SAP-C02 Practice Test 48 — 15 Questions

Question 1

A company has a multi-account AWS environment with a centralized logging account. The security team needs to analyze VPC Flow Logs from all accounts using Amazon Athena. Which THREE steps are required to enable this analysis? (Choose THREE.)

Accepted Answer

Create an AWS Glue table or use Athena's CREATE TABLE statement to define the schema of the Flow Logs.. Option B is correct because Athena requires a table defined over the data. Option C is correct because Flow Logs should be stored in a central S3 bucket. Option D is correct because Flow Logs are delivered to S3 in GZIP format, which Athena can query. Option A is incorrect because Kinesis Data Firehose is not needed; Flow Logs can go directly to S3. Option E is incorrect because the logs must be in the same region as the Athena queries.

Answer

Replicate the S3 bucket to a single AWS Region for consistency.

Answer

Configure a Kinesis Data Firehose delivery stream to convert Flow Logs to Parquet format.

Question 2

A company is designing a multi-account strategy using AWS Organizations. They want to enforce that no one can disable AWS CloudTrail in any account. Which TWO methods can achieve this?

Accepted Answer

Attach a Service Control Policy (SCP) that denies disabling or deleting CloudTrail.. Option A is correct because SCPs can deny CloudTrail:StopLogging and CloudTrail:DeleteTrail actions. Option D is correct because AWS Config rules can detect and remediate disabled trails. Option B is wrong because IAM permissions boundaries do not prevent root user actions. Option C is wrong because Trusted Advisor does not enforce. Option E is wrong because AWS Shield is for DDoS protection.

Answer

Use AWS Trusted Advisor to alert when CloudTrail is disabled.

Answer

Use AWS Shield Advanced to protect CloudTrail.

Answer

Use IAM permissions boundaries to restrict user permissions.

Question 3

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Accepted Answer

AWS CloudTrail. Option B is correct because CloudTrail logs API calls. Option C is correct because CloudWatch Logs can aggregate logs from multiple accounts into a central account. Option A is wrong because S3 is storage, not aggregation. Option D is wrong because Config records resource changes, not API calls. Option E is wrong because VPC Flow Logs capture network traffic.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon S3

Question 4

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AD Connector. AWS Managed Microsoft AD can be deployed in multiple regions and linked to on-premises Active Directory via AD Connector. AWS Identity and Access Management (IAM) integrates with AD for SSO. Option A (AWS SSO) is a separate service that can also be used but is not required; Option C (Cognito) is for external users; Option E (Direct Connect) is a network service. Correct: B and D.

Answer

Amazon Cognito

Answer

AWS Direct Connect

Answer

AWS Single Sign-On (SSO)

Question 5

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Accepted Answer

Create an SCP that denies all actions in non-approved regions.. Option A is correct because SCPs can deny actions in non-approved regions. Option C is correct because SCPs can deny creation of resources that do not have the required tag. Option D is correct because AWS Config rules can detect untagged resources and trigger remediation. Option B is wrong because IAM policies are per-account and not centrally managed; they can be used but SCPs are more centralized. Option E is wrong because Tag Policies enforce tagging on resource creation via SCPs, but they do not remediate existing resources.

Answer

Use IAM policies in each account to deny actions in non-approved regions.

Answer

Define a tag policy using AWS Organizations to enforce cost center tags.

Question 6

A CloudFormation stack creation failed with the status shown in the exhibit. The stack was created using a template that defines an EC2 instance, a security group, and an Elastic IP address. What is the MOST likely cause of the failure?

Accepted Answer

The AWS account has reached the Elastic IP address limit.. The reason for the EIP creation failure is 'The maximum number of addresses has been reached', indicating the AWS account has reached the limit of Elastic IP addresses. Option D is correct. Option A is wrong because the EC2 instance was created successfully. Option B is wrong because the security group was created successfully. Option C is wrong because the EIP resource failed, not the instance.

Answer

The security group rule is invalid.

Answer

The EC2 instance failed to associate with the Elastic IP.

Answer

The EC2 instance type is not supported in the region.

Question 7

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

Accepted Answer

Create a separate VPC for each service and use VPC peering for API communication only.. Placing each service in its own VPC with VPC peering (Option B) provides network isolation and controlled access. Option A (same VPC) does not isolate databases. Option C (security groups) is less granular. Option D (IAM roles) does not prevent network access.

Answer

Use a single VPC with network ACLs to block database ports between services.

Answer

Use IAM policies to restrict database access at the API level.

Answer

Place all services in the same VPC and use security groups to restrict database access.

Question 8

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared file system for storing user uploads. The solution architect needs to design a highly available and scalable storage solution that supports concurrent read/write operations from multiple EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed, elastic NFS file system that supports concurrent access from multiple EC2 instances, making it ideal for shared file storage. Option A (S3) is object storage, not a file system. Option C (EBS) is block storage attached to a single instance. Option D (FSx for Windows File Server) is for Windows workloads but requires Windows instances.

Answer

Amazon FSx for Windows File Server

Answer

Amazon S3 with S3 File Gateway

Answer

Amazon EBS with Multi-Attach enabled

Question 9

A company is designing a new application that will use Amazon S3 to store sensitive customer data. The data must be encrypted at rest and in transit. The company also needs to ensure that only authorized users can access the data. Which three steps should the company take? (Choose THREE.)

