SAP-C02 Practice Test 28 — 15 Questions

Question 1

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration. Option C (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 2

Which TWO actions will improve the security posture of an Amazon S3 bucket used to store sensitive data? (Choose two.)

Accepted Answer

Enable S3 Block Public Access settings at the account or bucket level.. Options B and D are correct. B: Enabling S3 Block Public Access prevents any public access to the bucket. D: Using bucket policies with condition keys such as aws:SourceIp restricts access to specific IP ranges. Option A is wrong because server access logs provide audit but do not improve security directly. Option C is wrong because encryption protects data at rest, not access control. Option E is wrong because versioning protects against accidental deletion but not unauthorized access.

Answer

Enable S3 Versioning on the bucket.

Answer

Enable default encryption using SSE-S3.

Answer

Enable S3 server access logging for the bucket.

Question 3

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Accepted Answer

Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.. Options A and C are correct. To guarantee ordering within a shard, use a single Lambda consumer per shard (option A). Exactly-once processing can be achieved by using the Kinesis Client Library (KCL) with an at-least-once delivery and deduplication in the Lambda function (option C). Option B is wrong because increasing batch size reduces ordering guarantees. Option D is wrong because SQS FIFO is for decoupling with ordering but introduces complexity. Option E is wrong because parallelization is not needed for ordering.

Answer

Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.

Answer

Increase the batch window to reduce the number of Lambda invocations.

Answer

Enable parallelization factor on the Lambda event source mapping.

Question 4

A startup needs a serverless compute service to run code in response to S3 events. The code should execute within milliseconds and require no server management. Which AWS service should be used?

Accepted Answer

AWS Lambda. Option B is correct because AWS Lambda is serverless and can be triggered by S3 events. Option A is wrong because ECS manages containers, not serverless. Option C is wrong because Fargate is serverless but still container-based. Option D is wrong because EC2 is virtual servers.

Answer

Amazon ECS

Answer

Amazon EC2

Answer

AWS Fargate

Question 5

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Option D is correct because CloudFront provides CDN with edge locations and AWS Shield Standard/Advanced provides DDoS protection. Option A is wrong because Route 53 is DNS, not CDN. Option B is wrong because Global Accelerator improves routing, not caching. Option C is wrong because WAF is for web application firewall, not DDoS.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 6

A company is designing a data lake on S3 with sensitive data that must be encrypted at rest and audited. Which TWO services should be used? (Choose TWO.)

Accepted Answer

AWS CloudTrail. Options B and D are correct. AWS KMS provides encryption keys, and CloudTrail logs access to S3 buckets. Option A is wrong because SSE-S3 provides encryption but no audit. Option C is wrong because Macie is for data discovery, not encryption. Option E is wrong because GuardDuty is for threat detection.

Answer

S3 Server-Side Encryption (SSE-S3)

Answer

Amazon Macie

Answer

Amazon GuardDuty

Question 7

A company is migrating a legacy monolithic application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to decouple the application into microservices while minimizing changes to the existing code. Which design approach is MOST cost-effective and requires the least code changes?

Accepted Answer

Use AWS App Runner for the existing application and add new microservices as separate App Runner services with a sidecar pattern. Using AWS App Runner with a sidecar pattern allows the existing application to run with minimal changes while adding microservices. Option A (refactoring to Lambda) requires significant code changes. Option B (using ECS with Fargate) involves containerization and orchestration. Option D (using Elastic Beanstalk) is simpler but does not inherently decouple into microservices.

Answer

Deploy the application on AWS Elastic Beanstalk and use Amazon RDS for MySQL

Answer

Refactor the application into AWS Lambda functions using an API Gateway

Answer

Containerize the application using Docker and run it on Amazon ECS with AWS Fargate, using Amazon RDS for MySQL

Question 8

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which approach provides the BEST security and performance?

Accepted Answer

Use AWS App Mesh for service-to-service communication with mutual TLS. AWS App Mesh provides service mesh capabilities for secure communication with mTLS, observability, and traffic control. Option A (internet-facing ALB) exposes services to the internet. Option B (NLB) also exposes services. Option D (VPC peering) is for connecting VPCs, not microservices.

Answer

Use VPC peering between the services' VPCs

Answer

Use an internet-facing Application Load Balancer for each service

Answer

Use an internal Network Load Balancer for each service

Question 9

A company is designing a new multi-region disaster recovery solution for a critical database. The database runs on Amazon RDS for MySQL in us-east-1. The recovery point objective (RPO) is 1 second, and the recovery time objective (RTO) is 1 minute. Which strategy meets these requirements?

