SAP-C02 Practice Test 46 — 15 Questions

Question 1

A company uses AWS Organizations with a single member account for its development environment. The IT team wants to allow developers to launch EC2 instances only if they use a specific AMI ID. Which policy type should the company use to enforce this requirement?

Accepted Answer

Attach a service control policy (SCP) to the member account that denies EC2:RunInstances if the AMI ID is not approved.. Option A is correct because SCPs can be used to restrict actions at the account level, including specifying allowed AMI IDs. Option B is wrong because IAM policies apply to users and roles within an account, but SCPs are more appropriate for organization-wide restrictions. Option C is wrong because AWS Config rules are detective, not preventive. Option D is wrong because service control policies are the right mechanism.

Answer

Create an IAM policy that denies EC2:RunInstances if the AMI ID is not approved and attach it to all developer IAM roles.

Answer

Use AWS Config rules to detect noncompliant EC2 instances and automatically terminate them.

Answer

Use AWS Systems Manager to enforce the AMI ID requirement.

Question 2

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The directory will be used for authentication across multiple VPCs in different accounts. The company needs to ensure that resources in all VPCs can resolve DNS names from the directory. What is the MOST scalable and secure solution?

Accepted Answer

Deploy the directory in a shared services VPC in the management account. Use AWS Transit Gateway to connect all VPCs and configure the directory's DNS as a forwarder via Amazon Route 53 Resolver.. Option A is correct because using AWS Transit Gateway with a shared services VPC allows centralized DNS resolution via VPC Peering or DNS forwarding. Option B (Route 53 Resolver endpoints) is also a good solution but is more complex and costly. Option C (Direct Connect) is not needed. Option D (VPN) is less scalable.

Answer

Create a VPN connection between each VPC and the on-premises AD, then use DNS forwarders.

Answer

Use Amazon Route 53 private hosted zones and associate them with all VPCs.

Answer

Deploy the directory in each VPC and use AWS Managed Microsoft AD multi-region replication.

Question 3

A company uses AWS Organizations with 50 accounts. They need to manage EC2 instance inventory across all accounts. Which THREE steps are necessary to achieve this?

Accepted Answer

Enable AWS Systems Manager Inventory in each account.. Option A is correct because AWS Systems Manager Inventory can collect instance metadata. Option C is correct because a cross-account role is needed for Systems Manager to access instances in other accounts. Option E is correct because enabling Systems Manager in each account is required. Option B is wrong because Config aggregator collects configuration data, not inventory metadata. Option D is wrong because CloudWatch only collects metrics.

Answer

Configure Amazon CloudWatch agent to send inventory data.

Answer

Set up an AWS Config aggregator in the management account.

Question 4

A multinational company has multiple AWS accounts managed via AWS Organizations. The security team requires that all S3 buckets across all accounts must have server-side encryption enabled. The company wants to enforce this policy centrally without modifying each bucket individually. Which solution is MOST effective?

Accepted Answer

Apply a service control policy (SCP) to the root organizational unit that denies s3:PutBucketEncryption unless encryption is set.. Option C is correct because using an SCP at the root OU can deny the creation of S3 buckets without encryption across all accounts. Option A is wrong because S3 default encryption is per-bucket and not centrally enforced. Option B is wrong because IAM roles cannot enforce encryption across accounts. Option D is wrong because CloudTrail only logs, not enforces.

Answer

Create an IAM role that all users must assume to create buckets, and attach a policy requiring encryption.

Answer

Use AWS CloudTrail to monitor bucket creation and trigger a Lambda function to enable encryption.

Answer

Enable default encryption on each S3 bucket using a custom AWS Config rule.

Question 5

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application data is stored on Amazon EBS volumes. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 2 hours. Which TWO actions should the company take to meet these objectives? (Choose two.)

Accepted Answer

Configure Amazon EBS snapshots to be taken every 15 minutes.. Options A and D are correct. To meet an RPO of 15 minutes, EBS snapshots must be taken every 15 minutes. To meet an RTO of 2 hours, the snapshots can be copied to another region and used to restore volumes and launch instances. Option B is not sufficient because EBS snapshots are not real-time. Option C is wrong because the RPO is 15 minutes, not 1 hour. Option E is wrong because it does not specify cross-region replication.

