SAP-C03 practice questions and answers

Question 1 · Domain 1 · Skill 1.1.1

A media company stores uploaded video files in an Amazon S3 bucket. An existing S3 event notification invokes an AWS Lambda function for all ObjectCreated events under the uploads/ prefix to generate thumbnails. A new compliance team must now run its own scanning workflow for the same objects, but only for files larger than 1 GB. A third team plans to add another consumer next quarter. The producers must not be changed, and each consumer must be added independently. Which solution meets these requirements with the LEAST operational overhead?

1. AAdd a second S3 event notification configuration on the bucket for ObjectCreated events under the uploads/ prefix that invokes the compliance Lambda function, and skip objects under 1 GB in the function code.
2. BModify the thumbnail Lambda function to check each object's size and asynchronously invoke the compliance team's function, passing the bucket and key, whenever an object exceeds 1 GB.
3. CTurn on Amazon EventBridge for the bucket, and give each consumer its own rule that matches Object Created events with the uploads/ key prefix, adding a numeric object-size condition to the compliance rule.
4. DConfigure S3 Same-Region Replication of the uploads/ prefix to a bucket owned by the compliance team, and add an S3 event notification on that bucket that invokes the compliance team's scanning workflow.

Question 2 · Domain 1 · Skill 1.1.3New in SAP-C03

A retail company collects clickstream events as JSON records from its website at roughly 5,000 records per second. Analysts query the data with Amazon Athena and need new data to be queryable within 10 minutes. To reduce Athena cost, the data must be stored in Amazon S3 in Apache Parquet format and partitioned by event date and country. The team has no capacity to manage servers or stream-processing applications. Which solution meets these requirements with the LEAST operational overhead?

1. AWrite records to Amazon Kinesis Data Streams, and run a Kinesis Client Library application on an EC2 Auto Scaling group that converts each batch to Parquet and writes it to date and country prefixes.
2. BSend records to Amazon Data Firehose with record format conversion to Parquet that uses an AWS Glue Data Catalog table schema, and enable dynamic partitioning on date and country.
3. CHave an AWS Lambda function write each incoming record as an individual JSON object to S3, and run an AWS Glue job every night that converts the day's objects to partitioned Parquet.
4. DWrite records to Amazon Kinesis Data Streams, and run a persistent Amazon EMR cluster with Spark Structured Streaming that writes Parquet files partitioned by date and country to S3.

Question 3 · Domain 1 · Skill 1.1.5

A company uses AWS Organizations with more than 300 accounts, and new accounts are created every week. Applications in every account publish custom business events to the default event bus in their own account. A central analytics account must receive all events whose source begins with com.company. on a custom event bus. The security team requires that only accounts in the organization can send events to the central bus, and new accounts must be onboarded automatically. Which combination of steps meets these requirements with the LEAST operational overhead? (Choose TWO.)

1. AIn the central account, create a rule on the custom event bus whose event pattern matches the account IDs of all member accounts and the com.company. source prefix.
2. BAttach a resource-based policy to the central event bus that allows events:PutEvents with an aws:PrincipalOrgID condition for the organization ID.
3. CUse AWS CloudFormation StackSets with service-managed permissions and automatic deployment to create, in every member account, a rule and IAM role that forward matching events to the central bus.
4. DAdd each member account ID as a principal in the central event bus policy, and update the policy from an AWS Lambda function that runs on each Organizations CreateAccount event.
5. ECreate an Amazon SQS queue in each member account that receives the matching events, and have a central AWS Lambda function poll all queues and publish the events to the central bus.

Question 4 · Domain 1 · Skill 1.1.7New in SAP-C03

A company has microservices spread across 15 AWS accounts. The services run on Amazon EC2, Amazon EKS, and AWS Lambda, and several VPCs use overlapping CIDR ranges that cannot be renumbered in the short term. The company needs service-to-service connectivity across accounts, request-level authorization based on the caller's IAM identity, and centralized access logs, without deploying sidecar proxies. Which solution meets these requirements with the LEAST operational overhead?

1. ACreate a VPC Lattice service network, share it with the other accounts through AWS RAM, register each service as a Lattice service, associate the VPCs, and attach IAM auth policies.
2. BAttach all VPCs to an AWS Transit Gateway shared through AWS RAM, place an internal Application Load Balancer in front of each service, and restrict access with security groups.
3. CCreate VPC peering connections between every pair of VPCs that need to communicate, enable private DNS resolution across them, and restrict access with security groups.
4. DFront each service with a Network Load Balancer, publish it as a VPC endpoint service, and create interface VPC endpoints for it in every consuming VPC across the accounts.

Question 5 · Domain 1 · Skill 1.1.10New in SAP-C03

A company runs 35 microservices on Amazon EKS. Each team created its own Kubernetes Ingress resource in its own namespace, and the AWS Load Balancer Controller provisioned a separate internet-facing Application Load Balancer for each Ingress. All services share the same parent domain and differ only by host name or path. The finance team wants to reduce load balancer costs. The platform team wants each team to keep managing its own Ingress resources independently. Which solution meets these requirements with the LEAST operational overhead?

