SAP-C02 Practice Test 2 — 30 Questions

Question 1

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.. A service control policy (SCP) at the OU level can deny the s3:CreateBucket action unless the request includes both the x-amz-bucket-object-locked-enabled-for-bucket-creation header (for versioning) and the x-amz-server-side-encryption-aws-kms-key-id header (for KMS encryption). This enforces compliance at the API level with no ongoing overhead, as the SCP is evaluated before the bucket is created, preventing noncompliant buckets from existing at all.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.

Question 2

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

Accepted Answer

Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.. Option D is correct because AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Answer

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Answer

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Answer

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Question 3

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server. Option A is correct because a launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Answer

Configure lifecycle hooks in the Auto Scaling group to drain connections

Answer

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Answer

Use a Network Load Balancer to distribute traffic to web servers

Question 4

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL is the correct choice because it provides a managed MySQL database service that minimizes operational overhead through automated backups, patching, and scaling. Each microservice can have its own RDS instance, enabling database-per-service isolation while offloading administrative tasks like replication and failover to AWS.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon Aurora

Question 5

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

Accepted Answer

Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.. AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Answer

Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

Answer

Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

Answer

Store the configuration data in environment variables in the ECS task definition.

Question 6

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

Accepted Answer

Use target tracking scaling with a schedule to increase minimum capacity during business hours.. Option A is correct because combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Answer

Use step scaling policies based on memory utilization.

Answer

Use scheduled scaling to increase capacity during business hours.

Answer

Use simple scaling policies based on CPU utilization.

Question 7

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

Accepted Answer

Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.. Option A is correct because configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Answer

Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

Answer

Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

Answer

Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

Question 8

Drag and drop the steps to deploy a serverless application using AWS SAM in the correct order.

Question 9

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Question 10

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

Accepted Answer

Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.. Option A is correct because blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Answer

Stop all instances, launch new instances with the new version, and update the target group.

Answer

Update the existing target group's instances to the new version, one at a time.

Answer

Create a new ALB and update DNS to point to the new ALB.

Question 12

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Accepted Answer

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.. Option A is correct because Route 53 health checks can monitor the primary application's endpoint, and DNS failover to a secondary Region enables automatic traffic redirection within minutes, aligning with the 1-hour RTO. This approach provides a simple, stateless failover mechanism without requiring complex routing changes.

Answer

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Answer

Deploy the application on Amazon Aurora Global Database.

Question 13

A company is designing a serverless application using AWS Lambda for business logic and Amazon API Gateway for REST APIs. The application needs to store and retrieve user session data. Which service should they use for session state?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice for storing user session state in a serverless application because it provides an in-memory data store with sub-millisecond latency, which is ideal for session management where fast reads and writes are critical. Redis supports key-value structures with TTL (time-to-live) expiration, allowing automatic cleanup of stale sessions, and integrates seamlessly with Lambda and API Gateway via the ElastiCache client SDK.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 14

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Kinesis Data Stream with 10 shards.. Option C is correct because with a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Answer

Use DynamoDB Streams to trigger the Lambda function for each record.

Answer

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Answer

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Question 15

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. Option B is correct because IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 16

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with a DB cluster.. Option A is correct because a Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Answer

Use automated backups with 5-minute retention.

Answer

Take manual snapshots every 5 minutes and copy to another region.

Answer

Create a cross-region read replica in us-west-2.

Question 17

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

Accepted Answer

Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.. Option B is correct because Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Answer

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Answer

Use Amazon CloudFront with origins in each region.

Answer

Use AWS Global Accelerator with Network Load Balancers in each region.

Question 18

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 19

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

Accepted Answer

Use S3 Object Lambda with AWS CloudTrail. Option D is correct because S3 Object Lambda allows you to add custom code to S3 GET requests, enabling fine-grained access control based on tags by dynamically modifying the data returned. AWS CloudTrail provides the required audit trail by logging all API calls, including those to S3 Object Lambda, ensuring full auditability of access to the data lake.

Answer

Use S3 bucket policies with condition keys for tags

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Answer

Use AWS Lake Formation with column-level permissions

Question 20

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Answer

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Answer

Amazon DynamoDB Global Tables