15 Free AWS Certified Solutions Architect – Professional (SAP-C02) Practice Questions with Answers (2026)

Resource control policies set the maximum permissions on resources in member accounts, whoever the caller is. A deny on aws:PrincipalOrgID blocks external principals even when a bucket policy allows them, and an exception for AWS service principals keeps service integrations working.

• B is wrong because SCPs only limit principals inside your organization; they cannot restrict what an external account's principals do.
• C is wrong because Block Public Access stops public access, not access granted to a specific external account.
• D is wrong because Macie is detective, not preventive.

A tag policy standardises the key and its allowed values across every account, and enforcement blocks non-compliant tagging on supported resource types. Activating the tag as a cost allocation tag in the management account makes it available as a dimension in Cost Explorer and billing reports for the whole organization.

• A is wrong because Cost Explorer in the management account already shows organization-wide costs; enabling it per account does not fix the tags.
• B is wrong because budgets alert on spend; they do not break costs down by business unit or fix tagging.
• D is wrong because Trusted Advisor flags savings opportunities, not cost attribution.

Transit gateways give hub-and-spoke, transitive routing, so each new VPC needs one attachment. Inter-Region peering connects the two Regions, a Direct Connect gateway connects on-premises, and an inspection VPC with appliance mode keeps traffic symmetric through the firewalls.

• A is wrong because peering is not transitive and a full mesh of 60 VPCs needs about 1,770 connections, with no central inspection point.
• B is wrong because a VPN per VPC plus peering is the model that already does not scale.
• C is wrong because PrivateLink exposes individual services one way; it does not provide any-to-any network routing or on-premises routing.

An Aurora global database replicates to the secondary Region with typical lag of about a second, which meets an RPO of seconds, and promoting the secondary takes minutes. A scaled-down application tier keeps standby cost low while still scaling up within the 15-minute RTO.

• A is wrong because hourly snapshots mean up to an hour of lost data, and restoring a large database can exceed the RTO.
• B is wrong because it meets the targets but pays for full capacity in the secondary Region, which breaks the cost requirement.
• D is wrong because Multi-AZ protects against an Availability Zone failure, not the loss of a Region.

DynamoDB global tables are multi-active: every replica Region accepts reads and writes locally, replication between Regions is managed, and the default multi-Region eventual consistency uses last-writer-wins for conflicts. If one Region fails, the others keep serving writes.

• A is wrong because an Aurora global database has one writer Region, so writes from other Regions are not local.
• C is wrong because DAX is an in-Region read cache; writes still go to a single Region.
• D is wrong because a global datastore has a single primary cluster for writes, and a cache is not a durable system of record.

Kinesis Data Streams keeps records in order within a shard, and using the vehicle ID as the partition key keeps each vehicle's events together. Several consumers can read the same stream independently, enhanced fan-out gives each one dedicated throughput, and extended retention allows a seven-day replay.

• A is wrong because standard queues do not guarantee order, and a message is gone once one consumer deletes it.
• B is wrong because standard SNS and SQS do not guarantee order and cannot replay messages that were already processed.
• C is wrong because messages are deleted after processing, so there is no replay, and a single FIFO queue does not give three teams independent copies of the stream.

The jobs tolerate interruption, so Spot gives the biggest saving. AWS Batch manages the queue and compute, several instance types plus the price-capacity-optimized strategy reduce interruptions, and retries with S3 checkpoints let interrupted jobs resume.

• B is wrong because reserving capacity for 24 hours a day to cover a six-hour nightly window wastes most of the commitment.
• C is wrong because one instance type limits Spot capacity and raises the chance of interruptions and missed deadlines.
• D is wrong because a Lambda invocation can run for at most 15 minutes, and these jobs run for up to 90.

An in-memory cache serves repeated reads in under a millisecond and takes most of the read load off the database. Lazy loading fills the cache on demand, and a TTL keeps catalogue data fresh enough for a few changes a day.

• A is wrong because a larger instance helps CPU but cannot deliver sub-millisecond reads from disk-backed queries.
• B is wrong because the standby in a Multi-AZ DB instance deployment does not serve read traffic.
• D is wrong because RDS Proxy pools connections; it does not cut the number of repeated queries.

A Quick Setup patch policy deploys Patch Manager configuration across accounts and Regions in the organization, with baselines and schedules for each operating system, and gives a central view of patch compliance.

• A is wrong because cron jobs on 3,000 instances give no central control, windows or compliance reporting.
• C is wrong because a manual monthly process is slow and depends on every team redeploying.
• D is wrong because Inspector finds vulnerabilities but does not install patches.

IAM Access Analyzer reads resource policies across the organization and creates a finding for any resource that grants access to a principal outside the zone of trust. Findings are sent to EventBridge, so they can be routed to the security team automatically.

• A is wrong because Trusted Advisor does not analyse resource policies for external access across these resource types, and monthly is not continuous.
• B is wrong because CloudTrail shows calls that have already happened, not policies that allow access.
• C is wrong because that rule only covers public S3 access, not grants to specific external accounts or other resource types.

Compute Savings Plans apply to EC2 usage in any instance family, size and Region, and also to Fargate and Lambda. The discount follows the workloads as they modernise.

• B is wrong because EC2 Instance Savings Plans are tied to one instance family in one Region and do not cover Fargate or Lambda.
• C is wrong because Standard Reserved Instances are tied to instance attributes and do not cover Fargate or Lambda.
• D is wrong because Spot can be interrupted, which does not suit steady production workloads, and it is not a commitment discount.

Moving from Oracle to PostgreSQL needs schema conversion. DMS copies the existing data while the source stays online, then change data capture keeps the target in sync, so the cutover window only covers the final switch.

• A is wrong because Data Pump files cannot be imported into PostgreSQL, and a weekend outage breaks the one-hour limit.
• C is wrong because it rehosts Oracle on EC2 instead of moving to Aurora PostgreSQL.
• D is wrong because Aurora cannot use copied Oracle data files.

A queue decouples the upload from the thumbnail work, so the request returns as soon as the message is sent. Lambda scales with the queue and needs no servers, and a dead-letter queue keeps messages that keep failing.

• A is wrong because a bigger instance delays the problem; the request still waits for the thumbnails.
• B is wrong because shared storage does not separate the thumbnail work from the web request.
• D is wrong because a synchronous call still makes the user wait for the thumbnails to finish.

Application Migration Service continuously replicates whole servers at block level to AWS, lets you launch test instances without affecting the source, and then cuts over with only minutes of downtime for the final sync. It is built for rehosting at scale.

• A is wrong because VM Import/Export imports one-off images with no continuous replication, so each cutover needs a longer outage.
• B is wrong because DMS migrates databases, not whole servers.
• C is wrong because DataSync moves files and objects, not bootable servers.