SAP-C02 Practice Test 23 — 15 Questions

Question 1

A company is designing a serverless application that uses Amazon API Gateway and AWS Lambda. The API must be secured using AWS WAF. Which TWO actions should the company take to integrate WAF with API Gateway? (Choose TWO.)

Accepted Answer

Associate an AWS WAF web ACL with the API Gateway HTTP API. Options A and D are correct because AWS WAF can be associated with an API Gateway REST API or HTTP API regional endpoint. Option B is incorrect because CloudFront is not required. Option C is incorrect because WAF does not protect Lambda functions directly. Option E is incorrect because WAF does not integrate with API keys.

Answer

Create an AWS WAF web ACL and attach it to the Lambda function

Answer

Configure API Gateway to require an API key and associate WAF with the usage plan

Answer

Place AWS WAF in front of Amazon CloudFront and use CloudFront as the API Gateway endpoint

Question 2

A company is designing a new application that will process sensitive financial transactions. The application must be deployed in a VPC with no public internet access. The application needs to send logs to Amazon CloudWatch Logs and store files in Amazon S3. Which set of actions should be taken to meet these requirements without allowing internet access?

Accepted Answer

Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for CloudWatch Logs. Option A is correct because VPC endpoints (Gateway for S3 and Interface for CloudWatch Logs) allow private connectivity to AWS services without internet access. Option B is wrong because a NAT gateway provides outbound internet access, which is not allowed. Option C is wrong because a public ALB would expose the application to the internet. Option D is wrong because AWS PrivateLink is used for services in other accounts, not for CloudWatch Logs; the correct endpoint is Interface endpoint.

Answer

Place the application behind a public Application Load Balancer

Answer

Set up a NAT gateway in a public subnet and route traffic through it

Answer

Use AWS PrivateLink to connect to CloudWatch Logs and S3

Question 3

Refer to the exhibit. A company has an S3 bucket policy that requires server-side encryption with AES256 for all objects uploaded. However, users can still upload objects without encryption. What is the MOST likely reason?

Accepted Answer

The policy does not deny requests that omit the encryption header. Option C is correct because the policy has a Deny with a condition but also an Allow with the same condition. The Allow statement effectively overrides the Deny because the Deny only applies when encryption is not AES256, but the Allow applies when encryption is AES256. However, the issue is that the Deny statement is not denying all non-compliant uploads because the Allow statement is too permissive. Actually, the correct interpretation: The Deny statement denies PutObject when encryption is not AES256. The Allow statement allows PutObject when encryption is AES256. However, without the Allow, the default is implicit deny. The Allow statement is redundant but not harmful. The problem might be that the policy is missing a condition to also require encryption for existing objects? But the real issue is that the policy does not deny requests that do not include the encryption header at all. The condition "StringNotEquals" only matches when the header is present but not equal to AES256. If no encryption header is present, the condition evaluates to true because the value is not present? Actually, if the header is missing, the condition key does not exist, and the condition evaluates to false. So the Deny does not apply when no encryption header is present. Therefore, users can upload without encryption. Option C correctly identifies this: the policy does not deny requests that omit the encryption header. Option A is incorrect because bucket policy can enforce encryption. Option B is incorrect because the condition is correct. Option D is incorrect because AWS managed keys are not relevant.

Answer

S3 bucket policies cannot enforce encryption; you must use bucket default encryption

Answer

The condition key is incorrect; it should be s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

The policy does not apply to objects uploaded using AWS KMS managed keys

Question 4

A company is designing a new application that must be highly available across multiple AWS Regions. The application will run on EC2 instances behind an Application Load Balancer. The company needs a DNS-based routing policy that routes users to the nearest healthy endpoint based on latency. Which Amazon Route 53 routing policy should be used?

Accepted Answer

Latency routing policy. Option D is correct because Latency-based routing directs traffic to the region with the lowest latency for the user. Option A is wrong because Simple routing is for a single resource. Option B is wrong because Weighted routing distributes traffic based on weights, not latency. Option C is wrong because Failover routing is for active-passive setups.

Answer

Failover routing policy

Answer

Weighted routing policy

Answer

Simple routing policy

Question 5

A company is designing a new data lake on Amazon S3 using AWS Glue for ETL. The data is partitioned by date and sensitive columns must be masked for non-privileged users. The solution must minimize storage costs and allow different masking policies per user. Which approach should the architect recommend?

