SAP-C02 Practice Exam 61 — 20 Questions

Question 1

A company has a centralized logging solution using Amazon OpenSearch Service (successor to Amazon Elasticsearch Service) in a central logging account. Application logs from hundreds of EC2 instances across multiple accounts are shipped to the OpenSearch cluster via Amazon Kinesis Data Firehose. The security team requires that all log data be encrypted at rest and in transit. The logging account has a KMS key used to encrypt the OpenSearch cluster and the Firehose delivery stream. Recently, the security team noticed that some log deliveries are failing with 'AccessDenied' errors. The CloudWatch Logs delivery to Firehose is configured correctly. What is the most likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption.. The most likely cause is that the KMS key policy does not grant the Firehose delivery stream permission to use the key for encryption. Even though the CloudWatch Logs subscription filter is correctly configured to send data to Firehose, Firehose must have kms:Decrypt and kms:GenerateDataKey permissions on the KMS key to encrypt the data at rest in the OpenSearch cluster and in transit. Without these permissions, Firehose cannot encrypt the data, resulting in 'AccessDenied' errors.

Answer

The CloudWatch Logs subscription filter does not have permissions to write to Firehose.

Answer

The OpenSearch cluster's access policy denies write access from the Firehose stream.

Answer

The Firehose delivery stream does not have a TLS certificate configured.

Question 2

A retail company is migrating its on-premises e-commerce application to AWS. The application currently runs on a single server with a MySQL database. The company wants to minimize operational overhead and improve scalability. Which migration strategy should be used?

Accepted Answer

Rehost the application on Amazon EC2 and use Amazon RDS for MySQL.. (Rehost) is the best migration strategy for this scenario because it involves lifting and shifting the application to Amazon EC2 with minimal changes, and using Amazon RDS for MySQL reduces operational overhead for database management. Rehosting is the fastest approach and aligns with the goal of minimizing operational overhead while improving scalability through managed services. Option A (Re-platform) would require modifications to use Elastic Beanstalk, increasing effort. Option B (Repurchase) involves switching to a new SaaS solution, which is not a migration of the existing application. Option C (Refactor) requires significant development to convert to microservices, which is high effort and not necessary for the stated goals.

Answer

Re-platform the application to use AWS Elastic Beanstalk and Amazon RDS.

Answer

Repurchase a new SaaS-based e-commerce solution.

Answer

Refactor the application as microservices on Amazon ECS with Amazon Aurora Serverless.

Question 3

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

Accepted Answer

Create a Change Set for the stack to preview the changes and identify the conflict.. A Change Set allows you to preview the changes that will be made during a stack update, including any potential errors or resource conflicts, before executing the update. This helps identify the specific resource causing the failure. Option B is wrong because the Events tab shows past events but does not provide a preview of planned changes or conflicts. Option C is wrong because StackSets are used for deploying stacks across multiple accounts and regions, not for troubleshooting a single stack update. Option D is wrong because drift detection compares the current stack resources with the template to identify manual changes, not update conflicts.

Answer

Review the stack's 'Events' tab in the AWS Management Console to find the error message.

Answer

Use AWS CloudFormation StackSets to deploy the update across multiple accounts.

Answer

Run a drift detection operation on the stack to identify manual changes.

Question 4

A solutions architect is trying to export an EC2 instance as a VM using AWS VM Import/Export. The CLI command fails with the error shown in the exhibit. What is the most likely cause?

Accepted Answer

The instance is not an EBS-backed instance.. The error message indicates that the instance does not have an attached root volume, which is characteristic of an instance store-backed instance. AWS VM Import/Export only supports EBS-backed instances. Since an instance store-backed AMI means the instance is not EBS-backed, both options B (the instance is not an EBS-backed instance) and D (the instance is based on an instance store-backed AMI) accurately describe the cause. Option A is incorrect because a region mismatch would produce a different error. Option C is incorrect because the error does not mention permissions.

Answer

The specified S3 bucket is in a different region.

Answer

The IAM role used does not have permission to export instances.

Question 5

A company has a multi-account AWS environment. The security team wants to centrally manage VPC flow logs for all accounts. They already have a centralized logging account. What is the MOST scalable solution?

