SAP-C02 Mock Exam 84 — 25 Questions

Question 1

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

Accepted Answer

The policy does not allow the dms:CreateEndpoint action. DMS needs permission to describe endpoints and test connections, which are not in the policy. The policy allows creating and starting tasks but not the prerequisite actions like creating endpoints. S3 access is correct if using S3 as a source/target, but the core issue is missing endpoint permissions.

Answer

The policy does not allow the s3:ListBucket action for the S3 bucket

Answer

The policy does not allow the dms:TestConnection action

Answer

The policy does not allow the rds:ModifyDBInstance action

Question 2

A company is migrating a mission-critical application to AWS. The application requires a fixed IP address for whitelisting by external partners. The company plans to use an Application Load Balancer (ALB) to distribute traffic. However, ALB does not support static IP addresses. How can the company meet the requirement for static IP addresses while using the ALB?

Accepted Answer

Use AWS Global Accelerator with the ALB as an endpoint. Option C is correct: Using AWS Global Accelerator provides static anycast IP addresses and directs traffic to the ALB. Option A (NLB) would require a separate NLB, adding complexity. Option B (Elastic IP on ALB) is not possible. Option D (Route 53) does not provide static IP addresses for whitelisting.

Answer

Replace the ALB with a Network Load Balancer (NLB) that has Elastic IP addresses

Answer

Use Amazon Route 53 with a failover routing policy

Answer

Assign Elastic IP addresses to the ALB

Question 3

A company is migrating a legacy application to AWS using the 7 Rs migration strategy. The application is a monolithic Java application running on a single on-premises server with a MySQL database. The company wants to reduce operational overhead and improve scalability. The development team has already containerized the application and tested it locally. The company wants to run the containerized application on AWS without managing the underlying infrastructure. Which AWS service should the company use to deploy the containerized application?

Accepted Answer

Amazon ECS with AWS Fargate launch type. Option C is correct: AWS Fargate is a serverless compute engine for containers, eliminating infrastructure management. Option A (EC2) requires managing instances. Option B (EKS) requires managing the control plane. Option D (Lightsail) is not container-native.

Answer

Amazon EKS with managed node groups

Answer

Amazon EC2 with Docker installed

Answer

Amazon Lightsail containers

Question 4

A company is modernizing a monolithic application into microservices on AWS. The application currently uses a single SQL database. Which THREE AWS services can help decouple the data layer and enable event-driven communication between microservices?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SQS provides message queuing for async communication. Amazon SNS enables pub/sub messaging. Amazon EventBridge provides event bus for decoupled communication. Amazon RDS is a relational database, not for decoupling. Amazon ElastiCache is caching.

Answer

Amazon RDS

Answer

Amazon ElastiCache

Question 5

A migration engineer is using AWS Application Migration Service (MGN) to migrate a Windows server from on-premises. The engineer runs the command above and sees the source server is in the "READY_FOR_TEST" state. What should the engineer do next?

Accepted Answer

Launch a test instance to validate the migration. The READY_FOR_TEST state indicates the initial replication is complete and a test instance can be launched. The next step is to launch a test instance to validate the migration. Cutting over immediately without testing is risky. Resuming data replication is for troubleshooting. Checking the recommended instance type is optional but not the next required step.

Answer

Perform the cutover to the AWS environment

Answer

Modify the source server's recommended instance type to a smaller size

Answer

Resume data replication from the source server

Question 6

A company is migrating a web application to AWS. The application uses a three-tier architecture with a web server, application server, and MySQL database. The company wants to ensure high availability by deploying across multiple Availability Zones. The web and application servers are stateless. Which solution provides the HIGHEST availability with the LEAST administrative effort?

Accepted Answer

Deploy web and application servers on EC2 instances in an Auto Scaling group across two AZs with an Application Load Balancer. Use Multi-AZ Amazon RDS for MySQL.. Option B is correct: Multi-AZ RDS provides automatic failover, and ALB distributes traffic to web/app servers across AZs. Option A (EC2 + Elastic IPs) requires manual failover. Option C (single AZ) is not highly available. Option D (Route 53 latency) adds complexity and latency.

Answer

Deploy web and application servers on EC2 instances in an Auto Scaling group in one AZ. Use Amazon Route 53 latency-based routing to another region.

Answer

Deploy web, application, and database on a single large EC2 instance in one AZ. Take snapshots every hour.