1. AChange each microservice to a Kubernetes Service of type LoadBalancer so that the AWS Load Balancer Controller provisions Network Load Balancers instead.
2. BExpose each microservice as a NodePort Service, and have the platform team register the node ports in one shared ALB and maintain its listener rules.
3. CReplace the Ingress resources with a single Amazon API Gateway REST API that reaches each microservice through a private integration over a VPC link.
4. DAdd the same alb.ingress.kubernetes.io/group.name annotation to every team's Ingress so that the AWS Load Balancer Controller merges them into one ALB.

Question 6 · Domain 1 · Skill 1.1.13New in SAP-C03

A B2B SaaS provider stores data for 900 tenants in a single Amazon Aurora PostgreSQL cluster. Every table has a tenant_id column, and microservices connect with a shared database role. The provider must guarantee that queries return only the current tenant's rows even if a developer omits a WHERE clause. It wants to keep the pooled model to control cost. The tenant ID is available from each request's validated JWT. Which solution meets these requirements with the LEAST operational overhead?

1. AMove each tenant into its own database in the cluster, keep the shared role, and maintain a separate connection pool per tenant database that the services select from the JWT tenant ID.
2. BCreate a schema for each tenant with identical tables, and set the search_path at the start of each connection to the schema that matches the JWT tenant ID.
3. CCreate one view per tenant for each table that filters on tenant_id, grant the shared role access only to the views, and have the services pick the view from the JWT tenant ID.
4. DEnable row-level security on each table with a policy comparing tenant_id to a session variable that is set from the JWT in each transaction, and connect with a non-owner role.

Question 7 · Domain 1 · Skill 1.2.3New in SAP-C03

A medical imaging company runs a computer vision model that analyzes scans submitted by clinics. Each request payload is 200-500 MB, and inference takes 5-12 minutes per request. Requests arrive unpredictably, and on many days there is no traffic for several hours. Results must be available within 20 minutes of submission, and clinics must be notified when processing completes. The company wants to minimize cost during idle periods. Which Amazon SageMaker AI inference option meets these requirements?

1. AA SageMaker AI Serverless Inference endpoint with no provisioned concurrency, so that the company pays only for the compute that each request uses.
2. BA SageMaker AI real-time endpoint on GPU instances with a target tracking auto scaling policy on InvocationsPerInstance and a minimum of one instance.
3. CSageMaker AI batch transform jobs that an Amazon EventBridge schedule starts every hour over a new S3 input prefix, with an SNS message when each job completes.
4. DA SageMaker AI Asynchronous Inference endpoint with S3 inputs, auto scaling that scales to zero instances when the backlog is empty, and SNS notifications.

Question 8 · Domain 1 · Skill 1.3.2

An engineering firm stores CAD project files on an on-premises Windows NAS that is almost full. Designers in the office access files over SMB and need low-latency access to the files they are actively working on. The firm does not want to buy more on-premises storage. All project files must also be available as native objects in Amazon S3 so that a data team can catalog and query metadata with AWS analytics services. The firm has a 1 Gbps internet connection and limited IT staff. Which solution meets these requirements with the LEAST operational overhead?

1. ADeploy an Amazon S3 File Gateway on premises, create an SMB file share backed by an S3 bucket, and move the NAS data to the share so that active files are served from the local cache.
2. BUse AWS DataSync scheduled tasks to copy the NAS contents to Amazon S3 every hour, and continue to serve the designers from the existing NAS over SMB.
3. CDeploy a Volume Gateway in cached mode, present its iSCSI volumes to an on-premises Windows file server, and share the volumes to the designers over SMB.
4. DMigrate the files to Amazon FSx for Windows File Server, and map the file system to designer workstations over a Site-to-Site VPN on the existing 1 Gbps internet link.

Question 9 · Domain 1 · Skill 1.4.3

A company uses a centralized inspection VPC attached to a transit gateway. AWS Network Firewall endpoints are deployed in two Availability Zones of the inspection VPC, and transit gateway route tables send all east-west traffic between spoke VPCs through the inspection VPC. Stateful rules allow traffic between approved applications. Users report that some connections between spoke VPCs in different Availability Zones time out intermittently, while connections within the same Availability Zone work. Which change will resolve the issue with the LEAST effort?

1. AEnable appliance mode on the transit gateway attachment for the inspection VPC.
2. BChange the stateful rule evaluation order of the firewall policy to strict order.
3. CRemove the inspection VPC and deploy a separate Network Firewall in every spoke VPC.
4. DReplace the stateful rules with stateless rules that allow the application ports in both directions.

Question 10 · Domain 1 · Skill 1.5.2New in SAP-C03

A payments company publishes card transaction events to an existing Amazon MSK cluster at up to 30,000 events per second. Fraud analysts must join these events with customer dimension tables that already live in an Amazon Redshift provisioned cluster, and their dashboards must reflect new events within 15 seconds. The company does not want to stage the data in Amazon S3 and does not want to build or operate any additional consumer applications. Which solution meets these requirements?

1. ACreate an Amazon Data Firehose stream with the MSK topic as its source and Amazon Redshift as the destination, using the smallest buffering interval.
2. BCreate an external schema in Redshift that maps to the MSK cluster, and create a materialized view with AUTO REFRESH on the topic for Redshift streaming ingestion.
3. CConfigure an AWS Lambda event source mapping on the MSK topic, and have the function insert each batch of events into Redshift through the Redshift Data API.
4. DRun an Amazon MSK Connect S3 sink connector that writes the topic to Amazon S3, and query the files from Redshift through Amazon Redshift Spectrum external tables.

