SAP-C02 Practice Exam 2 — 20 Questions

Question 1

A company is migrating a stateful application to AWS. The application uses sticky sessions (session affinity) on the current on-premises load balancer. The company wants to use an Application Load Balancer (ALB) in AWS. Which feature should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sticky sessions (session affinity) using a cookie generated by the load balancer.. ALB supports sticky sessions (session affinity) using a cookie generated by the load balancer, which meets the requirement to maintain session state from the on-premises environment. Option A (connection draining) is used to allow in-flight requests to complete during instance deregistration, not for session affinity. Option C (health checks) ensures traffic is only sent to healthy instances, but does not maintain session stickiness. Option D (cross-zone load balancing) distributes traffic evenly across all availability zones, but does not affect session affinity.

Answer

Connection draining (deregistration delay).

Answer

Health checks to ensure only healthy instances receive traffic.

Answer

Cross-zone load balancing.

Question 2

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

Accepted Answer

Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.. Option D meets the RPO of less than 5 minutes because RDS cross-Region read replicas use asynchronous replication with a typical lag of seconds. It meets the RTO of less than 30 minutes because the read replica can be promoted to a standalone primary in minutes. The standby EC2 environment with Auto Scaling set to 0 (scaling up based on health check alarms) minimizes cost when not in use. Route 53 failover routing redirects traffic to us-west-2 after promotion. Option A is incorrect because a single hot standby EC2 instance incurs ongoing cost, and it does not meet the cost minimization requirement. Option B is incorrect because automated snapshots have an RPO of up to 24 hours (not <5 minutes), and restoring to S3-mounted volumes is not a functional database serving solution. Option C is incorrect because Multi-AZ in both regions is costly (always running instances) and cross-Region load balancing with ALB is not a native feature for failover; plus Multi-AZ does not provide a separate read replica in another region for DR without additional replication.

Answer

Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

Answer

Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

Answer

Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

Question 3

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.. The AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Answer

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Answer

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Answer

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Question 4

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 5

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation. AWS CloudFormation allows infrastructure as code to provision all required resources, including the network, security groups, EC2 instances, and an Application Load Balancer. Option A (AWS Elastic Beanstalk) abstracts the underlying infrastructure and does not provide granular control. Option C (AWS CodeDeploy) is used for deploying application code, not infrastructure. Option D (AWS OpsWorks) is a configuration management service, not an infrastructure provisioning tool.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 6

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 7

Refer to the exhibit. A company deploys this CloudFormation template. After deployment, they enable S3 Transfer Acceleration on the bucket. Later, they update the stack. What happens to the Transfer Acceleration setting?

Accepted Answer

The Transfer Acceleration setting remains unchanged after the update.. CloudFormation drift detection does not automatically revert manual changes. The Transfer Acceleration setting is a property of the bucket; if not defined in the template, CloudFormation may not manage it, but typically manual changes are not overwritten unless the template explicitly defines them. However, best practice is to define all settings in the template to avoid drift. Option A is wrong because CloudFormation does not automatically disable it. Option B is wrong because CloudFormation does not automatically enable it. Option C is wrong because updates do not reset to default.

Answer

CloudFormation enables Transfer Acceleration because it is a best practice.

Answer

The update fails because of a conflict between the template and the manual change.

Answer

CloudFormation removes the Transfer Acceleration setting because it is not defined in the template.

Question 8

A company is migrating a legacy application to AWS. The application currently runs on a single on-premises server with a local MySQL database. The company wants to minimize changes and reduce operational overhead. Which TWO strategies should the solutions architect recommend? (Select TWO.)

Accepted Answer

Replatform the database to Amazon RDS for MySQL. Rehost (lift-and-shift) minimizes changes by moving the application as-is. Replatforming the database to RDS reduces operational overhead by offloading database management. Retire is not applicable. Refactor would require changes. Repurchase involves buying new software.

Answer

Refactor the application to use microservices

Answer

Retire the application

Answer

Repurchase a SaaS alternative

Question 9

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.. AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Answer

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Answer

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Answer

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Question 10

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

Accepted Answer

Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.. ECS Service Connect provides built-in DNS-based service discovery and automatic encryption via TLS for inter-service communication. Option B uses AWS Cloud Map for service discovery but does not enforce encryption in transit. Option C uses a Network Load Balancer (NLB) in front of each service, which adds unnecessary complexity and cost without addressing service discovery. Option D uses an Application Load Balancer (ALB) in front of each service, which is also overly complex and costly for simple inter-service communication.

Answer

Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.

Answer

Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.

Answer

Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.

Question 11

A company has deployed a web application behind an Application Load Balancer (ALB) with an Auto Scaling group. Users report that the application is slow during peak hours. The CPU utilization of the EC2 instances is consistently below 40%, but the ALB's request count per target is high. Which action would MOST improve performance?

