Free SAP-C02 Practice Test Questions and Answers (2026)

Enabling cross-account access to an Amazon S3 bucket requires a "two-sided" permission configuration.

1. Resource-Based Policy (in Account A): The owner of the resource (the S3 bucket in Account A) must create a resource-based policy (a bucket policy) that explicitly grants access to the principal in the other account. Option C correctly grants permission to the root of Account B, effectively trusting Account B to delegate those permissions to its own IAM principals.

2. Identity-Based Policy (in Account B): The administrator of the principal's account (Account B) must attach an identity-based policy (an IAM policy) to the user (UserDataProcessor). This policy must explicitly allow the user to perform the intended actions on the resource in Account A. Option D correctly provides this permission.

Both policies are required for the access to succeed.

A. Cross-origin resource sharing (CORS) is a browser security mechanism for web applications and is not relevant for programmatic access by an IAM user.

B. While granting access directly to a user ARN is possible, the delegation model in option C (granting to the account) is a more scalable and common pattern.

E. This IAM policy grants access to a bucket within Account B (bucket-in-account-b), not the required bucket in the external Account A.

1. AWS Identity and Access Management User Guide: In the section on how policies are evaluated

it states: "For a cross-account request

the principal who makes the request must have permissions from an identity-based policy in their account and from the resource-based policy in the resource's account."

Source: AWS IAM User Guide

"Determining whether a request is allowed or denied within an account"

Policy evaluation logic.

2. Amazon S3 User Guide: The documentation provides a specific walkthrough for this scenario

called "Tutorial: Delegate access across AWS accounts using IAM roles". A more direct example is under "Bucket owner granting cross-account bucket permissions". It shows that the bucket policy in the source account must grant permissions to the destination account's root user

and an IAM policy in the destination account must grant permissions to the specific user or role.

Source: Amazon S3 User Guide

Identity and access management for Amazon S3

"Bucket owner granting cross-account bucket permissions". The guide explicitly shows a bucket policy with "Principal": {"AWS": "arn:aws:iam::AccountB-ID:root"} and a corresponding user policy allowing action on arn:aws:s3:::bucket-in-account-a/.

3. AWS Security Blog: The post "How to Use Bucket Policies and Apply Defense-in-Depth to Help Secure Your Amazon S3 Data" explains the delegation model: "You can write a bucket policy that grants another account access to your S3 bucket... The administrator of the trusted account must then grant their IAM users access to your bucket."

Source: AWS Security Blog

"How to Use Bucket Policies and Apply Defense-in-Depth to Help Secure Your Amazon S3 Data"

section "Granting cross-account access to your S3 bucket".

An insufficient capacity error when adding instances to a cluster placement group indicates that AWS cannot find contiguous underlying hardware to co-locate the new instance with the existing ones. A recommended troubleshooting strategy is to stop all instances within the placement group and then start them again. This action may migrate the entire group to a different set of underlying hardware that has sufficient capacity to accommodate both the existing and the new instances. This approach attempts to resolve the capacity issue without requiring architectural changes.

A. A spread placement group has a hard limit of seven running instances per Availability Zone, so setting a minimum of eight is not possible. This also changes the architecture's intent.

C. AWS does not provide a feature to merge two placement groups. This is not a valid operation.

D. Launching on Dedicated Hosts is a significant architectural and cost change. It is not the most direct or common first step to troubleshoot a transient capacity error.

1. Amazon EC2 User Guide for Linux Instances: Under the section "Troubleshoot placement groups

" the guide explicitly states: "If you receive a capacity error when launching an instance in a placement group that already has running instances

stop and start all of the instances in the placement group

and then try the launch again. Starting the instances may migrate them to hardware that has capacity for all the requested instances." (See section: Placement groups > Troubleshoot placement groups).

2. Amazon EC2 User Guide for Linux Instances: The section on "Spread placement groups" details the limitations: "A spread placement group can span multiple Availability Zones within the same Region

and you can have a maximum of seven running instances per Availability Zone per group." This confirms that option A is invalid. (See section: Placement groups > Spread placement groups).

3. AWS API Reference - CreatePlacementGroup: The documentation for creating and managing placement groups does not include any action or parameter for merging existing groups

confirming that option C is not a valid AWS feature. (See the CreatePlacementGroup and related EC2 API actions in the AWS Command Line Interface Reference or SDK documentation).

This solution is the most cost-effective and meets all technical requirements. AWS DataSync is the purpose-built service for transferring large amounts of data from on-premises storage, like NFS, to AWS. Deploying the DataSync agent as a VM in the existing on-premises Hyper-V environment is the correct architecture, as it allows direct access to the NFS server. DataSync natively supports bandwidth throttling and task scheduling, fulfilling the requirement to copy data during non-business hours. Amazon S3 Glacier Deep Archive is the lowest-cost storage option, and its standard retrieval time of 12 hours is well within the required one-week timeframe, making it the most cost-effective choice for long-term archival.

A. Deploying the DataSync agent on an EC2 instance is inefficient and costly. S3 Glacier Instant Retrieval is more expensive than necessary for a one-week retrieval requirement.

C. Deploying the agent on EC2 is inefficient. Writing to S3 Standard first and then transitioning incurs unnecessary S3 Standard storage costs and lifecycle transition fees.

D. AWS Storage Gateway's Tape Gateway is designed to replace physical tape libraries for backup applications, not for a direct file-based copy from an NFS share. This adds unnecessary complexity.

1. AWS DataSync User Guide

"Requirements for AWS DataSync agents": This document confirms that the DataSync agent can be deployed on a Microsoft Hyper-V hypervisor on-premises. It states

"You can deploy your agent on a VMware ESXi

Linux Kernel-based Virtual Machine (KVM)

or Microsoft Hyper-V hypervisor."

2. AWS DataSync User Guide

"Working with tasks": This section details the features for managing data transfer. It explicitly mentions

"You can control the amount of network bandwidth that a task uses..." and "You can also schedule your task to run periodically

" which directly addresses the bandwidth and scheduling requirements.