Accepted Answer

Use a CloudFormation StackSet to deploy VPC Flow Logs to an S3 bucket in the central account using bucket policies.. Using a CloudFormation StackSet allows you to deploy VPC Flow Logs consistently across multiple accounts and regions, publishing them to a centralized S3 bucket in the logging account. Bucket policies grant cross-account write access, making this approach highly scalable without per-account agent management or CloudWatch Logs cross-account limitations.

Answer

Deploy a third-party log collector agent on each EC2 instance.

Answer

Configure AWS Transit Gateway to aggregate flow logs.

Answer

Enable VPC Flow Logs in each account and publish to a CloudWatch Logs group in the central account.

Question 6

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Accepted Answer

Use AWS Config rules to automatically remediate non-compliant buckets.. Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.

Answer

Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

Answer

Create an S3 bucket policy in each account to enforce encryption and block public access.

Answer

Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.

Question 7

A company is building a microservices architecture on Amazon ECS with Fargate. Each service must be isolated and communicate only via APIs. The company needs to enforce that services cannot directly access each other's databases. Which approach should be used?

Accepted Answer

Create a separate VPC for each service and use VPC peering for API communication only.. Placing each microservice in its own VPC and using VPC peering for API communication only enforces strict network isolation at the VPC boundary. This prevents any direct database access between services, as the peering connection can be configured to allow only specific API ports (e.g., HTTPS 443) and not database ports (e.g., 3306, 5432). This design aligns with the principle of least privilege and ensures that services cannot bypass API gateways to reach each other's databases.

Answer

Use a single VPC with network ACLs to block database ports between services.

Answer

Use IAM policies to restrict database access at the API level.

Answer

Place all services in the same VPC and use security groups to restrict database access.

Question 8

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

Accepted Answer

Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.. AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Answer

Use an AWS Config aggregator to deploy rules across accounts.

Answer

Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

Answer

Use AWS Config to create a custom rule in each account manually.

Question 9

A company wants to centrally manage access to multiple AWS accounts using AWS Organizations. The security team requires that all IAM users and roles be created in a single master account and assume roles in member accounts. Which configuration ensures that cross-account role assumptions are auditable and enforced?

Accepted Answer

Enable AWS CloudTrail in the master account and log sts:AssumeRole events.. AWS CloudTrail in the master account can log all sts:AssumeRole API calls across the organization when management events are enabled. This provides a centralized, immutable audit trail of who assumed which role in which member account, meeting the security team's requirement for auditable cross-account role assumptions. CloudTrail captures the source identity, target role ARN, and timestamp, enabling full forensic analysis.

Answer

Create an IAM Access Analyzer in each member account to monitor cross-account access.

Answer

Use AWS Config to record IAM role configurations and trigger Lambda functions on changes.

Answer

Configure a service control policy (SCP) to deny all IAM actions except sts:AssumeRole.

Question 10

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account have server-side encryption (SSE-S3 or SSE-KMS) enabled. Which solution should the team implement?

Accepted Answer

Create a service control policy (SCP) that denies the s3:CreateBucket action unless the request includes s3:x-amz-server-side-encryption header.. A service control policy (SCP) in AWS Organizations can centrally deny the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header. This enforces encryption on all newly created S3 buckets across all accounts in the organization, regardless of individual account permissions, and does not require modifying existing buckets or user policies.

Answer

Create an IAM role with a policy that requires encryption on S3 buckets and attach it to all users.

Answer

Configure S3 bucket policies on each existing bucket to deny requests that do not include encryption.

Answer

Enable AWS CloudTrail to log all S3 API calls and set up a CloudWatch alarm to notify when a bucket without encryption is created.

Question 11

A company has a centralized logging account and wants all VPC Flow Logs from all accounts to be delivered to a central S3 bucket in the logging account. Each account has a VPC Flow Log configured to deliver to a bucket in the same account. What is the most efficient way to centralize these logs?

Accepted Answer

Set up S3 cross-account replication from each account's bucket to the central bucket. S3 Cross-Region Replication (CRR) or Same-Region Replication (SRR) can be configured to automatically replicate objects from each account's VPC Flow Logs bucket to a central S3 bucket in the logging account. This approach is fully managed, requires no custom code, and ensures all logs are centralized with minimal operational overhead, while preserving the original delivery mechanism.

