SAP-C02 Mock Exam 81 — 25 Questions

Question 1

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.. Options C and E are correct. The error indicates that the IAM role used by CloudFormation to create the EC2 instance lacks the ec2:RunInstances permission. Therefore, updating the IAM role to include this permission (C) and then executing a stack update (E) will resolve the issue. Option A is incorrect because the instance type is not related to the IAM permissions error. Option B is incorrect because creating a new role is unnecessary; updating the existing role suffices. Option D is incorrect because granting permissions to the user does not affect the CloudFormation service role's permissions.

Answer

Modify the CloudFormation template to use a different instance type.

Answer

Create a new IAM service role for CloudFormation and assign it to the stack.

Answer

Grant the user additional IAM permissions to create EC2 instances.

Question 2

A company is using AWS Organizations with a multi-account strategy. The finance team wants to centrally manage and enforce cost allocation tags across all accounts. Which solution is MOST effective?

Accepted Answer

Create a service control policy (SCP) that denies the creation of resources if they do not have the required tags.. A service control policy (SCP) can be applied at the root, OU, or account level in AWS Organizations to deny the creation of resources that do not have the required cost allocation tags. This enforces tagging proactively at the API call level, preventing untagged resources from being created in the first place, which is the most effective approach for central enforcement.

Answer

Use AWS Budgets to alert on untagged resources.

Answer

Use AWS Config rules to detect untagged resources and trigger a Lambda function to tag them.

Answer

Create an AWS Lambda function that tags resources after they are created.

Question 3

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

Accepted Answer

Use AWS X-Ray to trace requests from the ALB to the application and downstream services.. AWS X-Ray provides end-to-end tracing of requests from the ALB to the EC2 instances and downstream services, allowing the team to identify the specific component causing latency spikes. Option A is wrong because detailed ALB metrics only provide aggregate data, not per-request traces. Option B is wrong because migrating to Lambda would not necessarily resolve latency and adds significant architectural change. Option C is wrong because a Network Load Balancer operates at Layer 4 and does not provide application-level tracing or visibility. Option E is wrong because while adding instances might reduce load, it does not help identify the root cause of intermittent latency spikes.

Answer

Enable detailed ALB metrics and create a CloudWatch dashboard.

Answer

Migrate the application to AWS Lambda to eliminate EC2 overhead.

Answer

Replace the ALB with a Network Load Balancer (NLB) for lower latency.

Answer

Add more EC2 instances behind the ALB to distribute the load.

Question 4

A company has three EC2 instances as shown in the exhibit. The company wants to use an Application Load Balancer to distribute traffic across these instances with cross-zone load balancing enabled. How will the traffic be distributed?

Accepted Answer

Each instance receives an equal share of traffic.. With cross-zone load balancing enabled on an Application Load Balancer, traffic is distributed evenly across all registered targets regardless of the availability zone they reside in. Since there are three EC2 instances, each instance receives an equal share (33.3%) of the incoming traffic, ensuring balanced load across all instances.

Answer

Traffic is distributed evenly across the two availability zones.

Answer

Instances in us-east-1a receive 67% of traffic, us-east-1b receives 33%.

Answer

Traffic is sent to the instance with the least outstanding requests.

Question 5

A company has multiple AWS accounts managed via AWS Organizations. The security team needs to enforce that all S3 buckets across all accounts have server-side encryption with AWS KMS (SSE-KMS) enabled, and any new bucket that does not comply must be automatically remediated. Which design should be used?

Accepted Answer

Use a Service Control Policy (SCP) to deny PutBucketEncryption actions that do not set SSE-KMS, and use AWS Config with a custom rule and automatic remediation via Lambda to fix existing buckets.. It combines a Service Control Policy (SCP) to proactively deny any PutBucketEncryption action that does not specify SSE-KMS, preventing non-compliant buckets from being created, and AWS Config with a custom rule and automatic remediation via Lambda to detect and fix existing non-compliant buckets. This dual approach ensures both prevention and remediation across all accounts in the AWS Organization, meeting the security team's enforcement requirement.