3. AWS DataSync User Guide

"Creating a location for Amazon S3": This guide specifies that when creating an S3 location as a destination

you can choose the S3 storage class directly. The supported classes include GLACIERDEEPARCHIVE

confirming that data can be written directly to this tier without intermediate steps.

4. Amazon S3 User Guide

"Amazon S3 storage classes": This official documentation compares the S3 storage classes. It describes S3 Glacier Deep Archive as "Amazon S3’s lowest-cost storage class" and notes its standard retrieval time is "within 12 hours

" which satisfies the "within 1 week" requirement at the lowest cost.

5. AWS Storage Gateway User Guide

"What is Tape Gateway?": This document clarifies the use case for Tape Gateway: "A tape gateway provides a virtual tape library (VTL)... You can back up your data to virtual tapes in the VTL by using your existing tape-based backup application." This shows it is not the appropriate tool for a file-based transfer from an NFS server.

Amazon Data Lifecycle Manager (DLM) is a managed service designed to automate the creation, retention, and deletion of Amazon EBS snapshots. A key feature of DLM is the ability to define policies that automatically copy snapshots to other AWS Regions for disaster recovery purposes. This approach directly meets the requirements of copying snapshots to two additional Regions while imposing the lowest possible operational overhead, as it is a fully managed, "set-and-forget" solution that does not require writing or maintaining custom code.

B. This is a viable but less optimal solution. It requires writing, deploying, and maintaining a custom AWS Lambda function, which results in higher operational overhead compared to using a managed service like DLM.

C. This option is technically incorrect. While AWS Backup can create and copy EBS snapshots, you cannot use Amazon S3 cross-Region replication (CRR) directly on EBS snapshots, as they are not stored in user-managed S3 buckets.

D. Amazon EC2 Image Builder is a service for creating and managing golden Amazon Machine Images (AMIs), not for backing up individual EBS volumes. Using it for this purpose is inefficient and misaligned with the stated requirement.

---

1. Amazon Data Lifecycle Manager User Guide: "With Amazon Data Lifecycle Manager

you can automate the creation

retention

and deletion of snapshots taken of your Amazon EBS volumes... You can also set up policies to create EBS-backed AMIs and to copy snapshots to other Regions for disaster recovery." (Source: AWS Documentation

Amazon Data Lifecycle Manager User Guide

"What is Amazon Data Lifecycle Manager?")

2. Amazon Data Lifecycle Manager User Guide

Cross-Region copy: "For disaster recovery purposes

you can create snapshot lifecycle policies that automatically copy snapshots to up to three AWS Regions." This section details the configuration steps

confirming it as a built-in

low-overhead feature. (Source: AWS Documentation

Amazon Data Lifecycle Manager User Guide

"Cross-Region copy")

3. Amazon EBS User Guide

Copy an Amazon EBS snapshot: "When you copy a snapshot

you create a new

identical snapshot in the destination of your choice... You can copy snapshots within the same AWS Region or from one Region to another." This describes the underlying API action (CopySnapshot) that services like DLM and AWS Backup use

and it makes no mention of S3 CRR. (Source: AWS Documentation

Amazon EBS User Guide

"Copy an Amazon EBS snapshot")

4. AWS Backup Developer Guide

Copying a backup: "You can copy backups to other AWS Regions... A copy can be created on-demand or automatically as part of a scheduled backup plan." This confirms AWS Backup's capability but does not validate the incorrect mechanism (S3 CRR) proposed in option C. (Source: AWS Documentation

AWS Backup Developer Guide

"Copying a backup")

The core issue is latency and scalability for serving large video files, leading to buffering and timeouts. The most effective solution is to use a Content Delivery Network (CDN) with an optimized origin store. Amazon S3 is designed for durable, scalable, and cost-effective storage of large static objects like videos. Amazon CloudFront, a CDN, caches this content at edge locations globally, significantly reducing latency for users and offloading requests from the origin infrastructure. Migrating videos from EFS to S3 and serving them via CloudFront directly addresses the video buffering problem in the most scalable and cost-efficient manner.

A. Reconfiguring EFS to Max I/O mode might increase throughput but does not solve the fundamental problem of network latency for geographically dispersed users. It is not a cost-effective solution for content delivery.

B. Using instance stores is not appropriate for persistent data like blog content. This approach is operationally complex, introduces a high risk of data loss, and does not solve the content delivery issue.

D. While placing CloudFront in front of the ALB is a valid pattern for caching, it keeps the videos on EFS. S3 is a more performant, scalable, and cost-effective origin for large static media files than EFS.

1. Amazon S3 Documentation: "Amazon S3 is an object storage service that offers industry-leading scalability

data availability

security

and performance... S3 is ideal for a variety of use cases

including... backup and restore

disaster recovery

archive

data lakes

big data analytics

hybrid cloud storage

and cloud-native application data."

Source: AWS Documentation

"What is Amazon S3?"

https://docs.aws.amazon.com/AmazonS3/latest/userguide/Welcome.html

2. Amazon CloudFront Documentation: "Amazon CloudFront is a content delivery network (CDN) service... When a user requests content that you're serving with CloudFront

the user is routed to the edge location that provides the lowest latency (time delay)

so that content is delivered with the best possible performance."

Source: AWS Documentation

"What is Amazon CloudFront?"

https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/Introduction.html

3. AWS Well-Architected Framework

Performance Efficiency Pillar: "Use a content delivery network (CDN) to reduce latency by serving requests from a location closer to your end users... For static content

you can use Amazon S3 as the origin for Amazon CloudFront."