Accepted Answer

Enable S3 default encryption with SSE-KMS.. Enforce encryption in transit (HTTPS) via bucket policy. Enable S3 default encryption with SSE-KMS. Use bucket policies to restrict access to authorized principals. Option D (public access) is wrong. Option E (client-side encryption) is not required.

Answer

Use client-side encryption with a customer key.

Answer

Make the bucket publicly accessible for ease of access.

Question 10

A company is designing a disaster recovery strategy for a production database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 1 hour. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Deploy Multi-AZ RDS instance and enable automatic failover. Multi-AZ with automatic failover provides RTO of minutes and RPO of seconds, meeting requirements. Cross-Region read replica with promotion provides RPO of seconds and RTO of minutes (promotion time). Option C (manual snapshot) has RPO > 1 hour and RTO > 15 minutes. Option D (export to S3) has high RTO. Option E (single instance backup) has high RTO.

Answer

Export the database to Amazon S3 using AWS DMS and import in another Region

Answer

Use automated backups with point-in-time recovery in the same Region

Answer

Take manual snapshots every hour and restore in another Region

Question 11

A company is designing a serverless data processing pipeline using AWS Lambda to process messages from an Amazon SQS queue. The messages are generated by thousands of IoT devices. The architect needs to ensure that messages are processed in order within each device's stream and that failures are handled without data loss. Which combination of services should the architect use?

Accepted Answer

Use Amazon Kinesis Data Streams with Lambda function and a dead-letter queue. Amazon Kinesis Data Streams preserves the order of records within a shard, and Lambda can process records in order. For error handling, a DLQ captures failed records. Option A (SQS FIFO) provides ordering but does not support Lambda triggers with ordered processing per shard. Option B (Lambda with DLQ on SQS) does not guarantee ordering across multiple shards. Option D (Kinesis with SQS) adds unnecessary complexity.

Answer

Use Amazon Kinesis Data Firehose with Lambda function and an SQS queue for error handling

Answer

Use Amazon SQS standard queues with Lambda function and a dead-letter queue

Answer

Use Amazon SQS FIFO queues with Lambda function

Question 12

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

Accepted Answer

Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key. Using SCPs in AWS Organizations allows the security team to deny creation of buckets that do not use the required KMS key. Option A (IAM policies) must be attached to each user/role, not centralized. Option C (Config rules) only detects non-compliance, does not enforce. Option D (Trusted Advisor) provides recommendations only.

Answer

Use AWS Trusted Advisor to check bucket encryption

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

Answer

Use AWS Config rules to detect non-compliant buckets and send alerts

Question 13

A company is designing a new microservices architecture on AWS. Each microservice is deployed as a containerized application and must be able to scale independently. The company wants to minimize operational overhead for managing the containers and the underlying infrastructure. Which solution should the architect recommend?

Accepted Answer

Amazon ECS with Fargate launch type. Option D is correct because AWS Fargate is a serverless compute engine for containers that eliminates the need to manage underlying instances. Option A is wrong because ECS with EC2 requires managing EC2 instances. Option B is wrong because EKS with managed node groups still requires managing node groups. Option C is wrong because Lightsail is for simple applications, not microservices.

Answer

Amazon EKS with managed node groups

Answer

Amazon ECS with EC2 launch type and Auto Scaling groups

Answer

Amazon Lightsail containers

Question 14

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

Accepted Answer

Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.. Option D is correct because EC2 Image Builder can automate AMI creation and replication to another region, meeting weekly updates and RPO/RTO with minimal cost. Option A is wrong because CloudEndure continuous replication has higher cost and complexity. Option B is wrong because AMI sharing is manual and does not meet RPO. Option C is wrong because S3 cross-region replication is for objects, not AMIs.

Answer

Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.

Answer

Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.

Answer

Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.

Question 15

A company is designing a multi-region disaster recovery solution for a stateless web application running on Amazon ECS Fargate. The application uses an Application Load Balancer and stores session data in Amazon ElastiCache for Redis. The company needs to achieve an RPO of 15 minutes and an RTO of 30 minutes. What is the MOST cost-effective design that meets these requirements?

Accepted Answer

Deploy a second ECS cluster and ALB in the secondary region with a scaled-down number of tasks. Use ElastiCache Global Datastore for Redis to replicate session data. Use Route 53 health checks to fail over.. Option A is correct because it meets the RPO and RTO with a warm standby approach that keeps a scaled-down copy running in the secondary region. Option B is too slow for RTO. Option C is too expensive (pilot light doesn't match). Option D is too slow for RTO.

Answer

Deploy a second ECS cluster and ALB in the secondary region with no tasks. Use cross-Region replication for ElastiCache. Use Route 53 to fail over after scaling up tasks.

Answer

Use a multi-region ECS service with Service Connect and Route 53 latency-based routing. Keep equal capacity in both regions.

Answer

Use pilot light by replicating ECS task definitions and copying AMIs to the secondary region. Use ElastiCache snapshot and restore. Fail over with Route 53.