Answer

Use AWS Resource Access Manager (RAM) to share a KMS key across accounts, and enable default encryption in each account's S3 settings.

Answer

Use AWS Config to detect non-compliant buckets and a Service Control Policy (SCP) to enforce encryption on existing buckets.

Answer

Use AWS CloudTrail to monitor bucket creation, and trigger a Lambda function to enable SSE-KMS on new buckets.

Question 6

A company is designing a multi-region disaster recovery solution for a stateful web application on Amazon EC2 with an Amazon Aurora MySQL database. The RPO must be less than 1 second and RTO less than 5 minutes. The application uses a custom TCP port 8080. What is the MOST cost-effective architecture?

Accepted Answer

Use Amazon Aurora Global Database. Use Amazon Route 53 failover routing with a health check on port 8080.. Amazon Aurora Global Database provides cross-region replication with a typical lag of under 1 second, meeting the RPO requirement, and supports failover in under 1 minute, satisfying the RTO of less than 5 minutes. Combined with Route 53 failover routing and a health check on port 8080, this architecture enables rapid, automated traffic redirection to the secondary region without additional compute or storage costs beyond the Aurora storage and I/O.

Answer

Use Amazon RDS Multi-AZ with synchronous replication. Use Elastic Load Balancing with cross-zone load balancing.

Answer

Use Amazon DynamoDB global tables. Use an Application Load Balancer in each region with Route 53 weighted routing.

Answer

Use Amazon RDS for MySQL with a cross-region read replica. Use Amazon Route 53 failover routing with a health check on port 8080.

Question 7

A company wants to use AWS Systems Manager to automate patching of EC2 instances across multiple AWS accounts. What is the most efficient way to manage this centrally?

Accepted Answer

Use AWS Systems Manager Quick Setup to configure patching across accounts.. AWS Systems Manager Quick Setup is the most efficient way to centrally configure patching across multiple AWS accounts because it automates the deployment of SSM Patch Manager resources, including patch baselines, maintenance windows, and IAM roles, across accounts in an AWS Organization. It eliminates the need to manually set up patching in each account, providing a single-pane-of-glass management experience from the management account.

Answer

Use AWS Systems Manager Patch Manager in the management account.

Answer

Use AWS Systems Manager Automation documents in each account.

Answer

Use AWS Config rules to trigger patching in each account.

Question 8

A multinational company is using AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization block public access. What is the MOST efficient way to enforce this requirement?

Accepted Answer

Apply an SCP to the root OU that denies s3:PutBucketPublicAccessBlock actions.. An SCP applied to the root OU is the most efficient way to enforce a blanket denial of public access to S3 buckets across all accounts in AWS Organizations. It prevents any account, including root users, from performing the s3:PutBucketPublicAccessBlock action, ensuring compliance without per-account configuration or remediation.

Answer

Use AWS Config rules to detect and remediate public buckets in each account.

Answer

Create a CloudFormation StackSet to deploy bucket policies in every account.

Answer

Use IAM roles to restrict users from modifying bucket public access settings.

Question 9

A company has multiple AWS accounts and wants to share a centrally managed Amazon VPC subnet for workloads that require low latency. The VPC is in the networking account. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Resource Access Manager (RAM) to share the subnet with the workload accounts.. AWS Resource Access Manager (RAM) allows you to share a subnet from a central VPC in the networking account with other AWS accounts without creating separate VPCs or complex networking. This enables workload accounts to launch resources directly into the shared subnet, achieving low latency by keeping them in the same VPC and Availability Zone. RAM handles the cross-account sharing with minimal operational overhead, as it does not require additional network appliances or routing configuration.

Answer

Create a separate VPC in each account and connect them with VPC peering.

Answer

Set up an AWS Transit Gateway and attach the VPCs from each account.

Answer

Create VPC peering connections between the networking account and each workload account.