Source: AWS Well-Architected Framework

Performance Efficiency Pillar Whitepaper

"PERF 7: How do you select the best performing architecture?"

https://docs.aws.amazon.com/wellarchitected/latest/performance-efficiency-pillar/select-the-best-performing-architecture.html (Section: Caching)

4. Amazon EFS Documentation: "Amazon EFS is designed to provide massively parallel shared access to thousands of Amazon EC2 instances... Use cases such as lift-and-shift enterprise applications

big data analytics

web serving and content management...". While EFS can be used for web serving

it is not optimized for global

low-latency delivery of large media files compared to the S3 + CloudFront pattern.

Source: AWS Documentation

"What is Amazon Elastic File System?"

https://docs.aws.amazon.com/efs/latest/ug/what-is-efs.html

The solution must address two distinct requirements: remediating existing unencrypted Amazon Elastic Block Store (Amazon EBS) volumes and implementing a forward-looking governance strategy for a multi-account environment.

Option C correctly outlines the standard, supported procedure for encrypting an existing unencrypted EBS volume. This involves creating a snapshot, using that snapshot to create a new, encrypted volume, and then replacing the original volume on the instance.

Option A establishes the required central governance and compliance framework. AWS Control Tower is designed to set up and govern a secure, multi-account AWS environment. Activating the "strongly recommended" guardrails includes a detective control (Detect whether encryption is enabled for EBS volumes attached to EC2 instances) that automatically detects unencrypted volumes, fulfilling the future detection and central management requirements.

B: It is not possible to encrypt an existing EBS volume "in place." The process requires creating a new, encrypted volume from a snapshot of the original.

D: The specific guardrail for detecting unencrypted EBS volumes is part of the "strongly recommended" guardrail set, not the "mandatory" set. This option would fail to meet the detection requirement.

E: While technically feasible for a single account, this approach does not provide the centralized governance and compliance management across multiple accounts that AWS Control Tower offers, which is a core requirement.

1. Encrypting an unencrypted volume: AWS Documentation

Amazon EC2 User Guide for Linux Instances

section "Encrypting an unencrypted volume". It states

"To encrypt an unencrypted volume

you must create a snapshot of the volume. Then

you can either restore the snapshot to a new

encrypted volume... or you can create an encrypted copy of the snapshot and restore it to a new

encrypted volume." This supports option C.

2. AWS Control Tower Guardrails: AWS Documentation

AWS Control Tower User Guide

section "Guardrail reference". The guide lists the guardrail Detect whether encryption is enabled for EBS volumes attached to EC2 instances (Identifier: AWS-GREBSVOLUMEENCRYPTIONMANDATORY) under the "Strongly recommended" behavior category. This supports option A and invalidates option D.

3. AWS Control Tower Overview: AWS Documentation

AWS Control Tower User Guide

section "What is AWS Control Tower?". It describes Control Tower as "the easiest way to set up and govern a secure

multi-account AWS environment

" which aligns with the requirement for a central management solution.

The optimal solution must address two key aspects: data locality and traffic routing. Given that over 90% of the database traffic is read-only, creating a cross-Region read replica for the Amazon RDS database is the most efficient and native AWS solution. This places a readable copy of the data in the new Europe Region, significantly reducing data access latency for European users. To complement this, Amazon Route 53 latency-based routing should be used. This policy directs users to the AWS Region that provides the lowest network latency for them, ensuring that both US and European users are automatically routed to their nearest and fastest application endpoint (API Gateway), thereby minimizing report download times.

A. An AWS DMS full load task is a one-time data migration. It does not provide continuous replication, so the database in the new Region would quickly become outdated.

B. While AWS DMS with Change Data Capture (CDC) provides replication, a native RDS cross-Region read replica is a simpler, more managed, and purpose-built solution for this use case.

D. Geolocation routing directs users based on their geographic origin, which is a reasonable proxy for latency. However, latency-based routing is more precise as it routes based on actual measured network performance to the AWS Regions.

1. Amazon RDS User Guide: "A cross-Region read replica is used to reduce latency for read queries. If you have a read-heavy workload and your users are globally distributed

you can create one or more read replicas in various AWS Regions to serve read traffic closer to your users."

Source: AWS Documentation

Amazon RDS User Guide

"Working with Amazon RDS read replicas

" Section: "Cross-Region read replicas."

2. Amazon Route 53 Developer Guide: "Latency-based routing lets you route your traffic to the AWS Region that provides the best latency (lowest network latency) and the best experience for your users. When Route 53 receives a query for your domain or subdomain

it determines which AWS Regions you've created latency records for

determines which region gives the user the lowest latency

and then selects a latency record for that region."

Source: AWS Documentation

Amazon Route 53 Developer Guide

"Choosing a routing policy

" Section: "Latency-based routing."

3. AWS Well-Architected Framework - Performance Efficiency Pillar: "To reduce latency

you can locate your resources closer to your users. You can do this by selecting the AWS Regions and edge locations that are closest to your users." This principle supports the use of both cross-Region resources (like the read replica) and latency-aware routing.

Source: AWS Well-Architected Framework

Performance Efficiency Pillar (aws-well-architected-framework.pdf)

Page 29

"Select the best performing architecture."

This solution correctly implements the standard AWS pattern for performing actions on an instance before it is terminated by an Auto Scaling group. An Auto Scaling lifecycle hook for the autoscaling:EC2INSTANCETERMINATING event pauses the termination process, placing the instance in a Terminating:Wait state. An Amazon EventBridge rule detects this state change and triggers an AWS Lambda function. The Lambda function uses the AWS Systems Manager (SSM) SendCommand API to reliably execute a predefined script (an SSM document) on the instance to copy the logs. Once the command is sent, the Lambda function signals the lifecycle hook to CONTINUE, allowing the Auto Scaling group to proceed with the termination.

A. This option incorrectly uses the ABANDON signal, which would cancel the termination action, preventing the instance from being scaled in as intended by the Auto Scaling group.

C. Reducing the log delivery frequency only lessens the chance of data loss but does not guarantee it. Furthermore, user data scripts run only at instance launch and cannot be re-invoked to handle termination events.

D. This option incorrectly uses the ABANDON signal. This would cancel the scale-in event, leaving the instance running and disrupting the Auto Scaling group's desired capacity.

