SAP-C02 Practice Test 45 — 15 Questions

Question 1

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

Accepted Answer

Apply an SCP that allows EC2 actions only in the allowed Regions.. Using an SCP with a Deny effect for EC2 actions outside allowed Regions is the best approach because it prevents the action across all accounts. Option A is wrong because IAM permissions boundaries are per-role. Option B is wrong because it allows EC2 in all Regions. Option D is wrong because it allows launching in all Regions.

Answer

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Answer

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Answer

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Question 2

Which TWO AWS services can be used to automate the enforcement of compliance policies across multiple AWS accounts? (Choose TWO.)

Accepted Answer

AWS Organizations SCPs. AWS Config rules (option A) and SCPs (option C) can enforce compliance. Option B is wrong because CloudTrail is logging. Option D is wrong because CloudFormation deploys resources but does not enforce policies. Option E is wrong because VPC Flow Logs are for network logging.

Answer

AWS CloudTrail

Answer

AWS CloudFormation StackSets

Answer

Amazon VPC Flow Logs

Question 3

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.. Option D is correct because AWS CloudFormation StackSets can deploy the flow log configuration to all accounts and regions, and a central S3 bucket policy allows cross-account delivery. Option A is wrong because manual creation does not scale. Option B is wrong because SCPs cannot create resources. Option C is wrong because AWS Config can detect but not automatically enable in all regions easily.

Answer

Use AWS Config rules to detect missing flow logs and send alerts to the security team.

Answer

Use an SCP to require that VPC flow logs be enabled.

Answer

Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

Question 4

A company uses AWS Organizations to manage multiple accounts. The security team wants to centrally manage CloudWatch Logs from all accounts. The logs should be sent to a central S3 bucket in the management account. Which two actions should the team take? (Choose two.)

Accepted Answer

Create a subscription filter in each member account's log groups that sends logs to the central S3 bucket.. Options A and C are correct. The management account must create a subscription filter policy in each account (or use cross-account subscription), and the S3 bucket policy must allow cross-account writes. Option B is wrong because SCPs cannot create log delivery. Option D is wrong because IAM roles in member accounts are needed for the subscription, not for the bucket. Option E is wrong because CloudWatch Logs does not natively send to S3 without subscription filters.

Answer

Create an IAM role in the management account that can read logs from member accounts.

Answer

Apply an SCP that requires all log groups to export logs to the central bucket.

Answer

Use AWS CloudTrail to deliver logs to the central bucket.

Question 5

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. Option B is correct because AWS Organizations can be used with AWS CloudFormation StackSets to automatically deploy and manage security configurations across accounts. Option A is wrong because custom scripts require ongoing maintenance. Option C is wrong because Service Catalog requires user action to provision. Option D is wrong because AWS Config conformance packs do not automatically apply to new accounts without additional setup.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 6

A company uses AWS Organizations with hundreds of accounts. The central IT team needs to ensure that all accounts use a standard set of network configurations, including VPC CIDR blocks and subnets. Which THREE steps should the team take to enforce this standard? (Choose THREE.)

Accepted Answer

Use AWS CloudFormation StackSets to deploy standard VPC and subnet configurations to all accounts.. Options A, B, and C are correct. SCPs enforce CIDR restrictions, CloudFormation StackSets deploy standard resources, and Config rules detect noncompliance. Option D is wrong because IAM roles do not enforce network config. Option E is wrong because it is reactive.

Answer

Create an IAM role in each account with permissions to manage VPCs.

Answer

Set up AWS Lambda functions to terminate noncompliant VPCs daily.

Question 7

A company wants to implement a centralized logging solution for its multi-account AWS environment. The solution must be resilient to AWS Regional failures and provide near real-time log delivery. Which combination of services should the company use?

Accepted Answer

Amazon CloudWatch Logs subscription filters in each account that stream log data to a Kinesis Data Stream in the central logging account, then use Kinesis Data Firehose to write to S3.. Option B is correct because CloudWatch Logs can stream to a cross-account Kinesis stream in the logging account, which can then be processed and stored in S3. Option A is not serverless; Option C uses S3 replication which is not near real-time; Option D uses Lambda which is more complex and less resilient.

Answer

S3 buckets in each account with cross-region replication enabled to a central bucket.

Answer

Lambda functions in each account that read CloudWatch Logs and write to a central S3 bucket.

Answer

Amazon Kinesis Data Firehose delivery streams in each account sending logs to a centralized S3 bucket.

Question 8

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

Accepted Answer

Use AWS Firewall Manager to centrally define and apply security group policies across accounts.. Option D is correct because AWS Firewall Manager allows centralized management of security group rules across accounts and VPCs. Option A is wrong because manual scripting is error-prone. Option B is wrong because AWS Config does not enforce rules; it only detects drift. Option C is wrong because Network ACLs are stateless and not as granular as security groups.

Answer

Use AWS Config rules to detect non-compliant security groups and send alerts.

Answer

Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

Answer

Use network ACLs instead of security groups to enforce segmentation.

