SAP-C02 Practice Test 34 — 15 Questions

Question 1

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data lake will ingest data from multiple sources, including streaming data from Amazon Kinesis Data Streams and batch data from on-premises systems via AWS Snowball. The company needs to catalog the data and make it available for querying with Amazon Athena and Amazon Redshift Spectrum. Which combination of services should the company use to meet these requirements?

Accepted Answer

Use AWS Glue to create a data catalog and run ETL jobs for both streaming and batch data.. AWS Glue provides a managed data catalog that integrates with Athena and Redshift Spectrum. Glue ETL can handle both streaming and batch data. Option B is correct. Option A is wrong because Athena does not catalog data. Option C is wrong because Lake Formation builds on Glue. Option D is wrong because Kinesis Data Firehose is for streaming only.

Answer

Use AWS Lake Formation to set up the data lake and use its built-in catalog.

Answer

Use Amazon Athena to create tables and partitions directly from S3.

Answer

Use Amazon Kinesis Data Firehose to deliver streaming data to S3 and catalog with Athena.

Question 2

A company needs to store application logs for at least one year with the ability to query them occasionally. The logs are generated at a rate of 10 GB per day. Which storage solution is MOST cost-effective?

Accepted Answer

Stream logs to Amazon S3 using Amazon Kinesis Data Firehose, then use S3 Lifecycle policies to transition to S3 Standard-IA after 30 days.. Amazon S3 with S3 Intelligent-Tiering or S3 Standard-IA is cost-effective for infrequent access. Option A (CloudWatch Logs) is expensive for long-term storage. Option C (S3 Glacier) has retrieval delays. Option D (EBS) is not suitable for logs.

Answer

Store logs on Amazon EBS volumes attached to a single EC2 instance for querying.

Answer

Store logs in Amazon S3 Glacier and use S3 Select to query directly.

Answer

Stream logs to Amazon CloudWatch Logs and set a retention policy of 365 days.

Question 3

A company is building a microservices architecture on Amazon ECS. Services need to communicate with each other and with external SaaS applications. The architect must ensure that service discovery is dynamic and that traffic to external services is routed through a single egress point for security and monitoring. Which combination of services should the architect use?

Accepted Answer

AWS Cloud Map for service discovery and a NAT gateway for egress. AWS Cloud Map provides service discovery for microservices, and a NAT gateway provides a consistent egress point. Option B (ALB) is for ingress, not egress. Option C (Route 53) is for DNS resolution but not for egress. Option D (VPC endpoints) is for private connectivity to AWS services, not external SaaS.

Answer

Amazon Route 53 for service discovery and an Application Load Balancer for egress

Answer

AWS Cloud Map for service discovery and an Internet Gateway for egress

Answer

Amazon Route 53 for service discovery and VPC endpoints for egress

Question 4

A company is designing a new application that will store sensitive customer data in Amazon S3. The data must be encrypted at rest. The company wants to use an encryption solution that provides an audit trail of when keys are used and by whom. The company also wants to rotate the encryption keys automatically every year. Which two options meet these requirements? (Choose TWO.)

Accepted Answer

Use client-side encryption with an AWS KMS managed key. Options B and C are correct. SSE-KMS uses AWS KMS which provides audit trail via CloudTrail and automatic key rotation. SSE-C does not provide key rotation. Client-side encryption with KMS also provides audit trail and rotation. Option A (SSE-S3) does not provide audit trail. Option D (SSE-C) does not provide rotation. Option E (client-side with master key) does not provide rotation or audit trail.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Use server-side encryption with customer-provided keys (SSE-C)

Answer

Use client-side encryption with a master key stored in AWS Secrets Manager

Question 5

A company is designing a data lake on Amazon S3. The data will be ingested from various sources, including streaming data from IoT devices. The data must be processed in near real-time to derive insights. The company wants to use serverless technologies to minimize operational overhead. Which combination of services should the company use?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, and Amazon Kinesis Data Firehose.. Option A is correct because Kinesis Data Streams ingests streaming data, Kinesis Data Analytics performs near real-time analysis, and Kinesis Data Firehose delivers the results to S3. Option B is wrong because SQS is not for streaming data. Option C is wrong because Lambda alone cannot handle streaming data at scale. Option D is wrong because Glue is for batch ETL, not real-time.

