AWS Certified Solutions Architect - Professional (SAP-C02)

Incorrect. Converting SQL Server to DynamoDB using AWS SCT is a major modernization effort, not a straightforward migration, and it adds significant application refactoring risk for a payment processing relational workload. Also, using Parameter Store plus CloudWatch/Lambda for rotation is custom operational work compared to Secrets Manager’s managed rotation. This does not meet the “least operational overhead” requirement.

Incorrect. Running SQL Server on EC2 increases operational overhead because the company must manage the Windows OS, SQL Server patching, backups, HA design, and monitoring. Using Parameter Store with a Lambda-based rotation schedule is also more custom work than Secrets Manager rotation and requires careful coordination to update the SQL login and dependent applications safely.

Incorrect. Amazon Neptune is a graph database and is not an appropriate target for migrating a Microsoft SQL Server payment processing database without significant redesign. AWS SCT does not make this a low-effort migration; it would require substantial schema and application changes. Additionally, using CloudWatch/Lambda for rotation is unnecessary compared to Secrets Manager’s managed rotation capabilities.

Incorrect. Amazon Inspector focuses on vulnerability management and exposure findings (e.g., CVEs, network reachability), not governance for cost allocation tags. It is not designed to discover or enforce missing CostCenter tags on EC2 instances, and it would not provide the required preventive control to block untagged launches.

Incorrect. An IAM policy can deny ec2:RunInstances when a request tag is missing, but it must be attached and maintained in each account (and potentially for many roles/users). It is easier to misconfigure, may not cover all principals, and is not as robust as an SCP for organization-wide preventive governance. The question explicitly wants organization-wide control and centralized reporting.

Incorrect. AWS Security Hub aggregates security findings from services and partners; it is not a primary mechanism for tag compliance reporting across all EC2 instances. While custom findings could be created indirectly, it does not natively provide the required-tag compliance evaluation and does not enforce preventive controls to block untagged EC2 launches.

Incorrect. An Application Load Balancer is Regional and cannot span multiple Regions or be attached to subnets in two different VPCs/Regions. Likewise, an Auto Scaling group cannot launch instances across multiple Regions; it is scoped to one Region and one VPC. VPC peering does not change these service boundaries, so this design cannot implement the required cross-Region active-passive DR.

Incorrect/insufficient. While it correctly builds separate stacks in each Region, it does not explicitly configure Route 53 for active-passive behavior. “Enable health checks on both records” without a failover routing policy could lead to active-active behavior (depending on routing policy) or ambiguous traffic routing. The requirement states traffic must be served only from ap-southeast-2 during normal operations.

Incorrect. Like option A, it relies on an ALB and Auto Scaling group spanning multiple VPCs/Regions, which is not supported. A single Route 53 record pointing to one ALB also does not provide the required active-passive cross-Region failover. VPC peering is unnecessary for this pattern and does not enable cross-Region load balancing.

Kinesis Data Firehose is primarily a delivery service (to S3, Redshift, OpenSearch, etc.) with buffering and optional lightweight transforms. It is not designed for custom near-real-time analytics with strict per-partition ordering and consumer-controlled replay. Firehose also doesn’t “analyze with Kinesis clients” (KCL is for KDS). Storing results in Amazon RDS is not a typical BI warehouse pattern compared to Redshift.

Amazon S3 is an object store, not a near-real-time ingestion bus; writing every second from 2,500 devices would create many small objects and higher end-to-end latency. The flow “analyze the data from Amazon SQS with Kinesis” is also incoherent: Kinesis does not consume from SQS as a native source. SQS provides at-least-once delivery but does not guarantee strict ordering at scale (standard queues) and is not ideal for replayable stream analytics.

API Gateway + SQS + Lambda can ingest events, but it is not a strong fit for ordered streaming with replay and high-throughput analytics. SQS standard queues do not guarantee ordering; FIFO queues provide ordering but have throughput constraints and operational complexity at this scale. Lambda-based analytics can struggle with stateful windowing and sub-3-second continuous processing compared to stream processors. EMR after SQS adds unnecessary complexity and latency.

