SAP-C02 Practice Test 8 — 10 Questions

Question 1

A company wants to centralize logging from multiple AWS accounts into a single Amazon S3 bucket. The logging accounts are part of an AWS Organization. Which approach should be used to allow CloudTrail to deliver logs from all accounts to the central bucket?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the central S3 bucket policy to allow CloudTrail from all accounts in the organization to write logs.. CloudTrail can deliver logs from all accounts in an AWS Organization to a single central S3 bucket by configuring the bucket policy to grant the CloudTrail service principal (cloudtrail.amazonaws.com) from each member account the s3:PutObject permission. This approach leverages the organization's trusted access, eliminating the need for individual IAM roles or cross-account assumptions, as CloudTrail automatically uses the organization's management account to validate member account identities.

Answer

Use a VPC endpoint and route logs through a central VPC.

Answer

Attach an SCP to allow CloudTrail to write to the central bucket.

Answer

Create an IAM role in each member account and allow the central account to assume it.

Question 2

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

Accepted Answer

Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.. An S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Answer

Enable default encryption on each bucket using SSE-S3.

Answer

Require that all buckets use AWS KMS managed keys for encryption.

Answer

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Question 3

A company has multiple AWS accounts and wants to centralize logging of all API calls. Which TWO services should be used together to achieve this?

Accepted Answer

AWS CloudTrail. AWS CloudTrail is the correct service because it records all API calls made within an AWS account, including the identity, source IP, and timestamp. Centralizing logging across multiple accounts requires sending these CloudTrail logs to a central Amazon S3 bucket (often with cross-account permissions) and then using Amazon CloudWatch Logs to monitor, alert, or analyze the logs in real time. Together, CloudTrail captures the API activity, and CloudWatch Logs provides a unified log management and monitoring layer.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon S3

Question 4

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 5

A company is designing a new application on AWS that requires high availability and disaster recovery across multiple AWS Regions. The application uses an Amazon RDS for MySQL database. Which TWO strategies should they implement to meet these requirements?

Accepted Answer

Enable automated backups and copy them to another Region.. The correct answers are B and D. Option B enables automated backups of the RDS instance and copies them to another region, allowing point-in-time restoration in a different region for disaster recovery. Option D creates a cross-Region read replica, which serves as a standby database in another region for DR and also offloads read traffic. Option A (manual snapshot) requires manual effort and scheduling, not automated. Option C (S3 cross-Region replication) does not apply to RDS database backups. Option E (Multi-AZ) provides high availability within a single region but not across regions.

Answer

Create a manual snapshot and copy it to another Region.

Answer

Use S3 cross-Region replication for the database.

Answer

Enable Multi-AZ deployment.

Question 6

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. A is correct because EC2 Spot Instances can reduce compute costs by up to 90% compared to On-Demand instances, making them ideal for fault-tolerant, stateless batch workloads that can handle interruptions. The batch processing system described is CPU-intensive and runs for up to 2 hours per file, which fits well within the typical Spot interruption notice (2 minutes) and can be retried using AWS Batch’s built-in retry logic.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 7

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 8

A company is using AWS Organizations and wants to allow certain member accounts to create VPCs with specific CIDR ranges. Which mechanism should be used to enforce this restriction?

Accepted Answer

Use SCPs with conditions on the ec2:CreateVpc action, specifying allowed CIDR ranges.. SCPs (Service Control Policies) are the correct mechanism because they allow you to centrally control the maximum available permissions for all IAM users and roles in member accounts within an AWS Organization. By attaching an SCP with a condition key like `ec2:CreateVpc` and specifying allowed CIDR ranges (e.g., using `StringEquals` or `IpAddress` condition operators), you can enforce that only VPCs with permitted CIDR blocks can be created across all affected accounts, regardless of local IAM policies.

Answer

Use AWS Config rules to automatically delete non-compliant VPCs.

Answer

Use IAM policies with conditions on the ec2:CreateVpc action in each account.

Answer

Use AWS CloudTrail to monitor VPC creation and alert the security team.

Question 9

Refer to the exhibit. A company has an IAM policy that allows s3:GetObject on all objects in 'my-bucket' but denies access to objects in the 'confidential' folder. A user tries to access 's3://my-bucket/confidential/report.pdf'. What will happen?

Accepted Answer

Access is denied because the Deny statement explicitly matches the resource.. An explicit Deny statement overrides any Allow. The policy denies access to objects in the 'confidential' folder, so the user will be denied access to 'report.pdf'. Option B is wrong because even though the Allow statement exists, the explicit Deny takes precedence. Option C is wrong because the Deny is explicit and does not require other policies. Option D is wrong because the broader Allow does not override the explicit Deny.

Answer

Access is allowed because the Deny statement is not evaluated.

Answer

Access is denied only if the user is not authorized by other policies.

Answer

Access is allowed because the Allow statement is broader.

Question 10

A company is designing a new serverless application that processes orders from an e-commerce website. The application uses AWS Lambda functions that are invoked by Amazon API Gateway. The company expects a sudden spike in traffic during a flash sale. Which TWO strategies should be used to ensure the application can handle the spike without errors? (Choose two.)

Accepted Answer

Set Lambda reserved concurrency to a value that matches the expected peak load.. Lambda reserved concurrency guarantees a fixed number of concurrent executions for the function, preventing it from being throttled by other functions in the account. By setting reserved concurrency to match the expected peak load, the application ensures that all requests during the flash sale can be processed without hitting account-level concurrency limits.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Use Amazon SQS to buffer requests and decouple the frontend.

Answer

Configure Lambda provisioned concurrency to pre-warm instances.