SAP-C02 Practice Test 32 — 15 Questions

Question 1

A company is using AWS Organizations with hundreds of accounts. They need to ensure that no account can modify the VPC default security group. Which SCP should they apply to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroupRules","Resource":"arn:aws:ec2:*:*:security-group/*","Condition":{"StringEquals":{"ec2:Vpc":"arn:aws:ec2:*:*:vpc/*"}}}]}. Option A is correct because it denies the ec2:ModifySecurityGroupRules action on the default security group. Option B is wrong because it denies all security group modifications. Option C is wrong because it denies creation. Option D is wrong because it denies deletion.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:DeleteSecurityGroup","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroup*","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateSecurityGroup","Resource":"*"}]}

Question 2

A company wants to allow developers to launch EC2 instances only if they include a specific tag 'CostCenter'. The tag must be provided at launch. Which IAM policy should be used?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"ec2:CreateAction":"true"}}}. Option B is correct because the condition ec2:CreateAction ensures the tag is applied during launch. Option A is wrong because the condition is on the tag, not on the action. Option C is wrong because it requires a specific value. Option D is wrong because it denies all launches without tag.

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"false"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"Null":{"aws:RequestTag/CostCenter":"true"}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"aws:RequestTag/CostCenter":"MyProject"}}}

Question 3

A company wants to centralize management of AWS resources across multiple accounts using AWS Control Tower. What is a prerequisite for setting up Control Tower?

Accepted Answer

An AWS Organizations management account.. Option B is correct because Control Tower requires an AWS Organizations management account. Option A is wrong because it is not required. Option C is wrong because Control Tower sets up a landing zone. Option D is wrong because multiple OUs are created automatically.

Answer

A pre-configured landing zone.

Answer

At least three organizational units (OUs).

Answer

Existing AWS Config rules in all accounts.

Question 4

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.

Question 5

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 6

A company wants to implement AWS Organizations with multiple OUs to isolate development, testing, and production workloads. The company needs to ensure that production workloads are not impacted by changes in other OUs. Which TWO practices should the company follow? (Choose two.)

Accepted Answer

Use separate AWS accounts for each environment to provide strong isolation.

Answer

Allow all users to assume cross-account roles for easier management.

Answer

Share the same VPC across all OUs to simplify networking.

Answer

Use resource tagging to isolate environments instead of accounts.

Question 7

A company is designing a new application that will run on Amazon ECS with Fargate. The application must process messages from an Amazon SQS queue and store results in an Amazon DynamoDB table. The workload is unpredictable and can scale from 0 to thousands of messages per second. What is the MOST cost-effective and scalable architecture?

Accepted Answer

Use an AWS Lambda function with an SQS trigger to process messages and write to DynamoDB.. Option C is correct because using a Lambda function to poll the SQS queue and write to DynamoDB is serverless, scales automatically, and is cost-effective for unpredictable workloads. Option A is wrong because provisioning EC2 instances for ECS with Fargate still incurs costs even when idle. Option B is wrong because ECS with Fargate services require at least one running task, which may be idle. Option D is wrong because Kinesis Data Streams is designed for real-time streaming, not for standard message queuing, and may be more expensive.

Answer

Run an Amazon ECS service with Fargate that polls the SQS queue and writes to DynamoDB. Configure auto scaling based on CPU utilization.

Answer

Use an Amazon ECS service with Fargate and a target tracking scaling policy based on SQS queue depth.

Answer

Use Amazon Kinesis Data Streams to ingest messages and an AWS Lambda function to process and write to DynamoDB.

Question 8

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

Accepted Answer

Store the database credentials in AWS Secrets Manager.. Options A, C, and D are correct. Store credentials in Secrets Manager, configure automatic rotation, and grant Lambda access to retrieve secrets via IAM policy. Option B is wrong because Lambda does not need direct access to RDS for credential management. Option E is wrong because rotation is handled by Secrets Manager, not by Lambda.

Answer

Grant the Lambda function's IAM role permission to access the RDS database directly.

Answer

Write custom rotation logic in the Lambda function to change the database password.

Question 9

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to store files in Amazon S3. The company has a strict security requirement that the application must not have any long-term credentials stored in the container image or environment variables. Which THREE steps should the company take to meet this requirement? (Choose THREE.)

Accepted Answer

Create an IAM role with permissions to access the S3 bucket.. IAM roles for tasks allow containers to obtain temporary credentials. An IAM policy with S3 permissions is attached to the role. The task definition must include a taskRoleArn. Option A, B, and D are correct. Option C is wrong because storing credentials in Secrets Manager still requires credentials to access the secret. Option E is wrong because AWS CLI will automatically use credentials from the task role, no configuration needed.

