Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

Separate VPC copies and peering links were created instead of sharing centrally governed subnets. The specific problem here is that each application team is provisioning its own disconnected backbone gateway.

Local Config assessments exist but no aggregation exposes cross-account status. The specific problem here is that each application team is provisioning its own disconnected backbone gateway.

Only source-region S3 versioning is enabled, but no replication rule or role exists. The specific problem here is that each application team is provisioning its own disconnected backbone gateway.

Traffic bypasses inspection endpoints, so rules exist but are never reached. The specific problem here is that a public bucket policy exposes origin objects outside the intended CloudFront access path.

A standard read replica is assumed to be a synchronous multi-Region failover mechanism without promotion. The specific problem here is that a public bucket policy exposes origin objects outside the intended CloudFront access path.

Static IAM user access keys were embedded in the external CI configuration. The specific problem here is that a public bucket policy exposes origin objects outside the intended CloudFront access path.

CloudTrail management events are not retained or centrally available for review. The specific problem here is that static security policy documents are not technically enforced against resource drift.

Kubernetes deployment treats process startup as adequate evidence of request readiness. The specific problem here is that static security policy documents are not technically enforced against resource drift.

WAF rules are deployed without visibility into which requests they affect. The specific problem here is that static security policy documents are not technically enforced against resource drift.

This action targets a different technical need: A message-processing application still uses an on-premises ActiveMQ-compatible broker and cannot immediately rewrite producers. It does not replace either required solution in A or B. Amazon MQ can support compatible managed message brokers when protocol continuity matters; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A global enterprise wants a portfolio-level view of application migrations, owners, blockers and cutover states. It does not replace either required solution in A or B. A centralized migration tracking layer supports coordination across application teams; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A legacy service needs to move into an EKS platform with no interruption to dependent clients. It does not replace either required solution in A or B. Container modernization requires tested runtime behavior and reversible client routing; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Globally dispersed users require low-latency local writes to the same DynamoDB dataset with multi-Region availability. It does not replace either required solution in A or B. Global tables provide multi-Region replication with eventual cross-Region convergence semantics; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: An enterprise wants line-item chargeback for data transfer and service usage across hundreds of accounts. It does not replace either required solution in A or B. The Cost and Usage Report provides detailed billing facts for accountable cost analysis; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: Many workload VPCs need access to a privately published service without opening routing to the provider's whole VPC. It does not replace either required solution in A or B. AWS PrivateLink exposes a selected service to consumers without full network-to-network reachability; verify the two stated requirements independently rather than accepting an unrelated change.

Resource-based trust was not evaluated beyond local IAM identity permission reports. The stated evidence instead indicates: Role policies retain privileges indefinitely without evidence about actual service usage.

Capacity commitments are purchased solely from forecast without checking historical eligible use. The stated evidence instead indicates: Role policies retain privileges indefinitely without evidence about actual service usage.

Static security policy documents are not technically enforced against resource drift. The stated evidence instead indicates: Role policies retain privileges indefinitely without evidence about actual service usage.

One-time offline export cannot satisfy the narrow write-freeze window. The stated evidence instead indicates: Mainframe batch and transaction semantics were treated as if they were ordinary Linux workloads.

Traffic was switched to the container environment before dependent services and probes were verified. The stated evidence instead indicates: Mainframe batch and transaction semantics were treated as if they were ordinary Linux workloads.

All consumers wait for a nightly export despite a near-real-time freshness requirement. The stated evidence instead indicates: Mainframe batch and transaction semantics were treated as if they were ordinary Linux workloads.

Overlapping network prefixes make ordinary VPC peering route selection ambiguous. The specific problem here is that a broad VPC peering link was used where a service-scoped private access path was needed.

Teams have only aggregate bills and cannot locate the source of inefficient storage usage. The specific problem here is that a broad VPC peering link was used where a service-scoped private access path was needed.

The inspection design allows forward and return packets to use different stateful inspection appliances. The specific problem here is that a broad VPC peering link was used where a service-scoped private access path was needed.

Each team independently patches hand-built machine images without reproducible validation. The specific problem here is that the disaster-recovery Region has no local image copy and the deployment assumes remote registry availability.

Stream shard limits or skewed partition keys cannot handle incoming record throughput. The specific problem here is that the disaster-recovery Region has no local image copy and the deployment assumes remote registry availability.

In-place overwriting of every production instance removed the healthy comparison environment. The specific problem here is that the disaster-recovery Region has no local image copy and the deployment assumes remote registry availability.

Snapshot creation is mistaken for proof the application can actually be restored. The stated evidence instead indicates: Shared per-shard read throughput is divided among too many polling consumers.

Gp2 capacity-linked performance assumptions lead to wasteful storage growth. The stated evidence instead indicates: Shared per-shard read throughput is divided among too many polling consumers.

Unsupported drivers or unsuitable instance networking features cap throughput. The stated evidence instead indicates: Shared per-shard read throughput is divided among too many polling consumers.

WAF rules are deployed without visibility into which requests they affect. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.

The application is exposed to one database host or zonal compute failure. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.

One overbroad bucket-level policy grants both teams access to all data. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.