AWS SAP-C03 Practice Exam

• A. Provision a second connection at the same location on separate Direct Connect devices and add a second transit virtual interface to the gateway.
• B. Provision Site-to-Site VPN connections to the transit gateway, advertise the same prefixes over BGP, and prefer the Direct Connect routes.
• C. Provision a second connection at the same location and join both connections in a link aggregation group behind the transit virtual interface.
• D. Provision a second connection at a different Direct Connect location and add a transit virtual interface to the existing Direct Connect gateway. Correct answer

Option D is correct because a second connection at a different Direct Connect location removes the single-location failure point. A transit virtual interface on the existing Direct Connect gateway lets both locations reach the transit gateway, and BGP fails over automatically between them without using the internet. Option A is wrong because both connections are still at the same location, so losing that location cuts all hybrid traffic. Option B is wrong because Site-to-Site VPN over the internet breaks the requirement that hybrid traffic never cross the public internet. Option C is wrong because a link aggregation group needs all its connections at one Direct Connect location, so it adds capacity but no location resilience.

• A. Create a cross-Region Aurora MySQL replica in eu-west-1 that replicates from the writer by using binary logs.
• B. Add a secondary cluster in eu-west-1 by converting the cluster to an Aurora Global Database. Correct answer
• C. Add Aurora Replicas in us-east-1 and route EU reads to a custom reader endpoint of the cluster.
• D. Create an RDS Proxy in eu-west-1 that targets the us-east-1 writer endpoint and use it for EU connections.
• E. Enable write forwarding on the secondary cluster so the EU application writes through its local endpoint. Correct answer

Options B and E are correct. Converting the cluster to an Aurora Global Database and adding a secondary cluster in eu-west-1 gives AWS-managed storage-level replication with typically sub-second lag, so a Region failure loses only seconds of data, and local readers serve EU reads. Enabling write forwarding on the secondary cluster lets the EU application send its writes to the local endpoint, and Aurora forwards them to the primary cluster in us-east-1, where they are committed. Option A is wrong because binary log replication is not the managed storage-level replication of a global database, has higher and less predictable lag, and has no write forwarding. Option C is wrong because replicas in us-east-1 do not bring reads closer to eu-west-1 users and give no Region failure protection. Option D is wrong because RDS Proxy cannot target a writer endpoint in another Region, and it would not meet the data loss requirement.

• A. Create both endpoint types in the shared services VPC, share the forwarding rule through AWS RAM, associate that VPC with each private hosted zone, and forward the zones from the data center to the inbound endpoint Correct answer
• B. Run a pair of DNS forwarder instances in the shared services VPC, set the DHCP options of every workload VPC to use them, and have the data center forward the private zones to those instances
• C. Create an outbound endpoint in the shared services VPC, share its forwarding rules through AWS RAM, and have the data center forward the private zones to the outbound endpoint IP addresses
• D. Create inbound and outbound endpoints in each workload VPC with its own forwarding rule, and have the data center forward each private zone to the inbound endpoint in the matching account

Option A is correct because one set of resolver endpoints in the shared services VPC serves everyone. The outbound endpoint with a forwarding rule shared through AWS RAM lets every workload VPC resolve corp.example.gov. Associating the shared services VPC with each private hosted zone lets the inbound endpoint answer queries for those zones, so the data center forwards the zones to the inbound endpoint over the Direct Connect and transit gateway path. Option B is wrong because DNS forwarder instances are servers the team would have to operate, which the requirements rule out. Option C is wrong because an outbound endpoint only sends queries out of AWS; the data center cannot send queries to it, so on-premises servers could not resolve the private zones. Option D is wrong because endpoints in every workload VPC multiply the resolver infrastructure and the data center forwarding configuration, against the one-account requirement and the least-overhead goal.

• A. Assign Elastic IP addresses to each Network Load Balancer and publish Route 53 geolocation records that map player locations to Regions
• B. Create a CloudFront distribution that uses the Network Load Balancers as custom origins, with origin failover between Regions
• C. Create a standard accelerator with an endpoint group in each Region that contains the local Network Load Balancer Correct answer
• D. Create Route 53 latency records for the Network Load Balancers with health checks and a 10-second TTL, and give partner studios the record name to allow-list

Option C is correct because a standard AWS Global Accelerator accelerator gives two static anycast IP addresses that stay the same no matter which Regions hold capacity, which is what the partner allow lists need. It supports UDP, routes each player over the AWS network to the closest healthy endpoint group, and fails over based on health checks without waiting for DNS caches to expire. Option A is wrong because Elastic IP addresses are per Region, so the allow list would change as capacity moves, and geolocation DNS routing is not proximity-based and still depends on resolver caches. Option B is wrong because CloudFront serves HTTP and HTTPS and does not carry UDP game traffic. Option D is wrong because latency records return changing addresses, partners cannot allow-list a DNS name in a firewall, and failover still depends on resolvers honoring the TTL.