Question 10

A company is designing a new disaster recovery solution for a critical application that runs on Amazon EC2 with an Amazon RDS for MySQL database. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database for the database tier.. Amazon Aurora Global Database supports cross-region replication with typical RPO of less than 1 second and RTO of less than 1 minute, easily meeting the 15-minute RTO and 1-hour RPO. The primary region writes are asynchronously replicated to up to five secondary regions, and in a disaster, you can promote a secondary region to full read/write in under a minute.

Answer

Use EC2 AMI copy to another region and launch instances from the AMI.

Answer

Use RDS cross-region snapshots and restore in the DR region.

Answer

Configure RDS Multi-AZ in the primary region.

Question 11

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

Accepted Answer

Use a Network Load Balancer (NLB) with an Elastic IP address.. A Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Answer

Use an Application Load Balancer (ALB) with an Elastic IP address.

Answer

Use Amazon Route 53 with a weighted routing policy.

Answer

Use a Classic Load Balancer (CLB) with an Elastic IP address.

Question 12

A company is designing a new application that will use Amazon DynamoDB as its primary database. The application has two access patterns: one requires strongly consistent reads, and the other requires eventually consistent reads. The company wants to minimize costs while meeting the read consistency requirements. How should the company configure DynamoDB reads?

Accepted Answer

Use strongly consistent reads for the pattern that requires it, and eventually consistent reads for the other pattern.. DynamoDB supports both strongly consistent reads and eventually consistent reads at the API level (via the `ConsistentRead` parameter). Strongly consistent reads return the most up-to-date data but consume twice the read capacity units (RCUs) compared to eventually consistent reads. By using strongly consistent reads only for the access pattern that requires it, and eventually consistent reads for the other pattern, the company minimizes RCU consumption and thus costs while meeting the specific consistency requirements of each pattern.

Answer

Use strongly consistent reads for all read requests to ensure data accuracy.

Answer

Use DynamoDB Accelerator (DAX) to cache reads and achieve strong consistency.

Answer

Use DynamoDB global tables with strongly consistent reads enabled.

Question 13

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 14

A company wants to migrate its on-premises Oracle database to Amazon RDS for MySQL with minimal downtime. Which AWS service should be used for the initial data load and ongoing replication?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports both initial data load and ongoing replication from on-premises Oracle to Amazon RDS for MySQL with minimal downtime. Option A (AWS SCT) is used for schema conversion, not data migration. Option B (Amazon S3) is a storage service, not a migration service. Option C (AWS Direct Connect) provides network connectivity but does not perform data migration.

Answer

AWS Schema Conversion Tool (SCT)

Answer

Amazon S3

Answer

AWS Direct Connect

Question 15

A solutions architect is designing a disaster recovery plan for a critical application. The application runs on EC2 instances behind an Application Load Balancer (ALB) in us-east-1. The recovery time objective (RTO) is 15 minutes, and the recovery point objective (RPO) is 1 hour. Which approach meets these requirements?

Accepted Answer

Use a warm standby: maintain a scaled-down copy of the environment in us-west-2 that can be scaled up within 15 minutes.. A warm standby strategy meets the RTO of 15 minutes and RPO of 1 hour by maintaining a scaled-down copy of the environment in us-west-2 that can be rapidly scaled up to full production capacity. This approach ensures data replication (e.g., using Amazon RDS cross-Region replication or EBS snapshots) meets the 1-hour RPO, while the pre-provisioned but smaller infrastructure allows scaling within the 15-minute RTO, unlike a pilot light which requires more time to provision resources.

Answer

Use backup and restore: take hourly snapshots of EBS volumes and copy to us-west-2, then restore EC2 instances from snapshots.

Answer

Implement a pilot light strategy: replicate data to us-west-2 and keep a minimal stack running.

Answer

Deploy a multi-site active-active configuration with full capacity in both regions.

Question 16

A multinational corporation is migrating its on-premises Active Directory to AWS. The company requires a solution that supports multi-region authentication for thousands of users and integrates with existing on-premises Active Directory for seamless SSO. The solution must be highly available and provide low-latency authentication. Which TWO AWS services should be combined to meet these requirements? (Choose two.)

