AWS SAP-C03 · New exam from 17 Nov 2026
Free AWS Solutions Architect Professional Practice Exam (SAP-C03)
Full-length mock exams with the same number of questions and time as the real exam, written for the new SAP-C03 blueprint that starts on 17 November 2026. Multi-account, hybrid, AI and DR scenarios across all 5 domains, answers explained, and your score by domain.
1. Choose a set
2. Choose a mode
75 questions · 3 hours · same as the real exam
You have an unfinished attempt on this set.
Questions 1–10Page 1 of 8
🏆
Question 1Cloud Architecture Design
A media company runs 25 microservices on Amazon ECS with AWS Fargate in one account and one VPC. Services call each other through internal load balancers, which adds cost and gives inconsistent retry behavior. The company wants services to reach each other by short names with automatic retries and per-service traffic metrics in CloudWatch, without managing proxy configuration. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: A. Enable Amazon ECS Service Connect on each service using a shared AWS Cloud Map namespace.
ECS Service Connect adds a managed proxy to each task, resolves services by short names in a Cloud Map namespace, retries failed requests, and publishes traffic metrics to CloudWatch. Plain Cloud Map DNS discovery provides names but leaves retries and metrics to custom code. A single shared load balancer still adds cost and does not provide automatic retries between services.
ECS Service Connect adds a managed proxy to each task, resolves services by short names in a Cloud Map namespace, retries failed requests, and publishes traffic metrics to CloudWatch. Plain Cloud Map DNS discovery provides names but leaves retries and metrics to custom code. A single shared load balancer still adds cost and does not provide automatic retries between services.
Question 2Security & Governance
A research company uses IAM Identity Center with an external IdP for 2,000 users across 40 accounts. New research projects start every week, and each project's resources are tagged with a project key. Users must access only resources whose project tag matches their own project, and the team does not want to create or update permission sets for each new project. Which solution BEST meets these requirements?
Correct answer: C. Pass each user's project as a session tag and compare aws:PrincipalTag with aws:ResourceTag in one shared permission set.
With attributes for access control, Identity Center passes the user's project attribute as a session tag, and one permission set compares aws:PrincipalTag/project with aws:ResourceTag/project. New projects only need tags, not policy changes. A permission set per project works but adds exactly the per-project maintenance the company wants to avoid.
With attributes for access control, Identity Center passes the user's project attribute as a session tag, and one permission set compares aws:PrincipalTag/project with aws:ResourceTag/project. New projects only need tags, not policy changes. A permission set per project works but adds exactly the per-project maintenance the company wants to avoid.
Question 3Operational Excellence
A company manages 200 CloudFormation stacks across 15 accounts in AWS Organizations. Auditors found that engineers changed security group rules and Lambda environment variables in the console, so live resources no longer match their stacks. The platform team wants every stack checked for out-of-band changes at least daily, with an alert for each affected stack and the LEAST operational overhead. Which solution meets these requirements?
Correct answer: D. Deploy the cloudformation-stack-drift-detection-check Config rule to the organization and alert on noncompliant stacks.
The cloudformation-stack-drift-detection-check rule runs drift detection on each stack and marks drifted stacks as noncompliant, which can trigger alerts through EventBridge. Stack policies only control updates made through CloudFormation, so they neither block nor detect direct console changes.
The cloudformation-stack-drift-detection-check rule runs drift detection on each stack and marks drifted stacks as noncompliant, which can trigger alerts through EventBridge. Stack policies only control updates made through CloudFormation, so they neither block nor detect direct console changes.
Question 4Cost Optimization
A gaming company with 80 AWS accounts found a misconfigured data pipeline only when the monthly invoice arrived, three weeks after its cost spiked. Spend per account and per service changes a lot from week to week, so fixed thresholds create many false alerts. The FinOps team wants alerts on unusual spend within a day in an existing SNS topic that posts to Slack. The solution must not require custom code. Which solution is MOST cost-effective?
Correct answer: D. Create Cost Anomaly Detection monitors for services and accounts that alert the SNS topic.
Cost Anomaly Detection uses machine learning to learn each monitor's normal spend pattern, so it flags unusual cost without fixed thresholds, and the service has no charge. Individual alerts can be sent to an SNS topic that posts to Slack. Budgets and billing alarms rely on static thresholds that cause the false alerts the team wants to avoid, and the Athena approach needs custom queries and scheduling.
Cost Anomaly Detection uses machine learning to learn each monitor's normal spend pattern, so it flags unusual cost without fixed thresholds, and the service has no charge. Individual alerts can be sent to an SNS topic that posts to Slack. Budgets and billing alarms rely on static thresholds that cause the false alerts the team wants to avoid, and the Athena approach needs custom queries and scheduling.
Question 5Resilience & Migration
A fintech company stores customer account balances in Amazon DynamoDB. The application must run active in us-east-1, us-east-2, and us-west-2, and it updates balances with conditional writes. If any Region fails, no acknowledged write can be lost, and a read in any Region must always return the latest balance. Higher write latency is acceptable. Which solution BEST meets these requirements?
Correct answer: B. Create a DynamoDB global table that uses multi-Region strong consistency across all three Regions.
Global tables with multi-Region strong consistency replicate each write to at least one other Region before acknowledging it, so the RPO is zero and strongly consistent reads return the latest item in any Region. The default eventual consistency mode replicates asynchronously, so a Regional failure can lose recent writes and reads in other Regions may be stale. Aurora global databases also replicate asynchronously to secondary Regions.
Global tables with multi-Region strong consistency replicate each write to at least one other Region before acknowledging it, so the RPO is zero and strongly consistent reads return the latest item in any Region. The default eventual consistency mode replicates asynchronously, so a Regional failure can lose recent writes and reads in other Regions may be stale. Aurora global databases also replicate asynchronously to secondary Regions.
Question 6Cloud Architecture Design
A collaborative whiteboard application must broadcast drawing updates to all users viewing the same board in near real time. Updates are published by browser clients and by backend Lambda functions. The company does not want to manage WebSocket connections, connection tables, or GraphQL schemas, and the solution must scale to hundreds of thousands of subscribers. Which solution meets these requirements?
Correct answer: B. Use AWS AppSync Events and have clients subscribe to one channel per board in a channel namespace.
AppSync Events provides managed WebSocket pub/sub channels that clients and backend services can publish to over HTTP or WebSocket, with no GraphQL schema and no connection tracking. An API Gateway WebSocket API requires the team to store and manage connection IDs. AppSync GraphQL subscriptions work but require a GraphQL schema and mutations.
AppSync Events provides managed WebSocket pub/sub channels that clients and backend services can publish to over HTTP or WebSocket, with no GraphQL schema and no connection tracking. An API Gateway WebSocket API requires the team to store and manage connection IDs. AppSync GraphQL subscriptions work but require a GraphQL schema and mutations.
Question 7Security & Governance
A pharmaceutical company runs research workloads in private subnets that have no internet access and reach Amazon S3 only through a gateway VPC endpoint. The security team must prevent anyone on these instances from copying data to S3 buckets outside the company's organization. The control must also apply when someone uses access keys from a personal AWS account on an instance. Which solution BEST meets these requirements?
Correct answer: D. Add a VPC endpoint policy that allows S3 requests only when aws:PrincipalOrgID and aws:ResourceOrgID match the organization.
The endpoint policy is evaluated for every request through the endpoint regardless of whose credentials are used, so the two conditions block both external principals and buckets outside the organization. An SCP applies only to principals in the organization, so it would not stop keys from a personal account. An RCP and bucket policies protect company buckets but cannot block writes to buckets the company does not own.
The endpoint policy is evaluated for every request through the endpoint regardless of whose credentials are used, so the two conditions block both external principals and buckets outside the organization. An SCP applies only to principals in the organization, so it would not stop keys from a personal account. An RCP and bucket policies protect company buckets but cannot block writes to buckets the company does not own.
Question 8Operational Excellence
A company has 300 accounts in AWS Organizations. Teams deploy CloudFormation stacks from the console, the CLI, the AWS CDK, and their own pipelines. Security requires that any stack operation that would create a DynamoDB table without point-in-time recovery be stopped before the table is provisioned. The solution must have the LEAST operational overhead. Which solution meets these requirements?
Correct answer: C. Activate a CloudFormation hook in fail mode that checks DynamoDB table properties, and deploy it to all accounts with StackSets.
A CloudFormation hook runs inside the CloudFormation service before resources are provisioned, so it applies no matter which tool started the stack operation, and fail mode stops the operation. A pipeline validation step misses stacks deployed from the console, the CLI, or direct CDK runs.
A CloudFormation hook runs inside the CloudFormation service before resources are provisioned, so it applies no matter which tool started the stack operation, and fail mode stops the operation. A pipeline validation step misses stacks deployed from the console, the CLI, or direct CDK runs.
Question 9Resilience & Migration
A payments company runs an active-passive application in us-east-1 and us-west-2. After a past incident with flapping health checks, leadership wants every Regional failover decided by a human operator. The failover action must work even if AWS control plane APIs are impaired during a Regional event. The design must also block any change that would leave both Regions turned off at the same time. Which solution BEST meets these requirements?
Correct answer: B. Use Application Recovery Controller routing controls with a safety rule, changed through cluster data plane endpoints.
Routing control states are changed through highly available cluster endpoints in the data plane, so operators can fail over without relying on control plane APIs. A safety rule, such as an assertion rule that keeps at least one routing control on, blocks a change that would turn off both Regions. Without the safety rule there is no guardrail, and automatic health check failover removes the human decision.