Answer

Deploy web and application servers on EC2 instances in two AZs with Elastic IP addresses. Use Amazon Route 53 with health checks to route traffic.

Question 7

A company is migrating a large number of on-premises virtual machines (VMs) to AWS using AWS Application Migration Service (AWS MGN). During the initial replication, some VMs fail with the error 'Replication agent cannot communicate with the AWS MGN endpoint'. Which TWO actions should the company take to resolve this issue? (Choose TWO.)

Accepted Answer

Configure AWS PrivateLink VPC endpoints for AWS MGN in the target VPC. Options A and D are correct. AWS MGN requires outbound internet access or VPC endpoints to communicate with the service endpoint. Option B (enable inbound rules) is for incoming traffic, not needed. Option C (change instance type) is unrelated. Option E (reinstall agent) is not the first troubleshooting step.

Answer

Reinstall the AWS Replication Agent on the source servers

Answer

Ensure that the security group of the replication servers allows inbound traffic from the source servers

Answer

Increase the instance type of the source servers to provide more CPU and memory

Question 8

A company is migrating a legacy on-premises .NET application to AWS. The application uses a SQL Server database and requires full control over the operating system for compliance. Which migration strategy should the solutions architect recommend to minimize rework while meeting compliance requirements?

Accepted Answer

Rehost the application on EC2 instances and use RDS Custom for SQL Server.. Rehosting (lift-and-shift) with EC2 and RDS Custom for SQL Server allows the company to move the application and database with minimal changes while retaining OS-level control for compliance. Option A is wrong because RDS does not provide OS access. Option B is wrong because ECS requires containerization which adds rework. Option D is wrong because DynamoDB is NoSQL and would require significant application changes.

Answer

Replace the database with Amazon DynamoDB and refactor the application.

Answer

Replatform the application to use RDS for SQL Server and deploy the application on EC2 instances.

Answer

Refactor the application to run on Amazon ECS using Docker containers.

Question 9

A company is migrating its application stack from on-premises to AWS using a rehost strategy. The stack includes a web server, an application server, and a MySQL database. The company wants to automate the migration using AWS Application Migration Service (MGN). After configuring MGN, the web server test instance fails to start because the boot volume is missing the boot sector. What is the most likely cause?

Accepted Answer

The source volume was not shut down cleanly before replication.. Option C is correct because MGN requires consistent volumes. Option A is wrong because instance type does not affect boot sector. Option B is wrong because volume size is not an issue. Option D is wrong because source OS is supported.

Answer

The EBS volume size is smaller than the source volume.

Answer

The source web server uses an unsupported instance type.

Answer

The source OS is not supported by MGN.

Question 10

A company is migrating a critical application to AWS and needs to ensure high availability across AWS Regions. The application uses a relational database. Which THREE components are necessary for this multi-region architecture?

Accepted Answer

Application Load Balancer in each region. For multi-region HA, an RDS cross-region read replica provides DR, Route 53 with failover routing directs traffic, and a global secondary index in DynamoDB is not relevant but actually for NoSQL. However, correct options: cross-region read replica, Route 53 failover, and an Application Load Balancer for regional distribution. Option D is wrong because VPC peering is within region. Option E is wrong because DynamoDB global tables are for NoSQL.

Answer

Amazon RDS Multi-AZ deployment

Answer

VPC peering between regions

Question 11

A company is migrating its on-premises data warehouse to Amazon Redshift. The existing system uses PostgreSQL and has 10 TB of data. The migration must be completed within a 4-hour downtime window. The company has a 1 Gbps AWS Direct Connect connection. After starting the migration using AWS DMS with a full load and CDC, the full load takes 6 hours. What should the company do to meet the downtime window?

Accepted Answer

Configure multiple DMS tasks to load different tables in parallel.. Option C is correct because parallel loading increases throughput. Option A is wrong because reducing data is not feasible. Option B is wrong because VPN is slower. Option D is wrong because Snowball adds latency and manual steps.

Answer

Use AWS Snowball Edge to transfer the data physically.

Answer

Reduce the amount of data by archiving older records.

Answer

Use AWS VPN instead of Direct Connect for higher bandwidth.

Question 12

Which TWO AWS services can be used to migrate on-premises applications to AWS without modifying the application code?

