SAP-C02 Practice Test 1 — 10 Questions

Question 1

Match each AWS compute service to its use case.

Question 2

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Answer

Amazon ECS Service Discovery

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 private hosted zones

Question 3

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Accepted Answer

Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.. Option C is correct because partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Answer

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Answer

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Answer

Use Athena with federated query to scan logs directly from the application accounts.

Question 4

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Accepted Answer

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Answer

Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

Answer

Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

Answer

Enable AWS Resource Access Manager to share resources only with trusted accounts.

Question 5

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.. Option D is correct because AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Answer

Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.

Answer

Set up AWS Direct Connect gateway and route all traffic through the security account.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.

Question 6

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. Option A is correct because StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 7

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Accepted Answer

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.. Option A is correct because it combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Answer

Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

Answer

Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

Answer

Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

Question 8

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

Accepted Answer

Use a separate Amazon RDS instance for each microservice. Option B is correct because a microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Answer

Use Amazon RDS Proxy with a single database

Answer

Use Amazon DynamoDB for all microservices

Answer

Use a single Amazon RDS instance shared across all microservices

Question 9

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

Accepted Answer

Use AWS App Mesh with Envoy sidecars. AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Answer

Use Amazon API Gateway with VPC Link

Answer

Use an Application Load Balancer with target groups per service

Answer

Use Amazon Route 53 with weighted routing policies

Question 10

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption