SAP-C02 Practice Test 20 — 15 Questions

Question 1

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

Accepted Answer

Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.. Option D is correct because EBS encryption provides at-rest encryption, and TLS provides in-transit encryption. Option A is wrong because S3 is not used for EC2 volumes. Option B is wrong because KMS alone does not encrypt data. Option C is wrong because ACM manages certificates, not encryption.

Answer

Use Amazon S3 with server-side encryption and enforce HTTPS.

Answer

Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.

Answer

Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.

Question 2

An IAM policy is attached to an IAM role that is assumed by an EC2 instance. The EC2 instance has an IP address of 10.0.1.15. The instance is unable to download objects from the S3 bucket 'example-bucket'. What is the MOST likely cause?

Accepted Answer

The EC2 instance is using a public IP address to access S3, which does not match the 'aws:SourceIp' condition.. The condition restricts access to IP addresses in the 10.0.0.0/8 range. However, EC2 instances use public IPs when accessing S3, or private IPs via a VPC endpoint. If the instance uses a public IP, the condition fails. Option B (instance profile) is not an issue. Option C (permissions boundary) is not shown. Option D (bucket policy) is not shown.

Answer

The S3 bucket policy denies access to the IAM role.

Answer

The IAM role is not attached to the EC2 instance profile.

Answer

The policy lacks permissions for s3:ListBucket.

Question 3

A company is designing a new application that will run on Amazon EKS. The application requires persistent storage that can be accessed by multiple pods simultaneously. The storage must be highly available and durable. Which storage solution should be used?

Accepted Answer

Amazon EFS with One Zone storage classes. Option C is correct because Amazon EFS provides a shared file system that can be mounted by multiple pods concurrently, with high availability and durability. Option A is incorrect because EBS volumes can only be attached to a single EC2 instance, not multiple pods. Option B is incorrect because S3 is object storage, not file system. Option D is incorrect because FSx for Lustre is optimized for high-performance computing, not general shared storage.

Answer

Amazon EBS with gp3 volume type

Answer

Amazon S3 with Mountpoint for S3

Answer

Amazon FSx for Lustre

Question 4

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

Accepted Answer

AWS Transit Gateway and AWS Direct Connect with VPN backup. Option B is correct because AWS Transit Gateway connects multiple VPCs and on-premises networks, and AWS Direct Connect provides dedicated encrypted connections with low latency and high availability when combined with VPN. Option A is wrong because VPC Peering does not support transitive routing or encrypted connections. Option C is wrong because Client VPN is for individual users, not site-to-site connections. Option D is wrong because AWS Site-to-Site VPN alone does not provide the low latency and high bandwidth of Direct Connect.

Answer

AWS Site-to-Site VPN and VPC Endpoints

Answer

VPC Peering and AWS Site-to-Site VPN

Answer

AWS Client VPN and VPC Peering

Question 5

A company is designing a new application on AWS that requires a highly available and fault-tolerant architecture. Which TWO design principles should they follow?

Accepted Answer

Use Auto Scaling groups to automatically replace unhealthy instances.. Option A is correct because deploying across multiple Availability Zones ensures high availability. Option D is correct because using Auto Scaling groups helps maintain desired capacity and fault tolerance. Option B is wrong because a single instance is a single point of failure. Option C is wrong because a single Region does not protect against AZ failures. Option E is wrong because manual snapshots are not automated.

Answer

Manually create EBS snapshots every day.

Answer

Store data in a single Amazon S3 bucket in one Region.

Answer

Use a single large EC2 instance to simplify management.

Question 6

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

Accepted Answer

Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.. Amazon RDS Multi-AZ with a standby replica in a different region is not supported. However, cross-region read replicas can be promoted to a standalone instance in a disaster. For low RPO/RTO, using a cross-region read replica with automatic failover via Route 53 can achieve near-real-time replication and fast failover.

Answer

Use Amazon Aurora Global Database.

Answer

Use Amazon RDS with automated backups and restore in another Region.

Answer

Use Amazon RDS Multi-AZ with a standby in a different AWS Region.

Question 7

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

Accepted Answer

The template will create an S3 bucket with versioning enabled.. The template creates an S3 bucket with versioning enabled. The bucket name is specified, and versioning is enabled via the VersioningConfiguration property.

Answer

The template will create an S3 bucket with a random name.

Answer

The template will fail because the bucket name is not globally unique.

Answer

The template will create an S3 bucket with versioning disabled.

Question 8

A company is designing a new application that will be hosted on AWS. The application must be highly available across multiple Availability Zones. Which of the following services provide built-in high availability across AZs? (Choose TWO.)

