SAP-C02 Practice Exam 52 — 20 Questions

Question 1

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must handle millions of requests per day. To reduce latency and offload traffic from the EC2 instances, which AWS service should be placed in front of the load balancer?

Accepted Answer

Amazon CloudFront. Option A is correct because CloudFront is a CDN that caches content at edge locations, reducing latency and offloading traffic. Option B is wrong because Global Accelerator improves performance via AWS global network but does not cache. Option C is wrong because WAF is a web application firewall. Option D is wrong because Shield is for DDoS protection.

Answer

AWS Global Accelerator

Answer

AWS Shield Advanced

Answer

AWS WAF

Question 2

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

Accepted Answer

Access is denied because the Deny statement explicitly matches the resource.. Option B is correct because an explicit Deny overrides any Allow. The user will be denied access. Option A is wrong because the Deny takes precedence. Option C is wrong because the Deny is explicit. Option D is wrong because the policy applies to the user.

Answer

Access is allowed because the Deny statement is not evaluated.

Answer

Access is denied only if the user is not authorized by other policies.

Answer

Access is allowed because the Allow statement is broader.

Question 3

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. Option A is correct because AWS CloudFormation allows infrastructure as code to deploy all resources. Option B is incorrect because AWS Elastic Beanstalk abstracts infrastructure but doesn't give full control. Option C is incorrect because AWS CodeDeploy deploys application code, not infrastructure. Option D is incorrect because AWS OpsWorks is configuration management, not infrastructure provisioning.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 4

A company is designing a real-time analytics pipeline for IoT data. They need to ingest millions of messages per second, process them with low latency, and store results in Amazon S3. Which combination of services should they use?

Accepted Answer

Amazon Kinesis Data Streams, Amazon Kinesis Data Analytics, Amazon Kinesis Data Firehose. Option A is correct because Kinesis Data Streams ingests high-throughput data, Kinesis Data Analytics processes it in real-time, and Firehose delivers to S3. Option B uses SQS which is not designed for millions of messages per second. Option C uses Lambda which may throttle. Option D uses Redshift which is for data warehousing, not real-time streaming.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Streams, Amazon Redshift, Amazon S3

Answer

Amazon IoT Core, AWS Lambda, Amazon DynamoDB

Question 5

A company is designing a data lake on AWS using Amazon S3. The data will be ingested from various sources and must be encrypted at rest. The company requires that the encryption keys be managed by AWS and rotated automatically. Which encryption option should be used?

Accepted Answer

Server-side encryption with S3 managed keys (SSE-S3). Option B is correct because SSE-S3 uses AWS-managed keys that are automatically rotated. Option A is wrong because SSE-C uses customer-provided keys. Option C is wrong because SSE-KMS uses customer-managed KMS keys. Option D is wrong because client-side encryption is managed by the customer.

Answer

Server-side encryption with customer-provided keys (SSE-C)

Answer

Server-side encryption with AWS KMS managed keys (SSE-KMS)

Answer

Client-side encryption

Question 6

Refer to the exhibit. A CloudFormation stack creation failed. The architect needs to identify the reason for the failure. Which CLI command should be used to get detailed error messages?

Accepted Answer

aws cloudformation describe-stack-events --stack-name my-stack. Option A is correct because 'describe-stack-events' provides detailed events including error messages. Option B is wrong because 'describe-stacks' only shows status. Option C is wrong because 'list-stack-resources' shows resources. Option D is wrong because 'get-template' shows the template.

Answer

aws cloudformation describe-stacks --stack-name my-stack

Answer

aws cloudformation get-template --stack-name my-stack

Answer

aws cloudformation list-stack-resources --stack-name my-stack

Question 7

A company is building a serverless application using AWS Lambda. The application processes files uploaded to an S3 bucket. Each file can be up to 500 MB, and processing takes up to 10 minutes. The Lambda function must be triggered as soon as a file is uploaded. Which configuration should they use?

