Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

The CDN forwards every request to origin due to ineffective cache keys or caching headers. The stated evidence instead indicates: S3 calls egress through NAT because no supported endpoint route was configured.

Stable compute baseline is paid at on-demand rates without analyzed commitments. The stated evidence instead indicates: S3 calls egress through NAT because no supported endpoint route was configured.

Single-AZ database storage and compute are a single zonal failure domain. The stated evidence instead indicates: S3 calls egress through NAT because no supported endpoint route was configured.

Threat detection remains inconsistently deployed across member accounts and Regions. The stated evidence instead indicates: Static security policy documents are not technically enforced against resource drift.

One overbroad bucket-level policy grants both teams access to all data. The stated evidence instead indicates: Static security policy documents are not technically enforced against resource drift.

Unsupported drivers or unsuitable instance networking features cap throughput. The stated evidence instead indicates: Static security policy documents are not technically enforced against resource drift.

Engineers measure host utilization but not the outcomes experienced by users. The specific problem here is that patch application is manual and lacks consistent baseline selection and change evidence.

Availability claims rest only on architecture diagrams, not controlled chaos evidence. The specific problem here is that patch application is manual and lacks consistent baseline selection and change evidence.

Uncorrelated logs hide where the end-to-end latency accumulates. The specific problem here is that patch application is manual and lacks consistent baseline selection and change evidence.

Partners are forced to replace SFTP clients with AWS SDK calls without business approval. The specific problem here is that traffic was switched to the container environment before dependent services and probes were verified.

A one-time export leaves days of writes uncopied before final deployment. The specific problem here is that traffic was switched to the container environment before dependent services and probes were verified.

Mainframe batch and transaction semantics were treated as if they were ordinary Linux workloads. The specific problem here is that traffic was switched to the container environment before dependent services and probes were verified.

Basic infrastructure availability controls were mistaken for managed advanced DDoS response workflow. The specific problem here is that the destination bucket is present but replication cannot use the destination KMS key.

A backup exists but no restore procedure or measured restore duration has been proven. The specific problem here is that the destination bucket is present but replication cannot use the destination KMS key.

Backup administrators can freely delete critical recovery points despite required immutability. The specific problem here is that the destination bucket is present but replication cannot use the destination KMS key.

Individual Security Hub instances were not centrally delegated or aggregated. The specific problem here is that new accounts are assembled by ad hoc scripts with inconsistent security baselines.

Each application team is provisioning its own disconnected backbone gateway. The specific problem here is that new accounts are assembled by ad hoc scripts with inconsistent security baselines.

Local Config assessments exist but no aggregation exposes cross-account status. The specific problem here is that new accounts are assembled by ad hoc scripts with inconsistent security baselines.

The shared file system's throughput mode or credit availability constrains parallel clients. The stated evidence instead indicates: A standard read replica is assumed to be a synchronous multi-Region failover mechanism without promotion.

A backup exists but no restore procedure or measured restore duration has been proven. The stated evidence instead indicates: A standard read replica is assumed to be a synchronous multi-Region failover mechanism without promotion.

Every component must be rebuilt from scratch after failure, despite a tighter RTO. The stated evidence instead indicates: A standard read replica is assumed to be a synchronous multi-Region failover mechanism without promotion.

This action targets a different technical need: Two Regions must retain independently encrypted object replicas to meet recovery requirements during a source Region failure. It does not replace either required solution in A or B. S3 encrypted object replication needs versioning and appropriate replication-role KMS authorization; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A revenue-critical public endpoint requires proactive DDoS response coordination and protected eligible application resources. It does not replace either required solution in A or B. Shield Advanced adds advanced DDoS protection and response support for supported resources; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: An operations team must roll out the same hardened EC2 AMI to many accounts with recorded patch and test history. It does not replace either required solution in A or B. EC2 Image Builder automates reproducible image lifecycles with testing and distribution; verify the two stated requirements independently rather than accepting an unrelated change.

The selected time window can be replayed to the target bus without inventing events that were never archived. However, this does not establish the required outcome: events from a test member account reach the central incident workflow and unauthorized senders are rejected.

Central compliance dashboards include resource findings from configured participating accounts and Regions. However, this does not establish the required outcome: events from a test member account reach the central incident workflow and unauthorized senders are rejected.

The delegated administrator can manage enrolled member security coverage within its supported scope. However, this does not establish the required outcome: events from a test member account reach the central incident workflow and unauthorized senders are rejected.

The only purpose of a 24/7 server is occasional timer-based work. The specific problem here is that an all-at-once replacement has unacceptable outage and rollback risk.

Console changes have no reproducible declarative infrastructure state. The specific problem here is that an all-at-once replacement has unacceptable outage and rollback risk.

Migration estimates are based solely on outdated procurement records rather than measured workload behavior. The specific problem here is that an all-at-once replacement has unacceptable outage and rollback risk.

This action targets a different technical need: A company wants to identify IAM permissions that have not been used recently before removing high-risk privileges. It does not replace either required solution in A or B. Last-accessed data informs least-privilege reviews but does not prove a permission is universally unnecessary; verify the two stated requirements independently rather than accepting an unrelated change.

State machines improve auditability when state transitions and idempotency are designed. The two requirements instead call for these controls: (A) Enable Security Hub delegated administration and finding aggregation for the target accounts and Regions; (B) Configure provisioned concurrency for selected published function aliases with suitable demand planning.

This action targets a different technical need: A global media site sends repeated uncached misses to an expensive origin even with widespread CloudFront edge caches. It does not replace either required solution in A or B. CloudFront Origin Shield can consolidate cache misses through an additional regional layer; verify the two stated requirements independently rather than accepting an unrelated change.