Routing control states are changed through highly available cluster endpoints in the data plane, so operators can fail over without relying on control plane APIs. A safety rule, such as an assertion rule that keeps at least one routing control on, blocks a change that would turn off both Regions. Without the safety rule there is no guardrail, and automatic health check failover removes the human decision.
Question 10Cloud Architecture Design
An online retailer serves its website through Amazon CloudFront at 80,000 requests per second. It must redirect requests based on a list of 5,000 URL mappings that the marketing team changes several times a day, and add security headers to every response. The solution must add minimal latency at the lowest cost, and redirect changes must not require a code deployment. Which solution meets these requirements?
Correct answer: C. Use a CloudFront Function that reads redirects from CloudFront KeyValueStore, plus a response headers policy.
CloudFront Functions run at edge locations with sub-millisecond startup and the lowest cost, KeyValueStore lets the team update redirect mappings without republishing the function, and a response headers policy adds security headers with no code. Lambda@Edge works but costs more and adds latency. Embedding 5,000 mappings in function code exceeds the 10 KB function size limit and needs a deployment for every change.
CloudFront Functions run at edge locations with sub-millisecond startup and the lowest cost, KeyValueStore lets the team update redirect mappings without republishing the function, and a response headers policy adds security headers with no code. Lambda@Edge works but costs more and adds latency. Embedding 5,000 mappings in function code exceeds the 10 KB function size limit and needs a deployment for every change.
Question 11Security & Governance
A logistics company exposes an Amazon API Gateway REST API that partner systems call server to server, with no human users involved. Each partner must get OAuth 2.0 access tokens, and some partners must be limited to read-only operations. The company wants a managed authorization server and no custom token code. Which solution BEST meets these requirements?
Correct answer: A. Use a Cognito resource server with read and write scopes, a client credentials app client per partner, and a Cognito authorizer.
The client credentials grant is the OAuth 2.0 flow for machine-to-machine access, and custom scopes on a Cognito resource server let the API Gateway authorizer limit read-only partners to the read methods. The authorization code and implicit grants require a user to sign in through a browser. API keys identify callers for usage plans but are not an authorization mechanism.
The client credentials grant is the OAuth 2.0 flow for machine-to-machine access, and custom scopes on a Cognito resource server let the API Gateway authorizer limit read-only partners to the read methods. The authorization code and implicit grants require a user to sign in through a browser. API keys identify callers for usage plans but are not an authorization mechanism.
Question 12Cost Optimization
A healthcare company runs 30 RDS for PostgreSQL DB instances of mixed sizes in the db.r7g family in one Region, across 6 member accounts of one organization. The databases run 24/7, and teams often resize them up or down within the db.r7g family. The company already has a Compute Savings Plan that fully covers its EC2 usage. It wants to cut database cost with a commitment of no more than 1 year. Which solution is MOST cost-effective?
Correct answer: B. Buy 1-year RDS reserved instances for the db.r7g family to match total normalized units.
RDS reserved instances for PostgreSQL are size-flexible within an instance family, so the discount follows databases as teams resize them, and consolidated billing shares unused reservations across the accounts. Compute Savings Plans apply only to EC2, Fargate and Lambda, not to RDS. Aurora Serverless v2 costs more for databases that run at a steady load 24/7, and a 3-year term breaks the 1-year limit.
RDS reserved instances for PostgreSQL are size-flexible within an instance family, so the discount follows databases as teams resize them, and consolidated billing shares unused reservations across the accounts. Compute Savings Plans apply only to EC2, Fargate and Lambda, not to RDS. Aurora Serverless v2 costs more for databases that run at a steady load 24/7, and a 3-year term breaks the 1-year limit.
Question 13Operational Excellence
An application on Amazon ECS connects to Aurora PostgreSQL with a database user whose credentials are stored in AWS Secrets Manager. Security requires rotation every 30 days. The application caches credentials for up to 15 minutes, and the current single user rotation causes authentication failures right after each rotation. Which solution BEST meets these requirements?
Correct answer: A. Switch the secret to the alternating users rotation strategy, with a separate administrator secret for the rotation function.
With alternating users, the rotation function updates a second database user while the current credentials stay valid, so cached credentials keep working until the next refresh. RDS-managed master user passwords also use single user rotation, so cached credentials can still fail, and applications should not use the master user.
With alternating users, the rotation function updates a second database user while the current credentials stay valid, so cached credentials keep working until the next refresh. RDS-managed master user passwords also use single user rotation, so cached credentials can still fail, and applications should not use the master user.
Question 14Cloud Architecture Design
A company runs 40 Amazon EKS clusters in private subnets, and the clusters pull public base images from Docker Hub. Deployments are failing because of Docker Hub rate limits, and the security team requires all images to be scanned and served from inside AWS. The platform team does not want to build a custom image mirroring process. Which solution meets these requirements?
Correct answer: C. Create an ECR pull through cache rule for Docker Hub and turn on image scanning for the private registry.
An ECR pull through cache rule fetches Docker Hub images on first pull, using upstream credentials stored in Secrets Manager, and keeps them in private ECR repositories that registry scanning covers. Later pulls are served from inside AWS without a custom pipeline. ECR replication copies images only between ECR registries, so it cannot pull from Docker Hub.
An ECR pull through cache rule fetches Docker Hub images on first pull, using upstream credentials stored in Secrets Manager, and keeps them in private ECR repositories that registry scanning covers. Later pulls are served from inside AWS without a custom pipeline. ECR replication copies images only between ECR registries, so it cannot pull from Docker Hub.
Question 15Security & Governance
A manufacturer runs 300 on-premises Linux servers that upload sensor data to Amazon S3 and read messages from Amazon SQS. A new policy bans long-term AWS access keys on servers. The company already operates an enterprise certificate authority that issues X.509 certificates to every server. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: D. Configure IAM Roles Anywhere with the enterprise CA as a trust anchor and use the credential helper to get temporary credentials.
IAM Roles Anywhere lets workloads outside AWS exchange an X.509 certificate from a registered trust anchor for temporary role credentials, so no long-term keys are stored. Calling AssumeRole with IAM user keys still requires long-term keys on every server. Rotated IAM user keys are still long-term keys, and Identity Center is built for human sign-in, not unattended servers.
IAM Roles Anywhere lets workloads outside AWS exchange an X.509 certificate from a registered trust anchor for temporary role credentials, so no long-term keys are stored. Calling AssumeRole with IAM user keys still requires long-term keys on every server. Rotated IAM user keys are still long-term keys, and Identity Center is built for human sign-in, not unattended servers.
Question 16Resilience & Migration
A manufacturer runs 80 on-premises ERP servers on VMware and on physical hardware. The lease on its secondary data center ends soon, and it wants AWS to be the disaster recovery site. Requirements are an RPO of seconds, an RTO under 30 minutes, and low standby compute cost. The company must also be able to fail back to its data center after an event. Which solution BEST meets these requirements?
Correct answer: D. Use AWS Elastic Disaster Recovery to replicate the servers to a low-cost staging area and use its failback process.
Elastic Disaster Recovery replicates continuously at the block level for an RPO of seconds, keeps standby costs low with lightweight replication servers and inexpensive storage, and launches recovery instances in minutes. It also supports failback to the on-premises source. Application Migration Service is built for one-way migration with no failback process, and hourly snapshots cannot meet an RPO of seconds.
Elastic Disaster Recovery replicates continuously at the block level for an RPO of seconds, keeps standby costs low with lightweight replication servers and inexpensive storage, and launches recovery instances in minutes. It also supports failback to the on-premises source. Application Migration Service is built for one-way migration with no failback process, and hourly snapshots cannot meet an RPO of seconds.
Question 17Cost Optimization
A retail analytics team trains a demand forecasting model every night on Amazon SageMaker with four GPU instances for about 5 hours. The training script already saves checkpoints to S3 every 15 minutes. The model only needs to be ready within 24 hours of the start, and the team does not want to manage infrastructure. The jobs currently run on On-Demand training instances. Which change is MOST cost-effective?
Correct answer: A. Use managed Spot training with S3 checkpoints and a maximum wait under 24 hours.
Managed Spot training runs SageMaker jobs on spare capacity at up to a 90% discount and automatically resumes from the latest S3 checkpoint after an interruption, and the 24-hour window leaves room for those interruptions. A SageMaker Savings Plan gives a smaller discount than Spot. Self-managed EC2 Spot adds the infrastructure work the team wants to avoid, and a Capacity Reservation bills at the On-Demand rate.
Managed Spot training runs SageMaker jobs on spare capacity at up to a 90% discount and automatically resumes from the latest S3 checkpoint after an interruption, and the 24-hour window leaves room for those interruptions. A SageMaker Savings Plan gives a smaller discount than Spot. Self-managed EC2 Spot adds the infrastructure work the team wants to avoid, and a Capacity Reservation bills at the On-Demand rate.
Question 18Operational Excellence
A company runs CodePipeline in a tooling account and deploys CloudFormation stacks to separate staging and production accounts. The pipeline artifact bucket uses SSE-KMS with the AWS managed key aws/s3. The production deploy action fails with an access denied error when it reads the artifacts. The company wants to keep a single pipeline. What should a solutions architect do?
Correct answer: B. Encrypt artifacts with a customer managed KMS key shared with production roles, and have the action assume a production role.
Cross-account actions need artifacts encrypted with a customer managed KMS key whose key policy allows the target account roles, plus a bucket policy and an action role in the production account. A bucket policy alone fails because an AWS managed key cannot be used by another account.
