Advanced certification validating skills in designing complex enterprise architectures and migration strategies on AWS.
Cross-Account Access, AWS Organizations, AWS Control Tower, Hybrid Networking, AWS Transit Gateway, AWS Resource Access Manager
Serverless Architecture, Amazon ECS & EKS Containers, Amazon Aurora & DynamoDB, Amazon API Gateway, AWS Step Functions, Event-Driven Architecture
AWS Well-Architected Framework, AWS Cost Explorer & Trusted Advisor, Auto Scaling Advanced Policies, Amazon CloudWatch & X-Ray, ElastiCache & DAX Caching Strategies, Cost Optimization
AWS Migration Hub, AWS Application Migration Service, AWS Database Migration Service, AWS Snow Family, AWS DataSync, 6R Migration Strategies
Try real exam-style questions from the free sample set. Each answer comes with a full explanation.
A global e-commerce company wants to fully migrate its web service from an on-premises data center to AWS.
The current system is single-server based with mixed static and dynamic content and uses a MySQL database. After migration, the architecture must minimize latency for global users, provide DDoS protection, ensure Multi-AZ high availability, and support automatic scaling. The database must maintain MySQL compatibility while improving read performance, and the operations team wants to minimize infrastructure management overhead.
Which AWS migration architecture BEST meets all of these requirements simultaneously?
Answer: B. CloudFront + ALB + Auto Scaling + Aurora MySQL
The CloudFront + ALB + Auto Scaling + Aurora MySQL combination is the standard migration architecture that satisfies all six requirements: minimizing global latency, DDoS protection, Multi-AZ high availability, automatic scaling, improved MySQL-compatible read performance, and minimized operational overhead. CloudFront provides DDoS protection through AWS Shield Standard while caching static content at edge locations worldwide, ALB + Auto Scaling handles Multi-AZ distribution and automatic scaling of dynamic traffic, and Aurora MySQL resolves both MySQL compatibility and read performance as a fully managed service.
Amazon CloudFront is a global CDN service that delivers content to users worldwide with minimal latency through 600+ edge locations. Amazon Aurora MySQL is fully compatible with MySQL while providing up to 5x the performance of standard MySQL, and it supports up to 15 Read Replicas to distribute read load. The combination of ALB and EC2 Auto Scaling Group automatically adds or removes instances based on traffic changes, eliminating the need for the operations team to directly manage capacity.
Be careful not to confuse Global Accelerator with CloudFront. Global Accelerator is suitable for routing optimization of TCP/UDP-based dynamic traffic, while CloudFront includes HTTP-based static and dynamic content caching plus DDoS protection. When keywords like mixed static/dynamic web service, global users, DDoS protection, and MySQL compatibility appear together, the CloudFront + ALB + Aurora MySQL combination is the standard correct answer.
A SaaS company operating in a multi-account environment managed by AWS Organizations manages DNS records for internal microservice endpoints and RDS instances in a Route 53 private hosted zone in a shared services account. VPCs in newly created workload accounts must also use this private DNS, but workload account owners must not be able to directly modify the hosted zone.
In an environment where workload accounts are continuously added, which private DNS sharing design BEST meets security requirements while minimizing operational overhead?
Answer: B. Route 53 Resolver + RAM
This question tests whether you can correctly select an architecture that centralizes DNS record modification rights in a shared services account while allowing workload account VPCs to use private DNS in a multi-account environment. Sharing a Route 53 Resolver Rule via AWS RAM allows the shared services account to deploy Resolver forwarding rules to workload account VPCs while retaining DNS record authority. Configuring OU-based sharing automatically applies to newly added accounts, achieving both scalability and operational convenience.
A Route 53 Resolver Rule is a rule that forwards DNS queries for a specific domain to a designated IP. Configuring an Inbound Resolver Endpoint in the shared services account allows external account VPCs to forward private domain queries to this endpoint. Using AWS RAM, this Resolver Rule can be shared with specific OUs or individual accounts within Organizations, and workload accounts only need to associate the shared rule with their VPCs. DNS resolution is possible without direct access to the hosted zone itself, satisfying the security requirements.
For AWS exam questions on multi-account DNS sharing, whether modification rights are isolated is the key decision criterion. If direct hosted zone sharing is needed, use Route 53 cross-account VPC association; if both query forwarding and permission isolation are required, Resolver Rule + RAM is the correct answer.
A large enterprise is planning an AWS migration with a mixed on-premises environment of 500 VMs in VMware vSphere, 200 VMs in Hyper-V, and 50 physical servers.
The migration team wants to automatically collect CPU, memory, network dependencies, and software inventory for all servers to determine migration priorities and appropriate EC2 instance types. They need to provide visualized migration reports to executives.
Which approach BEST configures discovery and reporting for a heterogeneous environment centered on AWS Migration Hub?