CloudFront can cache and reduce read latency, but it is not a multi-Region write solution and does not replicate objects between Regions. Global Accelerator improves routing to regional endpoints, but S3 is not fronted by GA in a way that provides active-active writes and a single S3 data endpoint. This option also keeps a single bucket, so ap-southeast-2 writes still traverse to us-east-1, increasing latency.

One-way CRR only replicates from the original bucket to the new bucket. If the application in ap-southeast-2 writes to its local bucket, those objects will not replicate back to us-east-1, violating the requirement to support writes from both Regions while keeping datasets aligned. It also lacks a single global access endpoint; the application would need region-specific bucket logic.

S3 gateway endpoints provide private connectivity from a VPC to S3 within a Region; they do not create a global endpoint, do not enable multi-Region writes, and do not replicate data. S3 Intelligent-Tiering is a storage class optimization for cost and access patterns, unrelated to cross-Region latency reduction or active-active multi-Region data access.

Incorrect. Standard Reserved Instances apply only to EC2 and are much more rigid than Savings Plans because they are tied to specific instance attributes and do not help with Lambda or Fargate usage. While the added Compute Savings Plan would cover serverless services, this answer mixes older RI purchasing with a newer mixed-compute environment instead of using a more scalable organization-wide Savings Plans strategy. It is therefore not the best overall purchasing model for maximizing savings across a modern multi-account, multi-service compute portfolio.

Incorrect. A 1-year term and No Upfront payment provide lower discounts than a 3-year commitment, which is not aligned with the stated 36-month stable usage pattern. Purchasing separately in each member account also fragments commitments and can reduce the effectiveness of discount sharing across the organization. In addition, this option uses only Compute Savings Plans and misses the opportunity to use a more discounted EC2-specific plan for the large steady EC2 footprint.

Incorrect. Purchasing in each member account is less efficient than buying centrally in the management account because it can strand commitments if usage shifts between accounts. EC2 Instance Savings Plans also do not cover Lambda or Fargate, so this option fails to address the new serverless pipeline at all. Even though it uses a 3-year All Upfront term, it is incomplete for the company’s full compute usage and therefore cannot provide the most savings overall.

Max I/O performance mode can improve scalability for highly parallel access by distributing load, but it often increases latency and does not automatically provide the massive sustained throughput needed for 20,000 concurrent 1080p streams. You would still need to address EFS throughput limits (bursting credits or provisioned throughput), and costs can rise significantly. It’s a partial mitigation, not the most cost-efficient scalable fix.

Using instance store for videos is operationally complex and fragile: instance store is ephemeral, requires large local capacity, and syncing 200 MB assets back to S3 at shutdown is unreliable with scaling events and terminations. It also duplicates content across the fleet, wastes storage, and doesn’t provide global low-latency delivery. This is not a standard, cost-efficient pattern for video libraries.

CloudFront in front of the ALB can accelerate dynamic content and cache some static responses, but keeping videos on EFS leaves the origin bottleneck in place. Video delivery often relies on range requests and can produce cache fragmentation or misses; when CloudFront must fetch from origin, EFS throughput/latency constraints still cause slow responses and timeouts. This is less effective and potentially more expensive than using S3 as the origin.

This improves performance by adding capacity (desired 28) and uses Reserved Instances for 20, but it is not the most cost-effective. The workload’s average CPU is only 10%, indicating 20 instances are significantly overprovisioned for baseline. Reserving 20 instances for 3 years locks in unnecessary spend. Also, setting desired capacity to 28 is not true elasticity; it keeps extra instances running even outside spike hours unless scaling policies reduce it.

Spot Fleet with DefaultTargetCapacityType set to On-Demand effectively provisions mostly On-Demand capacity, so it doesn’t materially reduce cost versus using Auto Scaling with On-Demand. Additionally, Spot Fleet is a legacy approach compared to EC2 Auto Scaling with mixed instances policies. It also doesn’t address right-sizing the baseline; it keeps TotalTargetCapacity at 20 continuously, which remains overprovisioned given 10% average CPU.