1. AWS Auto Scaling Documentation - Amazon EC2 Auto Scaling lifecycle hooks: This document explains how lifecycle hooks work

including the EC2INSTANCETERMINATING state. It explicitly mentions the pattern of using EventBridge

Lambda

and SSM Run Command to perform actions before termination. See the section "Tutorial: Configure a lifecycle hook that invokes a Lambda function".

Source: AWS Documentation

Amazon EC2 Auto Scaling User Guide

"Amazon EC2 Auto Scaling lifecycle hooks".

2. AWS Auto Scaling Documentation - CompleteLifecycleAction: This API reference details the CONTINUE and ABANDON results. It clarifies that CONTINUE signals that the lifecycle action is complete and the Auto Scaling group can proceed

while ABANDON cancels the action.

Source: AWS Documentation

Amazon EC2 Auto Scaling API Reference

"CompleteLifecycleAction".

3. AWS Systems Manager Documentation - AWS Systems Manager Run Command: This document describes how Run Command allows you to remotely and securely manage the configuration of your managed instances. It is the recommended method for running scripts on instances in response to events.

Source: AWS Documentation

AWS Systems Manager User Guide

"AWS Systems Manager Run Command".

4. AWS Compute Blog - Using lifecycle hooks to drain tasks from a container instance: While this example is for ECS

it demonstrates the same architectural pattern: Lifecycle Hook -> EventBridge -> Lambda. The blog states

"The Lambda function is responsible for performing the custom action and then sending the CONTINUE signal back to the Auto Scaling group." This confirms the correct use of the CONTINUE signal.

Source: AWS Compute Blog

"Using lifecycle hooks to drain tasks from a container instance

" Paragraph 5 under "The solution".

This solution represents a warm standby approach, which is optimal for minimizing recovery time (RTO) as required. By pre-provisioning the Amazon ECS cluster and service in the disaster recovery (DR) Region, the application compute layer is ready to accept traffic. Using a cross-Region read replica for the Amazon RDS database ensures that data is continuously and asynchronously replicated. During a failover, the process is swift: the Lambda function promotes the read replica to a standalone, writable primary instance and updates the Amazon Route 53 DNS record. This promotion process is significantly faster than creating a new database instance from a snapshot, directly meeting the requirement to minimize recovery time.

A. Restoring an RDS instance from a snapshot is a time-consuming process that results in a higher Recovery Time Objective (RTO) compared to promoting a read replica.

B. This option is even slower than A because it creates the ECS infrastructure during the failover event, in addition to the slow RDS snapshot restore process.

D. Converting a relational RDS snapshot to a DynamoDB global table during a disaster is technically complex, slow, and would likely require significant application code changes.

1. AWS Documentation

Amazon RDS User Guide: "You can use read replicas for disaster recovery... To use a read replica for disaster recovery

you promote the read replica. When you promote a read replica

it becomes a standalone DB instance." This guide details the process for "Promoting a read replica to be a standalone DB instance."

2. AWS Whitepaper

Disaster Recovery (DR) Architecture on AWS

Part III: Pilot Light and Warm Standby: This paper describes the Warm Standby approach. "In the case of disaster

the warm standby site can be scaled up to handle the full production load... For databases

you can use native features such as SQL Server Always On

Oracle Data Guard

or MySQL/PostgreSQL replication to a warm standby." (Page 5). This aligns with using an RDS read replica.

3. AWS Well-Architected Framework

Reliability Pillar: "Use a warm standby in a different AWS Region. This approach decreases the recovery time because your data is live in the other Region and the core infrastructure is running." This directly supports the chosen architecture of having running infrastructure (ECS) and a replicated database (RDS Read Replica). (Section: "Plan for disaster recovery (DR)").

This solution correctly addresses all three requirements outlined in the scenario. First, using AWS Lambda provisioned concurrency directly mitigates the cold start issue by keeping functions initialized and ready to respond instantly, ensuring low latency during traffic peaks. Second, for the database with consistent usage over 12 months, purchasing RDS Reserved Instances is the most cost-effective strategy, offering significant savings over On-Demand pricing. Third, integrating AWS WAF with Amazon CloudFront is the standard and most effective method to protect against common web exploits like SQL injection by filtering malicious traffic at the edge before it reaches the application.

A. Increasing a Lambda timeout does not solve cold starts. AWS Shield Advanced is primarily for DDoS protection, not for blocking application-layer attacks like SQL injection.

B. Amazon Redshift is a data warehouse, not a transactional (OLTP) database suitable for an ecommerce application. Amazon Inspector is a vulnerability scanner, not a web application firewall.

C. While provisioned concurrency is correct, AWS Shield Advanced is the wrong service for SQL injection protection. Also, for a consistent workload, RDS Reserved Instances are more cost-effective than Aurora Serverless.

---

References:

1. AWS Lambda Provisioned Concurrency:

AWS Lambda Documentation, "Configuring provisioned concurrency": "Provisioned concurrency initializes a requested number of execution environments so that they are prepared to respond immediately to your function's invocations... a great way to ensure that your serverless application is highly responsive and can scale to meet expected demand without any cold starts."

Source: AWS Lambda Developer Guide, Section: "Managing concurrency for a Lambda function".

2. RDS Reserved Instances:

Amazon RDS Documentation, "Reserved DB instances for Amazon RDS": "Reserved DB instances give you the option to reserve a DB instance for a one- or three-year term and in turn receive a significant discount compared to the On-Demand DB instance pricing... We recommend Reserved DB instances for applications with steady-state usage."

Source: Amazon RDS User Guide, Section: "Billing for DB instances".

3. AWS WAF for SQL Injection:

AWS WAF Documentation, "How AWS WAF works": "AWS WAF is a web application firewall that lets you monitor the HTTP and HTTPS requests that are forwarded to your protected web application resources... You can configure conditions to look for, such as... the values in request headers, or strings that appear in requests that are likely to be malicious (such as SQL injection)."