Cross-account actions need artifacts encrypted with a customer managed KMS key whose key policy allows the target account roles, plus a bucket policy and an action role in the production account. A bucket policy alone fails because an AWS managed key cannot be used by another account.
Question 19Cloud Architecture Design
A healthcare SaaS provider serves hundreds of small clinics from shared, pooled infrastructure. It is signing several large hospital networks that require their data and compute to be fully separated from other customers, with their own encryption keys and independent audits. The provider wants to keep costs low for small clinics and maintain one code base and deployment pipeline. Which approach BEST meets these requirements?
Correct answer: D. Keep clinics pooled and deploy each hospital network to a dedicated account from the same pipeline.
A tiered model keeps small clinics in the low-cost pool and gives each hospital network a silo in its own AWS account, with its own KMS keys and audit scope, deployed by the same pipeline. Moving every clinic to its own account meets the isolation need but greatly raises cost for small tenants. Tags in a shared stack do not separate data or compute.
A tiered model keeps small clinics in the low-cost pool and gives each hospital network a silo in its own AWS account, with its own KMS keys and audit scope, deployed by the same pipeline. Moving every clinic to its own account meets the isolation need but greatly raises cost for small tenants. Tags in a shared stack do not separate data or compute.
Question 20Security & Governance
A company wants contractors to reach three internal web applications that sit behind internal Application Load Balancers, and leadership wants to retire the VPN. Access must be granted per request, and only when the user is in the right IdP group and the device passes a posture check from the company's device management service. Which solution BEST meets these requirements?
Correct answer: C. Deploy AWS Verified Access with identity and device trust providers, and write an access policy for each application.
AWS Verified Access evaluates each request against policies that combine identity claims and device posture from trust providers, giving VPN-less access to internal applications. Client VPN keeps the VPN and does not check device posture on every request. Cognito authentication on a public ALB checks identity but not device posture.
AWS Verified Access evaluates each request against policies that combine identity claims and device posture from trust providers, giving VPN-less access to internal applications. Client VPN keeps the VPN and does not check device posture on every request. Cognito authentication on a public ALB checks identity but not device posture.
Question 21Cloud Architecture Design
A genomics company must process 3 million small files in an S3 bucket every week. Each file goes through three steps: validate the file, transform it with Lambda, and record metadata in DynamoDB. Each step needs its own retry policy, thousands of files must run in parallel, and failed items must be reported. The company wants the least custom orchestration code. Which solution meets these requirements?
Correct answer: A. Use a Step Functions Distributed Map state that reads the S3 object list and runs a child workflow per file.
A Distributed Map state reads items directly from S3, runs up to 10,000 child workflow executions in parallel, applies retry policies per state, and can write failed items to S3. An inline Map state is limited to 40 concurrent iterations and to the execution's input and history size limits. S3 Batch Operations invokes one function per object, so the per-step retries would have to be coded inside that function.
A Distributed Map state reads items directly from S3, runs up to 10,000 child workflow executions in parallel, applies retry policies per state, and can write failed items to S3. An inline Map state is limited to 40 concurrent iterations and to the execution's input and history size limits. S3 Batch Operations invokes one function per object, so the per-step retries would have to be coded inside that function.
Question 22Security & Governance
A document processing platform launches thousands of short-lived batch jobs per day, and each job serves a single tenant. Each job must decrypt only data keys that were encrypted with its tenant's encryption context, and only while the job runs. The security team does not allow key policy changes for individual jobs. Which solution BEST meets these requirements?
Correct answer: C. Create a KMS grant for each job with an encryption context constraint for its tenant, and retire the grant when the job ends.
KMS grants delegate specific operations on a key without editing the key policy, can be limited to an exact encryption context, and can be retired as soon as the job finishes. Editing the key policy per job is not allowed and would also run into the key policy size limit. A shared role with Decrypt for all contexts would let one tenant's job read another tenant's data.
KMS grants delegate specific operations on a key without editing the key policy, can be limited to an exact encryption context, and can be retired as soon as the job finishes. Editing the key policy per job is not allowed and would also run into the key policy size limit. A shared role with Decrypt for all contexts would let one tenant's job read another tenant's data.
Question 23Operational Excellence
A company runs an Amazon ECS service behind an Application Load Balancer and deploys it with CodeDeploy. Each new version must pass automated integration tests against the new tasks before any production traffic reaches them. After the tests pass, all traffic must move at once, and the team must be able to roll back quickly. Which solution meets these requirements?
Correct answer: A. Use blue/green with a test listener, run the tests from an AfterAllowTestTraffic hook, and use the all-at-once configuration.
A test listener routes test traffic to the replacement task set, and the AfterAllowTestTraffic hook can run tests and fail the deployment before production traffic shifts. The BeforeInstall hook runs before the replacement task set exists, so there is nothing to test yet.
A test listener routes test traffic to the replacement task set, and the AfterAllowTestTraffic hook can run tests and fail the deployment before production traffic shifts. The BeforeInstall hook runs before the replacement task set exists, so there is nothing to test yet.
Question 24Cost Optimization
A travel company runs 70 Go and Java microservices on Amazon EKS, using m6i nodes that Karpenter provisions. The services have no x86-only dependencies, and the CI pipeline already builds images with Docker Buildx. Nodes run at about 60% CPU utilization all day. The company wants to lower node cost without changing application code or adding any spending commitment. Which solution is MOST cost-effective?
Correct answer: B. Build multi-architecture images and allow Graviton instance types in the NodePool.
Graviton instances cost less per hour than comparable x86 instances and usually perform as well or better for Go and Java, and multi-architecture images let Karpenter place pods on arm64 nodes without code changes. AMD-based m6a instances save less than Graviton. Fargate charges more per vCPU and GB than well-utilized EC2 nodes, and a Savings Plan adds the commitment the company wants to avoid.
Graviton instances cost less per hour than comparable x86 instances and usually perform as well or better for Go and Java, and multi-architecture images let Karpenter place pods on arm64 nodes without code changes. AMD-based m6a instances save less than Graviton. Fargate charges more per vCPU and GB than well-utilized EC2 nodes, and a Savings Plan adds the commitment the company wants to avoid.
Question 25Resilience & Migration
A company uses AWS Organizations and AWS Backup across its workload accounts. The security team assumes that an attacker could gain administrator access to a workload account. Backups must be immutable so that such an attacker cannot delete them. The team must be able to restore directly into a clean recovery account without first running a copy job, with the least operational overhead. Which solution BEST meets these requirements?
Correct answer: A. Copy recovery points to a logically air-gapped vault and share that vault with the recovery account through AWS RAM.
A logically air-gapped vault holds recovery points that are locked against deletion by default, and it can be shared through AWS RAM so that a recovery account restores directly from it. A standard vault in a central account protects the data, but it requires another copy job before a restore in the recovery account. Controls that live inside the workload account, such as a vault access policy, can be changed by an attacker with administrator access.
A logically air-gapped vault holds recovery points that are locked against deletion by default, and it can be shared through AWS RAM so that a recovery account restores directly from it. A standard vault in a central account protects the data, but it requires another copy job before a restore in the recovery account. Controls that live inside the workload account, such as a vault access policy, can be changed by an attacker with administrator access.
Question 26Cloud Architecture Design
A software company has built several AI agents with an open-source agent framework and wants to run them in production on AWS. Each user session must be isolated from all other sessions, and some agent tasks run for up to two hours. The company does not want to rewrite the agents or manage servers or container clusters. Which solution meets these requirements?
Correct answer: C. Deploy the agents to Amazon Bedrock AgentCore Runtime, which runs each session in its own microVM.
AgentCore Runtime hosts agents built with any framework, isolates each session in a dedicated microVM, and supports sessions of up to eight hours without infrastructure to manage. Lambda functions stop after 15 minutes, so two-hour tasks would fail. Bedrock Agents would require rebuilding every agent in a different model.
AgentCore Runtime hosts agents built with any framework, isolates each session in a dedicated microVM, and supports sessions of up to eight hours without infrastructure to manage. Lambda functions stop after 15 minutes, so two-hour tasks would fail. Bedrock Agents would require rebuilding every agent in a different model.
Question 27Security & Governance
A company has 25 workload accounts that run internal Application Load Balancers on the private domain corp.internal. The security team wants one private CA hierarchy that it controls from the security account. Application teams want certificates managed by AWS Certificate Manager in their own accounts. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: B. Create an AWS Private CA in the security account, share it through AWS RAM, and request private certificates in ACM per account.
Sharing one AWS Private CA through AWS RAM keeps a single hierarchy under the security team, while each account requests and manages private certificates in ACM for its load balancers. A CA per account creates 25 separate hierarchies and extra cost. Public certificates cannot be issued for a private domain such as corp.internal.
Sharing one AWS Private CA through AWS RAM keeps a single hierarchy under the security team, while each account requests and manages private certificates in ACM for its load balancers. A CA per account creates 25 separate hierarchies and extra cost. Public certificates cannot be issued for a private domain such as corp.internal.
Question 28Operational Excellence
A company runs workloads on Amazon EKS clusters in four accounts. Compliance requires that only container images built and signed by the central CI pipeline can run, and unsigned or altered images must be rejected when pods are created. The company does not want to manage signing keys itself. Which solution meets these requirements?
Correct answer: D. Sign images with AWS Signer and Notation in the pipeline, and verify signatures in each cluster with an admission controller.
AWS Signer manages the signing keys and works with the Notation CLI, and an admission controller such as Kyverno or Ratify verifies each image signature before a pod starts. Restricting pushes and making tags immutable does not prove where an image came from and does not stop pods from pulling images from other registries.