Accepted Answer

Use AWS Lake Formation to define column-level permissions and masking policies.. Using Lake Formation with column-level permissions (option D) allows masking policies per user without duplicating data. Option A (multiple copies) increases cost. Option B (separate S3 paths) is complex. Option C (Glue transforms) mixes ETL with access control.

Answer

Create separate S3 buckets for each masking policy and copy data accordingly.

Answer

Use AWS Glue ETL jobs to mask data based on user role at query time.

Answer

Store masked data in separate prefixes in the same bucket and use S3 bucket policies.

Question 6

A company is designing a new microservices application on AWS. Each microservice needs to store and retrieve stateful data with low latency (single-digit milliseconds). The data must be durable and highly available across multiple Availability Zones. Which AWS service should be used for the primary data store for each microservice?

Accepted Answer

Amazon DynamoDB. Option C is correct because Amazon DynamoDB provides single-digit millisecond latency, automatic replication across multiple AZs, and is fully managed. Option A is wrong because Amazon S3 has higher latency and is not ideal for low-latency stateful data. Option B is wrong because Amazon RDS has higher latency than DynamoDB for simple key-value lookups. Option D is wrong because Amazon ElastiCache is in-memory and not durable by default without additional configuration.

Answer

Amazon S3

Answer

Amazon RDS with Multi-AZ

Answer

Amazon ElastiCache for Redis

Question 7

A company is designing a new multi-tier web application on AWS. The application consists of a public-facing Application Load Balancer, a fleet of EC2 instances in private subnets, and an RDS database in a private subnet. The security team requires that all traffic between the ALB and EC2 instances be encrypted, and that the EC2 instances have no direct internet access. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the ALB to use HTTPS listeners and the target group to use HTTPS.. The correct answers are A and B. Option A is correct because using HTTPS listeners on the ALB encrypts traffic between the client and ALB, and by using HTTPS as the protocol for the target group, the traffic between ALB and EC2 instances is also encrypted. Option B is correct because placing EC2 instances in private subnets ensures they have no direct internet access, and using a NAT gateway for outbound access allows them to reach the internet for updates if needed, but not inbound. Option C is wrong because Network ACLs are stateless and need rules for both inbound and outbound, but they do not encrypt traffic. Option D is wrong because VPC Flow Logs are for monitoring, not for encryption or internet access control. Option E is wrong because an Internet Gateway provides internet access, which is not allowed.

Answer

Attach an Internet Gateway to the VPC and route traffic through it.

Answer

Enable VPC Flow Logs on the private subnets.

Answer

Configure network ACLs to deny all inbound traffic from the internet.

Question 8

A company is designing a new web application that requires a scalable, low-latency key-value store for session state. The application runs on EC2 instances in an Auto Scaling group. Which solution is the MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis.. ElastiCache for Redis (option B) is a managed, scalable, low-latency key-value store ideal for session state. Option A (DynamoDB) works but is more expensive for simple session data. Option C (RDS) is relational and not low-latency for key-value. Option D (local instance store) is not durable.

Answer

Store session state on the local instance store of each EC2 instance.

Answer

Store session state in Amazon DynamoDB.

Answer

Store session state in Amazon RDS for MySQL.

Question 9

A company is building a new data lake on AWS. The data is stored in Amazon S3 and will be queried using Amazon Athena. The company wants to minimize query costs. Which S3 storage class should the company use for the data?

Accepted Answer

S3 Intelligent-Tiering. Option B is correct because S3 Intelligent-Tiering automatically optimizes costs for data with changing access patterns. Option A is wrong because S3 Standard is for frequent access, not cost-optimized. Option C is wrong because S3 Glacier is for archival, not querying. Option D is wrong because S3 One Zone-IA is for infrequent access but lacks durability and may not be cost-effective for queries.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 10

A company has an IAM policy attached to a user. The user is trying to download an object from the S3 bucket 'my-bucket' that was uploaded with SSE-S3 encryption. What will happen?

Accepted Answer

The user will be allowed to download the object.. Option A is correct because the condition requires s3:x-amz-server-side-encryption to be AES256, which matches SSE-S3. Option B is wrong because the condition is satisfied. Option C is wrong because SSE-S3 uses AES256. Option D is wrong because the condition is for get requests, not put.

