Free AWS Certified Solutions Architect - Professional (SAP-C02) Sample Questions

Correct answers: B, D — Enable Capacity Rebalancing to allow EC2 to proactively launch a replacement Spot Instance before an existing one receives a two-minute interruption notice.; Diversify the fleet across multiple instance types and families that meet the job's minimum vCPU and memory requirements.

• A. Incorrect. While newer-generation instance types might have lower interruption frequencies due to larger capacity pools, this is not a guaranteed rule. More importantly, limiting the fleet to a single instance type (or even generation) is an anti-pattern that reduces diversity and makes the entire fleet vulnerable to interruptions in that specific capacity pool.
• B. Correct. Capacity Rebalancing is a key feature for improving Spot Instance resilience. It allows Amazon EC2 to proactively launch a replacement Spot Instance when an existing instance receives a rebalance recommendation, which indicates it is at an elevated risk of interruption. This helps maintain the desired fleet capacity and reduces delays by replacing instances before they are terminated.
• C. Incorrect. Spot Instance interruptions are primarily driven by AWS needing the capacity back for On-Demand or Reserved Instance usage, not by the price exceeding your maximum bid. Setting a high max price does not prevent these capacity-based interruptions. The default max price is the On-Demand price, which is sufficient in most cases.
• D. Correct. Diversification is a fundamental best practice for using Spot Instances effectively. By configuring the fleet to use multiple instance types, families, and generations that meet the application's minimum requirements (e.g., vCPU, memory), you tap into different Spot capacity pools. This strategy significantly reduces the impact of an interruption in any single pool, thereby increasing the overall availability and resilience of the application.
• E. Incorrect. Confining the fleet to a single Availability Zone concentrates risk and reduces resilience. A best practice is to diversify across multiple Availability Zones. This allows the fleet to pull capacity from different, isolated locations, making it much less likely that a capacity shortage in one AZ will impact the entire fleet.

Correct answers: B, C — Deploy the firewall appliances behind a Gateway Load Balancer in a dedicated inspection VPC.; Create a VPC attachment on the Transit Gateway for the inspection VPC.

• A. Incorrect. A Network Load Balancer (NLB) operates at Layer 4 (TCP/UDP) and is not designed for transparently inserting security appliances into the network path. The purpose-built service for this use case is the Gateway Load Balancer.
• B. Correct. A Gateway Load Balancer (GWLB) is specifically designed to deploy, scale, and manage virtual appliances like firewalls. It operates at Layer 3 (IP layer) and provides a transparent 'bump-in-the-wire' insertion into the traffic flow, which is essential for inline inspection without altering the source or destination of the traffic. It also provides the required high availability and scalability for the appliance fleet.
• C. Correct. To integrate the inspection VPC (which contains the GWLB and firewall appliances) into the hub-and-spoke network, it must be connected to the Transit Gateway. Creating a VPC attachment is the standard mechanism for connecting a VPC to a Transit Gateway, allowing it to route traffic to and from the other spoke VPCs.
• D. Incorrect. The routing configuration on the Transit Gateway is modified, but it's configured to send traffic to the *VPC attachment* of the inspection VPC, not directly to a Gateway Load Balancer endpoint. The underlying AWS networking handles the delivery of traffic to the GWLB endpoint within the inspection VPC after it's routed to the attachment.
• E. Incorrect. This option directly violates the key requirement that the solution must not require any changes to the routing tables of the spoke VPCs. A centralized inspection model using Transit Gateway is specifically designed to avoid this kind of per-VPC configuration, which is unscalable.
• F. Incorrect. VPC Traffic Mirroring sends a copy of network traffic to a target for out-of-band monitoring or analysis. It does not route the actual traffic through the inspection appliances, so it cannot be used for inline inspection or to block malicious traffic, which is a primary function of a firewall.

Correct answers: A, B — Launch the EC2 instances in a Cluster Placement Group.; Use EC2 instances that support Elastic Fabric Adapter (EFA).

• A. A Cluster Placement Group is a logical grouping of instances within a single Availability Zone. This strategy ensures that the EC2 instances are placed in close physical proximity on the underlying hardware, which minimizes network latency and maximizes throughput between them. It is specifically designed for tightly-coupled, high-performance computing (HPC) workloads that require low-latency communication.
• B. Elastic Fabric Adapter (EFA) is a specialized network interface for EC2 instances that enables applications to communicate directly with the network hardware, bypassing the operating system's kernel. This OS-bypass capability significantly reduces latency to single-digit microseconds and increases throughput, making it essential for HPC and distributed computing workloads. EFA works best when used in conjunction with a Cluster Placement Group.
• C. Deploying instances across multiple Availability Zones is a best practice for high availability, but the physical separation between AZs introduces network latency (typically in the low single-digit milliseconds). This is orders of magnitude higher than the required single-digit microseconds and directly conflicts with the primary performance requirement.
• D. An Application Load Balancer distributes incoming traffic across multiple targets. It operates at Layer 7 and introduces an additional network hop and processing overhead, which inherently increases latency. It is not suitable for optimizing low-latency inter-node communication.
• E. A Spread Placement Group places each instance on distinct underlying hardware to reduce the risk of simultaneous failures. This physical separation is the opposite of what is needed for low latency and will increase the network round-trip time between instances, making it unsuitable for this workload.
• F. While Elastic Network Adapters (ENA) provide high-performance networking for most workloads, they do not offer the specialized OS-bypass capabilities of EFA. EFA is specifically engineered to achieve the single-digit microsecond latency required by tightly-coupled HPC applications, a level of performance that standard ENAs cannot match.

Correct answers: A, D — The 'Shared Services' account must be the owner of the VPC and share one or more of its subnets.; The owner account and participant accounts must be part of the same AWS Organization.

• A. Correct. In a VPC sharing model, the AWS account that owns the VPC is designated as the 'owner'. This owner account does not share the entire VPC; instead, it selectively shares specific subnets with other accounts using AWS Resource Access Manager (RAM). This is a fundamental concept of VPC sharing, enabling centralized management of the network while allowing other accounts to use it.
• B. Incorrect. This statement is not completely accurate because being a participant in a shared VPC does not automatically grant the ability to launch resources. While VPC sharing provides the network location (the subnet), the principals (users or roles) within the participant account must also have the appropriate IAM permissions (e.g., `ec2:RunInstances`) to create resources. VPC sharing and IAM permissions are separate mechanisms that must both be correctly configured.
• C. Incorrect. A key feature and benefit of VPC sharing is centralized network control. Only the VPC owner account has the permissions to modify the shared VPC's core networking components, such as route tables, network ACLs, and gateways. Participants can only manage the resources they launch within the shared subnets, such as the security groups attached to their own EC2 instances.
• D. Correct. This is a mandatory prerequisite for implementing VPC sharing. The feature is enabled through AWS Resource Access Manager (RAM), which requires that the VPC owner account and all participant accounts belong to the same AWS Organization. It is not possible to share a VPC with an account outside of the owner's Organization.
• E. Incorrect. The billing for shared VPC infrastructure is centralized to the owner account. The owner is responsible for the costs associated with the VPC itself, including hourly charges and data processing fees for shared components like NAT Gateways, internet gateways, and VPC endpoints. Participant accounts are billed for the resources they provision (e.g., EC2 instances, RDS databases) and the data transfer costs originating from those resources.