This relies primarily on Spot capacity (DefaultTargetCapacityType=Spot) with a maintain request, which can reduce cost but introduces interruption and capacity-availability risk during critical market-open spikes. The question emphasizes resolving latency during spikes for a compliance program; without explicit interruption tolerance and fallback to On-Demand, Spot is risky. Replacing NLB with ALB is unnecessary for a stateless API already behind NLB and adds change without clear benefit.

Incorrect. Moving all initialization into the handler usually increases per-invocation latency and defeats the benefit of doing heavy work once per execution environment. Also, SnapStart cannot be configured on $LATEST; it requires a published version. This option both misuses SnapStart and worsens performance characteristics.

Incorrect for the stated cost goal. Provisioned Concurrency on an alias will reduce cold starts and handle bursts, but it incurs ongoing charges for the provisioned capacity even when traffic is zero. The question explicitly asks to minimize startup latency without paying for always-on capacity, making this less cost-effective for spiky workloads.

Incorrect/less appropriate. While SnapStart must be enabled on published versions and can be combined with Provisioned Concurrency, adding Provisioned Concurrency reintroduces always-on cost. Also, it does not address the correctness risk of snapshotting unique IDs/cryptographic seeds; without moving that logic out of the snapshot, you can still get duplicated or unsafe state.

Increasing Lambda memory can reduce function runtime, but it does not directly solve the database connection limit or connection storm. Explicitly closing the DB connection after each query is usually counterproductive for Lambda-to-RDS because it increases connection churn (auth/TLS setup) and can raise DB CPU. This option might slightly reduce concurrent duration, but it won’t reliably prevent exhausting 500 connections during bursts.

ElastiCache for Redis is useful when repeated read queries dominate and results can be cached (e.g., course catalog browsing). However, the workload is described as transactional reads and writes for enrollment, and the symptoms include near-max DB connections and high CPU. Caching does not reduce the number of concurrent DB connections created by Lambda, and it does not help write-heavy or strongly consistent transactional paths.

Initializing the DB client outside the handler and reusing connections is a good Lambda optimization, but it only helps within a single warm execution environment. With concurrency spiking to 3,200, Lambda will create many parallel environments, each potentially holding one or more connections, still overwhelming a 500-connection RDS limit. This is a partial mitigation, not a robust solution for burst conditions compared to RDS Proxy.

ASG + ALB can add EC2 capacity, but it does not reduce operational toil for container orchestration (still managing hosts, deployments, bin packing) and leaves the self-managed Kafka cluster problem unsolved by switching to Kinesis (requires app changes and redesign). Read replicas help, and S3 offloads static assets, but overall it’s not the best “minimize toil” answer given Kafka and container management remain heavy.

Multi-AZ and storage autoscaling improve database availability and storage management, but they do not materially increase read throughput for a presale surge. Like option A, it proposes moving from Kafka to Kinesis, which is not a low-toil, low-change swap for an existing Kafka-based architecture. It also keeps compute on EC2 ASGs, which still requires significant operational work for containers and scaling behavior.

Creating your own Kubernetes cluster on EC2 increases operational overhead (control plane/worker management, upgrades, scaling, security hardening) compared to managed EKS/Fargate. MSK and CloudFront are strong choices, but the compute layer conflicts with the requirement to minimize toil quickly before next week’s event. This option modernizes streaming and CDN, but makes container operations more complex than the current setup.

Amazon FSx for Windows File Server provides a managed SMB file system that applications can access over SMB, and AWS DataSync can migrate data into it. However, the requirement is specifically to move the shared storage to Amazon S3 for durability and cost efficiency during the interim period. FSx for Windows stores data in the FSx file system rather than using S3 as the primary storage backend, so it does not satisfy the core storage-location requirement. It also introduces an AWS-hosted file system service when the design goal is to keep SMB access on premises while S3 serves as the durable backend.