Accepted Answer

Multi-AZ RDS instance with a cross-Region read replica in us-west-2. Option C is correct because Multi-AZ with a cross-Region read replica provides low RPO (via synchronous replication within the region and asynchronous to the replica) and fast failover (RTO ~1 minute). Option A (single-AZ with cross-Region snapshot) has higher RPO/RTO. Option B (Multi-AZ only) does not cover another region. Option D (Aurora Global Database) is for Aurora, not RDS MySQL.

Answer

Single-AZ RDS instance with cross-Region snapshot copy

Answer

Multi-AZ RDS instance in us-east-1

Answer

Amazon Aurora Global Database

Question 10

A healthcare company is storing sensitive patient data in Amazon S3. The compliance team requires that all data be encrypted at rest and that the encryption keys be rotated every 90 days. Additionally, the company must maintain an audit trail of all key usage. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use S3 server-side encryption with AWS KMS-managed keys (SSE-KMS) and enable automatic key rotation every 90 days. Enable AWS CloudTrail for KMS key usage logging.. Option D is correct because AWS KMS automatic key rotation handles rotation every 365 days (configurable to 90 days for custom key stores) and CloudTrail logs key usage. Option A is wrong because SSE-S3 does not provide key rotation control. Option B is wrong because SSE-C requires manual key management and rotation. Option C is wrong because client-side encryption places the burden on the application.

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and implement a Lambda function to rotate keys every 90 days.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3) and enable S3 server access logs.

Answer

Use client-side encryption with the AWS Encryption SDK and store the keys in AWS Secrets Manager with automatic rotation.

Question 11

A company has an IAM policy attached to a user as shown in the exhibit. The user is trying to stop an EC2 instance in the us-west-2 region. What will happen?

Accepted Answer

The user cannot stop the instance because the second statement denies all actions in regions other than us-east-1.. Option C is correct. The first statement allows DescribeInstances, StartInstances, StopInstances. The second statement denies all actions if the requested region is not us-east-1. Since us-west-2 is not us-east-1, the deny applies, and the user cannot stop the instance. Option A is wrong because the deny overrides the allow. Option B is wrong because the user cannot stop the instance. Option D is wrong because the action is explicitly denied.

Answer

The user cannot stop the instance because the condition checks the request region.

Answer

The user can stop the instance because the first statement allows it.

Answer

The user can stop the instance because the condition applies only to the Deny statement, but the Allow statement is unconditional.

Question 12

A company needs to store configuration files for multiple environments (dev, test, prod) and retrieve them programmatically with versioning and access control. Which AWS service should be used?

Accepted Answer

AWS Systems Manager Parameter Store. Option D is correct because AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data with versioning and IAM policies. Option A is wrong because S3 is object storage, not specifically for config. Option B is wrong because Secrets Manager is for secrets. Option C is wrong because DynamoDB is NoSQL.

Answer

AWS Secrets Manager

Answer

Amazon S3

Answer

Amazon DynamoDB

Question 13

A company is designing a new application that will run on EC2 instances behind an Application Load Balancer. The application must handle sudden spikes in traffic without manual intervention. Which scaling strategy should be used?

Accepted Answer

Target tracking scaling policy. Option C is correct because a target tracking scaling policy automatically adjusts capacity based on a CloudWatch metric. Option A is wrong because scheduled scaling is for predictable patterns. Option B is wrong because simple scaling is less responsive. Option D is wrong because manual scaling is not automated.

Answer

Manual scaling by operations team

Answer

Simple scaling with a cooldown period

Answer

Scheduled scaling based on historical data

Question 14

A developer runs the above AWS CLI command. What is the expected output?

Accepted Answer

A list of instance IDs for running web-server instances. Option A is correct because the command filters for instances with tag Name=web-server and state running, then outputs the InstanceIds as text. Option B is wrong because it outputs only if instances exist. Option C is wrong because the filter is correct. Option D is wrong because the query selects InstanceId, not all info.

Answer

A list of public IP addresses

Answer

All instance IDs regardless of state

Answer

An error because the query syntax is incorrect

Question 15

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Accepted Answer

The subnet's route table does not have a route to the internet gateway.. Option B is correct. The instance has a public IP (54.123.45.67), so it should be able to reach the internet. However, if the subnet does not have a route to the internet gateway, the instance cannot connect. Option A is wrong because the instance has a public IP. Option C is wrong because the security group allows outbound traffic. Option D is wrong because the instance state is running.

Answer

The instance does not have a public IP address.

Answer

The instance is not in a running state.

Answer

The security group is blocking outbound traffic.