Answer: B. Migration Hub + Agentless Connector + Agent
AWS Application Discovery Service provides two methods for collecting configuration and performance data from on-premises servers. For VMware vSphere environments, the Agentless Collector (OVA appliance) is deployed to vCenter to collect VM metadata without installing agents. For Hyper-V environments and physical servers, the Agent is installed directly to collect running processes, network connections, and software inventory. Option 2 combines both methods to cover the entire heterogeneous environment.
AWS Migration Hub centrally aggregates and visualizes data collected by Application Discovery Service. Based on collected CPU, memory, storage, and network data, it recommends appropriate EC2 instance types, and the application grouping feature visualizes inter-server dependencies to establish migration priorities and wave plans. All migration statuses are tracked in a single view to provide reports to executives.
Clearly distinguish the roles of the three tools on the exam. Choose Application Discovery Service for on-premises inventory collection, Migration Hub for migration tracking and management, and MGN for actual server migration. AWS Config is exclusively for tracking resource state within the AWS cloud and cannot be used for on-premises discovery.
A large financial group manages over 200 member accounts using AWS Organizations with a deny SCP applied at the root level that blocks all AWS service usage outside specific regions.
After acquiring a foreign subsidiary, the subsidiary's existing AWS account must be onboarded to Organizations. The subsidiary has a regulatory requirement to maintain its existing regional workloads for 6 months post-acquisition.
To allow the subsidiary account temporary access to additional regions while maintaining the security policies of the entire existing organization, which SCP design approach is MOST appropriate?
Answer: B. Create a dedicated OU for the subsidiary and apply a region-allow SCP
A financial group controls regional access for the entire organization using a root deny SCP, while needing to grant the subsidiary account temporary access to additional regions for 6 months. Since SCPs are inherited through the OU hierarchy, separating the subsidiary into a dedicated OU and adding a region-allowing SCP to that OU implements the exception without modifying the root policy. Although deny always takes precedence over allow in SCP evaluation, the exception is granted by structurally separating the target through OU placement.
SCPs are governance tools that set permission or denial boundaries at the account, OU, and root levels. While the root SCP is inherited by all child accounts, separating the subsidiary into a dedicated OU allows additional SCPs to be applied only to that OU. Importantly, exception handling within a root SCP using the aws:PrincipalAccount condition key is not officially supported in SCP syntax, making OU separation the only valid approach. After 6 months, removing the exception SCP or moving the subsidiary account to an existing OU automatically unifies the policy.
When SCP exception handling appears on the exam, remember that the ONLY way to grant exceptions without modifying the root SCP is to create a separate OU. Option 3, which attempts to bypass SCPs with IAM Policy, is always incorrect, and temporarily disabling the root SCP affects all 200+ accounts and is therefore incorrect.
A financial institution manages all AWS infrastructure with CloudFormation and templates are stored in a GitHub repository.
Recently, a developer modified a production stack CloudFormation template and deployed it directly, causing an incident where a running RDS instance was replaced. The security team requires that all infrastructure changes go through CI/CD pipelines only, and a step for pre-validating change impact before production deployment must be included.
What is the MOST appropriate CI/CD pipeline design to ensure safe deployment of CloudFormation changes while minimizing operational overhead?
Answer: C. CodePipeline + Change Sets + approval step
A financial institution needs to validate change impact before production deployment and enforce a CI/CD pipeline. The combination of AWS CodePipeline + CloudFormation Change Sets + manual approval step BEST meets these requirements. Change Sets preview each resource's Action (Add/Modify/Remove) and Replacement (True/False) before applying changes to the actual stack, enabling pre-detection of destructive changes such as RDS instance replacement and blocking them at the manual approval stage.
AWS CodePipeline is a fully managed CI/CD service that automates the stages: GitHub source change detection → Change Sets creation → review and approval → ExecuteChangeSet. Since the pipeline controls all deployment paths, it structurally prevents direct deployment by developers. When the Replacement field in CloudFormation Change Sets shows True, it means the existing resource will be deleted and recreated, allowing the approver to reject the deployment or choose an alternative.
On the exam, remember the combination of Change Sets and a manual approval step as the core of safe CloudFormation deployment questions. StackSets is for deploying the same template across multiple accounts and regions, and is unrelated to validating change impact for a single stack. CDK Diff + manual deployment is not enforcement through a CI/CD pipeline, leaving the risk that developers can still deploy directly.
The AWS Certified Solutions Architect - Professional (SAP-C02) exam consists of 75 questions with a 180-minute time limit.
The passing score for the SAP-C02 exam is 750 out of 1000.
The SAP-C02 sample set (20 questions with full explanations) is free. The full bank of 340+ questions is available with a CloudMasterIT subscription.
The SAP-C02 certification is valid for 3 years after passing. Recertification is required after that.