Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Savings recommendations exist in separate consoles and are double counted in spreadsheets. The specific problem here is that teams have only aggregate bills and cannot locate the source of inefficient storage usage.

All accounts share one indiscriminate service-control policy despite different risk profiles. The specific problem here is that teams have only aggregate bills and cannot locate the source of inefficient storage usage.

On-demand usage was left wholly uncommitted despite predictable baseline compute consumption. The specific problem here is that teams have only aggregate bills and cannot locate the source of inefficient storage usage.

Independent release scripts lack enforceable promotion ordering and approval evidence. The stated evidence instead indicates: A successful compilation is treated as proof that the release is safe and functional.

Every reporting query was sent to the cluster writer endpoint despite available readers. The stated evidence instead indicates: A successful compilation is treated as proof that the release is safe and functional.

Each team independently patches hand-built machine images without reproducible validation. The stated evidence instead indicates: A successful compilation is treated as proof that the release is safe and functional.

Static IAM user access keys were embedded in the external CI configuration. The specific problem here is that traffic bypasses inspection endpoints, so rules exist but are never reached.

IAM principal permission was mistaken for sufficient access despite a restrictive KMS key policy. The specific problem here is that traffic bypasses inspection endpoints, so rules exist but are never reached.

The team assumes an x86 machine image and native binaries can run unchanged on arm64. The specific problem here is that traffic bypasses inspection endpoints, so rules exist but are never reached.

Passive regional copies exist without health-driven endpoint selection. The stated evidence instead indicates: Capacity commitments are purchased solely from forecast without checking historical eligible use.

Shared costs are assigned by arbitrary percentage without service consumption evidence. The stated evidence instead indicates: Capacity commitments are purchased solely from forecast without checking historical eligible use.

Instances remain oversized based only on purchase history rather than performance evidence. The stated evidence instead indicates: Capacity commitments are purchased solely from forecast without checking historical eligible use.

Static IAM user access keys were embedded in the external CI configuration. The stated evidence instead indicates: Raw CloudTrail logs were collected but no managed threat-detection findings were enabled.

The destination bucket is present but replication cannot use the destination KMS key. The stated evidence instead indicates: Raw CloudTrail logs were collected but no managed threat-detection findings were enabled.

Service API traffic depends on public egress or an unintended NAT route despite a private-access requirement. The stated evidence instead indicates: Raw CloudTrail logs were collected but no managed threat-detection findings were enabled.

Migration scheduling ignored data classification and jurisdictional control requirements. The specific problem here is that separate component logs cannot be correlated to customer transactions.

The only purpose of a 24/7 server is occasional timer-based work. The specific problem here is that separate component logs cannot be correlated to customer transactions.

All consumers wait for a nightly export despite a near-real-time freshness requirement. The specific problem here is that separate component logs cannot be correlated to customer transactions.

The API meets latency SLOs under bursts and incurs low idle compute spend without permanently allocated hosts. However, this does not establish the required outcome: new DNS lookups return the secondary endpoint after a primary health check changes to unhealthy.

Events captured during the fault can be replayed to a corrected consumer after recovery. However, this does not establish the required outcome: new DNS lookups return the secondary endpoint after a primary health check changes to unhealthy.

A simulated transient error is retried according to policy and a persistent error follows a defined failure branch. However, this does not establish the required outcome: new DNS lookups return the secondary endpoint after a primary health check changes to unhealthy.

Backups remain recoverable from the dedicated account even when the application account is disabled. However, this does not establish the required outcome: writes in either Region replicate to the other and conflict handling matches the business design.

Queries from on-premises resolvers return the expected private-zone records through inbound endpoint addresses. However, this does not establish the required outcome: writes in either Region replicate to the other and conflict handling matches the business design.

Replica lag and promotion tests meet defined RPO and RTO targets during planned and simulated events. However, this does not establish the required outcome: writes in either Region replicate to the other and conflict handling matches the business design.

This action targets a different technical need: A headquarters requires a resilient private link to workloads in two Regions and must avoid routing all traffic over the public internet. It does not replace either required solution in A or B. Independent Direct Connect circuits and correctly associated gateways improve hybrid-path resiliency; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Compliance requires protected organization-wide API activity logs to flow into a centralized security account with controlled deletion. It does not replace either required solution in A or B. AWS Organizations trails centralize multi-account CloudTrail logging when storage access is secured; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Dozens of overprovisioned EC2 instances need evidence-based CPU and memory sizing recommendations before changing families. It does not replace either required solution in A or B. Compute Optimizer uses resource metrics and recommendations but must be checked against workload SLOs; verify the two stated requirements independently rather than accepting an unrelated change.

NAT processed-byte charges for eligible S3 traffic fall while S3 requests still succeed under endpoint policy. However, this does not establish the required outcome: cloudFront retrieves approved objects while direct anonymous S3 URLs are rejected.

The authorized role decrypts the designated ciphertext while an unrelated role remains denied. However, this does not establish the required outcome: cloudFront retrieves approved objects while direct anonymous S3 URLs are rejected.

The abusive source crosses its request threshold and is blocked without blocking allowed sample traffic. However, this does not establish the required outcome: cloudFront retrieves approved objects while direct anonymous S3 URLs are rejected.

Separate VPC copies and peering links were created instead of sharing centrally governed subnets. The stated evidence instead indicates: Individual accounts use drifting custom schedules that do not match central backup policy.

Static budgets cannot explain or detect each atypical spend pattern promptly. The stated evidence instead indicates: Individual accounts use drifting custom schedules that do not match central backup policy.

Management-account-only operations were mistaken for necessary daily centralized security administration. The stated evidence instead indicates: Individual accounts use drifting custom schedules that do not match central backup policy.