AWS Signer manages the signing keys and works with the Notation CLI, and an admission controller such as Kyverno or Ratify verifies each image signature before a pod starts. Restricting pushes and making tags immutable does not prove where an image came from and does not stop pods from pulling images from other registries.
Question 29Cloud Architecture Design
A real estate startup has a property valuation model that receives about 2,000 requests per day in unpredictable spikes, with long periods of no traffic. Payloads are under 1 MB, the model runs on CPU, and responses must be returned synchronously. Users accept a delay of a few seconds on the first request after an idle period. Which SageMaker AI inference option is the MOST cost-effective?
Correct answer: A. A serverless inference endpoint with a memory size and maximum concurrency sized for the model.
Serverless inference charges only for compute used while processing requests, scales to zero when idle, and returns synchronous responses, with cold starts that the users already accept. Asynchronous inference can scale to zero but writes results to S3 later instead of returning them in the response. A real-time endpoint bills for its instance every hour, even with no traffic.
Serverless inference charges only for compute used while processing requests, scales to zero when idle, and returns synchronous responses, with cold starts that the users already accept. Asynchronous inference can scale to zero but writes results to S3 later instead of returning them in the response. A real-time endpoint bills for its instance every hour, even with no traffic.
Question 30Security & Governance
A data lake stores billions of small objects in Amazon S3 with SSE-KMS using a customer managed key, which auditors require. AWS KMS request costs have grown quickly, and some ingestion jobs see KMS throttling. The company wants to keep the same key and encryption type. Which solution BEST meets these requirements?
Correct answer: B. Enable S3 Bucket Keys on the bucket and copy existing objects in place so they also use a bucket-level key.
S3 Bucket Keys let Amazon S3 use a bucket-level key derived from the KMS key, which cuts KMS requests sharply while keeping SSE-KMS with the same customer managed key. Switching to SSE-S3 removes the customer managed key that auditors require. A higher quota reduces throttling but does not lower request costs.
S3 Bucket Keys let Amazon S3 use a bucket-level key derived from the KMS key, which cuts KMS requests sharply while keeping SSE-KMS with the same customer managed key. Switching to SSE-S3 removes the customer managed key that auditors require. A higher quota reduces throttling but does not lower request costs.
Question 31Resilience & Migration
A company runs 40 applications defined by AWS CloudFormation stacks, and each has RTO and RPO targets set by the business. The architecture team wants to compare each application's estimated RTO and RPO with its targets for Availability Zone, Region, and infrastructure disruptions. It also wants improvement recommendations and an automatic check after every deployment in AWS CodePipeline. Which solution BEST meets these requirements?
Correct answer: A. Define resiliency policies in AWS Resilience Hub, add each application from its stacks, and run assessments in the pipeline.
Resilience Hub assesses each application against a resiliency policy that holds its RTO and RPO targets, estimates the achievable RTO and RPO for each disruption type, and gives recommendations. Assessments can be started through the API from a pipeline after each deployment. FIS experiments test real behavior, but they do not compare estimates with targets or produce architecture recommendations.
Resilience Hub assesses each application against a resiliency policy that holds its RTO and RPO targets, estimates the achievable RTO and RPO for each disruption type, and gives recommendations. Assessments can be started through the API from a pipeline after each deployment. FIS experiments test real behavior, but they do not compare estimates with targets or produce architecture recommendations.
Question 32Cost Optimization
A bank runs a containerized reconciliation job for each partner file that lands in an S3 bucket. Each job runs for 25 to 50 minutes. About 30 files arrive at random times each day, with many hours of no activity. The team wants to pay nothing while idle and does not want to patch or manage servers. Which solution is MOST cost-effective?
Correct answer: D. Start an Amazon ECS task on AWS Fargate for each file through an EventBridge rule.
Fargate bills per second only while a task runs, so idle hours cost nothing, and there are no servers to patch. Lambda would also scale to zero, but its 15-minute maximum run time is shorter than these 25 to 50 minute jobs. Always-on EC2 instances and EKS nodes keep billing through the idle hours and still need patching.
Fargate bills per second only while a task runs, so idle hours cost nothing, and there are no servers to patch. Lambda would also scale to zero, but its 15-minute maximum run time is shorter than these 25 to 50 minute jobs. Always-on EC2 instances and EKS nodes keep billing through the idle hours and still need patching.
Question 33Operational Excellence
A company runs 20 Java microservices on Amazon EKS. Leadership wants each service's availability and latency measured against targets, such as 99.9 percent of requests under 300 ms over a rolling 30 days, with alerts when the error budget burns too fast. Services and dependencies must be discovered automatically, and developers cannot change application code. Which solution meets these requirements?
Correct answer: A. Enable CloudWatch Application Signals through the CloudWatch Observability add-on and create SLOs with burn rate alarms.
Application Signals instruments Java services on EKS automatically through the add-on, discovers services and dependencies, and supports SLOs with burn rate alarms. Adding the X-Ray SDK requires code changes, and the error budget logic would be custom work.
Application Signals instruments Java services on EKS automatically through the add-on, discovers services and dependencies, and supports SLOs with burn rate alarms. Adding the X-Ray SDK requires code changes, and the error budget logic would be custom work.
Question 34Cloud Architecture Design
A retail bank scores its 20 million customers for churn risk once a week with a model trained in SageMaker AI. Customer records are exported to Amazon S3 as CSV files, results are needed by Monday morning, and no application calls the model at any other time. Which solution is the MOST cost-effective?
Correct answer: C. Run a weekly batch transform job on the S3 files, with instances that exist only for the job.
Batch transform reads the whole dataset from S3, splits it across instances, writes the results back to S3, and stops the instances when the job ends. A real-time endpoint bills continuously for capacity that is used once a week. Sending 20 million individual serverless or asynchronous requests adds per-request overhead and orchestration that a batch job avoids.
Batch transform reads the whole dataset from S3, splits it across instances, writes the results back to S3, and stops the instances when the job ends. A real-time endpoint bills continuously for capacity that is used once a week. Sending 20 million individual serverless or asynchronous requests adds per-request overhead and orchestration that a batch job avoids.
Question 35Security & Governance
A government contractor retrieves secrets from AWS Secrets Manager and calls AWS KMS from applications in its data center over the internet. The security team is worried that an attacker could record this TLS traffic today and decrypt it later with a quantum computer. The team wants to protect data in transit to these endpoints without changing application logic. Which solution BEST meets these requirements?
Correct answer: A. Configure the AWS SDK clients to negotiate hybrid post-quantum TLS key exchange that uses ML-KEM with the service endpoints.
Hybrid post-quantum TLS combines classical ECDH with ML-KEM, so recorded sessions stay protected even if the classical part is broken later, and the Secrets Manager and AWS KMS endpoints support it. ML-DSA provides signatures, which prove integrity but do not keep traffic confidential. Rotating secrets does nothing for plaintext data keys returned by AWS KMS, and RSA key exchange is not quantum resistant.
Hybrid post-quantum TLS combines classical ECDH with ML-KEM, so recorded sessions stay protected even if the classical part is broken later, and the Secrets Manager and AWS KMS endpoints support it. ML-DSA provides signatures, which prove integrity but do not keep traffic confidential. Rotating secrets does nothing for plaintext data keys returned by AWS KMS, and RSA key exchange is not quantum resistant.
Question 36Resilience & Migration
A streaming company runs stateless microservices on an Amazon EKS cluster in us-east-1. Container images are stored in Amazon ECR in us-east-1, Argo CD deploys workloads from Git, and all state lives in a DynamoDB global table. The company must recover in us-west-2 within 15 minutes of a full Regional outage. It wants to keep standby costs moderate. Which solution BEST meets these requirements?
Correct answer: D. Run a smaller standby EKS cluster in us-west-2 synced by Argo CD, turn on ECR cross-Region replication, and fail over with Route 53.
A standby cluster kept in sync by the same GitOps pipeline can scale out quickly, and ECR cross-Region replication makes images available in us-west-2 even when us-east-1 is down. A standby cluster that pulls images from us-east-1 cannot start new pods during that Regional outage. Creating a cluster and restoring backups during the event risks missing the 15-minute RTO, and an EKS cluster cannot span Regions.
A standby cluster kept in sync by the same GitOps pipeline can scale out quickly, and ECR cross-Region replication makes images available in us-west-2 even when us-east-1 is down. A standby cluster that pulls images from us-east-1 cannot start new pods during that Regional outage. Creating a cluster and restoring backups during the event risks missing the 15-minute RTO, and an EKS cluster cannot span Regions.
Question 37Cost Optimization
A publishing company stores 500 TB of article images in S3 Standard in us-east-1. A regulator requires a second copy in another Region that will be read only if the primary Region fails. In that case, the copy must serve reads within milliseconds. A recovery point objective of 24 hours is acceptable. Which solution is MOST cost-effective?
Correct answer: B. Use Cross-Region Replication into Glacier Instant Retrieval plus Batch Replication for old objects.
Replication can write replicas directly into Glacier Instant Retrieval, which has the lowest storage price of the classes that still return data in milliseconds, and its retrieval fee rarely applies because the copy is read only during a regional failure. Batch Replication copies the objects that existed before replication was turned on. Replication Time Control adds cost for a 15-minute SLA that a 24-hour RPO does not need, and Deep Archive takes hours to restore.
Replication can write replicas directly into Glacier Instant Retrieval, which has the lowest storage price of the classes that still return data in milliseconds, and its retrieval fee rarely applies because the copy is read only during a regional failure. Batch Replication copies the objects that existed before replication was turned on. Replication Time Control adds cost for a 15-minute SLA that a 24-hour RPO does not need, and Deep Archive takes hours to restore.
