SAP-C02 Practice Test 16 — 15 Questions

Question 1

A company is designing a new real-time analytics platform that ingests millions of events per second from IoT devices. The events must be processed with low latency (under 100 ms) and stored for replay. The company wants to use managed services. Which combination of AWS services should the company use?

Accepted Answer

Amazon Kinesis Data Streams + AWS Lambda. Amazon Kinesis Data Streams can ingest and buffer millions of events per second with sub-100 ms latency, and AWS Lambda can process each record in near real-time as it arrives in the stream. This combination meets the low-latency requirement and allows events to be replayed from the stream's retention window (up to 365 days with extended retention).

Answer

Amazon S3 + AWS Lambda

Answer

Amazon Kinesis Data Firehose + Amazon Redshift

Answer

Amazon SQS + AWS Lambda

Question 2

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only T3 and M5 instances. Which SCP should be applied?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}. Option A is correct because it uses a Deny effect with a StringNotEquals condition on ec2:InstanceType to block any instance type that does not match the patterns 't3.*' or 'm5.*'. This effectively restricts all accounts in the organization to only T3 and M5 instance families when launching EC2 instances, as any attempt to use a non-allowed type will be denied. The wildcard (*) in the Resource element covers all resources, ensuring the policy applies broadly.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}

Question 3

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Accepted Answer

AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.. Option B is correct because AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Answer

Service control policies (SCPs) apply to all accounts in the organization, including the management account.

Answer

Each account in an organization must have its own payment method.

Answer

AWS Config rules cannot be applied across accounts via AWS Organizations.

Question 4

A company uses AWS Organizations with 100 accounts. They want to restrict which AWS services can be used in the development OU. Which TWO steps should they take?

Accepted Answer

Use an SCP with an Allow effect for allowed services.. Service control policies (SCPs) are the correct mechanism to centrally restrict which AWS services can be used across accounts in an AWS Organization. An SCP with an Allow effect explicitly permits only the specified services, while an SCP with a Deny effect blocks the specified services; both approaches achieve the goal of restricting service usage at the OU level. SCPs apply to all IAM users, roles, and root users in the member accounts, making them the appropriate tool for this requirement.

Answer

Use AWS CloudFormation StackSets to enforce service usage.

Answer

Use AWS Config rules to detect disallowed services.

Answer

Use IAM policies in each account to deny services.

Question 5

A company is using AWS Organizations with multiple accounts. The security team wants to enforce encryption at rest for all Amazon S3 buckets across the organization. The solution must be automated and should not prevent existing compliant buckets from being used. Which TWO services should be combined to achieve this?

Accepted Answer

AWS Config. Options A and C are correct because AWS Config can detect non-compliant buckets, and AWS CloudFormation StackSets can deploy a bucket policy to enforce encryption. Option B is wrong because SCPs cannot enforce encryption settings on existing buckets. Option D is wrong because AWS Trusted Advisor only provides recommendations, not enforcement. Option E is wrong because AWS Lambda alone cannot deploy policies across accounts without additional orchestration.

Answer

AWS Lambda

Answer

AWS Trusted Advisor

Answer

Service control policy (SCP)

Question 6

A company uses AWS Organizations and wants to centrally manage backups of EC2 instances across multiple accounts. Which service should they use?

Accepted Answer

AWS Backup. AWS Backup is the correct service because it provides a fully managed, policy-based backup solution that integrates with AWS Organizations to centrally manage backups across multiple accounts. It allows you to define backup policies that automatically apply to EC2 instances and other supported resources across all member accounts, ensuring compliance and centralized monitoring without requiring per-account manual configuration.

Answer

AWS CloudEndure Disaster Recovery

Answer

Amazon S3 Glacier

Answer

AWS Storage Gateway

Question 7

A company is using AWS Organizations with multiple accounts. The central IT team wants to enforce that all EC2 instances are launched with specific tags (e.g., CostCenter and Environment). The solution should prevent any untagged instances from being created. Which approach should be taken?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action if the required tags are not specified in the request.. Option D is correct because an SCP can deny the ec2:RunInstances action if the required tags are not present. Option A is wrong because AWS Config rules can detect non-compliance but cannot prevent the action. Option B is wrong because IAM policies in each account would require manual management. Option C is wrong because tagging is not enforced at launch.

Answer

Use AWS Service Catalog to provision EC2 instances only from pre-configured products that include required tags.

Answer

Use an AWS Config rule to detect untagged instances and trigger a Lambda function to terminate them.

