SAP-C02 Practice Test 2 — 25 Questions

Question 1

A company is designing a new web application that will be accessed by users globally. The application uses Amazon CloudFront as a CDN and stores static content in Amazon S3. The dynamic content is served from EC2 instances in a single AWS Region. Which of the following will improve performance for users in distant regions with the LEAST operational effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Global Accelerator to route traffic to the EC2 instances via the AWS global network.. AWS Global Accelerator uses the AWS global network to route traffic from edge locations to the optimal EC2 endpoint, reducing latency and jitter for distant users without requiring multi-region deployments. This minimizes operational effort because it involves only a single configuration change (creating an accelerator and associating it with the existing EC2 instances) rather than managing infrastructure across multiple regions.

Answer

Deploy EC2 instances in multiple AWS Regions and use Route 53 latency-based routing.

Answer

Move the dynamic content to Lambda@Edge functions running at CloudFront edge locations.

Answer

Add an Amazon ElastiCache cluster in front of the EC2 instances to cache dynamic responses.

Question 2

A company is designing a new application that will process sensitive financial data. The data must be encrypted at rest and in transit. The application runs on EC2 instances. Which combination of services meets these requirements?

Accepted Answer

Enable EBS encryption on the volumes and configure the application to use TLS for all network traffic.. It addresses both encryption requirements: EBS encryption ensures data at rest is encrypted using AWS KMS-managed keys, and configuring the application to use TLS encrypts data in transit between clients and the EC2 instances. This combination directly meets the stated security needs without relying on external services like S3 or ACM for the EC2-hosted application.

Answer

Use Amazon S3 with server-side encryption and enforce HTTPS.

Answer

Use AWS Key Management Service (KMS) to generate keys and enable encryption on EBS volumes.

Answer

Use AWS Certificate Manager (ACM) to issue TLS certificates and configure the application to use HTTPS.

Question 3

A company is planning a large-scale migration of hundreds of applications to AWS. Which TWO strategies should the architect consider to reduce migration risks?

Accepted Answer

Use a wave-based migration approach with defined groups and dependencies. Option C is correct because a wave-based migration approach groups applications by dependencies, business criticality, and technical constraints, allowing the company to validate each wave before proceeding and limit the blast radius of any failures across hundreds of applications. Option D is correct because conducting a pilot migration of a small subset of applications lets the architect test the migration process, tooling (e.g., AWS Application Migration Service, AWS Database Migration Service), and runbooks on a low-risk sample, uncovering issues before committing the full portfolio. Option A is not appropriate because applying only rehosting to every application ignores the benefits of replatforming, refactoring, or repurchasing, and can carry forward technical debt and inefficiencies. Option B is incorrect because migrating all applications in a single wave maximizes risk, since a failure in one application or shared dependency can disrupt the entire migration with no incremental validation. Option E is incorrect because rolling back all migrations whenever any single application has issues is an overreactive, all-or-nothing response that would halt progress; instead, issues should be isolated and remediated per application or wave.

Answer

Use only the rehosting strategy for all applications

Answer

Migrate all applications in a single wave to reduce coordination effort

Answer

Roll back all migrations if any application experiences issues

Question 4

A solutions architect is designing a web application that will run on Amazon EC2 instances behind an Application Load Balancer (ALB). The application requires that users' session data be stored and made available across all instances. Which solution is MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data. Amazon ElastiCache for Redis provides a fully managed, in-memory data store that is ideal for storing session state externally from the EC2 instances. This decouples session data from the compute layer, allowing any instance to retrieve the same session data regardless of which instance originally handled the request. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it both highly scalable and cost-effective for session management at scale.

Answer

Store session data on an Amazon EBS volume attached to each instance

Answer

Store session data in an Amazon RDS database

Answer

Enable sticky sessions (session affinity) on the ALB

Question 5

A company has multiple AWS accounts and wants to use AWS CloudFormation StackSets to deploy a common set of resources across all accounts. The StackSet should be managed from the management account. What permissions are required?

Accepted Answer

Create an IAM role in each target account with a trust policy allowing the management account to assume it.. AWS CloudFormation StackSets require the management account to assume an IAM role in each target account to deploy resources. This role must have a trust policy that allows the management account's StackSets service-linked role (or a custom role) to assume it, granting the necessary permissions to create, update, or delete stack instances across accounts. Without this cross-account trust relationship, StackSets cannot perform operations in target accounts.