Question 38Cloud Architecture Design
A visual effects studio wants its artists in one large city to use cloud GPU workstations for editing with single-digit millisecond latency. The studio is closing its server room and will not install or maintain any hardware on premises. The nearest AWS Region is too far away to meet the latency target, but the city is served by an AWS Local Zone that offers GPU instances. Which solution meets these requirements?
Correct answer: C. Opt in to the Local Zone, extend the VPC with a subnet there, and run the GPU instances in that subnet.
A Local Zone places AWS compute in the metro area, so a VPC subnet there gives artists single-digit millisecond latency with no hardware at the studio. An Outposts rack also gives low latency but is hardware the studio must host on premises. Global Accelerator and placement groups do not shorten the physical distance to a remote Region.
A Local Zone places AWS compute in the metro area, so a VPC subnet there gives artists single-digit millisecond latency with no hardware at the studio. An Outposts rack also gives low latency but is hardware the studio must host on premises. Global Accelerator and placement groups do not shorten the physical distance to a remote Region.
Question 39Security & Governance
A company has 150 member accounts, and each still has root user credentials and MFA devices that the cloud team must store and audit. Auditors want those credentials removed. The team still occasionally needs to perform root-only tasks, such as deleting an S3 bucket policy that denies all principals. Which solution BEST meets these requirements?
Correct answer: B. Enable centralized root access management, delete member account root credentials, and run privileged root sessions when needed.
Centralized root access management lets the management account or a delegated administrator remove root credentials from member accounts and start short privileged root sessions for tasks like deleting a locked bucket policy. An SCP blocks root actions but leaves the credentials in place, which auditors reject. An administrator permission set cannot perform root-only tasks.
Centralized root access management lets the management account or a delegated administrator remove root credentials from member accounts and start short privileged root sessions for tasks like deleting a locked bucket policy. An SCP blocks root actions but leaves the credentials in place, which auditors reject. An administrator permission set cannot perform root-only tasks.
Question 40Operational Excellence
A company runs 30 services on Amazon ECS across EC2 and Fargate capacity. One task definition has four containers, and a memory leak in one of them makes tasks restart several times a day. The default ECS metrics show memory only at the cluster and service level. The team needs CPU and memory metrics for each task and container, with curated dashboards and the LEAST operational overhead. Which solution meets these requirements?
Correct answer: D. Turn on Container Insights with enhanced observability for the clusters and use its curated task and container views.
Container Insights with enhanced observability collects metrics down to the task and container level and provides curated dashboards without extra agents to manage. A custom sidecar could publish similar data, but it adds code and a container to every task definition.
Container Insights with enhanced observability collects metrics down to the task and container level and provides curated dashboards without extra agents to manage. A custom sidecar could publish similar data, but it adds code and a container to every task definition.
Question 41Cloud Architecture Design
A defense contractor must run Kubernetes workloads in a secure facility that has no connection to the internet or to AWS. It wants an AWS-supported Kubernetes distribution with tooling consistent with the Amazon EKS clusters it uses in the cloud. The contractor already owns the servers for the facility. Which solution meets these requirements?
Correct answer: B. Install Amazon EKS Anywhere on the servers in an air-gapped setup with a local registry.
EKS Anywhere runs the full Kubernetes control plane on customer hardware, uses Amazon EKS Distro, and supports air-gapped installation with a local image registry. EKS Hybrid Nodes and ECS Anywhere depend on a control plane in an AWS Region, so they need connectivity to AWS. Outposts also requires a connection to its parent Region and does not use the servers the contractor owns.
EKS Anywhere runs the full Kubernetes control plane on customer hardware, uses Amazon EKS Distro, and supports air-gapped installation with a local image registry. EKS Hybrid Nodes and ECS Anywhere depend on a control plane in an AWS Region, so they need connectivity to AWS. Outposts also requires a connection to its parent Region and does not use the servers the contractor owns.
Question 42Security & Governance
A company has 120 accounts across four Regions. The SOC wants AWS Security Hub with the AWS Foundational Security Best Practices standard enabled consistently in every account and Region, including new accounts, and wants all findings visible in a single Region. The SOC must not use the management account. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: C. Use a delegated administrator with central configuration policies on the root and a home Region that aggregates linked Regions.
A delegated administrator with central configuration applies Security Hub and its standards to all current and new accounts and Regions, and cross-Region aggregation shows all findings in the home Region. Using the management account as administrator violates the SOC constraint. Per-account scripts and StackSets with EventBridge forwarding add ongoing operational overhead.
A delegated administrator with central configuration applies Security Hub and its standards to all current and new accounts and Regions, and cross-Region aggregation shows all findings in the home Region. Using the management account as administrator violates the SOC constraint. Per-account scripts and StackSets with EventBridge forwarding add ongoing operational overhead.
Question 43Operational Excellence
A global online store hosts its web application in us-east-1. Customers in South America report slow pages, but server-side latency metrics look normal. The team needs page load times, JavaScript errors, and Core Web Vitals from real customer browsers, broken down by country and browser. Which solution BEST meets these requirements?
Correct answer: A. Create a CloudWatch RUM app monitor and add its JavaScript snippet to the pages to collect real user performance data.
CloudWatch RUM collects page load timing, JavaScript errors, and Core Web Vitals from real user sessions and lets the team filter by country and browser. Synthetics canaries measure scripted visits from AWS Regions, so they do not show what real customers experience on their own devices and networks.
CloudWatch RUM collects page load timing, JavaScript errors, and Core Web Vitals from real user sessions and lets the team filter by country and browser. Synthetics canaries measure scripted visits from AWS Regions, so they do not show what real customers experience on their own devices and networks.
Question 44Cost Optimization
A software vendor serves 900 TB per month of installer downloads directly from an S3 bucket to customers worldwide. About 40 files make up almost all of the downloads. Customers in Asia and Europe complain about slow download speeds. The vendor wants to cut data transfer cost and improve download speed. Which solution is MOST cost-effective?
Correct answer: D. Put an Amazon CloudFront distribution with origin access control in front of the bucket.
CloudFront caches the popular installers at edge locations, so few requests reach S3, and data transfer from S3 to CloudFront has no charge. At this volume CloudFront delivery is typically cheaper per GB than direct S3 internet transfer, and edge delivery fixes the speed problem. Transfer Acceleration adds a per-GB fee on top of normal transfer, and replicas add storage, replication and routing costs.
CloudFront caches the popular installers at edge locations, so few requests reach S3, and data transfer from S3 to CloudFront has no charge. At this volume CloudFront delivery is typically cheaper per GB than direct S3 internet transfer, and edge delivery fixes the speed problem. Transfer Acceleration adds a per-GB fee on top of normal transfer, and replicas add storage, replication and routing costs.
Question 45Resilience & Migration
A company is assessing 600 applications for migration. One is a commercial HR system that runs on premises, and its vendor will end support for on-premises installations in 10 months. The vendor offers a SaaS edition with the same features and a data import tool. The company wants to stop managing infrastructure and patching for this application. Which migration strategy BEST meets these requirements?
Correct answer: A. Repurchase by moving to the vendor's SaaS edition and loading the data with the vendor's import tool.
Repurchasing the vendor's SaaS edition removes all infrastructure and patching work and keeps the application supported. Rehosting or replatforming still leaves the company running a version that is losing vendor support, with servers to patch. Retaining the system only delays the problem and does not reduce operational work.
Repurchasing the vendor's SaaS edition removes all infrastructure and patching work and keeps the application supported. Rehosting or replatforming still leaves the company running a version that is losing vendor support, with servers to patch. Retaining the system only delays the problem and does not reduce operational work.
Question 46Cloud Architecture Design
A financial services firm backs up on-premises servers with commercial backup software to a physical tape library and ships the tapes offsite. It wants to eliminate physical tapes and keep backups for 10 years at the lowest storage cost. The firm cannot change its backup software or backup processes. Which solution meets these requirements?
Correct answer: C. Deploy Tape Gateway as a virtual tape library and archive the tapes to S3 Glacier Deep Archive.
Tape Gateway presents an iSCSI virtual tape library that existing backup software already supports, and archived virtual tapes can be stored in S3 Glacier Deep Archive for the lowest storage cost. S3 File Gateway would require changing the backup jobs to write to a file share. AWS Backup replaces the existing backup software, which the firm cannot do.
Tape Gateway presents an iSCSI virtual tape library that existing backup software already supports, and archived virtual tapes can be stored in S3 Glacier Deep Archive for the lowest storage cost. S3 File Gateway would require changing the backup jobs to write to a file share. AWS Backup replaces the existing backup software, which the firm cannot do.
Question 47Security & Governance
A security team wants CloudTrail management events, VPC Flow Logs, Route 53 Resolver query logs and Security Hub findings from 80 accounts and five Regions in one data lake. The data must be normalized to an open schema, kept in a rollup Region with lifecycle-based retention, and queryable by a third-party SIEM. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: D. Enable Amazon Security Lake from a delegated administrator with a rollup Region and add the SIEM as a subscriber.
Amazon Security Lake collects these AWS sources across accounts and Regions, normalizes them to OCSF, consolidates them in a rollup Region with retention settings, and grants subscriber access to third-party tools. Glue jobs or OpenSearch index templates would need custom normalization work. CloudTrail Lake is built for CloudTrail activity events, not as a normalized lake for Flow Logs and Resolver logs.