Accepted Answer

Configure S3 event notification to invoke the Lambda function directly.. Option A is correct because S3 event notifications can trigger Lambda for each object creation. Option B is incorrect because Lambda supports up to 15 minutes, but 10 minutes is fine, but S3 event notification is needed. Option C is incorrect because SQS is not necessary for direct S3 trigger. Option D is incorrect because Step Functions add complexity.

Answer

Use S3 event notification to send an SQS message, which triggers Lambda.

Answer

Increase the Lambda function timeout to 15 minutes and memory to 3 GB.

Answer

Use AWS Step Functions to poll S3 and invoke Lambda.

Question 8

A company wants to provide temporary access to an S3 bucket for external partners. The access must be time-limited and restricted to specific objects. Which AWS service or feature should they use?

Accepted Answer

Presigned URLs. Option A is correct because presigned URLs provide temporary, limited access to specific S3 objects. Option B (bucket policies) are not time-limited. Option C (IAM roles) require AWS credentials. Option D (CloudFront signed URLs) are for content delivery, not direct S3 access.

Answer

S3 bucket policies

Answer

CloudFront signed URLs

Answer

IAM roles

Question 9

A company is designing a multi-region active-active application using Amazon DynamoDB. They need to ensure low-latency reads and writes globally. Which DynamoDB feature should they use?

Accepted Answer

Global Tables. DynamoDB Global Tables provide a fully managed, multi-region, multi-active database. Option B (DAX) is a caching layer, Option C (Auto Scaling) adjusts throughput, and Option D (Streams) captures changes.

Answer

Auto Scaling

Answer

DynamoDB Accelerator (DAX)

Answer

DynamoDB Streams

Question 10

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

Accepted Answer

Amazon RDS Multi-AZ deployment. Option C is correct because RDS Multi-AZ provides automatic failover and high availability within a region. Option A is wrong because Single-AZ does not provide failover. Option B is wrong because Read Replicas are for read scaling, not failover. Option D is wrong because cross-region replication is for disaster recovery, not primary failover.

Answer

Amazon RDS Single-AZ deployment

Answer

Amazon RDS with Read Replicas

Answer

Amazon RDS cross-region replication

Question 11

A company is designing a multi-tier web application on AWS. The application must be highly available and scale automatically based on traffic. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The application tier also uses EC2 instances. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use Auto Scaling groups for both web and application tiers, and route traffic through an Application Load Balancer.. Option A is correct because using Auto Scaling groups for both tiers and an ALB provides automatic scaling and high availability with minimal operational overhead. Option B is incorrect because AWS Global Accelerator does not provide automatic scaling of instances. Option C is incorrect because Amazon ECS adds container orchestration overhead. Option D is incorrect because a Network Load Balancer is not ideal for HTTP traffic and does not provide automatic scaling.

Answer

Use Amazon ECS with Fargate for both tiers, with an Application Load Balancer.

Answer

Use AWS Global Accelerator with a single Auto Scaling group for both tiers.

Answer

Use Network Load Balancer with Auto Scaling groups for both tiers.

Question 12

A company is designing a disaster recovery solution for a web application hosted on AWS. The primary site is in us-east-1 and the DR site is in us-west-2. The application uses an Amazon RDS for MySQL database. They need to recover the database with a Recovery Point Objective (RPO) of 5 seconds and a Recovery Time Objective (RTO) of 1 hour. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database.. Option B is correct because Aurora Global Database provides replication with RPO of 1 second and failover in minutes. Option A is incorrect because RDS Multi-AZ is for high availability within a region, not cross-region DR. Option C is incorrect because RDS Cross-Region Read Replica has RPO of seconds but failover is manual. Option D is incorrect because DMS with ongoing replication has higher RTO.

Answer

Use RDS Multi-AZ in us-east-1 and failover to DR site.

Answer

Use AWS DMS with ongoing replication to an RDS instance in us-west-2.

Answer

Use RDS Cross-Region Read Replica and promote it.

