1. Home
  2. Amazon
  3. SAA-C02

Amazon SAA-C02 Online Practice Questions and Exam Preparation

SAA-C02 Exam Details

  • Exam Code
    :SAA-C02
  • Exam Name
    :AWS Certified Solutions Architect - Associate (SAA-C02)
  • Certification
    :Amazon Certifications
  • Vendor
    :Amazon
  • Total Questions
    :1080 Q&As
  • Last Updated
    :Jun 04, 2025

Amazon SAA-C02 Online Questions & Answers

  • Question 81:

    A company is planning on deploying a newly built application on AWS in a default VPC. The application will consist of a web layer and database layer. The web server was created in public subnets, and the MySQL database was created in private subnet. All subnets are created with the default network ACL settings, and the default security group in the VPC will be replaced with new custom security groups.

    A. Create a database server security group with inbound and outbound rules for MySQL port 3306 traffic to and from anywhere (0.0.0.0/0).
    B. Create a database server security group with an inbound rule for MySQL port 3300 and specify the source as a web server security group.
    C. Create a web server security group within an inbound allow rule for HTTPS port 443 traffic from anywbere (0.0.0.0/0) and an inbound deny rule for IP range 182. 20.0.0/16.
    D. Create a web server security group with an inbound rule for HTTPS port 443 traffic from anywhere (0.0.0.0/0). Create network ACL inbound and outbound deny rules for IP range 182. 20.0.0/16.
    E. Create a web server security group with an inbound and outbound rules for HTTPS port 443 traffic to and from anywbere (0.0.0.0/0). Create a network ACL inbound deny rule for IP range 182. 20.0.0/16.

  • Question 82:

    An application running on an Amazon EC2 instance needs to access an Amazon DynamoDB table Both the EC2 instance and the DynamoDB table are in the same AWS account A solutions architect must configure the necessary

    permissions.

    Which solution will allow least privilege access to the DynamoDB table from the EC2 instance?

    A. Create an IAM role with the appropriate policy to allow access to the DynamoDB table Create an instance profile to assign this IAM role to the EC2 instance
    B. Create an IAM role with the appropriate policy to allow access to the DynamoDB table Add the EC2 instance to the trust relationship policy document to allow it to assume the role
    C. Create an IAM user with the appropriate policy to allow access to the DynamoDB table Store the credentials in an Amazon S3 bucket and read them from within the application code directly.
    D. Create an IAM user with the appropriate policy to allow access to the DynamoDB table Ensure that the application stores the IAM credentials securely on local storage and uses them to make the DynamoDB calls

  • Question 83:

    A company runs a website on Amazon EC2 instances behind an ELB Application Load Balancer Amazon Route 53 Is used for the DNS The company wants to set up a backup website with a message including a phone number and email address that users can reach if the primary website is down.

    How should the company deploy this solution?

    A. Use Amazon S3 website hosting for the backup website and a Route 53 failover routing policy
    B. Use Amazon S3 website hosting for the backup website and a Route 53 latency routing policy
    C. Deploy the application in another AWS Region and use ELB health checks for failover routing.
    D. Deploy the application in another AWS Region and use server-side redirection on the primary website

  • Question 84:

    A company recently launched Linux-based application instances on Amazon EC2 in a private subnet and launched a Linux-based bastion host on an Amazon EC2 instance in a public subnet of a VPC A solutions architect needs to connect from the on-premises network, through the company's internet connection to the bastion host and to the application servers The solutions architect must make sure that the security groups of all the EC2 instances will allow that access

    Which combination of steps should the solutions architect take to meet these requirements? (Select TWO)

    A. Replace the current security group of the bastion host with one that only allows inbound access from the application instances.
    B. Replace the current security group of the bastion host with one that only allows inbound access from the internal IP range for the company.
    C. Replace the current security group of the bastion host with one that only allows inbound access from the external IP range for the company
    D. Replace the current security group of the application instances with one that allows inbound SSH access from only the private IP address of the bastion host.
    E. Replace the current security group of the application instances with one that allows inbound SSH access from only the public IP address of the bastion host

  • Question 85:

    A company has created a multi-tier application for its ecommerce website. The website uses an Application Load Balancer that resides in the public subnets, a web tier in me public subnets, and a MySQL cluster hosted on Amazon EC2 instances in the private subnets. The MySQL database needs to retrieve product catalog and pricing information that is hosted on the internet by a third-party provider. A solutions architect must devise a strategy that maximizes security without increasing operational overhead.

