SAP-C02 Practice Test 42 — 15 Questions

Question 1

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Accepted Answer

Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.. AWS Config rules can trigger custom Lambda functions to evaluate the S3 bucket policy and publish a notification to SNS if the policy allows public access. Option B is incorrect because S3 event notifications are triggered by object-level events (e.g., PUT, POST), not by policy changes. Option C is incorrect because AWS Config rules cannot directly publish to SNS; they require a Lambda function or other action to send notifications. Option D is incorrect because CloudTrail logs API calls but does not provide real-time compliance evaluation or direct notification.

Answer

Configure S3 event notifications on the bucket to send events to SNS.

Answer

Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.

Answer

Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.

Question 2

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

Accepted Answer

The DynamoDB table name is misspelled in the Lambda code.. The 'ResourceNotFoundException' error indicates that the DynamoDB table does not exist in the account and region where the Lambda function is running. The most common cause is a misspelled table name in the Lambda code (Option D). Cross-account permission issues (Option C) typically result in an 'AccessDeniedException' rather than 'ResourceNotFoundException', because the resource does exist but access is denied. Option A is incorrect because Lambda uses temporary credentials from its execution role, and credential issues would cause authentication errors. Option B is incorrect because DynamoDB is accessible over the public internet or via a VPC endpoint; lack of a VPC endpoint would cause a timeout, not a resource-not-found error.

Answer

The Lambda function is using the wrong AWS credentials.

Answer

The Lambda function is in a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table is in a different AWS account and the Lambda role does not have cross-account access.

Question 3

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a 5-minute downtime. The application uses a connection pool with a 30-second connection timeout. The RDS DNS name is used as the endpoint. What is the MOST likely cause of the downtime?

Accepted Answer

The DNS TTL for the RDS endpoint is set too high. During an RDS Multi-AZ failover, the DNS name remains the same but the underlying IP address changes. If the DNS TTL is set too high (default is 60 seconds but can be configured higher), clients may continue to use the old cached IP address for the duration of the TTL, leading to connection failures until the cache expires. This explains the 5-minute downtime, as the application's connection pool with a 30-second timeout cannot recover until the DNS record is refreshed. Option B is incorrect because the 30-second timeout is sufficient to wait for failover, but the issue is DNS propagation, not timeout duration. Option C is incorrect because Multi-AZ failover typically completes within 1-2 minutes, not 5 minutes. Option D is incorrect because the endpoint (DNS name) does not change after failover; only the IP changes.

Answer

The connection pool timeout is too short to allow failover

Answer

The Multi-AZ failover took longer than expected

Answer

The application is using the wrong endpoint after failover

Question 4

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

Accepted Answer

Use an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is not present.. The most secure way to enforce SSE-KMS across all S3 buckets is to use an S3 bucket policy that denies PutObject if the required encryption header is not present. This ensures that any upload attempts without SSE-KMS are rejected, providing a preventive control. Option A is incorrect because AWS Config rules can only detect and remediate after the fact, not prevent non-compliant uploads. Option B is incorrect because default encryption can be overridden by specifying a different encryption header in the request. Option C is incorrect because IAM policies control permissions for API calls but cannot enforce specific encryption parameters on object uploads.

Answer

Use AWS Config rules to detect unencrypted objects and remediate with Lambda.

Answer

Enable default encryption on each bucket with SSE-KMS.

Answer

Create an IAM policy that requires kms:Encrypt permission for all S3 operations.

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

Accepted Answer

Create a target tracking scaling policy using the custom metric as the target.. A target tracking scaling policy automatically adjusts the number of instances to maintain a target value for the custom metric, which is efficient for variable workloads. Option A is incorrect because scheduled scaling assumes predictable patterns. Option B is incorrect because using Lambda adds complexity and overhead. Option C is incorrect because step scaling requires manual configuration of steps and is less efficient than target tracking.

Answer

Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

Answer

Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

Answer

Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

Question 6

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Accepted Answer

Network Load Balancer (NLB) with target group stickiness.. Network Load Balancer (NLB) supports TLS termination at the listener level and provides sticky sessions through target group stickiness (source IP affinity). This meets the requirements for containerized microservices on Amazon ECS with Fargate. Application Load Balancer (ALB) also supports sticky sessions and SSL termination, but NLB is more cost-effective for high-throughput scenarios and works well with Fargate. Options C and D are incorrect because Classic Load Balancer is legacy and lacks advanced features, while AWS Lambda with API Gateway is not a load balancer and cannot directly provide sticky sessions.

Answer

Application Load Balancer (ALB) with stickiness and SSL termination.

Answer

Classic Load Balancer (CLB) with SSL termination at the instance.

Answer

AWS Lambda with API Gateway.

Question 7

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.. Using CloudFront Origin Access Control (OAC) restricts access to the S3 bucket so that only the CloudFront distribution can access objects. The bucket policy must be updated to grant CloudFront access. Option B is incorrect because S3 Object Ownership does not restrict access. Option C is incorrect because allowing public read access would enable direct S3 access. Option D is incorrect because CloudFront key pairs and signed URLs control access through CloudFront but do not prevent direct S3 bucket access.

Answer

Set S3 Object Ownership to BucketOwnerPreferred.

Answer

Configure the S3 bucket policy to allow public read access.

Answer

Generate CloudFront key pairs and require signed URLs for all content.