Correct answers: A, B — AWS CloudFormation; AWS Service Catalog

• A. Correct. AWS CloudFormation is the Infrastructure as Code (IaC) service used to define the standardized, pre-configured, and approved infrastructure stacks. These CloudFormation templates serve as the underlying blueprints for the 'products' that are offered to developers. It is a primary component of the solution as it defines *what* infrastructure will be provisioned.
• B. Correct. AWS Service Catalog is the core service that provides the self-service portal and governance framework. It allows a central IT team to create and manage a curated catalog of IT services (known as products, which are defined by CloudFormation templates). Service Catalog controls which users can launch which products, enforces versioning, and can apply constraints to ensure resources are tagged correctly and configured according to company policy. It directly addresses the self-service, governance, and restriction requirements.
• C. Incorrect. AWS Systems Manager is designed for operational management, automation, and configuration management of existing resources, such as patching instances or running commands. It does not provide a self-service catalog for provisioning new infrastructure stacks from templates.
• D. Incorrect. AWS Config is a service for assessing, auditing, and evaluating the configurations of AWS resources. It operates as a detective control to check for compliance after resources are created, but it does not provide the preventative controls or the self-service deployment mechanism required by the scenario.
• E. Incorrect. While AWS Organizations is fundamental for managing a multi-account environment and can apply broad preventative guardrails via Service Control Policies (SCPs), it does not provide the specific self-service catalog functionality for deploying pre-approved stacks. Service Catalog builds upon the multi-account structure managed by Organizations to deliver this capability.

Correct answers: B, D — A cross-account IAM role in each target account with a trust policy allowing the auditors' AWS account.; An IAM permissions boundary attached to the cross-account role, explicitly defining the maximum allowable read-only actions.

• A. Incorrect. Creating separate IAM users in each account is difficult to manage, scale, and audit. It forces auditors to handle multiple sets of long-lived credentials, increasing security risks. Furthermore, the `ReadOnlyAccess` AWS managed policy is overly permissive and does not adhere to the principle of least privilege, as it grants read access to all services, not just the required EC2, S3, and RDS.
• B. Correct. Using a cross-account IAM role is the standard and most secure method for granting third-party access to AWS resources. It allows the auditors to use their own existing IAM principals from a trusted AWS account to assume the role, eliminating the need to manage long-term credentials. The role's identity-based policy can be crafted to grant specific, least-privilege, read-only permissions for only the required services.
• C. Incorrect. Service Control Policies (SCPs) are used within AWS Organizations to set maximum permission guardrails for member accounts; they do not grant permissions. Additionally, external auditors would not typically be part of the company's AWS Organization, making an SCP attached to their OU an invalid approach.
• D. Correct. An IAM permissions boundary is an advanced security feature that sets the maximum permissions an IAM entity (user or role) can have. Attaching a permissions boundary to the cross-account role ensures that the role's permissions can never be escalated beyond the explicitly defined read-only actions, even if someone with permissions to modify the role's policy attempts to add more privileges. This directly addresses the requirement to prevent permission escalation.
• E. Incorrect. While using a central identity account and IAM groups is a good practice for managing internal users, it does not by itself solve the problem of granting cross-account access to an external party. This approach would still need to be combined with cross-account roles (as in option B) to be effective.

Correct answer: C — Store the credentials in AWS Secrets Manager, configure automatic rotation, and grant the EC2 instance's IAM role permission to retrieve the secret.

• A. This approach is not ideal. While using an encrypted S3 object and an IAM instance profile is more secure than plaintext, it lacks native secret management and rotation features. This means the 30-day rotation would require a custom solution or manual intervention, which increases operational overhead and risk, making it less efficient than other AWS-native services.
• B. This is a plausible but suboptimal solution. AWS Systems Manager Parameter Store can securely store credentials using the SecureString parameter type and control access via IAM. However, it does not offer built-in, automatic rotation capabilities. A custom solution, such as a Lambda function, would be required to handle the rotation, which adds complexity and operational burden compared to a fully managed service.
• C. This is the correct answer. AWS Secrets Manager is a purpose-built service for this exact use case. It securely stores secrets, provides fine-grained access control through IAM roles, and most importantly, offers native, automated secret rotation capabilities. This solution fully meets the security requirements without storing credentials on the instance and provides the highest operational efficiency by managing the entire secret lifecycle, including rotation.
• D. This is a severe security anti-pattern and is incorrect. Hardcoding credentials into an AMI violates the company's security policy, is highly insecure, and makes secrets difficult to rotate. Furthermore, the process of creating, validating, and deploying a new AMI every 30 days is extremely inefficient and operationally complex.

Correct answer: C — A Redis (cluster mode enabled) cluster with multiple shards, each having a primary and at least one replica, spread across multiple AZs.

• A. Incorrect. A single-node ElastiCache cluster is a single point of failure. Deploying it across multiple AZs doesn't provide automatic failover because there is no replica node to promote if the primary node fails. The session store would become unavailable until a new node is manually or automatically provisioned, which does not meet the high availability requirement.
• B. Incorrect. A cluster with a single primary node and no replicas lacks the necessary components for failover. To achieve automatic failover, at least one replica node is required to be promoted to primary in the event of a failure. This configuration represents a single point of failure.
• C. Correct. This configuration provides the highest level of availability and resilience for ElastiCache for Redis. Using replicas for each primary shard enables automatic failover; if a primary node fails, ElastiCache will automatically promote a replica node to become the new primary. Spreading these nodes across multiple Availability Zones (AZs) protects against an entire AZ failure, ensuring the cluster remains operational. Cluster Mode Enabled also allows the dataset to be partitioned across multiple shards for horizontal scalability.
• D. Incorrect. This describes a multi-region disaster recovery strategy, not a built-in high availability solution with automatic failover. Managing data synchronization with a custom Lambda function is complex, can introduce data consistency issues and latency, and does not leverage the native, low-latency automatic failover capabilities of ElastiCache within a single region.