Amazon Security Lake collects these AWS sources across accounts and Regions, normalizes them to OCSF, consolidates them in a rollup Region with retention settings, and grants subscriber access to third-party tools. Glue jobs or OpenSearch index templates would need custom normalization work. CloudTrail Lake is built for CloudTrail activity events, not as a normalized lake for Flow Logs and Resolver logs.
Question 48Operational Excellence
A company uses a Lambda function to start a Systems Manager Automation runbook that restarts the application process on EC2 instances tagged Role=web. Last month a faulty health check made the runbook restart all 400 web instances at once, which caused an outage. Remediation must stay fully automatic, touch no more than 10 percent of the instances at a time, and halt if 3 instances fail. Which solution meets these requirements?
Correct answer: D. Start the runbook with a tag target, a maximum concurrency of 10 percent, and a maximum errors value of 3.
Automation rate control limits how many targets a runbook processes at the same time and stops the execution when the error threshold is reached. Reserved concurrency on the Lambda function limits runbook executions, but a single execution can still restart every tagged instance at once.
Automation rate control limits how many targets a runbook processes at the same time and stops the execution when the error threshold is reached. Reserved concurrency on the Lambda function limits runbook executions, but a single execution can still restart every tagged instance at once.
Question 49Cloud Architecture Design
A global logistics company operates in eight AWS Regions with dozens of VPCs and branch offices connected through SD-WAN appliances. It maintains a full mesh of transit gateway peering connections with static routes, and route changes have caused outages. The company wants one central policy that defines which Regions and network segments can communicate, with routes propagated automatically across Regions. Which solution meets these requirements?
Correct answer: B. Migrate to AWS Cloud WAN with a core network policy that defines edge locations and network segments.
AWS Cloud WAN builds a global core network from a single policy document that defines segments and edge locations, and it propagates routes between Regions automatically. A Lambda function that updates peering routes is custom code that keeps the risky static route model. A transit gateway can attach only VPCs in its own Region.
AWS Cloud WAN builds a global core network from a single policy document that defines segments and edge locations, and it propagates routes between Regions automatically. A Lambda function that updates peering routes is custom code that keeps the risky static route model. A transit gateway can attach only VPCs in its own Region.
Question 50Security & Governance
A company has 80 accounts where teams often create internet-facing Application Load Balancers and API Gateway stages. Security wants a baseline AWS WAF web ACL with AWS managed rule groups attached automatically to every existing and new ALB and API stage. Teams must still be able to add their own rules. Which solution meets these requirements with the LEAST operational overhead?
Correct answer: C. Create an AWS Firewall Manager WAF policy with automatic remediation that adds the baseline as first rule groups in each web ACL.
Firewall Manager WAF policies apply a web ACL to all in-scope resources across the organization, including new ones, and the first and last rule groups set by security leave room for teams to add their own rules. StackSets deploy the web ACL but do not associate it with new resources. Shield Advanced focuses on DDoS protection, and Network Firewall does not protect API Gateway stages.
Firewall Manager WAF policies apply a web ACL to all in-scope resources across the organization, including new ones, and the first and last rule groups set by security leave room for teams to add their own rules. StackSets deploy the web ACL but do not associate it with new resources. Shield Advanced focuses on DDoS protection, and Network Firewall does not protect API Gateway stages.
Question 51Resilience & Migration
A company is moving a monolithic Java order application from its data center to AWS and wants to break it into microservices over 18 months. Features must move one at a time with no big-bang cutover. The monolith must keep serving every feature that has not moved yet. Each moved feature must be easy to roll back. Which approach BEST meets these requirements?
Correct answer: D. Put Amazon API Gateway in front, route each moved feature's paths to its new service, and send other paths to the monolith.
This is the strangler fig pattern. A routing layer sends only the moved features to new services while the monolith handles the rest, so rolling back a feature means changing one route. A one-weekend cutover and a DNS switch after every feature is rebuilt are both big-bang approaches, and weighted DNS splits traffic by hostname, not by feature path.
This is the strangler fig pattern. A routing layer sends only the moved features to new services while the monolith handles the rest, so rolling back a feature means changing one route. A one-weekend cutover and a DNS switch after every feature is rebuilt are both big-bang approaches, and weighted DNS splits traffic by hostname, not by feature path.
Question 52Cost Optimization
A conglomerate runs 150 AWS accounts in one organization for 12 business units, and some accounts are shared by several units. Resources already carry a CostCenter tag, but the tag does not appear in Cost Explorer or in any billing data. Finance wants monthly chargeback reports grouped by CostCenter across all accounts using SQL, with minimal ongoing effort. Which solution is MOST cost-effective?
Correct answer: C. Activate the tag for cost allocation in the management account and query a CUR 2.0 export in Athena.
User-defined tags appear in billing data only after they are activated as cost allocation tags, and in an organization that is done in the management account. A CUR 2.0 export through Data Exports then carries the tag as a column, so Athena can group costs by CostCenter across every account, including shared ones. Member accounts cannot activate the tag for the organization, and a custom Lambda pipeline adds code and Cost Explorer API charges.
User-defined tags appear in billing data only after they are activated as cost allocation tags, and in an organization that is done in the management account. A CUR 2.0 export through Data Exports then carries the tag as a column, so Athena can group costs by CostCenter across every account, including shared ones. Member accounts cannot activate the tag for the organization, and a custom Lambda pipeline adds code and Cost Explorer API charges.
Question 53Operational Excellence
A company runs 150 EBS-backed EC2 instances that are not in Auto Scaling groups. It often receives AWS Health notifications that instances are scheduled for retirement because of degraded hardware, and engineers handle them by hand. The company wants each affected instance moved to healthy hardware automatically when the notification arrives, without waiting for the hardware to fail. Which solution meets these requirements?
Correct answer: B. Create an EventBridge rule for the retirement events that runs an Automation runbook to stop and start each affected instance.
AWS Health events reach EventBridge, which can start an Automation runbook right away, and a stop and start moves an EBS-backed instance to new hardware. A reboot keeps the instance on the same host, so it does not avoid the retirement.
AWS Health events reach EventBridge, which can start an Automation runbook right away, and a stop and start moves an EBS-backed instance to new hardware. A reboot keeps the instance on the same host, so it does not avoid the retirement.
Question 54Cloud Architecture Design
A company wants 30 application teams, each with its own AWS account, to deploy workloads into a few centrally managed VPCs. The network team must keep control of route tables, NAT gateways, and network ACLs, and wants fewer VPCs and transit gateway attachments to manage. Each application team must manage only its own resources. Which solution meets these requirements?
Correct answer: C. Share subnets from VPCs in a network account with the application accounts through AWS RAM.
VPC sharing through AWS RAM lets application accounts launch resources into shared subnets while the owner account keeps control of route tables, NAT gateways, and network ACLs. Participants manage only their own resources and security groups. A VPC per account with transit gateway attachments is the model the company wants to move away from, and a peered VPC cannot use another VPC's NAT gateway.
VPC sharing through AWS RAM lets application accounts launch resources into shared subnets while the owner account keeps control of route tables, NAT gateways, and network ACLs. Participants manage only their own resources and security groups. A VPC per account with transit gateway attachments is the model the company wants to move away from, and a peered VPC cannot use another VPC's NAT gateway.
Question 55Security & Governance
A fintech company must prove data residency: workloads and data may exist only in eu-central-1 and eu-west-1. Developers in member accounts must be blocked from launching resources in any other Region, except for the global services that IAM and CloudFront require. Which solution enforces this with the LEAST ongoing effort?
Correct answer: A. Attach an SCP that denies all actions when aws:RequestedRegion is outside the two Regions, with exemptions for global services
A Region deny SCP (the pattern Control Tower uses for its Region deny control) blocks creation in unapproved Regions organization-wide, including in new accounts, with no per-account work. Config rules only detect after the fact, and opt-in Region settings do not cover the default commercial Regions.
A Region deny SCP (the pattern Control Tower uses for its Region deny control) blocks creation in unapproved Regions organization-wide, including in new accounts, with no per-account work. Config rules only detect after the fact, and opt-in Region settings do not cover the default commercial Regions.
Question 56Resilience & Migration
A gaming company runs a 4 TB Amazon RDS for MySQL 8.0 DB instance and wants to move to Amazon Aurora MySQL for better read scaling. The cutover can cause no more than 10 minutes of write downtime. The team wants the least operational overhead and does not want to manage replication tasks. Which solution BEST meets these requirements?
Correct answer: B. Create an Aurora read replica of the RDS for MySQL instance, wait for zero lag, stop writes, and promote the replica.
An Aurora read replica of an RDS for MySQL instance stays in sync through replication that AWS manages, so promoting it after lag reaches zero takes only minutes of write downtime. Restoring a snapshot loses every write made after the snapshot unless writes stop for the whole restore. A DMS task can also meet the downtime goal, but it adds the replication tasks that the team wants to avoid.
An Aurora read replica of an RDS for MySQL instance stays in sync through replication that AWS manages, so promoting it after lag reaches zero takes only minutes of write downtime. Restoring a snapshot loses every write made after the snapshot unless writes stop for the whole restore. A DMS task can also meet the downtime goal, but it adds the replication tasks that the team wants to avoid.
Question 57Cloud Architecture Design
A gaming company has nearly run out of private IPv4 addresses and is moving new backend services to IPv6. The backend instances need outbound access to IPv6 internet services, must not accept connections that start from the internet, and must still call several IPv4-only partner APIs. New subnets must not consume IPv4 addresses for instances. Which solution meets these requirements?
Correct answer: A. Use IPv6-only subnets with an egress-only internet gateway, plus DNS64 and a NAT gateway for NAT64.