Question 13

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Accepted Answer

Enable automated backups and copy them to another Region.. Option A (Cross-Region Read Replica) provides DR and read scaling. Option C (Cross-Region automated backups) allows restore in another region. Option B (Multi-AZ) is for HA within a region, not DR. Option D (snapshot copy) is manual. Option E (S3 replication) doesn't apply to RDS.

Answer

Create a manual snapshot and copy it to another Region.

Answer

Use S3 cross-Region replication for the database.

Answer

Enable Multi-AZ deployment.

Question 14

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. They need to offload SSL/TLS termination to reduce CPU usage on the instances. What should they do?

Accepted Answer

Configure the ALB with an SSL certificate. ALB can terminate SSL/TLS by installing a certificate on it. Option B (NLB) does not support SSL termination natively, Option C (CloudFront) is a CDN, and Option D (self-signed certificate) is less secure and not recommended for production.

Answer

Install a self-signed certificate on each EC2 instance

Answer

Use a Network Load Balancer (NLB) with SSL pass-through

Answer

Use Amazon CloudFront for SSL termination

Question 15

A company is designing a new data lake on Amazon S3. They need to ensure that data is encrypted at rest and that access is audited. Which services should they use? (Choose TWO.)

Accepted Answer

AWS KMS. AWS KMS provides encryption keys, and AWS CloudTrail logs API calls for auditing. Option C (Amazon GuardDuty) is for threat detection, Option D (Amazon Macie) is for sensitive data discovery, and Option E (AWS Config) is for resource configuration tracking.

Answer

Amazon Macie

Answer

Amazon GuardDuty

Answer

AWS Config

Question 16

Which TWO design patterns help ensure data durability in Amazon S3?

Accepted Answer

Enable Cross-Region Replication (CRR).. Options A and B are correct. Versioning protects against accidental deletion or overwrite. Cross-Region Replication provides durability across regions. Option C is incorrect because S3 Standard is already durable; additional storage class doesn't improve durability. Option D is incorrect because MFA Delete is a security feature for deletion protection. Option E is incorrect because lifecycle policies manage cost, not durability.

Answer

Enable MFA Delete.

Answer

Use S3 Standard-IA storage class.

Answer

Configure lifecycle policies to transition to Glacier.

Question 17

A company is migrating a legacy monolithic application to a microservices architecture on AWS. They want to use an event-driven design where services react to state changes. Which AWS service should they use to capture, store, and replay events?

Accepted Answer

Amazon EventBridge. Option D is correct because Amazon EventBridge captures events and can replay them. Option A (SQS) is queue-based, not event storage. Option B (SNS) is pub/sub, no replay. Option C (Kinesis Data Streams) can replay but is for streaming data, not event sourcing.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

Amazon SQS

Question 18

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket. After deployment, the bucket is created but objects are not automatically deleted after 30 days as expected. What is the most likely cause?

Accepted Answer

The lifecycle rule only applies to noncurrent versions, not current objects.. Option C is correct because the lifecycle rule only expires noncurrent versions, not current objects. To delete current objects, need an ExpirationInDays rule. Option A (versioning not enabled) is wrong because versioning is enabled. Option B (bucket name conflict) would cause stack creation failure, not lifecycle issue. Option D (region not specified) is irrelevant.

Answer

The bucket name conflicts with an existing bucket.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule requires a region-specific prefix.

Question 19

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The Deny statement with aws:SecureTransport=false explicitly denies requests that are not using HTTPS. Even though the Allow statement permits the IP range, the Deny overrides it. Therefore, the request is denied.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 20

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to minimize operational overhead and ensure that service discovery is automatically updated when services scale. Which service discovery option should be used?

Accepted Answer

AWS Cloud Map. AWS Cloud Map provides service discovery that automatically updates with service scaling.

Answer

Amazon ECS service connect

Answer

Elastic Load Balancing with internal NLB

Answer

Amazon Route 53 private hosted zones with health checks