SAP-C02 Practice Test 49 — 15 Questions

Question 1

A company is designing a microservices architecture on Amazon ECS with Fargate. The services need to communicate securely and efficiently. The company wants to implement service-to-service authentication and authorization. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Use AWS Secrets Manager to store and rotate service credentials.. Options A, C, and E are correct. A: ECS Service Connect provides DNS and encryption. C: IAM roles for tasks grant permissions. E: Secrets Manager stores secrets. Option B is not needed with Service Connect. Option D is for public APIs.

Answer

Configure mutual TLS (mTLS) between services using certificates from ACM.

Answer

Deploy an API Gateway in front of each microservice.

Question 2

A company is designing a new static website hosted on Amazon S3. The website must be served over HTTPS with a custom domain name. Which AWS service should be used to achieve this?

Accepted Answer

Amazon CloudFront with SSL certificate. Option B is correct because CloudFront can be configured with a custom SSL certificate and domain. Option A is wrong because S3 does not natively support HTTPS with custom domains. Option C is wrong because ELB is for dynamic content. Option D is wrong because Route 53 is DNS, not content delivery.

Answer

Amazon Route 53 with alias record

Answer

Amazon S3 static website hosting with bucket policy

Answer

Elastic Load Balancer with SSL termination

Question 3

Which TWO actions improve the security of an Amazon S3 bucket that stores sensitive data?

Accepted Answer

Enable S3 server access logging.. Options A and D are correct. Enabling S3 Block Public Access prevents any public access. Enabling S3 server access logging allows auditing. Option B is incorrect because bucket policies are not a substitute for encryption. Option C is incorrect because S3 Transfer Acceleration is for speed, not security. Option E is incorrect because CORS is for cross-origin requests, not security.

Answer

Enable CORS (Cross-Origin Resource Sharing).

Answer

Enable S3 Transfer Acceleration.

Answer

Use a bucket policy that denies access to all principals except the root user.

Question 4

A company is deploying a web application on AWS. The application runs on EC2 instances behind an ALB. The security team requires that all traffic between the ALB and the EC2 instances be encrypted, and that the EC2 instances only accept traffic from the ALB. Which THREE steps should the architect take? (Choose three.)

Accepted Answer

Configure the ALB target group to use HTTPS protocol. Option A ensures encryption between ALB and instances. Option B restricts instance security group to only ALB's security group. Option D enables HTTPS listener on ALB for client-to-ALB encryption (though question asks for ALB-to-instance, but this is also needed for end-to-end encryption). Option C (public subnets) is not needed. Option E (NACL) is not the best way. Option F (same security group) is not the approach.

Answer

Assign the same security group to the ALB and the instances

Answer

Place the EC2 instances in a public subnet

Answer

Use network ACLs to restrict inbound traffic to the ALB's IP addresses

Question 5

A company is designing a new system that will ingest and process real-time streaming data from thousands of IoT devices. Each device sends data every second. The data must be processed with low latency (under 1 second) and then stored in Amazon S3 for long-term analytics. The company also needs to be able to reprocess data in case of processing errors. Which solution should the architect recommend?

Accepted Answer

Use Amazon Kinesis Data Streams to ingest data, AWS Lambda to process, and store in S3. Option D is correct because Kinesis Data Streams ingests data with low latency, Lambda processes it, and S3 stores it. Kinesis Data Analytics can also be used for real-time analytics. The stream's data retention allows reprocessing. Option A is wrong because Kinesis Firehose is for near-real-time, not sub-second. Option B is wrong because SQS is not designed for streaming data and does not support reprocessing with the same ease. Option C is wrong because DMS is for database migration, not streaming ingestion.

Answer

Use Amazon Kinesis Data Firehose to ingest data, transform with Lambda, and store in S3

Answer

Use AWS Database Migration Service (DMS) to ingest data into Amazon S3

Answer

Use Amazon SQS to buffer data, and an EC2 Auto Scaling group to process and store in S3

Question 6

A company is designing a new application that will store sensitive user data in an Amazon RDS for PostgreSQL database. The data must be encrypted at rest and in transit. The company also requires automated backups with a retention period of 35 days. What is the MOST secure and cost-effective configuration?