Question 8

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. The most likely cause of the timeout is that the Lambda function is attached to a VPC but does not have a NAT gateway or VPC endpoints to access external resources (Option D). When a Lambda function is configured to run in a VPC, it loses default internet access. To access external services (such as an external database or API), the function needs a NAT gateway in a public subnet or VPC endpoints for the specific services. Without this, the function will timeout when trying to reach external resources. Option A is incorrect because cold starts cause latency but not consistent timeouts. Option B is incorrect because hitting the concurrent execution limit would cause throttling (HTTP 429 or 500 errors), not timeouts. Option C is incorrect because attaching to a public subnet would not help; Lambda functions cannot have public IPs in a VPC by default, and a public subnet does not provide internet access without an internet gateway and route table updates.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 9

A company has a multi-account AWS environment. The central IT team manages IAM roles in each account using AWS CloudFormation StackSets. The team needs to ensure that a specific IAM role exists in all member accounts. Which solution is the MOST efficient?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role template across all accounts.. AWS CloudFormation StackSets allow you to deploy a single IAM role template across multiple accounts and Regions in a single operation, ensuring consistent role creation without manual effort. This is the most efficient solution because it automates the deployment, handles drift detection, and integrates with AWS Organizations for automatic account addition.

Answer

Use AWS Config rules to enforce the IAM role creation in each account.

Answer

Manually create the IAM role in each account using the AWS Management Console.

Answer

Use AWS Organizations to create the IAM role via a service control policy (SCP).

Question 10

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. A ResourceNotFoundException indicates that the specified DynamoDB table does not exist or has been deleted. Option A is incorrect because a Lambda timeout would result in a timeout error, not a ResourceNotFoundException. Option C is incorrect because insufficient permissions to access DynamoDB would produce an AccessDeniedException. Option D is incorrect because throttling by DynamoDB would cause a ProvisionedThroughputExceededException.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 11

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

Accepted Answer

View the stopped task logs in Amazon CloudWatch Logs.. When tasks fail health checks and are stopped, their logs are sent to CloudWatch Logs (if configured). Viewing the stopped task logs reveals application errors that caused the health check failure. Option B is incorrect because misconfigured environment variables would likely affect the old running tasks as well; the issue is specific to new tasks, so the task definition is probably fine. Option C is incorrect because the ECS service event stream shows deployment events (like rollback triggers) but not the detailed error logs of the failing tasks. Option D is incorrect because ECS Exec requires the task to be running; since the tasks are failing health checks and stopping, ECS Exec cannot connect to them.

Answer

Review the task definition for misconfigured environment variables.

Answer

Check the ECS service event stream for error messages.

Answer

Use ECS Exec to connect to the failing tasks and debug.

Question 12

A company is designing a new application that requires a relational database. The application has variable workloads with predictable spikes. The company wants to minimize costs while ensuring that the database can handle the spikes. Which Amazon RDS feature should the company use?

Accepted Answer

RDS Proxy. RDS Proxy is the correct choice because it acts as a connection pooling layer that efficiently manages database connections, allowing the application to handle variable workloads and predictable spikes without overwhelming the database. It reduces the overhead of connection management and improves scalability. RDS Storage Auto Scaling only scales storage capacity, not compute or connection handling, and thus does not address workload spikes. Read Replicas are useful for offloading read traffic but do not provide automatic scaling for unpredictable spikes. Multi-AZ deployment ensures high availability and failover but does not scale the database for variable workloads.

Answer

RDS Storage Auto Scaling

Answer

Read Replicas

Answer

Multi-AZ deployment

Question 13

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. ECS tasks should be launched in the same private subnet as the RDS instance to allow direct network communication via VPC routing, without needing internet gateways or NAT. Option B is incorrect because placing ECS tasks in a public subnet with a NAT gateway would require traffic to go through the NAT, but NAT gateways are for outbound internet access, not for inbound traffic to private resources; also, public subnets have direct internet access which is unnecessary and could introduce security risks. Option C is incorrect because a VPN connection is typically used for on-premises to VPC connectivity, not for internal VPC communication; VPC routing and security groups are sufficient. Option D is incorrect because an Application Load Balancer is used for load balancing HTTP/HTTPS traffic to application targets, not for routing internal database traffic; it would add unnecessary complexity and latency.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 14

A company uses AWS Organizations with a hierarchical structure of organizational units (OUs). The security team needs to restrict the use of specific AWS services in the development OU. However, the SCP applied at the root level allows all services. Which TWO SCP strategies can restrict services for the development OU without affecting other OUs? (Choose TWO.)

Accepted Answer

Use a service control policy that denies access to the unwanted services and attach it to the development OU.. Tag policies enforce tagging requirements, not service restrictions. Option B is incorrect because modifying the root-level SCP would affect all OUs, not just the development OU. Option C is correct: attaching a deny SCP to the development OU that denies unwanted services will restrict that OU only, as SCPs are inherited but explicit denies override allows. Option D is correct: similarly, an explicit deny SCP attached to the development OU will block those services for that OU. Option E is incorrect because IAM permissions boundaries are applied to IAM principals, not OUs, and do not override SCPs. Therefore, the correct answers are C and D.

Answer

Apply a tag policy to the development OU that requires tags for all resources.

Answer

Modify the root-level SCP to deny the unwanted services.

Answer

Create an IAM permissions boundary for all users in the development OU.

Question 15

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

Accepted Answer

Change the task placement strategy to spread across Availability Zones.. Changing the task placement strategy to spread distributes tasks across Availability Zones, reducing resource contention and improving latency. Option A is wrong because increasing memory and CPU does not address placement-related contention. Option B is wrong because increasing the number of tasks with the default binpack strategy may worsen contention by packing tasks more densely. Option D is wrong because using EC2 with GPU instances does not solve placement issues and introduces unnecessary complexity.

Answer

Increase the memory and CPU for each task definition to reduce contention.

Answer

Increase the number of tasks to distribute the load evenly.

Answer

Use a launch type of EC2 with GPU instances to handle the load.