SAP-C02 Practice Test 50 — 15 Questions

Question 1

A solutions architect is troubleshooting an issue where an EC2 instance cannot connect to the internet. The output of the describe-instances CLI command is shown in the exhibit. The instance is in a VPC with a public subnet that has a route table with a default route pointing to an internet gateway. The security group allows outbound traffic to 0.0.0.0/0. What is the MOST likely cause of the problem?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The instance does not have a public IP address.. The stem states that the subnet has a route table with a default route to an internet gateway, and the security group allows outbound traffic. The exhibit shows describe-instances output, which likely indicates the instance does not have a public IP address. Without a public IP, the instance cannot communicate with the internet even though routing is configured correctly. Option B is correct.

Answer

The subnet's route table does not have a route to the internet gateway.

Answer

The instance is not in a running state.

Answer

The security group is blocking outbound traffic.

Question 2

A company uses AWS Organizations with a multi-account strategy. The DevOps team wants to allow developers to launch EC2 instances only in specific Regions and only with approved AMIs. Which AWS service should be used to enforce these controls across all accounts?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are the correct choice because they allow you to centrally define and enforce permission guardrails across all accounts in your organization. SCPs can restrict EC2 actions to specific Regions using the `aws:RequestedRegion` condition key and limit AMI usage by denying launch actions unless the AMI ID matches an approved list, ensuring compliance without requiring per-account configuration.

Answer

AWS Config rules with auto-remediation

Answer

AWS Service Catalog with a portfolio of approved AMIs

Answer

AWS Identity and Access Management (IAM) policies in each account

Question 3

A company is migrating a legacy application that uses an Oracle database to AWS. The application is critical and requires high availability with automatic failover. The company wants to use Amazon RDS for Oracle. The database size is 200 GB. The company needs a solution that provides automatic failover to a standby instance in a different Availability Zone with minimal downtime. Which RDS deployment option should the company use?

Accepted Answer

Multi-AZ deployment. Multi-AZ deployment. Multi-AZ deployment for Amazon RDS automatically provisions and maintains a standby replica in a different Availability Zone. In the event of a failure, Amazon RDS automatically fails over to the standby, resulting in minimal downtime. Option A is incorrect because Multi-Region with Read Replicas is designed for read scaling and disaster recovery, not automatic failover with minimal downtime. Option B is incorrect because Single-AZ with Oracle Data Guard requires manual setup and management, and does not provide the same level of automated failover as Multi-AZ. Option C is incorrect because Single-AZ deployment lacks a standby instance; automatic backups do not provide failover capability.

Answer

Multi-Region deployment with Read Replicas

Answer

Single-AZ deployment with Oracle Data Guard

Answer

Single-AZ deployment with automatic backups

Question 4

A company has multiple AWS accounts managed under AWS Organizations. The security team wants to enforce that all new S3 buckets created in any account are automatically tagged with the cost center and environment (e.g., dev, prod). Which solution should the team implement?

Accepted Answer

Use a Service Control Policy (SCP) in AWS Organizations that denies s3:CreateBucket if the request does not include the required tags.. A Service Control Policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action if the request does not include the required tags (cost center and environment). SCPs apply to all accounts in the organization, enforcing the tagging requirement at the API level before the bucket is created, which is the most effective preventive control.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template with tags.

Answer

Use IAM policies in each account to require tags on bucket creation.

Answer

Use AWS Config rules to automatically tag buckets after creation.

Question 5

A company is migrating a Windows-based .NET application to AWS. The application uses SQL Server for its database and stores documents on a Windows file share. The company wants to adopt a hybrid model initially, where the application runs on AWS but still connects to on-premises resources for legacy integration. The migration must use a phased approach: first move the compute to AWS, then the database, and finally the file storage. The company has high latency to the internet and wants to optimize data transfer. You have set up a Direct Connect connection. During the first phase, you migrate the web and application servers to Amazon EC2 Windows instances. You need to ensure that the EC2 instances can access the on-premises SQL Server and file share securely. Which combination of actions should be taken?

Accepted Answer

Place the EC2 instances in a private subnet. Create a VPN connection or use Direct Connect virtual interface to connect to on-premises. Configure security groups to allow traffic to on-premises SQL Server and file share.. Placing EC2 instances in a private subnet and using a Direct Connect virtual interface (or VPN) provides a secure, low-latency connection to on-premises resources. Security groups can be configured to allow traffic only to the necessary on-premises SQL Server and file share. Option B is wrong because VPC peering is used to connect VPCs within AWS, not for on-premises connectivity; a NAT gateway is for outbound internet access from private subnets, not for secure access to on-premises resources. Option C is wrong because placing instances in a public subnet with an internet gateway exposes them to internet traffic, which is less secure and does not leverage the Direct Connect connection. Option D is wrong because ClassicLink is a legacy feature that was used for linking EC2-Classic instances to a VPC, but EC2-Classic is no longer available, and it does not provide on-premises connectivity.

