SAP-C02 Practice Test 3 — 25 Questions

Question 1

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account

Question 2

Match each AWS service to its primary use case.

Accepted Answer

AWS Organizations: Centrally manage multiple AWS accounts and consolidate billing. Correct matches: AWS Organizations for account management, AWS Direct Connect for dedicated private connection, AWS VPN for encrypted internet connection, AWS Transit Gateway for hub-and-spoke network interconnection. Common confusions include swapping Direct Connect and VPN, or misattributing account management to networking services.

Answer

AWS Organizations: Dedicated private network connection from on-premises to AWS

Answer

AWS Direct Connect: Secure encrypted connection over the public internet to AWS

Question 3

A company is using AWS DMS to migrate a SQL Server database to Amazon Redshift. The initial full load completed, but the ongoing replication task failed with the error shown. What is the MOST likely cause?

Accepted Answer

The source SQL Server transaction log has not been backed up or truncated, causing it to become full.. The error indicates that AWS DMS cannot read the source SQL Server transaction log to capture ongoing changes. This typically occurs when the transaction log is full because it has not been backed up or truncated, preventing DMS from reading new log records for continuous replication. DMS relies on the source database's transaction log for CDC (Change Data Capture), and a full log blocks this process.

Answer

The DMS task is not configured to use a task log for troubleshooting.

Answer

The target Redshift table does not have a primary key defined for the DMS task to apply changes.

Answer

The DMS task is using a full LOB mode, which is not supported for Redshift targets.

Question 4

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must block public access. How can this be enforced centrally with minimal operational overhead?

Accepted Answer

Create a service control policy (SCP) to deny s3:PutBucketPublicAccessBlock actions with conditions that require public access block settings.. An SCP applied at the AWS Organizations root or OU level can centrally deny the `s3:PutBucketPublicAccessBlock` action unless the request includes specific public access block settings. This enforces the security requirement across all accounts without per-account configuration, minimizing operational overhead. SCPs are the only mechanism that can prevent actions at the account level before they occur, making them ideal for mandatory security baselines.

Answer

Enable AWS Config in each account and create a rule to mark public buckets as non-compliant.

Answer

Create an IAM role in each account with a policy that denies public access modifications and assign it to all users.

Answer

Use a bucket policy on each existing bucket to deny public access and rely on AWS Config to detect new buckets.

Question 5

A company is migrating a large-scale Oracle data warehouse to Amazon Redshift. The migration must minimize downtime. The source database is 10 TB and runs on a single on-premises server with 1 Gbps network. Which approach should be used for the initial data load?

Accepted Answer

Use AWS Snowball Edge to transfer data to S3, then copy to Redshift.. Using AWS Snowball Edge devices for offline transfer avoids network bandwidth limitations and provides fast, secure transfer of large data volumes. Option A is wrong because 1 Gbps network would take over 22 hours and may cause congestion. Option B is wrong because DMS works for ongoing replication but initial load over network is slow. Option D is wrong because S3 Transfer Acceleration only speeds up S3 uploads, not the full pipeline.

Answer

Use AWS DMS to migrate data directly to Redshift over the network.

Answer

Use AWS DMS with ongoing replication after initial load via network.

Answer

Use S3 Transfer Acceleration to upload data to S3, then COPY to Redshift.

Question 6

A company is migrating a large-scale e-commerce platform from on-premises to AWS. The migration plan includes rehosting the application servers and replatforming the database to Amazon Aurora. The company needs to ensure minimal downtime during the cutover. Which strategy should the company use for the database migration?

Accepted Answer

Use AWS DMS with a full load and ongoing replication to keep the target synchronized. AWS DMS with a full load and ongoing replication (change data capture) keeps the target Aurora database synchronized with the source during the migration. This allows minimal downtime because the cutover only requires stopping writes to the source and letting DMS apply the final changes, then redirecting the application to Aurora. This is the standard strategy for minimal-downtime database migrations.