Answer

Use a Lambda function in each account to copy logs to the central bucket

Answer

Configure VPC Flow Logs in each account to directly deliver to the central bucket

Answer

Use CloudWatch Logs subscription filter to stream logs to the central account

Question 12

A company is migrating a stateful application to AWS. The application uses local storage for temporary data that must survive instance restarts but not region failures. Which storage solution should the company use?

Accepted Answer

Instance Store. Instance Store provides ephemeral block storage that persists across instance reboots but is lost if the instance is stopped or terminated. This matches the requirement for temporary data that survives restarts but not region failures. Option A (Amazon EBS) survives stops, which is unnecessary. Option C (Amazon S3) is object storage, not temporary local storage. Option D (Amazon EFS) is a network file system, not local storage.

Answer

Amazon EBS

Answer

Amazon S3

Answer

Amazon EFS

Question 13

A company is modernizing its legacy PHP application to run on AWS. The application is currently deployed on a single on-premises server with a LAMP stack. The company wants to use containerization to improve scalability and deployment speed. Which AWS service should be used to run the containers with minimal operational overhead?

Accepted Answer

Amazon ECS with AWS Fargate. Amazon ECS with AWS Fargate allows running containers without managing servers, significantly reducing operational overhead. AWS Fargate is a serverless compute engine that automatically provisions and scales the infrastructure. Option A is incorrect because AWS Lambda is designed for event-driven serverless functions, not for running containerized applications directly. Option C is incorrect because Amazon EKS with Amazon EC2 requires managing the Kubernetes control plane and worker nodes, adding operational complexity. Option D is incorrect because Amazon ECS with the EC2 launch type requires you to manage the EC2 instances, increasing operational overhead compared to Fargate.

Answer

AWS Lambda

Answer

Amazon EKS with Amazon EC2

Answer

Amazon ECS with Amazon EC2 launch type

Question 14

A company runs a batch processing application on AWS. The application reads input files from an S3 bucket, processes them on EC2 instances, and writes results to another S3 bucket. The processing job runs once a day and takes approximately 3 hours. The company wants to reduce costs and operational overhead. The Solutions Architect suggests using AWS Lambda for processing, but the processing time per file can exceed the Lambda maximum execution time of 15 minutes. The architect also considers using AWS Batch. The company wants to minimize the need for infrastructure management. Which solution should the Solutions Architect recommend?

Accepted Answer

Use AWS Batch with a managed compute environment that uses Spot Instances and a job queue.. AWS Batch with a managed compute environment automatically handles job scheduling, scaling, and infrastructure provisioning. It can accommodate long-running jobs beyond Lambda's 15-minute limit and uses Spot Instances to reduce costs, minimizing operational overhead. Option A is incorrect because managing EC2 instances and Auto Scaling requires more operational effort than using a managed service like AWS Batch. Option B is incorrect because even with increased memory, Lambda has a maximum execution time of 15 minutes, which may not be sufficient for processing files that exceed this limit. Option D is incorrect because while ECS with Fargate reduces infrastructure management, AWS Batch is specifically designed for batch processing and provides more features like job queues, automatic retries, and integration with Spot Instances, making it a better fit for this use case.

Answer

Provision a fleet of EC2 instances and use Auto Scaling to manage the processing.

Answer

Use AWS Lambda with a larger memory allocation to increase CPU and reduce processing time.

Answer

Use Amazon ECS with Fargate launch type and run the processing as a task.

Question 15

A company is migrating a critical application from on-premises to AWS. The application uses a Microsoft SQL Server database with Always On Availability Groups for high availability. The company wants to use Amazon RDS for SQL Server to reduce management overhead. The database size is 500 GB. The migration must have minimal downtime and support transactional consistency. The company has a VPN connection to AWS. Which migration strategy should the company use?

Accepted Answer

Use AWS DMS with a full-load migration and ongoing replication from the on-premises SQL Server to RDS for SQL Server.. AWS DMS supports ongoing replication from SQL Server to RDS for SQL Server using native CDC capabilities, enabling minimal downtime. Option B is wrong because native backup/restore requires downtime and does not support ongoing replication. Option C is wrong because exporting data with SQL Server Import/Export Wizard requires downtime and does not support ongoing sync. Option D is wrong because SCT is for schema conversion, not data migration; also, the question states the database is SQL Server to RDS for SQL Server, so schema conversion is not needed.