Answer

AWS Lambda, Amazon DynamoDB Streams, and Amazon S3.

Answer

Amazon SQS, AWS Lambda, and Amazon S3.

Answer

Amazon Kinesis Data Firehose, AWS Glue, and Amazon S3.

Question 6

A company is designing a new microservices architecture on Amazon ECS with Fargate. The services need to communicate with each other securely. The company wants to use service discovery so that services can find each other using DNS names. Which AWS service should the company use?

Accepted Answer

AWS Cloud Map with namespaces and service instances.. Option C is correct because AWS Cloud Map provides service discovery for ECS services, allowing them to register and discover each other via DNS or API calls. Option A is wrong because Route 53 private hosted zones can be used but Cloud Map is specifically designed for service discovery. Option B is wrong because ELB is for load balancing, not service discovery. Option D is wrong because VPC endpoints are for accessing AWS services privately, not for service discovery.

Answer

AWS PrivateLink with VPC endpoint services.

Answer

Amazon Route 53 private hosted zones with DNS records for each service.

Answer

Elastic Load Balancing with internal load balancers for each service.

Question 7

A company is designing a multi-region active-active architecture for a web application using Amazon Route 53 latency-based routing. The application runs on EC2 instances in Auto Scaling groups with Application Load Balancers in each region. The application uses an Amazon Aurora global database for its data tier. The architecture must provide the lowest possible RTO and RPO for regional failures. What should the company do to meet these requirements?

Accepted Answer

Use the Aurora Global Database failover capability to promote the secondary region to primary.. Aurora Global Database has a typical RPO of 1 second and RTO of 1 minute for regional failover. Failover is initiated by promoting the secondary region's cluster to primary. Option D is correct. Option A is wrong because failover is manual; there's no automatic failover to a cross-Region read replica. Option B is wrong because Route 53 health checks do not trigger Aurora failover. Option C is wrong because RDS Multi-AZ is for single-region HA, not multi-region.

Answer

Configure Amazon RDS for MySQL with a cross-Region read replica and automatic failover.

Answer

Use Route 53 health checks to detect regional failure and automatically update the Aurora Global Database endpoint.

Answer

Use Amazon RDS Multi-AZ with synchronous replication across Regions.

Question 8

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket. The company wants to use a custom domain name and SSL/TLS termination. Which THREE services should the company use together to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon CloudFront with an S3 origin.. CloudFront can serve content from S3 globally, with custom domain and SSL. S3 is the origin. Route 53 manages DNS for the custom domain. Option A, B, and D are correct. Option C is wrong because ALB is not needed for static content. Option E is wrong because AWS WAF is for security, not required.

Answer

AWS WAF to protect the website.

Answer

Application Load Balancer to distribute traffic across multiple S3 buckets.

Question 9

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

Accepted Answer

Order two AWS Direct Connect connections from different providers and configure them in a LAG.. AWS Direct Connect with multiple connections provides dedicated, consistent throughput and high availability. Option A (VPN) is lower throughput. Option C (VPN over Internet) is not dedicated. Option D (Transit Gateway) is for managing multiple VPCs, not the primary connection.

Answer

Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.

Answer

Use a single AWS Direct Connect connection with a backup VPN over the internet.

Answer

Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.

Question 10

A financial services company needs to store transaction records for 7 years to meet regulatory requirements. The records must be retrievable within 24 hours of a request. The volume of data is 10 TB per year. Which storage solution is MOST cost-effective?

Accepted Answer

Amazon S3 Glacier Deep Archive. Amazon S3 Glacier Deep Archive is the lowest-cost storage for long-term archival with retrieval times of 12-48 hours, meeting the 24-hour requirement. Option A (S3 Standard) is more expensive. Option B (S3 Glacier) is more expensive than Deep Archive. Option C (S3 Intelligent-Tiering) is designed for changing access patterns, not long-term archive.