Question 11 · Domain 2 · Skill 2.1.1

A retail company manages 40 AWS accounts in AWS Organizations and has enabled AWS IAM Identity Center. All workforce identities and group memberships are mastered in Okta. The security team requires that when HR disables a user in Okta, the user can no longer start new AWS sessions within minutes, and that group changes in Okta are reflected in AWS access without manual steps. The cloud team has two engineers and wants to avoid writing custom synchronization code. Which solution meets these requirements with the LEAST operational overhead?

1. ACreate a SAML 2.0 identity provider for Okta in IAM in each of the 40 accounts, create IAM roles that trust the provider, and map Okta groups to role ARNs in the Okta application configuration.
2. BConfigure Okta as a SAML 2.0 external identity provider in IAM Identity Center, and run a nightly script that exports Okta users and groups to CSV and creates them in the Identity Center directory.
3. CConfigure Okta as a SAML 2.0 external identity provider in IAM Identity Center, enable automatic provisioning with SCIM from Okta, and assign permission sets to the synchronized Okta groups.
4. DCreate an Amazon Cognito user pool federated with Okta, and use a Cognito identity pool to issue AWS credentials that grant console access to each account.

Question 12 · Domain 2 · Skill 2.1.3

A company is onboarding a third-party SaaS cost-monitoring vendor that needs read-only access to billing and resource metadata in 25 of the company's AWS accounts. The vendor runs its service from its own AWS account and serves thousands of customers. The company's security team is concerned that another vendor customer could trick the vendor's service into accessing the company's accounts by supplying the company's role ARN. The vendor must not receive long-term credentials. Which solution is MOST secure?

1. ACreate a read-only IAM user in each account, store its access keys in AWS Secrets Manager, and share the secrets with the vendor's account through a resource-based policy.
2. BCreate an IAM role in each account that trusts the vendor's AWS account, grants read-only access, and requires sts:ExternalId to equal the unique ID the vendor assigned to the company.
3. CCreate an IAM role in each account that trusts the vendor's AWS account, grants read-only access, and requires aws:PrincipalOrgID to match the vendor's AWS Organizations ID.
4. DCreate an IAM role in each account that trusts the vendor's AWS account, grants read-only access, and requires the aws:MultiFactorAuthPresent condition key to be true for AssumeRole calls.

Question 13 · Domain 2 · Skill 2.2.1

A bank encrypts data in Amazon S3 and Amazon EBS by using AWS KMS. A new internal policy requires that the cryptographic material for these keys be rotated every 180 days, that all previously encrypted data remain decryptable without running re-encryption jobs, and that a separate analytics account be able to decrypt the S3 data. The cloud team wants the solution with the LEAST operational overhead. Which solution meets these requirements?

1. AUse the AWS managed keys for Amazon S3 and Amazon EBS, which AWS KMS rotates automatically, and grant the analytics account access through a cross-account IAM role.
2. BUse a customer managed KMS key with automatic key rotation enabled and the rotation period set to 180 days, and add the analytics account to the key policy.
3. CCreate a new customer managed KMS key every 180 days, repoint an alias to it, and use S3 Batch Operations and EBS snapshot copies to re-encrypt existing data.
4. DGenerate new keys in an AWS CloudHSM cluster every 180 days with an AWS Lambda function, and use client-side encryption with those keys for all S3 objects.

Question 14 · Domain 2 · Skill 2.2.4New in SAP-C03

An industrial IoT company signs firmware images that will be installed on devices with an expected field life of 20 years. The security team requires that the signatures remain secure against future quantum computers, that the private signing key never leaves an AWS managed HSM, and that devices verify signatures offline by using an embedded public key. The company wants a managed service and does not want to operate HSM infrastructure. Which solution meets these requirements?

1. ACreate an AWS KMS asymmetric key with the RSA_4096 key spec for SIGN_VERIFY, sign the firmware with the Sign API, and embed the public key in the devices.
2. BCreate an AWS KMS asymmetric key with an ML-DSA key spec for SIGN_VERIFY, sign with the Sign API, and embed the public key from GetPublicKey in each of the devices.
3. CCreate an AWS KMS asymmetric key with the ECC_NIST_P521 key spec for SIGN_VERIFY, sign the firmware with the Sign API, and embed the public key in the devices.
4. DCreate an AWS KMS HMAC key, generate a MAC for each firmware image with the GenerateMac API, and have the devices verify the MAC before installation.

Question 15 · Domain 2 · Skill 2.3.2

A company has 200 accounts in AWS Organizations and adds new accounts every week. Regulators require the company to retain AWS API activity logs for every account in every Region for 7 years. Administrators in member accounts must not be able to stop, modify, or delete the logging, and new accounts must be covered automatically. The logs must be stored in a dedicated log archive account in a form that nobody, including administrators of that account, can delete or overwrite before the retention period ends. Which solution meets these requirements with the LEAST operational overhead?

1. AUse service-managed AWS CloudFormation StackSets to deploy a multi-Region CloudTrail trail into every account that delivers to a central S3 bucket, and protect the trails with an SCP.
2. BCreate an organization trail that delivers to an S3 bucket in the management account with S3 Versioning enabled and a 7-year S3 Lifecycle expiration rule.
3. CCreate an AWS Config organization aggregator in the log archive account, record all resource types, and retain the configuration history for 7 years.
4. DCreate a multi-Region organization trail that delivers to an S3 bucket in the log archive account with S3 Object Lock in compliance mode and 7-year default retention.

