AWS Certified Solutions Architect Professional SAPC02 AWS Certified Solutions Architect Professional SAPC02 Free Practice Test — 30 Questions
This practice set exercises the knowledge and decision-making required to design advanced AWS architectures for global enterprises under strict compliance, data residency, and high-availability constraints. It covers multi-account governance with AWS Organizations and SCPs, modernization of monolithic applications into microservices, disaster recovery strategies with low RTO/RPO, and data protection using encryption, monitoring, and auditing services. The questions emphasize trade-offs between cost, performance, and regulatory requirements, and the ability to choose the right combination of AWS services such as ECS/EKS, Lambda, DynamoDB, ElastiCache, Step Functions, and KMS. Mastery of these scenarios prepares you for complex architectural challenges on the AWS platform.
What this AWS Certified Solutions Architect Professional SAPC02 AWS Certified Solutions Architect Professional SAPC02 practice set measures
This is an analysis of the practice bank, not a claim about the vendor's live exam blueprint. Use it to identify the knowledge, judgment, and recall patterns exercised here, then verify your coverage against the current official exam guide.
Multi-Account Governance and Compliance
This practice set frequently tests the interplay between AWS Organizations, Service Control Policies (SCPs), and IAM policies in multi-account environments. Scenarios involve enforcing data residency, denying actions on tagged resources, and managing cross-account access. Understanding that SCPs set maximum permissions and explicit denies override any IAM allow is critical. Additionally, AWS Control Tower and AWS Config are used for automated guardrails and monitoring compliance. The questions require you to determine effective permissions when SCPs and IAM policies conflict, and to design solutions that prevent unauthorized resource creation or deletion across accounts.
- SCPs act as guardrails; explicit denies in SCPs always override IAM allows.
- AWS Control Tower automates multi-account setup with pre-defined guardrails.
- AWS Config continuously monitors resource configurations for compliance drift.
- Data residency can be enforced using SCPs to restrict region-specific resource creation.
Microservices and Application Modernization
Many questions address migrating monolithic applications to microservices using container orchestration (ECS/EKS), serverless compute (Lambda), and managed databases (DynamoDB, Aurora). The focus is on achieving independent scaling, resilience, and faster deployment cycles. Key decisions include choosing between ECS Fargate and EKS, using API Gateway for inter-service communication, and leveraging Step Functions for workflow orchestration. State management is often externalized to ElastiCache or DynamoDB to maintain session integrity during gradual rollouts.
- Decompose monoliths into microservices with ECS/EKS for orchestration and Lambda for event-driven processing.
- Use API Gateway with Lambda to expose RESTful APIs and manage traffic.
- Externalize session state using ElastiCache for Redis to support stateless application tiers.
- AWS Step Functions coordinate multi-step transactions across microservices with built-in error handling.
Data Protection and Disaster Recovery
Disaster recovery scenarios demand low RTO/RPO, often using SAP HANA System Replication, RDS Multi-AZ, or Aurora Global Databases. Pilot light and warm standby strategies balance cost and recovery time. Data immutability for audit logs is achieved through S3 Object Lock in Compliance mode. Encryption at rest using KMS with customer-managed keys is a recurring requirement. The practice set emphasizes the need for automated failover and regular testing of DR procedures to ensure business continuity under regulatory scrutiny.
- SAP HANA with System Replication supports sub-minute RPO; pilot light reduces standby costs.
- S3 Object Lock (Compliance mode) prevents any user from deleting or overwriting objects during retention.
- Enable RDS automated backups with WAL archiving for point-in-time recovery down to the second.
- Cross-region replication for S3 must be paired with SCPs to enforce data residency boundaries.
Security and Monitoring
Security questions cover identity management (Cognito User Pools), vulnerability scanning (Inspector), and automated patching (Systems Manager). Monitoring and troubleshooting rely on CloudWatch Logs, Metrics, and AWS X-Ray for distributed tracing. Compliance with standards like PCI DSS and GDPR requires encrypting data at rest and in transit, enabling CloudTrail for audit logs, and using Macie for sensitive data discovery. The practice set tests the ability to design proactive security postures that include WAF for web application protection and Config rules for continuous compliance.
- Amazon Inspector continuously scans EC2 for vulnerabilities; Systems Manager Patch Manager automates patching.
- AWS X-Ray traces requests through distributed services to identify performance bottlenecks.
