Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A company is building an application on Amazon EMR to analyze data. The following user groups need to perform different actions:
* Administrator: Provision EMR clusters from different configurations.
* Data engineer: Create an EMR cluster from a small set of available configurations. Run ETL scripts to process data.
* Data analyst: Create an EMR cluster with a specific configuration. Run SQL queries and Apache Hive queries on the data.
A solutions architect must design a solution that gives each group the ability to launch only its authorized EMR configurations. The solution must provide the groups with least privilege access to only the resources that they need. The solution also must provide tagging for all resources that the groups create.
Which solution will meet these requirements?
To provide least-privilege access to EMR resources by user group:
This combination ensures each group can only access and launch their authorized configurations while maintaining an audit trail through tagging.
A large company runs an AWS migration assessment. Now, the company must select its first workload to migrate to AWS. The company has the following goals:
* Build cloud migration skills. * Minimize business risk. * Move quickly to prepare for an on-premises data center contract expiration in less than 6 months.
Which migration approach aligns with AWS guidance for selecting and migrating a first workload?
AWS migration guidance for selecting a first workload recommends: (1) Start with a small, non-critical workload to build organizational cloud skills and experience before migrating critical applications, (2) Choose workloads with low business risk (not revenue-critical, not complex dependencies) to minimize impact if issues arise, (3) Select workloads with short migration time (weeks, not months) to demonstrate quick progress toward the 6-month deadline, (4) This approach builds confidence and skills for subsequent workload migrations. Choosing a complex, mission-critical application as the first workload increases risk and may miss the timeline. A small foundational workload (such as a non-critical internal application, development environment, or batch processing job) aligns with the three goals: skill building, risk minimization, and rapid timeline achievement.
A company is migrating a large on-prem Oracle database (withstored procedures) to AWS. The solution must usemanaged services, behighly available, and enable afast migrationwithminimal downtime.
Dis correct:Aurora PostgreSQLis afully managed, high-availabilitydatabase engine.
UseAWS DMSto migrate data andAWS Schema Conversion Tool (SCT)to convert stored procedures from Oracle to Aurora-compatible code.
This meets the requirements ofminimal downtime,managed services, andstored procedure support.
Ais not valid---RDS doesn't allow custom S3 integration for storage.
Binvolves EC2, which violates the ''managed services'' constraint.
Crequires complete rewrite of the application logic, which contradicts the minimal downtime requirement.
A company wants to send data from its on-premises systems to Amazon S3 buckets. The company created the S3 buckets in three different accounts. The company must send the data privately without the data traveling across the internet The company has no existing dedicated connectivity to AWS
Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)
https://docs.aws.amazon.com/AmazonS3/latest/userguide/privatelink-interface-endpoints.html#types-of-vpc-endpoints-for-s3
https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-direct-connect/
Use a private IP address over Direct Connect (with an interface VPC endpoint)
To access Amazon S3 using a private IP address over Direct Connect, perform the following steps:
3. Create a private virtual interface for your connection.
5. Create an interface VPC endpoint for Amazon S3 in a VPC that is associated with the virtual private gateway. The VGW must connect to a Direct Connect private virtualinterface. This interface VPC endpoint resolves to a private IP address even if you enable a VPC endpoint for S3.
A company runs an application across three AWS accounts. The company uses an organization in AWS Organizations to manage the AWS accounts. One account hosts a development environment. The second account hosts a testing environment. The third account hosts a production environment. The application runs on Amazon ECS with the AWS Fargate launch type. The application stores data in an Amazon Aurora MySQL database.
The company expects production environment traffic to be consistent and predictable for the next year. The production environment remains active throughout each week. However, the development environment and the testing environment shut down during weekends and 12 hours each weekday.
The company wants to optimize costs for the application.
Which solution will meet this requirement?
The cost optimization challenge involves: (1) Consistent production traffic suitable for Fargate Reserved Capacity, (2) Predictable reduced usage in dev/test environments with specific shutdown windows. The solution: (1) Use AWS Compute Optimizer to analyze current usage and recommend the most cost-effective instance types and sizes for each environment, (2) For ECS Fargate, use Savings Plans or Reserved Capacity for the predictable production workload, (3) Implement ECS scheduled task scaling to auto-scale dev/test environments down during configured shutdown windows (nights and weekends) and scale back up before business hours, (4) For Aurora, use on-demand instances for dev/test databases (billing stops when instances are stopped) and reserved instances for production. This combination minimizes compute costs through reserved capacity and scheduled scaling while aligning with the predictable usage patterns.