Answer

Place the EC2 instances in a private subnet with a NAT gateway. Use VPC peering to on-premises.

Answer

Place the EC2 instances in a public subnet. Use an internet gateway and configure security groups to allow inbound traffic from on-premises IPs.

Answer

Use Amazon EC2-Classic and link the instances to on-premises via ClassicLink.

Question 6

A small business is migrating its on-premises infrastructure to AWS. The current environment consists of two VMs running a LAMP stack (Linux, Apache, MySQL, PHP) and a separate file server. The business has limited IT staff and wants to minimize operational overhead. They also want to ensure high availability for the web application. The company has a modest budget and is looking for a cost-effective solution. You need to design the migration. Which approach should be taken?

Accepted Answer

Use AWS Elastic Beanstalk to deploy the web application. Use Amazon RDS for MySQL Multi-AZ for the database. Use S3 for file storage.. The best approach because AWS Elastic Beanstalk provides a managed platform for the web application, reducing operational overhead. Amazon RDS for MySQL Multi-AZ ensures high availability for the database with automatic failover. Using S3 for file storage is cost-effective and scalable. Option A (EC2 Auto Scaling with ALB) requires more management than Elastic Beanstalk. Option B (Lightsail on a single instance) does not provide high availability. Option D (ECS Fargate) introduces containerization complexity and higher cost, which is not ideal for a small business with limited IT staff and a modest budget.

Answer

Migrate the VMs to two EC2 instances in an Auto Scaling group behind an ALB. Use RDS for MySQL Multi-AZ.

Answer

Use Amazon Lightsail to host the entire application on a single instance with a managed database.

Answer

Containerize the application and run on Amazon ECS with Fargate. Use Amazon RDS for MySQL.

Question 7

A company is designing a multi-region disaster recovery solution for a critical application using Amazon RDS for MySQL. They need a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which solution should they choose?

Accepted Answer

Use Amazon RDS with cross-Region read replicas and promote the replica to a primary instance in a disaster.. Amazon RDS for MySQL cross-Region read replicas use asynchronous replication with a typical lag of less than 5 seconds, meeting the RPO requirement. In a disaster, you promote the replica to a standalone primary instance, which takes under 1 minute, satisfying the RTO. This is the only option that provides both sub-5-second RPO and sub-1-minute RTO for RDS MySQL.

Answer

Use Amazon Aurora Global Database.

Answer

Use Amazon RDS with automated backups and restore in another Region.

Answer

Use Amazon RDS Multi-AZ with a standby in a different AWS Region.

Question 8

A company is designing a new web application that requires a scalable, low-latency key-value store for session state. The application runs on EC2 instances in an Auto Scaling group. Which solution is the MOST cost-effective and scalable?

Accepted Answer

Use Amazon ElastiCache for Redis.. Amazon ElastiCache for Redis provides a fully managed, in-memory key-value store that delivers ultra-low latency (sub-millisecond) for session state access. It is highly scalable, supports replication and clustering, and is more cost-effective than DynamoDB for high-throughput session workloads because it avoids per-request read/write costs and provides automatic failover for high availability.

Answer

Store session state on the local instance store of each EC2 instance.

Answer

Store session state in Amazon DynamoDB.

Answer

Store session state in Amazon RDS for MySQL.

Question 9

A company is migrating a critical application to AWS and needs to ensure high availability across AWS Regions. The application uses a relational database. Which THREE components are necessary for this multi-region architecture?

Accepted Answer

Application Load Balancer in each region. For a multi-region architecture ensuring high availability, three key components are required: an Application Load Balancer in each region to distribute traffic locally, Amazon Route 53 with failover routing policy to direct traffic to the healthy region, and an Amazon RDS cross-Region read replica to provide database disaster recovery and read scalability. Option A (RDS Multi-AZ) is incorrect because it only provides high availability within a single region, not across regions. Option E (VPC peering) is incorrect because VPC peering does not provide high availability; it is a networking feature for connecting VPCs, typically within the same region or across regions for private communication, but it is not a component for multi-region HA architecture.

Answer

Amazon RDS Multi-AZ deployment

Answer

VPC peering between regions

Question 10

A company is migrating workloads to AWS using AWS Application Migration Service (AWS MGN). The source servers are running on VMware vSphere. After installing the AWS Replication Agent on the source servers, the migration waves are set up. However, during a test cutover, the test instance fails to launch with an error 'Insufficient IP address space in the target VPC'. What is the most likely cause?

