SAP-C02 Mock Exam 73 — 25 Questions

Question 1

A company is designing a multi-account strategy using AWS Organizations. The security team requires that all API calls to create or modify IAM roles are logged and alerted. Which TWO steps should be taken to meet this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a CloudWatch Logs metric filter and alarm to detect IAM role creation/modification events.. A CloudWatch Logs metric filter can parse CloudTrail logs for specific API calls (e.g., CreateRole, UpdateAssumeRolePolicy) and trigger an alarm when IAM role creation or modification events occur. Option D is correct because enabling CloudTrail management events with CloudWatch Logs integration in all accounts ensures that all IAM role API calls are captured in a centralized log group, which is a prerequisite for the metric filter and alarm to work.

Answer

Use AWS Config to record IAM role changes and stream to CloudWatch Logs.

Answer

Create an SCP that denies IAM role creation and modification.

Answer

Enable IAM Access Analyzer to monitor IAM role usage.

Question 2

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

Accepted Answer

Enable cluster mode for the Redis cluster and add more shards.. Enabling cluster mode for the Redis cluster and adding more shards horizontally partitions the data across multiple nodes, distributing both CPU and memory load. This directly addresses the 100% CPU and high memory utilization during traffic spikes, allowing the cluster to handle more concurrent requests without performance degradation. Cluster mode also provides linear scalability, which is essential for a critical web application experiencing variable traffic.

Answer

Configure ElastiCache Auto Scaling to automatically add nodes when CPU utilization exceeds 75%.

Answer

Enable Multi-AZ replication for the Redis cluster.

Answer

Increase the instance size of the Redis cluster to a larger node type.

Question 3

A company uses AWS Organizations to manage multiple accounts. The central team wants to deploy a CloudFormation template that creates an S3 bucket with default encryption in every member account. Which THREE steps are required to accomplish this?

Accepted Answer

Write a CloudFormation template that includes an S3 bucket resource with default encryption enabled.. The CloudFormation template must define the S3 bucket resource with default encryption enabled (e.g., using the `BucketEncryption` property with `AES256` or `aws:kms`) to meet the requirement. Without this configuration in the template, the deployed bucket would not have default encryption, failing the central team's objective.

Answer

Create an IAM role in each member account that allows CloudFormation to create resources.

Answer

Create an SCP that allows CloudFormation to create S3 buckets.

Question 4

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that delivers single-digit millisecond latency at any scale. It supports auto-scaling of read/write capacity based on traffic patterns, enabling the application to handle sudden spikes in read traffic without manual intervention.

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache

Answer

Amazon Aurora

Question 5

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Accepted Answer

Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager. AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Answer

Deploy VPC endpoints in each account for communication

Answer

Establish VPC peering connections between each account and the central networking account

Answer

Set up AWS Direct Connect between all accounts

Question 6

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. A scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 7

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, NFS-based shared file system that can be mounted concurrently by multiple EC2 instances across different Availability Zones within the same AWS Region. It offers low-latency access and supports frequent updates through its standard storage class, making it ideal for shared datasets that require consistent, low-latency performance.

Answer

Amazon S3

Answer

Amazon EBS with Provisioned IOPS

Answer

Amazon S3 Glacier

Question 8

A company is designing a new solution to host a static website with global low latency. The website content is stored in an S3 bucket and must be secured with HTTPS. Which three services or features should be used together to meet these requirements?

Accepted Answer

S3 bucket configured as an origin with Origin Access Control (OAC). Origin Access Control (OAC) allows CloudFront to securely access the S3 bucket without making the bucket public, enforcing that all requests come through CloudFront. This is the modern replacement for Origin Access Identity (OAI) and supports HTTPS between CloudFront and S3.

Answer

Application Load Balancer

Answer

Amazon Route 53

Question 9

A company is migrating a web application from on-premises to AWS. The application consists of a stateless web tier and a stateful application tier that stores session data in a local file system. The company wants to use AWS Elastic Beanstalk for both tiers. During a test migration, the development team notices that users are being logged out intermittently. The application tier is configured with two EC2 instances behind an internal load balancer. What should the development team do to resolve the issue?

Accepted Answer

Move session storage to Amazon ElastiCache for Redis and configure the application to use it.. The issue is that session data is stored locally on each application instance. When traffic is distributed by the internal load balancer, subsequent requests from the same user may go to a different instance, losing the session data. The best practice is to use a centralized session store like Amazon ElastiCache for Redis. This ensures session data persists across all instances. Option A (sticky sessions) would cause load imbalance and is not recommended for high availability. Option C does not address session storage. Option D (DynamoDB) is possible but not as performant for session storage and requires more custom code; Redis is the recommended service for session management.

