AWS Solutions Architect Professional - SAP-C02

1. 1.A company has 60 VPCs across 12 accounts in three AWS Regions, plus two on-premises data centers connected by AWS Direct Connect. All VPCs must reach each other and both data centers, and the network team must manage routing centrally with route domains isolating production from development. What should the solutions architect recommend?

   • ATransit Gateway per Region with separate route tables, cross-Region peering, and a Direct Connect gatewayCorrect answer
   • BA full mesh of VPC peering connections between all 60 VPCs
   • CA Site-to-Site VPN from each VPC to each data center
   • DAWS PrivateLink endpoints between every pair of VPCs

   Why

   Deploy an AWS Transit Gateway per Region with separate route tables for production and development attachments, peer the transit gateways across Regions, and associate the Direct Connect gateway with them. Transit Gateway route tables provide the isolation domains the requirement names, and cross-Region peering plus a Direct Connect gateway extends the hub to every Region and both data centers. A full mesh of VPC peering needs roughly 1,770 connections and is not transitive, and a VPN per VPC does not centralize routing.

2. 2.A financial services company must expose an internal API from a provider VPC to 200 consumer VPCs owned by different business units and partner organizations. Consumers must reach only that one service, the VPCs must not be routable to each other, and overlapping CIDR blocks must be tolerated. What should be used?

   • AAn AWS PrivateLink service behind a Network Load Balancer with interface endpointsCorrect answer
   • BA Transit Gateway with all 201 VPCs attached
   • CVPC peering from the provider VPC to each consumer VPC
   • DA public API Gateway endpoint restricted by resource policy

   Why

   Publish the service behind a Network Load Balancer as an AWS PrivateLink service and have each consumer create an interface endpoint in its own VPC. PrivateLink exposes a single service rather than joining routing domains, so consumers cannot reach anything else and overlapping CIDRs are irrelevant because no routes are exchanged. Transit Gateway and VPC peering both join routing domains and fail on overlapping CIDRs.

3. 3.An enterprise runs a hybrid workload where EC2 instances must resolve on-premises Active Directory names, and on-premises servers must resolve Route 53 private hosted zone names. The company has 30 VPCs attached to a Transit Gateway. What is the most operationally efficient design?

   • ACentral resolver endpoints with forwarding rules shared through AWS RAMCorrect answer
   • BResolver inbound and outbound endpoints in each of the 30 VPCs
   • CCustom DNS servers on EC2 instances in each VPC
   • DA public hosted zone containing the Active Directory records

   Why

   Create Route 53 Resolver inbound and outbound endpoints in a central networking VPC with forwarding rules, then share the rules across accounts with AWS Resource Access Manager and associate them with the VPCs. This centralizes DNS in one place and reaches the other VPCs over the Transit Gateway. Deploying resolver endpoints in each of the 30 VPCs multiplies cost and management, and custom DNS servers on EC2 reintroduce infrastructure the managed resolver replaces.

4. 4.A company requires 99.99 percent availability for its AWS Direct Connect connectivity to a single Region and must survive the loss of any one device, location, or circuit. What configuration meets this?

   • ATwo connections at two separate Direct Connect locations on separate customer routersCorrect answer
   • BTwo connections at the same Direct Connect location on the same router
   • COne connection with a Site-to-Site VPN as backup
   • DOne connection upgraded to a higher port speed

   Why

   Provision two Direct Connect connections at two separate Direct Connect locations, each terminating on a different customer router, and configure BGP across all paths. Redundancy at a single location leaves the location itself as a single point of failure, and a single connection with a VPN backup provides resilience but not the 99.99 percent Direct Connect SLA posture. Increasing port speed adds capacity without adding a failure domain.

5. 5.After migrating a workload, packets from an on-premises subnet reach an EC2 instance but no replies arrive. Security groups and route tables appear correct on the AWS side. Which AWS tool most directly identifies where the path breaks?

   • AVPC Reachability AnalyzerCorrect answer
   • BVPC Flow Logs in the destination subnet
   • CAWS CloudTrail event history
   • DAn AWS Config rule on the security groups

   Why

   Run VPC Reachability Analyzer between the source and destination, which performs a configuration analysis of the entire path and reports the specific component that blocks it. VPC Flow Logs show whether packets were accepted or rejected without explaining which rule or route is responsible, CloudTrail records API calls, and a Config rule evaluates resource compliance rather than traffic paths.

Practice all 65 questions

Frequently asked questions