SAP-C02 Practice Test 5 — 25 Questions

Question 1

A company is migrating its on-premises PostgreSQL database to Amazon Aurora PostgreSQL. The database is 2 TB in size and has a 24-hour maintenance window on weekends. The company needs to minimize downtime and ensure data consistency. Which strategy should the solutions architect recommend?

Accepted Answer

Use AWS DMS with ongoing replication from the on-premises database to Aurora, then perform a cutover during the maintenance window.. AWS DMS with ongoing replication (change data capture, CDC) allows the on-premises PostgreSQL database to be continuously synchronized with the target Aurora PostgreSQL cluster, minimizing downtime. When the cutover is performed during the 24-hour maintenance window, data consistency is ensured because all changes up to that point have been replicated. This approach avoids the need for a lengthy full database dump and restore, which would cause extended downtime.

Answer

Create an Aurora read replica from the on-premises database using a VPN connection.

Answer

Use AWS Schema Conversion Tool (AWS SCT) to convert the schema and then use AWS Database Migration Service (AWS DMS) with full load only.

Answer

Perform a full pg_dump of the on-premises database and restore it to Aurora using pg_restore.

Question 2

A company has a multi-account AWS environment with hundreds of accounts. The central IT team needs to audit all API calls made in the organization. The solution must be cost-effective and capture events from all regions and accounts, including future accounts. Which solution should the company use?

Accepted Answer

Create an organization trail in the management account that logs all events to an S3 bucket with a bucket policy granting access to all accounts.. An organization trail in the management account automatically applies to all existing and future accounts and regions within AWS Organizations, capturing all management events without per-account configuration. It delivers logs to a single S3 bucket, and the bucket policy grants read access to all accounts, making it cost-effective by avoiding duplicate trails and reducing storage overhead.

Answer

Use AWS Config to record API calls and deliver to a central S3 bucket.

Answer

Enable CloudTrail in each account and configure each trail to deliver logs to a central S3 bucket.

Answer

Use VPC Flow Logs to capture API calls and send to a central S3 bucket.

Question 3

A large enterprise has 200 AWS accounts organized under AWS Organizations. The central security team needs to audit all IAM role trust policies across accounts to ensure no cross-account roles allow external principals. Which approach is most efficient and scalable?

Accepted Answer

Enable AWS Config aggregator and use advanced queries to search for trust policies.. AWS Config aggregator with advanced queries allows you to query the resource configuration of IAM roles across all accounts in AWS Organizations from a single management account. This approach is serverless, scalable, and provides a centralized view without needing to script cross-account access or manage multiple findings. The query can filter on the 'assumeRolePolicyDocument' field to detect trust policies that allow external principals (e.g., 'Effect: Allow' with 'AWS': '*' or a non-account ARN).

Answer

Use AWS Trusted Advisor to check for overly permissive roles.

Answer

Write a script using AWS SDK to list roles in each account and analyze trust policies.

Answer

Use IAM Access Analyzer to generate findings for each account.

Question 4

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

Accepted Answer

Amazon CloudFront. Option A is correct because CloudFront is a CDN that caches content at edge locations, reducing latency and offloading traffic. Option B is wrong because Global Accelerator improves performance via AWS global network but does not cache. Option C is wrong because Shield Advanced is for DDoS protection. Option D is wrong because WAF is a web application firewall.

Answer

AWS Global Accelerator

Answer

AWS Shield Advanced

Answer

AWS WAF

Question 5

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Accepted Answer

Configure a health check on the ALB for the target group. Option C is correct because configuring a health check on the ALB for the target group allows the load balancer to periodically send health check requests to each registered EC2 instance. If an instance fails to respond with a healthy status (e.g., HTTP 200) within the configured interval and threshold, the ALB automatically deregisters it and stops routing traffic to it, ensuring high availability and fault tolerance.