Answer

Use AWS DMS with a full load only, then cut over

Answer

Use an application-level dual-write to both databases during the cutover

Answer

Take a snapshot of the on-premises database and restore it to Amazon Aurora

Question 7

Drag and drop the steps to configure an S3 bucket as a static website hosting in the correct order.

Accepted Answer

Step 1: Create an S3 bucket, Step 2: Enable static website hosting, Step 3: Upload website content, Step 4: Set bucket policy for public read access, Step 5: Test the website endpoint.. The correct sequence ensures that the S3 bucket is properly configured for static website hosting. Start by creating the bucket, then enable static hosting, upload your files, apply a bucket policy for public read access, and finally test the website URL.

Answer

Step 1: Create an S3 bucket, Step 2: Upload website content, Step 3: Enable static website hosting, Step 4: Set bucket policy for public read access, Step 5: Test the website endpoint.

Answer

Step 1: Create an S3 bucket, Step 2: Enable static website hosting, Step 3: Set bucket policy for public read access, Step 4: Upload website content, Step 5: Test the website endpoint.

Answer

Step 1: Create an S3 bucket, Step 2: Set bucket policy for public read access, Step 3: Enable static website hosting, Step 4: Upload website content, Step 5: Test the website endpoint.

Question 8

An organization is planning to migrate a large number of on-premises virtual machines to AWS. The migration must be automated and support replication of live workloads with minimal downtime. Which AWS service is best suited for this task?

Accepted Answer

AWS Application Migration Service (MGN). (AWS Application Migration Service) is correct as it automates lift-and-shift migration with continuous replication and cutover. Option A (AWS DataSync) is for data transfer, not live VM replication. Option C (AWS Server Migration Service) is legacy and less capable. Option D (AWS Database Migration Service) is for databases, not general VM migration.

Answer

AWS DataSync

Answer

AWS Server Migration Service (SMS)

Answer

AWS Database Migration Service (DMS)

Question 9

A company is planning to migrate a Microsoft SQL Server database to Amazon RDS for SQL Server. They want to automate the migration process and minimize manual effort. Which AWS service should they use?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can migrate SQL Server to RDS with minimal downtime. Option A is wrong because CloudEndure Migration is for server migration. Option B is wrong because DataSync is for file data. Option D is wrong because Schema Conversion Tool is for schema conversion.

Answer

AWS CloudEndure Migration

Answer

AWS DataSync

Answer

AWS Schema Conversion Tool (SCT)

Question 10

A financial services company is designing a highly available architecture for a critical application on AWS. The application runs on EC2 instances and uses an Oracle database. The database must be resilient to an Availability Zone failure and must have automated failover. Which database solution meets these requirements?

Accepted Answer

Use Amazon RDS for Oracle with Multi-AZ deployment.. Amazon RDS for Oracle with Multi-AZ deployment provides automatic failover to a standby instance in a different Availability Zone, meeting the requirements for high availability and automated failover. Option A is incorrect because Amazon Aurora (MySQL-compatible) is not Oracle-compatible, so it cannot replace an Oracle database. Option B is incorrect because a Read Replica in another AZ does not provide automated failover; it is used for read scaling and requires manual promotion. Option C is incorrect because deploying Oracle on EC2 with asynchronous replication requires manual failover management and does not provide automated failover.

Answer

Use Amazon Aurora (MySQL-compatible) with Multi-AZ.

Answer

Use Amazon RDS for Oracle with a Read Replica in another AZ.

Answer

Deploy Oracle on EC2 in two Availability Zones and use asynchronous replication.