Correct answer: C — Failover Routing

• A. Incorrect. Simple routing is used to route traffic to a single resource and does not support health checks or automated failover capabilities. It is unsuitable for a high-availability architecture requiring redirection upon failure.
• B. Incorrect. Latency-based routing directs traffic to the region providing the lowest network latency for the user. While it uses health checks to stop routing traffic to unhealthy endpoints, its primary goal is performance optimization, not a strict active/standby failover as required.
• C. Correct. Failover routing is specifically designed for active-passive (primary/standby) disaster recovery scenarios. It routes traffic to a primary endpoint as long as it passes its associated health check. If the primary health check fails, Route 53 automatically redirects all traffic to the designated secondary (standby) endpoint, fulfilling the requirement for automated failover.
• D. Incorrect. Geolocation routing directs traffic based on the geographic location of the user's DNS query. It is used for content localization and geographic restrictions, not for health-based automated failover between a primary and standby environment.

Correct answer: C — An S3 Lifecycle policy with transition rules.

• A. Incorrect. S3 Cross-Region Replication (CRR) is primarily used for disaster recovery, reducing latency for users in different geographical locations, or meeting data sovereignty compliance requirements. While you can specify a different storage class in the destination bucket, its main purpose is not to manage the storage lifecycle within a single bucket based on access patterns for cost optimization.
• B. Incorrect. S3 Intelligent-Tiering is designed for data with unknown, changing, or unpredictable access patterns. It automatically moves objects between a frequent and an infrequent access tier. While it can also be configured to move data to archive tiers, it incurs a small monthly per-object monitoring and automation fee. For a well-defined and predictable access pattern as described in the scenario, a Lifecycle policy is more direct and cost-effective.
• C. Correct. An S3 Lifecycle policy is the ideal solution for objects with a predictable lifecycle. It allows for the automated transition of objects between different storage classes based on their age. A policy can be configured to precisely match the requirements: start in S3 Standard, transition to S3 Standard-IA after 30 days (for infrequent but immediate access), transition to an archive class like S3 Glacier Flexible Retrieval or S3 Glacier Deep Archive after 365 days (for long-term retention), and expire after seven years.
• D. Incorrect. S3 Storage Class Analysis is a feature that monitors data access patterns to help you determine when to transition data to a more cost-effective storage class. It provides recommendations for creating S3 Lifecycle policies but does not automate the object transitions itself. This option would still require manual intervention to create the policy, and it doesn't fulfill the requirement of an automated solution.

Correct answers: A, C, D — Implement a mandatory tagging policy for all new resources, using tags for cost allocation by project and team.; Configure AWS Budgets with alert notifications sent to team distribution lists when spending forecasts exceed thresholds.; Use AWS Service Catalog to create pre-approved, cost-optimized portfolios of products that developers can deploy.

• A. This is a correct action. Implementing a mandatory tagging policy is a foundational best practice for cost management. It enables the organization to use cost allocation tags to track spending by project, team, or application. This provides crucial visibility into where costs are originating, fosters accountability, and helps identify specific areas for optimization.
• B. This is an incorrect action. Consolidating into a single account is an anti-pattern for growing organizations. The AWS best practice is to use a multi-account strategy with AWS Organizations. This provides better security isolation, granular cost tracking per account, and simplifies management and billing for distinct teams or environments.
• C. This is a correct action. AWS Budgets provides a proactive mechanism for cost control. By setting custom cost or usage thresholds and configuring alerts that notify development teams directly, the organization can foster cost-conscious behavior. Teams become aware of their spending trends and can take corrective action before budgets are significantly exceeded, which aligns perfectly with the CTO's goals.
• D. This is a correct action. AWS Service Catalog allows an organization to create and manage a catalog of approved IT services. This strikes a balance between governance and innovation. The central IT team can define cost-optimized and compliant product templates (e.g., right-sized EC2 instances with specific tags), and developers can then deploy these pre-approved resources via a self-service model, ensuring cost control without hindering their agility.
• E. This is an incorrect action. While migrating to newer generation instances is a valid cost-optimization tactic, immediately terminating all older instances is a drastic and disruptive measure. This approach can cause outages and does not account for application dependencies or specific workload requirements. A planned, gradual migration based on analysis from tools like AWS Compute Optimizer is the appropriate strategy.
• F. This is an incorrect action and a severe security risk. The root account has unrestricted privileges and should be used sparingly. AWS best practice is to use IAM users, groups, and roles to enforce the principle of least privilege. Forcing developers to use the root account would eliminate individual accountability and create a massive security vulnerability.

Correct answer: A — AWS X-Ray

• A. Correct. AWS X-Ray is a distributed tracing service specifically designed to help developers analyze and debug production, distributed applications, such as those built using a microservices architecture. It provides an end-to-end view of requests as they travel through your application, helps identify performance bottlenecks and errors, and generates a service map to visualize the application's underlying components and their relationships.
• B. Incorrect. Amazon CloudWatch is a monitoring and observability service for AWS resources and applications. It collects and tracks metrics, collects and monitors log files, and sets alarms. While CloudWatch ServiceLens integrates with X-Ray to provide a more unified view, X-Ray is the core service that provides the specific distributed tracing and service map generation capabilities mentioned in the question.
• C. Incorrect. AWS CloudTrail is a service for governance, compliance, operational auditing, and risk auditing of your AWS account. It records API calls and events for AWS services, but it does not analyze application performance or trace requests within an application.
• D. Incorrect. AWS Trusted Advisor is an online tool that provides real-time guidance to help you provision your resources following AWS best practices. It inspects your AWS environment and makes recommendations for saving money, improving system performance and reliability, and closing security gaps. It does not perform application-level performance analysis or tracing.

Correct answers: B, C — Increase the number of shards in the Kinesis Data Stream.; Configure the EC2 instances in an Auto Scaling group to scale based on the `IteratorAgeMilliseconds` metric.

• A. Incorrect. Each shard in a Kinesis Data Stream has a fixed throughput capacity. Decreasing the number of shards would reduce the overall throughput of the stream, worsening the bottleneck and further increasing the `GetRecords.IteratorAgeMilliseconds`.
• B. Correct. The total throughput of a Kinesis Data Stream is the sum of the capacities of its shards. Increasing the number of shards directly increases the stream's capacity for both writes and reads. This allows for a greater degree of parallel processing by consumer applications, which is essential for improving overall data processing throughput.
• C. Correct. The `GetRecords.IteratorAgeMilliseconds` metric is a key indicator of consumer application lag. Using this metric as a trigger for an Auto Scaling group allows the consumer fleet to scale out dynamically when processing falls behind. Adding more EC2 instances provides more consumers to process data from the stream's shards in parallel, directly addressing the processing bottleneck and reducing the iterator age.
• D. Incorrect. While SQS is a messaging service, SQS FIFO queues are designed for ordered, exactly-once processing and typically have lower throughput limits than Kinesis Data Streams. Kinesis is specifically designed for high-throughput, real-time data streaming and is the more appropriate service for this use case. Switching would likely not solve the performance issue.
• E. Incorrect. This describes vertical scaling (scaling up). The problem states the application is designed to scale horizontally (scaling out). While a larger instance might process its records faster, the primary bottleneck in a high-volume stream is typically the parallelism of consumption, not the processing power of a single instance. Scaling out by adding more instances (Option C) is a more effective and cost-efficient way to handle the increased load in this scenario.