Answer

Use a Network Load Balancer instead of an ALB

Answer

Use an Application Load Balancer with a single target group

Answer

Launch all EC2 instances in a single Availability Zone

Question 6

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

Accepted Answer

Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.. Amazon RDS Proxy sits between the Lambda function and the RDS database, maintaining a pool of established connections. When Lambda invocations scale up, they reuse connections from the pool instead of opening new ones, preventing the database from being overwhelmed. This is the recommended AWS pattern for serverless applications with high concurrency and relational databases.

Answer

Increase the Lambda function timeout and use a single database connection per function instance.

Answer

Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.

Answer

Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.

Question 7

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Option D is correct because enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 8

Match each AWS monitoring and logging service to its capability.

Accepted Answer

CloudWatch: Monitor and manage metrics, logs, and alarms. CloudWatch provides observability via metrics and logs (correct). GuardDuty detects threats with ML (correct). CloudTrail records API activity for auditing, not resource configuration changes, so B is incorrect. AWS Config tracks resource configuration changes, not API activity, so C is incorrect.

Answer

CloudTrail: Evaluate and track resource configuration changes

Answer

AWS Config: Record API activity for auditing and compliance

Question 9

Match each AWS cost management tool to its use.

Accepted Answer

AWS Cost Explorer: A visual tool that enables you to view and analyze your AWS costs and usage.. Correct matches: Cost Explorer visualizes costs, Budgets set alerts, Trusted Advisor recommends optimizations, and CUR provides detailed data. Common confusions involve mixing tool capabilities.

Answer

AWS Cost Explorer: A service that automatically reduces costs by applying savings plans.

Answer

AWS Budgets: A report that includes all cost and usage data in CSV format.

Question 10

Match each AWS database service to its characteristic.

Accepted Answer

Amazon RDS: Fully managed relational database service supporting multiple database engines. Each AWS database service targets specific use cases: RDS for relational workloads, DynamoDB for NoSQL, Redshift for analytics, and ElastiCache for caching. Common confusions include mixing up NoSQL with relational and caching with warehousing.

Answer

Amazon RDS: Fully managed NoSQL key-value database

Answer

Amazon Redshift: In-memory caching service

Question 11

Match each AWS networking concept to its definition.

Accepted Answer

VPC: A virtual network dedicated to your AWS account.. A VPC is a logically isolated virtual network. Subnets are subdivisions of the VPC. An Internet Gateway provides internet access to public subnets, while a NAT Gateway provides outbound internet access to private subnets. Security Groups control instance-level traffic.

Answer

VPC: A service that provides a dedicated physical network for your account.

Answer

Internet Gateway: Allows instances in a private subnet to access the internet.

Question 12

Match each AWS disaster recovery strategy to its description.

Accepted Answer

Backup and Restore: Data is backed up to S3 and restored when needed.. AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Answer

Backup and Restore: A scaled-down version of the environment runs and can be scaled up quickly.

Answer

Pilot Light: Data is backed up to S3 and restored when needed.

Question 13

A company has a data lake on Amazon S3 that is accessed by multiple business units via VPC endpoints. The security policy mandates that all access to the data lake must be encrypted in transit and originate from approved VPCs. The company has a central security account that manages AWS Network Firewall. Which combination of controls should be implemented to enforce this policy? (Choose TWO.)

Accepted Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpce condition matches the approved VPC endpoint IDs.. Option A is correct because the `aws:SourceVpce` condition key in an S3 bucket policy allows you to restrict access to traffic originating from specific VPC endpoints (interface or gateway endpoints). This ensures that only requests coming through approved VPC endpoints can access the data lake, directly enforcing the mandate that access must originate from approved VPCs.

Answer

Enable S3 Block Public Access at the account level.

Answer

Use AWS Certificate Manager to issue certificates for S3 bucket access.

Answer

Attach an S3 bucket policy that denies access unless the aws:SourceVpc condition matches the approved VPC IDs.