Question 16 · Domain 2 · Skill 2.3.3

A company's network team owns a transit gateway in a central networking account. Fifty workload accounts in the same organization must attach their VPCs to this transit gateway, and new workload accounts are created every week. The network team wants new accounts to be able to use the transit gateway automatically without accepting invitations, and workload teams must not be able to modify the transit gateway route tables. Which solution meets these requirements with the LEAST operational overhead?

1. ACreate an AWS RAM resource share for each workload account ID, and ask each account administrator to accept the resource share invitation before attaching.
2. BDeploy a transit gateway in every workload account, and create transit gateway peering attachments from each one to the central transit gateway.
3. CCreate a cross-account IAM role in the networking account that workload teams assume to create their own VPC attachments to the transit gateway.
4. DEnable sharing with AWS Organizations in AWS RAM, and share the transit gateway with the organization or the workloads OU as the principal.

Question 17 · Domain 2 · Skill 2.3.5

A company with 150 accounts in four Regions wants to continuously evaluate its accounts against the AWS Foundational Security Best Practices (FSBP) standard and the CIS AWS Foundations Benchmark. Accounts in production OUs must have both standards enabled, while accounts in the sandbox OU must have only FSBP with several controls disabled. The security team wants to manage these settings from one account and one Region, apply them automatically to new accounts, and review findings from all Regions in a single place. Which solution meets these requirements with the LEAST operational overhead?

1. AUse AWS CloudFormation StackSets to enable AWS Security Hub CSPM in every account and Region, and run a script that enables standards and disables controls account by account.
2. BDesignate a delegated administrator for AWS Security Hub CSPM, and use local configuration with auto-enable turned on for new member accounts and default standards in each Region.
3. CDesignate a Security Hub CSPM delegated administrator, turn on central configuration with linked Regions, associate per-OU configuration policies, and enable cross-Region aggregation.
4. DDeploy organization conformance packs for both benchmarks from AWS Config, and review compliance for all accounts through an AWS Config organization aggregator.

Question 18 · Domain 2 · Skill 2.4.2

A European fintech company uses AWS Control Tower to manage 60 accounts. A national regulator requires that customer workloads and data be created only in eu-central-1 and eu-west-1. Developers must still be able to use global services such as IAM, Amazon CloudFront, and AWS Organizations. The security team wants a preventive control that applies automatically to every existing and future enrolled account. Which solution meets these requirements with the LEAST operational overhead?

1. AAttach an SCP to the root that denies all actions when aws:RequestedRegion is not eu-central-1 or eu-west-1, with no exceptions.
2. BDeploy an AWS Config rule in every account that flags resources created outside the two approved Regions and triggers an automatic remediation to delete them.
3. CAdd an IAM permissions boundary to every developer role that restricts actions to the two approved Regions.
4. DConfigure the AWS Control Tower landing zone to govern only eu-central-1 and eu-west-1 and enable the Region deny control.

Question 19 · Domain 2 · Skill 2.4.6New in SAP-C03

A company completed a threat modeling exercise for a public web application that runs on Amazon EC2 instances behind an Application Load Balancer. The exercise identified two high-risk threats: (1) a server-side request forgery (SSRF) flaw in a third-party library could let an attacker retrieve the instance role credentials from the instance metadata service, and (2) a small number of source IP addresses could flood the login page with HTTP requests. The company wants preventive mitigations for both threats. Which combination of actions should a solutions architect recommend? (Choose TWO.)

1. AEnable Amazon GuardDuty in all Regions to detect EC2 instance credentials that are used from outside AWS.
2. BRequire IMDSv2 on all instances by setting HttpTokens to required, and keep the PUT response hop limit at 1.
3. CAdd an outbound security group rule that denies traffic from the instances to the 169.254.169.254 metadata address.
4. DEnable Amazon Inspector to scan the instances and container images for vulnerable third-party libraries.
5. EAssociate an AWS WAF web ACL with the ALB and add a rate-based rule scoped to the login page path.

Question 20 · Domain 2 · Skill 2.5.1New in SAP-C03

A media company already uses an Amazon Bedrock guardrail with content filters and denied topics for its Bedrock-based chat applications. It also serves a fine-tuned open-weight model on an Amazon SageMaker AI real-time endpoint, which must stay on SageMaker AI because of custom inference code. The company wants the same content policies applied to prompts and responses for the SageMaker AI model, managed in one place. Which solution meets these requirements with the LEAST operational overhead?

1. ACall the Bedrock ApplyGuardrail API with the existing guardrail on each prompt before invoking the SageMaker AI endpoint and on each response before returning it.
2. BPass the existing guardrail identifier and version in each InvokeEndpoint request to the SageMaker AI endpoint so that inputs and outputs are filtered automatically.
3. CReimplement the content policies with Amazon Comprehend toxicity detection and custom classifiers in an AWS Lambda function in front of the SageMaker AI endpoint.
4. DImport the fine-tuned model into Amazon Bedrock with Custom Model Import, and attach the existing guardrail to the Bedrock invocations of the imported model.