Correct answers: A, D — Set the queue's Visibility Timeout to at least 20 minutes.; Configure a dead-letter queue (DLQ) to handle messages that consistently fail processing.

• A. This is a correct answer. The Visibility Timeout determines how long a message is hidden from other consumers after being received. Since processing can take up to 20 minutes, setting the timeout to a value greater than 20 minutes ensures that a message is not picked up by another instance while it is being successfully processed. If the processing instance fails and terminates, the message will become visible again on the queue after the timeout expires, allowing a different instance to process it. This directly addresses the requirement to prevent message loss due to instance failure.
• B. This is incorrect. Long polling (Receive Message Wait Time) is an efficiency and cost-optimization feature. It reduces the number of empty API calls to SQS by allowing the call to wait for a message to arrive in the queue. It does not provide resilience against instance failures or prevent message loss during processing.
• C. This is incorrect. The Message Retention Period dictates how long SQS will keep a message in the queue if it's not deleted. A 60-second retention period is far too short for a job that takes 20 minutes. If processing fails and retries are needed, the message could be permanently deleted from the queue before it can be successfully processed, leading to data loss. The retention period should be significantly longer than the visibility timeout.
• D. This is a correct answer. A dead-letter queue (DLQ) is a critical component for building resilient, asynchronous systems. It is used to isolate messages that consistently fail to be processed after a specified number of attempts (maxReceiveCount). This prevents 'poison pill' messages from blocking the queue and impacting other messages. By moving problematic messages to a DLQ, they are not lost and can be analyzed later, which enhances the overall reliability and fault tolerance of the system.
• E. This is incorrect. The problem description does not require message ordering or exactly-once processing. The idempotent nature of the application is well-suited for a standard SQS queue's at-least-once delivery model. Converting to a FIFO queue would introduce unnecessary complexity and throughput limitations without addressing the core requirements of handling long-running tasks and instance failures.

Correct answer: C — AWS Security Hub, by designating a central administrator account and integrating with Amazon EventBridge to trigger automated responses.

• A. Incorrect. Amazon CloudWatch is primarily a service for monitoring performance, operational health, and collecting logs and metrics. While it supports cross-account dashboards and alarms that can trigger actions, it is not designed to natively aggregate, normalize, and prioritize security findings from diverse services like GuardDuty and Inspector. Its remediation capabilities are general-purpose and not specifically tailored for security finding orchestration.
• B. Incorrect. AWS CloudTrail is an auditing service that records API activity across AWS accounts. While creating an organization trail is a best practice for centralizing audit logs, CloudTrail itself does not aggregate security findings from other services. It provides the raw data for analysis but does not offer a consolidated view of prioritized findings or a native mechanism to orchestrate remediation.
• C. Correct. AWS Security Hub is the purpose-built service for this scenario. It is designed to be a central hub to aggregate, organize, and prioritize security findings from various integrated AWS services (like GuardDuty, Inspector, IAM Access Analyzer) and third-party products across an entire AWS Organization. By designating an administrator account, the security team gets a single pane of glass view. Furthermore, Security Hub integrates seamlessly with Amazon EventBridge, allowing findings to trigger automated remediation workflows using AWS Lambda, AWS Step Functions, or AWS Systems Manager to perform actions like modifying security groups.
• D. Incorrect. AWS Config is focused on assessing, auditing, and evaluating the configurations of AWS resources for compliance. While it has aggregator features for configuration data and can perform auto-remediation for non-compliant resources, its primary function is not to consolidate security findings from threat detection services like GuardDuty or vulnerability scanners like Inspector. Its scope is configuration compliance, not comprehensive security posture management.

Correct answers: A, C — { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-app-data/*" }; { "Effect": "Allow", "Action": "s3:PutObject", "Resource": "arn:aws:s3:::my-app-logs/production/*" }

• A. This statement is correct. It grants the `s3:GetObject` permission, which is required to read objects. The resource is correctly scoped to `arn:aws:s3:::my-app-data/*`, which targets all objects within the specified `my-app-data` bucket. This aligns perfectly with the first requirement and adheres to the principle of least privilege by not granting access to other buckets.
• B. This statement is incorrect because it violates the principle of least privilege. The resource `arn:aws:s3:::*` is a wildcard that grants `s3:GetObject` permission to all S3 buckets in the account, which is far more permissive than required.
• C. This statement is correct. It grants the `s3:PutObject` permission, which is needed to write files. The resource is scoped to `arn:aws:s3:::my-app-logs/production/*`, precisely limiting write access to the `production/` prefix within the `my-app-logs` bucket. This meets the second requirement while strictly following the principle of least privilege.
• D. This statement is incorrect because it is too permissive. The resource `arn:aws:s3:::my-app-logs/*` grants permission to write objects anywhere in the `my-app-logs` bucket, not just within the required `production/` prefix. This violates the principle of least privilege.
• E. This statement is incorrect. The question specifies a requirement to 'read objects', which corresponds to the `s3:GetObject` action. The `s3:ListBucket` action allows listing the contents of a bucket, which was not an explicit requirement. Granting permissions that are not explicitly required violates the principle of least privilege.

Correct answers: B, D, F — Configure the Global Accelerator endpoints with health checks to monitor the regional ALBs.; Ensure that the Aurora global database is configured to allow automatic, managed failover to the secondary region.; Replicate user session data, stored in Amazon ElastiCache, to the secondary region using scheduled snapshots.

• A. Incorrect. AWS Global Accelerator has its own built-in health checking mechanism for its endpoints. While Route 53 can also perform health checks, using it here would be redundant and is not the standard way to configure failover with Global Accelerator.
• B. Correct. This is a fundamental requirement for automated failover with Global Accelerator. By configuring health checks on the endpoints (the regional ALBs), Global Accelerator can continuously monitor their health. If the ALB in us-east-1 becomes unhealthy, Global Accelerator will automatically stop routing traffic to it and redirect all traffic to the next nearest healthy endpoint, which is the ALB in eu-central-1.
• C. Incorrect. The primary requirement is for a *fully automated* failover. Manual promotion of the secondary database cluster would require human intervention, which increases the Recovery Time Objective (RTO) and does not meet the automation requirement.
• D. Correct. For the application to function correctly after a regional failover, the database tier must also fail over. The Aurora cluster in eu-central-1, which is a read replica, must be promoted to become the primary write instance. Configuring the Aurora global database for managed, automated failover ensures this promotion happens automatically upon detection of a primary region failure, which is crucial for maintaining data consistency and availability.
• E. Incorrect. The architecture already includes an EC2 Auto Scaling group in the secondary region (eu-central-1). This group is designed to launch instances automatically when traffic increases. During a failover, Global Accelerator will direct traffic to the eu-central-1 ALB, and the Auto Scaling group will scale out accordingly. AWS Backup with cross-region copy is a disaster recovery strategy for point-in-time recovery, not a solution for a hot/warm standby automated failover scenario.
• F. Correct. For an e-commerce platform, achieving failover with 'minimal disruption' means preserving user-specific data like shopping carts and login status. This session data must be available in the failover region. Therefore, replicating session data is a critical step. While using scheduled snapshots is a suboptimal method for real-time session data (a solution like Amazon DynamoDB Global Tables or ElastiCache for Redis with Global Datastore would be superior), this is the only option that addresses the critical need to handle session state persistence across regions.

