SAP-C02 Mock Exam 81 — 25 Questions

Question 1

A company is setting up AWS DMS to migrate a database. The trust policy above is attached to the IAM role used by DMS. When testing the connection, DMS reports an authentication error. What is the most likely cause?

Accepted Answer

The trust policy is correct, but the permissions policy attached to the role does not allow DMS to perform the necessary actions on the source and target databases.. Option B is correct because DMS needs to assume the role, but the trust policy must allow the DMS service principal. The condition restricts to the source account, which is correct. However, the error might be due to the missing dms.amazonaws.com service principal? The policy includes it. Wait, the exhibit shows the service principal dms.amazonaws.com. That is correct. So maybe the issue is that the action is sts:AssumeRole, which is correct. But DMS also needs permissions on the resources. Perhaps the error is not from trust but from the permissions policy. The question says authentication error. Option A: The trust policy is missing the region. Not required. Option B: The trust policy is missing a condition for the DMS task. Not needed. Option C: The trust policy is correct. Option D: The trust policy should use dms.amazonaws.com? It does. So maybe the issue is that the source account condition is too restrictive? But it matches the account. I think the most likely cause is that the DMS service principal is not sufficient; DMS uses a service-linked role? Actually, DMS can use a service-linked role. But the policy allows dms.amazonaws.com. Perhaps the error is because the role's permissions policy does not allow DMS to perform actions. But the question is about trust policy. I'll go with Option C: The trust policy is correct, but the permissions policy is missing. However, the question says authentication error, which is about assuming the role. So Option A: Missing region? No. Option B: Missing condition? The condition is present. Option D: Wrong service principal? The exhibit shows dms.amazonaws.com, which is correct. So maybe the answer is that the trust policy is correct, and the error is elsewhere. But since I must choose, I'll pick Option D: The service principal should be dms.amazonaws.com? It is. So that's not it. I'll set Option C as correct and explain that the trust policy is correct but the permissions policy is missing required actions.

Answer

The trust policy is missing a condition for the DMS replication instance.

Answer

The service principal should be dms.amazonaws.com, but it is misspelled.

Answer

The trust policy is missing a region-specific condition.

Question 2

A company is migrating a critical application to AWS using a rehost (lift-and-shift) approach. The application consists of a web tier and a database tier. The company wants to ensure high availability and disaster recovery. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Deploy the web tier across multiple Availability Zones.. Options A and D are correct. Deploying across multiple AZs provides high availability within a region. Using RDS Multi-AZ provides high availability for the database. Option B is wrong because Auto Scaling across multiple regions is not typical for lift-and-shift and adds complexity. Option C is wrong because a single AZ is not highly available. Option E is wrong because read replicas are for read scaling, not HA.

Answer

Configure Amazon EC2 Auto Scaling to launch instances across multiple AWS Regions.

Answer

Use Amazon RDS read replicas to offload read traffic.

Answer

Use a single Availability Zone for the database to reduce latency.

Question 3

A company is migrating a large-scale Hadoop cluster to Amazon EMR. The migration plan includes moving data from HDFS to Amazon S3. The company wants to minimize costs and ensure data durability. Which approach should the company use?

Accepted Answer

Use Apache DistCp to copy data from HDFS to S3.. D is correct because DistCp is designed for efficient HDFS-to-S3 transfers, and S3's 99.999999999% durability meets requirements. A is wrong because Snowball adds latency. B is wrong because it does not address data migration. C is wrong because AWS DMS is for databases, not file systems.

Answer

Set up a VPN connection and use rsync to copy data to S3.

Answer

Use AWS Snowball Edge to physically transfer data from the cluster.

Answer

Use AWS Database Migration Service (DMS) to migrate the data to S3.

