SAP-C02 Practice Test 19 — 15 Questions

Question 1

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Option B is correct because Amazon EFS provides a fully managed NFS file system that can be mounted by multiple EC2 instances concurrently with strong consistency. Option A is wrong because EBS volumes can only be attached to one instance at a time. Option C is wrong because S3 is object storage, not a file system. Option D is wrong because Storage Gateway file gateway provides file access to S3 but adds latency and consistency trade-offs.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 2

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.. SSE-KMS with automatic key rotation provides encryption at rest with automated key rotation, minimizing operational overhead. Option A (SSE-S3) does not support key rotation. Option C (client-side encryption) requires managing keys. Option D (SSE-C) requires managing keys.

Answer

Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

Answer

Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

Question 3

A company is building a data analytics pipeline. Raw data is ingested into an Amazon S3 bucket. The data must be transformed and loaded into Amazon Redshift for analysis. The pipeline must handle late-arriving data and ensure data consistency. Which THREE AWS services should the company use?

Accepted Answer

AWS Lambda. AWS Glue catalogs and transforms data, S3 stores raw data, and AWS Lambda can handle late-arriving data triggers. Option B (Kinesis Data Analytics) is for streaming. Option D (EMR) is for big data processing but adds complexity. Option E (RDS) is not suitable for analytics.

Answer

Amazon Kinesis Data Analytics

Answer

Amazon EMR

Question 4

A company wants to design a cost-effective solution to store infrequently accessed log files for 7 years. The logs are generated daily and must be available for retrieval within 24 hours. Which Amazon S3 storage class should be used?

Accepted Answer

S3 Glacier Deep Archive. Option B is correct because S3 Glacier Deep Archive is the lowest-cost storage for long-term archival with retrieval times of 12-24 hours. Option A is incorrect because S3 Standard is for frequently accessed data. Option C is incorrect because S3 Intelligent-Tiering is for unknown access patterns. Option D is incorrect because S3 One Zone-IA is for infrequent access but not long-term archive.

Answer

S3 One Zone-Infrequent Access

Answer

S3 Intelligent-Tiering

Answer

S3 Standard

Question 5

A company is designing a new application that will store sensitive data in Amazon S3. The data must be encrypted at rest using a key that is rotated every 90 days. The company wants to use AWS managed services to minimize operational overhead. Which encryption solution should they choose?

Accepted Answer

SSE-S3. Option A is correct because SSE-S3 uses S3-managed keys that are automatically rotated. Option B is wrong because SSE-KMS requires customer management of key rotation, though it can be automatic with KMS. Option C is wrong because SSE-C requires the customer to manage the keys. Option D is wrong because client-side encryption adds operational overhead.

Answer

SSE-C

Answer

Client-side encryption with AWS KMS

Answer

SSE-KMS with automatic rotation

Question 6

A company is designing a data lake on AWS using Amazon S3. They need to run SQL queries on the data without moving it to a separate database. Which AWS service should they use?

Accepted Answer

Amazon Athena. Option D is correct because Amazon Athena allows serverless SQL queries directly on S3 data. Option A is wrong because Redshift is a data warehouse, requires loading data. Option B is wrong because EMR is for big data processing. Option C is wrong because Glue is an ETL service.

Answer

Amazon EMR

Answer

Amazon Redshift

Answer

AWS Glue

Question 7

A financial services company needs to design a solution for storing sensitive customer data that must be encrypted at rest using a customer-managed key stored in AWS Key Management Service (KMS). The data will be accessed by multiple EC2 instances in an Auto Scaling group. The company needs to rotate the key every 90 days and ensure that old encrypted data can still be decrypted. Which key strategy should they use?

Accepted Answer

Use a customer-managed CMK and enable automatic key rotation.. Customer-managed CMKs support automatic key rotation (annual) and manual rotation. Old data remains decryptable because KMS retains previous backing keys. Using a customer-managed CMK allows the customer to control rotation and access policies.

Answer

Use AWS CloudHSM to generate a key and store it in a hardware security module.

Answer

Use an AWS managed key for S3 and enable automatic rotation.

Answer

Use a customer-managed CMK and generate a new key every 90 days, re-encrypting all data.

