SAP-C02 Practice Test 4 — 10 Questions

Question 1

A company has multiple AWS accounts managed using AWS Organizations. The security team wants to enforce that all new accounts automatically have a specific AWS Config rule enabled to prohibit public S3 bucket access. Which solution requires the least operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation StackSets to deploy the AWS Config rule to all accounts.. AWS CloudFormation StackSets can deploy the AWS Config rule to all accounts in the organization. With automatic deployment enabled, new accounts will automatically receive the rule, requiring minimal operational overhead after initial setup. Option B is incorrect because it only sets up an aggregator and does not enable any rule. Option C is incorrect because SCPs cannot automatically enable Config rules; they only control API actions. Option D is incorrect because it denies the s3:PutBucketPublicAccessBlock action but does not enable the required Config rule, failing to meet the explicit requirement.

Answer

Enable AWS Config in the management account and use an aggregator for all accounts.

Answer

Use an SCP to automatically enable the AWS Config rule in all accounts.

Answer

Use an SCP to deny the s3:PutBucketPublicAccessBlock action if a specific tag is not present.

Question 2

A company is using AWS Organizations and wants to delegate administration of AWS IAM Identity Center (successor to AWS SSO) to a member account. Which step is required?

Accepted Answer

Enable IAM Identity Center in the management account and then register the member account as a delegated administrator.. To delegate administration of IAM Identity Center to a member account, you must first enable IAM Identity Center in the management account. Then, you can register the member account as a delegated administrator using the IAM Identity Center console or the RegisterDelegatedAdministrator API. This allows the member account to manage IAM Identity Center settings, users, and groups without requiring management account credentials.

Answer

Create a service control policy that allows the member account to manage IAM Identity Center.

Answer

Use AWS CloudFormation StackSets to deploy IAM Identity Center configurations to the member account.

Answer

Set up AWS Config rules to enforce IAM Identity Center settings in the member account.

Question 3

A company is using AWS Organizations with a hierarchical OU structure. The security team wants to enforce that any new account created in the organization automatically inherits a baseline set of AWS Config rules and a VPC with a default CIDR block. What is the MOST efficient way to achieve this?

Accepted Answer

Enable AWS Control Tower and configure Account Factory to provision accounts with a baseline blueprint containing the VPC and Config rules.. AWS Control Tower provides a managed service that automates the setup of a multi-account environment based on AWS best practices. By enabling Control Tower and configuring Account Factory, new accounts are automatically provisioned with a baseline blueprint that includes the desired VPC and AWS Config rules, ensuring consistent governance without manual intervention or custom orchestration.

Answer

Use AWS CloudFormation StackSets with a stack that creates the VPC and Config rules, and trigger it via an SCP.

Answer

Create an SCP that denies creation of resources unless they comply with the baseline.

Answer

Use AWS Config conformance packs with YAML templates deployed to all accounts via an SCP.

Question 4

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, elastic NFS file system that supports concurrent read/write access from thousands of EC2 instances across multiple Availability Zones. It is designed for high availability and scalability, automatically growing and shrinking as files are added or removed, making it ideal for a shared file system for user uploads in a migrated monolithic application.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 5

A company wants to assess its on-premises environment for migration to AWS. The company needs to collect utilization data for servers and applications. Which AWS service should the company use?

Accepted Answer

AWS Application Discovery Service. AWS Application Discovery Service collects server and application utilization data from on-premises environments to support migration planning. Option A is wrong because AWS Migration Hub tracks migrations but does not perform discovery. Option B is wrong because AWS Database Migration Service (DMS) is for migrating databases, not for collecting utilization data. Option D is wrong because AWS Server Migration Service (SMS) is deprecated and was used for migrating individual servers, not for discovery.

Answer

AWS Migration Hub

Answer

AWS Database Migration Service (DMS)

Answer

AWS Server Migration Service (SMS)

Question 6

A company needs to share a VPC subnet with multiple accounts in the same AWS Organization. What is the MOST secure way to achieve this?

Accepted Answer

Use AWS RAM to share the subnet with the organization.. AWS Resource Access Manager (RAM) allows you to share a subnet with other accounts within the same AWS Organization without requiring any intermediate networking appliances or complex routing. This is the most secure approach because the shared subnet remains under the VPC owner's administrative control, and participating accounts can launch resources directly into the subnet while inheriting the VPC's security policies. No traffic traverses external connections or third-party devices, reducing the attack surface.

Answer

Create a Transit Gateway and attach all accounts.

Answer

Set up a VPN connection between accounts.

Answer

Create a VPC peering connection between each account and the VPC owner.

Question 7

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

Accepted Answer

Check the security group rules for the instance.. The instance is running but the application is inaccessible, which often indicates that security group rules are not allowing the required inbound traffic. Option A is wrong because the instance is reported as 'running', so it is not terminated. Option B is wrong because the command output successfully returns instance details, meaning the instance ID is correct. Option C is wrong because status checks relate to the health of the instance OS and system, not network access.

Answer

Check if the instance is terminated.

Answer

Check if the instance ID is correct.

Answer

Check the instance status checks.

Question 8

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 9

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 10

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

Accepted Answer

Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.. Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Answer

Store the Docker image in Amazon S3 instead of ECR.

Answer

Use the 'latest' tag for all images.

Answer

Retry the failed pipeline step after a delay.