Design Solutions for Organizational Complexity

SAP-C02 · 78 questions

• A county needs separate VPCs for assessor, courts, and public works that must reach a central shared-services VPC for Active Directory and logging without creating a full mesh of VPC peerings. Which connectivity design best meets this requirement?
• A city utility must connect on-premises SCADA historians to an analytics VPC with consistent low latency and dedicated bandwidth for continuous telemetry. Which hybrid connectivity approach best fits these requirements?
• A regional library consortium already uses AWS Direct Connect for catalog syncs into one Region and must remain connected if the Direct Connect circuit fails. Which hybrid design provides resilient private connectivity?
• A transit authority requires bidirectional hybrid DNS: on-premises resolvers must answer queries for private Route 53 records in AWS, and domain-joined jump hosts in AWS must resolve corporate DNS names. Which approach meets this need?
• A school district must segment student SIS, staff administration, and guest Wi-Fi backends into separate subnets or VPCs, block casual lateral movement, and still allow tightly controlled access to shared services such as directory and logging. Which design best achieves this?
• A public-health department runs workloads in private subnets that must reach Amazon S3 and Amazon DynamoDB APIs without sending that traffic across the public internet or a NAT Gateway. Which design satisfies this requirement?
• Two cities merging IT operations both use overlapping 10.0.0.0/8 addressing and must connect selected workloads into AWS without renumbering every on-premises network on day one. Which approach best addresses the overlapping CIDR constraint?
• A county must choose AWS Regions for a citizen portal where data-residency rules constrain allowable locations and page-load latency for residents also matters. Which Region and AZ selection approach best balances these requirements?
• A municipal security operations center needs flow-level visibility of east-west traffic across Transit Gateway attachments to investigate anomalous paths between department VPCs. Which monitoring approach best supports this investigation?
• A parks department runs an ECS container platform in a shared city VPC alongside other applications and needs controlled egress plus tightly scoped service-to-service connectivity. Which networking approach best fits this multi-app VPC?
• A water utility hosts burst analytics gear in a co-location cage and must connect that environment to AWS for periodic large transfers. Architects must choose among Direct Connect, Site-to-Site VPN, and public endpoints. Which evaluation best matches professional hybrid design?
• A city's hub-and-spoke Transit Gateway design accidentally allows a sandbox account VPC to reach production courts systems through transitive routes. Which control best remediates this?
• A county application team proposes peering every microservice VPC to every other microservice VPC. The architect must recommend a scalable alternative for multi-VPC connectivity. What should the architect recommend?
• A municipal API in a shared networking account must privately reach Network Load Balancer targets that live in a spoke VPC application account without opening the spoke to broad network routing. Which pattern best fits?
• During an outage, a city network team must determine whether traffic is blackholed by a Transit Gateway route table misconfiguration, a network ACL deny, or a security group rule. Which troubleshooting approach is most appropriate?
• A regional emergency-management organization runs workloads across multiple Availability Zones but terminates all Direct Connect virtual interfaces on a single path lacking diversity. What should a resilience review recommend?
• A county workforce must sign in to many AWS accounts using Microsoft Entra ID without creating long-lived IAM users in each account. Which approach best meets this requirement?
• A city auditor requires that a contractor AWS account may deploy into a project account only through a break-glass role that enforces MFA and short session durations. Which cross-account access design best satisfies the auditor?
• A courts system must encrypt case files at rest so cryptographic key control remains with the justice AWS account rather than depending only on default keys owned by a shared security account. Which encryption strategy best meets this ownership requirement?
• A public permits website terminates TLS on Application Load Balancers across multiple AWS accounts and needs centrally requestable certificates with automatic renewal. Which certificate approach best fits?
• A municipality wants centralized detection of overly permissive IAM policies and unintended public resource exposure across all Organization accounts. Which security approach best provides these findings?
• All CloudTrail management events from every municipal AWS account must be delivered to an immutable logging-account bucket that member accounts cannot alter. Which auditing strategy best meets this requirement?