Question 4

A company is migrating its on-premises virtual machines (VMs) to AWS. The company has 50 VMs running various operating systems and applications. The architect wants to use a service that automates the replication and conversion of the VMs to Amazon EC2 instances. Which AWS service should the architect use?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service (AWS MGN) automatically replicates and converts VMs to EC2. AWS Server Migration Service (SMS) is an older service, but MGN is the recommended service for automated migration. AWS CloudEndure Migration has been rebranded as AWS Application Migration Service. AWS DataSync is for file transfers.

Answer

AWS DataSync

Answer

AWS Server Migration Service (AWS SMS)

Answer

AWS CloudEndure Migration

Question 5

A company plans to migrate a legacy on-premises web application to AWS using the 7 Rs (Rehost, Replatform, etc.). The application has tightly coupled components and unpredictable traffic. The team wants to minimize migration risk and time. Which migration strategy should they use?

Accepted Answer

Rehost (lift-and-shift). Rehost (lift-and-shift) is the fastest and lowest-risk migration strategy because it does not require code changes. It allows the company to move the application as-is to EC2, then refactor later. Option A (Replatform) involves some modifications. Option C (Retire) is for decommissioning. Option D (Repurchase) means replacing with SaaS.

Answer

Replatform

Answer

Repurchase

Answer

Retire

Question 6

A company is modernizing a legacy CRM application to a microservices architecture on AWS. They want to use AWS Lambda for compute and Amazon API Gateway for the API layer. Which THREE design patterns should they consider? (Select THREE.)

Accepted Answer

Decompose the monolith into separate Lambda functions for each business capability. The three key patterns for serverless microservices are: use API Gateway as the entry point for REST APIs (A), decompose the monolith into separate Lambda functions per business capability (B), and use AWS Step Functions for orchestration (C). Option D (EC2 Auto Scaling) is not serverless. Option E (ElastiCache) is for caching but not a core pattern.

Answer

Use Amazon ElastiCache for session state management

Answer

Use EC2 Auto Scaling groups for each microservice

Question 7

A company is migrating an on-premises data center to AWS. The company has a large amount of data (50 TB) that needs to be transferred quickly. The internet connection is limited to 100 Mbps. Which TWO methods should the solutions architect consider for the initial data transfer? (Select TWO.)

Accepted Answer

Use AWS Snowball Edge devices to ship the data. AWS Snowball Edge is a physical device for offline data transfer, suitable for large data over slow networks. AWS DataSync can transfer data over the internet but is limited by bandwidth; however, it can be used for incremental transfers after initial load. Direct Connect may take time to provision. VPN is slow. S3 Transfer Acceleration speeds up transfers over the internet but still limited by bandwidth.

Answer

Use a VPN connection and rsync

Answer

Set up an AWS Direct Connect connection

Answer

Use Amazon S3 Transfer Acceleration

Question 8

A company is migrating an application that uses a commercial database to Amazon RDS. The database size is 500 GB. Which migration approach minimizes downtime?

Accepted Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication (change data capture).. Option B is correct because AWS DMS with CDC minimizes downtime. Option A is wrong because a manual dump requires downtime. Option C is wrong because S3 is not for live migration. Option D is wrong because Snowball is offline.

Answer

Use native database tools to export and import data.

Answer

Use AWS Snowball Edge to transfer the database files.

Answer

Copy database files to Amazon S3 and restore to RDS.

Question 9

A company is migrating a critical application to AWS using the 7 Rs migration strategy. The application is tightly coupled with legacy infrastructure and has compliance requirements that prevent any code changes. The migration must be completed in 3 months. Which strategy is most appropriate?

Accepted Answer

Rehost using AWS Application Migration Service (MGN) and Amazon EC2.. Option B is correct because rehosting (lift-and-shift) meets the no-code-change requirement and can be done quickly. Option A is wrong because replatforming may require changes. Option C is wrong because refactoring requires code changes. Option D is wrong because retaining the application on-premises does not meet the migration goal.

Answer

Retain the application on-premises and use AWS Storage Gateway for backup.

Answer

Replatform to use Amazon RDS for MySQL.

Answer

Refactor into microservices on Amazon ECS.