IPv6-only subnets use no IPv4 addresses, the egress-only internet gateway allows outbound-only IPv6 traffic, and DNS64 with a NAT gateway route for 64:ff9b::/96 lets instances reach IPv4-only APIs through NAT64. Dual-stack subnets work functionally but still assign a private IPv4 address to every instance. An egress-only internet gateway does not translate between IPv6 and IPv4.
IPv6-only subnets use no IPv4 addresses, the egress-only internet gateway allows outbound-only IPv6 traffic, and DNS64 with a NAT gateway route for 64:ff9b::/96 lets instances reach IPv4-only APIs through NAT64. Dual-stack subnets work functionally but still assign a private IPv4 address to every instance. An egress-only internet gateway does not translate between IPv6 and IPv4.
Question 58Security & Governance
A healthcare startup with 30 accounts in AWS Organizations plans to store protected health information. It must accept the AWS Business Associate Addendum so that it covers every current and future account, and its auditors need AWS's latest SOC 2 report. Which solution BEST meets these requirements?
Correct answer: C. From the management account, accept the BAA as an organization agreement in AWS Artifact and download the SOC 2 report there.
An organization agreement accepted in AWS Artifact from the management account applies to all current and future member accounts, and Artifact also provides AWS compliance reports such as SOC 2. Account agreements must be accepted per account and would miss new accounts. Audit Manager does not accept agreements with AWS.
An organization agreement accepted in AWS Artifact from the management account applies to all current and future member accounts, and Artifact also provides AWS compliance reports such as SOC 2. Account agreements must be accepted per account and would miss new accounts. Audit Manager does not accept agreements with AWS.
Question 59Operational Excellence
A multi-tenant SaaS company processes jobs for all tenants from one SQS queue with one Lambda function. Last week one large tenant submitted 2 million jobs, which used all of the account's Lambda concurrency, delayed other tenants for hours, and throttled the company's API functions. The company wants to isolate its five largest tenants so that their spikes cannot delay other tenants or throttle the API. Which solution BEST meets these requirements?
Correct answer: D. Give each large tenant its own queue and function, cap each event source mapping's concurrency, and reserve API concurrency.
Separate queues and functions act as bulkheads, maximum concurrency on each event source mapping caps what one tenant can consume, and reserved concurrency protects the API functions. Reserved concurrency on the shared worker protects the API, but all other tenants still wait behind the large tenant's jobs in the single queue.
Separate queues and functions act as bulkheads, maximum concurrency on each event source mapping caps what one tenant can consume, and reserved concurrency protects the API functions. Reserved concurrency on the shared worker protects the API, but all other tenants still wait behind the large tenant's jobs in the single queue.
Question 60Cost Optimization
A software company runs a customer support assistant on Amazon Bedrock. Every request sends the same 30,000-token product manual and system instructions, followed by a customer question of about 200 tokens. Traffic is steady at several requests per second during business hours. Answers must be returned in real time, and response quality must not change. Which change is MOST cost-effective?
Correct answer: D. Enable prompt caching with a cache checkpoint after the shared manual and instructions.
Prompt caching stores the repeated 30,000-token prefix, and later requests that reuse it are billed at a much lower rate for cached input tokens, which is almost all of each prompt here. The same model sees the same context, so quality does not change. Batch inference cannot answer customers in real time, and a smaller model with a shorter manual risks worse answers.
Prompt caching stores the repeated 30,000-token prefix, and later requests that reuse it are billed at a much lower rate for cached input tokens, which is almost all of each prompt here. The same model sees the same context, so quality does not change. Batch inference cannot answer customers in real time, and a smaller model with a shorter manual risks worse answers.
Question 61Cloud Architecture Design
A company sends all traffic between 20 spoke VPCs through an inspection VPC that runs AWS Network Firewall endpoints in three Availability Zones, all connected by a transit gateway. Some connections between spokes in different Availability Zones are dropped because the firewall sees only one direction of the flow. The company must fix the problem without redesigning the network. What should the company do?
Correct answer: A. Enable appliance mode on the transit gateway attachment for the inspection VPC.
Appliance mode on the inspection VPC attachment makes the transit gateway keep both directions of a flow in the same Availability Zone for the life of the flow, so the stateful firewall sees symmetric traffic. Setting it on the spoke attachments does not control how traffic enters the inspection VPC. Using a single Availability Zone fixes symmetry but removes high availability.
Appliance mode on the inspection VPC attachment makes the transit gateway keep both directions of a flow in the same Availability Zone for the life of the flow, so the stateful firewall sees symmetric traffic. Setting it on the spoke attachments does not control how traffic enters the inspection VPC. Using a single Availability Zone fixes symmetry but removes high availability.
Question 62Security & Governance
A German insurer uses Amazon Bedrock in eu-central-1 for claims summarization. Traffic spikes now exceed the Region's on-demand throughput, and the company wants Bedrock to route requests to other Regions automatically. Regulators require that prompts and responses are processed only within the EU. Which solution BEST meets these requirements?
Correct answer: B. Invoke the model through an EU geographic cross-Region inference profile and allow its EU destination Regions in the SCPs.
An EU geographic inference profile spreads requests across Regions inside the EU only, which raises throughput while meeting the residency rule, as long as SCPs allow those destination Regions. A global inference profile can process requests outside the EU. Sending overflow to us-east-1 also breaks the residency requirement.
An EU geographic inference profile spreads requests across Regions inside the EU only, which raises throughput while meeting the residency rule, as long as SCPs allow those destination Regions. A global inference profile can process requests outside the EU. Sending overflow to us-east-1 also breaks the residency requirement.
Question 63Operational Excellence
Video transcoding workers run in an EC2 Auto Scaling group and pull jobs from an SQS queue. Each instance completes about 10 jobs per minute, and jobs must start within 5 minutes, so the acceptable backlog is 50 messages per instance. Scaling on CPU does not work because CPU stays high whether the queue holds 20 or 20,000 messages. Which scaling approach BEST meets these requirements?
Correct answer: D. Use target tracking on a metric math expression that divides visible messages by in-service instances, with a target of 50.
Backlog per instance changes in proportion to group capacity, which target tracking needs in order to calculate how many instances to add or remove. Tracking raw queue depth with a target of 50 ignores the number of instances, so the policy cannot size the group correctly.
Backlog per instance changes in proportion to group capacity, which target tracking needs in order to calculate how many instances to add or remove. Tracking raw queue depth with a target of 50 ignores the number of instances, so the policy cannot size the group correctly.
Question 64Resilience & Migration
A company runs a self-managed Apache Kafka cluster on premises and wants to move to Amazon MSK. Producers and consumers must keep working during the migration. Consumers must resume on MSK from the position they reached on premises, without reprocessing old data. Downtime for each application should be only a quick restart. Which solution BEST meets these requirements?
Correct answer: C. Use MirrorMaker 2 to replicate topics and consumer group offsets to MSK, then move consumers and producers to MSK.
MirrorMaker 2 continuously replicates topics and can sync translated consumer group offsets, so consumers resume on MSK close to where they stopped. Replicating without offset sync and starting from the earliest offset forces consumers to reprocess old data. DMS supports Kafka only as a target, not as a source, and MSK does not give access to broker storage.
MirrorMaker 2 continuously replicates topics and can sync translated consumer group offsets, so consumers resume on MSK close to where they stopped. Replicating without offset sync and starting from the earliest offset forces consumers to reprocess old data. DMS supports Kafka only as a target, not as a source, and MSK does not give access to broker storage.
Question 65Cost Optimization
A SaaS company publishes a custom CloudWatch latency metric with a CustomerId dimension for each of its 60,000 customers. The custom metrics charge is now one of the largest items on its monthly bill. Operations needs alarms only on overall latency, and per-customer latency is reviewed only when a customer opens a ticket. The application already writes every request, including the customer ID and latency, to CloudWatch Logs. Which solution is MOST cost-effective?
Correct answer: B. Drop the CustomerId dimension and use Logs Insights on the request logs for per-customer latency.
Each unique dimension value creates a separate billed custom metric, so removing CustomerId leaves one latency metric for alarms, and Logs Insights can compute any customer's latency from logs that are already stored. Publishing less often does not help because custom metrics are billed per metric for each hour they receive data. Embedded metric format and per-customer metric filters still create one custom metric per customer.
Each unique dimension value creates a separate billed custom metric, so removing CustomerId leaves one latency metric for alarms, and Logs Insights can compute any customer's latency from logs that are already stored. Publishing less often does not help because custom metrics are billed per metric for each hour they receive data. Embedded metric format and per-customer metric filters still create one custom metric per customer.
Question 66Cloud Architecture Design
A mobile game has 5 million daily players and must show a global leaderboard that updates within milliseconds of a score change. Players must be able to see their own rank and the top 100 players instantly. Scores are already stored durably in Amazon DynamoDB. Which solution meets these requirements with the simplest design at peak load?
Correct answer: C. Keep the leaderboard in an ElastiCache for Valkey sorted set that is updated from DynamoDB Streams.
A sorted set keeps members ordered by score in memory, so commands such as ZADD, ZREVRANK, and ZREVRANGE update scores and return ranks in under a millisecond. A DynamoDB index can return the top scores, but finding one player's rank among millions requires reading many items. DAX caches reads but does not compute ranks, so the scans are still needed.
A sorted set keeps members ordered by score in memory, so commands such as ZADD, ZREVRANK, and ZREVRANGE update scores and return ranks in under a millisecond. A DynamoDB index can return the top scores, but finding one player's rank among millions requires reading many items. DAX caches reads but does not compute ranks, so the scans are still needed.