Answer

Use Amazon EBS Multi-Attach to attach volumes to instances in another region.

Answer

Use AWS Backup to create a backup plan with a daily backup.

Answer

Use AWS CloudFormation to recreate the EC2 instances from a template.

Question 6

A company is designing a hybrid cloud solution that extends its on-premises data center to AWS. The company has a 10 Gbps AWS Direct Connect connection and needs to securely connect multiple VPCs and on-premises networks with transitive routing. The solution must be highly available and use AWS managed services. Which TWO components should the company include in the design? (Choose TWO.)

Accepted Answer

AWS Transit Gateway with attachments for each VPC and the Direct Connect Gateway.. AWS Transit Gateway provides transitive routing between VPCs and on-premises networks. Direct Connect Gateway allows association of multiple VPCs via Transit Gateway. Option A and Option C are correct. Option B is wrong because VPN CloudHub does not integrate with Transit Gateway. Option D is wrong because VPC peering does not support transitive routing. Option E is wrong because AWS Global Accelerator is not for network connectivity.

Answer

AWS Global Accelerator endpoints in each VPC.

Answer

AWS Site-to-Site VPN connections from on-premises to each VPC.

Answer

VPC peering between each VPC and the on-premises network.

Question 7

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

Accepted Answer

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.. The bucket policy condition requires that the request includes the header 'x-amz-server-side-encryption' with value 'aws:kms' for PutObject. Users must specify SSE-KMS encryption in their upload request. Option C is correct. Option A is wrong because the bucket policy already allows. Option B is wrong because the role policy allows it. Option D is wrong because KMS key permission is not the issue.

Answer

Remove the condition from the bucket policy.

Answer

Add an IAM policy that allows s3:PutObject to the role.

Answer

Grant the role permission to use the KMS key.

Question 8

A company is designing a solution to process real-time streaming data from IoT devices. The data must be ingested, processed with sub-second latency, and stored for analytics. Which services should the company use? (Choose TWO.)

Accepted Answer

AWS Lambda. Amazon Kinesis Data Streams ingests streaming data with sub-second latency. AWS Lambda processes data in near real-time. Option C (Kinesis Data Firehose) is for loading to S3 with higher latency. Option D (SQS) is for message queuing. Option E (Kinesis Data Analytics) is for SQL analytics on streams.

Answer

Amazon SQS

Answer

Amazon Kinesis Data Analytics

Answer

Amazon Kinesis Data Firehose

Question 9

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

Accepted Answer

Configure S3 to send event notifications to the Lambda function directly. S3 can send events directly to Lambda via an S3 event notification. Option A (SNS) adds unnecessary intermediate service. Option B (CloudWatch Events) is not designed for S3 object creation triggers. Option D (SQS) adds latency and complexity.

Answer

Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

Answer

Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

Answer

Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

Question 10

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Accepted Answer

Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries. Option C is correct because S3 with lifecycle policies can move data to lower-cost storage classes as it ages, and Athena can query data in place without loading. Option A is wrong because Redshift is designed for structured data warehouse workloads, not a data lake. Option B is wrong because S3 with Glacier does not support direct querying; data must be restored first. Option D is wrong because EMR requires managing clusters and is not cost-effective for occasional queries.

Answer

Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

Answer

Store data in Amazon EMR on EC2 and query with Hive

Answer

Store data in Amazon Redshift and query with Redshift Spectrum

Question 11

A company has a central IT team that manages multiple AWS accounts. The team wants to allow developers to create resources in their own accounts but wants to restrict the use of certain expensive services like Amazon Redshift. The developers should not be able to launch Redshift clusters in any account. What is the MOST efficient way to achieve this?

Accepted Answer

Apply an SCP that denies redshift:CreateCluster to the organizational unit containing the developer accounts.. Option A is correct because SCPs can deny the redshift:CreateCluster action across all accounts in the organization. Option B is wrong because IAM policies in each account require manual setup. Option C is wrong because AWS Config cannot deny actions. Option D is wrong because CloudTrail does not prevent actions.