Copying data directly from the on-premises SMB repository to an S3 bucket can satisfy the durability/cost goal, but it does not satisfy the access requirement. The application cannot use native S3 APIs for 4 months and must continue to access the dataset via SMB with minimal changes. S3 is an object store and does not provide an SMB endpoint for Windows clients without an intermediary service.

AWS Server Migration Service (historical) is for migrating server workloads, not for providing an SMB interface backed by S3. Even if a file server were lifted and shifted to EC2, that would still mean operating a file server in AWS, which the requirements prohibit. It also adds operational burden (patching, scaling, HA) and does not inherently achieve the goal of storing the dataset in S3 as the primary repository.

Incorrect. Sharing account access keys (especially root or broadly privileged keys) is one of the least secure approaches. It uses long-term credentials, is hard to audit and rotate safely, and violates AWS best practices. It also breaks least privilege because account-level keys typically imply broad access and create significant blast radius if compromised.

Incorrect. Creating an IAM user and sharing long-term access keys is explicitly discouraged for third-party access. Even if permissions are scoped, long-term credentials increase exposure (leakage, reuse, storage risk) and require ongoing rotation and secure distribution. This does not meet the requirement to use temporary credentials and is not the most secure pattern.

Partially correct but not the MOST secure. Using an IAM role and STS AssumeRole provides temporary credentials and supports least privilege, which is good. However, for independent third-party access, omitting an ExternalId leaves the customer more exposed to confused deputy scenarios. Adding ExternalId (and optionally other conditions) is the stronger, recommended control.

A trail in the management account that writes to an S3 bucket is not necessarily an organization trail. Without enabling an organization-level trail, CloudTrail will not automatically capture events from all member accounts. Even with multi-Region enabled and S3 encryption/MFA Delete, it fails the requirement to record every API call across all current and future accounts with minimal ongoing effort.

Creating a trail and bucket in each member account can capture API activity per account and can be configured for all Regions with encryption and MFA Delete. However, it has high operational overhead (30+ accounts, new accounts monthly, many Regions) and increases the chance of configuration drift. This contradicts the requirement to minimize ongoing operational effort.

Adding SNS notifications to an external management system introduces extra integration and operational burden and is not required to meet the core logging and retention requirements. Also, a trail in the management account alone does not guarantee coverage of all member accounts unless it is configured as an organization trail. This option is both incomplete and higher-ops than necessary.

ElastiCache for Redis can reduce database load, but it increases operational complexity (VPC design, node sizing, scaling, patching, monitoring) and requires Lambda code changes plus a cache invalidation/TTL strategy. For a pattern of identical GET requests within 30–90 seconds, API Gateway caching provides similar benefits with far less effort and fewer moving parts, making Redis unnecessary here.

Raising Aurora Serverless v2 maximum capacity can help handle spikes by allowing more compute and memory, but it increases cost during peak scaling and does not eliminate redundant reads. The traffic pattern indicates avoidable repeated queries; caching is a more cost-effective first step. Scaling the database is typically used after optimizing request patterns and adding caching layers.

API Gateway throttling (rate/burst limits) protects downstream systems from overload but does so by rejecting or delaying requests (429 responses), which harms the mobile app experience and does not meet the requirement to support additional usage. Throttling is appropriate as a safety mechanism, not as the primary strategy for handling legitimate increased demand and repeated read traffic.

Incorrect. It violates the security requirement because artifacts would be stored in S3, which is not the approved registry. Also, Lambda layers are ZIP archives, not created from a Docker image stored in S3. While attaching a layer to multiple ZIP-based functions is a common reuse pattern, it conflicts with the stated production constraint and misstates how layers are built and published.

Incorrect. Although ECR is the approved registry, Lambda layers are not created directly from an ECR container image. Layers are published as ZIP archives (uploaded to Lambda), and typical deployment workflows often involve S3 as a staging location. The option’s premise (layer-from-ECR-image) is not a supported Lambda feature, making it an invalid approach despite sounding governance-friendly.

