SAP-C02 Practice Test 39 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. A service control policy (SCP) can be applied at the organization, organizational unit (OU), or account level to deny the s3:CreateBucket action unless the request includes the x-amz-bucket-object-lock-enabled header or the bucket is created with default encryption enabled. This enforces encryption at rest for all new S3 buckets across the entire organization. Option E is correct because AWS Config rules can evaluate existing S3 buckets for encryption compliance and trigger an automatic remediation action, such as enabling default encryption via AWS Systems Manager Automation, ensuring both new and existing buckets are encrypted.

Answer

Attach a bucket policy to each bucket that denies PutObject without encryption.

Answer

Create an IAM policy that denies s3:PutObject unless encryption is specified.

Answer

Enable S3 Block Public Access at the organization level.

Question 2

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

Accepted Answer

Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Enable Aurora Auto Scaling to add read replicas based on CPU or connections.. It uses an Auto Scaling group with a target tracking scaling policy based on CPU utilization to automatically scale the web tier, and enables Aurora Auto Scaling to add read replicas based on CPU or connections, which meets the requirements for both web and database scaling. Option B is incorrect because Amazon SQS is a message queue service and does not scale the database or handle read traffic for Aurora. Option C is incorrect because DynamoDB is a NoSQL database, not the specified Aurora MySQL database, and its auto scaling does not apply. Option D is incorrect because ElastiCache is a caching service, not the database tier, and its auto scaling does not address read scaling for Aurora.

Answer

Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Use Amazon SQS to queue read requests during peak traffic.

Answer

Use an Auto Scaling group with a simple scaling policy based on CPU utilization. Use DynamoDB Auto Scaling for the database.

Answer

Use an Auto Scaling group with a step scaling policy based on CPU utilization. Use ElastiCache Auto Scaling to add cache nodes for read traffic.

Question 3

A company runs a static website on Amazon S3 behind Amazon CloudFront. The website uses a custom domain and SSL certificate from AWS Certificate Manager (ACM). Users report that they sometimes see an older version of the website after updates. What should the company do to ensure users always see the latest content?

Accepted Answer

Create a CloudFront invalidation for the updated files.. Creating a CloudFront invalidation removes cached objects, forcing CloudFront to fetch the latest content from the origin. Option A is wrong because disabling and re-enabling the distribution is disruptive and unnecessary. Option B is wrong because bucket versioning controls object versions but does not invalidate CloudFront cache. Option C is wrong because reducing TTL to 0 affects future caching but does not clear existing cache.

Answer

Disable and re-enable the CloudFront distribution after each update.

Answer

Enable S3 bucket versioning and use version IDs in URLs.

Answer

Reduce the CloudFront TTL to 0 seconds for all objects.

Question 4

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without direct coupling. Which AWS service should they use to decouple the services?

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, allowing them to send, store, and receive messages without direct coupling. Services can poll or receive messages from the queue at their own pace, ensuring that the producer and consumer are decoupled and can operate independently, even if one is temporarily unavailable.

Answer

AWS Step Functions

Answer

Amazon SNS

Answer

Amazon Kinesis

Question 5

A company wants to implement a single sign-on (SSO) solution for its employees to access multiple AWS accounts. The company has an existing identity provider (IdP) that supports SAML 2.0. Which AWS service should be used to integrate with the IdP?

Accepted Answer

AWS IAM Identity Center.. AWS IAM Identity Center (formerly AWS SSO) is the recommended service for centrally managing SSO access to multiple AWS accounts. It natively integrates with external SAML 2.0 identity providers, allowing you to define permissions sets that govern user access across accounts without creating IAM users. This provides a single place to manage user assignments and enforce least-privilege access across your AWS Organization.

Answer

AWS Directory Service for Microsoft Active Directory.

Answer

Amazon Cognito user pools.

Answer

AWS Identity and Access Management (IAM) with SAML federation.

Question 6

A company uses AWS Organizations and wants to enable cost allocation across business units using tags. They require that all resources are tagged with a 'CostCenter' tag. What is the most effective way to enforce this?

Accepted Answer

Create a tag policy in AWS Organizations that requires the CostCenter tag on resources.. AWS Organizations tag policies allow you to define rules for tagging resources across all accounts in the organization, including enforcement of required tags like 'CostCenter'. Tag policies are evaluated at resource creation and can prevent non-compliant resources from being created, ensuring consistent cost allocation tagging without requiring individual account-level IAM changes.

Answer

Create an IAM policy in each account that requires the CostCenter tag.

Answer

Use AWS Config rules to identify untagged resources and automatically tag them.

Answer

Use an SCP to deny resource creation if the CostCenter tag is missing.

Question 7

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

Accepted Answer

Implement scheduled scaling actions to add capacity before known peak times.. Scheduled scaling can proactively add capacity before known peak times, preventing slow response times during traffic spikes. Option A is incorrect because decreasing the CPU utilization threshold would cause the Auto Scaling group to scale out sooner, which could help with responsiveness but may lead to over-provisioning and increased costs; however, it does not address the slow response times during a spike that has already started. Option B is incorrect because increasing the cooldown period delays subsequent scaling actions, making the system less responsive during a spike. Option D is incorrect because step scaling with a higher step adjustment is still a reactive measure; it does not add capacity before the spike and may cause abrupt scaling that could overshoot.

Answer

Decrease the CPU utilization threshold for scale-out.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Change the scaling policy to step scaling with a higher step adjustment.