    What should the solutions architect do to meet these requirements?

    A. Deploy a NAT instance in the VPC. Route all the internet-based traffic through the NAT instance.
    B. Deploy a NAT gateway in the public subnets. Modify the private subnet route table to direct all internet-bound traffic to the NAT gateway.
    C. Configure an internet gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the internet gateway.
    D. Configure a virtual private gateway and attach it to the VPC. Modify the private subnet route table to direct internet-bound traffic to the virtual private gateway.

  • Question 86:

    A solutions architect must provide a fully managed replacement for an on-premises solution that allows employees and partners to exchange files. The solution must be easily accessible to employees connecting from on-premises systems, remote employees, and external partners.

    Which solution meets these requirements?

    A. Use AWS Transfer for SFTP to transfer files into and out of Amazon S3.
    B. Use AWS Snowball Edge for local storage and large-scale data transfers.
    C. Use Amazon FSx to store and transfer files to make them available remotely.
    D. Use AWS Storage Gateway to create a volume gateway to store and transfer files to Amazon S3.

  • Question 87:

    A company wants to host a scalable web application on AWS. The application will be accessed by users from different geographic regions of the world. Application users will be able to download and upload unique data up to gigabytes in size. The development team wants a cost-effective solution to minimize upload and download latency and maximize performance.

    What should a solutions architect do to accomplish this?

    A. Use Amazon S3 with Transfer Acceleration to host the application.
    B. Use Amazon S3 with CacheControl headers to host the application.
    C. Use Amazon EC2 with Auto Scaling and Amazon CloudFront to host the application
    D. Use Amazon EC2 with Auto Scaling and Amazon ElastiCache to host the application.

  • Question 88:

    A company is planning to migrate its virtual server-based workloads to AWS The company has internet-facing load balancers backed by application servers. The application servers rely on patches from an internet-hosted repository

    Which services should a solutions architect recommend be hosted on the public subnet*? (Select TWO.)

    A. NAT gateway
    B. Amazon RDS DB instances
    C. Application Load Balancers
    D. Amazon EC2 application servers
    E. Amazon Elastic File System (Amazon EFS) volumes

  • Question 89:

    A solutions architect must design a solution for a persistent database that is being migrated from on- premises to AWS. The database requires 64,000 IOPS according to the database administrator. If possible, the database administrator

    wants to use a single Amazon Elastic Block Store (Amazon EBS) volume to host the database instance.

    Which solution effectively meets the database administrator's criteria?

    A. Use an instance from the 13 I/O optimized family and leverage local ephemeral storage to achieve the IOPS requirement.
    B. Create an Nitro-based Amazon EC2 instance with an Amazon EBS Provisioned IOPS SSD (io1) volume attached. Configure the volume to have 64,000 IOPS.
    C. Create and map an Amazon Elastic File System (Amazon EFS) volume to the database instance and use the volume to achieve the required IOPS for the database.
    D. Provision two volumes and assign 32,000 IOPS to each. Create a logical volume at the operating system level that aggregates both volumes to achieve the IOPS requirements.

  • Question 90:

    A company uses Amazon RDS for PostgreSQL databases for its data tier. The company must implement password rotation for the databases. Which solution meets this requirement with the LEAST operational overhead?

    A. Store the password in AWS Secrets Manager. Enable automatic rotation on the secret.
    B. Store the password in AWS Systems Manager Parameter Store. Enable automatic rotation on the parameter.
    C. Store the password in AWS Systems Manager Parameter Store. Write an AWS Lambda function that rotates the password.
    D. Store the password in AWS Key Management Service (AWS KMS). Enable automatic rotation on the customer master key (CMK).

Related Exams:

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only Amazon exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your SAA-C02 exam preparations and Amazon certification application, do not hesitate to visit our Vcedump.com to find your solutions here.