SAP-C02 Practice Questions 2 — 50 Questions

Question 1

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Organizations. AWS Organizations is correct because it provides a centralized governance framework for managing multiple AWS accounts, enabling the security team to apply service control policies (SCPs) that centrally restrict IAM permissions across all member accounts. This allows the security account to enforce permission boundaries and audit IAM actions at the organizational level.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 2

A company is using AWS Organizations with multiple accounts. The IT team wants to centrally manage AWS Systems Manager Patch Manager to patch EC2 instances across all accounts. Which TWO actions are required?

Accepted Answer

Create an IAM service role for Systems Manager in each member account and attach the AmazonSSMManagedInstanceCore policy.. Systems Manager requires an IAM service role in each member account to delegate permissions from the management account; the AmazonSSMManagedInstanceCore policy provides the minimum necessary permissions for SSM Agent to communicate with the Systems Manager service. Option E is correct because a maintenance window created in the management account can target instances across multiple accounts using AWS Resource Groups that are configured with cross-account resource queries, enabling centralized patch management without logging into each account.

Answer

Install the AWS Systems Manager Agent (SSM Agent) on each EC2 instance in all accounts.

Answer

Enable AWS Config in all accounts to track patch compliance.

Answer

Configure the instance profile for each EC2 instance to include the AmazonSSMManagedInstanceCore policy.

Question 3

A company has multiple AWS accounts and wants to centrally manage VPC flow logs for all accounts. The flow logs should be sent to a central S3 bucket in the logging account. The solution must be automated for new accounts added to the organization. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy a VPC flow log configuration to all accounts and regions, and configure the S3 bucket policy to allow cross-account delivery from all accounts.. AWS CloudFormation StackSets can deploy a VPC flow log configuration across multiple accounts and regions in an AWS Organization, and the central S3 bucket policy must allow cross-account delivery from all accounts. This approach automates the deployment for new accounts as they are added to the organization, meeting the requirement for centralized management and automation.

Answer

Use AWS Config rules to detect missing flow logs and send alerts to the security team.

Answer

Use an SCP to require that VPC flow logs be enabled.

Answer

Manually enable VPC flow logs in each account and region, and specify the central S3 bucket as the destination.

Question 4

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

Accepted Answer

The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.. The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Answer

The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.

Answer

The bucket policy is missing an 'Allow' statement for HTTPS requests.

Answer

The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.

Question 5

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

Accepted Answer

Create a conformance pack in the management account and deploy it to the organization.. To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources. Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.

Answer

Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.

Answer

Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.

Answer

Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.

Question 6

A company uses Amazon CloudFront with an S3 origin to serve static content. They recently updated the content in S3, but users still see the old files. What is the MOST likely reason?

Accepted Answer

The CloudFront distribution's cache TTL is too long. CloudFront caches objects at edge locations based on TTL; if the TTL has not expired, users will get cached old content. Option B is wrong because S3 versioning does not affect cache invalidation. Option C is wrong because CloudFront does not have a 'Cache-Control' header by default; it's set by the origin. Option D is wrong because S3 Transfer Acceleration is irrelevant to caching.

Answer

S3 versioning is enabled and the objects are not updated

Answer

CloudFront is not configured to forward the Cache-Control header

Answer

S3 Transfer Acceleration is disabled

Question 7

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts and business applications. Which TWO components are required for this setup?

Accepted Answer

Permission sets that define the level of access to each account. AWS Single Sign-On requires an identity source and permission sets. The identity source can be the built-in identity store or an external identity provider (IdP). Therefore, an external IdP is not strictly required. From the given options, only permission sets (E) are a required component.

Answer

AWS Cloud Directory

Answer

A service control policy (SCP) attached to the root

Answer

An IAM user in each account

Answer

An external identity provider (IdP) such as Azure AD or Okta

Question 8

A company is designing a centralized logging solution for multiple AWS accounts. The solution must meet compliance requirements that logs be immutable and stored for 7 years. Which THREE services should be combined to achieve this?

Accepted Answer

S3 Object Lock. S3 Object Lock is correct because it enforces a write-once-read-many (WORM) model on S3 objects, preventing any deletion or overwriting for a specified retention period. Combined with Amazon S3 for durable storage and AWS CloudTrail for logging API activity across accounts, this meets the 7-year immutability and retention compliance requirements.