Source: AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide, Section: "How AWS WAF works".

4. AWS Shield Advanced vs. AWS WAF:

AWS Shield Documentation, "AWS Shield Advanced": "For higher levels of protection against attacks, you can subscribe to AWS Shield Advanced... Shield Advanced provides expanded DDoS attack protection for your AWS resources." This confirms its primary purpose is DDoS mitigation, whereas WAF handles application-layer threats.

Source: AWS WAF, AWS Firewall Manager, and AWS Shield Advanced Developer Guide, Section: "AWS Shield Advanced".

The requirement calls for encryption with keys the company controls. This is provided by server-side encryption that uses a customer-managed AWS KMS key (SSE-KMS with a CMK).

Step 1 – Set the bucket’s default encryption to SSE-KMS and select the company’s customer-managed CMK.

Step 2 – Add a bucket policy that denies PutObject requests lacking “x-amz-server-side-encryption":"aws:kms”.

Step 3 – Because versioning is disabled, copy (re-upload) every existing object so that S3 writes a new object encrypted with the CMK; the original unencrypted copies are overwritten.

This ensures all present and future objects are encrypted with company-managed keys.

A. SSE-S3 always uses Amazon-managed keys; customers cannot supply their own, so it fails the “company-managed key” requirement.

C. A bucket policy cannot “automatically encrypt” objects on GetObject; it can only enforce PutObject conditions. Existing objects remain with SSE-S3.

D. “AES-256 with a customer managed key” does not exist; AES-256 designates SSE-S3, which again uses Amazon-managed keys.

1. Amazon S3 User Guide – “Using server-side encryption with AWS Key Management Service (SSE-KMS)” (Section: Specifying a customer managed key) – https://docs.aws.amazon.com/AmazonS3/latest/dev/UsingKMSEncryption.html

2. Amazon S3 User Guide – “Copying objects” (Section: Changing encryption of existing objects) – https://docs.aws.amazon.com/AmazonS3/latest/userguide/CopyingObjectUsingCLI.html

3. AWS KMS Developer Guide – “Customer managed keys” (Para 1) – https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html#customer-cmk

4. Amazon S3 Bucket Policy Examples – “Deny unencrypted object uploads” – https://docs.aws.amazon.com/AmazonS3/latest/userguide/bucket-encryption.html#bucket-encryption-enforcing

The core requirement is to encrypt data in one AWS Region and decrypt it in another using the same logical key. AWS KMS multi-Region keys are designed for this exact purpose. A multi-Region primary key is created in one Region, and replica keys are created in other Regions. These keys are interoperable because they share the same underlying key material and key ID. An application in any of these Regions can use its local replica key (via the regional KMS endpoint) to encrypt or decrypt data, ensuring low latency and high availability while maintaining a consistent encryption standard across Regions for the replicated S3 data.

B: Creating new, independent customer-managed KMS keys in each Region would result in keys with different key material, making it impossible to decrypt data in one Region that was encrypted in another.

C: AWS Private CA is used for creating and managing private X.509 certificates, primarily for securing network communications (TLS) or authenticating entities, not for encrypting application data at rest.

D: Exporting the key material from an AWS-generated KMS key is not a supported feature. This is a fundamental security design of AWS KMS to ensure the key material never leaves the FIPS-validated hardware security modules (HSMs).

1. AWS KMS Developer Guide

"Multi-Region keys in AWS KMS": "Multi-Region keys are AWS KMS keys in different AWS Regions that can be used interchangeably to encrypt and decrypt data in any of these Regions... Each set of related multi-Region keys has the same key ID and key material." This directly supports the functionality described in option A.

2. AWS KMS Developer Guide

"How multi-Region keys work": "Because related multi-Region keys have the same key material

data encrypted with a multi-Region key in one AWS Region can be decrypted with a related multi-Region key in a different AWS Region." This confirms the interoperability required by the question.

3. AWS KMS Developer Guide

"Importing key material in AWS KMS": This section details the process for using your own key material (BYOK). It implicitly confirms that you cannot export AWS-generated key material. The documentation states

"When you use a KMS key with imported key material

you remain responsible for the key material

" which is not the case for standard KMS keys where AWS manages the material securely.

4. AWS Private Certificate Authority User Guide

"What is AWS Private Certificate Authority?": "AWS Private Certificate Authority (AWS Private CA) is a managed private CA service that helps you easily and securely manage the lifecycle of your private certificates." This defines the service's purpose

which is distinct from encrypting data at rest.

The core requirements are low-latency reads and writes for users in both the US and Europe, with real-time data consistency across regions. Amazon Aurora Global Database is the only solution presented that meets these needs. It provides a primary write region and low-latency read replicas in secondary regions. The key feature is write forwarding, which allows applications in secondary regions (Europe) to issue write statements. These writes are transparently forwarded to the primary cluster (US) for execution and then replicated globally, typically in under a second. Option A correctly identifies this architecture and also details a valid, standard procedure for migrating from RDS for MySQL to Aurora with minimal downtime by creating an Aurora Read Replica and then promoting it.

B: Standard RDS for MySQL cross-Region replicas are strictly read-only. There is no native feature to replicate write queries back to the primary, which would create an unsupported and problematic configuration.

C: "Write forwarding" is a feature exclusive to Amazon Aurora, not RDS for MySQL. Additionally, managing bi-directional logical replication between standard RDS instances is complex and not a managed AWS feature.

D: While this option correctly identifies the target architecture (Aurora Global Database), it is less precise than option A. Option A provides a complete solution by including the specific, valid migration steps required to transition from the current state.

