Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

WAF rules are deployed without visibility into which requests they affect. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.

The application is exposed to one database host or zonal compute failure. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.

One overbroad bucket-level policy grants both teams access to all data. The specific problem here is that resource-based trust was not evaluated beyond local IAM identity permission reports.

Central compliance dashboards include resource findings from configured participating accounts and Regions. However, this does not establish the required outcome: a new workload account's API activity appears in the central log bucket and member administrators cannot erase it.

A synthetic or observed unusual cost pattern appears in anomaly alerts with impacted spend drivers. However, this does not establish the required outcome: a new workload account's API activity appears in the central log bucket and member administrators cannot erase it.

Events from a test member account reach the central incident workflow and unauthorized senders are rejected. However, this does not establish the required outcome: a new workload account's API activity appears in the central log bucket and member administrators cannot erase it.

Untracked imperative orchestration repeats previous side effects after transient failures. The specific problem here is that uncorrelated logs hide where the end-to-end latency accumulates.

Config findings are left as unactioned notifications while risky drift remains exposed. The specific problem here is that uncorrelated logs hide where the end-to-end latency accumulates.

One overbroad bucket-level policy grants both teams access to all data. The specific problem here is that uncorrelated logs hide where the end-to-end latency accumulates.

Separate point-to-point VPC peering connections lack transitive routing and are difficult to govern at scale. The stated evidence instead indicates: Overlapping network prefixes make ordinary VPC peering route selection ambiguous.

The remote principal has S3 object access but lacks required key-policy and IAM decrypt permission. The stated evidence instead indicates: Overlapping network prefixes make ordinary VPC peering route selection ambiguous.

There is no independently functioning VPN path when private connectivity goes down. The stated evidence instead indicates: Overlapping network prefixes make ordinary VPC peering route selection ambiguous.

Findings remain siloed in local account consoles and cannot be triaged centrally. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

In-place mass deployment removed rollback capacity before verifying the new version. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

Static security policy documents are not technically enforced against resource drift. The stated evidence instead indicates: Threat detection remains inconsistently deployed across member accounts and Regions.

Basic infrastructure availability controls were mistaken for managed advanced DDoS response workflow. The specific problem here is that instance capacity is pinned to one zone with no automated target recovery.

No event archive exists to replay notifications that failed during downstream processing. The specific problem here is that instance capacity is pinned to one zone with no automated target recovery.

Single-AZ database storage and compute are a single zonal failure domain. The specific problem here is that instance capacity is pinned to one zone with no automated target recovery.

Standard short-lived backups cannot recover the exact chosen accidental-update point. The stated evidence instead indicates: Patch application is manual and lacks consistent baseline selection and change evidence.

Engineers measure host utilization but not the outcomes experienced by users. The stated evidence instead indicates: Patch application is manual and lacks consistent baseline selection and change evidence.

Uncorrelated logs hide where the end-to-end latency accumulates. The stated evidence instead indicates: Patch application is manual and lacks consistent baseline selection and change evidence.

Metrics and logs are not organized into actionable per-service operational signals. The specific problem here is that kubernetes deployment treats process startup as adequate evidence of request readiness.

Snapshot creation is mistaken for proof the application can actually be restored. The specific problem here is that kubernetes deployment treats process startup as adequate evidence of request readiness.

The application is exposed to one database host or zonal compute failure. The specific problem here is that kubernetes deployment treats process startup as adequate evidence of request readiness.

Every enrolled account produces expected trail events in the security account and workloads cannot delete retained logs. However, this does not establish the required outcome: an administrator's disable request is denied while an authorized central management path remains available.

Eligible accounts create scheduled recovery points according to policies and restores are tested. However, this does not establish the required outcome: an administrator's disable request is denied while an authorized central management path remains available.

The consumer role reads approved encrypted objects but cannot decrypt other protected datasets. However, this does not establish the required outcome: an administrator's disable request is denied while an authorized central management path remains available.

Failed notifications disappear because no supported retry and DLQ design is in place. The specific problem here is that passive regional copies exist without health-driven endpoint selection.

In-place mass deployment removed rollback capacity before verifying the new version. The specific problem here is that passive regional copies exist without health-driven endpoint selection.

Unattached volumes are treated as free merely because they are not mounted. The specific problem here is that passive regional copies exist without health-driven endpoint selection.

Workload service calls repeatedly cross paid network boundaries without quantified need. The stated evidence instead indicates: Capacity planning ignores demand spikes or hot keys that concentrate requests.

Unsupported drivers or unsuitable instance networking features cap throughput. The stated evidence instead indicates: Capacity planning ignores demand spikes or hot keys that concentrate requests.

Misses from different edge caches repeatedly burden the same origin. The stated evidence instead indicates: Capacity planning ignores demand spikes or hot keys that concentrate requests.