SAP-C02 Mock Exam 71 — 25 Questions

Question 1

A company is migrating to AWS and wants to use AWS CloudFormation to manage infrastructure as code. The DevOps team needs to ensure that stack updates are reviewed and approved before execution. Which feature should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS CloudFormation Change Sets. AWS CloudFormation Change Sets allow you to preview how proposed changes to a stack will impact your running resources before you apply them. This enables the DevOps team to review and approve stack updates by generating a summary of the changes (additions, modifications, deletions) without executing them immediately, meeting the requirement for a review-and-approval workflow.

Answer

AWS CloudFormation Drift Detection

Answer

AWS CloudFormation StackSets

Answer

AWS CloudFormation Nested Stacks

Question 2

A company is designing a new application that will run on Amazon ECS with Fargate. They need to store configuration data and secrets securely. Which services should they use? (Choose TWO.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is correct because it is purpose-built for securely storing, rotating, and managing secrets such as database credentials and API keys throughout their lifecycle. It integrates natively with Amazon ECS to inject secrets into containers at runtime without exposing them in the task definition or environment variables, meeting the requirement for secure configuration data and secrets.

Answer

Amazon S3

Answer

AWS CloudFormation

Answer

AWS KMS

Question 3

A company runs a critical application on an Amazon RDS for PostgreSQL DB instance. The database experiences periodic slowdowns. The team notices that the DB instance has a large number of connections in an idle state. What is the BEST way to address this issue?

Accepted Answer

Use an RDS Proxy to pool database connections.. Using an RDS Proxy reduces the number of idle connections by pooling and reusing them. Option A is wrong because switching to Aurora may not directly address idle connections. Option B is wrong because Lambda is not a database connection management tool. Option D is wrong because increasing max_connections might worsen the problem.

Answer

Migrate the database to Amazon Aurora.

Answer

Configure AWS Lambda to manage database connections.

Answer

Increase the max_connections parameter in the DB parameter group.

Question 4

A company has a centralized network account that hosts a transit gateway with attachments to multiple VPCs in different accounts. The security team needs to ensure that all traffic between VPCs is inspected by a centralized NGFW appliance in the network account. What is the MOST efficient solution?

Accepted Answer

Create a transit gateway with a route table that includes a blackhole route for inter-VPC traffic, and attach an inspection VPC with the NGFW.. It uses a transit gateway with a centralized inspection VPC, which allows all inter-VPC traffic to be routed through the NGFW appliance. By attaching the inspection VPC to the transit gateway and configuring route tables with blackhole routes for direct inter-VPC traffic, traffic is forced to traverse the NGFW for inspection. This is the most efficient and scalable solution for centralized traffic inspection across multiple VPCs in different accounts.

Answer

Use AWS PrivateLink to route traffic through the NGFW.

Answer

Establish VPC peering connections between all VPCs and route traffic through the inspection VPC.

Answer

Set up AWS Direct Connect between all VPCs and the inspection VPC.

Question 5

A company is migrating its on-premises Active Directory to AWS Managed Microsoft AD. The company has multiple VPCs across different accounts that need to authenticate against the same directory. What is the MOST scalable and secure way to provide this access?

Accepted Answer

Deploy AWS Managed Microsoft AD in a central account and share it with other accounts using AWS Resource Access Manager.. AWS Resource Access Manager (RAM) allows you to share AWS Managed Microsoft AD directories across accounts without duplicating the directory or managing multiple trust relationships. This provides a single, centrally managed directory that multiple VPCs in different accounts can authenticate against, ensuring scalability and security by avoiding cross-account credential replication or complex VPN meshes.

Answer

Set up a VPN connection from each VPC to the on-premises AD.

Answer

Clone the directory and deploy it in each account.

Answer

Deploy an AD Connector in each VPC pointing to the on-premises AD.