1. Amazon Aurora User Guide - Using Amazon Aurora global databases: "An Aurora global database consists of one primary AWS Region where your data is mastered

and up to five read-only

secondary AWS Regions. ... You can use write forwarding to issue write operations from secondary AWS Regions. With write forwarding

write operations issued from reader DB instances in a secondary AWS Region are forwarded to the writer DB instance in the primary AWS Region." (Section: "Using write forwarding in an Amazon Aurora global database")

2. Amazon Aurora User Guide - Migrating data to an Amazon Aurora DB cluster: "To migrate data from an RDS for MySQL DB instance to an Amazon Aurora MySQL DB cluster with minimal downtime

you can create an Aurora Read Replica of your RDS for MySQL DB instance. ... When the replica lag between the RDS for MySQL DB instance and the Aurora Read Replica is zero

you can promote the Aurora Read Replica..." (Section: "Migrating data from an RDS for MySQL DB instance to an Amazon Aurora MySQL DB cluster"

Subsection: "Migrating from an RDS for MySQL DB instance by creating an Aurora Read Replica")

3. AWS Documentation - Working with read replicas for Amazon RDS for MySQL: "You can create a read replica in a different AWS Region from the source DB instance. This is called a cross-Region read replica. ... Cross-Region read replicas are read-only..." (Section: "Cross-Region read replica limitations for MySQL")

This solution provides a well-architected approach for a heterogeneous database migration from Oracle to a managed AWS service. It correctly identifies the use of the AWS Schema Conversion Tool (SCT) and AWS Database Migration Service (DMS) for this purpose. Amazon RDS for PostgreSQL supports the PostGIS extension, which provides native spatial data capabilities, meeting a key requirement. Most importantly, it addresses the need to query on-premises data as a foreign table by using AWS Direct Connect to establish a dedicated, private network connection, over which PostgreSQL's Foreign Data Wrappers (FDW) can securely connect to the on-premises Oracle database.

A. Amazon DynamoDB is a NoSQL database, which is an unsuitable target for a relational Oracle database without a major application rewrite. Amazon API Gateway does not provide foreign table support.

B. AWS Glue crawlers are used to discover data and populate the AWS Glue Data Catalog; they do not enable live foreign table queries from an RDS instance.

C. An internet gateway provides public internet access. It is not the appropriate or secure method for establishing a private, persistent connection to an on-premises database for foreign table queries.

1. AWS DMS and SCT for Oracle to PostgreSQL Migration: AWS Documentation

"AWS Schema Conversion Tool User Guide

" section "Converting Oracle Schemas to PostgreSQL." This guide details using SCT to convert the source Oracle schema and code to a format compatible with PostgreSQL

and then using DMS to migrate the data.

2. Spatial Data Support in RDS for PostgreSQL: AWS Documentation

"Amazon RDS for PostgreSQL

" section "Working with PostgreSQL extensions

" subsection "PostGIS." This document confirms that the PostGIS extension is supported on RDS for PostgreSQL to "add support for geographic objects."

3. Hybrid Connectivity with Direct Connect: AWS Documentation

"AWS Direct Connect User Guide

" section "What is AWS Direct Connect?." It states

"AWS Direct Connect creates a dedicated private connection between your data center...and AWS. This can reduce network costs

increase bandwidth throughput

and provide a more consistent network experience than internet-based connections." This is the required connectivity for stable foreign table access.

4. PostgreSQL Foreign Data Wrappers: The official PostgreSQL documentation (Version 14

Section 37.3

"Writing a Foreign Data Wrapper") describes the FDW feature. The oraclefdw extension allows a PostgreSQL database to connect to and query a remote Oracle database as if it were a local table

which directly fulfills the requirement. This connection would be established over the Direct Connect link.

To automatically decrypt PGP-encrypted files upon upload, the AWS Transfer Family managed workflow requires the corresponding PGP private key. This sensitive key must be stored securely in AWS Secrets Manager. The decryption process is a standard, successful operation within the data pipeline, and therefore must be configured as a "nominal step" in the workflow. An exception-handling step is reserved for error conditions. This nominal step is then configured with the necessary PGP decryption parameters, referencing the private key stored in Secrets Manager. Finally, associating the workflow with the Transfer Family server ensures it is automatically triggered for every file successfully uploaded.

A. Decryption requires the private key, not the public key. The step must also be configured for decryption, not encryption.

B. Decryption is a standard operation (nominal step), not an error condition (exception-handling step), and the step must be configured for decryption.

D. This option is incorrect because it uses the wrong key (public instead of private) and the wrong step type (exception-handling instead of nominal).

1. AWS Transfer Family User Guide

"Create a workflow to decrypt files": This guide outlines the exact procedure. Step 1 explicitly states

"Store your PGP private key in AWS Secrets Manager." Step 3 details creating a workflow with a decryption step

which is a nominal (standard) step. Step 4 describes associating the workflow with the server. (See section: Managed workflows > Example workflows and steps > Create a workflow to decrypt files).

2. AWS Transfer Family User Guide

"Workflow steps for AWS Transfer Family": This document describes the available workflow steps. The "Decrypt file" step is listed as a primary action. It specifies

"For PGP decryption

you must provide a private key and an optional passphrase that are stored in AWS Secrets Manager." This confirms the need for the private key and its storage location. (See section: Managed workflows > Workflow steps for AWS Transfer Family > Decrypt file).

3. AWS Transfer Family User Guide

"Getting started with AWS Transfer Family workflows": This page illustrates the workflow structure

showing that nominal steps handle the primary execution path

while exception-handling steps are for processing failures. Decryption is part of the primary path. (See section: Managed workflows > Getting started with AWS Transfer Family workflows).

This option correctly maps each security requirement to the most appropriate AWS service and its intended target. AWS WAF integrates directly with Amazon API Gateway to protect against common web exploits and DoS attacks (Layer 7). Amazon Inspector is designed to assess workloads like EC2 instances for software vulnerabilities and unintended network exposure, making it the correct choice for the legacy API host. Amazon GuardDuty is a threat detection service that continuously monitors the AWS account for malicious activity by analyzing data sources like VPC Flow Logs and AWS CloudTrail logs. This provides a comprehensive, layered security posture by applying the correct service to each part of the architecture.

