SAP-C02 Practice Test 15 — 15 Questions

Question 1

A company is designing a new global application that will serve users worldwide. The application uses an Application Load Balancer (ALB) in a single region. To reduce latency for users in other regions, the company wants to cache static content at edge locations. The dynamic content must still be served from the ALB. Which configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon CloudFront with multiple origins: S3 for static content and ALB for dynamic content. It uses Amazon CloudFront with multiple origins: an S3 bucket for static content (cached at edge locations) and the ALB for dynamic content (forwarded to the origin). This configuration meets the requirement to reduce latency for static assets via edge caching while ensuring dynamic requests are always served from the ALB, avoiding stale or incorrect responses.

Answer

AWS Global Accelerator with the ALB as the endpoint

Answer

Amazon CloudFront with the ALB as the origin

Answer

Amazon S3 Transfer Acceleration for static content

Question 2

A company is running a containerized application on Amazon ECS with Fargate launch type. The application needs to store persistent data that must be shared across multiple containers in the same task. Which storage option should the company use?

Accepted Answer

Amazon EFS file system. Amazon EFS provides a shared, persistent, and scalable NFS file system that can be mounted concurrently by multiple containers within the same ECS task using Fargate. EFS supports the NFSv4.1 protocol, enabling simultaneous read/write access from multiple containers, which meets the requirement for shared persistent storage across containers in the same task.

Answer

Amazon S3 bucket mounted using s3fs

Answer

Amazon FSx for Lustre

Answer

Amazon EBS volume

Question 3

A company is modernizing a legacy application by breaking it into microservices. The application currently uses a single relational database. The company wants to adopt a microservices architecture with separate databases per service. Which THREE patterns should the company consider? (Choose THREE.)

Accepted Answer

API Gateway. (API Gateway) is correct for routing requests to appropriate microservices. Option C (Database per Service) is correct as it aligns with the requirement for separate databases per service. Option D (Event Sourcing) is correct for maintaining data consistency across services. Option B (Shared Database) is incorrect because it would create coupling. Option E (CQRS) is incorrect because it is a pattern for read/write separation, not a primary pattern for microservices with separate databases.

Answer

Shared Database

Answer

Command Query Responsibility Segregation (CQRS)

Question 4

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 5

A company is designing a new microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which THREE mechanisms can be used for service-to-service communication? (Choose THREE.)

Accepted Answer

Amazon API Gateway as a front end. Amazon API Gateway acts as a front-end proxy that can route requests to ECS Fargate services, enabling synchronous service-to-service communication via RESTful or WebSocket APIs. It handles authentication, throttling, and request transformation, making it a suitable mechanism for external or internal service calls.

Answer

Amazon SQS queues between services

Answer

Amazon DynamoDB as a communication channel

Question 6

A company is designing a new application that will store sensitive user data in Amazon S3. Compliance requirements mandate that all data must be encrypted at rest using a key that is managed by the company and rotated automatically every year. Which solution meets these requirements?

Accepted Answer

Use S3 server-side encryption with AWS KMS customer managed keys (SSE-KMS) and enable automatic key rotation.. SSE-KMS with customer managed keys (CMKs) meets the compliance requirements because it allows the company to manage the encryption key lifecycle, including automatic annual rotation. AWS KMS supports automatic key rotation for customer managed keys, which can be configured to rotate every year, satisfying the mandate for company-managed keys with automatic rotation.

Answer

Use client-side encryption with the AWS SDK.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C).

Answer

Use S3 server-side encryption with S3 managed keys (SSE-S3).

Question 7

A company is migrating a 10 TB SQL Server database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. The source database is running on-premises with a 1 Gbps network link to AWS. Which strategy should be used to reduce the migration downtime?

Accepted Answer

Use AWS Database Migration Service (DMS) with full load and ongoing replication.. AWS Database Migration Service (DMS) is the correct choice because it combines a full load of the existing data with ongoing replication to capture incremental changes, minimizing downtime. Option A allows the target Aurora database to stay in sync with the source SQL Server until a cutover. Option B (backup/restore) requires significant downtime to take and restore the backup, and does not support ongoing replication. Option C (SCT) only converts the schema and exports data, missing the replication needed for minimal downtime. Option D is incorrect because an Aurora read replica can only be created from another Aurora DB instance, not from an on-premises database.

Answer

Take a full backup of the SQL Server database, upload it to Amazon S3, and restore to Aurora.

Answer

Use AWS Schema Conversion Tool (SCT) to convert the schema, then export data to flat files and upload to S3.

Answer

Create an Amazon Aurora read replica from the on-premises database.

Question 8

A company is designing a multi-account AWS environment using AWS Organizations. The security team requires that all Amazon S3 buckets across accounts must have server access logging enabled and must block public access. What is the MOST scalable and secure way to enforce these requirements?

