SAP-C02 question patterns

Managed services: Fargate, Aurora, DynamoDB, Lambda, Control Tower, native integrations.

Anything involving servers to patch, custom scripts or manual steps adds overhead.

Delegated administrator with auto-enable, service-managed StackSets with auto-deploy, SCPs, Control Tower controls, organization trail.

Per-account setup misses new accounts.

Application Migration Service, RDS or Aurora, managed equivalent of the same engine.

Refactoring costs more than the requirement allows.

Commit the baseline with Compute Savings Plans or RIs, keep peaks On-Demand or Spot.

Commitment discounts apply to predictable usage only.

Aurora Global Database or DynamoDB global tables with Route 53 or Global Accelerator and a running second Region.

Backup-based and pilot-light designs recover too slowly.

TGW with VPC, VPN and Direct Connect attachments, shared through RAM.

Peering is not transitive and doesn't scale to a mesh.

Endpoint service behind an NLB, interface endpoints in consumer VPCs.

One-way connections, no routing between networks, overlapping ranges don't matter.

VPN to a TGW now, Direct Connect later; keep VPN as backup.

Direct Connect takes weeks to provision.

IPsec VPN over a public or transit VIF, or MACsec on dedicated ports.

Direct Connect is private but not encrypted by default.

Associate the gateway with VGWs or a TGW in each Region.

A DX gateway is global.

Inbound endpoint for on-premises queries, outbound endpoint with forwarding rules for AWS queries; share rules with RAM.

Resolver endpoints are the managed hybrid DNS path.

TGW routing to an inspection VPC with Network Firewall or Gateway Load Balancer appliances, appliance mode on.

Appliance mode keeps both directions on the same AZ.

S3 interface endpoint reachable over VPN or Direct Connect.

Gateway endpoints aren't reachable from on premises.

Run Reachability Analyzer between the resources; check Flow Logs for rejects.

It names the blocking route, security group or NACL.

Identity Center with the external IdP over SAML and SCIM, permission sets per account.

One place to manage access, temporary credentials.

Cross-account role with an external ID in the trust policy.

Prevents the confused deputy problem.

Service control policy on the OU, deny list style.

SCPs cap permissions; they never grant.

Resource control policy or bucket policy condition on the organization ID.

Controls the resource side across all accounts.

Control Tower with Account Factory and controls.

Opinionated multi-account baseline with logging and audit accounts.

GuardDuty, Security Hub and Inspector with delegated administrator, auto-enable and cross-Region aggregation.

Central view for new accounts too.

Organization CloudTrail to a log archive account bucket with Object Lock and log validation.

Member accounts can't remove it.

Firewall Manager policies at the organization level.

Automatically covers new resources and accounts.

Share the snapshot and grant the target account use of the customer managed key.

AWS managed keys can't be shared.

Unused access findings and policy generation from CloudTrail.

Based on observed activity.

Secrets Manager with rotation for the RDS secret.

Parameter Store has no built-in rotation.

DRS continuous replication to a staging area, launch on failover.

Pilot-light style cost with fast recovery.

Aurora Global Database with managed failover.

Sub-second replication lag and about a minute RTO.

Global tables in each Region.

Multi-writer replication.

Application Recovery Controller routing controls and safety rules.

Data plane is highly available.

Global Accelerator with endpoint groups.

Fails over in about 30 seconds without DNS TTL.

Organization backup policies, cross-account copy, Vault Lock in compliance mode.

Defends against deletion and ransomware.

Cross-Region replication with RTC.

Has a 15-minute SLA for most objects.

RDS Proxy between Lambda and the database.

Pools and reuses connections.

ElastiCache or DAX in front, or read replicas.

Offloads reads before scaling up the writer.

Anycast IPs onto the AWS backbone.

CloudFront is for cacheable HTTP content.

Cluster placement group, EFA, FSx for Lustre.

Same-AZ, high bandwidth interconnect.

S3 Intelligent-Tiering.

Moves objects automatically with no retrieval fee.

S3 and DynamoDB gateway endpoints.

Free and bypass NAT processing.

Spot with diversified instance types.

Up to 90% cheaper; tolerates interruption.

Tag policies, activated cost allocation tags, cost categories.

Tags apply only after activation.

SQS (FIFO if order matters) between producer and consumers.

Absorbs spikes and decouples scaling.

MGN continuous block replication, test then cutover.

Replaces older CloudEndure and SMS.

Convert schema, then DMS full load plus CDC.

Source stays online.

Order Snow devices, then DataSync for deltas.

Offline transfer beats weeks of network time.

DataSync agent with scheduled incremental tasks.

Handles integrity checks and throttling.

Managed SFTP endpoint backed by S3.

No servers to run.

Discovery Agent for process and network data, tracked in Migration Hub.

Agentless collector has no dependency detail.

Proxy in front, route features to new services gradually.

Incremental refactoring.

EKS with Fargate or managed node groups.

ECS is AWS-specific.