Accepted Answer

Increase the desired capacity of the Auto Scaling group. High request count per target with low CPU utilization suggests the application is I/O bound or waiting on external calls. Adding more instances by increasing the desired capacity distributes the load across more targets, reducing queueing and improving performance. Option A is wrong because the bottleneck is not CPU, so increasing instance size is unlikely to help. Option C is wrong because scaling based on CPU utilization would not trigger since CPU is low. Option D is wrong because changing the ALB routing algorithm to least outstanding requests might help distribute load more evenly but does not add capacity; increasing desired capacity directly addresses the high request count per target.

Answer

Increase the instance size (e.g., from t3.medium to t3.large)

Answer

Configure the Auto Scaling group to scale based on CPU utilization

Answer

Change the ALB routing algorithm to least outstanding requests

Question 12

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account

Question 13

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

Accepted Answer

Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.. It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.

Answer

Use Amazon S3 with server-side encryption and enforce HTTPS.

Answer

Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.

Answer

Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.

Question 14

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 15

A company has multiple AWS accounts and wants to centralize operational data such as cost reports, security findings, and resource inventory. The solution should provide a single pane of glass for the operations team. Which AWS service should be used?

Accepted Answer

Use AWS Organizations to create a central management account and use AWS Systems Manager Explorer to aggregate operational data.. AWS Systems Manager Explorer, when used with AWS Organizations, provides a single-pane-of-glass dashboard that aggregates operational data (e.g., cost reports, security findings, resource inventory) across multiple accounts. The central management account in Organizations enables Explorer to collect and display data from all member accounts without requiring individual connections or manual aggregation.

Answer

Use Amazon QuickSight to connect to each account's AWS Cost and Usage Report and AWS Config data.

Answer

Use AWS Control Tower to set up a landing zone and use the built-in dashboard for operational data.

Answer

Use AWS Config aggregator to collect resource configurations from all accounts.

Question 16

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Accepted Answer

Configure RDS Multi-AZ in the primary region.. RDS Multi-AZ provides automatic failover to a standby in a different Availability Zone within the same region, achieving an RTO typically under 1-2 minutes and an RPO of zero (synchronous replication). This meets the 15-minute RTO and 1-minute RPO for intra-region failures, but it does not address cross-region DR. Option B is correct because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of 1 second or less and can promote a secondary region in under 1 minute, satisfying both the 15-minute RTO and 1-minute RPO for a full regional disaster.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 17

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Accepted Answer

Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization. AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in each account

Answer

Enable GuardDuty manually in each member account by logging into each account

Answer

Create a service control policy to force GuardDuty to be enabled

Question 18

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Accepted Answer

Enable default encryption on each S3 bucket.. Enabling default encryption on each S3 bucket ensures that all objects uploaded to that bucket are automatically encrypted, enforcing the policy across existing and future buckets. Option B is wrong because an IAM policy that denies s3:PutObject without encryption headers only applies when the request includes encryption headers; it does not enforce encryption for all objects, and it depends on the caller including the headers. Option C is wrong because while an S3 bucket policy can deny PutObject without encryption, it requires a policy per bucket and does not automatically remediate existing buckets. Option D is wrong because AWS Config can detect noncompliant buckets but requires a custom remediation action to enable encryption; it does not automatically enforce encryption without additional setup.

Answer

Create an IAM policy that denies s3:PutObject unless encryption headers are present.

Answer

Use an S3 bucket policy to deny PutObject without encryption.

Answer

Use AWS Config to automatically remediate noncompliant buckets.

Question 19

A company is managing multiple AWS accounts using AWS Organizations. They want to centralize the management of EC2 instances and enforce tagging standards across all accounts. Which TWO approaches should they use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy AWS Config rules across all accounts to check for required tags.. AWS Config rules can be deployed via CloudFormation StackSets across all accounts in an AWS Organization to continuously check for required tags on EC2 instances, enabling centralized enforcement of tagging standards. Option D is correct because a service control policy (SCP) can deny the ec2:RunInstances action if required tags are not present in the request, using the ec2:ResourceTag condition key to enforce tagging at the API level before the instance is created.

Answer

Use AWS Service Catalog to enforce tagging on EC2 products.

Answer

Use AWS Resource Access Manager to share a tagging policy across accounts.

Answer

Use EC2 Auto Scaling lifecycle hooks to add tags automatically.

Question 20

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL database. Recently, the application has become slow during peak hours. The operations team notices that the database CPU utilization is high, but the number of connections is within limits. The application is read-heavy. The team wants to improve performance with minimal changes to the application code. The database is currently a single Aurora instance. Which solution should the team implement?

Accepted Answer

Add an Aurora Replica and configure the application to use the reader endpoint for read-only queries.. Adding an Aurora Replica distributes read traffic, reducing load on the primary instance. The application must be configured to use the reader endpoint for read queries.

Answer

Use Amazon DynamoDB Accelerator (DAX) to cache database queries.

Answer

Add an Amazon ElastiCache Redis cluster in front of the database.

Answer

Increase the instance size of the Aurora primary instance.