• A. Create accounts in the Control Tower Account Factory and apply both baselines with Customizations for Control Tower, using manifest files that target the PHI accounts
• B. Provision accounts with Account Factory for Terraform, applying the common baseline as global customizations and the PHI baseline as account customizations Correct answer
• C. Call organizations:CreateAccount from a Terraform pipeline in the management account and apply both baselines with account-specific Terraform modules
• D. Provision accounts with Account Factory for Terraform, applying the common baseline as global customizations and enforcing the PHI baseline with an SCP on the PHI OU

Option B is correct because Account Factory for Terraform (AFT) lets the team request accounts through pull requests in Terraform, enrolls each new account in Control Tower, applies global customizations to every account for the common logging and networking baseline, and applies account customizations only to the accounts that request them, such as the PHI accounts. Option A is wrong because Customizations for Control Tower is driven by CloudFormation templates and manifest files, not a Terraform-only, pull-request workflow. Option C is wrong because calling organizations:CreateAccount directly bypasses Control Tower enrollment and its baseline. Option D is wrong because an SCP can only restrict permissions; it cannot deploy an encryption and audit baseline into the PHI accounts.

• A. Attach an RCP at the organization root that denies s3:* when aws:PrincipalOrgID does not match the organization, unless the caller is an AWS service or the vendor's account Correct answer
• B. Attach an RCP at the organization root that denies s3:* when aws:PrincipalOrgID does not match the organization, with an exception for the vendor's account ID
• C. Attach an SCP at the organization root that denies s3:* when aws:PrincipalOrgID does not match the organization, unless the principal is an AWS service or belongs to the vendor's account
• D. Deploy a StackSet that adds a bucket policy denying principals outside the organization to every bucket, and revert policy changes with an AWS Config remediation

Option A is correct because a resource control policy (RCP) is the organization policy type that restricts access to resources, including requests from principals outside the organization, even when a developer writes a bucket policy that grants such access. The deny on aws:PrincipalOrgID must exempt AWS service principals (for example with aws:PrincipalIsAWSService), because CloudTrail and AWS Config deliver logs as service principals that carry no organization ID, and without that exemption the deny would break log delivery. That service-principal exemption is what separates Option A from Option B, which has the same RCP but would block CloudTrail and Config. The vendor's account ID is exempted in both options; it is needed only if the vendor's principal lives outside the organization, because a vendor role that lives inside the organization already matches aws:PrincipalOrgID and needs no exception. Option C is wrong because SCPs only limit principals in the organization's own accounts and cannot control access by external principals to member-account buckets. Option D is wrong because a StackSet and after-the-fact Config remediation is detective and reactive, leaves a window before reverting, and does not guarantee control over future buckets the way an organization-level policy does.

• A. Create an IAM role for each tenant with a prefix-scoped policy and have the application assume the role that matches the request
• B. Have the application call AssumeRole on one shared role for each request and pass an inline session policy that limits S3 access to the tenant's prefix Correct answer
• C. Create an S3 access point for each tenant that restricts access to its prefix and route each request through the matching access point
• D. Attach a permissions boundary to the task role and rewrite it with the current tenant's prefix before each request is processed

Option B is correct because one shared role combined with an inline session policy passed in AssumeRole gives each request temporary credentials scoped to the calling tenant's prefix. The effective permissions are the intersection of the role policy and the session policy, so no per-tenant IAM or bucket configuration is needed and onboarding a tenant needs no changes at all. Option A is wrong because it needs a role per tenant, which fails the onboarding requirement and runs into IAM role quotas at thousands of tenants. Option C is wrong because a per-tenant access point is a per-tenant configuration change and is limited in number per Region and account. Option D is wrong because permissions boundaries are an administrative control, and rewriting one on the task role before each request is slow, changes IAM at runtime, and is unsafe with concurrent requests for different tenants.