Accepted Answer

Enable encryption at rest for the RDS instance, and enforce SSL/TLS connections by setting the rds.force_ssl parameter to 1.. Option C is correct because enabling encryption at rest (via RDS encryption) and in transit (SSL/TLS) meets both requirements; automated backups are included and retained up to 35 days. Option A is wrong because client-side encryption adds unnecessary complexity. Option B is wrong because AWS KMS is part of RDS encryption, not an additional service. Option D is wrong because RDS encryption at rest is sufficient; no need for separate S3 encryption.

Answer

Enable RDS encryption at rest using AWS KMS, and use client-side encryption for data in transit.

Answer

Use an AWS KMS key to encrypt the RDS instance, and configure the DB instance to use SSL/TLS for connections.

Answer

Store the data in Amazon S3 with server-side encryption, and use an RDS database for metadata only.

Question 7

A company wants to store application logs in Amazon S3 with a lifecycle policy that moves objects to S3 Glacier Instant Retrieval after 30 days and deletes them after 1 year. The logs are accessed frequently in the first 30 days but rarely after. Which storage class should the company use for the first 30 days?

Accepted Answer

S3 Standard-IA. Option B is correct because S3 Standard-IA is cost-effective for data accessed infrequently but with rapid access when needed, and it transitions to Glacier Instant Retrieval. Option A is too expensive if logs are not frequently accessed. Option C is for infrequent access with longer retrieval times. Option D is for archival.

Answer

S3 Standard

Answer

S3 One Zone-IA

Answer

S3 Glacier Flexible Retrieval

Question 8

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

Accepted Answer

Amazon Elastic Container Service (ECS) with AWS Fargate. Option D is correct because Amazon ECS with Fargate is a fully managed container orchestration service that reduces operational overhead. Option A is wrong because EC2 requires manual management of instances. Option B is wrong because Lambda is for serverless functions, not container orchestration. Option C is wrong because EKS requires managing the Kubernetes control plane.

Answer

Amazon Elastic Kubernetes Service (EKS)

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Lambda

Question 9

A company is designing a new application on AWS that requires a highly available and durable NoSQL database. The database must be able to scale horizontally for both reads and writes. Which TWO AWS services meet these requirements? (Choose two.)

Accepted Answer

Amazon DynamoDB. Options A and C are correct. Amazon DynamoDB is a fully managed NoSQL database that scales horizontally and provides high availability and durability. Amazon DocumentDB is a MongoDB-compatible document database that also scales horizontally. Option B is wrong because RDS is relational. Option D is wrong because Neptune is a graph database. Option E is wrong because ElastiCache is a cache.

Answer

Amazon Neptune

Answer

Amazon RDS for MySQL with Multi-AZ

Answer

Amazon ElastiCache for Memcached

Question 10

A company is building a data lake on Amazon S3. The data comes from various sources and must be encrypted at rest. The security policy requires that the encryption keys be managed by the company and rotated annually. Which TWO solutions meet these requirements? (Choose two.)

Accepted Answer

Use server-side encryption with customer-provided keys (SSE-C). SSE-C allows the company to manage keys and rotate them. SSE-KMS with customer managed key also allows management and rotation. Option B (SSE-S3) uses AWS-managed keys. Option C (client-side encryption) is not at rest encryption. Option D (default encryption) might use SSE-S3 or SSE-KMS but not necessarily customer managed.

Answer

Use server-side encryption with S3 managed keys (SSE-S3)

Answer

Enable default encryption on the S3 bucket with SSE-S3

Answer

Use client-side encryption with the Amazon S3 encryption client

Question 11

A company is designing a new application that will process messages from an SQS queue. The messages must be processed in real-time with minimal latency, and the processing time per message varies from 100 ms to 5 seconds. The company wants to minimize cost and operational overhead. Which solution should the architect recommend?

