SAP-C02 Practice Test 14 — 15 Questions

Question 1

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.. Option C is correct because AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Answer

AWS PrivateLink to route traffic through a centralized security appliance in a single account.

Answer

VPC Peering connections between all VPCs and use security groups to control traffic.

Answer

AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.

Question 2

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Answer

AWS Config

Answer

Amazon ECS

Answer

AWS OpsWorks

Question 3

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS KMS

Question 4

A company is deploying a multi-tier web application on AWS. The application must be highly available across three Availability Zones. The web tier runs on EC2 instances behind an Application Load Balancer (ALB). The application tier runs on EC2 instances behind a Network Load Balancer (NLB). The database tier uses a Multi-AZ RDS instance. To reduce cross-AZ data transfer costs, which design should be implemented?

Accepted Answer

Place web and application tier instances in the same subnets across all three AZs. Option D is correct because placing web and application tier EC2 instances in the same subnets across all three Availability Zones ensures that traffic between the ALB and NLB, as well as between the NLB and application instances, stays within the same AZ whenever possible. This design leverages the ALB's cross-zone load balancing behavior (enabled by default) and the NLB's ability to route traffic to targets in the same AZ, minimizing cross-AZ data transfer costs. AWS charges for data transfer between AZs, so keeping traffic within the same AZ reduces those costs while maintaining high availability across three AZs.

Answer

Use AWS Global Accelerator to reduce data transfer costs

Answer

Place all web tier instances in one AZ and all application tier instances in another AZ

Answer

Use a single AZ for all tiers to avoid cross-AZ traffic

Question 5

A company uses AWS Organizations with consolidated billing. The company wants to share a centrally managed Amazon VPC subnet across multiple accounts using AWS Resource Access Manager (RAM). Which THREE resources can be shared via RAM? (Choose THREE.)

Accepted Answer

License configurations. Option A is correct because AWS License Manager configurations can be shared across accounts using AWS Resource Access Manager (RAM), enabling centralized management of software licenses. This allows organizations to enforce license usage limits and rules consistently across multiple accounts in an AWS Organization.

Answer

VPC peering connections

Answer

Security groups

Question 6

A company is designing a new application that will store and retrieve large files (up to 5 TB). The files must be accessible via HTTPS and must be durable. Which AWS storage service should be used?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it supports objects up to 5 TB in size, provides HTTPS access via RESTful API endpoints, and offers 99.999999999% (11 nines) durability by automatically replicating data across multiple Availability Zones. S3 is purpose-built for storing and retrieving large files over the internet with high durability and scalability.

Answer

Amazon EFS

Answer

AWS Storage Gateway

Answer

Amazon EBS

Question 7

A company uses AWS Organizations and wants to ensure that all member accounts have AWS CloudTrail enabled and logs are delivered to a central S3 bucket in the management account. Which approach is MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail template to all accounts.. Option C is correct because AWS CloudFormation StackSets allow you to deploy a single CloudTrail template across all member accounts in an AWS Organization from a central management account. This approach is the most efficient as it automates the deployment, ensures consistent configuration, and delivers logs to the specified central S3 bucket without requiring manual intervention or per-account scripting.

Answer

Use AWS Config rules to detect accounts without CloudTrail and auto-remediate.

Answer

Manually enable CloudTrail in each account by logging into every account.

Answer

Create an SCP that requires CloudTrail to be enabled in each account.

Question 8

A multinational corporation is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs in different AWS Regions, and all VPCs must be able to authenticate against the same directory. The directory must be highly available and support automatic failover. What is the MOST operationally efficient solution?

Accepted Answer

Deploy AWS Managed Microsoft AD in each Region using multi-Region replication. Configure the directory as a global directory.. AWS Managed Microsoft AD with multi-Region replication provides a single global directory that spans multiple Regions, enabling automatic failover and high availability. This is the most operationally efficient solution because it eliminates the need for complex networking (VPC peering or VPNs) and allows all VPCs to authenticate against the same directory natively, with replication handled by AWS.

Answer

Use AWS Directory Service AD Connector in each VPC and point to an on-premises Active Directory.