• A. Attach an SCP at the organization root that denies S3 object actions unless aws:ResourceOrgID matches the organization Correct answer
• B. Attach a policy to the S3 gateway endpoint in each VPC that allows only principals whose aws:PrincipalOrgID matches the organization
• C. Enable S3 Block Public Access in every member account and have the security team review any buckets that remain open
• D. Create an IAM Access Analyzer in each member account with that account as the zone of trust and review the findings centrally
• E. Create an external access analyzer with the organization as its zone of trust in the delegated administrator account Correct answer

Options A and E are correct. Option A is correct because an SCP that denies S3 object actions unless aws:ResourceOrgID matches the organization applies to every principal in the member accounts, wherever the request comes from, whether a VPC with no endpoints or a laptop using the AWS CLI, so writes to buckets owned by outside accounts are blocked. Option E is correct because an external access analyzer whose zone of trust is the organization, created in the delegated administrator account, continuously reports any supported resource shared with a principal outside the organization. Option B is wrong because an endpoint policy affects only traffic through that endpoint, so laptops and VPCs without endpoints are not covered, and it filters on the calling principal rather than on who owns the bucket. Option C is wrong because Block Public Access governs public access to a bucket and does not stop writes to external buckets, and manual review is not continuous detection. Option D is wrong because with a single account as the zone of trust, other accounts in the organization appear as external, which creates noise and does not give a single organization-wide view.

• A. Create an S3 interface endpoint in the egress VPC and resolve its DNS names from the spokes
• B. Create an S3 gateway endpoint in the egress VPC and route spoke traffic to it
• C. Create an S3 gateway endpoint in each spoke VPC and update the spoke route tables Correct answer
• D. Add a NAT gateway to each spoke VPC and send S3 traffic through it locally

Option C is correct because a gateway endpoint for Amazon S3 adds a prefix-list route in the route tables of the VPC that contains it, so each spoke sends S3 traffic straight to S3 over the AWS network. That bypasses both the Transit Gateway and the NAT gateway, so both data processing charges disappear, and gateway endpoints have no hourly or data charge. Other internet-bound traffic keeps its default route through the egress VPC. Option A is wrong because the spokes' S3 traffic would still cross the Transit Gateway, so its data processing charge remains, and interface endpoints add hourly and per-GB charges. Option B is wrong because a gateway endpoint can be used only from within its own VPC and cannot be reached through a Transit Gateway or peering, so spoke traffic cannot be routed to it. Option D is wrong because it removes the Transit Gateway charge but still pays NAT gateway processing and adds 30 NAT gateways' hourly cost.

• A. Create On-Demand Capacity Reservations for the nightly job's workers
• B. Purchase three-year Standard Reserved Instances for the nightly job's workers
• C. Run the nightly job on Spot Instances spread across several instance types Correct answer
• D. Purchase a Compute Savings Plan that covers the steady baseline usage Correct answer
• E. Purchase EC2 Instance Savings Plans for the current instance families

Options C and D are correct because the two workloads call for different discounts. A Compute Savings Plan applies to EC2 regardless of instance family, size, or Region, and also to Fargate, so it keeps discounting the always-on baseline after the move from x86 to Graviton and from EC2 to Fargate. The nightly job is stateless, checkpoints, and restarts on failure, which is the profile Spot Instances suit, and spreading across several instance types lowers the chance of interruption. Option A is wrong because Capacity Reservations guarantee capacity but give no discount and would be paid for while idle. Option B is wrong because a three-year Standard Reserved Instance commits to a specific configuration for a job that runs only about three hours a night. Option E is wrong because EC2 Instance Savings Plans are tied to an instance family and do not cover Fargate, so the planned move would strand the commitment.

• A. Buy a 3-year Compute Savings Plan sized to the lowest steady hourly spend Correct answer
• B. Buy 3-year EC2 Instance Savings Plans for the m5 family in eu-west-1
• C. Buy 3-year Convertible Reserved Instances and exchange them for m7g as instances move
• D. Buy 3-year Standard Reserved Instances for m5 instances in both Regions

Option A is correct because a Compute Savings Plan applies to EC2 regardless of family, size or Region, and also to Fargate, so the commitment stays used through the move to m7g, the shift to Fargate and the eu-central-1 relocation. Options B and D tie the discount to the m5 family or a Region and Option C needs exchanges that cannot cover Fargate, so each would strand part of the commitment.

