AWS Certified Solutions Architect Professional - SAP-C02

1. A large enterprise has 40 AWS accounts organized across 5 business units. Each business unit has its own VPCs in multiple AWS Regions. The network team requires full any-to-any connectivity between all VPCs within the same Region, centralized routing policy enforcement, and the ability to isolate traffic between business units. Which architecture best meets these requirements?

2. A company is connecting its on-premises data center to AWS using AWS Direct Connect. The connection must provide 10 Gbps of dedicated throughput. The network team wants to increase aggregate bandwidth to 20 Gbps and achieve link redundancy without managing multiple separate logical connections in BGP. Which Direct Connect feature should the solutions architect recommend?

3. An enterprise uses AWS Direct Connect to connect its on-premises data center to three AWS Regions. The company wants to use a single Direct Connect connection to access VPCs in all three Regions without establishing separate private virtual interfaces for each Region. Which AWS service enables this architecture?

4. A company has an AWS Site-to-Site VPN connection using BGP dynamic routing between its on-premises router and an AWS Virtual Private Gateway. The network team reports that the VPN is routing all on-premises traffic to AWS, including internet-bound traffic, which is causing performance issues. The team wants only traffic destined for the VPC CIDR to traverse the VPN tunnel. Which configuration change resolves this issue?

5. A company needs to provide remote employees with access to internal AWS-hosted applications. The solution must support certificate-based mutual TLS authentication, allow employees to access only specific VPC resources based on their Active Directory group membership, and must not route employee internet traffic through the AWS environment. Which service and configuration meets all requirements?