Question 11

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 12

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 13

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Option A is correct because running the validation script manually on a healthy instance isolates whether the script itself is broken or whether the failure is environmental (permissions, dependencies, or runtime context), which is the fastest way to reproduce and diagnose the error. Option C is correct because the CodeDeploy agent logs on a failing instance (typically /var/log/aws/codedeploy-agent/codedeploy-agent.log) contain the exact stderr/stdout and exit code from the failing lifecycle hook, pinpointing the specific validation error. Option D is correct because CodeDeploy only executes scripts mapped to lifecycle event hooks defined in the AppSpec file's hooks section (for EC2/on-premises, e.g., BeforeInstall, AfterInstall, ApplicationStart, ValidateService); if ValidateService is missing or misspelled, the validation script never runs as intended and the deployment fails validation. Option B is not appropriate because increasing the deployment timeout only masks a script that is failing outright rather than slow, and the logs already show the validation scripts are failing, not timing out. Option E is not appropriate because Auto Scaling lifecycle hooks govern instance launch/termination and do not address CodeDeploy application validation script failures during the deploy stage.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 14

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

Accepted Answer

AWS Fargate. AWS Fargate is the correct compute option because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. By using Fargate with Amazon EKS, the development team can deploy containers without worrying about node scaling, patching, or cluster capacity, thereby minimizing operational overhead.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 15

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 16

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 17

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and the company wants each upload to trigger processing without managing servers. Jobs can take up to 20 minutes, and the company must be able to retry a failed job without reprocessing successful ones. The operations team wants visibility into which specific uploads failed and the ability to replay only those. The company also wants to decouple the upload event from the worker so that bursts of thousands of simultaneous uploads do not overwhelm the processing tier. Which design should the solutions architect recommend?

Accepted Answer

Configure S3 Event Notifications to send each upload to an Amazon SQS queue, and run workers on Amazon ECS that poll the queue and delete messages only after successful transcoding. The design must buffer unpredictable bursts, support jobs longer than a Lambda invocation, and allow selective replay of only failed uploads. An SQS queue between S3 event notifications and a long-running ECS worker tier satisfies all three: the queue absorbs spikes, workers process at their own pace, and messages are deleted only on success so failures remain individually replayable. This also keeps the pipeline serverless at the ingestion edge without imposing a compute timeout.

Answer

Configure S3 Event Notifications to publish to an Amazon SNS topic that fans out to an AWS Step Functions state machine per upload

Answer

Enable S3 Transfer Acceleration and use S3 Batch Operations to transcode all objects nightly regardless of which uploads succeeded

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function directly for each upload, with a 15-minute timeout and built-in retries

Question 18

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. Option A is correct because EC2 Spot Instances can cut compute costs by up to 90% versus On-Demand, and since the workload is a fault-tolerant batch job that can be retried, Spot interruptions are acceptable, directly supporting the goal of minimizing cost. Option C is correct because AWS Batch is purpose-built for batch computing: it manages a job queue and a compute environment (which can be backed by Spot Instances), dynamically provisioning resources so there is no idle compute capacity. Option D is correct because Amazon S3 Event Notifications can publish an event (e.g., to Amazon EventBridge, SQS, or Lambda) when a new file lands in the bucket, automatically submitting the batch job and eliminating polling or manual triggering. Option B is not appropriate because Lambda has a maximum execution timeout of 15 minutes, far short of the 2-hour CPU-intensive processing time per file. Option E is not appropriate because an Auto Scaling group with scheduled scaling provisions capacity on a time schedule rather than reacting to file arrivals, which risks idle compute and does not provide the job queue and job management that AWS Batch offers.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 19

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 20

Drag and drop the steps to configure an Application Load Balancer with HTTPS listeners in the correct order.

Accepted Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create a target group, 3. Create an ALB with an HTTPS listener, 4. Register targets with the target group, 5. Update DNS to point to the ALB.. First get the certificate, then create the target group, then the ALB with HTTPS, register targets, and update DNS.

Answer

1. Create an ALB with an HTTPS listener, 2. Create a target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Register targets with the target group, 5. Update DNS to point to the ALB.

Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create an ALB with an HTTPS listener, 3. Create a target group, 4. Update DNS to point to the ALB, 5. Register targets with the target group.

Answer

1. Create a target group, 2. Register targets with the target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Create an ALB with an HTTPS listener, 5. Update DNS to point to the ALB.