A company wants to design a disaster recovery (DR) solution for an application that runs in the company's data center. The application writes to an SMB file share and creates a copy on a second file share. Both file shares are in the data center. The application uses two types of files: metadata files and image files.
The company wants to store the copy on AWS. The company needs the ability to use SMB to access the data from either the data center or AWS if a disaster occurs. The copy of the data is rarely accessed but must be available within 5 minutes.
Which solution will meet these requirements MOST cost-effectively?
The correct solution is to use an Amazon S3 File Gateway to store the copy of the SMB file share on AWS. An S3 File Gateway enables on-premises applications to store and access objects in Amazon S3 using the SMB protocol. The S3 File Gateway can also be accessed from AWS using the SMB protocol, which provides the ability to use the data from either the data center or AWS if a disaster occurs. The S3 File Gateway supports tiering of data to different S3 storage classes based on the file type. This allows the company to optimizethe storage costs by using S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files, which are rarely accessed but must be available within 5 minutes, and S3 Glacier Deep Archive for the image files, which are the lowest-cost storage class and suitable for long-term retention of data that is rarely accessed. This solution is the most cost-effective because it does not require any additional hardware, software, or replication services.
The other solutions are incorrect because they either use more expensive or unnecessary services or components, or they do not meet the requirements. For example:
Solution A is incorrect because it uses AWS Outposts with Amazon S3 storage, which is a very expensive and complex solution for the scenario in the question. AWS Outposts is a service that extends AWS infrastructure, services, APIs, and tools to virtually any data center, co-location space, or on-premises facility. It is designed for customers who need low latency and local data processing. Amazon S3 storage on Outposts provides a subset of S3 features and APIs to store and retrieve data on Outposts. However, this solution does not provide SMB access to the data on Outposts, which requires a Windows EC2 instance on Outposts as a file server. This adds more cost and complexity to the solution, and it does not provide the ability to access the data from AWS if a disaster occurs.
Solution B is incorrect because it uses Amazon FSx File Gateway and Amazon FSx for Windows File Server Multi-AZ file system that uses SSD storage, which are both more expensive and unnecessary services for the scenario in the question. Amazon FSx File Gateway is a service that enables on-premises applications to store and access data in Amazon FSx for Windows File Server using the SMB protocol. Amazon FSx for Windows File Server is a fully managed service that provides native Windows file shares with the compatibility, features, and performance that Windows-based applications rely on. However, this solution does not meet the requirements because it does not provide the ability to use different storage classes for the metadata files and image files, and it does not provide the ability to access the data from AWS if a disaster occurs. Moreover, using a Multi-AZ file system that uses SSD storage is overprovisioned and costly for the scenario in the question, which involves rarely accessed data that must be available within 5 minutes.
Solution D is incorrect because it uses an S3 File Gateway that uses S3 Standard-IA for both the metadata files and image files, which is not the most cost-effective solution for the scenario in the question. S3 Standard-IA is a storage class that offers high durability, availability, and performance for infrequently accessed data. However, it is more expensive than S3 Glacier Deep Archive, which is the lowest-cost storage class and suitable for long-term retention of data that is rarely accessed. Therefore, using S3 Standard-IA for the image files, which are likely to be larger and more numerous than the metadata files, is not optimal for the storage costs.
What is S3 File Gateway?
Using Amazon S3 storage classes with S3 File Gateway
Accessing your file shares from AWS
A company hosts an application behind an Application Load Balancer (ALB) in the us-east-1 Region. The company serves users from around the world. The company recently attached an AWS WAF web ACL that applies Bot Control and regular-expression rules directly to the ALB.
Amazon CloudWatch shows substantial AWS WAF rule-processing time. During peak usage periods, the ALB TargetResponseTime metric is significantly higher than normal. Users outside North America experience noticeably slower page loads than users in North America.
The company wants to reduce global latency while keeping the infrastructure components in a single AWS Region.
Which solution will meet these requirements in the MOST cost-effective way?
Exam domains verified against: Official Amazon SAP-C02 exam guide, last checked October 2026.
Learn to architect network connectivity strategies that support complex enterprise environments. Master designing multi-account AWS environments and implementing security controls while ensuring reliable and resilient architectures.
Develop deployment strategies aligned with business requirements and design solutions for business continuity. Apply security and reliability requirements to new architectures while meeting performance objectives.
Sample question from this domain above: Q7
Create strategies to enhance operational excellence, security, performance, and reliability of existing workloads. Analyze current architectures and identify practical improvements across the AWS Well-Architected Framework pillars.
Evaluate existing workloads and processes to identify migration candidates. Determine optimal migration approaches and new architectures for existing workloads while identifying opportunities for modernization and enhancements.
Common questions about the exam itself
