SAP-C02 Practice Exam 1 — 20 Questions

Question 1

Match each AWS compute service to its use case.

Question 2

A company is designing a new microservices architecture on AWS. They need a solution for service discovery that allows services to register themselves and discover other services dynamically. The solution must be highly available and integrated with AWS-native services. Which AWS service should they use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is the correct choice because it is a fully managed service discovery service that allows microservices to register themselves dynamically and discover other services via DNS or HTTP API calls. It integrates natively with AWS services like Amazon ECS, Amazon EKS, and AWS Lambda, and provides high availability through automatic health checking and resource synchronization across AWS Regions.

Answer

Amazon ECS Service Discovery

Answer

Application Load Balancer (ALB)

Answer

Amazon Route 53 private hosted zones

Question 3

A company has a centralized logging account and multiple application accounts. All VPC Flow Logs are sent to a central S3 bucket in the logging account. The security team needs to analyze the logs using Amazon Athena. The team must ensure queries are cost-effective and return results quickly for recent logs. Which configuration should be used?

Accepted Answer

Partition the S3 bucket by date (e.g., year/month/day) and use Athena partition projection.. Option C is correct because partitioning the S3 bucket by date (e.g., year/month/day) and using Athena partition projection allows Athena to automatically discover and prune partitions without manual metadata management. This reduces the amount of data scanned per query, lowering costs and improving query speed for recent logs. Partition projection is serverless and eliminates the need for Glue crawlers or Hive-style partition loading, making it ideal for time-series data like VPC Flow Logs.

Answer

Convert the logs to Parquet format using AWS Glue and store them in the same bucket.

Answer

Use S3 lifecycle policies to transition logs to S3 Glacier after 7 days and query with Athena.

Answer

Use Athena with federated query to scan logs directly from the application accounts.

Question 4

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Accepted Answer

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Answer

Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

Answer

Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

Answer

Enable AWS Resource Access Manager to share resources only with trusted accounts.

Question 5

A company is designing a cross-account network architecture. The security team requires that all traffic between VPCs in different accounts must be inspected by a centralized firewall appliance in the security account. The network team wants to minimize complexity and avoid route table manipulation. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway with a central appliance VPC, and configure route tables to send traffic to the firewall for inspection.. Option D is correct because AWS Transit Gateway (TGW) allows you to centralize network traffic through a security appliance VPC. By attaching all VPCs to a single TGW and configuring route tables to route inter-VPC traffic to the firewall appliance in the security VPC, you meet the inspection requirement without manual route table manipulation in each spoke VPC. This design minimizes complexity by using a hub-and-spoke topology with centralized routing control.

Answer

Use AWS PrivateLink to connect each VPC to the security VPC via interface endpoints.

Answer

Set up AWS Direct Connect gateway and route all traffic through the security account.

Answer

Create VPC peering connections between each VPC and the security VPC, then configure route tables to route traffic through the firewall.

Question 6

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. Option A is correct because StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 7

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Accepted Answer

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.. Option A is correct because it combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Answer

Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

Answer

Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

Answer

Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

Question 8

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

Accepted Answer

Use a separate Amazon RDS instance for each microservice. Option B is correct because a microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Answer

Use Amazon RDS Proxy with a single database

Answer

Use Amazon DynamoDB for all microservices

Answer

Use a single Amazon RDS instance shared across all microservices

Question 9

A company is designing a microservices architecture on Amazon ECS with AWS Fargate. The services need to communicate with each other using HTTP APIs. The company wants to minimize operational overhead and enable canary deployments. Which solution should the company use for service discovery and traffic routing?

Accepted Answer

Use AWS App Mesh with Envoy sidecars. AWS App Mesh with Envoy sidecars provides a service mesh that handles service discovery, traffic routing, and canary deployments at the application layer. It integrates natively with ECS Fargate, offloading operational overhead by managing traffic splitting, retries, and observability without modifying application code. This makes it ideal for microservices requiring fine-grained control over HTTP traffic routing.

Answer

Use Amazon API Gateway with VPC Link

Answer

Use an Application Load Balancer with target groups per service

Answer

Use Amazon Route 53 with weighted routing policies

Question 10

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 11

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

Accepted Answer

Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.. Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Answer

Migrate the application to use Amazon DynamoDB with global tables.

Answer

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Answer

Implement Amazon ElastiCache in front of the database to cache read queries.

Question 12

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 13

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Option D is correct because switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Question 14

A company is migrating a multi-tier application to AWS and wants to modernize by using containers and serverless technologies. The application consists of a Node.js frontend, a Java backend, and a PostgreSQL database. The company wants to reduce operational overhead and improve scalability. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Migrate the database to Amazon RDS for PostgreSQL. Option B is correct because Amazon RDS for PostgreSQL reduces operational overhead by managing backups, patching, and replication, while providing scalability through read replicas and storage auto-scaling. This aligns with the goal of modernizing the database layer without changing the database engine, avoiding the need to refactor the application to use a NoSQL database like DynamoDB.