Incorrect. ECS/Fargate runs long-lived containers, but Lambda cannot “reference a running container” as a Lambda layer. Layers are static dependency bundles mounted into the Lambda execution environment at init time. Using ECS would also add unnecessary operational overhead (service management, scaling, networking) and does not solve the packaging/reuse requirement for Lambda runtimes.

Creating a Client VPN endpoint in each AWS account could provide access, but it is not the best architecture here because it creates multiple endpoints, duplicated configuration, and higher operational overhead. It also does not inherently solve centralized access across all six VPCs from a single user connection unless users connect to different endpoints as needed. The question asks for a scalable solution that allows remote users to reach applications in all VPCs, and this option fragments access rather than centralizing it. It is also less elegant and potentially more expensive than a single endpoint with proper transit routing.

This option is incorrect because VPC peering does not support transitive routing. A Client VPN endpoint associated with the hub VPC can provide access to resources in that VPC, but traffic from VPN clients cannot simply traverse the hub and then continue over peering connections to the spoke VPCs as a transit path. Even with route tables and authorization rules configured, AWS does not allow using a peered VPC as a transit gateway for this purpose. Therefore, a single Client VPN endpoint in the hub account cannot reach all peered VPCs using peering alone.

This option is incorrect because AWS Client VPN is not designed to connect to an existing Site-to-Site VPN as a mechanism for reaching AWS workloads across multiple VPCs. The Site-to-Site VPN connects the corporate network to AWS, but remote users connecting through Client VPN would still face the same underlying routing limitations to the spoke VPCs. It also introduces unnecessary hairpinning and complexity without solving the lack of transitive connectivity between the hub VPC and the peered spokes. As a result, this design does not meet the requirement for scalable access to applications in all VPCs.

Incorrect. Relies on IP allow listing CloudFront service IP ranges, which the question explicitly forbids and is operationally brittle due to frequent changes. Also, “move the ALB into private subnets” conflicts with the described architecture (ALB in public subnets) and would require redesign (internal ALB) while still needing a supported path for CloudFront to reach the origin.

Incorrect. Systems Manager Parameter Store does not provide automatic rotation for arbitrary random strings in the same way Secrets Manager does for secrets rotation. Additionally, ALB listener rules are primarily for routing/forwarding decisions; they are not a robust security enforcement mechanism to block unauthorized requests based on a secret header compared to AWS WAF’s explicit allow/block controls.

Incorrect. Shield Advanced provides DDoS protections and visibility but does not solve origin authentication. The option still depends on allowing CloudFront IP ranges at the network layer (security group policy), which violates the “no static IP allow lists” requirement and is difficult to maintain. Origin access control here needs an application-layer verification mechanism (e.g., WAF header match).

Taking snapshots every 4 minutes and copying them to another Region is not a practical way to achieve a sub-4-minute RPO for a 9 TB relational database. Snapshot creation, cross-Region copy, and restore operations introduce substantial delay, and restoring a new Aurora cluster from backup would almost certainly exceed the 12-minute RTO. This option is a backup-and-restore strategy, not a warm standby disaster recovery design. It is suitable for longer recovery windows, not near-real-time cross-Region failover.

An RDS for PostgreSQL cross-Region read replica is a valid disaster recovery pattern, but it is not the strongest choice for a strict RPO under 4 minutes on a 9 TB database. Cross-Region replication for standard RDS PostgreSQL is asynchronous and can experience lag that is harder to bound tightly under heavy write workloads or large-scale operational conditions. The option may work in some environments, but the question asks for a solution that should be chosen to meet the stated objectives with confidence. Aurora-based cross-Region replication patterns are generally better aligned with stringent minute-level DR requirements.

A read replica in the same Region does not satisfy the explicit requirement to fail over to a secondary AWS Region. It can help with instance or Availability Zone failures, but it offers no protection against a full Regional outage. Because the compliance requirement specifically calls for secondary-Region failover, this option must be eliminated regardless of its cost or promotion speed. Therefore it cannot be the correct answer.