly lowers cost compared to invoking Lambda per message. A 900-second buffering interval still ensures data arrives in S3 well within the 30-minute requirement. Other options either trigger Lambda too frequently (higher cost) or introduce unnecessary services such as Timestream or Kinesis Data Streams.
$19
Get all 516 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.