Question 6

A company is designing a new data lake on AWS. The data lake must support SQL queries using Amazon Athena and also allow Amazon SageMaker to access training data. The solution must minimize storage costs for infrequently accessed data while providing immediate access when needed. Which storage tier should be used for the data lake?

Accepted Answer

Amazon S3 Intelligent-Tiering. Amazon S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant access) based on changing access patterns, optimizing storage costs without compromising performance. This meets the requirement for infrequently accessed data to be cost-effective while still providing immediate access for Athena queries and SageMaker training, as data in the archive instant access tier can be retrieved within milliseconds.

Answer

Amazon S3 Glacier Deep Archive

Answer

Amazon S3 Standard

Answer

Amazon S3 One Zone-Infrequent Access

Question 7

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to centrally enforce that all S3 buckets across all accounts have server-side encryption enabled. Which solution should be used?

Accepted Answer

Attach a service control policy (SCP) to the root organizational unit that denies s3:PutBucket without encryption. A service control policy (SCP) attached to the root organizational unit can centrally deny the s3:PutBucket action unless the request includes a condition that requires server-side encryption (e.g., s3:x-amz-server-side-encryption). SCPs apply to all accounts in the organization, ensuring that even administrators in member accounts cannot create unencrypted buckets, and they cannot be overridden by IAM policies within those accounts.

Answer

Use AWS CloudTrail to monitor and alert on bucket creation without encryption

Answer

Use AWS Config rules with auto-remediation in each account

Answer

Define an IAM policy in each account to deny S3:PutBucket without encryption

Question 8

A company uses a centralized logging account with an S3 bucket that receives VPC Flow Logs from multiple accounts. The logs must be encrypted at rest using a KMS key in the logging account. Which configuration is required to allow cross-account delivery of VPC Flow Logs?

Accepted Answer

Add a bucket policy on the logging account's S3 bucket granting the VPC Flow Logs service principal write access, and a KMS key policy granting the same principal encrypt/decrypt permissions.. VPC Flow Logs can be published to an S3 bucket in a different account by using a resource-based bucket policy that grants the VPC Flow Logs service principal (delivery.logs.amazonaws.com) write access. Additionally, since the logs must be encrypted at rest with a KMS key in the logging account, the KMS key policy must also grant the same service principal the kms:Encrypt and kms:Decrypt permissions. This combination allows the cross-account delivery service to write encrypted objects directly into the logging account's bucket.

Answer

Create an IAM role in the logging account that can be assumed by the VPC Flow Logs service.

Answer

Configure the source account's S3 bucket policy to allow VPC Flow Logs to write logs and replicate them to the logging account.

Answer

In the source account, create a KMS key and allow the logging account to use it for encryption.

Question 9

A company is designing a highly available web application on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to EC2 instances in an Auto Scaling group across multiple Availability Zones. The application state is stored in an Amazon ElastiCache for Redis cluster. The company wants to minimize downtime during patching of the Redis cluster. What should the company do?

Accepted Answer

Deploy the Redis cluster with Multi-AZ and automatic failover enabled across two Availability Zones.. Deploying ElastiCache for Redis with Multi-AZ and automatic failover enabled ensures that if the primary node fails or requires patching, a read replica in a different Availability Zone is automatically promoted to primary, minimizing downtime. This aligns with the requirement for high availability during patching, as ElastiCache handles failover transparently without manual intervention.

Answer

Increase the Redis node type to handle the load and rely on the ElastiCache maintenance window.

Answer

Use a blue/green deployment strategy by creating a new Redis cluster and switching the application endpoint.

Answer

Deploy the Redis cluster as a single node in one Availability Zone and take regular snapshots.

Question 10

A company is designing a new application that will run on Amazon EC2 instances. The application needs to access an Amazon S3 bucket to read and write objects. The company wants to ensure that the EC2 instances can access the S3 bucket without storing AWS credentials on the instances. Which TWO steps should the company take?