• A. Use an On-Demand compute environment backed by Capacity Reservations for the full nightly vCPU count and attached to the jobs
• B. Use a Spot compute environment with SPOT_PRICE_CAPACITY_OPTIMIZED across many instance families and all Availability Zones Correct answer
• C. Use an On-Demand compute environment covered by a 3-year Compute Savings Plan sized for peak vCPU demand
• D. Use a Spot compute environment with the BEST_FIT strategy on one instance type in one Availability Zone

Option B is correct because checkpointed, restartable batch jobs with a 12-hour window tolerate Spot interruptions, and SPOT_PRICE_CAPACITY_OPTIMIZED across many instance families and zones gives the lowest price with the fewest interruptions. Options A and C pay On-Demand or committed rates for a nightly job, and Option D narrows Spot to one type and zone, which raises interruption risk.

• A. Add an Aurora global database secondary cluster in us-west-2 with a prebuilt ALB and a zero-capacity Auto Scaling group, and shift traffic by editing Route 53 weighted records
• B. Copy Aurora snapshots to us-west-2 every 15 minutes with AWS Backup, restore the cluster during an outage, and point a Route 53 failover record at the restored stack
• C. Create an Aurora global database secondary cluster in us-west-2 with a prebuilt ALB and a zero-capacity Auto Scaling group, and shift traffic with Route 53 ARC routing controls Correct answer
• D. Build an Aurora global database secondary cluster in us-west-2 with a prebuilt ALB and a fully scaled Auto Scaling group, and shift traffic with Route 53 ARC routing controls

Option C is correct because an Aurora global database secondary in us-west-2 replicates with typically about one second of lag, which meets the 1-minute RPO. A prebuilt ALB and a zero-capacity Auto Scaling group keep steady-state cost low. The key relies on the Aurora secondary being promoted and the Auto Scaling group being scaled up in us-west-2 as part of the failover runbook, which fits within the 30-minute RTO. Route 53 ARC routing controls are operated through a highly available cluster data plane with Regional endpoints, so operators can shift traffic by hand without depending on a control plane in us-east-1. Option A is wrong because Route 53 weighted-record edits go through the Route 53 control plane in us-east-1, which may be unavailable in the very event being handled. Option B is wrong because 15-minute snapshot copies give an RPO of up to 15 minutes, and restoring a cluster during the outage risks the 30-minute RTO. Option D is wrong because a fully scaled Auto Scaling group in the second Region meets the requirements but pays for idle capacity, so it is not the lowest steady-state cost.

• A. Run a full-size duplicate fleet beside a cross-Region read replica, with Route 53 failover records for both Regions
• B. Keep a cross-Region RDS read replica and a zero-capacity Auto Scaling group, then promote and scale out at failover Correct answer
• C. Schedule hourly AWS Backup copies of the database to eu-central-1 and deploy the stack from CloudFormation at failover
• D. Copy RDS automated snapshots to eu-central-1 each day and restore the database from the newest copy at failover

Option B is correct because a cross-Region read replica keeps the RPO near seconds, and a zero-capacity Auto Scaling group costs nothing until failover, when the replica is promoted and the group scaled out within the 60-minute RTO (a pilot light). Option A pays for a full duplicate fleet. Options C and D rely on hourly or daily copies, which cannot meet a 5-minute RPO.

• A. Create On-Demand Capacity Reservations in us-west-2 for the checkout tier's instance types and Zones Correct answer
• B. Configure the DR Auto Scaling group with a mixed instances policy that lists several instance types across all Availability Zones Correct answer
• C. Purchase a Compute Savings Plan that covers the expected DR fleet in us-west-2
• D. Buy Regional Reserved Instances for the checkout instance types in us-west-2
• E. Move the checkout tier in the DR Region to Spot Instances to reach spare capacity at a lower price

Options A and B are correct. On-Demand Capacity Reservations hold capacity for the instance types and Zones, and a mixed instances policy across several types and all Zones lets Auto Scaling find capacity wherever it exists. Compute Savings Plans and Regional Reserved Instances reduce price but do not reserve capacity, and Spot capacity is the first to be unavailable in a Regional event.