Answer

AWS Glue

Answer

Amazon Kinesis Data Streams

Question 9

A company wants to implement a data perimeter across all AWS accounts to prevent data exfiltration. Which TWO strategies should the company use? (Choose TWO.)

Accepted Answer

Use AWS Resource Access Manager to share resources only with trusted accounts.. AWS Resource Access Manager (RAM) enables you to share resources such as subnets, transit gateways, and License Manager configurations only with specific AWS accounts or organizational units, which directly supports a data perimeter by preventing unintended cross-account access. Option C is correct because Service Control Policies (SCPs) can be applied at the organization root, OU, or account level to deny access to external AWS accounts unless explicitly allowed, effectively creating a boundary that prevents data exfiltration to unauthorized accounts.

Answer

Disable public access to all S3 buckets and restrict cross-account access.

Answer

Use VPC endpoints for all AWS services and ensure they are private.

Answer

Use security groups to restrict outbound traffic to known IP addresses.

Question 10

A company wants to decouple a frontend API from backend processing to improve scalability and fault tolerance. The frontend sends requests that can be processed asynchronously. Which AWS service should be used to decouple the components?

Accepted Answer

Amazon Simple Queue Service (SQS). Amazon Simple Queue Service (SQS) is the correct choice because it provides a fully managed message queue that decouples the frontend API from backend processing. The frontend can send requests to an SQS queue, and backend consumers can poll and process messages asynchronously, which improves scalability by buffering traffic spikes and enhances fault tolerance by persisting messages until they are successfully processed.

Answer

Amazon Simple Notification Service (SNS)

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 11

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 12

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail across multiple accounts. The logs are delivered to a central S3 bucket. The security team needs to ensure that logs are encrypted at rest and access is limited to only authorized security personnel. Which combination of actions should be taken?

Accepted Answer

Use an SCP to require SSE-KMS for all S3 put operations, and apply a bucket policy that only allows access from a specific IAM role.. Using an SCP to require SSE-KMS for all S3 put operations ensures that any log data written to the central bucket is encrypted at rest with AWS KMS, providing an additional layer of control and auditability. The bucket policy that restricts access to a specific IAM role ensures that only authorized security personnel can access the logs, meeting the security team's requirements for encryption and access limitation.

Answer

Enable CloudTrail log file validation and use IAM policies to limit access.

Answer

Enable default encryption on the S3 bucket using SSE-S3 and apply a bucket policy to restrict access.

Answer

Use AWS KMS with a customer managed key and attach an SCP to prevent deletion of the key.

Question 13

A company is designing a data lake on AWS using Amazon S3 as the storage layer. The data includes sensitive customer information that must be encrypted at rest. The company also needs to regularly rotate the encryption keys. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use server-side encryption with AWS KMS (SSE-KMS) and enable automatic key rotation in KMS.. SSE-KMS with automatic key rotation provides encryption at rest with minimal operational overhead. AWS KMS automatically rotates the customer master key (CMK) annually, and you can configure a custom rotation period (e.g., 90 days) if needed. This meets the requirement for regular key rotation without manual intervention, unlike SSE-S3 which does not support key rotation, and SSE-C which requires manual key management.

Answer

Use server-side encryption with S3 managed keys (SSE-S3) and enable S3 bucket key rotation.

Answer

Implement client-side encryption using the AWS Encryption SDK and store keys in AWS Secrets Manager.

Answer

Use server-side encryption with customer-provided keys (SSE-C) and rotate keys manually.

Question 14

A company uses AWS Organizations with 50 accounts. The networking team wants to deploy a shared VPC in the network account and share subnets with other accounts. The shared subnets will host EC2 instances from the consuming accounts. What is the MOST secure way to ensure that only authorized accounts can create resources in the shared subnets?

Accepted Answer

Use AWS Resource Access Manager to share subnets with specific accounts and require that the consuming account uses a service-linked role.. AWS Resource Access Manager (RAM) allows the network account to share subnets with specific consuming accounts, and requiring a service-linked role ensures that only authorized accounts can launch resources in those subnets. This approach provides granular, cross-account subnet sharing without exposing the VPC to unauthorized actions, aligning with the principle of least privilege.