Accepted Answer

Use an SQS queue as an event source for an AWS Lambda function. Option A is correct because SQS combined with Lambda provides a serverless solution that scales automatically, processes messages in near real-time, and charges only for compute time used. Option B is wrong because EC2 instances require provisioning and management, leading to higher operational overhead. Option C is wrong because Kinesis is designed for streaming data, not simple message processing. Option D is wrong because SNS is for pub/sub messaging, not for processing messages.

Answer

Use Amazon Kinesis Data Streams and an AWS Lambda function

Answer

Use an SQS queue and an EC2 Auto Scaling group to poll and process messages

Answer

Use SQS to send messages to Amazon SNS, which triggers a Lambda function

Question 12

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Accepted Answer

Use the default last writer wins conflict resolution. Option D is correct because DynamoDB global tables use last writer wins (LWW) based on a timestamp attribute to resolve concurrent updates. Option A is wrong because conditional writes would reject one update, not guarantee the most recent. Option B is wrong because DynamoDB Streams only capture changes, they do not resolve conflicts. Option C is wrong because optimistic locking requires application logic and does not automatically resolve multi-region conflicts.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 13

A company is designing a new web application that will run on EC2 instances behind an Application Load Balancer (ALB). The application must be highly available across multiple Availability Zones. The company wants to ensure that if an EC2 instance fails, the load balancer stops sending traffic to it. Which two steps should the architect take? (Choose TWO.)

Accepted Answer

Configure a health check on the ALB for the target group. Options A and D are correct. Configuring a health check on the ALB ensures the load balancer can detect unhealthy instances and stop sending traffic. Using an Auto Scaling group with a minimum of two instances across multiple AZs ensures high availability and replacement of failed instances. Option B is wrong because using only one AZ does not provide multi-AZ high availability. Option C is wrong because a Network Load Balancer is for TCP traffic, not HTTP. Option E is wrong because an ALB is needed for HTTP traffic.

Answer

Use a Network Load Balancer instead of an ALB

Answer

Use an Application Load Balancer with a single target group

Answer

Launch all EC2 instances in a single Availability Zone

Question 14

A company is designing a new application that will use Amazon S3 to store user-uploaded images. The application must enforce that all uploads are encrypted in transit and at rest. Additionally, the bucket must be configured to block all public access. Which TWO actions should be taken to meet these requirements?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Option A is correct because enabling S3 default encryption ensures objects are encrypted at rest. Option D is correct because blocking public access via the Block Public Access settings is a bucket-level control. Option B is wrong because bucket policies are not used for encryption. Option C is wrong because CloudFront is not related to S3 encryption. Option E is wrong because SSE-C is client-managed, but the question does not specify client-managed keys.

Answer

Use server-side encryption with customer-provided keys (SSE-C).

Answer

Use Amazon CloudFront to serve the images and enforce HTTPS.

Answer

Create a bucket policy that denies uploads without encryption in transit.

Question 15

A company is designing a serverless application that uses AWS Lambda to process events from Amazon DynamoDB Streams. The Lambda function updates an Amazon RDS for MySQL database. The company expects a high volume of updates and is concerned about the Lambda function causing too many connections to the database. How should the company design the solution to manage the database connection pool effectively?

Accepted Answer

Use Amazon RDS Proxy to pool database connections, and configure the Lambda function to connect through the proxy.. Option D is correct because Lambda functions should not maintain persistent connections across invocations; using RDS Proxy manages connection pooling. Option A is not possible in Lambda. Option B is not recommended because Lambda can scale rapidly. Option C does not solve the connection pooling issue.

Answer

Increase the Lambda function timeout and use a single database connection per function instance.

Answer

Use a singleton Lambda function with a reserved concurrency of 1 to ensure only one connection is used.

Answer

Use a Lambda function that batches records from DynamoDB Streams and uses a single database connection per batch.