SAP-C02 Practice Test 10 — 10 Questions

Question 1

Match each AWS security service to its purpose.

Question 2

A company is designing a new application that will process sensitive data. The application will run on Amazon ECS with Fargate. The security team requires that all data at rest be encrypted, and that encryption keys be managed by the company's own hardware security module (HSM) in an on-premises data center. Which TWO steps should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS CloudHSM to generate and store encryption keys. Option C is correct because AWS CloudHSM provides dedicated, single-tenant HSM instances that the company can use to generate and store encryption keys in its own HSM, meeting the requirement that keys be managed by the company's own HSM in an on-premises data center (though CloudHSM is in AWS, it is customer-controlled). Option D is correct because creating an AWS KMS custom key store backed by AWS CloudHSM allows the company to use KMS for encryption operations while the key material is stored in the CloudHSM cluster, satisfying the need for customer-managed HSM-backed keys.

Answer

Configure Amazon EBS encryption using AWS KMS with a customer managed key

Answer

Enable Amazon S3 default encryption with SSE-C

Answer

Store encryption keys in AWS Certificate Manager (ACM)

Question 3

A company is using AWS DMS to migrate a SQL Server database to Amazon Redshift. The initial full load completed, but the ongoing replication task failed with the error shown. What is the MOST likely cause?

Accepted Answer

The source SQL Server transaction log has not been backed up or truncated, causing it to become full.. The error indicates that AWS DMS cannot read the source SQL Server transaction log to capture ongoing changes. This typically occurs when the transaction log is full because it has not been backed up or truncated, preventing DMS from reading new log records for continuous replication. DMS relies on the source database's transaction log for CDC (Change Data Capture), and a full log blocks this process.

Answer

The DMS task is not configured to use a task log for troubleshooting.

Answer

The target Redshift table does not have a primary key defined for the DMS task to apply changes.

Answer

The DMS task is using a full LOB mode, which is not supported for Redshift targets.

Question 4

Refer to the exhibit. A company uses this IAM policy to allow an automation script to manage Amazon EBS snapshots. The script runs on an EC2 instance with this attached IAM role. The script is failing when trying to create a snapshot from a volume and tag it. The error message indicates an authorization failure. What is the root cause?

Accepted Answer

The policy does not grant permission to call ec2:CreateSnapshot on the volume resource.. The error occurs because the IAM policy grants `ec2:CreateSnapshot` only on the `arn:aws:ec2:*::snapshot/*` resource, but the API call to create a snapshot also requires permission on the source volume resource (`arn:aws:ec2:*:*:volume/*`). Without that volume-level permission, the request fails with an authorization error, even though the snapshot-level permission is present.

Answer

The policy does not grant permission to call ec2:DescribeSnapshots, which is required before creating a snapshot.

Answer

The policy lacks a condition key to restrict the snapshot creation to specific volumes.

Answer

The policy does not include ec2:CreateTags for the volume, only for snapshots.

Question 5

A company is migrating its on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size and has a 24-hour maintenance window on weekends. The company needs to minimize downtime and ensure data consistency. Which strategy should the solutions architect recommend?

Accepted Answer

Use AWS DMS with ongoing replication from the on-premises database to Aurora, then perform a cutover during the maintenance window.. AWS DMS with ongoing replication (change data capture, CDC) allows the on-premises PostgreSQL database to be continuously synchronized with the target Aurora PostgreSQL cluster, minimizing downtime. When the cutover is performed during the 24-hour maintenance window, data consistency is ensured because all changes up to that point have been replicated. This approach avoids the need for a lengthy full database dump and restore, which would cause extended downtime.

Answer

Create an Aurora read replica from the on-premises database using a VPN connection.

Answer

Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and then use AWS Database Migration Service (AWS DMS) with full load only.

Answer

Perform a full pg_dump of the on-premises database and restore it to Aurora using pg_restore.

Question 6

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

Question 7

Drag and drop the steps to restore an Amazon RDS DB instance from a snapshot in the correct order.

Question 8

Drag and drop the steps to configure an S3 bucket as a static website hosting in the correct order.

Question 9

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Question 10

Drag and drop the steps to set up a Direct Connect private virtual interface in the correct order.