Answer

Deploy AWS Managed Microsoft AD in one Region. Create VPC peering connections to all other VPCs.

Answer

Deploy AWS Managed Microsoft AD in one Region. Configure VPN connections from each VPC to this directory.

Question 9

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

Accepted Answer

Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.. Option D is correct because S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Answer

Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

Answer

Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

Question 10

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Option B is correct because Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 11

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. The security team needs to allow a third-party SIEM tool to read these logs from the S3 bucket, but only from a specific VPCE (VPC Endpoint). Which policy should be applied to the S3 bucket?

Accepted Answer

Deny s3:GetObject unless aws:SourceVpce matches the VPCE ID.. Option C is correct because using a bucket policy with a condition key like `aws:SourceVpce` allows you to restrict access to only requests originating from a specific VPC Endpoint (VPCE). This ensures that even if the SIEM tool has valid credentials, it can only read the VPC Flow Logs from the S3 bucket when the traffic comes through the designated VPCE, meeting the security team's requirement precisely.

Answer

Allow s3:GetObject to the SIEM's IAM role.

Answer

Use an S3 access point with a network origin policy.

Answer

Allow s3:GetObject to the SIEM's AWS account ID.

Question 12

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no IAM role in any member account can be assumed by a user from outside the organization. Which policy should be used?

Accepted Answer

Attach a service control policy (SCP) that denies sts:AssumeRole if the aws:PrincipalOrgID condition is not set.. Option D is correct because a service control policy (SCP) can centrally enforce that all IAM role trust policies in member accounts require the `aws:PrincipalOrgID` condition key. This condition ensures that only principals within the organization can assume roles, blocking any external user from assuming a role even if the role's trust policy is misconfigured. SCPs apply to all accounts in an OU or organization, providing a preventive control that cannot be overridden by account administrators.

Answer

Enable AWS CloudTrail to log role assumptions and send alerts when external assumptions occur.

Answer

Use AWS Config to detect roles with external trust relationships and automatically delete them.

Answer

Modify the trust policy of each IAM role to allow only principals from the organization.

Question 13

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 14

A company has a central IT account that manages DNS using Amazon Route 53 Private Hosted Zones. Multiple VPCs from different accounts are associated with the same private hosted zone. The company wants to ensure that only authorized VPCs can resolve records in the zone. Which three steps should be taken? (Choose THREE.)

Accepted Answer

Restrict IAM permissions to only allow authorized users to associate VPCs with the hosted zone.. Option B is correct because restricting IAM permissions ensures that only authorized users can associate VPCs with the private hosted zone, preventing unauthorized VPCs from resolving records. This is a fundamental security control for managing cross-account DNS resolution in Route 53.

Answer

Create a Route 53 Resolver rule in the central account to forward queries to the private hosted zone.

Answer

Create a VPC peering connection between the central account and each VPC.

Question 15

A company has a centralized logging account and multiple member accounts. The security team wants to enable VPC Flow Logs for all VPCs across all accounts and centralize the logs in the logging account. The solution must be automated and ensure that new VPCs are automatically included. Which approach should be taken?

Accepted Answer

Use an AWS Config rule to detect VPCs without Flow Logs and trigger an AWS Systems Manager Automation runbook to enable them, publishing to a centralized Amazon S3 bucket.. Option C is correct because AWS Config can continuously evaluate all VPCs against a custom rule that checks for the presence of VPC Flow Logs. When a non-compliant VPC is detected (including newly created ones), Config can trigger an AWS Systems Manager Automation runbook that enables Flow Logs and publishes them to a centralized Amazon S3 bucket in the logging account. This approach is fully automated, covers existing and new VPCs, and centralizes logs without requiring event-driven triggers that might miss resources created before the rule was deployed.

Answer

Use AWS CloudTrail to monitor VPC creation and invoke an AWS Lambda function to enable Flow Logs.

Answer

Use Amazon EventBridge to capture VPC creation events and trigger an AWS Lambda function to enable Flow Logs.

Answer

Use AWS Trusted Advisor to check VPC Flow Logs configuration and send alerts to an Amazon SNS topic.