Answer

Refactor the Node.js frontend to run on AWS Lambda with Amazon API Gateway

Answer

Migrate the database to Amazon DynamoDB

Answer

Deploy the Java backend on Amazon EC2 with Auto Scaling

Question 15

A company is migrating a monolithic .NET application to AWS. The application uses a SQL Server database with complex stored procedures and tightly coupled components. The migration team wants to minimize refactoring and reduce licensing costs. Which migration strategy should the team use?

Accepted Answer

Rehost the application on Amazon EC2 and the database on EC2 with SQL Server using Bring Your Own License (BYOL).. Option B is correct because rehosting (lift-and-shift) the monolithic .NET application on Amazon EC2 and the SQL Server database on EC2 with BYOL minimizes refactoring effort and reduces licensing costs by leveraging existing SQL Server licenses. This strategy avoids the complexity of rewriting stored procedures or decoupling tightly coupled components, which is critical for a migration focused on speed and cost reduction.

Answer

Refactor the application to .NET Core and use Amazon RDS for MySQL to eliminate Windows licensing.

Answer

Rearchitect the application to microservices and use Amazon DynamoDB for the database.

Answer

Replatform the database to Amazon Aurora with PostgreSQL compatibility to reduce licensing costs.

Question 16

A company is migrating a critical application to AWS and wants to ensure business continuity during the cutover. The migration plan includes a pilot light strategy. Which of the following BEST describes the pilot light pattern?

Accepted Answer

Replicate data to AWS and run a minimal version of the application that can be scaled up during cutover.. The pilot light pattern is a disaster recovery strategy where core data is continuously replicated to AWS, and a minimal version of the application (e.g., a small EC2 instance running the application stack) is kept running. During cutover, this minimal environment is rapidly scaled up to full production capacity. This matches option C, as it describes replicating data and running a minimal version that can be scaled up.

Answer

Take regular backups and restore them in AWS during cutover.

Answer

Run a scaled-down but fully functional version of the environment in AWS at all times.

Answer

Run the application simultaneously in both environments and route traffic to both.

Question 17

A company has a centralized logging account that receives VPC Flow Logs from all accounts in the organization. The logs are stored in an S3 bucket. A security analyst needs to query the logs to identify traffic to a specific IP address. The analyst has been granted read-only access to the S3 bucket. However, the analyst cannot access the logs. What is the MOST likely cause?

Accepted Answer

The S3 bucket policy includes a condition that only allows access from the logging account's AWS service principals, not from individual IAM users.. Option C is correct because the S3 bucket policy likely includes a condition that restricts access to only AWS service principals (e.g., the logging account's own services) rather than individual IAM users or roles from other accounts. Even with read-only access granted to the analyst's IAM user or role, the bucket policy's explicit deny for non-service principals overrides any allow, preventing the analyst from accessing the logs. This is a common cross-account access issue where bucket policies must explicitly allow principals from other accounts.

Answer

The S3 bucket has a lifecycle policy that deletes logs after a short period.

Answer

The S3 bucket has a bucket policy that requires the analyst to assume a role in the logging account.

Answer

The S3 bucket is encrypted with an AWS KMS key, and the analyst does not have permissions to decrypt.

Question 18

A company has a centralized networking team that manages a shared VPC with multiple AWS Transit Gateway attachments. Application teams create VPCs in separate AWS accounts and want to connect to the shared VPC. The networking team needs to ensure that only authorized VPCs can connect to the shared VPC. What is the MOST secure and scalable way to manage this?

Accepted Answer

Use AWS Resource Access Manager to share the Transit Gateway with the application accounts.. AWS Resource Access Manager (RAM) allows the centralized networking team to share the Transit Gateway with specific application accounts, enabling authorized VPCs to create attachments without exposing the resource to all accounts. This approach is secure because it uses resource-based policies to grant access only to designated accounts, and scalable because it avoids the administrative overhead of managing individual VPNs or VPC peering connections as the number of application VPCs grows.

Answer

Use a VPN connection from each application VPC to the shared VPC.

Answer

Use VPC peering between the shared VPC and each application VPC.

Answer

Create IAM roles in each application account that allow the networking team to create VPC attachments.

Question 19

A multinational company is implementing AWS Organizations to manage multiple accounts across business units. The security team requires that all IAM users in member accounts must use a specific password policy and must have MFA enabled. Which combination of actions should the company take to enforce these requirements?

Accepted Answer

Use an SCP to deny changes to the password policy and to deny deactivation of MFA devices. Use AWS Config rules to detect non-compliant users.. Option C is correct because SCPs can deny changes to the password policy and deny deactivation of MFA devices, preventing users from weakening security controls. AWS Config rules then detect non-compliant users (e.g., those without MFA or with a non-compliant password policy), allowing the security team to trigger remediation or alerts. SCPs alone cannot enforce a specific password policy or enable MFA; they only block actions, so Config rules are needed for detection and enforcement.

Answer

Use an SCP to enforce a specific password policy and require MFA across all accounts.

Answer

Use AWS Config rules to automatically set the password policy and enable MFA for all users.

Answer

Use AWS CloudTrail to monitor password policy changes and MFA status, and trigger an automatic remediation.

Question 20

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.