Drill SAP-C02 · sore 2026-09-29

Set #1 · fokus Domain 2 · 10 soal · pilih jawaban lalu tekan Periksa

1Domain 2

A company runs its order database on Amazon RDS for MySQL as a Multi-AZ DB instance deployment. The analytics team now runs heavy reporting queries against the primary, which drives up CPU and slows down transactions. The company must offload the read traffic and also keep automatic failover, ideally faster than the current failover time, while making as few application changes as possible. Which solution meets these requirements?

A.Point the reporting tool at the endpoint of the existing standby instance in the second AZ.B.Deploy an Amazon ElastiCache for Redis cluster in front of the database and cache all reporting query results.C.Convert to an RDS Multi-AZ DB cluster deployment and point the reporting tool at the cluster's reader endpoint.D.Migrate to an Amazon Aurora global database and send reporting queries to a secondary Region.

2Domain 2

An e-commerce platform publishes an "order placed" event that the inventory, billing, and analytics services each need to process independently. When the analytics service goes down, the other services must not be affected, and no events can be lost while it recovers. The solution must scale automatically during sales events. Which architecture meets these requirements?

A.Publish events to an Amazon SNS topic and subscribe a separate Amazon SQS queue for each service. Each service polls its own queue.B.Publish events to one Amazon SQS standard queue and have all three services poll that same queue.C.Send events through an Application Load Balancer with a separate target group for each service.D.Have the order service call each downstream service synchronously through Amazon API Gateway, with retries.

3Domain 2

A financial services company stores regulated data in Amazon S3 and must use SSE-KMS. A new compliance requirement says the encryption keys must be generated and stored in single-tenant HSMs that are under the company's exclusive control. The company wants to keep using native S3 and AWS KMS integration without changing the application. Which solution meets these requirements?

A.Create a KMS customer managed key with imported key material generated in an on-premises HSM.B.Deploy an AWS CloudHSM cluster and change the application to do client-side encryption with the CloudHSM SDK before uploading to S3.C.Create a KMS multi-Region customer managed key and turn on automatic key rotation.D.Create an AWS KMS custom key store backed by an AWS CloudHSM cluster, and use a KMS key from that store for SSE-KMS.

4Domain 2Choose 2

Amazon EC2 instances in private subnets need to reach Amazon S3 and Amazon SQS. Security policy forbids traffic from crossing the internet, and the company wants the MOST cost-effective solution. Which combination of actions meets these requirements? (Choose TWO)

A.Create an interface VPC endpoint for S3 and add a route to that endpoint in the private route tables.B.Create a gateway VPC endpoint for S3 and associate it with the private subnets' route tables.C.Create a gateway VPC endpoint for SQS and add it to the private route tables.D.Deploy a NAT gateway in each AZ and route S3 and SQS traffic through it.E.Create an interface VPC endpoint for SQS in each AZ, turn on private DNS, and allow HTTPS from the instances in its security group.

5Domain 2

A company uses AWS Organizations with more than 150 accounts. The security team must deploy a baseline (an IAM role, a CloudTrail configuration, and an SNS alerting topic) to every account in the Workloads OU across three Regions. Accounts created in that OU later must receive the baseline automatically, with the LEAST operational overhead. Which solution meets these requirements?

A.Create a CloudFormation nested stack in the management account that contains a child stack for each account.B.Use CloudFormation StackSets with service-managed permissions, target the Workloads OU, and turn on automatic deployment.C.Deploy an AWS Config conformance pack to the organization.D.Build a CodePipeline pipeline in each account that deploys the baseline template whenever the repository changes.

6Domain 2

A team deploys a critical AWS Lambda function several times a week. Each new version must receive 10% of traffic for 10 minutes before a full rollout. If a CloudWatch error alarm fires during that window, traffic must roll back automatically without anyone stepping in. Which approach meets these requirements with the LEAST custom code?

A.Use an API Gateway stage canary release set to 10% traffic, then promote the canary manually.B.Write a script that updates the Lambda alias's weighted routing and polls CloudWatch to decide whether to roll back.C.Update the function in place through CloudFormation, with rollback triggers tied to the CloudWatch alarm.D.Use AWS SAM with AutoPublishAlias and a CodeDeploy DeploymentPreference of Canary10Percent10Minutes, linked to the CloudWatch alarm.

7Domain 1

A company uses AWS Organizations (without AWS Control Tower) with 200 accounts. For data residency, no account may create or use resources outside eu-west-1 and eu-central-1. Global services such as IAM, Route 53, and CloudFront must keep working. The solution must be preventive and have the LEAST operational overhead. Which solution meets these requirements?

A.Attach an SCP at the root with a Deny statement, NotAction for the global services, and a condition on aws:RequestedRegion that allows only the two Regions.B.Apply an IAM permissions boundary to every IAM role and user in all accounts that allows only the two Regions.C.Deploy an AWS Config rule across the organization that detects resources in other Regions, with automatic remediation to delete them.D.Use Amazon EventBridge in every account to catch API calls in other Regions and trigger Lambda to revoke the sessions.

8Domain 3

A gaming company runs multiplayer servers on UDP behind Network Load Balancers in us-east-1 and ap-southeast-1. Players around the world need the lowest possible latency and static IP addresses to allowlist. If one Region fails, traffic must move to the other in seconds, without waiting on clients' DNS caches. Which solution meets these requirements?

A.Put an Amazon CloudFront distribution in front of both NLBs as origins, using an origin group for failover.B.Use Route 53 latency-based routing with health checks and a 60-second TTL.C.Deploy AWS Global Accelerator with one endpoint group per Region pointing at each NLB.D.Use Route 53 geolocation routing, with Elastic IP addresses on the NLBs.

9Domain 4

A company must migrate a 60 TB on-premises NFS file share to Amazon EFS within 4 weeks. It has a 1 Gbps internet link, but only 70% of it can be used during business hours. Users will keep changing files until cutover, so the migration needs incremental syncs and data integrity verification, with the LEAST operational overhead. Which solution meets these requirements?

A.Order an AWS Snowball Edge device, copy the data, ship it back, and then rsync the changes before cutover.B.Deploy an AWS DataSync agent on premises, create a task from NFS to EFS with bandwidth throttling, and run incremental syncs until cutover.C.Deploy an Amazon S3 File Gateway and point users at the new share during the transition.D.Write rsync scripts on an on-premises server that copy to EFS over a VPN, and schedule them with cron.

10Domain 3

A company runs a steady 24/7 compute workload that spends about $40,000 per month. The workload runs on EC2 across several instance families in two Regions. The company is also moving part of the workload to AWS Fargate and AWS Lambda over the next year, and it may change instance families. It is ready to commit for 3 years. Which purchase option gives the largest savings while staying flexible?

A.EC2 Instance Savings Plans for each instance family in each Region.B.Standard Reserved Instances with regional scope for the current instance types.C.Compute Savings Plans sized to the baseline hourly spend.D.Convertible Reserved Instances that get exchanged whenever the instance family changes.

📝 Drill SAP-C02 — sore 2026-09-29