Answer

Enable sticky sessions (session affinity) on the application tier's load balancer.

Answer

Increase the number of instances in the web tier to reduce the load on the application tier.

Answer

Store session data in Amazon DynamoDB.

Question 10

A company is designing a new serverless application using AWS Lambda. The application needs to access an Amazon RDS for PostgreSQL database. The database credentials must be rotated automatically every 30 days. Which THREE steps should the company take to securely manage the credentials? (Choose three.)

Accepted Answer

Store the database credentials in AWS Secrets Manager.. AWS Secrets Manager is designed to securely store, manage, and automatically rotate database credentials, including for Amazon RDS for PostgreSQL. By storing credentials in Secrets Manager, the company avoids hardcoding secrets in code or configuration files, ensuring a centralized and auditable secrets management solution.

Answer

Grant the Lambda function's IAM role permission to access the RDS database directly.

Answer

Write custom rotation logic in the Lambda function to change the database password.

Question 11

A company has a central networking account that hosts a transit gateway (TGW). Multiple VPCs from various accounts are attached to the TGW. The security team wants to ensure that only specific VPCs can communicate with each other, but all VPCs need access to a shared services VPC. Which configuration should be used?

Accepted Answer

Create separate TGW route tables for each VPC and only propagate the shared services VPC routes.. Using separate TGW route tables for each VPC allows you to control which VPCs can communicate by selectively propagating only the shared services VPC routes into each VPC's route table. This ensures all VPCs can reach the shared services VPC, while VPCs that do not have each other's routes in their respective route tables cannot communicate directly. This approach leverages the transitive routing capability of the transit gateway while maintaining strict isolation between non-shared VPCs.

Answer

Create a VPC peering connection between each pair of VPCs that need to communicate.

Answer

Use AWS PrivateLink to connect VPCs to the shared services VPC.

Answer

Use a single TGW route table for all attachments and control traffic with security groups.

Question 12

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

Accepted Answer

Use a cell-based architecture where each microservice runs in isolated cells with independent data stores.. Cell-based architecture isolates failures to individual cells, reducing blast radius. Option A is wrong because sharing a data store creates a single point of failure. Option C is wrong because a single Application Load Balancer creates a single point of failure and bottleneck. Option D is wrong because a single Availability Zone and shared database are single points of failure.

Answer

Implement Auto Scaling groups for each microservice without separating data stores.

Answer

Route all traffic through a single Application Load Balancer to simplify management.

Answer

Deploy all microservices in a single Availability Zone with a shared database.

Question 13

A company has multiple AWS accounts and wants to centralize CloudTrail logs in a single S3 bucket in the security account. Which policy should be applied to the S3 bucket to allow cross-account delivery from all member accounts?

Accepted Answer

Add a bucket policy that grants the CloudTrail service principal s3:PutObject permissions for the bucket, with a condition that the source account is in the organization.. CloudTrail cross-account logging requires a bucket policy that grants the CloudTrail service principal (cloudtrail.amazonaws.com) s3:PutObject permission, with a condition (aws:SourceOrgID or aws:SourceAccount) to restrict access to only the member accounts within the AWS Organization. This ensures centralized delivery while preventing unauthorized accounts from writing to the bucket.

Answer

Add an IAM role in the security account and allow the CloudTrail service in each member account to assume that role.

Answer

Configure the bucket ACL to allow write access for all member account root users.

Answer

Add a bucket policy that grants the service principal 'logs.amazonaws.com' s3:PutObject permissions.

Question 14

A company uses AWS Organizations with several OUs for different environments (dev, test, prod). They want to restrict the use of specific EC2 instance types in the prod OU only. Which approach should they use?

Accepted Answer

Attach a service control policy (SCP) to the prod OU that denies ec2:RunInstances for non-approved instance types.. Service control policies (SCPs) are the correct mechanism to centrally restrict permissions across all accounts within an AWS Organizations organizational unit (OU). By attaching an SCP to the prod OU that denies ec2:RunInstances for non-approved instance types, you enforce a guardrail that applies to every principal (including root users) in all accounts under that OU, regardless of IAM policies. This ensures that even if a user or role has an IAM policy allowing all EC2 instances, the SCP will block the non-approved types.

Answer

Create a separate AWS account for prod and use an IAM policy on the account.

Answer

Attach an IAM policy to all users in the prod accounts that denies non-approved instance types.

