AWS Certified Professional SAP-C02 Dumps PDF

Answer B (AWS Global Accelerator) best meets both requirements: fastest failover from application failures and the lowest response time for global users. Global Accelerator is designed for global, latency-sensitive, highly available applications. It uses static Anycast IP addresses so users enter the AWS network at the nearest edge location, then traffic is carried over the AWS global backbone to the closest healthy regional endpoint (in this case, each Region’s ALB). It continuously performs health checks and can rapidly shift traffic away from unhealthy endpoints, which helps “handle application failures quickly” without being constrained by DNS caching behavior.

Why the other options are less suitable:

C (Route 53 latency-based routing + health checks) can improve routing and failover, but it is still DNS-based. DNS-based failover can be delayed by DNS resolver caching and TTL propagation, meaning failover may not be as fast or as consistent as Global Accelerator for rapid recovery.

A (CloudFront with origin group) can provide origin failover and performance benefits mainly for cacheable or edge-optimizable content. For a payment processing API (typically dynamic and not cache-friendly), CloudFront is not the primary service for achieving the least response time globally with fast multi-Region failover compared with Global Accelerator’s Anycast + edge routing model.

D (AWS Cloud WAN) addresses private network connectivity and centralized network policy across Regions/VPCs. It does not directly optimize public user-to-application latency or provide the same kind of edge-based, Anycast-driven rapid failover for internet-facing API endpoints.

The correct answer is C. This option uses AWS CloudTrail to create a trail in the organization’s management account that applies to all accounts in the organization. This way, the company can centrally manage and audit all API calls to AWS resources across multiple accounts and regions. The company also needs to create a new Amazon S3 bucket with versioning turned on to store the logs. Versioning helps protect against accidental or malicious deletion of log files by keeping multiple versions of each object in the bucket. The company also needs to enable MFA delete and encryption on the S3 bucket to further enhance the security and durability of the data store.

Option A is incorrect because it uses an existing S3 bucket in the organization’s management account to store the logs. This may not be optimal for regulatory compliance, as the existing bucket may have different permissions, encryption settings, or lifecycle policies than a dedicated bucket for CloudTrail logs.

Option B is incorrect because it requires creating a new CloudTrail trail in each member account of the organization. This adds operational overhead and complexity, as the company would need to manage multiple trails and S3 buckets across multiple accounts and regions.

Option D is incorrect because it requires configuring Amazon SNS to send log-file delivery notifications to an external management system that will track the logs. This adds unnecessary complexity and cost, as CloudTrail already provides log-file integrity validation and log-file digest delivery features that can help verify the authenticity and integrity of log files.