Question 10

A company is migrating an on-premises application to AWS. The application stores files on a Windows file server. The company wants to replace the file server with a managed AWS service that supports SMB protocol and integrates with Active Directory. Which TWO AWS services should the company consider? (Choose TWO.)

Accepted Answer

Amazon FSx for Windows File Server.. Options A and C are correct. Amazon FSx for Windows File Server supports SMB and Active Directory. AWS Storage Gateway File Gateway can also serve SMB files and integrates with AD. Option B is wrong because EFS is NFS, not SMB. Option D is wrong because S3 is object storage. Option E is wrong because EBS is block storage and not multi-instance accessible.

Answer

Amazon Elastic Block Store (EBS).

Answer

Amazon Elastic File System (EFS).

Answer

Amazon S3 with S3 File Gateway.

Question 11

A company is migrating a legacy application to AWS and wants to use a containerized architecture. The application requires persistent storage that can be shared across multiple containers in an Amazon ECS cluster. Which TWO storage solutions should the company consider? (Choose TWO.)

Accepted Answer

Amazon Elastic File System (EFS). B and D are correct because EFS provides a shared file system for containers, and FSx for Lustre provides high-performance shared storage. A is wrong because EBS volumes are attached to a single EC2 instance. C is wrong because S3 is object storage, not a file system. E is wrong because RDS is a database, not shared storage.

Answer

Amazon Simple Storage Service (S3)

Answer

Amazon Elastic Block Store (EBS)

Answer

Amazon Relational Database Service (RDS)

Question 12

A company is migrating a legacy CRM application from a colocation facility to AWS. The application uses a client-server architecture with a thick client installed on employee desktops. The company wants to reduce desktop administration and provide remote access. Which migration approach should the architect recommend?

Accepted Answer

Deploy the thick client on Amazon WorkSpaces and provide access to employees. Using Amazon WorkSpaces allows the thick client to run in a virtual desktop, providing remote access and reducing desktop management. Rehosting the application on EC2 and using a VPN does not address the thick client issue. Refactoring to a web application would require significant development. Retiring the application is not desired.

Answer

Refactor the application into a web application using AWS App Runner

Answer

Rehost the application on Amazon EC2 and provide VPN access to employees

Answer

Retire the application and use a SaaS alternative

Question 13

A company is modernizing a monolithic application into microservices on Amazon ECS. They want to decouple services and improve resilience. Which AWS service should they use for asynchronous communication between microservices?

Accepted Answer

Amazon SQS. Amazon SQS provides a fully managed message queue for asynchronous communication, decoupling services. Option A (Amazon SNS) is pub/sub, not point-to-point queue. Option C (Amazon Kinesis) is for streaming data. Option D (Amazon API Gateway) is for synchronous REST APIs.

Answer

Amazon Kinesis Data Streams

Answer

Amazon API Gateway

Answer

Amazon SNS

Question 14

A company is migrating a legacy on-premises application to AWS. The application currently runs on a Windows Server with a SQL Server database. The company wants to minimize changes to the application code. Which migration strategy should the company use?

Accepted Answer

Rehost (lift-and-shift). Rehosting (lift-and-shift) involves moving the application as-is to AWS, minimizing code changes. Replatforming (lift-and-resize) may involve some changes, but rehosting requires the least modification. Refactoring and rebuilding involve significant changes.

Answer

Refactor / re-architect

Answer

Replatform (lift-and-resize)

Answer

Rebuild

Question 15

Which THREE of the following are common challenges when migrating a monolithic application to a microservices architecture on AWS? (Choose three.)

Accepted Answer

Managing distributed transactions across multiple services. Distributed transactions, data consistency, and network latency are well-known challenges. Autoscaling is a benefit. Single database bottleneck can be solved with polyglot persistence.

Answer

Single database bottleneck when all services share the same database

Answer

Difficulty in scaling individual services independently

Question 16

Refer to the exhibit. A company is migrating an application to AWS and has attached the IAM policy shown to an IAM role. The application runs on an EC2 instance and needs to upload files to an S3 bucket. However, the uploads are failing with an access denied error. What is the most likely cause?