Answer

Take a full backup of the database, restore it to RDS, and then schedule a final backup and restore after cutting over.

Answer

Use the SQL Server Import/Export Wizard to copy data from on-premises to RDS over the VPN.

Answer

Use AWS SCT to convert the database schema and then use AWS DMS for data migration.

Question 16

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS database. Which THREE steps are required to secure the database access? (Choose THREE.)

Accepted Answer

Place the Lambda function in a VPC with access to the RDS instance. Placing the Lambda function in the same VPC as the RDS instance allows it to communicate over a private IP address, eliminating exposure to the public internet. This is essential for secure database access, as Lambda functions outside the VPC cannot directly connect to RDS instances that are not publicly accessible.

Answer

Store database credentials in the Lambda function code

Answer

Use a public IP address for the RDS instance

Question 17

A company is migrating an on-premises application to AWS and wants to implement a continuous integration/continuous delivery (CI/CD) pipeline. Which TWO AWS services should the company use to build the pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is a fully managed CI/CD service that automates the build, test, and deploy phases. AWS CodeCommit is a managed source control service that hosts Git repositories. Together, they form a robust CI/CD pipeline. AWS Cloud9 is an IDE, not a CI/CD service. AWS CodeArtifact is for artifact management, and Amazon CodeGuru provides code reviews and performance recommendations. Therefore, the correct answers are AWS CodePipeline (B) and AWS CodeCommit (C).

Answer

AWS Cloud9

Answer

AWS CodeArtifact

Answer

Amazon CodeGuru

Question 18

A company is migrating a legacy application that uses Windows Authentication for SQL Server. The company wants to use AWS Managed Microsoft AD. Which migration strategy should be used for the database to maintain compatibility?

Accepted Answer

Replatform to Amazon RDS for SQL Server with Windows Authentication. (Replatform to Amazon RDS for SQL Server with Windows Authentication) is correct because RDS for SQL Server supports Windows Authentication via AWS Managed Microsoft AD. Option A (Amazon DynamoDB) is incorrect because DynamoDB is a NoSQL database and does not support Windows Authentication. Option B (Amazon RDS for MySQL) is incorrect because MySQL does not support Windows Authentication. Option D (Amazon Aurora PostgreSQL) is incorrect because PostgreSQL does not support Windows Authentication.

Answer

Use AWS DMS to migrate to Amazon DynamoDB

Answer

Replatform to Amazon RDS for MySQL

Answer

Replatform to Amazon Aurora PostgreSQL

Question 19

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The Lambda function has been running successfully for months. Recently, the company updated the Lambda function code and started seeing occasional throttling errors (HTTP 429) from the Lambda service. The function's reserved concurrency is set to 100. The company is unsure why throttling is occurring only after the code update. What is the MOST likely cause?

Accepted Answer

The code update increased the execution time of the Lambda function, leading to a higher number of concurrent executions that exceed the account-level concurrency limit.. When a Lambda function's execution time increases due to a code update, each invocation holds a concurrency slot for longer. With reserved concurrency set to 100, if the function's invocations per second remain the same but each takes longer, the number of concurrent executions can exceed the account-level concurrency limit (default 1000), causing throttling (HTTP 429). Option A is wrong because CloudWatch Logs throttling would result in dropped log events, not Lambda throttling errors. Option B is wrong because if the S3 bucket received the same rate of uploads, the invocation rate wouldn't change; the question states throttling occurred only after the code update, not due to increased uploads. Option C is wrong because missing IAM permissions would cause access denied errors (HTTP 403), not throttling errors.

Answer

The Lambda function is writing logs to CloudWatch Logs at a rate that exceeds the CloudWatch throttling limit.

Answer

The S3 bucket is receiving more uploads than before, causing more Lambda invocations.

Answer

The updated Lambda function no longer has the required IAM permissions to access S3, causing retries that throttle.

Question 20

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

Accepted Answer

Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.. An SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.

Answer

Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.

Answer

Use S3 bucket policies to deny PutObject if encryption is not set.