A. This is incorrect because AWS WAF cannot be directly attached to a standalone EC2 instance. It requires an Application Load Balancer or Amazon CloudFront, which represents an unstated architectural change.

B. This is incorrect because Amazon Inspector is not used to analyze API Gateway directly, and Amazon GuardDuty is a detection and alerting service, not a blocking service.

D. This is incorrect because Amazon Inspector assesses vulnerabilities rather than providing active "protection" (blocking). Additionally, Amazon GuardDuty does not natively block malicious attempts.

---

1. AWS WAF with API Gateway: AWS Documentation states

"You can use AWS WAF to protect your Amazon API Gateway APIs from common web exploits

such as SQL injection and cross-site scripting (XSS) attacks."

Source: Amazon API Gateway Developer Guide

"Controlling access to an API with AWS WAF".

2. Amazon Inspector for EC2: The Amazon Inspector User Guide specifies its function: "Amazon Inspector is a vulnerability management service that continuously scans your AWS workloads for software vulnerabilities and unintended network exposure... Amazon Inspector scans Amazon EC2 instances..."

Source: Amazon Inspector User Guide

"What is Amazon Inspector?"

Introduction section.

3. Amazon GuardDuty Function: The official documentation describes GuardDuty as a monitoring and detection service: "Amazon GuardDuty is a threat detection service that continuously monitors your AWS accounts and workloads for malicious activity and delivers detailed security findings for visibility and remediation." It does not block traffic itself.

Source: Amazon GuardDuty User Guide

"What is Amazon GuardDuty?"

Introduction section.

4. AWS WAF Protected Resources: The AWS WAF Developer Guide lists the resources it can protect

which include Application Load Balancer and API Gateway

but not EC2 instances directly. This supports why option A is flawed.

Source: AWS WAF Developer Guide

"How AWS WAF works"

section on "AWS resources that you can protect with AWS WAF".

This option presents a comprehensive, automated solution that directly addresses the root causes of downtime. Using AWS CloudFormation change sets allows the team to preview the impact of template modifications on existing resources before applying them, preventing unexpected changes. AWS CodeDeploy with a blue/green deployment strategy creates a new, parallel environment (green) to deploy and test the application without affecting the live production environment (blue). Traffic is only switched after successful validation. Integrating automated testing with AWS CodeBuild ensures that both infrastructure and application changes are validated systematically, catching errors early in the pipeline and significantly reducing the risk of production downtime.

A. This approach is reactive and relies on manual testing, which is slow, error-prone, and does not align with modern CI/CD best practices for preventing downtime.

C. Validating templates only checks for syntax errors, not logical issues or the operational impact of resource changes. This option still depends on inefficient manual testing.

D. While introducing a blue/green pattern is an improvement, relying on operators to manually log in and test is not a scalable, repeatable, or reliable validation method for a CI/CD pipeline.

1. AWS CloudFormation User Guide: "With change sets

you can preview how proposed changes to a stack might impact your running resources... before you implement them. Change sets allow you to see how your changes might impact your running resources

for example

if your changes will delete or replace any critical resources." (AWS CloudFormation User Guide

Section: "Updating stacks using change sets").

2. AWS CodeDeploy User Guide: "In a blue/green deployment

a new set of instances (the green fleet) is provisioned

and the new application revision is deployed to it. CodeDeploy reroutes traffic from the original environment (the blue fleet) to the green fleet... After traffic is rerouted

the instances in the blue fleet can be terminated." (AWS CodeDeploy User Guide

Section: "Overview of a blue/green deployment").

3. AWS CodePipeline User Guide: "You can add a test action that uses AWS CodeBuild... to your pipeline. A common use for a test action is to run unit tests on your source code." (AWS CodePipeline User Guide

Section: "Add a test action").

4. AWS Whitepaper - Practicing Continuous Integration and Continuous Delivery on AWS: "AWS CodeDeploy supports blue/green deployments. This deployment strategy helps you minimize downtime... You can also monitor the new application version and roll back the deployment if you encounter any issues." (AWS Whitepapers & Guides

"Practicing Continuous Integration and Continuous Delivery on AWS"

Page 21).

The most cost-effective solution is to establish five distinct inter-region VPC peering connections. Each of the five VPCs in the us-east-2 Region will be directly peered with the single VPC in the eu-west-1 Region. VPC peering is highly cost-effective as it does not incur hourly charges for the connection or data processing fees, which are characteristic of AWS Transit Gateway. The only cost associated with VPC peering is for the data transferred between the regions. This model precisely fulfills the connectivity requirements without the fixed operational costs of a more complex hub-and-spoke architecture using Transit Gateway, making it the most economical choice for this specific scenario.

A. An AWS Transit Gateway is a regional resource. It is not technically possible to attach a VPC from one region (us-east-2) directly to a Transit Gateway located in another region (eu-west-1).

B. While technically sound, this solution is not the most cost-effective. It requires two Transit Gateways and six attachments, all of which have hourly costs, in addition to data processing fees per gigabyte, making it more expensive than VPC peering.

C. A full mesh configuration is unnecessarily complex for this requirement. It would involve creating 15 peering connections, leading to significant management overhead and providing unneeded connectivity between the US-based VPCs.

1. AWS Documentation - What is VPC peering?: This document states

"A VPC peering connection is a networking connection between two VPCs... The VPCs can be in different Regions (also known as an inter-Region VPC peering connection)." It also clarifies that there are no gateway or VPN connection dependencies

highlighting its simpler cost structure.

Source: AWS VPC User Guide

"What is VPC peering?"

https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

2. AWS Transit Gateway Pricing: The official pricing page clearly shows that Transit Gateway has an hourly charge for each VPC attachment and a per-GB charge for data processing. In contrast

the Amazon VPC pricing page shows no such charges for VPC peering

only for inter-region data transfer.

