AWS SAP-C02 SCS-C02 ANS-C01 - Professional Architecture Security Networking Specialty

By Alex Rivera · Updated May 25, 2026

Questions25
Passing Score75%
Format100% Multiple Choice
Sessions Logged2,322
Your progressLog in / Register to track times taken, best score, questions mastered, and coverage on this quiz.
Rating
4.4 (16)

Topics covered

This quiz

Uncategorized25 (100%)

Uncategorized25 questions

Browse more · Report this quiz

Question catalog for this preview

Catalog listing of the 5 preview questions for this quiz.

Question 1

An architect designs a multi-region active-active architecture for a globally distributed application. Database writes must be consistent across regions. Which AWS database service supports this?

Answer choices

  • A. RDS Multi-AZ

  • B. DynamoDB Global Tables with last-write-wins conflict resolution

  • C. Aurora Global Database with write forwarding

  • D. ElastiCache Global Datastore

Question 2

A developer stores application secrets (database passwords, API keys) in AWS Secrets Manager. The application must automatically rotate the database password every 30 days. Which mechanism handles rotation?

Answer choices

  • A. Secrets Manager uses IAM policies to rotate credentials

  • B. Secrets Manager triggers a Lambda rotation function that updates the password in the database and the secret

  • C. RDS automatically detects Secrets Manager and rotates the password

  • D. Secrets Manager emails the DBA to manually update the password

Question 3

An organization implements AWS Network Firewall to inspect all traffic entering their VPC from the internet. Where should the Network Firewall endpoint be deployed in the VPC architecture?

Answer choices

  • A. In the private subnet, between the application layer and database

  • B. In a dedicated firewall subnet, with route tables directing internet traffic through the firewall before reaching application subnets

  • C. In the public subnet alongside the Internet Gateway

  • D. Deployed externally — Network Firewall is a cloud service, not deployed in VPC

Question 4

A company uses Amazon GuardDuty and receives a finding: `CryptoCurrency:EC2/BitcoinTool.B!DNS`. What does this finding indicate and what is the appropriate response?

Answer choices

  • A. Cryptocurrency software is using excessive CPU on the EC2 instance

  • B. An EC2 instance is making DNS queries associated with cryptocurrency mining pool domains — potentially indicating compromised instance running unauthorized cryptomining

  • C. The EC2 instance is using an approved cryptocurrency payment API

  • D. GuardDuty has blocked the mining activity automatically

Question 5

A company uses Route 53 with a private hosted zone. An application needs to resolve on-premises DNS names while instances in the VPC also need to resolve Route 53 private zone records. Which feature enables bidirectional DNS resolution?

Answer choices

  • A. Route 53 Resolver with inbound and outbound endpoints

  • B. Route 53 Public Hosted Zones with health checks

  • C. VPC DNS attributes `enableDnsHostnames` and `enableDnsSupport` only

  • D. AWS Direct Connect with split-horizon DNS