Question 21 · Domain 3 · Skill 3.1.1

A media company runs a steady baseline of about $40 per hour of compute on Amazon EC2 m6i instances in us-east-1. Over the next 18 months, the engineering team plans to move most of these services to Amazon ECS on AWS Fargate and some event handlers to AWS Lambda, and it may shift part of the workload to eu-west-1. Finance wants a commitment-based discount on the baseline that will keep applying as the workload changes compute services, instance families, and Regions. Which purchase option is MOST cost-effective while meeting these requirements?

1. APurchase a 1-year Compute Savings Plan sized to the steady hourly baseline that is expected to remain after the migration.
2. BPurchase 1-year Standard Reserved Instances for m6i in us-east-1 and exchange them for other instance families as services move.
3. CPurchase a 3-year EC2 Instance Savings Plan for the m6i family in us-east-1 to obtain the deepest discount on the current baseline.
4. DPurchase 1-year Convertible Reserved Instances for m6i in us-east-1 and convert them to Fargate capacity after the migration.

Question 22 · Domain 3 · Skill 3.1.3

A company has 1,800 Amazon EC2 instances across 60 accounts in AWS Organizations. Many instances run memory-intensive Java applications. A previous rightsizing effort that used only CPU utilization downsized several instances and caused out-of-memory failures. The FinOps team wants rightsizing recommendations for all accounts that account for both CPU and memory utilization, and it wants to review the recommendations centrally from one account. Which solution meets these requirements with the LEAST operational overhead?

1. AEnable AWS Trusted Advisor in every account and export the Low Utilization Amazon EC2 Instances check results from all accounts to a central Amazon S3 bucket.
2. BUse AWS Cost Explorer rightsizing recommendations in the management account, filtered to instances whose average CPU utilization stayed below 40%.
3. CCreate a scheduled Lambda function in each account that collects CPUUtilization metrics and writes recommended sizes to a central Amazon DynamoDB table.
4. DOpt in to AWS Compute Optimizer for the organization from the management account, and publish memory metrics with the CloudWatch agent.

Question 23 · Domain 3 · Skill 3.2.3

A healthcare company stores 900 TB in an Amazon S3 bucket in us-east-1. Only objects under the records/ prefix, about 60 TB, are subject to a regulation that requires a copy in a second AWS Region. The copy will be read only during a regional disaster, and the recovery plan allows 6 hours to begin reading the restored records. The remaining objects are reproducible and do not need a second copy. Which solution meets these requirements MOST cost-effectively?

1. AConfigure S3 Cross-Region Replication for the entire bucket with S3 Replication Time Control, and store replicas in S3 Standard-Infrequent Access.
2. BConfigure an S3 Cross-Region Replication rule filtered on the records/ prefix, and set the destination storage class to S3 Glacier Flexible Retrieval.
3. CConfigure an S3 Cross-Region Replication rule filtered on the records/ prefix, and set the destination storage class to S3 Glacier Deep Archive.
4. DRun a nightly S3 Batch Operations copy of the full bucket to the second Region, and transition the copies to S3 Glacier Flexible Retrieval.

Question 24 · Domain 3 · Skill 3.2.5New in SAP-C03

A European bank runs a document assistant that calls a foundation model through Amazon Bedrock on-demand inference in eu-central-1. During month-end peaks, requests are throttled. A compliance rule requires that inference requests are processed only in EU Regions. The team is considering Provisioned Throughput, but peaks last only a few days each month, and the team does not want to deploy and route the application across multiple Regions itself. Which solution meets these requirements MOST cost-effectively?

1. APurchase Provisioned Throughput in eu-central-1 sized to the month-end peak and keep it for the rest of the month.
2. BDeploy the application in eu-west-1 and eu-central-1 and use Amazon Route 53 weighted routing to spread requests between the two Regional Bedrock endpoints.
3. CInvoke the model through the global cross-Region inference profile so that Amazon Bedrock can route requests to any Region with available capacity.
4. DInvoke the model through the EU cross-Region inference profile so that Amazon Bedrock routes requests to EU Regions with available capacity.

Question 25 · Domain 3 · Skill 3.3.4

A software company runs a single large Amazon EKS cluster on Amazon EC2 nodes that is shared by 15 product teams, each deployed to its own Kubernetes namespace. Pods from different teams run on the same nodes. Finance wants to charge each team back for its share of the EC2 instance costs based on the CPU and memory its pods consume, and the data must appear alongside the rest of the company's billing data. The platform team wants the least operational overhead. Which solution meets these requirements?

1. AEnable split cost allocation data for Amazon EKS in the Billing and Cost Management preferences, and allocate the pod-level costs in the CUR by namespace.
2. BTag each EC2 worker node with the name of the team whose pods run on it most often, and activate that tag as a cost allocation tag for chargeback.
3. CSplit the cluster into 15 separate EKS clusters, one per team in a dedicated account, so that each account's bill reflects that team's cost.
4. DDeploy a self-managed cost monitoring tool in the cluster, scrape Prometheus metrics, and build a custom pipeline that merges the results with billing data monthly.

