AWS Certified Solutions Architect - Professional (SAP-C02) Practice Test

A solutions architect is advising a software company. The current environment includes a situation where a central networking account owns private subnets that several application accounts should use for ALB and EC2 placement. The target architecture must reduce duplicated NAT gateways and subnet sprawl while keeping account-level ownership of workloads. Network administrators must retain control of subnet configuration. The review board also wants the recommendation to minimize undifferentiated operations, preserve least-privilege boundaries, and avoid a one-off pattern that another account or Region cannot reuse. Which design should the solutions architect recommend?

A solutions architect is advising a healthcare SaaS provider. The current environment includes a situation where developers need administrator access inside workload accounts, but the CISO must prevent creation of public S3 buckets and deployment outside approved Regions. The target architecture must enforce organization-wide maximum permissions while still letting account teams manage IAM within those boundaries. The control must apply even if an account administrator creates a permissive IAM policy. The review board also wants the recommendation to minimize undifferentiated operations, preserve least-privilege boundaries, and avoid a one-off pattern that another account or Region cannot reuse. Which design should the solutions architect recommend?

A solutions architect is advising a global retailer. The current environment includes a situation where 42 application VPCs in six accounts are connected with selective VPC peering, and the security team cannot reason about transitive paths. The target architecture must support another 80 VPCs, centralized inspection, and routing domains for production, shared services, and sandbox accounts. The platform team must avoid a full mesh and must be able to propagate routes from new accounts automatically. The review board also wants the recommendation to minimize undifferentiated operations, preserve least-privilege boundaries, and avoid a one-off pattern that another account or Region cannot reuse. During design review, one engineer proposes additional VPC peering connections between every application and shared services VPC. Which response should the solutions architect give?

A solutions architect is advising a payments processor. The current environment includes a situation where all outbound traffic from workload VPCs must pass through a centralized inspection VPC before reaching the internet or partner networks. The target architecture must preserve symmetric routing for stateful inspection appliances and avoid bypass by application teams. Traffic crosses multiple VPC attachments on a transit gateway. The review board also wants the recommendation to minimize undifferentiated operations, preserve least-privilege boundaries, and avoid a one-off pattern that another account or Region cannot reuse. Which design should the solutions architect recommend?

A solutions architect is advising a healthcare SaaS provider. The current environment includes a situation where developers need administrator access inside workload accounts, but the CISO must prevent creation of public S3 buckets and deployment outside approved Regions. The target architecture must enforce organization-wide maximum permissions while still letting account teams manage IAM within those boundaries. The control must apply even if an account administrator creates a permissive IAM policy. The review board also wants the recommendation to minimize undifferentiated operations, preserve least-privilege boundaries, and avoid a one-off pattern that another account or Region cannot reuse. During design review, one engineer proposes IAM identity policies attached to the developer groups only. Which response should the solutions architect give?