SAP-C02 Practice Test 2 — 10 Questions

Question 1

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

Accepted Answer

Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.. Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Answer

Migrate the application to use Amazon DynamoDB with global tables.

Answer

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Answer

Implement Amazon ElastiCache in front of the database to cache read queries.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 3

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Option D is correct because switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Question 4

A company is migrating a multi-tier application to AWS and wants to modernize by using containers and serverless technologies. The application consists of a Node.js frontend, a Java backend, and a PostgreSQL database. The company wants to reduce operational overhead and improve scalability. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Migrate the database to Amazon RDS for PostgreSQL. Option B is correct because Amazon RDS for PostgreSQL reduces operational overhead by managing backups, patching, and replication, while providing scalability through read replicas and storage auto-scaling. This aligns with the goal of modernizing the database layer without changing the database engine, avoiding the need to refactor the application to use a NoSQL database like DynamoDB.

Answer

Refactor the Node.js frontend to run on AWS Lambda with Amazon API Gateway

Answer

Migrate the database to Amazon DynamoDB

Answer

Deploy the Java backend on Amazon EC2 with Auto Scaling

Question 5

A company is migrating a monolithic .NET application to AWS. The application uses a SQL Server database with complex stored procedures and tightly coupled components. The migration team wants to minimize refactoring and reduce licensing costs. Which migration strategy should the team use?

Accepted Answer

Rehost the application on Amazon EC2 and the database on EC2 with SQL Server using Bring Your Own License (BYOL).. Option B is correct because rehosting (lift-and-shift) the monolithic .NET application on Amazon EC2 and the SQL Server database on EC2 with BYOL minimizes refactoring effort and reduces licensing costs by leveraging existing SQL Server licenses. This strategy avoids the complexity of rewriting stored procedures or decoupling tightly coupled components, which is critical for a migration focused on speed and cost reduction.

Answer

Refactor the application to .NET Core and use Amazon RDS for MySQL to eliminate Windows licensing.

Answer

Rearchitect the application to microservices and use Amazon DynamoDB for the database.

Answer

Replatform the database to Amazon Aurora with PostgreSQL compatibility to reduce licensing costs.

Question 6

A company is migrating a critical application to AWS and wants to ensure business continuity during the cutover. The migration plan includes a pilot light strategy. Which of the following BEST describes the pilot light pattern?

Accepted Answer

Replicate data to AWS and run a minimal version of the application that can be scaled up during cutover.. The pilot light pattern is a disaster recovery strategy where core data is continuously replicated to AWS, and a minimal version of the application (e.g., a small EC2 instance running the application stack) is kept running. During cutover, this minimal environment is rapidly scaled up to full production capacity. This matches option C, as it describes replicating data and running a minimal version that can be scaled up.

Answer

Take regular backups and restore them in AWS during cutover.

Answer

Run a scaled-down but fully functional version of the environment in AWS at all times.

Answer

Run the application simultaneously in both environments and route traffic to both.

Question 7

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Accepted Answer

The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.. Option C is correct because the S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Answer

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Answer

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Answer

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Question 8

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.

Question 9

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

Accepted Answer

Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.. Option C is correct because SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Answer

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Answer

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Answer

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Question 10

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.