Accepted Answer

The target VPC subnet does not have enough available IP addresses. The error 'Insufficient IP address space in the target VPC' indicates that the subnet used for test instances does not have enough available IP addresses to launch the instance. AWS MGN allocates IP addresses from the specified subnet during instance launch. Option A is incorrect because a CIDR mismatch would cause a different error, typically related to subnet configuration. Option B is incorrect because IAM permission issues would result in an access denied error, not an IP space error. Option D is incorrect because the service not being enabled would produce a different error (e.g., service not available). Therefore, the most likely cause is insufficient available IP addresses in the target VPC subnet.

Answer

The replication settings specify a subnet with an incorrect CIDR block

Answer

The IAM role for AWS MGN does not have permissions to create network interfaces

Answer

The AWS MGN service is not enabled in the target AWS Region

Question 11

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

Accepted Answer

Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.. AWS Config conformance packs can be deployed across all accounts in an AWS Organization using the AWS Organizations integration. Conformance packs allow you to deploy a collection of AWS Config rules and remediation actions consistently. Option B is incorrect because the AWS Config aggregator only provides a central view of compliance status; it does not automatically enable rules in member accounts. Option C is incorrect: while CloudFormation StackSets can deploy Config rules, conformance packs are the recommended and more straightforward method for deploying Config rules across an organization. Option D is incorrect because SCPs (Service Control Policies) are used to manage permissions and cannot directly enforce AWS Config rules.

Answer

Use the AWS Config aggregator to manually enable the rule in each account.

Answer

Use AWS CloudFormation StackSets to deploy a Config rule template to each account.

Answer

Create an SCP that requires all accounts to enable AWS Config.

Question 12

A company is using AWS Organizations with consolidated billing. They want to track costs by department, where each department has its own AWS account. Which service should they use to tag resources with department IDs and view cost breakdowns?

Accepted Answer

AWS Cost Explorer with cost allocation tags.. Cost allocation tags in AWS allow you to tag resources (e.g., EC2 instances, S3 buckets) with department IDs and then use AWS Cost Explorer to view cost breakdowns by those tags. This directly meets the requirement to track costs per department account within AWS Organizations with consolidated billing.

Answer

AWS Budgets with tag-based filters.

Answer

AWS Trusted Advisor cost optimization checks.

Answer

AWS Cost Explorer with tag-based filtering.

Question 13

A company is building a new application that requires a relational database with high availability across multiple Availability Zones. The database must automatically failover with minimal downtime. Which two AWS services or features meet these requirements?

Accepted Answer

Amazon Aurora DB cluster with multiple Availability Zones. Amazon Aurora DB cluster with multiple Availability Zones meets the requirements because Aurora automatically replicates data across three Availability Zones by default, providing high availability and automatic failover with minimal downtime (typically under 30 seconds). Aurora's distributed storage layer allows the primary instance to fail over to a read replica in another AZ without data loss, making it ideal for applications requiring a relational database with multi-AZ high availability.

Answer

Amazon RDS Single-AZ deployment with automated backups

Answer

Amazon DynamoDB with global tables

Answer

Amazon RDS Read Replica

Question 14

A company is designing a new container-based application using Amazon EKS. The application requires persistent storage for stateful workloads, such as databases. The storage must be highly available and durable across multiple Availability Zones. Which storage solution should be used?

Accepted Answer

Use Amazon EFS with the EFS CSI driver.. Amazon EFS provides a fully managed, elastic NFS file system that is accessible from multiple Amazon EKS worker nodes across different Availability Zones simultaneously. The EFS CSI driver enables Kubernetes pods to mount EFS as a persistent volume, delivering the required high availability and durability for stateful workloads like databases without single-AZ dependency.

Answer

Use Amazon EBS volumes with the EBS CSI driver.

Answer

Use Amazon FSx for Lustre as a shared file system.

Answer

Use Amazon S3 with the S3 CSI driver.

Question 15

A company receives a Trusted Advisor recommendation to reduce costs by deleting unused Amazon EBS snapshots. The company has hundreds of snapshots. Which approach should the company use to identify and delete snapshots that are no longer needed?

Accepted Answer

Use AWS Backup to manage snapshots and set retention rules.. AWS Backup provides lifecycle policies and centralized snapshot management, making it easy to identify and automatically delete unused snapshots. Option A is incorrect because detailed billing reports show cost data but do not help identify which specific snapshots are unused. Option B is incorrect because manually checking each snapshot with the AWS CLI is not scalable for hundreds of snapshots. Option D is incorrect because Amazon S3 Lifecycle policies manage S3 objects, not EBS snapshots.

Answer

Enable detailed billing reports and analyze costs.

Answer

Use the AWS CLI to list all snapshots and manually check each one.

Answer

Use Amazon S3 Lifecycle policies to expire snapshots automatically.