Accepted Answer

Apply service control policies (SCPs) at the organizational unit (OU) level to deny actions that disable logging or enable public access. Service control policies (SCPs) at the OU level are the most scalable and secure way to enforce guardrails across all accounts in an AWS Organization. By denying actions that disable server access logging (e.g., s3:PutBucketLogging with a condition that the logging target is not set) and actions that enable public access (e.g., s3:PutBucketPublicAccessBlock with a condition that the block is not set to true), SCPs prevent non-compliant configurations from being created or modified, regardless of the IAM principal used. This approach is centralized, immutable by child accounts, and scales automatically as new accounts are added to the OU.

Answer

Use AWS CloudFormation StackSets to deploy S3 buckets with logging and public access blocks

Answer

Create IAM roles in each account with policies that require logging and block public access

Answer

Use AWS Config rules to detect non-compliant buckets and send notifications

Question 9

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Accepted Answer

The policy does not deny requests that omit the encryption header. The bucket policy only requires encryption but does not explicitly deny requests that omit the `x-amz-server-side-encryption` header. Without a `Deny` effect for requests lacking the header, the policy is effectively a statement of intent rather than an enforcement mechanism. S3 bucket policies can enforce encryption by using a `Deny` statement with a condition key like `s3:x-amz-server-side-encryption` set to `AES256`.

Answer

S3 bucket policies cannot enforce encryption; you must use bucket default encryption

Answer

The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

The policy does not apply to objects uploaded using AWS KMS managed keys

Question 10

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.. AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts. Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Answer

Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

Answer

Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

Answer

Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

Question 11

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Accepted Answer

The application is redirecting health checks to another URL.. The ALB health check expects a 200 OK response from the target. A 302 redirect indicates the application is responding with a redirect (e.g., HTTP to HTTPS or to a login page) instead of a success status. This causes the health check to fail because the ALB does not follow redirects for health checks; it only accepts the configured success codes (default 200).

Answer

The application is returning a 500 Internal Server Error.

Answer

The application is taking too long to respond.

Answer

The security group is blocking health check traffic.

Question 12

A company is migrating a stateful application that uses local storage on EC2. They want to modernize to a stateless architecture using Amazon EFS for shared storage. What is the best approach to migrate the existing data?

Accepted Answer

Copy data from local storage to EFS using AWS DataSync during a maintenance window. The best approach is to use AWS DataSync to copy data from the local EC2 instance storage to Amazon EFS during a maintenance window, then reconfigure the application to use EFS as shared storage. Option A (AWS FSx for Lustre with S3) is overcomplicated and not appropriate for a simple shared file system migration to EFS. Option C (detach EBS volume and attach to new instance) is not stateless and does not enable shared access. Option D (EBS snapshot restore) retains the stateful nature and does not provide shared storage.

Answer

Use AWS Fsx for Lustre with S3 as data repository

Answer

Detach the EBS volume and attach it to the new EC2 instance

Answer

Create an EBS snapshot and restore it on the new instance

Question 13

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Accepted Answer

Configure Amazon EBS snapshots to be taken every 15 minutes.. Taking Amazon EBS snapshots every 15 minutes ensures that the RPO of 15 minutes is met, as the maximum data loss is limited to the interval between snapshots. Option E is correct because copying EBS snapshots to another AWS Region and automating their restoration into EBS volumes enables cross-region recovery, which is necessary since the application runs in a single Region and the RTO of 2 hours allows time for the restore process.

Answer

Use Amazon EBS Multi-Attach to attach volumes to instances in another region.

Answer

Use AWS Backup to create a backup plan with a daily backup.

Answer

Use AWS CloudFormation to recreate the EC2 instances from a template.

Question 14

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Accepted Answer

Configure the ALB as internet-facing and attach it to multiple Availability Zones.. An internet-facing Application Load Balancer (ALB) must be attached to multiple Availability Zones (AZs) to provide high availability and fault tolerance. If the ALB is configured in only one AZ, a failure in that AZ would render the application unreachable. Option C is correct because EC2 instances must be launched in at least two AZs to serve as healthy targets for the ALB, ensuring that traffic can be routed to instances in another AZ if one AZ fails.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Answer

Assign Elastic IP addresses to each EC2 instance.

Question 15

A company is migrating its on-premises VMware virtual machines to AWS. The company wants to use the same VM images and has a 10 Gbps direct connect link. Which service should be used to automate the migration of the VMs?

Accepted Answer

AWS VM Import/Export. AWS VM Import/Export enables the import of existing VM images (including VMware) from on-premises into EC2, making it the correct choice for migrating existing VM images. Option A (AWS Migration Hub) is a tracking and management service, not a migration tool. Option B (AWS DataSync) is used for transferring file and object storage, not VM images. Option D (AWS Server Migration Service) is deprecated and is not the recommended service for this use case; AWS Application Migration Service (MGN) is the modern replacement, but VM Import/Export directly supports importing images without agent installation.

Answer

AWS Migration Hub

Answer

AWS DataSync

Answer

AWS Server Migration Service