Question 14

A company has a data lake in AWS using S3 and Glue. The security team requires that all data in the data lake be encrypted at rest using a customer-managed KMS key. However, some users are able to upload data without encryption. What is the most effective way to enforce encryption?

Accepted Answer

Apply an S3 bucket policy that denies s3:PutObject unless encryption headers are present. Option A is correct because an S3 bucket policy with a condition that denies s3:PutObject unless the x-amz-server-side-encryption header is present and specifies the required KMS key enforces encryption at the point of upload. This prevents any unencrypted object from being written to the bucket, regardless of the client or tool used, and works with any IAM principal. It is the most effective and direct method to enforce encryption for all uploads.

Answer

Use AWS Config rules to remediate non-compliant objects

Answer

Require users to use pre-signed URLs for uploads

Answer

Attach an SCP that denies s3:PutObject without encryption

Question 15

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Accepted Answer

Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.. Option B is correct because VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Answer

Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

Answer

Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

Answer

Place a network load balancer in each VPC and capture traffic using a packet sniffer.

Question 16

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Accepted Answer

S3 Object Lock. S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 17

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

Accepted Answer

Delegated administrator for AWS services. Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Answer

AWS Control Tower

Answer

Cross-account IAM roles

Answer

AWS CloudTrail organization trail

Question 18

A company is designing a multi-account strategy using AWS Organizations. They need to enforce that all IAM users in member accounts must use multi-factor authentication (MFA) to access the AWS Management Console. Which TWO approaches should they combine to enforce this requirement?

Accepted Answer

Create a service control policy (SCP) that denies console access unless aws:MultiFactorAuthPresent is true.. Option C is correct because a service control policy (SCP) can be applied centrally at the organizational unit or account level to deny all console access unless the `aws:MultiFactorAuthPresent` condition key is `true`. This enforces MFA usage across all member accounts and cannot be overridden by account administrators. Option E is also correct because an IAM policy with the same condition key can be attached to all users or groups within each account, providing an additional layer of enforcement. Combining both ensures that even if the SCP is bypassed or not applied to a specific account, the IAM policy still enforces MFA. Together, they provide defense in depth.

Answer

Use AWS Config rules to detect users without MFA and send alerts.

Answer

Enable AWS CloudTrail to log console access without MFA.

Answer

Use AWS Single Sign-On (SSO) with MFA enabled for all users.

Question 19

A company uses AWS Organizations and wants to centralize Amazon VPC IP Address Manager (IPAM) across multiple accounts. Which TWO steps are required to enable cross-account IPAM?

Accepted Answer

Share the IPAM pool using AWS Resource Access Manager (RAM).. Option C is correct because AWS Resource Access Manager (RAM) is the service used to share IPAM pools across accounts in an AWS Organization. Sharing the pool allows member accounts to allocate CIDRs from the centrally managed pool without needing direct access to the management account. This enables centralized IP address management while maintaining account isolation.

Answer

Create a PrivateLink endpoint for IPAM.

Answer

Enable VPC sharing in each member account.

Answer

Set up AWS Direct Connect between accounts.

Question 20

A company has a multi-account AWS environment and wants to enforce that all EC2 instances are launched with a specific AMI ID. The AMI ID is maintained by the security team in a central account. What is the MOST effective way to enforce this across all accounts?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances if the ami parameter does not match the approved AMI ID. Option D is correct because an SCP can centrally deny the ec2:RunInstances action unless the request includes a specific AMI ID parameter, enforced across all accounts in the AWS Organization. This preventive control blocks non-compliant launches at the API level, ensuring no instance can be created with an unapproved AMI, regardless of account-level permissions.

Answer

Create an EC2 launch template with the approved AMI and share it with all accounts

Answer

Use AWS CloudTrail to monitor instance launches and trigger a Lambda function to terminate non-compliant instances

Answer

Use AWS Config rules in each account to detect non-compliant instances and send alerts