Answer

Use AWS Config to detect non-approved instance types and terminate them.

Question 15

A company is designing a new data lake on AWS using Amazon S3. The data will be ingested from various sources, including IoT devices, application logs, and streaming data. The data must be processed in near real-time as it arrives. Which combination of services should be used for ingestion and processing?

Accepted Answer

Amazon Kinesis Data Firehose and Amazon Kinesis Data Analytics. Amazon Kinesis Data Firehose is the correct ingestion service because it can reliably capture and load streaming data into Amazon S3 in near real-time without custom code. Amazon Kinesis Data Analytics then processes the data using SQL or Apache Flink as it arrives, enabling near real-time transformations and analytics before the data lands in the data lake.

Answer

Amazon S3 Transfer Acceleration and AWS Lambda

Answer

Amazon Athena and Amazon S3

Answer

AWS Glue and Amazon Redshift

Question 16

A large enterprise uses AWS Organizations with hundreds of accounts. The central security team needs to enforce that no IAM users are created in any account; instead, all access must be through IAM roles federated with the corporate identity provider. The security team wants to detect any IAM user creation and automatically remediate it by deleting the user and notifying the security team. Which solution should be implemented?

Accepted Answer

Use AWS Config with a custom rule triggered by iam:CreateUser, and an AWS Lambda function that deletes the user and sends an Amazon SNS notification.. AWS Config custom rules can be triggered on specific API calls via AWS CloudTrail events. By configuring a custom rule with an AWS Lambda function triggered by iam:CreateUser, the solution can automatically delete the newly created IAM user and send an SNS notification to the security team, providing both detection and remediation.

Answer

Use IAM Access Analyzer to detect and report IAM user creation.

Answer

Use an SCP to deny iam:CreateUser across all accounts.

Answer

Enable AWS CloudTrail and create a metric filter for iam:CreateUser, then set up an Amazon CloudWatch alarm that triggers an SNS notification.

Question 17

A company has a single AWS account and wants to implement a multi-account strategy for better isolation. Which AWS service is designed to help centrally manage multiple accounts?

Accepted Answer

AWS Organizations. AWS Organizations is the native AWS service designed to centrally manage multiple AWS accounts. It allows you to create a hierarchy of accounts with organizational units (OUs), apply service control policies (SCPs) for governance, and consolidate billing. This directly addresses the need for a multi-account strategy with centralized management.

Answer

AWS IAM

Answer

AWS Control Tower

Answer

AWS Service Catalog

Question 18

A company is designing a new hybrid cloud solution that requires low-latency access to on-premises data from AWS. The connection must be highly available and encrypted. The company has multiple VPCs and on-premises locations. Which combination of services meets these requirements?

Accepted Answer

AWS Transit Gateway and AWS Direct Connect with VPN backup. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs and on-premises networks, simplifying the hybrid architecture. AWS Direct Connect provides a private, low-latency, and consistent network path, while a Site-to-Site VPN over the Direct Connect link (or as a separate backup) adds encryption and high availability. This combination meets all requirements: low latency (Direct Connect), encryption (VPN), high availability (dual connections or failover), and support for multiple VPCs and on-premises locations (Transit Gateway).

Answer

AWS Site-to-Site VPN and VPC Endpoints

Answer

VPC Peering and AWS Site-to-Site VPN

Answer

AWS Client VPN and VPC Peering

Question 19

Match each AWS compute service to its use case.

Accepted Answer

Amazon EC2: Full control over virtual servers in the cloud, including OS and software.. The correct matches are: EC2 for full control over virtual servers, Lambda for serverless event-driven code, and ECS for Docker containers. Common confusions include mixing up serverless features with EC2.

Answer

Amazon EC2: Run code without provisioning or managing servers, event-driven execution.

Question 20

A company manages 200 AWS accounts using AWS Organizations. The security team wants to prevent developers from creating resources outside of a set of approved AWS Regions. Additionally, they want to restrict the creation of resources that are not tagged with a cost center tag. Which THREE actions should be taken to enforce these requirements?

Accepted Answer

Create an SCP that denies all actions in non-approved regions.. Service Control Policies (SCPs) in AWS Organizations can be used to deny all actions in non-approved regions by specifying a condition key like 'aws:RequestedRegion' with a list of allowed regions. This effectively prevents developers in any member account from creating or interacting with resources outside the approved set, regardless of their IAM permissions.

Answer

Use IAM policies in each account to deny actions in non-approved regions.

Answer

Define a tag policy using AWS Organizations to enforce cost center tags.