SAP-C02 Practice Test 7 — 10 Questions

Question 1

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 2

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 3

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Option A is correct because running the validation script manually on a healthy instance isolates whether the script itself is broken or whether the failure is environmental (permissions, dependencies, or runtime context), which is the fastest way to reproduce and diagnose the error. Option C is correct because the CodeDeploy agent logs on a failing instance (typically /var/log/aws/codedeploy-agent/codedeploy-agent.log) contain the exact stderr/stdout and exit code from the failing lifecycle hook, pinpointing the specific validation error. Option D is correct because CodeDeploy only executes scripts mapped to lifecycle event hooks defined in the AppSpec file's hooks section (for EC2/on-premises, e.g., BeforeInstall, AfterInstall, ApplicationStart, ValidateService); if ValidateService is missing or misspelled, the validation script never runs as intended and the deployment fails validation. Option B is not appropriate because increasing the deployment timeout only masks a script that is failing outright rather than slow, and the logs already show the validation scripts are failing, not timing out. Option E is not appropriate because Auto Scaling lifecycle hooks govern instance launch/termination and do not address CodeDeploy application validation script failures during the deploy stage.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 4

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Fargate. AWS Fargate is the correct compute option because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. By using Fargate with Amazon EKS, the development team can deploy containers without worrying about node scaling, patching, or cluster capacity, thereby minimizing operational overhead.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 5

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 6

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 7

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and the company wants each upload to trigger processing without managing servers. Jobs can take up to 20 minutes, and the company must be able to retry a failed job without reprocessing successful ones. The operations team wants visibility into which specific uploads failed and the ability to replay only those. The company also wants to decouple the upload event from the worker so that bursts of thousands of simultaneous uploads do not overwhelm the processing tier. Which design should the solutions architect recommend?

Accepted Answer

Configure S3 Event Notifications to send each upload to an Amazon SQS queue, and run workers on Amazon ECS that poll the queue and delete messages only after successful transcoding. The design must buffer unpredictable bursts, support jobs longer than a Lambda invocation, and allow selective replay of only failed uploads. An SQS queue between S3 event notifications and a long-running ECS worker tier satisfies all three: the queue absorbs spikes, workers process at their own pace, and messages are deleted only on success so failures remain individually replayable. This also keeps the pipeline serverless at the ingestion edge without imposing a compute timeout.

Answer

Configure S3 Event Notifications to publish to an Amazon SNS topic that fans out to an AWS Step Functions state machine per upload

Answer

Enable S3 Transfer Acceleration and use S3 Batch Operations to transcode all objects nightly regardless of which uploads succeeded

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function directly for each upload, with a 15-minute timeout and built-in retries

Question 8

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. Option A is correct because EC2 Spot Instances can cut compute costs by up to 90% versus On-Demand, and since the workload is a fault-tolerant batch job that can be retried, Spot interruptions are acceptable, directly supporting the goal of minimizing cost. Option C is correct because AWS Batch is purpose-built for batch computing: it manages a job queue and a compute environment (which can be backed by Spot Instances), dynamically provisioning resources so there is no idle compute capacity. Option D is correct because Amazon S3 Event Notifications can publish an event (e.g., to Amazon EventBridge, SQS, or Lambda) when a new file lands in the bucket, automatically submitting the batch job and eliminating polling or manual triggering. Option B is not appropriate because Lambda has a maximum execution timeout of 15 minutes, far short of the 2-hour CPU-intensive processing time per file. Option E is not appropriate because an Auto Scaling group with scheduled scaling provisions capacity on a time schedule rather than reacting to file arrivals, which risks idle compute and does not provide the job queue and job management that AWS Batch offers.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 9

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 10

Drag and drop the steps to configure an Application Load Balancer with HTTPS listeners in the correct order.

Accepted Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create a target group, 3. Create an ALB with an HTTPS listener, 4. Register targets with the target group, 5. Update DNS to point to the ALB.. First get the certificate, then create the target group, then the ALB with HTTPS, register targets, and update DNS.

Answer

1. Create an ALB with an HTTPS listener, 2. Create a target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Register targets with the target group, 5. Update DNS to point to the ALB.

Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create an ALB with an HTTPS listener, 3. Create a target group, 4. Update DNS to point to the ALB, 5. Register targets with the target group.

Answer

1. Create a target group, 2. Register targets with the target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Create an ALB with an HTTPS listener, 5. Update DNS to point to the ALB.