Question 9

A company applied the above SCP to an OU. A developer in an account under that OU tries to launch a t2.medium EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies all instance types except t2.micro and t2.small.. The SCP denies RunInstances if the instance type is not t2.micro or t2.small. Since t2.medium is not in the allowed list, the action is denied. Option A is wrong because t2.medium is not allowed. Option C is wrong because SCP applies. Option D is wrong because IAM policy does not override SCP.

Answer

The instance launches only if the developer's IAM policy explicitly allows t2.medium.

Answer

The instance launch is allowed because there is no explicit Allow statement in the SCP.

Answer

The instance launches successfully because the SCP does not affect IAM users.

Question 10

A company is designing a new solution to host a static website on AWS. The website content is stored in an Amazon S3 bucket. The company wants to use a custom domain name (e.g., www.example.com) and enforce HTTPS. Which combination of AWS services should the company use?

Accepted Answer

Use Amazon CloudFront with an SSL certificate from AWS Certificate Manager and point the CloudFront distribution to the S3 bucket.. Option D is correct because Amazon CloudFront can serve content from S3, and AWS Certificate Manager (ACM) can provision an SSL/TLS certificate for the custom domain, allowing HTTPS. Option A is wrong because S3 does not support custom SSL certificates natively. Option B is wrong because ELB is not needed for static website hosting. Option C is wrong because Route 53 does not provide HTTPS termination.

Answer

Configure the S3 bucket for static website hosting and attach a custom SSL certificate using AWS Certificate Manager.

Answer

Use Amazon Route 53 with an alias record pointing to the S3 bucket and enable DNSSEC.

Answer

Use an Application Load Balancer in front of the S3 bucket and attach an SSL certificate from AWS Certificate Manager.

Question 11

A company is designing a new solution to store and analyze large volumes of IoT sensor data. The data is time-series and must be retained for 90 days. The company needs to run complex SQL queries on the data and expects low latency for the most recent 7 days of data. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Kinesis Data Analytics to analyze data in real-time and store results in S3.. Amazon Timestream is a time-series database that supports SQL queries and automatically tiers data. Amazon Kinesis Data Analytics + S3 can also provide SQL querying on streaming data stored in S3. Option A and Option D are correct. Option B is wrong because DynamoDB TTL is not for complex SQL. Option C is wrong because RDS is not optimized for time-series scale. Option E is wrong because Redshift is not low-latency for recent data without streaming.

Answer

Use Amazon RDS for PostgreSQL with TimescaleDB extension.

Answer

Use Amazon Redshift with automated snapshot retention of 90 days.

Answer

Use Amazon DynamoDB with TTL to expire data after 90 days and use PartiQL for queries.

Question 12

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

Accepted Answer

Add subnets from other Availability Zones to the VPC configuration.. Lambda functions require subnets in multiple Availability Zones for high availability. With only one subnet, if that AZ becomes unavailable or the subnet lacks a NAT gateway for internet access, the function may fail. Adding subnets from multiple AZs improves availability. Option B is correct. Option A is wrong because increasing memory may help performance but not connectivity. Option C is wrong because VPC is needed for RDS. Option D is wrong because the security group may be correct.

Answer

Remove the VPC configuration to allow the function to access the internet.

Answer

Increase the function's memory size to 1024 MB.

Answer

Update the security group to allow all outbound traffic.

Question 13

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Accepted Answer

Create a step scaling policy based on a CloudWatch alarm for CPU utilization.. Create a CloudWatch alarm on average CPU utilization and a scaling policy. Option A (scheduled scaling) is for time-based. Option B (simple scaling) is not recommended. Option D (ELB health check) is for health, not scaling.

Answer

Create a scheduled scaling action to add instances at peak times.

Answer

Create a simple scaling policy that adds one instance when CPU exceeds 50%.

Answer

Configure the ALB health check to mark instances unhealthy if CPU is high.

Question 14

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

Accepted Answer

Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover. A multi-Region active-passive architecture with Route 53 failover and a warm standby in the secondary region provides resilience at reasonable cost. Option A (multi-AZ within one region) does not protect against regional failure. Option C (active-active across regions) is more expensive. Option D (single Region with spread) still vulnerable to regional failure.

Answer

Deploy the Auto Scaling group in a single Region with instances spread across two AZs

Answer

Deploy the Auto Scaling group in three Availability Zones within a single Region

Answer

Use an active-active configuration across two Regions with Route 53 weighted routing

Question 15

A company ran the command above. The management account (111111111111) has an SCP attached that denies all actions. The DevAccount (222222222222) has no SCP. What can the root user of the DevAccount do?

Accepted Answer

Full access to all AWS services because no SCP is applied to the DevAccount.. SCPs are inherited from the root OU. Since no SCP is attached to the DevAccount or its OU, there is no restriction. Option A is wrong because management account SCP does not apply. Option C is wrong because root user can be restricted by SCP. Option D is wrong because there is no SCP.

Answer

Nothing, because the management account's SCP applies to all accounts.

Answer

Only read-only actions because of default SCP.

Answer

Only actions allowed by the root user's implicit full access.