Accepted Answer

Amazon RDS Multi-AZ. Option A (ELB) and Option C (RDS Multi-AZ) are correct. ELB distributes traffic across AZs and is highly available. RDS Multi-AZ provides a standby in another AZ with automatic failover. Option B (EC2) is not inherently HA; it requires an ASG and load balancer. Option D (EBS) is tied to a single AZ. Option E (S3) is automatically HA across AZs, but the question asks for services that provide built-in HA across AZs; S3 is HA across multiple AZs in a region, but the typical answer is ELB and RDS Multi-AZ. However, S3 is also HA. But the exam expects ELB and RDS Multi-AZ as correct. Let's follow that.

Answer

Amazon EBS volumes

Answer

Amazon EC2 instances

Answer

Amazon S3

Question 9

A company is designing a microservices architecture on Amazon ECS with Fargate. They want to ensure that services can communicate with each other but are isolated from the internet. What is the MOST secure way to achieve this?

Accepted Answer

Place all ECS services in private subnets and use AWS Cloud Map for service discovery.. Option A is correct because placing services in private subnets and using ECS service discovery with AWS Cloud Map allows internal DNS resolution without internet exposure. Option B is wrong because AWS PrivateLink is used for accessing services over endpoints, not service-to-service. Option C is wrong because VPC peering is for connecting VPCs, not for service discovery. Option D is wrong because placing in public subnets exposes services to the internet.

Answer

Use VPC peering to connect the subnets of each service.

Answer

Use AWS PrivateLink to create VPC endpoints for each service.

Answer

Place services in public subnets and use security groups to restrict inbound traffic.

Question 10

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. Options A, B, and D are correct. Placing web tier instances in a private subnet (A) ensures they are not internet-facing. Using a security group for the database that allows inbound traffic only from the web tier security group (B) restricts access. Enabling the 'publicly accessible' flag to 'No' (D) ensures no public endpoint. Option C is wrong because placing the database in a public subnet would expose it. Option E is wrong because storing secrets in Parameter Store is for credentials, not network access.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 11

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as the origin.. Option C is correct because Amazon CloudFront is a CDN that caches content at edge locations, reducing latency and cost for data transfer. Option A is wrong because S3 alone does not provide edge caching. Option B is wrong because Global Accelerator improves network path but does not cache content. Option D is wrong because EC2 instances would require management and scaling.

Answer

Use AWS Global Accelerator with endpoints pointing to the S3 bucket.

Answer

Deploy EC2 instances in multiple Regions and use a load balancer.

Answer

Host the content directly from the S3 bucket and use S3 Transfer Acceleration.

Question 12

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

Accepted Answer

Configure an Auto Scaling group with a target tracking scaling policy based on average CPU utilization.. Using a target tracking scaling policy based on average CPU utilization automatically adjusts capacity to maintain a target utilization, preventing over-provisioning. Option A (increase instance size) is not scalable and may be costly. Option C (use Spot Instances) can introduce interruptions. Option D (add a cache layer) addresses different issues.

Answer

Add Amazon ElastiCache to cache database queries.

Answer

Use Spot Instances to reduce costs and scale horizontally.

Answer

Increase the EC2 instance size to handle peak loads.

Question 13

A company wants to give its developers access to specific Amazon S3 buckets based on their team membership. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which approach should the company use to grant fine-grained access?

Accepted Answer

Create an IAM policy that allows access to specific buckets based on tags, and assign the policy to an IAM role that developers can assume.. Using attribute-based access control (ABAC) with IAM Identity Center allows dynamic permissions based on user attributes like team. Option B (IAM groups) is less dynamic. Option C (S3 bucket policies) is not tied to user attributes. Option D (resource-based policies) is not scalable.

Answer

Create separate IAM groups for each team and attach policies granting access to the appropriate buckets.

Answer

Use resource-based policies on the buckets to allow access from the IAM Identity Center users.

Answer

Use S3 bucket policies that grant access to specific IAM users based on their usernames.

Question 14

A company is migrating a monolithic application to microservices on Amazon ECS. The application needs to communicate with external partners via HTTPS. The company wants to use mTLS for mutual authentication. Which AWS service should be used to handle the mTLS termination?

Accepted Answer

Application Load Balancer (ALB) with mutual TLS. Option D is correct because Application Load Balancer supports mTLS authentication. Option A is incorrect because CloudFront does not natively support mTLS. Option B is incorrect because Network Load Balancer does not support mTLS. Option C is incorrect because API Gateway supports mTLS only in REST API mode, not HTTP API, and is less suitable for ECS.

Answer

Amazon CloudFront with a custom origin

Answer

Network Load Balancer (NLB) with TLS termination

Answer

Amazon API Gateway HTTP API

Question 15

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Accepted Answer

CloudFormation cross-stack references using Export and ImportValue. Option B is correct because AWS CloudFormation cross-stack references allow you to export stack outputs and import them into other stacks using the Fn::ImportValue function. Option A is incorrect because Systems Manager Parameter Store can store parameters but is not the native CloudFormation way. Option C is incorrect because Secrets Manager is for secrets. Option D is incorrect because SNS is for notifications.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store