Accepted Answer

AWS VM Import/Export. AWS VM Import/Export allows importing VM images as EC2 instances, preserving the OS and applications. AWS MGN automates lift-and-shift replication. AWS DMS requires some changes for database migration. AWS DataSync is for data transfer. AWS App2Container requires containerization.

Answer

AWS DataSync

Answer

AWS Database Migration Service (DMS)

Answer

AWS App2Container

Question 13

A large enterprise uses AWS Organizations with 200 accounts. The central security team has implemented a service control policy (SCP) that denies all actions unless the request comes from a specific set of allowed AWS services. The SCP is attached to the root OU. Recently, the DevOps team reported that they cannot launch Amazon EC2 instances in any account, even though they have full administrator access via IAM roles. The security team verifies that the SCP is correctly configured and that allowed services include EC2. However, the error message states 'Action 'ec2:RunInstances' is not authorized.' The DevOps team is using the AWS Management Console. What is the MOST LIKELY cause?

Accepted Answer

The SCP denies all actions except those from allowed services, but the console makes calls that are not from an allowed service.. Option D is correct because SCPs that deny all actions unless the request comes from allowed services would block the initial API call to EC2 because the console makes calls to multiple services. Option A is wrong because the SCP already allows EC2. Option B is wrong because the SCP is attached to the root OU, so it applies to all accounts. Option C is wrong because the issue is not about resource-based policies.

Answer

The SCP does not include 'ec2:RunInstances' in the list of allowed actions.

Answer

The SCP is attached only to the root OU and not to the specific account OUs.

Answer

The IAM roles used by the DevOps team do not have a trust policy that allows the EC2 service.

Question 14

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

Accepted Answer

Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.. Option C is correct because AWS CloudFormation StackSets with drift detection and automatic remediation can detect and correct any changes to the VPC stack across all accounts. SCPs can then deny changes to the VPC resources outside of StackSets, preventing unauthorized modifications. Option A is reactive and does not prevent drift. Option B requires custom development and is less integrated. Option D is not integrated with StackSets and requires manual steps.

Answer

Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.

Answer

Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.

Answer

Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.

Question 15

A startup is launching a new multi-account AWS environment using AWS Organizations. They want to ensure that only the central security team has access to the root user of each member account. Additionally, they want to enable multi-factor authentication (MFA) for the root user of each account. The security team has access to the management account. What is the MOST secure and efficient way to meet these requirements?

Accepted Answer

Use the management account to assume an IAM role in each member account that has permissions to reset the root user password and enable MFA. Then, rotate the root user password and enable MFA.. Option B is correct because AWS Organizations allows you to create an IAM role in each member account that can be assumed from the management account. The root user password can be reset and MFA can be enabled by assuming the role with appropriate permissions. Option A is incorrect because you cannot use AWS Organizations to manage root user credentials directly. Option C is incorrect because AWS Single Sign-On (now IAM Identity Center) does not manage root users. Option D is inefficient and insecure as it requires sharing root credentials.

Answer

Use AWS Organizations to create a new IAM user in each member account with full permissions, and disable the root user.

Answer

Capture the root user email addresses and passwords in a secure password manager and share them with the security team.

Answer

Use AWS Single Sign-On (SSO) to grant the security team access to the root user credentials for each account.

Question 16

A company has a multi-account AWS environment using AWS Organizations with 50 accounts. The accounts are organized into OUs based on environment: Production, Staging, and Development. The central IT team uses AWS CloudFormation StackSets to deploy a baseline network configuration (VPC, subnets, security groups) to all accounts. Recently, the network team updated the stack set to add a new subnet to the VPC. After the update, they noticed that the stack set operation failed for 10 accounts. The error message indicates that the stack set cannot update because a resource already exists. What is the MOST LIKELY cause of this failure?

Accepted Answer

Some accounts have manually created resources that conflict with the stack set template's resources.. Option C is correct because StackSets use a single template, and if an account already has a resource with the same logical ID (e.g., due to a previous manual creation), the update fails. Option A is wrong because stack set updates can be performed with proper permissions. Option B is wrong because StackSets can manage resources across OUs, but the issue is resource conflict. Option D is wrong because drift does not prevent updates; it would be detected separately.

Answer

The accounts are in different OUs and the stack set is not configured to deploy to all OUs.

Answer

The network team does not have sufficient IAM permissions to update stacks in those accounts.

Answer

The stack set was previously drift-detected and the drift is preventing updates.

