SAP-C02 Practice Test 33 — 15 Questions

Question 1

A company is modernizing a monolithic application into microservices on Amazon ECS. They want to decouple services and improve resilience. Which AWS service should they use for asynchronous communication between microservices?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Amazon SQS. Amazon SQS provides a fully managed message queue for asynchronous communication, decoupling services. Option B (Amazon Kinesis Data Streams) is for streaming data. Option C (Amazon API Gateway) is for synchronous REST APIs. Option D (Amazon SNS) is pub/sub, not point-to-point queue.

Answer

Amazon Kinesis Data Streams

Answer

Amazon API Gateway

Answer

Amazon SNS

Question 2

A company is planning to migrate 50 TB of data from on-premises to Amazon S3 over a 100 Mbps internet connection. The data is not time-sensitive and can tolerate some latency. Which migration method is MOST cost-effective and suitable?

Accepted Answer

Use AWS Snowball Edge devices to transfer the data.. AWS Snowball Edge is designed for large-scale data transfer when network bandwidth is limited, making it cost-effective for 50 TB over a 100 Mbps link. Option A is wrong because AWS DataSync over the internet would take very long (approximately 46 days) and is not optimal for such a large volume. Option B is wrong because S3 Transfer Acceleration improves speed via optimized routing but cannot overcome the 100 Mbps bandwidth cap; the transfer would still be slow. Option D is wrong because a 1 Gbps Direct Connect connection would be significantly more expensive than Snowball Edge, and since the data is not time-sensitive, physical shipment is more suitable.

Answer

Use AWS DataSync over the existing internet connection.

Answer

Enable S3 Transfer Acceleration on the destination bucket.

Answer

Provision a 1 Gbps AWS Direct Connect connection.

Question 3

A company is migrating a legacy e-commerce application to AWS. The application includes a web tier, an application tier, and a MySQL database. The company wants to improve scalability and reduce operational overhead. The architect plans to use Amazon RDS for MySQL and refactor the application to use Auto Scaling for the web and application tiers. However, the application currently stores session state locally on the web servers. What should the architect do to address session state management in the new architecture?

Accepted Answer

Use Amazon ElastiCache for Redis to store session state. Using ElastiCache for Redis provides a centralized, scalable session store that works with Auto Scaling. Using sticky sessions (ELB session stickiness) is a workaround but less scalable and not recommended for Auto Scaling. Storing sessions in RDS would add database load. Storing in S3 is not suitable for low-latency session access.

Answer

Store session state in Amazon S3

Answer

Store session state in Amazon RDS for MySQL

Answer

Configure an Application Load Balancer with sticky sessions

Question 4

A company is migrating a legacy Windows application to AWS. The application requires a shared file system accessible from multiple EC2 instances. Which AWS storage solution should the company use?

Accepted Answer

Amazon FSx for Windows File Server. Amazon FSx for Windows File Server provides a fully managed native Windows file system that supports the SMB protocol, which is required for legacy Windows applications to access shared file systems. Amazon EFS uses NFS, which is not natively supported by Windows. EBS with multi-attach is limited to a small number of instances and not ideal for file sharing. S3 is object storage and does not provide a traditional file system interface.

Answer

Amazon Elastic File System (EFS)

Answer

Amazon Elastic Block Store (EBS) with multi-attach enabled

Answer

Amazon Simple Storage Service (S3)

Question 5

Which TWO of the following are best practices for migrating a large-scale relational database to Amazon Aurora using AWS DMS? (Choose two.)

Accepted Answer

Use multiple parallel DMS tasks to improve throughput. Using parallel tasks improves throughput. Validating data after migration ensures consistency. Disabling foreign keys may cause data integrity issues. Using largest instance type may not be cost-effective. Using CDC reduces downtime.

Answer

Disable foreign key constraints on the target database during migration to speed up the load

Answer

Use the largest DMS replication instance to maximize performance

Answer

Migrate while the source database is fully active without any downtime

Question 6

A company wants to migrate its on-premises virtualized workloads to AWS using the VMware Cloud on AWS service. The company currently uses VMware vSphere for virtualization. What is the primary benefit of using VMware Cloud on AWS for this migration?

Accepted Answer

It allows the company to continue using existing VMware management tools and processes. VMware Cloud on AWS allows organizations to use the same VMware tools and processes, minimizing the learning curve and operational changes. It does not automatically reduce costs, nor does it provide better performance or eliminate the need to refactor applications.

Answer

It provides better application performance compared to running on AWS native compute

Answer

It reduces the total cost of ownership by eliminating the need for any hardware maintenance

Answer

It eliminates the need to refactor applications for the cloud

Question 7

A company is planning a hybrid cloud migration and needs to establish a dedicated network connection between its on-premises data center and AWS with consistent low latency. Which AWS service should be used?

Accepted Answer

AWS Direct Connect. AWS Direct Connect provides a dedicated private network connection from on-premises to AWS, offering consistent low latency. Option A is correct for this reason. Option B (AWS Client VPN) is incorrect because it is designed for individual remote clients, not a dedicated connection. Option C (AWS Transit Gateway) is incorrect as it is a hub for connecting networks, not a direct connection method. Option D (AWS Site-to-Site VPN) is incorrect because it uses the public internet and does not provide dedicated bandwidth or consistent low latency.

Answer

AWS Client VPN

Answer

AWS Transit Gateway

Answer

AWS Site-to-Site VPN

Question 8

A company is migrating a legacy PHP application running on a single on-premises server to AWS. The application stores session data locally on the server's filesystem. The company wants to achieve high availability and elasticity for the application on AWS. What should the company do to handle session state in the new architecture?

