AWS Solutions Architect Professional Sample Questions With Full Explanations
This mock exam set is designed to mirror the complexity and scenario-based nature of the AWS Solutions Architect Professional (SAP-C02) exam. Each question requires you to analyze requirements, weigh trade-offs between cost, performance, and operational complexity, and select the best architectural pattern from realistic, plausible alternatives. Pay close attention to keywords like "cost-effective," "highly available," "minimize operational overhead," and "seamless" to guide your decision-making.
Question 1
A company is migrating a legacy monolithic application to AWS. The application currently stores user session data in local memory on the EC2 instance. To support horizontal scaling and high availability, the application must be refactored. The Solutions Architect proposes a stateless architecture. Which service should the Architect use to store session state to ensure the lowest latency and highest throughput? Our post on AWS Solutions Architect Associate in 8 Weeks: A Working Professional Plan covers this further.
A. Amazon ElastiCache for Memcached
B. Amazon DynamoDB with DAX
C. Amazon S3 with Transfer Acceleration
D. Amazon RDS for MySQL with Multi-AZ
Answer: A
Explanation: ElastiCache for Memcached is purpose-built for storing ephemeral session state in memory, offering sub-millisecond latency and high throughput. DynamoDB is durable but has higher latency than an in-memory cache; S3 and RDS are not suitable for high-frequency session lookups.
Question 2
A global media company uses Amazon CloudFront to distribute video content. They need to ensure that only premium subscribers can access specific high-definition (HD) content, while free users can access standard-definition (SD) content. The company uses AWS WAF for security. What is the most cost-effective and scalable way to enforce this access control?
A. Use Lambda@Edge to validate a signed cookie and check user tier against a DynamoDB table, returning different CloudFront distributions based on the tier.
B. Create two separate CloudFront distributions (one for HD, one for SD) and require users to log in to the correct URL.
C. Use CloudFront signed URLs for the HD content and public URLs for the SD content, with AWS WAF rules to block free users from the HD path.
D. Use Lambda@Edge to generate a signed URL on the fly and redirect users to a pre-signed S3 URL for the HD content only.
Answer: A
Explanation: Lambda@Edge allows you to run code at CloudFront edge locations to validate cookies and query DynamoDB for user tier, enabling dynamic routing to the correct content origin. This is scalable and cost-effective compared to managing multiple distributions or complex WAF rules, which cannot easily validate user-specific subscription tiers.
Question 3
A financial services firm runs a critical trading application on EC2 instances in a private subnet. They require a database with strong consistency, ACID compliance, and the ability to handle high-volume OLTP transactions. They also need to failover automatically to a secondary region in under 15 minutes in a disaster recovery scenario. Which database solution meets these requirements with the least operational overhead?
A. Amazon DynamoDB Global Tables
B. Amazon Aurora Global Database (MySQL-compatible)
C. Self-managed MySQL on EC2 with synchronous replication
D. Amazon RDS for PostgreSQL with Cross-Region Read Replicas
Answer: B
Explanation: Aurora Global Database is designed for cross-region disaster recovery with a typical failover time of under 1 minute, and it provides ACID compliance and strong consistency. DynamoDB is NoSQL and not ACID-compliant for OLTP; self-managed MySQL adds high operational overhead; RDS Cross-Region Replicas are asynchronous and do not guarantee sub-15-minute failover.
Question 4
A company is deploying a serverless application that processes JSON files uploaded to S3. The processing involves a compute-intensive transformation that takes approximately 5 minutes per file. The files are uploaded in bursts of 100 at a time. The company wants to minimize cost and avoid throttling. Which configuration should the Solutions Architect recommend?
A. Configure an S3 event notification to invoke an AWS Lambda function with a 5-minute timeout and a reserved concurrency of 100.
B. Configure an S3 event notification to publish to an SQS queue, and use a Lambda function with a 5-minute timeout polling the queue with a batch size of 1. Before moving on, consider reading AWS AI Practitioner Sample Questions With Full Explanations.
C. Configure an S3 event notification to invoke a Lambda function that sends each file to AWS Batch for processing on Spot Instances.
D. Configure an S3 event notification to publish to an SNS topic, which triggers a Lambda function that processes the file synchronously.
Answer: C
Explanation: Lambda has a maximum execution time of 15 minutes, but 100 concurrent invocations at 5 minutes each could hit concurrency limits and is inefficient. AWS Batch is purpose-built for heavy, long-running compute jobs and can leverage Spot Instances for cost savings, making it the best fit for this workload.
Question 5
A company has a VPC with a public subnet and a private subnet. An Application Load Balancer (ALB) in the public subnet routes traffic to EC2 instances in the private subnet. The EC2 instances need to access an S3 bucket to read configuration files. The company wants to ensure traffic to S3 does not traverse the internet and does not incur NAT gateway costs. What is the most efficient way to meet these requirements?
A. Create a VPC endpoint for S3 (Gateway type) and attach it to the route table for the private subnet.
B. Create a VPC endpoint for S3 (Interface type) and attach it to the private subnet.
C. Configure a NAT Gateway in the public subnet and update the private subnet route table.
D. Use an S3 access point and update the S3 bucket policy to allow access from the ALB.
Answer: A
Explanation: A Gateway VPC endpoint for S3 is free, highly available, and uses the AWS backbone network, not the internet. Interface endpoints are not free and are used for other services; a NAT Gateway incurs hourly and data processing costs.
