Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

WAF rules are deployed without visibility into which requests they affect. The specific problem here is that findings remain siloed in local account consoles and cannot be triaged centrally.

One overbroad bucket-level policy grants both teams access to all data. The specific problem here is that findings remain siloed in local account consoles and cannot be triaged centrally.

Patch application is manual and lacks consistent baseline selection and change evidence. The specific problem here is that findings remain siloed in local account consoles and cannot be triaged centrally.

Raw CloudTrail logs were collected but no managed threat-detection findings were enabled. The stated evidence instead indicates: A public bucket policy exposes origin objects outside the intended CloudFront access path.

Individual account stacks were created manually and drift from the approved baseline. The stated evidence instead indicates: A public bucket policy exposes origin objects outside the intended CloudFront access path.

Traffic bypasses inspection endpoints, so rules exist but are never reached. The stated evidence instead indicates: A public bucket policy exposes origin objects outside the intended CloudFront access path.

A successful compilation is treated as proof that the release is safe and functional. The stated evidence instead indicates: The function's unqualified ARN always invokes latest code for all users, bypassing version routing.

The disaster-recovery Region has no local image copy and the deployment assumes remote registry availability. The stated evidence instead indicates: The function's unqualified ARN always invokes latest code for all users, bypassing version routing.

A single active Region was incorrectly advertised as having near-zero recovery time. The stated evidence instead indicates: The function's unqualified ARN always invokes latest code for all users, bypassing version routing.

Partners are forced to replace SFTP clients with AWS SDK calls without business approval. The specific problem here is that always-on monolith capacity is required merely to handle infrequent independent endpoints.

A direct S3 SDK rewrite was imposed on workloads that cannot change their file interface. The specific problem here is that always-on monolith capacity is required merely to handle infrequent independent endpoints.

Local instance disks are wrongly used as a shared durable POSIX file system. The specific problem here is that always-on monolith capacity is required merely to handle infrequent independent endpoints.

On-premises DNS has no forwarding path into the VPC's Route 53 Resolver. The stated evidence instead indicates: Only source-region S3 versioning is enabled, but no replication rule or role exists.

Every backup copy resides in the same administration boundary as the threatened workloads. The stated evidence instead indicates: Only source-region S3 versioning is enabled, but no replication rule or role exists.

A single-Region Aurora cluster lacks a suitable crossregional disaster recovery target. The stated evidence instead indicates: Only source-region S3 versioning is enabled, but no replication rule or role exists.

This action targets a different technical need: An ECS cluster has enough total CPU but tasks stay pending due to unsuitable placement and capacity provider configuration. It does not replace either required solution in A or B. ECS placement depends on available per-host resources and declared capacity-provider strategy; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: A DynamoDB application requires recovery from accidental writes to an earlier point within a month. It does not replace either required solution in A or B. DynamoDB PITR restores to a selected point within its available recovery window; verify the two stated requirements independently rather than accepting an unrelated change.

This action targets a different technical need: An S3 bucket is repeatedly made public and security wants prompt correction beyond simply generating findings. It does not replace either required solution in A or B. Config rules can invoke automations for selected remediable configuration noncompliance; verify the two stated requirements independently rather than accepting an unrelated change.

The job executes at its configured schedule while no dedicated idle EC2 host is required. However, this does not establish the required outcome: source and destination data reconcile, CDC lag reaches the target and switching endpoints remains reversible.

Each proposed migration wave includes dependencies required for a functional smoke test. However, this does not establish the required outcome: source and destination data reconcile, CDC lag reaches the target and switching endpoints remains reversible.

A forced downstream failure follows tested compensation logic without duplicating completed orders. However, this does not establish the required outcome: source and destination data reconcile, CDC lag reaches the target and switching endpoints remains reversible.

Repeated retries of one failed message prevent useful error isolation and redrive workflow. The stated evidence instead indicates: No event archive exists to replay notifications that failed during downstream processing.

Single-AZ database storage and compute are a single zonal failure domain. The stated evidence instead indicates: No event archive exists to replay notifications that failed during downstream processing.

Stable compute baseline is paid at on-demand rates without analyzed commitments. The stated evidence instead indicates: No event archive exists to replay notifications that failed during downstream processing.

Instances were resized from average CPU alone despite memory or traffic constraints. The stated evidence instead indicates: Static budgets cannot explain or detect each atypical spend pattern promptly.

Resource tags were never activated as billing cost allocation dimensions. The stated evidence instead indicates: Static budgets cannot explain or detect each atypical spend pattern promptly.

Management-account-only operations were mistaken for necessary daily centralized security administration. The stated evidence instead indicates: Static budgets cannot explain or detect each atypical spend pattern promptly.

Actual eligible usage receives commitment coverage while variable spikes remain flexible. However, this does not establish the required outcome: origin request count and cacheable transferred bytes fall without serving stale protected content.

The repeated key lookup hits DAX with lower latency while noncacheable paths use the underlying table. However, this does not establish the required outcome: origin request count and cacheable transferred bytes fall without serving stale protected content.

Free storage stays above emergency thresholds while capacity grows within policy rather than being oversized initially. However, this does not establish the required outcome: origin request count and cacheable transferred bytes fall without serving stale protected content.

Every component must be rebuilt from scratch after failure, despite a tighter RTO. The stated evidence instead indicates: The destination bucket is present but replication cannot use the destination KMS key.

A single active Region was incorrectly advertised as having near-zero recovery time. The stated evidence instead indicates: The destination bucket is present but replication cannot use the destination KMS key.

Every read request traverses the backing DynamoDB service despite highly reusable cacheable data. The stated evidence instead indicates: The destination bucket is present but replication cannot use the destination KMS key.