Correct answer: B — Amazon CloudWatch alarms based on composite metrics to detect complex failure conditions and Amazon EventBridge to trigger AWS Step Functions workflows for recovery.

• A. Incorrect. AWS CloudTrail is a service for logging API calls for auditing and compliance, while AWS Config tracks resource inventory and configuration changes. Neither service is designed for real-time application health monitoring or for initiating automated recovery actions.
• B. Correct. This combination creates a powerful, proactive recovery system. Amazon CloudWatch can use metrics, and specifically composite alarms, to monitor complex conditions across multiple application tiers. When an alarm's state changes, it generates an event that can be sent to Amazon EventBridge. EventBridge acts as a central event bus, routing the alarm event to trigger an AWS Step Functions state machine. Step Functions is ideal for orchestrating complex, multi-step recovery workflows, such as promoting a standby database, updating DNS records, and notifying operators.
• C. Incorrect. Amazon GuardDuty is a threat detection service, and AWS Security Hub aggregates security findings from various AWS services. These services are focused on security posture management and threat response, not on application availability or operational recovery from failures.
• D. Incorrect. AWS X-Ray is used for tracing and analyzing application requests to identify performance bottlenecks, which is useful for debugging but not for triggering automated recovery. Service Quotas helps monitor AWS service limits to prevent failures due to exceeding them, but it is not a comprehensive solution for application health monitoring or recovery orchestration.
• E. Incorrect. VPC Flow Logs capture information about IP traffic going to and from network interfaces in a VPC, and AWS Network Firewall is a managed network security service. While important for network monitoring and security, these services operate at the network layer and are not suited for detecting application-level failures or orchestrating recovery actions.

Correct answers: B, C — Each microservice must have its own independent CI/CD pipeline.; Implement API versioning and ensure backward compatibility for at least one previous version to allow consumers to upgrade at their own pace.

• A. This is a classic microservices anti-pattern. Sharing a single database creates tight coupling at the data layer. Any schema change by one team could break other services, forcing coordinated testing and deployments, which directly undermines the goal of deployment independence.
• B. This is a correct and fundamental principle for microservices. An independent CI/CD pipeline for each service is the primary mechanism that empowers a team to build, test, and deploy its service autonomously, without being blocked by or needing to coordinate with other teams' release cycles.
• C. This is a correct and critical design principle. By ensuring backward compatibility through API versioning, a service can be updated and deployed without breaking its consumers. This decouples the service provider from its consumers, allowing consumers to upgrade on their own schedule and eliminating the need for coordinated, system-wide releases.
• D. While monorepos can be used for microservices with sophisticated tooling, they often introduce complexities in build processes and dependency management that can hinder independent deployment. This approach can lead to coordination challenges and conflicts, which is contrary to the stated goal of simple deployment independence.
• E. This option describes the exact 'big-bang' release model that the company is trying to move away from. It directly contradicts the core requirement of enabling independent, frequent, and uncoordinated deployments for each microservice team.

Correct answers: A, C, F — A blue/green deployment strategy managed by AWS CodeDeploy.; Amazon CloudWatch alarms based on application KPIs like ALB 5XX errors and TargetResponseTime.; An automatic rollback configuration within the CodeDeploy deployment group, triggered by the CloudWatch alarms.

• A. A blue/green deployment strategy using AWS CodeDeploy is the ideal choice for meeting these requirements. It provisions a new replacement environment (green) alongside the existing production environment (blue). This allows the new application version to be tested with live production traffic before all traffic is shifted over, facilitating a zero-downtime cutover. It's the foundational strategy that enables safe, controlled rollouts.
• B. A standard ECS rolling update incrementally replaces old tasks with new ones. While this method can minimize downtime, it does not provide a separate, fully provisioned environment for testing with live traffic before committing to the full rollout. Furthermore, its native rollback capabilities are less sophisticated than the alarm-driven rollbacks offered by CodeDeploy.
• C. To trigger an automatic rollback based on KPI degradation, a monitoring and alerting system is essential. Amazon CloudWatch alarms are the native AWS solution for monitoring application health metrics like Application Load Balancer (ALB) 5XX error counts and target response time (latency). These alarms act as the trigger for the automatic rollback process.
• D. AWS CloudFormation is an Infrastructure as Code (IaC) service used for provisioning and managing the underlying AWS resources like the ECS cluster, services, and task definitions. While it's a best practice for infrastructure management, it does not execute the deployment logic itself, such as traffic shifting, monitoring during deployment, or handling automatic rollbacks.
• E. The requirement is for an *automatic* rollback. Introducing a manual approval step directly contradicts this requirement. A manual process adds delay and requires human intervention, which is undesirable for a critical application where a rapid, automated response to performance degradation is needed.
• F. This option describes the specific mechanism that connects the deployment tool (CodeDeploy) with the monitoring system (CloudWatch). By configuring automatic rollbacks in the CodeDeploy deployment group and associating it with the specified CloudWatch alarms, the system can automatically stop the deployment and revert to the last known good version if a KPI alarm is triggered. This directly fulfills the automatic rollback requirement.

Correct answer: C — AWS Budgets with a budget alert for forecasted costs.

• A. Incorrect. AWS Cost Anomaly Detection is designed to identify unusual or anomalous spending patterns compared to historical trends. It alerts on unexpected spikes in cost, not on whether the total monthly cost is projected to cross a predefined budget threshold.
• B. Incorrect. CloudWatch alarms based on the `EstimatedCharges` metric trigger when the *actual* accumulated cost exceeds a threshold. This is a reactive alert based on current spend and does not provide a proactive notification based on a *forecasted* or *projected* monthly total.
• C. Correct. AWS Budgets is the ideal service for this requirement. It allows you to set custom cost budgets and configure alerts that can be triggered when your *forecasted* costs are projected to exceed the budgeted amount. This provides the proactive notification the company needs to manage its unpredictable spending.
• D. Incorrect. AWS Cost Explorer is a tool for visualizing, understanding, and managing AWS costs and usage over time. While it can generate reports with forecasted data, it does not provide an automated, threshold-based alerting mechanism for projected overspending. It's more suited for analysis and reporting than for proactive alerting.