Answer

Amazon S3 Intelligent-Tiering

Answer

Amazon S3 Glacier with expedited retrieval

Answer

Amazon S3 Standard with lifecycle policies to transition to S3 Glacier after 1 year

Question 11

A company is designing a new application that will use Amazon DynamoDB as its database. The application will have a heavy read workload with occasional write spikes. The company wants to minimize costs while ensuring that reads are eventually consistent and writes are not throttled. Which three options should the architect consider? (Choose THREE.)

Accepted Answer

Use Auto Scaling for write capacity. Options A, B, and D are correct. DynamoDB Accelerator (DAX) provides a cache for reads, reducing read capacity units. Read capacity can be set to eventually consistent reads (lower cost). Auto Scaling adjusts write capacity to handle spikes. Option C is wrong because strongly consistent reads cost more. Option E is wrong because DynamoDB Streams are for change capture, not for read performance.

Answer

Use DynamoDB Streams to asynchronously replicate data to a second table for reads

Answer

Use strongly consistent reads for all queries

Question 12

A company is designing a new application that will run on Amazon ECS with Fargate launch type. The application needs to store session state that is shared across multiple tasks. The session data must be highly available and low-latency. Which AWS service should be used to store the session state?

Accepted Answer

Amazon ElastiCache for Redis. Option B is correct because Amazon ElastiCache for Redis provides an in-memory data store with low latency and high availability, ideal for session state. Option A is wrong because DynamoDB is a NoSQL database with higher latency than in-memory. Option C is wrong because EFS is a file system, not optimized for session state. Option D is wrong because RDS is a relational database with higher latency.

Answer

Amazon EFS

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Question 13

A company wants to implement a multi-account strategy using AWS Organizations. The security team requires that all new accounts added to the organization automatically inherit a baseline set of security controls, such as AWS CloudTrail and AWS Config rules. Which approach should the company use?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the baseline stack to new accounts automatically.. Option C is correct because AWS CloudFormation StackSets allow you to deploy stacks across multiple accounts and regions from a single template, which can be automated to apply to new accounts. Option A is wrong because Service Control Policies (SCPs) are used to restrict permissions, not to deploy resources. Option B is wrong because AWS Config aggregators only collect configuration data, not deploy resources. Option D is wrong because AWS Systems Manager is primarily for operational management, not automated resource deployment across accounts.

Answer

Use AWS Organizations Service Control Policies (SCPs) to enforce the baseline controls.

Answer

Use AWS Systems Manager Automation to apply the baseline to new accounts.

Answer

Use AWS Config aggregators to apply the baseline controls to new accounts.

Question 14

A company uses AWS Organizations with multiple OUs. The security team wants to prevent all accounts in the 'Production' OU from using non-compliant EC2 instance types, but allow exceptions for specific accounts. Which combination of controls should be used?

Accepted Answer

Use an SCP to deny non-compliant instance types at the OU level, and use resource-based policies on exception accounts to allow them.. Option D is correct because SCPs can deny access to non-compliant instance types at the OU level, and resource-based policies on the exception accounts can allow them to override the SCP. Option A is wrong because IAM policies alone are not effective when an SCP denies the action. Option B is wrong because AWS Config rules only detect, not block. Option C is wrong because tagging alone does not enforce instance type restrictions.

Answer

Use AWS Config rules to mark non-compliant instances and use AWS Lambda to terminate them.

Answer

Use resource tags to identify compliant instances and enforce via IAM conditions.

Answer

Use IAM policies to deny non-compliant instance types for the Production OU, and attach a different IAM policy to exception accounts.

Question 15

A company has a central IT team that manages networking resources for multiple application teams. Each application team needs to manage its own EC2 instances and RDS databases. Which AWS architecture best supports this separation of duties?

Accepted Answer

Use a shared VPC with separate subnets for each team, with IAM policies to control access.. Option B is correct because a shared VPC allows the central IT team to manage the network while application teams can create their own resources in the same VPC. Option A is wrong because individual VPCs per team would not allow central management. Option C is wrong because VPC peering does not provide central management. Option D is wrong because AWS Transit Gateway does not control resource creation permissions within VPCs.

Answer

Use AWS Transit Gateway to connect individual VPCs managed by each team.

Answer

Create a single VPC and use VPC peering to connect team resources.

Answer

Create a separate VPC for each application team and use VPC peering.