Question 8

A company is migrating a monolithic application to a microservices architecture on AWS. They want to decouple the services and ensure that messages between services are processed asynchronously and durably. Which AWS service should they use for this purpose?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon SQS (Simple Queue Service) is the correct choice for decoupling microservices with asynchronous, durable message processing. It provides a fully managed message queue that allows services to send, store, and receive messages between software components without losing messages. Amazon Kinesis Data Streams (option A) is designed for real-time streaming of large data, not for point-to-point queue-based messaging. Amazon SNS (option C) is a pub/sub service that pushes messages to subscribers, but it does not provide durable storage or polling capabilities. AWS Step Functions (option D) is used for coordinating complex workflows, not for basic asynchronous messaging.

Answer

Amazon Kinesis Data Streams

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Step Functions

Question 9

A company is designing a new application that will run on Amazon EC2 instances. The application writes logs to local disk, and the logs must be aggregated centrally for analysis. The company wants a solution that requires minimal configuration and can handle high log volume. Which TWO AWS services should the company use?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs (option D) can collect logs from EC2 instances via the CloudWatch agent with minimal configuration and at scale. Amazon CloudWatch Logs Insights (option E) provides a query engine to interactively search and analyze the aggregated logs. Option A (Amazon S3) is used for log storage, not for real-time collection or analysis. Option B (AWS Lambda) can process logs but is not designed for high-volume log ingestion without additional setup. Option C (Amazon Kinesis Data Firehose) is for streaming data to destinations like S3 or Redshift, but it requires more configuration and is not the simplest solution for EC2 log collection.

Answer

Amazon S3

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Question 10

A company is migrating a multi-tier web application to AWS. The application consists of a web server, application server, and Oracle database. Which TWO AWS services should be used to modernize the application while reducing operational overhead?

Accepted Answer

Amazon RDS for Oracle. (Amazon RDS for Oracle) is correct because it manages the Oracle database, reducing operational overhead compared to self-managed EC2. Option C (AWS Elastic Beanstalk) is correct because it automatically handles the deployment and scaling of the web and application servers, reducing operational overhead. Option B (Amazon Lightsail) is not suitable for complex multi-tier applications. Option D (Amazon EC2) would increase operational overhead as it requires manual management. Option E (Amazon DynamoDB) is a NoSQL database and not suitable for migrating an Oracle database.

Answer

Amazon Lightsail

Answer

Amazon EC2

Answer

Amazon DynamoDB

Question 11

A company is designing a disaster recovery solution for a web application hosted on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The application uses an Amazon RDS for MySQL database. They need to recover the database with a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

Accepted Answer

Use RDS Cross-Region Read Replica and promote it.. RDS Cross-Region Read Replicas for MySQL provide asynchronous replication with an RPO of typically seconds, and promoting the replica to a standalone instance can be done quickly (minutes), meeting the RTO of 1 hour. Option A is incorrect because Multi-AZ is single region. Option B is incorrect because while DMS can achieve low RPO, it is typically used for migrations and ongoing replication setups may have higher operational complexity and RTO. Option D is incorrect because Amazon Aurora Global Database is not available for RDS MySQL; it is for Aurora databases.

Answer

Use RDS Multi-AZ in us-east-1 and failover to DR site.

Answer

Use AWS DMS with ongoing replication to an RDS instance in us-west-2.

Answer

Use Amazon Aurora Global Database.

Question 12

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

Accepted Answer

Global Tables. DynamoDB Global Tables provide a fully managed, multi-region, multi-active database for low-latency reads and writes globally. Option A (Auto Scaling) adjusts throughput but doesn't enable multi-region replication. Option B (DAX) is an in-memory cache that improves read latency but doesn't handle writes or multi-region. Option C (Streams) captures item-level changes but requires additional setup for cross-region replication. Option D (Global Tables) is the correct feature for active-active multi-region workloads.

Answer

Auto Scaling

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Streams

Question 13

A company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts be encrypted with AWS KMS and that bucket policies enforce HTTPS. What is the MOST efficient way to enforce these policies across all accounts?

Accepted Answer

Apply a service control policy (SCP) to the organizational unit (OU) containing all accounts.. Applying an SCP at the OU level that denies S3 bucket creation/updates without KMS encryption and HTTPS enforcement provides centralized enforcement across all accounts in the OU. This is the most efficient method as it prevents non-compliant actions at the API level. Option A is incorrect because SCPs applied to the management account do not affect member accounts and the management account itself is not restricted by SCPs. Option B is incorrect because while Lambda functions could remediate, they are reactive and require per-account deployment, making them less efficient than proactive SCP enforcement. Option D is incorrect because AWS Config rules can detect non-compliance but do not automatically enforce; automatic remediation may require additional setup and is also reactive.

Answer

Apply a service control policy (SCP) to the management account.

Answer

Create a custom AWS Lambda function to monitor and remediate non-compliant buckets.

Answer

Use AWS Config rules with automatic remediation in each account.

Question 14

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

Accepted Answer

Presigned URLs. Presigned URLs provide temporary, time-limited access to specific S3 objects without requiring AWS credentials. Option A (bucket policies) apply to all principals and cannot be restricted to specific users or time-limited directly. Option B (CloudFront signed URLs) are used for controlling access to content delivered via CloudFront, not for direct S3 access. Option D (IAM roles) require the user to have AWS credentials and assume the role, which is not suitable for temporary external access.

Answer

S3 bucket policies

Answer

CloudFront signed URLs

Answer

IAM roles

Question 15

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3). SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option B is wrong because SSE-KMS uses customer-managed KMS keys. Option D is wrong because client-side encryption is managed by the customer.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS)

Answer

Client-side encryption