Correct answers: B, D, E — AWS Compute Optimizer; Spot Instances; Savings Plans

• A. Incorrect. While AWS Trusted Advisor provides cost optimization recommendations, it is a broader best practices service. AWS Compute Optimizer is the specialized service designed for in-depth, proactive rightsizing of compute resources based on utilization metrics, making it a better fit for the specific requirement.
• B. Correct. AWS Compute Optimizer is a service that analyzes the configuration and utilization metrics of your workloads to recommend optimal AWS resources. It directly addresses the requirement for proactive rightsizing to reduce costs and improve performance.
• C. Incorrect. AWS Budgets is a tool for monitoring and managing costs by setting custom budgets and receiving alerts when usage exceeds thresholds. It is a cost control and visibility tool, not a mechanism for achieving discounts or rightsizing resources.
• D. Correct. Spot Instances allow you to use spare EC2 computing capacity at steep discounts (up to 90% off On-Demand prices). They are ideal for fault-tolerant, interruptible workloads such as batch processing, perfectly matching one of the key requirements.
• E. Correct. Savings Plans are a flexible pricing model that offers significant discounts (up to 72%) on EC2, Fargate, and Lambda usage in exchange for a commitment to a consistent amount of usage for a 1- or 3-year term. This directly fulfills the requirement for commitment-based discounts for predictable workloads.
• F. Incorrect. Amazon S3 Intelligent-Tiering is a storage class designed to optimize storage costs by automatically moving data to the most cost-effective access tier. This is irrelevant to the question, which focuses on cost optimization for compute workloads (rightsizing, batch processing, and predictable usage).

Correct answers: B, C — Implement client-side logic in the application to attempt writing to a primary S3 bucket, and upon failure, failover to a secondary S3 bucket in a different region.; Use an Amazon Kinesis Data Firehose delivery stream to buffer logs and deliver them to S3, configuring a secondary S3 bucket in another region as a backup destination.

• A. Incorrect. S3 Cross-Region Replication (CRR) asynchronously replicates objects *after* they are successfully written to the primary bucket. It provides data redundancy and disaster recovery for data at rest, but it does not improve the availability of the write operation itself. If the S3 service in the primary region is down, the application cannot write the initial object, and CRR will not be triggered.
• B. Correct. This approach directly addresses the application's write failure. By implementing failover logic within the application client, it can handle a failure to write to the primary S3 bucket by retrying the operation against a secondary bucket in a different, healthy region. This ensures the application can continue to function and logs are durably stored during a regional outage.
• C. Correct. Using Amazon Kinesis Data Firehose decouples the application from the S3 write process. The application sends logs to the highly available Firehose endpoint. Firehose buffers the data and manages the delivery to S3. By configuring a backup S3 bucket in a different region, Firehose can automatically redirect the data stream to the secondary location if the primary destination is unavailable, thus ensuring high reliability for log ingestion without complex client-side logic.
• D. Incorrect. Enabling S3 Versioning and MFA Delete are important data protection features that safeguard against accidental deletion or overwriting of objects. However, they do not address the problem of service availability. These features are irrelevant to the application's ability to write new logs during a regional S3 service disruption.
• E. Incorrect. Amazon CloudFront is a content delivery network (CDN) primarily designed to accelerate the delivery of read-heavy content by caching it at edge locations. While it supports some write operations (like PUT) to an S3 origin, it does not solve the underlying availability problem. If the origin S3 bucket's region is unavailable, CloudFront will also be unable to write the object, and the request will fail.

Correct answer: C — To act as a managed threat detection service that continuously monitors for malicious activity and unauthorized behavior by analyzing AWS CloudTrail, VPC Flow Logs, and DNS logs.

• A. This option describes the function of Amazon Inspector, which is a service designed to scan EC2 instances and container images for software vulnerabilities and unintended network exposure. GuardDuty does not perform vulnerability scanning.
• B. This option describes AWS WAF (Web Application Firewall), a service that helps protect web applications from common web exploits at the application layer. GuardDuty is a threat detection service, not a firewall.
• C. This is the correct description of Amazon GuardDuty. It is a managed threat detection service that continuously monitors AWS accounts and workloads for malicious activity and unauthorized behavior by analyzing multiple data sources, including AWS CloudTrail event logs, VPC Flow Logs, and DNS logs, using machine learning and anomaly detection.
• D. This option describes AWS Security Hub. Security Hub acts as a central place to manage security alerts and findings from various AWS services (including GuardDuty) and automates security checks against industry standards and best practices. GuardDuty's primary role is threat detection, and its findings are often sent to Security Hub for aggregation.

Correct answer: B — Use CloudFront Functions on the viewer-request event to execute the personalization logic.

• A. Incorrect. The `origin-request` event only triggers after a cache miss, meaning it does not execute if the requested object is already in the CloudFront cache. The requirement is to run logic before the cache is checked. Additionally, Lambda@Edge has higher latency and cold start times compared to CloudFront Functions, making it less suitable for the most performance-sensitive, lightweight tasks.
• B. Correct. This is the best solution for performance. CloudFront Functions are designed for extremely low-latency, lightweight request processing directly at CloudFront's edge locations. The `viewer-request` event triggers for every single request before the cache is checked, meeting the requirement perfectly. While CloudFront Functions cannot make external network calls (like to DynamoDB), the optimal architecture would be for the function to act on user data already present in the request (e.g., a JWT in a cookie or header). This data would have been generated by a separate authentication/login process that queried DynamoDB. Given the strong emphasis on 'best performance' and 'lightweight logic', this is the intended answer.
• C. Incorrect. Using a Lambda function URL as the origin forces every request to be processed by a single Lambda function in its configured AWS region. This completely bypasses the benefits of CloudFront's distributed edge caching for the content itself and introduces significant network latency for users far from the Lambda's region.
• D. Incorrect. This approach introduces poor performance by requiring two separate network round trips from the client: one to an API for personalization and another to CloudFront for the content. This significantly increases the overall page load time and complicates the client-side application.

Correct answers: C, D — AWS X-Ray; CloudWatch ServiceLens

• A. Incorrect. AWS CloudTrail is a service for governance, compliance, and auditing of your AWS account. It records API calls made to the AWS control plane but does not provide the detailed application-level performance tracing required to identify latency bottlenecks within a microservices architecture.
• B. Incorrect. VPC Flow Logs capture information about the IP traffic to and from network interfaces in a VPC. This is useful for network-level troubleshooting but does not offer insight into the application-layer request flow or service-to-service call latency.
• C. Correct. AWS X-Ray is the core service for distributed tracing. It is designed to analyze and debug production, distributed applications by tracing user requests as they travel through various services like API Gateway, Lambda, and DynamoDB. X-Ray collects data about the requests and provides the tools to view, filter, and gain insights into that data to identify issues and opportunities for optimization, such as latency bottlenecks.
• D. Correct. CloudWatch ServiceLens works in conjunction with AWS X-Ray to provide a unified view of your application's health. It integrates X-Ray traces with CloudWatch metrics and logs to generate a service map, which visually represents your application's components, their dependencies, and their performance. This visualization is crucial for understanding the end-to-end flow and pinpointing the exact source of latency.
• E. Incorrect. AWS Trusted Advisor acts as an automated expert that provides recommendations to optimize your AWS environment across cost, performance, security, and fault tolerance. It does not provide real-time tracing or performance visualization capabilities for application debugging.