Question 26 · Domain 3 · Skill 3.4.2

A logistics company runs a self-managed PostgreSQL database on Amazon EC2 with a 2 TiB gp2 Amazon EBS data volume. CloudWatch metrics show the workload steadily uses about 5,000 IOPS and 200 MiB/s of throughput, and the data is growing slowly. The company wants to reduce storage costs without downtime and without lowering performance. Which solution meets these requirements?

1. AUse Amazon EBS Elastic Volumes to change the volume in place to gp3, and provision 5,000 IOPS and 200 MiB/s of throughput to match the workload.
2. BUse Amazon EBS Elastic Volumes to change the volume in place to io2, and provision 5,000 IOPS to guarantee consistent database latency.
3. CTake a snapshot, create a new st1 volume from the snapshot, stop the instance, and swap the volumes during a maintenance window.
4. DChange the volume to gp3 and keep the included baseline of 3,000 IOPS and 125 MiB/s, relying on burst credits to cover the peaks.

Question 27 · Domain 4 · Skill 4.1.1

A manufacturer plans to migrate 400 workloads out of its data center by using AWS Transform. About 250 workloads run on physical Linux and Windows servers, and the rest run as virtual machines on Microsoft Hyper-V. There is no current documentation of which servers communicate with each other, and the migration team must group interdependent servers into the same migration wave. The team needs running process information and network connection data from every server. Which discovery approach meets these requirements?

1. ADeploy the AWS Transform discovery tool with only the Hyper-V hosts as a discovery source, and build waves from the VM inventory and utilization that the hypervisors report.
2. BDeploy the AWS Transform discovery tool, add the Hyper-V hosts and a CSV import of the physical servers as sources, and give it OS credentials to collect processes and connections.
3. CInstall the AWS Transform MGN replication agent on every server, and use the replication status in the MGN console to infer which servers depend on each other.
4. DRegister every server as a hybrid managed node in AWS Systems Manager, and use Systems Manager Inventory to collect installed applications and network configuration.

Question 28 · Domain 4 · Skill 4.1.2

A company runs 3,000 virtual machines on VMware vSphere with VMware NSX networking. Its VMware license renewal is due in 9 months, and leadership wants to exit VMware entirely by running the workloads as native Amazon EC2 instances. The migration team is small and wants to automate discovery, dependency-based wave planning, translation of the on-premises network configuration into VPC resources, and orchestration of server rehosting. Which approach meets these requirements with the LEAST manual effort?

1. ADeploy Amazon Elastic VMware Service (Amazon EVS) in a VPC, and use VMware HCX to move the VMs in waves without changing their format or their NSX networking.
2. BCollect inventory with RVTools exports, plan waves in spreadsheets, hand-write CloudFormation templates for VPCs and security groups, and run AWS Transform MGN for each wave.
3. CUse AWS Transform to discover the VMs and dependencies, build wave plans, translate the source network configuration into VPC resources, and orchestrate rehosting to Amazon EC2.
4. DExport each VM as an OVA image, upload the images to Amazon S3, recreate the networks by hand, and import the images with VM Import/Export one wave at a time before renewal.

Question 29 · Domain 4 · Skill 4.1.5

An insurance company runs a large Java monolith on Amazon EC2 instances behind an Application Load Balancer. The monolith serves the /quotes, /policies, /claims, and /billing paths. The company wants to modernize incrementally, starting by moving the claims functionality to a new service on AWS Lambda while the rest of the monolith keeps running unchanged. Each extracted capability must be released and rolled back independently, and the public URL that clients use must not change. Which approach meets these requirements?

1. ARewrite all four capabilities as microservices in parallel and switch the DNS record to the new platform with Amazon Route 53 once every service has passed testing.
2. BCreate Amazon Route 53 weighted records that send 10 percent of all requests to an Amazon API Gateway endpoint for the new claims service and the rest to the existing load balancer.
3. CAdd code to the monolith that forwards claims requests to the new Lambda function and returns its responses to clients.
4. DAdd an ALB listener rule that forwards the /claims* path pattern to a Lambda target group, keep the default rule on the monolith, and delete the rule to roll back.

Question 30 · Domain 4 · Skill 4.1.6

A software company runs a line-of-business application on Microsoft SQL Server Enterprise Edition in its data center. The database contains extensive T-SQL stored procedures, and the application connects through a standard SQL Server client driver over the TDS protocol. The company wants to eliminate SQL Server licensing costs and move to a fully managed AWS database while making as few application code changes as possible. Which solution meets these requirements?

1. AMigrate to Aurora PostgreSQL with Babelfish enabled, move the data with AWS DMS, and point the application at the Babelfish TDS endpoint after compatibility testing.
2. BMigrate to an Amazon RDS for SQL Server license-included Multi-AZ DB instance by using native backup and restore from Amazon S3.
3. CConvert the schema to Amazon Aurora MySQL-Compatible Edition with the AWS Schema Conversion Tool, rewrite the stored procedures, and switch the application to a MySQL driver.
4. DRehost the SQL Server virtual machine to Amazon EC2 with AWS Transform MGN and bring the existing SQL Server licenses.

Question 31 · Domain 4 · Skill 4.2.4

A payments company runs an active-passive workload in us-east-1 and us-west-2 with Amazon Route 53 DNS records pointing to each Region. A post-incident review found that automatic failover based on health checks flapped during a partial outage and caused a split-brain write scenario. The company now wants failover to be an explicit operator decision, wants the failover action to keep working even if a Region or the Route 53 control plane is impaired, and wants protection against an operator accidentally turning off both Regions. Which solution meets these requirements?