Answer

The user will be allowed only if the object was uploaded with SSE-KMS.

Answer

The user will be denied access because the condition is not met.

Answer

The user will be denied because SSE-S3 is not AES256.

Question 11

A company is designing a new serverless application using AWS Lambda. The application must process files uploaded to an S3 bucket. Each file can be up to 1 GB in size. The processing time for each file is expected to be up to 15 minutes. The company wants to minimize cost and operational overhead. Which TWO configuration choices should the company make? (Choose TWO.)

Accepted Answer

Configure S3 to send event notifications to the Lambda function.. The correct answers are A and C. Option A is correct because Lambda's maximum execution timeout is 15 minutes, which meets the processing time requirement. Option C is correct because using S3 event notifications to invoke Lambda directly is a simple, cost-effective integration. Option B is wrong because Lambda has a maximum payload size of 128 KB for synchronous invocation, but for S3 events, the payload size limit is 128 KB; however, the file itself is stored in S3, and Lambda reads it using the S3 API, so the 1 GB file is not passed as an event payload. The event notification contains only metadata. Option D is wrong because Lambda does not support mounting EFS by default in all regions; it requires a VPC configuration and is not needed here. Option E is wrong because extending Lambda timeout to 30 minutes is not possible as the maximum is 15 minutes.

Answer

Mount an Amazon EFS file system to the Lambda function for temporary storage.

Answer

Use S3 event notifications to send the file content directly to Lambda.

Answer

Extend the Lambda function timeout to 30 minutes.

Question 12

A company is designing a new real-time analytics platform that processes streaming data from IoT devices. The data must be ingested, processed with windowed aggregations, and stored in Amazon S3 for long-term analytics. The solution must handle late-arriving data and provide exactly-once processing semantics. Which combination of AWS services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Analytics for Apache Flink to process data from Kinesis Data Streams and output to S3.. Kinesis Data Analytics for Apache Flink (option D) provides exactly-once processing and handles late data. Option A (Kinesis Data Firehose) does not provide exactly-once. Option B (Lambda) is not ideal for streaming analytics. Option C (EMR) is more complex.

Answer

Use Amazon Kinesis Data Firehose to ingest data and AWS Glue for processing.

Answer

Use Amazon EMR with Spark Streaming to process data from Kinesis Data Streams.

Answer

Use AWS Lambda to process records from Kinesis Data Streams and store in S3.

Question 13

A company is designing a new microservices architecture on AWS. The company wants to use a service mesh to manage service-to-service communication, observability, and security. Which AWS service should the company use?

Accepted Answer

AWS App Mesh. Option C is correct because AWS App Mesh is a service mesh that provides traffic management, observability, and security. Option A is wrong because Amazon API Gateway is for external APIs. Option B is wrong because AWS Cloud Map is for service discovery. Option D is wrong because AWS Transit Gateway is for network connectivity.

Answer

Amazon API Gateway

Answer

AWS Transit Gateway

Answer

AWS Cloud Map

Question 14

A CloudFormation stack output is as above. The company wants to use the SQS queue URL in another stack. Which intrinsic function should be used to reference the queue URL in the second stack?

Accepted Answer

Fn::ImportValue. Option C is correct because Fn::ImportValue is used to import exported stack outputs. Option A is wrong because Fn::GetAtt gets attributes from resources in the same template. Option B is wrong because Fn::Ref returns a resource's primary identifier. Option D is wrong because Fn::Sub is for string substitution.

Answer

Fn::GetAtt

Answer

Fn::Sub

Answer

Fn::Ref

Question 15

Refer to the exhibit. A CloudFormation template creates an S3 bucket with versioning and a public bucket policy. After deployment, users can access objects in the bucket via the internet. However, the security team requires that all access be logged. What is missing from this configuration?

Accepted Answer

No logging configuration is specified.. Option D is correct. The template does not enable S3 server access logs or AWS CloudTrail for object-level logging. Option A is wrong because versioning is enabled. Option B is wrong because the policy is public. Option C is wrong because the bucket is not encrypted.

Answer

The bucket is not encrypted.

Answer

The bucket policy does not restrict access to a specific IP range.

Answer

Bucket versioning is not enabled.