Question 17

A company has a multi-account AWS environment with 50 accounts. They use AWS Organizations and want to centrally manage EC2 instances across all accounts. The operations team needs to run a script on all EC2 instances that are tagged with Environment=Production. The script must be executed once immediately and requires access to a shared S3 bucket in the management account. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS Systems Manager Run Command with a resource group that selects instances by tag across accounts.. Option D is correct because AWS Systems Manager Run Command can target instances by tags across accounts using resource data sync and cross-account delegation. Option A is wrong because AWS Systems Manager State Manager is for scheduled execution, not one-time immediate. Option B is wrong because AWS Config does not execute scripts. Option C is wrong because AWS Lambda cannot directly run scripts on EC2 instances without additional infrastructure.

Answer

Use AWS Systems Manager State Manager to create an association that runs the script on the targeted instances.

Answer

Use AWS Config to create a custom rule that triggers an AWS Lambda function to run the script on the instances.

Answer

Use AWS Lambda to directly run the script on EC2 instances using the AWS SDK.

Question 18

A startup is deploying a multi-account AWS environment using AWS Organizations. They have a central logging account where all VPC Flow Logs and CloudTrail logs are stored in an S3 bucket. The security team requires that all accounts in the organization, including future accounts, automatically send logs to this central bucket. They also want to prevent any account from disabling logging. Which solution meets these requirements?

Accepted Answer

Create an organization trail in CloudTrail and store logs in the central bucket. Attach an SCP to the root that denies s3:PutBucketPolicy for the central bucket.. AWS Organizations allows you to create service control policies (SCPs) that can deny actions across accounts. Using an SCP to deny the s3:PutBucketPolicy action on the central bucket ensures that no account can change the bucket policy to block log delivery. Additionally, enabling CloudTrail for all regions and all accounts with an organization trail ensures automatic log delivery. Option A is correct.

Answer

Set up VPC Flow Logs at the VPC level and CloudTrail at the account level, then use Lambda to copy logs to the central bucket.

Answer

Use AWS Config rules to detect when logs are not being sent and automatically re-enable logging.

Answer

Create individual trails per account and use S3 cross-region replication to copy logs to the central bucket.

Question 19

A company is centralizing its logging across multiple AWS accounts using a central logging account. Each application account delivers its CloudTrail logs and VPC Flow Logs to an S3 bucket in the logging account. The security team needs to query these logs using Amazon Athena. The logs are currently in separate S3 prefixes per account. The team wants to create a single Athena table that can query logs from all accounts without having to modify the table definition every time a new account is added. The logs are in CSV format for VPC Flow Logs and JSON format for CloudTrail. What is the MOST efficient solution?

Accepted Answer

Use AWS Glue crawlers configured to crawl the S3 bucket with a partition structure based on account ID and log type. Enable partition indexing to improve query performance.. Option D is correct because using AWS Glue crawlers with partition indexes allows automatic discovery of new partitions as new accounts add logs. The crawler can be scheduled to run periodically, updating the table metadata. Option A requires manual partition management. Option B requires converting logs to a common format, which adds overhead. Option C requires manual DDL updates.

Answer

Create a view that unions all the tables for each account, and update the view DDL when a new account is added.

Answer

Create an Athena table with partitions manually for each account and use MSCK REPAIR TABLE to add new partitions.

Answer

Convert all logs to Parquet format using AWS Glue ETL jobs and store them in a single prefix.

Question 20

A company has a multi-account AWS environment. They want to use AWS CloudTrail to log all API calls across all accounts and deliver the logs to a central S3 bucket in the logging account. They have configured a trail in the management account that logs management events for all accounts. However, they notice that the logs from member accounts are not being delivered to the central S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant the CloudTrail service principal from member accounts write access.. Option B is correct because a trail in the management account can log management events for all accounts, but it requires that the trail be created with the option 'Apply trail to all accounts in the organization' and the S3 bucket policy must allow CloudTrail to write from member accounts. Option A is wrong because there is no such limitation. Option C is wrong because CloudTrail supports cross-account delivery. Option D is wrong because the bucket policy is likely the issue.

Answer

CloudTrail cannot log management events for member accounts from the management account.

Answer

The trail is configured to log only read events.

Answer

The member accounts have disabled CloudTrail.

SAP-C02 Mock Exam 84 — 25 Questions

Exhibit

SAP-C02 Mock Exam 84 — 25 Questions

Exhibit