Answer

Use AWS Transit Gateway to route traffic between accounts and rely on route tables to control access.

Answer

Create VPC Peering connections between the network account and each consuming account, and use security groups to restrict access.

Answer

Create an SCP that denies ec2:RunInstances unless the subnet is in the network account.

Question 15

Which TWO actions should a company take to implement a least-privilege access model across multiple AWS accounts? (Choose TWO.)

Accepted Answer

Use IAM roles in each account with cross-account trust from a central identity provider, granting only required permissions.. Using IAM roles with cross-account trust from a central identity provider (e.g., AWS IAM Identity Center or an external IdP) allows users to assume roles in each account with only the permissions required for their tasks. This eliminates the need for long-term credentials and enables centralized access management while adhering to least-privilege principles. Option B is correct because Service Control Policies (SCPs) are applied at the AWS Organizations level to deny high-risk actions across all accounts, providing a guardrail that enforces least-privilege by preventing even privileged users from performing dangerous operations.

Answer

Generate long-term access keys for each user in the central account.

Answer

Share the root user credentials of each account with the central team.

Answer

Create IAM users in each account with full administrator access for all users.

Question 16

Refer to the exhibit. A CloudFormation stack has been deployed with the VPCId and SubnetIds outputs. A developer wants to use these outputs as parameters in another CloudFormation stack. Which AWS service can be used to pass these values to the new stack?

Accepted Answer

CloudFormation cross-stack references using Export and ImportValue. CloudFormation cross-stack references using the `Export` output attribute and the `Fn::ImportValue` intrinsic function allow you to pass output values from one stack as parameters to another stack within the same AWS account and region. This is the native, recommended mechanism for sharing stack outputs without introducing external services or additional complexity.

Answer

Amazon Simple Notification Service (SNS)

Answer

AWS Secrets Manager

Answer

AWS Systems Manager Parameter Store

Question 17

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.

Question 18

A company has a production AWS account that contains sensitive data. The security team wants to ensure that no one can disable AWS CloudTrail or delete the CloudTrail S3 bucket. Which THREE actions should be taken to protect these resources? (Choose three.)

Accepted Answer

Enable multi-factor authentication (MFA) delete on the S3 bucket.. Enabling MFA delete on the S3 bucket adds an extra layer of security, requiring multi-factor authentication for any delete operations on the bucket or its objects. This prevents unauthorized or accidental deletion of the CloudTrail log bucket, even if an attacker gains full IAM permissions.

Answer

Use IAM groups to restrict access to CloudTrail and S3.

Answer

Store CloudTrail logs in a separate account that only the security team can access.

Question 19

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application requires that users' session data be stored durably and with low latency. The session data is accessed frequently but is rarely updated. Which solution is MOST cost-effective?

Accepted Answer

Use ElastiCache for Redis with replication.. ElastiCache for Redis with replication is the most cost-effective solution because it provides durable, low-latency session storage with built-in replication for high availability. Redis supports persistence (e.g., snapshots or AOF logs) to ensure session data survives node failures, and its in-memory nature delivers sub-millisecond latency for frequent reads with rare updates, avoiding the higher costs of DynamoDB on-demand or the lack of durability in Memcached.

Answer

Store session data in Amazon S3 with reduced redundancy.

Answer

Use DynamoDB with on-demand capacity.

Answer

Use ElastiCache for Memcached with multiple nodes.

Question 20

The above AWS CloudFormation template creates an S3 bucket with a bucket policy. A user from IP 198.51.100.5 tries to access an object in the bucket. What will happen?

Accepted Answer

Access is denied because the IP is not allowed.. The bucket policy explicitly denies access to all principals except those coming from the allowed IP address range (which does not include 198.51.100.5). In AWS IAM, an explicit deny overrides any allow, so the request from IP 198.51.100.5 is denied. Option D is correct because the policy's condition block restricts access to a specific IP range, and the user's IP is not within that range.

Answer

Access is allowed because the Principal is "*".

Answer

Access is denied because the bucket is not public.

Answer

Access is allowed because the policy does not explicitly deny.