Answer

Store AWS access keys in AWS Secrets Manager and retrieve them at runtime.

Answer

Configure the application to use the AWS CLI with environment variables for credentials.

Question 10

A company is designing a serverless application using AWS Lambda to process incoming files from Amazon S3. Each file is less than 1 MB and processing must complete within 10 seconds. The application must handle bursts of up to 1,000 concurrent invocations. Which configuration will provide the MOST cost-effective solution?

Accepted Answer

Set function memory to 128 MB and leave concurrency at the account default of 1,000.. Lambda concurrency limit of 1,000 and function memory of 128 MB is sufficient for small files and cost-effective. Option A (reserved concurrency) may waste resources. Option C (provisioned concurrency) incurs extra cost. Option D (VPC) adds unnecessary network cost.

Answer

Use provisioned concurrency for 1,000 concurrent executions with 128 MB memory.

Answer

Place the Lambda function in a VPC with 1,024 MB memory for faster processing.

Answer

Set reserved concurrency to 1,000 and function memory to 256 MB.

Question 11

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by third-party APIs. The company plans to use an Application Load Balancer with EC2 instances. Which two steps should the company take to ensure the ALB has a consistent set of IP addresses? (Choose TWO.)

Accepted Answer

Place the ALB behind an AWS Global Accelerator.. Using AWS Global Accelerator provides two static anycast IP addresses. Associating the ALB with a WAF protects the application. Option B (NLB with EIP) is not required if using Global Accelerator. Option D (NAT Gateway) is for outbound traffic. Option E (Route 53) does not provide static IP.

Answer

Use a NAT Gateway with Elastic IPs for outbound traffic.

Answer

Place a Network Load Balancer with Elastic IP addresses in front of the ALB.

Answer

Use Amazon Route 53 with an A record pointing to the ALB.

Question 12

A company is designing a multi-region active-active application using Amazon Route 53 latency-based routing. The application runs on Amazon EC2 instances behind Application Load Balancers (ALBs) in two AWS Regions. The company needs to ensure that if one region becomes unavailable, traffic is automatically routed to the healthy region with minimal disruption. Which configuration meets these requirements?

Accepted Answer

Configure Route 53 latency-based routing with health checks attached to each ALB endpoint.. Option B is correct because Route 53 health checks can monitor ALB endpoints. When a health check fails, Route 53 removes the unhealthy endpoint from latency-based routing, directing traffic to the healthy region. Option A is wrong because latency-based routing alone does not failover. Option C is wrong because failover routing requires a primary/secondary setup, not active-active. Option D is wrong because weighted routing does not automatically failover based on health.

Answer

Use Route 53 failover routing instead of latency-based routing.

Answer

Configure Route 53 latency-based routing without health checks.

Answer

Use Route 53 weighted routing with weights set to 50 for each region.

Question 13

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Launch EC2 instances in an Auto Scaling group across multiple Availability Zones.. Options A, D, and E are correct. Using an Auto Scaling group across multiple AZs, an ALB that distributes traffic across AZs, and health checks to replace unhealthy instances ensure high availability and fault tolerance. Option B is wrong because single AZ is not fault-tolerant. Option C is wrong because a larger instance type does not provide fault tolerance.

Answer

Use a larger EC2 instance type to handle failures.

Answer

Use a single Availability Zone to reduce latency.

Question 14

A company has an S3 bucket with server-side encryption using S3-Managed Keys (SSE-S3). The IAM policy shown in the exhibit is attached to a user. When the user attempts to download an object using the AWS CLI with no encryption headers, the request fails. What is the MOST likely reason?

Accepted Answer

The policy condition requires the encryption header in the request.. The policy requires that the request include the encryption header 'x-amz-server-side-encryption: AES256'. SSE-S3 uses AES256, but the condition requires the header to be present in the request. Without the header, the request does not satisfy the condition. Option B is correct. Option A is wrong because the user has GetObject permission. Option C is wrong because the bucket policy does not need to match. Option D is wrong because SSE-S3 is enabled by default.

Answer

The object is encrypted with SSE-KMS, not SSE-S3.

Answer

The user does not have the s3:GetObject permission.

Answer

The bucket has a bucket policy that denies all requests.

Question 15

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

Accepted Answer

Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.. Amazon Aurora Global Database provides replication with sub-second RPO. Route 53 failover routing with health checks on port 8080 enables fast RTO. Option A (cross-region read replica) has higher RPO. Option C (RDS Multi-AZ) is single-region. Option D (Application Load Balancer) is not cross-region.

Answer

Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

Answer

Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

Answer

Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.