Question 6
A development team uses AWS CloudFormation to manage infrastructure. They want to deploy a new version of an application to a test environment. The CloudFormation stack creation fails midway due to an invalid IAM role ARN. The team has fixed the ARN in the template. What is the most efficient way to complete the stack deployment without re-creating the resources that were successfully created?
A. Delete the stack and re-create it with the updated template.
B. Use the aws cloudformation update-stack command with the updated template.
C. Use the aws cloudformation continue-update-rollback command.
D. Use the aws cloudformation create-change-set command to review the changes.
Answer: B
Explanation: When a stack creation fails, CloudFormation rolls back the created resources, but you can re-run the update-stack command with the corrected template to attempt the creation again. This is more efficient than deleting and recreating. continue-update-rollback is for stacks in UPDATE_ROLLBACK_FAILED state, not for failed creates.
Question 7
A company runs a containerized microservices application on Amazon EKS. The application uses an Application Load Balancer (ALB) to expose services. The company needs to implement end-to-end encryption (TLS) for all traffic. They currently manage SSL certificates on the ALB using AWS Certificate Manager (ACM). What is the best practice for securing traffic between the ALB and the pods?
A. Terminate TLS at the ALB and use HTTP to the pods for performance.
B. Terminate TLS at the ALB and enable TLS between the ALB and the pods using a self-signed certificate on the pods.
C. Terminate TLS at the ALB and use a Network Load Balancer (NLB) in front of the pods for TLS passthrough.
D. Use an NLB directly with TLS passthrough to the pods, bypassing the ALB entirely.
Answer: B You might also find AWS Data Engineer Associate Sample Questions With Full Explanations helpful.
Explanation: Best practice for end-to-end encryption is to terminate TLS at the ALB and then re-encrypt traffic to the pods using a certificate (often self-signed) installed on the pod or sidecar. This ensures encryption in transit across the entire path. Option A is insecure; option C is over-engineered; option D loses ALB features like path-based routing.
Question 8
A solutions architect is designing a data lake on Amazon S3. The data is ingested from multiple sources in Parquet format. The data is partitioned by date and source. The company requires a new ETL pipeline that queries the data using Amazon Athena. The query performance is poor because Athena is scanning too much data. Which strategy will improve query performance and reduce costs?
A. Convert the partitions from date and source to a single partition key.
B. Use S3 Intelligent-Tiering to move data to colder storage.
C. Add a partition projection to the Athena table definition.
D. Enable S3 server-side encryption with AWS KMS (SSE-KMS).
Answer: C
Explanation: Partition projection automatically adds new partitions to the Athena table without requiring manual ALTER TABLE ADD PARTITION statements, and it can significantly speed up queries by reducing metadata overhead and data scanned. Converting partitions would worsen performance; storage tiering doesn't affect query scanning; encryption doesn't affect performance.
Question 9
An organization has a hybrid architecture with an on-premises data center connected to AWS via AWS Direct Connect. They are running a mission-critical application in a VPC that needs to failover to a different AWS region in the event of a disaster. The application uses a private IP address. What is the most reliable way to provide a seamless failover for this application?
A. Use Amazon Route 53 with a failover routing policy and health checks.
B. Use an AWS Transit Gateway to route traffic between the two regions.
C. Use a Global Accelerator endpoint group with a failover configuration.
D. Use an Elastic IP address reassigned to an instance in the secondary region.
Answer: C
Explanation: AWS Global Accelerator provides static anycast IP addresses that route traffic to the nearest healthy endpoint. It supports failover between regions automatically, and it is designed for TCP/UDP traffic with private IPs via endpoint groups. Route 53 is for DNS-based failover, which is slower due to DNS caching; Transit Gateway is for network connectivity, not failover; EIP reassignment is manual and slow.
Question 10
A company is using AWS Organizations to manage multiple accounts. The Security team requires that all new S3 buckets created in any account must have encryption enabled by default. The company wants to enforce this using a preventive control. What is the most effective way to implement this policy?
A. Use an SCP (Service Control Policy) that denies s3:CreateBucket without the x-amz-server-side-encryption header.
B. Use an IAM policy in each account to require encryption on S3 bucket creation.
C. Use an AWS Config rule to check for unencrypted buckets and trigger a Lambda function to remediate.
D. Use a CloudTrail event that triggers a Lambda function to enable encryption on new buckets.
Answer: A
Explanation: An SCP can explicitly deny the s3:CreateBucket action if the encryption header is missing. This is a preventive control that is enforced across all accounts in the organization, blocking non-compliant actions before they happen. Config rules are detective (post-event); IAM policies are not centralized; CloudTrail is for auditing.
This set covered key domains including high availability, cost optimization, migration, and security. Remember that the Professional exam focuses on trade-offs and "best" answers in complex, multi-service scenarios. For more practice with detailed explanations and a timed environment, consider taking a full-length mock test.
A free AWS Certified Solutions Architect - Professional readiness check offers a quick way to spot which topic areas need more work before that mock test.
Every retake costs money and time — avoid it by sitting AWS Certified Solutions Architect - Professional practice exam questions first.
A free AWS Certified Solutions Architect - Professional study plan gives you a schedule that fits your remaining preparation window and keeps your study sessions ordered.