Answer

Create an IAM policy for each account that requires tags on instance creation.

Question 8

A company has multiple AWS accounts and wants to centrally manage CloudWatch dashboards. Which solution should they use?

Accepted Answer

Use CloudWatch cross-account dashboards with a monitoring account.. CloudWatch cross-account dashboards allow you to create a single dashboard in a central monitoring account that displays metrics from multiple source accounts. This is the native AWS solution for centralized observability, requiring no additional data movement or custom code. The monitoring account uses the CloudWatch cross-account functionality to query metrics across accounts via IAM roles and the CloudWatch API.

Answer

Use AWS Config aggregator to view resources.

Answer

Use Amazon QuickSight with data sources from each account.

Answer

Use AWS CloudFormation StackSets to deploy dashboards in each account.

Question 9

A company uses AWS Organizations with a central logging account. They want to ensure that all VPC Flow Logs from member accounts are published to a central S3 bucket in the logging account. Which steps are required?

Accepted Answer

Configure VPC Flow Logs in each member account to deliver to a central S3 bucket using a bucket policy.. Option A is correct because VPC Flow Logs can be published directly to an S3 bucket in a different account by configuring the destination S3 bucket with a bucket policy that grants the required permissions (e.g., `AWS:SourceAccount` and `AWS:SourceArn`) to the member account's VPC Flow Logs service. This allows each member account to write flow logs directly to the central logging account's S3 bucket without needing intermediate services, aligning with AWS Organizations' centralized logging best practices.

Answer

Use Amazon Kinesis Data Firehose to stream logs to the central bucket.

Answer

Create a CloudWatch Logs subscription in the central account that receives logs from all accounts.

Answer

Create a CloudWatch Logs log group in each member account and use a subscription filter to forward to a central S3 bucket via Kinesis.

Question 10

A company is deploying a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The company wants to secure the API by requiring authentication via a JSON Web Token (JWT). Which service should the company use to manage user authentication and issue JWTs?

Accepted Answer

Amazon Cognito User Pools. Amazon Cognito User Pools is the correct choice because it is a fully managed identity provider that handles user sign-up, sign-in, and issues JSON Web Tokens (JWTs) for authentication. It integrates directly with API Gateway Lambda authorizers to validate JWTs and control access to API endpoints without custom code.

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Security Token Service (STS)

Question 11

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Accepted Answer

Use a service control policy that denies access to the unwanted services and attach it to the development OU.. Option A (attach SCP to the OU) and Option D (use a deny SCP for specific services) are correct. Option B is incorrect because tag policies don't restrict services. Option C is incorrect because IAM permissions boundaries do not override SCPs. Option E is incorrect because it would affect all OUs.

Answer

Apply a tag policy to the development OU that requires tags for all resources.

Answer

Modify the root-level SCP to deny the unwanted services.

Answer

Create an IAM permissions boundary for all users in the development OU.

Question 12

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.. Option C is correct because the AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Answer

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Answer

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Answer

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Question 13

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

Accepted Answer

Use Lambda reserved concurrency to set a limit on concurrent executions.. Option B is correct because Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Answer

Use Lambda provisioned concurrency to pre-warm instances.

Answer

Configure DynamoDB auto scaling to handle traffic spikes.

Answer

Set a usage plan in API Gateway with a throttling limit.

Question 14

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

Accepted Answer

Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.. Option A is correct because AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Answer

Use IAM Access Analyzer to detect and report IAM user creation.

Answer

Use an SCP to deny iam:CreateUser across all accounts.

Answer

Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

Question 15

A company is designing a new solution to process streaming data from IoT devices. The data must be ingested, processed in real-time, and stored in a data warehouse for analytics. The company expects millions of events per second. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams for ingestion, Amazon Kinesis Data Analytics for real-time processing, and Amazon S3 as a staging area before loading into Amazon Redshift.. Amazon Kinesis Data Streams can ingest millions of events per second with durable, ordered shards, while Kinesis Data Analytics provides real-time SQL or Apache Flink processing on the stream. Amazon S3 acts as a staging layer before loading into Amazon Redshift via COPY or Redshift Spectrum, enabling scalable analytics without throttling the ingestion pipeline.

Answer

Amazon Kinesis Data Firehose for ingestion and delivery to Amazon S3, then use AWS Glue for ETL into Amazon Redshift.

Answer

Amazon DynamoDB Streams for ingestion, AWS Lambda for processing, and Amazon Redshift for storage.

Answer

Amazon SQS for ingestion, AWS Lambda for processing, and Amazon DynamoDB for storage.