Question 67Security & Governance
A media company lets internal users query a knowledge base through an Amazon Bedrock application. Legal requires evidence for each quarter showing which SOC 2 controls are met, combining AWS compliance reports with the company's own control evidence, assembled with minimal manual work. Which approach should the architect recommend?
Correct answer: A. Use AWS Audit Manager with a SOC 2 framework to collect evidence automatically, alongside AWS Artifact for AWS's own reports
Audit Manager continuously collects evidence mapped to SOC 2 controls and produces assessment reports, while Artifact supplies AWS's own compliance reports, covering both sides of the shared responsibility model. Security Hub findings show security posture, not control evidence mapped to an audit framework.
Audit Manager continuously collects evidence mapped to SOC 2 controls and produces assessment reports, while Artifact supplies AWS's own compliance reports, covering both sides of the shared responsibility model. Security Hub findings show security posture, not control evidence mapped to an audit framework.
Question 68Operational Excellence
A company defines 15 services in the AWS CDK with TypeScript. It needs a pipeline in a tooling account that deploys each change to dev, staging, and production accounts in two Regions, with a manual approval before production. When engineers add a new stage or Region in code, the pipeline must update itself. The company wants the LEAST operational overhead. Which solution meets these requirements?
Correct answer: B. Use CDK Pipelines in the tooling account with self-mutation, waves for the Regions, and a manual approval step for production.
CDK Pipelines generates a pipeline that updates its own definition when the CDK code changes, deploys to bootstrapped target accounts, and supports waves and manual approval steps. A pipeline built by hand in the console must be edited every time a stage or Region is added.
CDK Pipelines generates a pipeline that updates its own definition when the CDK code changes, deploys to bootstrapped target accounts, and supports waves and manual approval steps. A pipeline built by hand in the console must be edited every time a stage or Region is added.
Question 69Cloud Architecture Design
A sales operations team needs Salesforce opportunity records copied into an Amazon S3 data lake every hour. Only new and changed records should be transferred, and files must be written in Parquet format. The company has no developers to build or maintain API integration code and wants a fully managed service. Which solution meets these requirements?
Correct answer: A. Create an Amazon AppFlow flow from Salesforce to S3 with an hourly schedule and incremental transfer.
Amazon AppFlow connects to Salesforce without code, runs scheduled flows that transfer only new and changed records, and can write Parquet files to S3. AWS DMS does not support Salesforce as a source endpoint. Glue crawlers populate the Data Catalog with schemas and do not copy records.
Amazon AppFlow connects to Salesforce without code, runs scheduled flows that transfer only new and changed records, and can write Parquet files to S3. AWS DMS does not support Salesforce as a source endpoint. Glue crawlers populate the Data Catalog with schemas and do not copy records.
Question 70Security & Governance
A company has 40 accounts where developers call Amazon Bedrock models directly. Security requires that every model invocation, including Converse API calls, uses the company's approved guardrail, and developers must not be able to skip it. The control must be preventive and centrally managed. Which solution BEST meets these requirements?
Correct answer: C. Attach an SCP that denies Bedrock invoke actions unless the bedrock:GuardrailIdentifier key matches the approved guardrail.
The bedrock:GuardrailIdentifier condition key lets an SCP deny model invocations that do not specify the approved guardrail, which is preventive and managed centrally for all accounts. Invocation logging and EventBridge automation only react after a call without the guardrail has run. An SDK wrapper can be bypassed by calling the API directly.
The bedrock:GuardrailIdentifier condition key lets an SCP deny model invocations that do not specify the approved guardrail, which is preventive and managed centrally for all accounts. Invocation logging and EventBridge automation only react after a call without the guardrail has run. An SDK wrapper can be bypassed by calling the API directly.
Question 71Cost Optimization
A manufacturing company plans to buy a Savings Plan this week to cover its average On-Demand EC2 spend. Compute Optimizer reports that 45% of its instances are over-provisioned, and engineering can apply those changes within 6 weeks. The CFO wants the lowest total cost over the next 3 years without paying for unused commitment. Which approach is MOST cost-effective?
Correct answer: B. Apply the rightsizing changes first, then buy a Savings Plan sized to the new baseline.
Rightsizing lowers the hourly baseline, so a Savings Plan bought afterward commits only to spend the company will actually use. A plan bought now at today's average would be partly unused once the over-provisioned instances shrink, and unused commitment is still billed every hour. Six weeks at On-Demand rates cost far less than three years of excess commitment.
Rightsizing lowers the hourly baseline, so a Savings Plan bought afterward commits only to spend the company will actually use. A plan bought now at today's average would be partly unused once the over-provisioned instances shrink, and unused commitment is still billed every hour. Six weeks at On-Demand rates cost far less than three years of excess commitment.
Question 72Resilience & Migration
A retailer has replicated its web tier and database to AWS and plans to cut over next week. Its public DNS record currently has a TTL of 24 hours. The database can accept writes in only one location at a time. The business allows at most 15 minutes of disruption and wants a fast rollback path to the data center during the first hour. Which cutover plan BEST meets these requirements?
Correct answer: D. Lower the record's TTL to 60 seconds at least 24 hours before cutover, and then update the record during the window.
Resolvers keep caching a record for its old TTL, so the TTL must be lowered at least one full old TTL, 24 hours, before cutover. After that, both the cutover and any rollback take effect within about a minute. Lowering the TTL at the start of the window does not help because resolvers still hold the 24-hour value, and weighted routing would send writes to two databases at once.
Resolvers keep caching a record for its old TTL, so the TTL must be lowered at least one full old TTL, 24 hours, before cutover. After that, both the cutover and any rollback take effect within about a minute. Lowering the TTL at the start of the window does not help because resolvers still hold the 24-hour value, and weighted routing would send writes to two databases at once.
Question 73Operational Excellence
A team must apply a template update to a production CloudFormation stack that contains an RDS DB instance holding customer data. Before anything changes, the team must see which resources CloudFormation will modify and whether any will be replaced. A database administrator must approve the update before it runs. Which solution meets these requirements?
Correct answer: A. Create a change set, review the Replacement value for each resource, and execute it after the administrator approves.
A change set previews the exact actions CloudFormation will take, including whether each resource will be replaced, and nothing changes until someone executes it. Drift detection compares live resources with the current template, so it says nothing about what the new template will do.
A change set previews the exact actions CloudFormation will take, including whether each resource will be replaced, and nothing changes until someone executes it. Drift detection compares live resources with the current template, so it says nothing about what the new template will do.
Question 74Cloud Architecture Design
A retail company runs a large Amazon Redshift RA3 cluster in its central data account. The marketing and finance teams each have their own AWS account and want to query the latest sales tables with their own compute so their workloads do not slow down the central cluster. Data must not be copied or reloaded. Which solution meets these requirements?
Correct answer: B. Create Redshift datashares and grant them to each team's account for querying from Redshift Serverless.
Redshift data sharing gives consumer clusters or Serverless workgroups in other accounts live read access to shared tables without copying data, and the consumers use their own compute. Workload management only divides the central cluster's resources, so heavy queries still compete with other work. Unloading data or restoring snapshots copies the data and returns stale results.
Redshift data sharing gives consumer clusters or Serverless workgroups in other accounts live read access to shared tables without copying data, and the consumers use their own compute. Workload management only divides the central cluster's resources, so heavy queries still compete with other work. Unloading data or restoring snapshots copies the data and returns stale results.
Question 75Security & Governance
A company is building an AI agent on Amazon Bedrock AgentCore Runtime that reads and updates each employee's tasks in a third-party project management SaaS. The SaaS supports OAuth 2.0, and the agent must act only with each user's own consented access. Employees sign in with the corporate IdP, and tokens must not be stored in agent code or configuration. Which solution BEST meets these requirements?
Correct answer: D. Use AgentCore Identity with the corporate IdP for inbound auth and an OAuth 2.0 credential provider for user tokens.
AgentCore Identity authenticates users through the corporate IdP and uses an OAuth 2.0 credential provider to obtain user-consented tokens, which it keeps in its token vault instead of agent code. A shared service account token lets the agent act beyond each user's own access. Third-party SaaS APIs do not accept IAM role credentials.
AgentCore Identity authenticates users through the corporate IdP and uses an OAuth 2.0 credential provider to obtain user-consented tokens, which it keeps in its token vault instead of agent code. A shared service account token lets the agent act beyond each user's own access. Third-party SaaS APIs do not accept IAM role credentials.
The real AWS Solutions Architect Professional exam at a glance
75questions
3htime limit
MCQmultiple choice
75%+aim for here
Score 75% or more on two different sets before you book the real exam. Need a plan for your weak topics? See how we help you pass, or get a full refund.
More free AWS practice tests
AWS Cloud Practitioner Practice Test65 questions · CLF-C02AWS AI Practitioner Practice Test65 questions · AIF-C01AWS Solutions Architect Associate Practice Test65 questions · SAA-C03AWS Security Specialty Practice Test65 questions · SCS-C03AWS DevOps Engineer Professional Practice Test75 questions · DOP-C02AWS Data Engineer Associate Practice Test65 questions · DEA-C01
See all 36 free practice tests →
Original practice questions written by CertOcean in the style of the AWS Solutions Architect Professional exam. They are not real exam questions. AWS Solutions Architect Professional and Amazon Web Services are trademarks of their owners. Real exam format: 75 questions (65 scored, 10 unscored) · 180 minutes · passing score 720 on a 100-1000 scale.