Accepted Answer

Attach the IAM role to the EC2 instance profile.. An IAM role can be attached to an EC2 instance via an instance profile, allowing the instance to obtain temporary credentials from the AWS Security Token Service (STS) without storing any long-term credentials on the instance. This is the recommended secure method for granting EC2 instances access to AWS services like S3.

Answer

Store the AWS access key and secret access key in a configuration file on the instance.

Answer

Create an S3 bucket policy that allows access from the EC2 instance's IP address.

Answer

Configure the EC2 security group to allow outbound traffic to S3.

Question 11

A company wants to centralize management of Amazon EC2 instances across multiple AWS accounts. They need to be able to run commands on instances in any account from a central management account. Which service should be used?

Accepted Answer

AWS Systems Manager. AWS Systems Manager (SSM) is the correct choice because it provides a unified interface to manage EC2 instances across multiple AWS accounts via the Systems Manager Agent (SSM Agent). With SSM, you can use Run Command, Session Manager, or State Manager to execute commands on instances in any account, as long as the instances are registered in AWS Systems Manager and the appropriate cross-account IAM roles and resource access manager (RAM) sharing are configured. This centralizes management without requiring SSH or bastion hosts.

Answer

AWS Config

Answer

Amazon ECS

Answer

AWS OpsWorks

Question 12

A company has a multi-account environment with over 500 accounts. They need to enforce that all EC2 instances are launched only in approved instance families (e.g., t3, m5, c5). Which combination of AWS services provides the MOST scalable and effective enforcement?

Accepted Answer

Use a service control policy (SCP) to deny ec2:RunInstances if the instance type is not in the approved list, and use AWS CloudFormation hooks to enforce the same.. SCPs provide preventive, account-level enforcement that blocks unauthorized EC2 instance launches before they occur, while CloudFormation hooks add a second layer of preventive control at the infrastructure-as-code level. This combination is the most scalable for 500+ accounts because SCPs are applied centrally via AWS Organizations and CloudFormation hooks operate at deployment time, ensuring no non-compliant instance is ever created.

Answer

Use AWS CloudTrail to trigger an AWS Lambda function that terminates non-compliant instances.

Answer

Use AWS Systems Manager to scan instances and apply a tag for non-compliance.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Question 13

A company is designing a new web application that will be deployed on Amazon EC2 instances behind an Application Load Balancer (ALB). The application must be highly available and fault-tolerant across multiple Availability Zones. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Launch EC2 instances in an Auto Scaling group across multiple Availability Zones.. Launching EC2 instances in an Auto Scaling group across multiple Availability Zones ensures that the application can withstand the failure of an entire Availability Zone. The Auto Scaling group automatically maintains the desired instance count across the specified zones, providing fault tolerance and high availability.

Answer

Use a larger EC2 instance type to handle failures.

Answer

Use a single Availability Zone to reduce latency.

Question 14

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. In this scenario, CodeBuild can build the Docker image from a Dockerfile, run unit or integration tests inside the build environment, and then push the image to Amazon ECR, all within the CI/CD pipeline defined in AWS CodePipeline.

Answer

AWS CodeDeploy

Answer

Amazon ECR

Answer

AWS CodeCommit

Question 15

A company is designing a multi-region active-active application using Amazon DynamoDB global tables. The application requires strong consistency reads. However, global tables only support eventual consistency. What should the solutions architect do to meet the requirement?

Accepted Answer

Design the application to handle eventual consistency using conditional writes and application logic.. DynamoDB global tables inherently replicate data asynchronously across regions, which means they only support eventual consistency. To meet strong consistency requirements in an active-active multi-region setup, the application must be designed to handle eventual consistency by using conditional writes and application logic to manage conflicts and ensure data integrity. This approach acknowledges the technical limitation of global tables while still achieving the desired consistency level through careful application design.

Answer

Enable strong consistency in the global table configuration.

Answer

Use DynamoDB Streams to replicate data to another region with strong consistency.

Answer

Use DynamoDB Accelerator (DAX) to provide strong consistency reads.