• A. Pre-create the VPC, subnets, security groups, and IAM roles in eu-central-1 with infrastructure as code Correct answer
• B. Select larger instance types for the servers that are recovered in eu-central-1 to speed up boot and data load
• C. Enable EBS fast snapshot restore for the copied snapshots in the recovery Availability Zones Correct answer
• D. Enable S3 Transfer Acceleration on the bucket that holds the backup manifests
• E. Increase the backup frequency to every 15 minutes and keep the copies in both Regions

Options A and C are correct. Pre-creating the network and IAM resources with infrastructure as code removes the manual build time, and fast snapshot restore removes the lazy-loading delay when EBS volumes are created from snapshots. Larger instance types do not speed up volume restore, S3 Transfer Acceleration does nothing for recovery in the same Region pair, and a higher backup frequency improves RPO rather than RTO.

• A. Use a self-managed StackSet in the shared-services account with execution roles created in all existing accounts, including the management account
• B. Use an auto-deploying service-managed StackSet in the management account for the root, which includes the management account itself
• C. Use a delegated administrator with an auto-deploying service-managed StackSet for the root, plus a separate stack in the management account Correct answer
• D. Use a delegated administrator with an auto-deploying service-managed StackSet for the root and add the management account ID as an extra target

Option C is correct because a delegated administrator in the shared-services account can manage service-managed StackSets, and auto-deployment to the organization root covers the 150 existing accounts and every account created later, in all three Regions. StackSets never deploys service-managed instances to the management account, so that account needs its own stack in each Region. Option A is wrong because self-managed StackSets do not auto-deploy to new accounts and need execution roles created everywhere. Option B is wrong because the root target still skips the management account, and it also leaves the management account running the StackSet instead of the shared-services team. Option D is wrong because the management account cannot be added as an extra target of a service-managed StackSet run by a delegated administrator.

• A. Build once, then copy the tested image by digest to a release repository that ECR replicates to each production account and Region Correct answer
• B. Grant the production accounts pull access through a repository policy and deploy the tested image from the tooling account by digest
• C. Rebuild the image in a CodeBuild project in each production account from the tested Git commit, using a pinned base image digest
• D. Export the tested image as an S3 pipeline artifact, replicate the bucket to each Region, and load the image into local repositories

Option A is correct because the image is built and tested once, and copying that exact image by digest to a release repository keeps the bytes identical. ECR cross-account and cross-Region replication then places a copy in each production account and Region, so scale-out pulls come from a local registry and do not depend on the tooling account. Option B is wrong because production would still pull from the tooling account's registry, which is the dependency the company wants to remove. Option C is wrong because a rebuild in each account does not guarantee a byte-identical image, even with a pinned base digest, since layer timestamps and package state can differ. Option D is wrong because it is a custom export and load process that adds operational work, and the images it loads are not tied to the tested digest by any registry control.

• A. Run the per-account remediations in a Distributed Map state with a MaxConcurrency limit and a ToleratedFailurePercentage threshold Correct answer
• B. Add Retry rules on the throttling error with a BackoffRate, a MaxAttempts cap and full jitter to each remediation Task state Correct answer
• C. Create a CloudWatch alarm on the remediation error rate that pages the on-call engineer to disable the EventBridge rule
• D. Request API rate limit increases in all member accounts and Regions before the workflow is enabled again
• E. Extend the EventBridge target retry policy to 24 hours so that throttled remediation calls eventually succeed

Options A and B are correct. A Distributed Map state with MaxConcurrency caps how many accounts are changed at once, and ToleratedFailurePercentage stops the run on its own when too many accounts fail. Retry rules with a BackoffRate, a MaxAttempts cap and full jitter spread out throttled retries so the S3 and IAM APIs are not hit by immediate repeated calls. Option C is wrong because it relies on a person to disable the rule after the damage is already done, so it does not stop on its own. Option D is wrong because higher limits allow more API pressure and do nothing to limit concurrent changes or stop a bad run. Option E is wrong because a longer EventBridge retry policy only retries starting the workflow and does not control the throttled calls inside it.

• A. Add a Mappings section keyed by an environment parameter to select the instance size Correct answer
• B. Add a Conditions section so the read replica resource is created only for the prod environment Correct answer
• C. Store the environment settings in the template Metadata section for CloudFormation to evaluate at deploy time
• D. Use Fn::ImportValue to read each environment's settings from a stack in a different Region
• E. Keep three copies and sync them with a script that rewrites the differing property values

Options A and B are correct because a Mappings section keyed by an environment parameter selects per-environment values such as instance size, and a Conditions section creates the read replica only for prod, so one template serves all three environments. Option C is wrong because Metadata is not evaluated at deploy time. Option D adds cross-Region dependencies, which exports do not support. Option E keeps the duplication.