Accepted Answer

AD Connector. AD Connector (Option C) is correct because it acts as a proxy to redirect authentication requests from AWS services to your on-premises Active Directory without caching credentials or requiring directory synchronization, enabling seamless SSO for users. AWS Managed Microsoft AD (Option E) is correct because it provides a highly available, fully managed Active Directory in the AWS cloud that can be extended to multiple regions via trust relationships, supporting low-latency authentication for thousands of users across regions.

Answer

Amazon Cognito

Answer

AWS Direct Connect

Answer

AWS Single Sign-On (SSO)

Question 17

A company has a multi-account AWS organization. The security team wants to centrally manage and enforce that all S3 buckets are encrypted with a specific KMS key. Which approach should the architect recommend?

Accepted Answer

Use a service control policy (SCP) to deny s3:PutBucketEncryption if the encryption is not the specified KMS key. A service control policy (SCP) can deny the s3:PutBucketEncryption action unless the encryption setting specifies the required KMS key. This centrally enforces the encryption requirement across all accounts in the AWS Organization, preventing any account from creating or modifying a bucket with non-compliant encryption, regardless of IAM permissions within that account.

Answer

Use AWS Trusted Advisor to check bucket encryption

Answer

Create an IAM policy that denies s3:PutObject unless the request includes the specific KMS key, and attach it to all users

Answer

Use AWS Config rules to detect non-compliant buckets and send alerts

Question 18

A company has multiple AWS accounts for different departments. The finance team wants to centrally manage and optimize EC2 Reserved Instance purchases across all accounts. Which solution should the company implement?

Accepted Answer

Use AWS Organizations with consolidated billing and purchase Reserved Instances in the management account to share with all accounts.. AWS Organizations with consolidated billing allows Reserved Instance (RI) discounts to be applied across all accounts in the organization. By purchasing RIs in the management account, the finance team can centrally manage and optimize RI purchases, and the hourly cost and usage benefits are shared across all accounts, maximizing utilization and cost savings.

Answer

Use AWS Budgets to monitor usage and then purchase Reserved Instances per account.

Answer

Purchase Reserved Instances in the EC2 Reserved Instance Marketplace for distribution to accounts.

Answer

Have each account purchase its own Reserved Instances based on its usage.

Question 19

A company needs to share a central Amazon S3 bucket containing common data files with multiple accounts in AWS Organizations. Which approach is most secure and scalable?

Accepted Answer

Use an S3 bucket policy that grants access to the organization using aws:PrincipalOrgID condition key.. Using the `aws:PrincipalOrgID` condition key in an S3 bucket policy allows you to grant access to all principals (users, roles) within your AWS Organization without needing to list individual account IDs. This approach is both secure (no public access) and scalable (automatically includes new accounts added to the organization).

Answer

Make the bucket public with read-only access.

Answer

Generate presigned URLs for each account to access the bucket.

Answer

Create IAM roles in each account with permissions to assume a role in the central account.

Question 20

A company plans to migrate on-premises workloads to AWS. They have 500 VMs and need to ensure consistent network segmentation and security group rules across multiple VPCs in different AWS accounts. The network team uses a centralized hub-and-spoke model with AWS Transit Gateway. Which approach minimizes operational overhead while maintaining security compliance?

Accepted Answer

Use AWS Firewall Manager to centrally define and apply security group policies across accounts.. AWS Firewall Manager is the correct choice because it provides a centralized, policy-based approach to define and apply security group rules across multiple accounts and VPCs in an AWS Organization. It integrates with AWS Transit Gateway to enforce consistent network segmentation in a hub-and-spoke model, minimizing operational overhead by automating rule enforcement and compliance without custom scripting or manual periodic checks.

Answer

Use AWS Config rules to detect non-compliant security groups and send alerts.

Answer

Create a Python script that uses AWS SDK to apply security group rules to each VPC and run it periodically.

Answer

Use network ACLs instead of security groups to enforce segmentation.