SAP-C02 — frequently asked questions

VPC peering is not a high-availability mechanism. It connects two VPCs but does not provide redundancy against AZ failures or instance crashes within those VPCs.

No. You cannot directly move a running EC2 instance to a different VPC. You must create a new instance in the target VPC from a snapshot or AMI, which disrupts service.

An outbound Resolver endpoint forwards DNS queries from VPCs to on-premises resolvers; on-premises systems need an inbound endpoint to query Route 53 private hosted zones.

No. Local association lets each VPC answer cloud.example.com directly, avoiding hairpins through the shared services VPC and improving resolution performance.

SCPs are filters, not grants; an explicit deny at the organization root still applies to every child OU and account, so a lower-level allow cannot take effect while the root deny remains.

Moving it keeps the same deny-list protections for Production accounts while freeing the new account in Onboarding to update AWS Config; deleting it would remove enforcement for everyone.

A TGW routes traffic between VPCs but does not grant accounts permission to launch resources in another account's subnets; the requirement is delegated subnet use via AWS RAM.

AWS RAM sharing with an OU requires resource sharing enabled at the organization level; without it, the infrastructure account's resource share cannot target the OU.

Its per-GB storage is cheaper, but restoring archived objects takes hours and adds retrieval/request costs; without a restore workflow the intranet cannot serve them directly.

Because the archive is a secondary copy, losing one Availability Zone does not lose the only copy, and One Zone-IA costs less than Standard-IA.

VPC Flow Logs are delivered to CloudWatch Logs (or S3/Firehose), not CloudTrail, which records AWS API activity rather than packet flows.

The visible inbound record only shows the public IP sending traffic; the reverse flow with dstAddr 198.51.100.2 and srcAddr 203.0 shows whether the EC2 instance initiated the connection first.

DMS writes change data as CSV or Parquet in S3, not a restorable Aurora cluster. Restoring would require ETL and reload, so it does not meet the database DR requirement.

Aurora automated backups cannot be disabled; retention is managed at the DB cluster level. That makes option D not implementable as written.

Quick Insights is produced by Migration Evaluator; Migration Hub visualizes ADS discovery data but does not replace the Migration Evaluator Collector or its assessment workflow.

Agentless collection is useful for inventory, but application dependency visualization often needs agent-based inbound/outbound network connection data, especially when the scenario permits installing agents on every VM.