• A utility OT/IT bridge VPC must allow historian hosts to reach analytics only on specific ports, using security groups as the primary instance-level control and network ACLs as coarse subnet guardrails. Which prescription is correct?
• Resident PII moves from a public citizen portal to internal APIs and must remain encrypted in transit across public TLS termination and private backend hops. Which design best satisfies encryption-in-transit requirements?
• A school district wants continuous vulnerability visibility for Amazon EC2 instances and container images used by student-facing systems. Which service prescription best meets this need?
• After a phishing wave, a city needs org-wide visibility into suspicious API activity correlated across accounts for investigation and notifications. Which approach should the architect prescribe?
• A library consortium must prevent member libraries' accounts from disabling CloudTrail or creating unrestricted IAM admin users, while still detecting risky configurations. Which design best combines preventive and detective controls?
• Cross-account analytics consumers need access to a municipal shared data lake. Direct long-term access keys are rejected by security. How should consumers authenticate?
• A county encrypts tax data with AWS KMS and must separate key administrators from key users while enabling automatic key rotation where appropriate. Which design should the architect prescribe?
• Architects must not conflate citizen-facing sign-in with workforce AWS access for a municipal portal. Which identity pattern is correct?
• A municipal Security Hub administrator account aggregates findings. Leadership requires that member accounts cannot silently mute critical GuardDuty findings from central view. What should the architect emphasize?
• During review, route tables in a shared networking account send 0.0.0.0/0 from a protected subnet toward an inspection VPC rather than directly to an internet gateway. How should the architect treat that design?
• A 911 CAD system requires an RTO of minutes and near-zero RPO across Regions. A team proposes pilot light only. What should the architect recommend?
• A county property database needs automated failover across Availability Zones; multi-Region DR is optional for cost reasons. Which recommendation fits?
• A city needs continuous block-level replication and orchestrated failover for lift-and-shifted VMs, not only periodic AMI copies. Which service should the architect select?
• Court recordings require immutable retention and proof that restores work. Untested snapshots alone are insufficient. What should the backup strategy include?
• A municipal web tier must replace unhealthy instances automatically without waiting for human change windows. Which architecture best meets that requirement?
• Permit-application workers see seasonal peaks. Leadership prefers resilient capacity over vertical scale-up of one large instance. What should the architect recommend?
• Utility meter readings have a 15-minute RPO. Which data protection approach should the architect select?
• A library catalog must meet a stated RTO in a second Region while keeping costs lower than active-active multi-site. Which DR pattern fits best?
• A grants portal DR design should keep a minimal core data plane running in a standby Region and scale out only after disaster declaration. Which pattern is that?
• Private subnet egress depends on a single NAT Gateway in one Availability Zone. What redesign removes that single point of failure?
• Tax archives need automated cross-Region backup copies encrypted with KMS keys usable in the destination Region. Which design is appropriate?
• City leadership states that losing the last hour of 311 tickets after failover is unacceptable. How should that statement drive architecture?
• A damaged schema deploy corrupts data in a municipal database. Multi-AZ failover alone does not fix the logical corruption. What should the architect rely on?
• Emergency-management DR runbooks currently launch AMIs by hand. What improvement should the architect prioritize?
• A statewide alerts system targets multi-site active-active DR. What implication must the architecture address beyond duplicating web tiers?
• A newly consolidated metro government needs AWS accounts for security, logging, shared networking, sandboxes, and each department workload. Which structure should the architect evaluate first?
• A county previously created AWS accounts ad hoc and now wants standardized landing zones with guardrails. Which service should the architect recommend to baseline that multi-account governance?
• Member accounts must be prevented from leaving the organization or disabling central security services. Which governance control should the architect apply?
• A county SOC wants CloudWatch alarms and EventBridge security events from every workload account to land in one security and operations account so on-call can respond from a single place. Which multi-account notification strategy best meets that need?