Correct answers: B, E — AWS X-Ray for distributed tracing and performance analysis.; Amazon CloudWatch ServiceLens to visualize service maps and correlated traces.

• A. Incorrect. While Amazon CloudWatch Logs Insights is a powerful tool for interactively searching and analyzing log data, it does not natively provide distributed tracing or a visual service map. Tracing would require manual instrumentation and correlation IDs within the logs, which is less efficient and comprehensive than a dedicated tracing service.
• B. Correct. AWS X-Ray is the fundamental AWS service for distributed tracing. It is designed to trace user requests end-to-end as they travel through various services like API Gateway and Lambda. By collecting trace data, it helps developers analyze application behavior, identify performance bottlenecks, and pinpoint the root cause of errors and latency issues.
• C. Incorrect. VPC Flow Logs capture information about IP traffic going to and from network interfaces within a VPC. This operates at the network layer (Layer 3/4) and is not suitable for application-level (Layer 7) tracing of requests across managed services like API Gateway and Lambda, which may not even reside in the customer's VPC.
• D. Incorrect. AWS Trusted Advisor is a high-level advisory tool that provides recommendations based on AWS best practices for cost optimization, performance, security, and fault tolerance. It does not provide real-time, request-level tracing or operational insights needed to debug application performance issues.
• E. Correct. Amazon CloudWatch ServiceLens provides a unified view of application health by integrating data from AWS X-Ray, Amazon CloudWatch Metrics, and Amazon CloudWatch Logs. It directly addresses the need to visualize service dependencies by generating a service map from X-Ray trace data. This allows teams to correlate traces, metrics, and logs to quickly identify performance bottlenecks and understand the impact of issues on different services.

Correct answer: C — Canary deployment

• A. Incorrect. A blue/green deployment strategy involves maintaining two identical production environments: 'blue' (current) and 'green' (new). All traffic is directed to the blue environment. The new feature is deployed to the green environment. After testing, all traffic is switched from blue to green at once. This strategy does not support a gradual rollout to a specific percentage of users.
• B. Incorrect. An all-at-once deployment, also known as a big bang deployment, releases the new version to all users and servers simultaneously. This is the highest-risk approach and directly contradicts the requirement for a cautious, gradual release to a small subset of users.
• C. Correct. Canary deployment is the ideal strategy for this scenario. It involves releasing the new feature to a small subset of the user base (the 'canary' group), such as the 2% mentioned. This allows the team to monitor the new version's performance, stability, and business metrics in a controlled, real-world environment with minimal blast radius. If the release proves successful, the percentage of users on the new version is gradually increased until it reaches 100%.
• D. Incorrect. A rolling deployment gradually replaces instances running the old version of the application with instances running the new version. While this is a gradual process that avoids downtime, it is less precise for targeting a specific percentage of users. Canary deployment is more explicitly designed for controlled, percentage-based traffic shifting to validate a new release with a subset of the user base before a full rollout.

Correct answers: A, C — AWS Lambda with Amazon API Gateway; AWS Fargate

• A. This combination represents a quintessential serverless architecture. AWS Lambda is a function-as-a-service (FaaS) offering that executes code in response to triggers, and Amazon API Gateway provides the HTTP endpoint to trigger the Lambda function. This model perfectly addresses the requirements by automatically scaling from zero to handle massive traffic spikes and scaling back to zero during idle periods. The company pays only for the compute time consumed, completely eliminating costs for idle capacity.
• B. Incorrect. Amazon Lightsail is a virtual private server (VPS) service that provides a simplified way to launch and manage resources with a fixed monthly price. It is not a serverless compute service and does not automatically scale based on traffic or scale down to zero to save costs.
• C. This is a valid serverless compute option for containerized applications. AWS Fargate is a serverless compute engine for containers that works with Amazon ECS and EKS. It allows you to run containers without managing the underlying EC2 instances. The application can be containerized and run on Fargate, which can be configured to scale the number of running tasks down to zero during periods of no traffic, thus eliminating idle costs and meeting the serverless requirement.
• D. Incorrect. Amazon EC2 Spot Instances are a pricing model for EC2, not a serverless compute service. They offer significant discounts on spare EC2 capacity but still require managing server infrastructure. They do not eliminate the concept of idle capacity, as you still pay for the instance as long as it's running.
• E. Incorrect. AWS Elastic Beanstalk is a Platform as a Service (PaaS) offering that simplifies the deployment and management of applications. However, it provisions and runs on underlying EC2 instances. While it automates scaling, it is not a serverless compute model and would still incur costs for idle EC2 instances, even at minimum capacity.

Correct answer: B — Have users upload images to an S3 bucket. Configure an S3 event notification to trigger an AWS Lambda function that uses the S3 object as input, generates thumbnails, and writes them to another S3 bucket.

• A. Incorrect. While using an Auto Scaling group and EFS improves upon the original design's single point of failure for the web tier, it is not the most effective solution. Designating a single instance for the thumbnail generation script reintroduces a single point of failure for the processing logic. This approach still requires managing EC2 instances and a shared file system, which is less scalable and more operationally complex than a serverless alternative.
• B. Correct. This is the canonical, modern, and serverless architecture for this use case on AWS. Uploading directly to S3 decouples the web tier from the storage and processing, and S3 provides highly durable and scalable object storage. Using S3 event notifications to trigger a Lambda function creates a highly scalable, resilient, and cost-effective event-driven system. This eliminates the need for managing servers, cron jobs, or polling mechanisms, and you only pay for the compute time used to generate the thumbnails.
• C. Incorrect. Amazon Kinesis is designed for real-time processing of streaming data, such as logs, IoT telemetry, or clickstreams. Using it for processing discrete image file uploads is an inappropriate application of the service. It would add unnecessary complexity and cost compared to the direct S3-to-Lambda pattern.
• D. Incorrect. Although using SQS to decouple the web server from a worker process is a valid architectural pattern, this option is inferior to the serverless approach. It still relies on a dedicated EC2 instance, which is a single point of failure and does not scale automatically. Managing, patching, and scaling this instance creates operational overhead that is completely avoided with the Lambda-based solution. While an improvement over the original cron job, it's not the most modern or effective solution available.