Source: AWS Transit Gateway Pricing

https://aws.amazon.com/transit-gateway/pricing/

3. AWS Documentation - How transit gateways work: This document confirms the regional nature of Transit Gateways. "A transit gateway is a regional resource and can connect VPCs in the same Region." This directly invalidates option A.

Source: AWS VPC Transit Gateways Guide

"How transit gateways work"

https://docs.aws.amazon.com/vpc/latest/tgw/how-transit-gateways-work.html

4. AWS Whitepaper - Building a Scalable and Secure Multi-VPC AWS Network Infrastructure: This paper compares connectivity options. In the "VPC-to-VPC connectivity" section

it notes

"For a small number of VPCs

VPC peering is a very cost-effective way to provide... connectivity." This supports the choice of VPC peering as the most cost-effective solution for the scale described in the question.

Source: AWS Whitepapers & Guides

"VPC-to-VPC connectivity"

https://docs.aws.amazon.com/whitepapers/latest/building-scalable-secure-multi-vpc-network-infrastructure/vpc-to-vpc-connectivity.html

This solution outlines a standard, best-practice approach for a heterogeneous, cross-account database migration with minimal downtime. First, the target database instance (RDS for PostgreSQL) is created, and its schema is prepared using the AWS Schema Conversion Tool (SCT), which is designed for heterogeneous migrations (Option A). Second, secure, private network connectivity is established between the source and target VPCs across the two AWS accounts using VPC Peering and correctly configured security groups (Option C). Finally, AWS Database Migration Service (DMS) is used with a "Full load + change data capture (CDC)" task to migrate all existing data and replicate ongoing changes, ensuring the target stays in sync. The cutover is then performed by updating the Route 53 CNAME record, achieving a near-zero downtime migration (Option E).

B: The AWS Schema Conversion Tool (SCT) does not create RDS DB instances; it converts and applies the schema to an existing target database. Data migration is the primary role of AWS DMS.

D: Making the source database publicly accessible is a significant security risk and an anti-pattern. VPC peering is the secure and recommended method for establishing private connectivity between VPCs.

F: A change data capture (CDC) only migration task is insufficient as it would not migrate the existing data. A "Full load + CDC" task is required to migrate all existing data and then replicate ongoing changes.

References:

1. AWS Database Migration Service Documentation - Best practices for AWS Database Migration Service: "For a heterogeneous migration, you first use the AWS Schema Conversion Tool (AWS SCT) to convert your source schema to the target format. After you convert your schema, you can use AWS DMS to migrate your data." This supports the sequence in options A and E.

Source: AWS Database Migration Service User Guide, "Best practices for AWS Database Migration Service," section "Heterogeneous database migration."

2. AWS Database Migration Service Documentation - Creating a task: "Full load, ongoing replication — AWS DMS first loads existing data from the source to the target. After the full load is complete, ongoing changes are replicated to the target. This process is also called change data capture (CDC)." This supports the choice of a "Full load + CDC" task in option E for minimal downtime.

Source: AWS Database Migration Service User Guide, "Working with AWS DMS tasks," section "Creating a task."

3. AWS Documentation - What is VPC peering?: "A VPC peering connection is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses... You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account." This supports using VPC peering for cross-account connectivity as described in option C.

Source: Amazon VPC User Guide, "VPC peering," section "What is VPC peering?"

4. AWS Database Migration Service Documentation - Using an Amazon RDS DB instance as a source for AWS DMS: "The security group used by the source RDS DB instance must allow incoming traffic from the DMS replication instance... If the replication instance and the source database are in different VPCs, you can use VPC peering." This directly validates the networking approach in option C.

Source: AWS Database Migration Service User Guide, "Sources for data migration," section "Using an Amazon RDS DB instance as a source for AWS DMS."

This solution addresses two distinct requirements cost-effectively using a single Direct Connect connection.

First, to provide on-premises access to VPCs in multiple AWS Regions, a Direct Connect gateway is the optimal solution. It is a global resource that allows a single Direct Connect connection to be associated with Virtual Private Gateways (VGWs) in any AWS Region (except China). This avoids the high cost and complexity of provisioning separate Direct Connect connections for each Region.

Second, to provide on-premises access to AWS public services (like Amazon S3 or Amazon DynamoDB) over the private network connection, a public virtual interface (VIF) is required. A public VIF advertises AWS's public IP prefixes over the Direct Connect connection, routing traffic to these services through the private link instead of the public internet.

B: Setting up additional Direct Connect connections is significantly more expensive than using a Direct Connect gateway and is not the least-cost solution.

C: Establishing a Site-to-Site VPN over a private VIF is not a standard or valid architecture for extending connectivity to other VPCs in this context.

D: Using a VPN over a public VIF to connect to VPCs is an unnecessarily complex and less efficient method compared to a Direct Connect gateway.

F: While VPC peering connects the VPCs, routing on-premises traffic through one VPC to reach others is less efficient and scalable than using a Direct Connect gateway.

1. AWS Documentation - Direct Connect gateways: "A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway in any Region and access it from all other Regions. You can associate the Direct Connect gateway with a virtual private gateway for a VPC. You can then create a private virtual interface for your Direct Connect connection to the Direct Connect gateway." This supports using a DX gateway for multi-region VPC access. (Source: AWS Documentation

Direct Connect User Guide

"Direct Connect gateways").

2. AWS Documentation - Direct Connect virtual interfaces: "Public virtual interface: A public virtual interface enables you to connect to all AWS public IP addresses." This supports using a public VIF for accessing AWS public services. (Source: AWS Documentation

Direct Connect User Guide

"Direct Connect virtual interfaces").

3. AWS Documentation - Working with Direct Connect gateways: "After you create the Direct Connect gateway

you can associate it with the virtual private gateways for your VPCs... A Direct Connect gateway supports communication between its attached private virtual interfaces and associated virtual private gateways." This confirms the architecture described in option A. (Source: AWS Documentation

Direct Connect User Guide

"Working with Direct Connect gateways").