Accepted Answer

Store session data in Amazon ElastiCache for Redis. Using ElastiCache for session storage decouples session state from individual servers, allowing the application to scale horizontally. Sticky sessions with an ALB ties a user to a specific instance, which reduces availability if that instance fails. Storing sessions on EFS is possible but slower than ElastiCache. Re-architecting to use Cognito is unnecessary for session state.

Answer

Configure an Application Load Balancer with sticky sessions enabled

Answer

Use Amazon EFS to share the session files across multiple EC2 instances

Answer

Refactor the application to use Amazon Cognito for session management

Question 9

A company wants to migrate its on-premises Active Directory to AWS Managed Microsoft AD to support Windows-based workloads on AWS. The company has a complex Active Directory structure with multiple domains, group policies, and trusts with external directories. Which migration approach should the company use?

Accepted Answer

Establish a forest trust between the on-premises AD and AWS Managed Microsoft AD, then gradually move resources to AWS. Setting up a trust between the on-premises AD and AWS Managed Microsoft AD allows gradual migration of resources. This maintains existing authentication and group policies during the transition. Replacing AD with IAM is not suitable for Windows workloads. Replicating the entire AD structure via AD Connector is not possible. A full rebuild is complex and risky.

Answer

Replace Active Directory with AWS Identity and Access Management (IAM) for all authentication

Answer

Rebuild the entire Active Directory structure from scratch in AWS Managed Microsoft AD

Answer

Use AD Connector to proxy authentication requests from AWS to the on-premises AD

Question 10

A company is migrating a web application to AWS. The application currently runs on a single server and uses a MySQL database. The company wants to ensure high availability and scalability. The web application is stateless. Which TWO actions should the company take to achieve these goals? (Choose TWO.)

Accepted Answer

Deploy the web application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones, with an Application Load Balancer. To achieve high availability and scalability for the web application, the company should deploy the web tier across multiple Availability Zones using an Auto Scaling group with an Application Load Balancer (Option A), which distributes traffic and automatically scales instances. For the MySQL database, using Multi-AZ Amazon RDS (Option C) provides automatic failover and high availability. Option B (single RDS instance) is a single point of failure. Option D (ElastiCache) is for caching, not for high availability or scaling. Option E (large EC2 instance with Elastic IP) does not provide scalability or availability.

Answer

Use a single Amazon RDS for MySQL DB instance

Answer

Use Amazon ElastiCache to cache database queries

Answer

Use a large EC2 instance for the web application with Elastic IP

Question 11

Which TWO AWS services can be used to migrate on-premises applications to AWS without modifying the application code?

Accepted Answer

AWS VM Import/Export. AWS VM Import/Export allows importing VM images as EC2 instances, preserving the OS and applications. AWS MGN automates lift-and-shift replication. AWS DMS requires some changes for database migration. AWS DataSync is for data transfer. AWS App2Container requires containerization.

Answer

AWS DataSync

Answer

AWS Database Migration Service (DMS)

Answer

AWS App2Container

Question 12

A security engineer created the S3 bucket policy shown in the exhibit. The policy is intended to allow the role MyAppRole to get objects only if they are encrypted with SSE-S3. However, the role is getting access denied errors when trying to get objects that are encrypted with SSE-S3. What is the most likely cause?

Accepted Answer

The condition key 's3:x-amz-server-side-encryption' checks the request header, not the object's encryption state.. The condition key `s3:x-amz-server-side-encryption` evaluates the `x-amz-server-side-encryption` request header sent by the client during the GET request, not the encryption state of the object stored in S3. Since the role is making GET requests without this header (or with a different value), the condition fails even though the object is encrypted with SSE-S3. To enforce that only objects encrypted with SSE-S3 can be retrieved, you must use a different approach, such as a bucket policy with `s3:ExistingObjectTag` or a pre-signed URL that includes the required header.

Answer

The Principal is incorrect; it should be the role name, not ARN.

Answer

The Resource ARN is incorrect; it should be 'arn:aws:s3:::my-bucket'.

Answer

The condition key is misspelled.

Question 13

A company is migrating to a multi-account AWS environment. They want to centralize DNS management using Amazon Route 53 private hosted zones. The private zones must be accessible from all VPCs in the organization. Which THREE steps are required to achieve this?

Accepted Answer

Create a private hosted zone in the central networking account.. A private hosted zone must be created in a central networking account to serve as the authoritative DNS namespace for the organization's internal resources. This central account acts as the zone owner, allowing the zone to be associated with VPCs across multiple accounts via AWS Resource Access Manager (RAM).

Answer

Create a public hosted zone with the same name and configure DNSSEC.

Answer

Create a Route 53 Resolver outbound endpoint in each account.

Question 14

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager to store and rotate service credentials.. AWS Secrets Manager provides a secure way to store and automatically rotate service credentials (such as database passwords or API keys) used by microservices running on ECS Fargate. This eliminates hard-coded secrets and reduces the risk of credential exposure, aligning with security best practices for service-to-service authentication.

Answer

Configure mutual TLS (mTLS) between services using certificates from ACM.

Answer

Deploy an API Gateway in front of each microservice.

Question 15

Refer to the exhibit. A company is using AWS Migration Hub to track migrations. The above IAM policy is attached to an IAM role used by the migration tool. The migration tool reports that it cannot register the migration task with Migration Hub. Which action should the company add to the policy to fix the issue?

Accepted Answer

mgh:ImportMigrationTask. The migration tool needs mgh:ImportMigrationTask to register a migration task. Option B (AssociateDiscoveredResource) is for associating resource data, not registering tasks. Option C (CreateHomeRegion) is not needed. Option D (GetHomeRegion) is read-only.

Answer

mgh:AssociateDiscoveredResource

Answer

mgh:CreateHomeRegion

Answer

mgh:GetHomeRegion