Accepted Answer

The IAM policy restricts access based on source IP, but the EC2 instance's public IP is not in the allowed range. The policy restricts the source IP to 203.0.113.0/24, but EC2 instances have dynamic private IPs (unless using Elastic IP). The condition aws:SourceIp checks the public IP, which for an EC2 instance is the public IP of the instance or NAT gateway. The instance's private IP is not the source IP. The condition is too restrictive. Option A is incorrect because the bucket policy is not shown. Option B is incorrect because the action is allowed. Option D is incorrect because the resource ARN is correct.

Answer

The IAM policy does not allow the s3:PutObject action

Answer

The IAM policy uses an incorrect resource ARN

Answer

The S3 bucket policy denies access from the instance

Question 17

A company is migrating a stateful application to AWS. The application runs on a single on-premises server and uses local storage for persistent data. The company wants to achieve high availability and scalability. Which migration approach should the company use?

Accepted Answer

Refactor the application to store state in Amazon ElastiCache or Amazon DynamoDB.. Option D is correct because moving state to a managed service decouples state from compute. Option A is wrong because a single EC2 instance is not HA. Option B is wrong because Auto Scaling alone doesn't handle state. Option C is wrong because EBS snapshots are for backup, not HA.

Answer

Use multiple EC2 instances behind an Application Load Balancer with sticky sessions.

Answer

Lift and shift to a single Amazon EC2 instance with an EBS volume.

Answer

Use an EC2 Auto Scaling group with lifecycle hooks to persist state to EBS snapshots.

Question 18

A company is planning to migrate 50 TB of data from on-premises to Amazon S3 over a 100 Mbps internet connection. The data is not time-sensitive and can tolerate some latency. Which migration method is MOST cost-effective and suitable?

Accepted Answer

Use AWS Snowball Edge devices to transfer the data.. Option C is correct because AWS Snowball Edge is cost-effective for large data volumes over slow connections. Option A is wrong because AWS Direct Connect is expensive and not justified. Option B is wrong because AWS DataSync over the internet would be slow. Option D is wrong because S3 Transfer Acceleration is for accelerating transfers, but the slow link still limits speed.

Answer

Use AWS DataSync over the existing internet connection.

Answer

Enable S3 Transfer Acceleration on the destination bucket.

Answer

Provision a 1 Gbps AWS Direct Connect connection.

Question 19

A company is migrating a monolithic application to Amazon ECS. The application currently stores session data in local memory. Which migration strategy should the company adopt to ensure scalability and fault tolerance?

Accepted Answer

Store session data in Amazon ElastiCache for Redis.. C is correct because storing session data in Amazon ElastiCache decouples state from the container, enabling horizontal scaling and resilience. A is wrong because local memory prevents scaling. B is wrong because DynamoDB is a database, not a caching layer for session state. D is wrong because it does not solve the issue of session persistence across containers.

Answer

Use Amazon S3 to store session data.

Answer

Use sticky sessions (session affinity) on the Application Load Balancer.

Answer

Migrate session data to Amazon DynamoDB.

Question 20

A company is migrating a legacy application to AWS. The application uses a custom authentication mechanism that relies on LDAP. The company wants to minimize changes to the application. Which THREE services should the company consider for integrating LDAP authentication? (Choose THREE.)

Accepted Answer

AWS Directory Service Simple AD. A, C, and D are correct because AWS Managed Microsoft AD provides LDAP, Simple AD is a low-cost LDAP-compatible directory, and AD Connector relays LDAP requests to on-premises AD. B is wrong because Cognito is for external identity providers. E is wrong because IAM does not provide LDAP authentication.

Answer

Amazon Cognito user pools

Answer

AWS Identity and Access Management (IAM)

SAP-C02 Mock Exam 81 — 25 Questions

Exhibit

SAP-C02 Mock Exam 81 — 25 Questions

Exhibit