Question 8

Which TWO AWS services can be used to decouple components in a new microservices architecture? (Choose two.)

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SQS (message queue) and Amazon SNS (pub/sub) are both decoupling services that allow asynchronous communication between services.

Answer

AWS Direct Connect

Answer

Amazon Route 53

Answer

Amazon ElastiCache

Question 9

A company wants to decouple a front-end web application from a backend processing service to improve scalability. Which AWS service should be used to send tasks from the web tier to the processing tier?

Accepted Answer

Amazon Simple Queue Service (SQS). Option A is correct because Amazon SQS is a fully managed message queue that decouples application components. Option B is wrong because SNS is pub/sub, not a queue. Option C is wrong because Kinesis is for streaming data. Option D is wrong because EventBridge is for event buses, not simple task queues.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams

Question 10

A company is designing a cost-effective architecture for a batch processing job that runs nightly. The job can tolerate interruptions and requires significant compute power for a few hours. The company wants to minimize costs. Which TWO strategies should the company use?

Accepted Answer

Use Spot Instances for compute.. Using Spot Instances reduces cost, and Auto Scaling adjusts capacity. Option B (On-Demand) is more expensive. Option C (RI) requires commitment. Option D (Dedicated Hosts) is expensive.

Answer

Purchase Reserved Instances (RI) for a 1-year term.

Answer

Use On-Demand Instances to ensure availability.

Answer

Use Dedicated Hosts for compliance.

Question 11

A company is designing an event-driven architecture using Amazon EventBridge. They have multiple AWS accounts that need to receive events from a central account. What is the MOST scalable and secure way to route events to these accounts?

Accepted Answer

Use Amazon EventBridge cross-account event buses in each target account. Option D is correct because EventBridge cross-account event buses allow events to be sent directly to event buses in other accounts securely and scalably. Option A is incorrect because SNS topics have limited cross-account capabilities. Option B is incorrect because Kinesis Data Streams is not designed for event routing. Option C is incorrect because Lambda functions would require custom invocation logic.

Answer

Publish events to an AWS Lambda function in each target account

Answer

Use Amazon Kinesis Data Streams with cross-account access

Answer

Create an Amazon SNS topic in the central account and subscribe SQS queues in each target account

Question 12

A company wants to design a serverless event-driven architecture where multiple downstream services need to process events from a single source. Events must be reliably delivered and each downstream service must process every event independently. Which AWS service should be used as the event router?

Accepted Answer

Amazon EventBridge. Option A is correct because Amazon EventBridge can route events to multiple targets (e.g., Lambda, SQS, SNS) based on rules, and each target receives the event independently. Option B is wrong because Amazon SQS is a queue, not a router; it only delivers messages to a single consumer per message. Option C is wrong because AWS Step Functions is for orchestrating workflows, not for broadcasting events. Option D is wrong because Amazon Kinesis Data Streams is for real-time streaming, but each shard is processed by a single consumer; broadcasting requires multiple consumer applications.

Answer

AWS Step Functions

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Queue Service (SQS)

Question 13

A company is designing a disaster recovery solution for a critical database using Amazon RDS Multi-AZ. However, they also need to protect against regional failures. Which additional AWS service should they use?

Accepted Answer

RDS Cross-Region Read Replicas. Option B is correct because RDS Cross-Region Read Replicas provide a secondary database in another region for DR. Option A is wrong because Multi-AZ only protects within a single region. Option C is wrong because DMS is for migration, not DR. Option D is wrong because S3 is not a database DR solution.

Answer

RDS Multi-AZ in the same region

Answer

Amazon S3

Answer

AWS Database Migration Service

Question 14

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed to securely store secrets like database credentials and rotate them automatically. Lambda can retrieve them at runtime using the Secrets Manager API.

Answer

Amazon DynamoDB

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 15

A Solutions Architect runs the AWS CLI command shown in the exhibit. Which statement accurately describes the output?

Accepted Answer

The command lists all instances regardless of state.. The command uses the --query parameter to filter output and --output table. The query extracts InstanceId and State.Name, and the table format shows the results. The command does not filter by state; it returns all instances regardless of state.

Answer

The command lists instances in JSON format.

Answer

The command lists only running instances.

Answer

The command fails because --query is used incorrectly.