Amazon AWS Certified Solutions Architect - Professional SAP-C02 Bundle

This alternative, Attach an AWS Organizations SCP that restricts Region-specific APIs with suitable global-service exceptions, is appropriate when Security must prevent a workload account from launching resources in prohibited AWS Regions. SCPs centrally constrain maximum allowed account permissions.

Enable AWS Config rules and aggregate compliance results centrally solves the related scenario An organization wants to continuously identify publicly exposed S3 buckets without periodic manual audits; config rules evaluate resource configuration against policies and emit noncompliance states.

Although Designate an organization administrator and enable organization-wide GuardDuty management can be valid when Multiple accounts need a consolidated view of GuardDuty findings without signing in individually, it targets a different technical condition. Delegated GuardDuty administration centralizes threat findings across enrolled accounts.

Although Route matching CloudTrail events through Amazon EventBridge to the remediation workflow can be valid when A central detection pipeline must react when an account logs an IAM policy attachment event, it targets a different technical condition. EventBridge rules can invoke security workflows from selected API activity.

Enable S3 Object Lock with appropriately governed retention on the evidence bucket would address a different requirement: Application teams may not delete security log objects before a regulated retention period ends. Object Lock protects retained object versions against premature deletion within configured mode.

This alternative, Retain AWS Organizations API events in an appropriately secured CloudTrail logging account, is appropriate when A finance team needs an immutable record of which accounts were invited into an organization. CloudTrail management events provide auditable organizational API actions.

Although Route matching CloudTrail events through Amazon EventBridge to the remediation workflow can be valid when A central detection pipeline must react when an account logs an IAM policy attachment event, it targets a different technical condition. EventBridge rules can invoke security workflows from selected API activity.

Enable S3 Object Lock with appropriately governed retention on the evidence bucket would address a different requirement: Application teams may not delete security log objects before a regulated retention period ends. Object Lock protects retained object versions against premature deletion within configured mode.

For the separate situation The security team must collect management API history from every organization account in a centralized location, Create an organization-level CloudTrail trail with secure central S3 delivery could be useful. Organization trails collect governance events consistently across member accounts.

Retain AWS Organizations API events in an appropriately secured CloudTrail logging account would address a different requirement: A finance team needs an immutable record of which accounts were invited into an organization. CloudTrail management events provide auditable organizational API actions.

This alternative, Create an organization-level CloudTrail trail with secure central S3 delivery, is appropriate when The security team must collect management API history from every organization account in a centralized location. Organization trails collect governance events consistently across member accounts.

For the separate situation Investigators require object-level S3 GetObject and PutObject access records, Enable CloudTrail S3 data events for the required bucket or object selectors could be useful. Object data events are distinct from default management event coverage.

This alternative, Create an organization-level CloudTrail trail with secure central S3 delivery, is appropriate when The security team must collect management API history from every organization account in a centralized location. Organization trails collect governance events consistently across member accounts.

For the separate situation A central detection pipeline must react when an account logs an IAM policy attachment event, Route matching CloudTrail events through Amazon EventBridge to the remediation workflow could be useful. EventBridge rules can invoke security workflows from selected API activity.

Retain AWS Organizations API events in an appropriately secured CloudTrail logging account solves the related scenario A finance team needs an immutable record of which accounts were invited into an organization; cloudTrail management events provide auditable organizational API actions.

Route matching CloudTrail events through Amazon EventBridge to the remediation workflow solves the related scenario A central detection pipeline must react when an account logs an IAM policy attachment event; eventBridge rules can invoke security workflows from selected API activity.

Although Enable S3 Object Lock with appropriately governed retention on the evidence bucket can be valid when Application teams may not delete security log objects before a regulated retention period ends, it targets a different technical condition. Object Lock protects retained object versions against premature deletion within configured mode.

Enable CloudTrail S3 data events for the required bucket or object selectors would address a different requirement: Investigators require object-level S3 GetObject and PutObject access records. Object data events are distinct from default management event coverage.

Choose a pilot-light recovery pattern for persistent essential services would address a different requirement: An application has a four-hour RTO but recovery requires core infrastructure ready with no application fleet running. Pilot light retains critical foundations while scaling application capacity during recovery.

This alternative, Reconcile the zero-RPO requirement with synchronous replication or transaction acceptance changes, is appropriate when A migration plan calls for zero data loss even though database replication is asynchronous. Asynchronous cross-Region replication cannot guarantee zero committed-transaction loss.

For the separate situation A customer-facing API needs recovery within an hour but cannot justify full active-active deployment, Implement a warm standby stack with preprovisioned reduced-capacity resources could be useful. Warm standby trades steady-state cost for faster recovery than backup-only or pilot light.

Reconcile the zero-RPO requirement with synchronous replication or transaction acceptance changes would address a different requirement: A migration plan calls for zero data loss even though database replication is asynchronous. Asynchronous cross-Region replication cannot guarantee zero committed-transaction loss.

This alternative, Design a suitably replicated multi-Region active-active architecture with tested conflict handling, is appropriate when An essential payments service requires near-zero recovery downtime across regional disruptions. Active-active serves traffic in multiple Regions without waiting to create standby infrastructure.

For the separate situation An application has a four-hour RTO but recovery requires core infrastructure ready with no application fleet running, Choose a pilot-light recovery pattern for persistent essential services could be useful. Pilot light retains critical foundations while scaling application capacity during recovery.

This alternative, Select a backup-and-restore recovery pattern with tested restore runbooks, is appropriate when A noncritical nightly batch service can lose several hours of work and recover the following day. A long RTO and RPO justify inexpensive recovery from stored backups.

For the separate situation A customer-facing API needs recovery within an hour but cannot justify full active-active deployment, Implement a warm standby stack with preprovisioned reduced-capacity resources could be useful. Warm standby trades steady-state cost for faster recovery than backup-only or pilot light.

Choose a pilot-light recovery pattern for persistent essential services solves the related scenario An application has a four-hour RTO but recovery requires core infrastructure ready with no application fleet running; pilot light retains critical foundations while scaling application capacity during recovery.

For the separate situation A customer-facing API needs recovery within an hour but cannot justify full active-active deployment, Implement a warm standby stack with preprovisioned reduced-capacity resources could be useful. Warm standby trades steady-state cost for faster recovery than backup-only or pilot light.

Reconcile the zero-RPO requirement with synchronous replication or transaction acceptance changes solves the related scenario A migration plan calls for zero data loss even though database replication is asynchronous; asynchronous cross-Region replication cannot guarantee zero committed-transaction loss.

Although Select a backup-and-restore recovery pattern with tested restore runbooks can be valid when A noncritical nightly batch service can lose several hours of work and recover the following day, it targets a different technical condition. A long RTO and RPO justify inexpensive recovery from stored backups.

Choose a pilot-light recovery pattern for persistent essential services solves the related scenario An application has a four-hour RTO but recovery requires core infrastructure ready with no application fleet running; pilot light retains critical foundations while scaling application capacity during recovery.

Select a backup-and-restore recovery pattern with tested restore runbooks would address a different requirement: A noncritical nightly batch service can lose several hours of work and recover the following day. A long RTO and RPO justify inexpensive recovery from stored backups.

This alternative, Design a suitably replicated multi-Region active-active architecture with tested conflict handling, is appropriate when An essential payments service requires near-zero recovery downtime across regional disruptions. Active-active serves traffic in multiple Regions without waiting to create standby infrastructure.