Question 16

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.. Deploying a centralized inspection VPC with AWS Network Firewall and using Transit Gateway to route traffic allows the company to centralize network administration and enforce common security rules across all VPCs. Transit Gateway acts as a hub for inter-VPC and on-premises connectivity, while AWS Network Firewall provides stateful inspection and filtering for all traffic passing through the hub, meeting the requirement for a common set of security rules.

Answer

Allow each team to create their own VPCs and use VPC Peering to connect them.

Answer

Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

Question 17

A company uses AWS Organizations with 100 accounts. The security team wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. They create an SCP that denies all actions if MFA is not present. However, some users report that they cannot access the console even with MFA. What is the most likely reason?

Accepted Answer

The SCP does not include an explicit allow for the sts:GetSessionToken action.. When users authenticate with MFA, the AWS Management Console calls the STS GetSessionToken API to obtain temporary credentials that include the MFA session. If the SCP denies all actions, including sts:GetSessionToken, then even with valid MFA the user cannot obtain the necessary temporary credentials, resulting in access denial. The SCP must explicitly allow the sts:GetSessionToken action for users who authenticate with MFA. Option B is incorrect because the issue is not about the users' IAM policies but about the SCP. Option C is incorrect because SCPs apply to all principals in the account, including administrators. Option D is incorrect because the SCP does not inherently affect the root user differently; root user is not affected by SCPs in the management account.

Answer

The IAM policy attached to the users does not allow any actions.

Answer

The SCP does not apply to users who have administrative privileges.

Answer

The SCP also denies access to the root user of each account.

Question 18

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which TWO components are required?

Accepted Answer

AWS Cloud Map. Only AWS Cloud Map (A) and Amazon Route 53 (D) are required for DNS-based service discovery. AWS Cloud Map allows services to register with DNS names and health checks, while Route 53 can be configured with private hosted zones to resolve those DNS names within the VPC. An Application Load Balancer (E) is not required because service discovery can be achieved solely through Cloud Map and Route 53 without any load balancer. ECS Service Connect (C) and Network Load Balancer (B) are also not required for basic DNS-based service discovery.

Answer

Network Load Balancer (NLB)

Answer

Amazon ECS Service Connect

Answer

Application Load Balancer (ALB)

Question 19

A company has a multi-account AWS environment with hundreds of accounts. The security team needs to centrally manage IAM roles that grant cross-account access to a central security account. The solution must scale as new accounts are added. What should the team do?

Accepted Answer

Use AWS CloudFormation StackSets to deploy the IAM role to all accounts, and enable AWS Organizations trusted access for the role.. AWS CloudFormation StackSets allows you to deploy the same IAM role across multiple accounts in an AWS Organization in a single, automated operation. By enabling trusted access with AWS Organizations, the role can be centrally managed and automatically deployed to new accounts as they are added, ensuring the solution scales without manual intervention.

Answer

Use a service control policy (SCP) to enforce the creation of the role.

Answer

Manually create the same IAM role in each account with a trust policy pointing to the security account.

Answer

Use IAM groups in the security account and grant permissions to the groups.

Question 20

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

Accepted Answer

Enable RDS Proxy to manage database connections.. RDS Proxy is a database proxy that manages connection pooling, reducing the CPU overhead associated with opening and closing many database connections. It requires only a change in the database endpoint configuration, not application code changes, making it the most effective solution that satisfies the requirement of no code changes. Option A (read replica) would require application changes to direct read traffic to the replica. Option B (upgrading instance type) vertically scales the database but does not reduce the load; it only provides more capacity to handle the same load. Option C (ElastiCache for Redis) reduces database read load by caching frequent queries, but implementing it typically requires application code modifications to integrate the caching logic, which conflicts with the stem's requirement.

Answer

Add a second RDS read replica to distribute read traffic.

Answer

Upgrade the RDS instance to a larger instance type with more vCPUs.

Answer

Implement an ElastiCache for Redis cluster to cache frequently accessed data.