Free AWS Certified Solutions Architect - Professional (SAP-C02) Practice Questions

Sample Practice Questions

Try these 10 sample questions from the AWS Certified Solutions Architect - Professional (SAP-C02) practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1A company needs to interconnect many VPCs and its on-premises network through a central routing hub. Which AWS networking component directly serves that role?

   1. A. A transit gateway with VPC and network attachments
   2. B. A VPC peering connection between each VPC pair
   3. C. A Direct Connect private virtual interface per subnet
   4. D. A Route 53 Resolver endpoint in each VPC

   Answer: A

   Explanation: AWS states, "AWS Transit Gateway is a network transit hub used to interconnect virtual private clouds (VPCs) and on-premises networks." That is the central connectivity role in the question; peering is pairwise, while the other options do not supply the hub.

   Reference: What is AWS Transit Gateway for Amazon VPC? — What is AWS Transit Gateway for Amazon VPC?

2. 2A production CloudFormation update might replace a critical resource. The team must inspect the proposed changes before deciding whether to apply them. What should it create?

   1. A. A CloudFormation change set
   2. B. A CloudFormation drift detection run
   3. C. A stack termination protection setting
   4. D. A CloudWatch rollback trigger

   Answer: A

   Explanation: AWS says, "Change sets allow you to preview how proposed changes to a stack might impact your running resources" and CloudFormation makes the changes only when the set is executed. Drift detection checks existing drift, termination protection concerns deletion, and rollback triggers react to alarms.

   Reference: Update CloudFormation stacks using change sets — Update CloudFormation stacks using change sets, introduction

3. 3Operators receive separate pages whenever several related CloudWatch metric alarms enter ALARM together. They want one notification only when the required alarm conditions are met. Which CloudWatch alarm design should they use?

   1. A. Create a separate alarm for each metric and notify on all.
   2. B. Create a composite alarm with a rule over the metric alarms.
   3. C. Create a single metric filter over archived log files.
   4. D. Create an anomaly detector for each unrelated metric.

   Answer: B

   Explanation: AWS states, "A composite alarm includes a rule expression that takes into account the alarm states of other alarms that you have created." It also says, "Using composite alarms can reduce alarm noise." Notify from the composite when the specified combination holds.

   Reference: Using Amazon CloudWatch alarms — Using Amazon CloudWatch alarms, composite alarms

4. 4A company uses several AWS migration tools and wants one place to view the migration status of each application and its servers. Which service directly provides that portfolio-level tracking?

   1. A. AWS Migration Hub
   2. B. AWS Application Migration Service
   3. C. AWS DataSync
   4. D. AWS Database Migration Service

   Answer: A

   Explanation: AWS says Migration Hub "provides a single place to discover your existing servers, plan migrations, and track the status of each application migration." The other services perform particular transfers or migrations; Migration Hub aggregates status across them.

   Reference: What Is AWS Migration Hub? — Overview

5. 5An architect is segmenting traffic on a transit gateway using several transit gateway route tables. How many of those route tables can a single attachment be associated with at one time?

   1. A. Zero, because attachments only propagate routes
   2. B. Exactly one route table
   3. C. One route table for each destination VPC
   4. D. Every route table that receives its propagated routes

   Answer: B

   Explanation: The transit gateway guide says, "Each attachment is associated with exactly one route table." Propagation can affect routes in tables, but it does not make the attachment associated with several tables.

   Reference: What is AWS Transit Gateway for Amazon VPC? — Transit gateway concepts — Associations

6. 6A CloudFormation stack update must be rolled back automatically if a specified application health alarm enters ALARM during the deployment or monitoring period. Which mechanism should be configured?

   1. A. A change set preview of the proposed stack update
   2. B. A CloudFormation rollback trigger for the CloudWatch alarm
   3. C. Termination protection on the CloudFormation stack
   4. D. A drift detection operation after deployment

   Answer: B

   Explanation: AWS states, "If any of the alarms goes to ALARM state during the stack operation or the monitoring period, CloudFormation rolls back the entire stack operation." A rollback trigger links this alarm to the update; the alternatives do not initiate alarm-driven rollback.

   Reference: Roll back your CloudFormation stack on alarm breach with rollback triggers — Roll back your CloudFormation stack on alarm breach with rollback triggers, introduction

7. 7An application writes error events to a CloudWatch Logs Standard log group. The team needs a numerical count of matching new events that can drive a CloudWatch alarm. What should it configure?

   1. A. A CloudWatch Logs metric filter.
   2. B. A CloudWatch Logs retention period.
   3. C. A CloudTrail event history search.
   4. D. A CloudFormation change set.

   Answer: A

   Explanation: AWS says, "CloudWatch Logs uses these metric filters to turn log data into numerical CloudWatch metrics that you can graph or set an alarm on." A filter pattern on the Standard log group can publish the count needed for the alarm.

   Reference: Creating metrics from log events using filters — Creating metrics from log events using filters, introduction

8. 8Before grouping on-premises servers into migration applications, an architect needs their network connections to identify dependencies. Which discovery data is useful for that assessment?

   1. A. Server network connection data from AWS Application Discovery Service
   2. B. Only the AWS bill for new target instances
   3. C. Only the application deployment package size
   4. D. Only the target account's IAM role inventory

   Answer: A

   Explanation: AWS explains that Application Discovery Service can export "data about the network connections that exist between servers" and that this information helps determine network dependencies. Billing, package size, and target IAM inventory cannot reveal on-premises inter-server communication.

   Reference: What is AWS Application Discovery Service? — Server discovery

9. 9A VPC is attached to a transit gateway, but instances still cannot send traffic for a remote VPC to that gateway. Which VPC-side routing action is required?

   1. A. Propagate transit gateway routes automatically into every subnet route table
   2. B. Associate each subnet directly with the transit gateway route table
   3. C. Add a static VPC route for the remote destination pointing to the transit gateway
   4. D. Create a Route 53 forwarding rule for the remote VPC CIDR

   Answer: C

   Explanation: AWS specifies, "With a VPC, you must create static routes to send traffic to the transit gateway." A gateway attachment alone does not supply the needed VPC route.

   Reference: What is AWS Transit Gateway for Amazon VPC? — Transit gateway concepts — Route propagation

10. 10A CodePipeline pipeline runs in one Region but must perform a deploy action in another Region. What artifact-store design does CodePipeline require?

    1. A. Only the pipeline-Region bucket for all Regions
    2. B. Only a bucket in the destination action Region
    3. C. A pipeline-Region bucket and a bucket in each action Region
    4. D. One bucket in each Availability Zone of the pipeline Region

    Answer: C

    Explanation: AWS states, "you must have an artifact bucket in the pipeline Region and then you must have one artifact bucket per Region where you plan to execute an action." The other layouts omit a required Region or substitute Availability Zones for Regions.

    Reference: Add a cross-region action in CodePipeline — Add a cross-region action in CodePipeline, artifact bucket requirement