Answer

Use AWS CloudTrail to monitor cluster creation and alert the security team.

Answer

Create an IAM policy that denies redshift:CreateCluster and attach it to the developers' IAM groups in each account.

Answer

Use AWS Config rules to detect Redshift cluster creation and automatically delete them.

Question 12

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

Accepted Answer

The trail was not created as an organization trail.. Option B is correct because a single trail in the management account can log events for all member accounts only if CloudTrail is configured to include all accounts (organization trail). Option A is wrong because SCPs do not affect CloudTrail logging. Option C is wrong because CloudTrail is not a regional service; organization trails log all regions. Option D is wrong because IAM permissions do not affect logging once the trail is configured.

Answer

The SCPs applied to member accounts are blocking CloudTrail from sending logs.

Answer

CloudTrail is a regional service and the trail is only in one region.

Answer

Member accounts have IAM policies that deny CloudTrail logging.

Question 13

Refer to the exhibit. A company applies this SCP to an OU. However, users in the OU are still able to upload objects to S3 without encryption. What is the most likely reason?

Accepted Answer

The users are uploading objects using the Multipart Upload API, which uses the s3:UploadPart action.. Option C is correct because the SCP only denies s3:PutObject if the encryption is not AES256. However, if users use s3:PutObject with encryption set to aws:kms, the condition StringNotEquals evaluates to true (since 'AES256' != 'aws:kms'), so the Deny applies. Wait: actually, the condition denies if encryption is NOT AES256, so both 'aws:kms' and no encryption would be denied. But if users use SSE-S3 (AES256), it's allowed. The problem is that users are able to upload without encryption. That means the Deny is not taking effect. The most likely reason is that the SCP is not attached to the OU, or the users are using Multipart Upload (s3:PutObjectPart) which is a different action. Option A is wrong because SSE-C is also not AES256. Option B is wrong because they are not using SSE-S3. Option D is wrong because the SCP does not deny s3:PutObject without encryption? Actually, the condition denies if encryption is not AES256, so it should deny unencrypted uploads. But if users use Multipart Upload, the action is s3:UploadPart, not s3:PutObject. So the SCP does not cover that.

Answer

The users are using SSE-S3 encryption (AES256).

Answer

The SCP is missing a Deny for s3:PutObject without any encryption header.

Answer

The users are using SSE-C encryption.

Question 14

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets in the organization are encrypted at rest. Which TWO approaches can the company use to achieve this? (Choose TWO.)

Accepted Answer

Create a service control policy (SCP) that denies s3:CreateBucket unless the bucket has default encryption enabled.. Options A and B are correct. SCP can deny creation of unencrypted buckets, and Config can detect noncompliant buckets. Option C is wrong because bucket policies can be bypassed by bucket owners. Option D is wrong because IAM policies are per-account and may not cover all principals. Option E is wrong because S3 Block Public Access does not address encryption.

Answer

Attach a bucket policy to each bucket that denies PutObject without encryption.

Answer

Create an IAM policy that denies s3:PutObject unless encryption is specified.

Answer

Enable S3 Block Public Access at the organization level.

Question 15

A company has a central IT team that manages AWS resources for multiple business units using AWS Organizations. Each business unit has its own OU. The central team needs to allow each OU's administrators to manage their own IAM roles and policies, but prevent them from modifying the OU structure or creating new accounts. Which IAM policy should be attached to the administrators in the management account?

Accepted Answer

A policy that allows iam:* and denies organizations:CreateAccount, organizations:CreateOrganizationalUnit, organizations:UpdateOrganizationalUnit, and organizations:DeleteOrganizationalUnit.. Option D is correct because it explicitly denies the organizational-level actions that could modify the OU structure or create accounts, while allowing other IAM actions. Option A allows full administration, violating the restriction. Option B denies all IAM actions, preventing any management. Option C allows full organization management, which is too permissive.

Answer

A policy that denies all IAM and organization actions except for viewing.

Answer

A policy that allows all IAM actions and denies organizations:CreateAccount and organizations:UpdateOrganizationalUnit.

Answer

A policy that allows organizations:* and IAM:* except for DeleteOrganization and RemoveAccountFromOrganization.