SAP-C02 Practice Test 2 — 30 Questions

Question 1

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.. AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule. Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

Question 2

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 3

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 4

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 5

A company wants to assess its on-premises environment for migration to AWS. The company needs to collect utilization data for servers and applications. Which AWS service should the company use?

Accepted Answer

AWS Application Discovery Service. AWS Application Discovery Service collects server and application utilization data from on-premises environments to support migration planning. Option A is wrong because AWS Migration Hub tracks migrations but does not perform discovery. Option B is wrong because AWS Database Migration Service (DMS) is for migrating databases, not for collecting utilization data. Option D is wrong because AWS Server Migration Service (SMS) is deprecated and was used for migrating individual servers, not for discovery.

Answer

AWS Migration Hub

Answer

AWS Database Migration Service (DMS)

Answer

AWS Server Migration Service (SMS)

Question 6

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

Accepted Answer

Use AWS RAM to share the subnet with the organization.. AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Answer

Create a Transit Gateway and attach all accounts.

Answer

Set up a VPN connection between accounts.

Answer

Create a VPC peering connection between each account and the VPC owner.

Question 7

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

Accepted Answer

Check the security group rules for the instance.. The instance is running but the application is inaccessible, which often indicates that security group rules are not allowing the required inbound traffic. Option A is wrong because the instance is reported as 'running', so it is not terminated. Option B is wrong because the command output successfully returns instance details, meaning the instance ID is correct. Option C is wrong because status checks relate to the health of the instance OS and system, not network access.

Answer

Check if the instance is terminated.

Answer

Check if the instance ID is correct.

Answer

Check the instance status checks.

Question 8

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 9

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 10

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

Accepted Answer

Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.. Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Answer

Store the Docker image in Amazon S3 instead of ECR.

Answer

Use the 'latest' tag for all images.

Answer

Retry the failed pipeline step after a delay.

Question 11

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. A Lambda function attached to a VPC with only a private subnet has no route to the internet unless a NAT gateway (for outbound internet) or VPC endpoints (for AWS services) are configured. If the function calls external resources or AWS APIs without these, the calls hang until the 30-second timeout. This is the most likely cause of intermittent timeouts in this scenario.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 12

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for secure secret storage with built-in automatic rotation for RDS, Redshift, and DocumentDB credentials, plus custom Lambda-based rotation for other secrets. It centralizes secret management and integrates natively with EC2 via the AWS SDK or Secrets Manager Agent. KMS is for encryption keys, not secret lifecycle management, and Parameter Store lacks native rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 13

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Answer

AWS Data Pipeline

Answer

AWS Lambda functions

Answer

AWS Glue ETL jobs

Question 14

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

Accepted Answer

Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Answer

Store logs on an EBS volume and take regular snapshots.

Answer

Write logs to the instance store volume of each EC2 instance.

Answer

Write logs to an Amazon S3 bucket mounted on each instance using NFS.

Question 15

A company is designing a new real-time bidding platform that must handle sudden bursts of traffic up to 100,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores bid data in Amazon DynamoDB. The company wants to minimize latency and cost while ensuring the database can scale automatically. Which solution meets these requirements?

Accepted Answer

Use DynamoDB with on-demand capacity mode and enable DynamoDB Accelerator (DAX) for read-heavy workloads.. The correct solution uses DynamoDB on-demand mode to handle unpredictable bursts without capacity planning, and DAX to provide microsecond read latency for read-heavy operations. This combination ensures automatic scaling, low latency, and cost efficiency for a real-time bidding platform. Other options either require manual scaling, introduce bottlenecks, or are not optimized for the required throughput and latency.

Answer

Use Amazon RDS for MySQL with Multi-AZ and read replicas, and implement a caching layer using Amazon ElastiCache.

Answer

Use DynamoDB with provisioned capacity mode and set up Auto Scaling with a target utilization of 70%.

Answer

Use Amazon Aurora Serverless v2 with auto-scaling and enable Aurora Global Database for low-latency reads.

Question 16

A company is migrating 200 on-premises virtual machines running a mix of Windows and Linux workloads to AWS. The migration must complete within a tight cutover window, and the company wants to minimize manual configuration and scripting. A solutions architect needs to choose a migration approach that supports automated conversion of the source servers into Amazon EC2 instances with minimal changes. Which AWS service should the solutions architect use?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service is purpose-built for rehosting physical, virtual, or cloud servers to AWS. It continuously replicates source servers at the block level, then automatically launches them as EC2 instances for test or cutover. This removes the need to rebuild operating systems or applications manually, supports both Windows and Linux, and enables short cutover windows because the replication is ongoing. The other services address data transfer or database migration, not whole-server conversion.

Answer

AWS DataSync

Answer

AWS Database Migration Service (AWS DMS)

Answer

AWS Server Migration Service (AWS SMS)

Question 17

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

Accepted Answer

Implement retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code.. For synchronous REST-based microservices on ECS Fargate with variable traffic and a requirement to prevent cascading failures, implementing retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code is the correct approach. These patterns handle transient failures gracefully, prevent a failing service from overwhelming upstream callers, and ensure that a slow or unavailable dependency does not cause thread exhaustion or cascading timeouts.

Answer

Use Amazon API Gateway in front of each service to throttle requests and protect against traffic spikes.

Answer

Convert all inter-service communication to asynchronous messaging using Amazon SQS or SNS.

Answer

Deploy multiple instances of each service across multiple Availability Zones and use an Application Load Balancer.

Question 18

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS supports ongoing replication to minimize downtime during migration.

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Answer

AWS Snowball

Question 19

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

Accepted Answer

Implement a Read Replica and direct read traffic to it.. Implementing a Read Replica allows offloading read traffic from the primary DB instance. This reduces the load on the primary, potentially enabling the use of a smaller instance size or lowering provisioned IOPS, thereby reducing costs without affecting performance for the read-intensive application. Option A is incorrect because Multi-AZ deployment adds a standby instance and synchronous replication, increasing costs without direct performance benefit. Option B is incorrect; upgrading to the latest generation instance type may improve performance but generally does not reduce costs. Option D is incorrect; purchasing Reserved Instances provides a discount on hourly rates but does not address the utilization or instance size, so it does not directly reduce costs based on workload.

Answer

Change the DB instance to a Multi-AZ deployment.

Answer

Upgrade to the latest generation instance type.

Answer

Purchase Reserved Instances for the database.

Question 20

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.. Option D is correct because creating an organization trail from the management account with 'Enable for all accounts in my organization' is the mechanism that makes CloudTrail log events from every member account into the specified S3 bucket, satisfying the centralized logging requirement. Option E is correct because the central S3 bucket must have a bucket policy granting the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, and it must account for the source accounts (via aws:SourceArn or organization conditions) so logs from all accounts can be delivered. Option A is not required because S3 replication copies objects between buckets and is unrelated to CloudTrail's native organization trail delivery. Option B is not required because CloudTrail uses the service principal and bucket policy, not an IAM role in each member account, to deliver logs. Option C is not required because AWS Config records resource configuration changes and does not forward CloudTrail logs to S3.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.