Correct answer: B — AWS Elastic Beanstalk.

• A. Incorrect. This option represents an Infrastructure as a Service (IaaS) approach. While it provides scalability, it requires the operations team to manually configure and manage the underlying EC2 instances, Auto Scaling policies, load balancers, and a CI/CD pipeline. This contradicts the requirements for a simplified platform and automation, especially for a team with limited AWS experience.
• B. Correct. AWS Elastic Beanstalk is a Platform as a Service (PaaS) that is ideal for this scenario. It automates infrastructure provisioning, load balancing, auto-scaling, and application deployment. It natively supports Java applications packaged as WAR files, allowing for migration with minimal to no code changes. This directly addresses all the company's requirements: simplification, automation, and suitability for teams with limited AWS experience.
• C. Incorrect. Amazon EKS is a powerful container orchestration service, but it introduces significant operational complexity. Managing a Kubernetes cluster requires specialized skills and is not a simple solution for a team with limited AWS experience. Furthermore, it would require containerizing the application, which is an extra step that violates the 'minimal code changes initially' requirement.
• D. Incorrect. AWS Fargate with Amazon ECS is a serverless compute engine for containers. While it simplifies infrastructure management by removing the need to manage EC2 instances, it still requires the application to be containerized first. This modernization step is beyond the initial scope of migrating with minimal changes. The learning curve for containerization and ECS is also steeper than for Elastic Beanstalk.

Correct answers: B, D — Amazon EC2 instances in a managed node group; AWS Fargate

• A. Incorrect. AWS Lambda is a serverless, event-driven compute service for running functions. It is not designed to run the Kubernetes worker node components (like the kubelet) required for an EKS data plane.
• B. Correct. Using Amazon EC2 instances is a standard and common method for creating the data plane for an EKS cluster. Managed node groups are the recommended approach as they automate the provisioning and lifecycle management of these EC2 instances, simplifying operations.
• C. Incorrect. Amazon Lightsail is a simplified virtual private server (VPS) offering intended for smaller workloads and is not integrated with Amazon EKS to serve as its data plane.
• D. Correct. AWS Fargate is a serverless compute engine for containers that is natively integrated with Amazon EKS. It allows you to run Kubernetes pods without having to provision or manage the underlying EC2 instances, offering a distinct, serverless compute option for the data plane.
• E. Incorrect. AWS Batch is a fully managed service for running batch computing workloads at scale. While it uses containerized jobs, its compute environments are not designed to function as the general-purpose data plane for an Amazon EKS cluster.

Correct answers: C, E — AWS Schema Conversion Tool (SCT); AWS Database Migration Service (DMS)

• A. Incorrect. AWS DataSync is a service designed for transferring file and object data between on-premises storage systems (like NFS or SMB) and AWS storage services (like Amazon S3 or Amazon EFS). It is not suited for relational database migration.
• B. Incorrect. AWS Glue is a fully managed ETL (extract, transform, and load) service. While it can handle data transformations, it is not the primary tool for live, heterogeneous database migrations with ongoing replication and schema conversion. Its main use cases are for data warehousing and analytics workloads.
• C. Correct. The AWS Schema Conversion Tool (SCT) is specifically designed for heterogeneous database migrations, like moving from MySQL to PostgreSQL. Its primary function is to analyze and convert the source database schema, including tables, indexes, views, and, critically, code objects like the hundreds of stored procedures mentioned in the scenario, from the MySQL dialect to PostgreSQL's PL/pgSQL.
• D. Incorrect. Native MySQL backup and restore tools are intended for homogeneous migrations (e.g., MySQL to MySQL) or for disaster recovery. They cannot convert the schema, data types, or procedural code to be compatible with a different database engine like PostgreSQL. They also do not inherently support a minimal downtime migration strategy.
• E. Correct. The AWS Database Migration Service (DMS) is essential for moving the actual 2 TB of data from the on-premises MySQL database to Amazon Aurora PostgreSQL. Its key feature is the ability to perform change data capture (CDC), which allows for ongoing replication of changes from the source to the target database. This capability is crucial for achieving the 'minimal application downtime' requirement.

Correct answers: B, D — It generates a database migration assessment report detailing the complexity of the conversion.; It converts the source database schema and application-embedded SQL code to a format compatible with the target database.

• A. Incorrect. Continuous data replication (Change Data Capture) is a core feature of the AWS Database Migration Service (DMS), not the AWS Schema Conversion Tool (SCT). SCT's role is to handle the schema and code conversion before the data migration phase begins.
• B. Correct. A primary function of SCT is to generate a comprehensive database migration assessment report. This report analyzes the source schema, quantifies the conversion complexity by identifying what can be converted automatically versus what requires manual intervention, and helps in planning the overall migration effort.
• C. Incorrect. SCT does not provision or configure AWS infrastructure. The target Amazon Aurora cluster must be provisioned separately by the user, either through the AWS Management Console, CLI, or Infrastructure as Code (IaC) tools like AWS CloudFormation.
• D. Correct. This is the main purpose of SCT in a heterogeneous migration. It converts the source database schema (tables, views, indexes) and proprietary database code objects (stored procedures, functions, triggers) from the source engine's format (e.g., Oracle PL/SQL) to one that is compatible with the target database engine (e.g., PostgreSQL PL/pgSQL). SCT can also scan application code to convert embedded SQL.
• E. Incorrect. Monitoring replication lag is a function associated with the data migration process itself, which is managed by AWS Database Migration Service (DMS). This metric is typically monitored using Amazon CloudWatch metrics for the DMS replication task.

Correct answers: B, D — To provide a central dashboard for tracking the progress of application migrations.; To visualize dependencies between servers and help group them into applications.

• A. Incorrect. AWS Migration Hub is a service for planning and tracking migrations. It does not perform automated code refactoring. That task is typically handled by specialized tools like AWS Microservice Extractor for .NET or requires significant manual effort.
• B. Correct. A primary function of AWS Migration Hub is to act as a single place to track the progress of application migrations across multiple AWS and partner solutions. It provides a central dashboard, offering visibility into the entire migration portfolio.
• C. Incorrect. AWS Migration Hub tracks the status of migrations but does not execute them. The actual migration of servers or data is performed by other specialized services such as AWS Application Migration Service (MGN), AWS Server Migration Service (SMS), or AWS Database Migration Service (DMS).
• D. Correct. During the portfolio assessment phase, AWS Migration Hub integrates with discovery tools like AWS Application Discovery Service. This allows it to collect on-premises server data, visualize server-to-server dependencies, and help group servers into logical applications, which is a critical step for planning migration waves.
• E. Incorrect. AWS Migration Hub does not provision the target infrastructure in AWS. This function is performed by Infrastructure as Code (IaC) services like AWS CloudFormation, the AWS CDK, or tools like Terraform.