• A network account owns a Transit Gateway and a Route 53 Resolver rule set that parks, courts, and public-works accounts must use without recreating those resources. How should those networking assets be shared?
• A municipal landing zone must apply strict SCPs to production courts accounts while giving experimental AI sandboxes looser guardrails. Which OU design best supports that governance model?
• City shared services must host AWS Directory Service once so assessor, permitting, and fleet accounts can join domain resources without each building its own directory. Which multi-account pattern is appropriate?
• A log archive account will receive organization CloudTrail and other logs. The bucket design must allow only approved trails or log writers to put objects and must prevent premature deletion. Which approach best meets those controls?
• Parks leadership needs a new AWS account for a recreation-registration project. How should the account be created so it stays inside the municipal landing-zone governance model?
• Security findings raised in member accounts must trigger automated response runbooks that run only in the central security account. Which event architecture supports that pattern?
• A city council IT committee wants chargeback-friendly AWS boundaries that match departments such as police, parks, and finance instead of one shared production account. Which account-structure approach aligns to that need?
• Courts workloads adjacent to CJIS-style policy needs must inherit Control Tower preventive and detective guardrails mapped to those requirements. What should architects do?
• A network account shares an AMI and a subnet via AWS RAM to a workload account that has SCPs denying certain EC2 and networking actions. What must architects understand about that interaction?
• Finance staff manage consolidated billing in the payer account while the SOC runs Security Hub and GuardDuty admin tooling elsewhere. How should those roles be separated in the org design?
• Two counties will federate a shared 911 platform on AWS. Each county's call-data plane must remain isolated even though some platform services are shared. Which multi-account approach best fits?
• Leadership asks whether AWS Config aggregators and Security Hub delegated administration belong in the baseline multi-account governance model. What is the correct stance?
• City finance requires every AWS resource to map to a department and fund code so chargeback invoices are accurate. Which cost-visibility strategy should architects implement?
• Cost Explorer shows a sharp rise in data-transfer charges tied to a public S3 access pattern for a citizen media site. What should architects do first as part of cost and usage monitoring?
• A citizen portal has steady baseline EC2 demand all year, while a monthly batch job spikes briefly and can tolerate interruption. How should purchasing options be matched?
• An internal city intranet on EC2 is rarely used yet remains on large instance types. Which service provides rightsizing visibility for that compute?
• Library media buckets have grown unexpectedly. Operations needs organization-wide storage cost visibility into incomplete multipart uploads and non-current versions. Which tool fits?
• Utilities OU spend is approaching the approved ratepayer IT budget. Leadership wants proactive alerts before actual overruns. Which AWS capability should they use?
• Sandbox accounts still run unused Application Load Balancers after experiments end. Which cost-visibility source commonly flags that waste?
• Before council approves funding for multi-Region warm-standby DR, architects must present a forward-looking cost estimate. Which tool should they use?
• Public-meeting video rendering can tolerate interruption, but real-time computer-aided dispatch (CAD) for first responders cannot. How should Spot be applied?
• Consolidated billing exists, yet finance still cannot attribute spend to parks versus police. What is missing for cost visibility?
• Rightsizing reviews currently look only at EC2 instance size, yet RDS databases and EBS volumes also drive waste. What should the visibility approach include?
• A county must choose between 1-year and 3-year Savings Plans while election-year budgets make long commitments politically uncertain. How should architects evaluate the tradeoff?
• A city FinOps team must give each department a monthly showback of AWS spend with service-level detail across dozens of accounts. Which approach best provides that granular organizational cost visibility?
• Architects propose multi-AZ deployment for a county permitting API to improve reliability. Finance will not approve until the cost impact of that HA choice is visible. What should the solutions architect emphasize before approval?
• A municipality’s sandbox accounts for students and vendors regularly overspend. Leadership wants notifications and the option to apply spend controls when budgets are exceeded. Which design best fits org cost governance?