Answer

Create IAM users in target accounts with AdministratorAccess.

Answer

Use a CloudFormation service role in the management account.

Answer

Apply an SCP to allow CloudFormation actions across accounts.

Question 6

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.. AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule. Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

Question 7

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 8

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 9

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 10

A company wants to assess its on-premises environment for migration to AWS. The company needs to collect utilization data for servers and applications. Which AWS service should the company use?

Accepted Answer

AWS Application Discovery Service. AWS Application Discovery Service collects server and application utilization data from on-premises environments to support migration planning. Option A is wrong because AWS Migration Hub tracks migrations but does not perform discovery. Option B is wrong because AWS Database Migration Service (DMS) is for migrating databases, not for collecting utilization data. Option D is wrong because AWS Server Migration Service (SMS) is deprecated and was used for migrating individual servers, not for discovery.

Answer

AWS Migration Hub

Answer

AWS Database Migration Service (DMS)

Answer

AWS Server Migration Service (SMS)

Question 11

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

Accepted Answer

Use AWS RAM to share the subnet with the organization.. AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Answer

Create a Transit Gateway and attach all accounts.

Answer

Set up a VPN connection between accounts.

Answer

Create a VPC peering connection between each account and the VPC owner.

Question 12

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

Accepted Answer

Check the security group rules for the instance.. The instance is running but the application is inaccessible, which often indicates that security group rules are not allowing the required inbound traffic. Option A is wrong because the instance is reported as 'running', so it is not terminated. Option B is wrong because the command output successfully returns instance details, meaning the instance ID is correct. Option C is wrong because status checks relate to the health of the instance OS and system, not network access.

Answer

Check if the instance is terminated.

Answer

Check if the instance ID is correct.

Answer

Check the instance status checks.

Question 13

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 14

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 15

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

Accepted Answer

Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.. Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Answer

Store the Docker image in Amazon S3 instead of ECR.

Answer

Use the 'latest' tag for all images.

Answer

Retry the failed pipeline step after a delay.

Question 16

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. A Lambda function attached to a VPC with only a private subnet has no route to the internet unless a NAT gateway (for outbound internet) or VPC endpoints (for AWS services) are configured. If the function calls external resources or AWS APIs without these, the calls hang until the 30-second timeout. This is the most likely cause of intermittent timeouts in this scenario.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 17

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for secure secret storage with built-in automatic rotation for RDS, Redshift, and DocumentDB credentials, plus custom Lambda-based rotation for other secrets. It centralizes secret management and integrates natively with EC2 via the AWS SDK or Secrets Manager Agent. KMS is for encryption keys, not secret lifecycle management, and Parameter Store lacks native rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 18

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Answer

AWS Data Pipeline

Answer

AWS Lambda functions

Answer

AWS Glue ETL jobs

Question 19

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

Accepted Answer

Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Answer

Store logs on an EBS volume and take regular snapshots.

Answer

Write logs to the instance store volume of each EC2 instance.

Answer

Write logs to an Amazon S3 bucket mounted on each instance using NFS.

Question 20

A company is designing a new real-time bidding platform that must handle sudden bursts of traffic up to 100,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores bid data in Amazon DynamoDB. The company wants to minimize latency and cost while ensuring the database can scale automatically. Which solution meets these requirements?

Accepted Answer

Use DynamoDB with on-demand capacity mode and enable DynamoDB Accelerator (DAX) for read-heavy workloads.. The correct solution uses DynamoDB on-demand mode to handle unpredictable bursts without capacity planning, and DAX to provide microsecond read latency for read-heavy operations. This combination ensures automatic scaling, low latency, and cost efficiency for a real-time bidding platform. Other options either require manual scaling, introduce bottlenecks, or are not optimized for the required throughput and latency.

Answer

Use Amazon RDS for MySQL with Multi-AZ and read replicas, and implement a caching layer using Amazon ElastiCache.

Answer

Use DynamoDB with provisioned capacity mode and set up Auto Scaling with a target utilization of 70%.

Answer

Use Amazon Aurora Serverless v2 with auto-scaling and enable Aurora Global Database for low-latency reads.