- CloudTrail logs all API calls; configure data events for S3 access auditing.
- Amazon Macie uses machine learning to discover and protect sensitive data in S3.
Practice AWS Certified Solutions Architect Professional SAPC02 AWS Certified Solutions Architect Professional SAPC02 with real flashcards
Read the prompt, commit to an answer, then flip the card. Move through the deck at your own pace and repeat any topic that does not come back quickly.
Card 1 of 20
1 reviewed this session
Static practice bank
Start the 30-question diagnostic
The complete question bank is embedded in this pre-rendered page. There is no database request or second content download when you begin.
AstroDynamics, a global technology firm, is migrating its sensitive customer data processing workloads to AWS. The company operates under stringent data residency regulations in several jurisdictions, requiring that Personally Identifiable Information (PII) originating from specific customer bases must remain within designated AWS Regions. As part of a broader disaster recovery initiative, they are planning to implement multi-region architectures. The challenge is to establish a proactive and auditable framework that prevents the accidental or intentional deployment of resources that could violate these data residency laws, ensuring that all data storage and processing adheres to geographical compliance mandates across all their AWS accounts. Which architectural approach would most effectively satisfy these requirements for granular, cross-account enforcement of data residency policies?
Study workflow
Turn one AWS Certified Solutions Architect Professional SAPC02 AWS Certified Solutions Architect Professional SAPC02 attempt into a study plan
- 1
Identify Compliance and Business Requirements
Start by extracting all regulatory, data residency, and availability mandates. Note RTO/RPO, encryption needs, audit requirements, and cross-account access rules. These drive architectural choices such as SCP enforcement, multi-region deployment, and immutable storage.
- 2
Design Multi-Account Governance with SCPs
Use AWS Organizations to structure accounts into OUs. Apply SCPs to OUs to enforce guardrails like region restrictions or denying actions on specific resources. Remember that SCPs are global across the account and any explicit deny blocks even root user actions.
- 3
Choose Modernization and Compute Strategy
For monolithic applications, plan a phased migration to microservices using containers (ECS/EKS) or serverless (Lambda). Use API Gateway and Step Functions for orchestration. Externalize state to managed services like ElastiCache or DynamoDB to ensure statelessness.
- 4
Implement Data Protection and Disaster Recovery
For critical databases, enable automated backups, Multi-AZ, and cross-region read replicas. Use S3 Object Lock for immutable logs. Select DR strategy (pilot light, warm standby, active-active) based on RTO/RPO and cost. Test failover regularly with simulated drills.
- 5
Set Up Monitoring, Logging, and Automated Remediation
Enable CloudTrail and CloudWatch for audit and metrics. Use AWS Config for continuous compliance and custom remediation via Lambda. Implement X-Ray for distributed tracing. For security, use Inspector for vulnerability scanning and patch management through Systems Manager.
FAQ
Questions about this exam practice page
Clear boundaries on what the bank covers, how to use it, and where official vendor information still matters.
What is the difference between an SCP deny and an IAM deny?+
An SCP deny sets a maximum permission boundary at the organizational level and overrides any IAM allow. An IAM deny only affects the principal to which it is attached. SCPs apply to all principals in the account, including the root user, making them more powerful for central control.
How does S3 Object Lock Compliance mode differ from Governance mode?+
In Compliance mode, no user (including the root account) can delete or overwrite an object during its retention period. Governance mode allows users with specific IAM permissions to bypass the lock. Compliance mode is required for strict regulatory immutability.
When should I use AWS Step Functions versus Amazon SQS for microservices orchestration?+
Step Functions is ideal for coordinating complex, multi-step workflows with state management, error handling, and parallel execution. SQS is better for simple decoupling and buffering of tasks. Step Functions can call Lambda functions and other services, while SQS only stores messages.
Can a root user in a member account override an SCP?+
No. SCPs apply to all principals in the account, including the root user. An explicit deny in an SCP blocks any action, even for the root user. This is key for enforcing organization-wide security policies.
What AWS service provides granular distributed tracing for microservices?+
AWS X-Ray. It helps analyze and debug distributed applications by tracing requests as they travel through services, identifying performance bottlenecks and errors. It integrates with Lambda, API Gateway, and EC2.
Build the next review session
Browse another free bank or use the study strategy guide to turn your misses into spaced review.