1. AUse ARC routing controls with Route 53 health checks on the failover records, change states through the cluster's Regional endpoints, and add a safety rule that keeps one Region on.
2. BCreate an AWS Lambda function that operators invoke to update the Route 53 failover records with the ChangeResourceRecordSets API, and require MFA in the IAM policy that allows invocation.
3. CReplace Route 53 with AWS Global Accelerator, and have operators set the traffic dial of the primary Region's endpoint group to 0 percent during a failover.
4. DKeep Route 53 failover routing but raise the health check failure threshold to 10 and the request interval to 30 seconds to reduce flapping.

Question 32 · Domain 4 · Skill 4.3.2

An e-commerce company runs its checkout service on Amazon EC2 instances in three Availability Zones behind an Application Load Balancer, with an Amazon RDS Multi-AZ database. The company claims the service recovers from the loss of an Availability Zone within 5 minutes, and auditors want evidence from a realistic test in production. The test must stop automatically if the customer-facing error rate exceeds an agreed threshold, and the team must measure how long customers experienced failures. Which approach meets these requirements?

1. AHave an engineer terminate all EC2 instances in one Availability Zone from the console during a low-traffic window, and review Application Load Balancer access logs afterward to estimate impact.
2. BRun an AWS Resilience Hub assessment of the checkout application and provide the estimated Availability Zone RTO from the assessment report to the auditors.
3. CReboot the RDS DB instance with failover and use the RDS event timestamps to report the recovery time of the service.
4. DRun an AWS FIS experiment from the AZ Availability: Power Interruption scenario with an error-rate alarm as the stop condition, and measure failure duration with CloudWatch Synthetics canaries.

Question 33 · Domain 5 · Skill 5.1.1

A platform team supports 40 product teams that write application code in TypeScript. Every team currently copies a 900-line CloudFormation template to create the same pattern: an Application Load Balancer, an Amazon ECS service on AWS Fargate, an encrypted log group, and alarms. Copies have drifted apart, and security fixes take weeks to reach every team. The platform team wants teams to consume one versioned, reusable definition of the pattern, written in a language they already know, and to receive fixes by upgrading a dependency. Which approach meets these requirements with the LEAST operational overhead?

1. APublish the template to a versioned Amazon S3 prefix and have each team reference it from its own stack as a nested stack (AWS::CloudFormation::Stack), passing team-specific values as parameters.
2. BRegister the pattern as a CloudFormation module in the CloudFormation registry of every account and Region, and require teams to reference the module type in their YAML templates.
3. CBuild an AWS CDK L3 construct in TypeScript for the pattern, publish it as a versioned npm package to AWS CodeArtifact, and have teams import it in their CDK apps.
4. DCreate an AWS Service Catalog product from the template, share the portfolio with every account, and have teams launch the product from the console for each new service.

Question 34 · Domain 5 · Skill 5.1.3

In a single account, a network stack exports VPC and subnet IDs that 25 application stacks consume with Fn::ImportValue. The network team now cannot replace subnets, because CloudFormation blocks changes to exports that other stacks import. The values are not sensitive. The company wants application stacks to stay decoupled from the network stack's lifecycle while still resolving the current IDs at each deployment. Which solution is the MOST cost-effective?

1. AHave the network stack write the IDs to AWS Secrets Manager secrets, and resolve them in the application templates with secretsmanager dynamic references at each deployment.
2. BHave the network stack write the IDs to Systems Manager Parameter Store standard parameters, and use AWS::SSM::Parameter::Value parameter types in application templates.
3. CConvert the network stack into a nested stack of each application stack so that application resources can read the VPC and subnet IDs with Fn::GetAtt on the nested stack outputs.
4. DKeep the exports, and add DependsOn from each application resource to the network stack's resources so that CloudFormation orders updates across the stacks.

Question 35 · Domain 5 · Skill 5.2.2New in SAP-C03

A company deploys container images from Amazon ECR to Amazon EKS. Security requires two controls: a pipeline must not promote any image that has a CRITICAL vulnerability in OS packages or in language libraries such as Java and Python dependencies, and the team must be alerted when a newly published CVE affects an image that is already running in production, without rebuilding the image. Which solution meets these requirements with the LEAST operational overhead?

1. AEnable ECR enhanced scanning with Amazon Inspector in continuous mode, fail a CodeBuild step when the image has CRITICAL findings, and route new Inspector findings to SNS through EventBridge.
2. BEnable ECR basic scanning with scan on push, have a CodeBuild step call DescribeImageScanFindings and fail on CRITICAL findings, and start a manual rescan of production images each month.
3. CRun an open source scanner such as Trivy in CodeBuild during each build, fail the build on CRITICAL findings, and store the scan report with the build artifacts.
4. DEnable Amazon Inspector EC2 scanning on the EKS worker nodes, and send CRITICAL findings to AWS Security Hub CSPM, which notifies the security team through EventBridge and SNS.

Question 36 · Domain 5 · Skill 5.2.3New in SAP-C03

A company runs an application on Amazon ECS in us-east-1 and eu-west-1 in the same account. It uses AWS CodeDeploy blue/green deployments in each Region. Today, two separate pipelines build the image twice and have no coordination. The company wants one pipeline that builds once in us-east-1, deploys to us-east-1, waits for a manual approval, and then deploys the same artifacts to eu-west-1. Which solution meets these requirements with the LEAST operational overhead?

