Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

All assets are scheduled for direct rehost even when some are obsolete or unsuitable. The specific problem here is that migration scheduling ignored data classification and jurisdictional control requirements.

Database engine migration was assumed to be a simple homogeneous replication job. The specific problem here is that migration scheduling ignored data classification and jurisdictional control requirements.

Dedicated EC2 servers remain the scaling bottleneck for stateless containerized workloads. The specific problem here is that migration scheduling ignored data classification and jurisdictional control requirements.

Stream shard limits or skewed partition keys cannot handle incoming record throughput. The specific problem here is that every read request traverses the backing DynamoDB service despite highly reusable cacheable data.

A single active Region was incorrectly advertised as having near-zero recovery time. The specific problem here is that every read request traverses the backing DynamoDB service despite highly reusable cacheable data.

Every static asset fetch goes to a distant origin instead of the edge cache. The specific problem here is that every read request traverses the backing DynamoDB service despite highly reusable cacheable data.

On-demand usage was left wholly uncommitted despite predictable baseline compute consumption. The stated evidence instead indicates: Management-account-only operations were mistaken for necessary daily centralized security administration.

Each application team is provisioning its own disconnected backbone gateway. The stated evidence instead indicates: Management-account-only operations were mistaken for necessary daily centralized security administration.

Local activity trails are not consolidated into the audit security boundary. The stated evidence instead indicates: Management-account-only operations were mistaken for necessary daily centralized security administration.

This action targets a different technical need: Network administrators must manage a shared subnet centrally while application accounts place their own resources in it. It does not replace either required solution in A or B. VPC sharing separates network ownership from application resource ownership; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Order processing must survive transient database outages without permanently losing accepted incoming work. It does not replace either required solution in A or B. Durable queues decouple intake availability from downstream processing failures; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A multi-account organization must prevent member accounts from disabling mandatory CloudTrail trails even when local administrators hold broad IAM policies. It does not replace either required solution in A or B. Service control policies set permission ceilings for member account principals and cannot grant access themselves; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Finance needs engineering costs apportioned by team using tags rather than guessed from account totals. It does not replace either required solution in A or B. Cost allocation tags must be activated before they appear in billing cost analytics; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Regulators require consistent detection and correction of publicly accessible S3 buckets across a multi-account organization. It does not replace either required solution in A or B. Organization-level Config rules continuously evaluate configuration and can launch controlled remediations; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A company uses Direct Connect for normal hybrid traffic but needs encrypted emergency connectivity if carrier circuits fail. It does not replace either required solution in A or B. A tested secondary encrypted tunnel path can carry critical traffic while primary private connectivity is unavailable; verify the two stated requirements independently rather than accepting an unrelated change.

Disjoint local-account trails leave central auditors with incomplete visibility. The specific problem here is that the remote principal has S3 object access but lacks required key-policy and IAM decrypt permission.

Public ACM-issued certificates were wrongly assumed to provide a corporate private CA chain. The specific problem here is that the remote principal has S3 object access but lacks required key-policy and IAM decrypt permission.

There is no independently functioning VPN path when private connectivity goes down. The specific problem here is that the remote principal has S3 object access but lacks required key-policy and IAM decrypt permission.

An overly broad assumed-role session is not constrained to the vendor's assigned resources. The specific problem here is that local Config assessments exist but no aggregation exposes cross-account status.

Events remain confined to local account buses because cross-account bus authorization is absent. The specific problem here is that local Config assessments exist but no aggregation exposes cross-account status.

All accounts share one indiscriminate service-control policy despite different risk profiles. The specific problem here is that local Config assessments exist but no aggregation exposes cross-account status.

Snapshot creation is mistaken for proof the application can actually be restored. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

Teams confuse key material rotation with replacing the KMS key ID and losing access to old data. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

One overbroad bucket-level policy grants both teams access to all data. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

S3 calls egress through NAT because no supported endpoint route was configured. The specific problem here is that a single active Region was incorrectly advertised as having near-zero recovery time.

A standard read replica is assumed to be a synchronous multi-Region failover mechanism without promotion. The specific problem here is that a single active Region was incorrectly advertised as having near-zero recovery time.

The destination bucket is present but replication cannot use the destination KMS key. The specific problem here is that a single active Region was incorrectly advertised as having near-zero recovery time.

A one-time export leaves days of writes uncopied before final deployment. The specific problem here is that the only purpose of a 24/7 server is occasional timer-based work.

An all-at-once replacement has unacceptable outage and rollback risk. The specific problem here is that the only purpose of a 24/7 server is occasional timer-based work.

Developers assume SQS has identical JMS or broker feature semantics to the source stack. The specific problem here is that the only purpose of a 24/7 server is occasional timer-based work.

Every static asset fetch goes to a distant origin instead of the edge cache. The stated evidence instead indicates: Region-specific public IPs and DNS routing do not provide the needed global anycast transport optimization.

Repeated retries of one failed message prevent useful error isolation and redrive workflow. The stated evidence instead indicates: Region-specific public IPs and DNS routing do not provide the needed global anycast transport optimization.

Instance-local caches cannot share consistent ephemeral state across horizontally scaled hosts. The stated evidence instead indicates: Region-specific public IPs and DNS routing do not provide the needed global anycast transport optimization.