1. AKeep both pipelines, replicate the artifact bucket to eu-west-1 with S3 Cross-Region Replication, and have the eu-west-1 pipeline start from the replicated object after approval.
2. BUse one pipeline in us-east-1 with an artifact store in each Region, and add an eu-west-1 CodeDeploy action after a manual approval action.
3. CReplace both CodeDeploy actions with a single CloudFormation StackSets action that updates the ECS service in both Regions in parallel after the build stage.
4. DAdd a CodeBuild action after the manual approval that runs aws deploy create-deployment against the eu-west-1 deployment group and polls until it finishes.

Question 37 · Domain 5 · Skill 5.3.1

A logistics company runs 40 microservices written in Java, Python, and Go across Amazon EKS, Amazon ECS on AWS Fargate, and AWS Lambda. Each team instruments its services differently, so traces break at service boundaries and metric names are inconsistent. The architecture board mandates a single vendor-neutral instrumentation standard so that the company can change observability backends later without modifying application code. Traces must be viewable as an end-to-end service map in AWS, and application metrics must be stored in Amazon CloudWatch. Which solution meets these requirements?

1. AInstrument all services with the AWS X-Ray SDKs, run the X-Ray daemon as a sidecar or DaemonSet, and publish application metrics with PutMetricData calls from a shared internal metrics library.
2. BEnable Lambda active tracing and Lambda Insights for the functions, enable Container Insights for EKS and ECS, and add the X-Ray SDK to the container services for tracing.
3. CInstrument the services with OpenTelemetry SDKs and auto-instrumentation agents, and export through ADOT collectors and the ADOT Lambda layer to X-Ray and CloudWatch.
4. DInstrument the services with OpenTelemetry SDKs that export traces directly to a self-managed Jaeger cluster on Amazon EKS, and derive metrics from CloudWatch Logs metric filters.

Question 38 · Domain 5 · Skill 5.3.4

An e-commerce company has separate CloudWatch alarms for ALB 5XX errors, p99 latency, and Amazon RDS CPU utilization for its checkout service. Each alarm notifies an Amazon SNS topic that pages the on-call engineer. Short latency spikes during nightly batch jobs page engineers even though customers are unaffected, and during real incidents engineers receive three pages at once. The company wants a single page only when customer impact is likely and no pages during a weekly planned maintenance window, while keeping the individual alarms for dashboards. Which solution meets these requirements with the LEAST operational overhead?

1. ARequire 10 out of 10 breaching datapoints on every alarm, and have the maintenance team disable the alarm actions on all three alarms before each weekly window and re-enable them after.
2. BRemove the SNS actions from the alarms, add a composite alarm with the rule ALARM("checkout-5xx") AND ALARM("checkout-p99") that notifies SNS, and set an actions suppressor for maintenance.
3. CCreate an EventBridge rule for CloudWatch alarm state changes that invokes a Lambda function to suppress duplicate alarms within 5 minutes and to check a maintenance calendar before it publishes to SNS.
4. DReplace the three alarms with one metric math alarm that sums the normalized 5XX count, p99 latency, and RDS CPU utilization, notifies SNS, and is disabled by automation during maintenance.

Question 39 · Domain 5 · Skill 5.3.7

A payments company runs its order API on Amazon EKS. It wants a service-level objective stating that 99.9% of requests to the POST /orders operation succeed over a rolling 28-day period. Engineers want to be alerted early when the error budget is being consumed too quickly rather than only after the objective is breached. The service-level indicator must be derived automatically from standard application telemetry without building custom metric pipelines. Which solution meets these requirements with the LEAST operational overhead?

1. APublish custom success and failure counts with PutMetricData, and build a dashboard that computes 28-day availability with metric math.
2. BCreate a CloudWatch Synthetics canary that calls POST /orders every minute, and alarm when the canary's SuccessPercent metric drops below 99.9%.
3. CCreate a CloudWatch alarm on the load balancer's HTTPCode_Target_5XX_Count metric with a static threshold, and notify an SNS topic when it is breached.
4. DEnable Application Signals for the cluster, create an availability SLO on the POST /orders operation with a rolling 28-day interval, and add burn rate alarms.

Question 40 · Domain 5 · Skill 5.4.2New in SAP-C03

A company must apply a configuration remediation script to 4,000 managed EC2 instances that run a customer-facing service behind load balancers. A previous change pushed to all instances at once caused an outage because the script had a defect. The company wants the change to run in waves so that no more than 5% of the instances are being modified at any time, and the operation must stop automatically if more than 10 instances fail. Which solution meets these requirements with the LEAST operational overhead?

1. AWrite a Lambda function that loops through instance IDs, calls SendCommand in batches with a delay between them, and tracks failures in a DynamoDB table.
2. BUse an AWS Config rule with automatic remediation that runs the script on every noncompliant instance as soon as it is evaluated.
3. CRun the script on all instances at once during an off-peak window, and restore any failed instances from AMIs taken immediately before the change.
4. DRun the script with Systems Manager Run Command targeting the instances by tag, with the concurrency control set to 5% and the error threshold set to 10 errors.