SAP-C02 Mock Exam 87 — 25 Questions

Question 1

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. Option C is correct because it leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 2

Refer to the exhibit. A solutions architect is reviewing an IAM trust policy for a Lambda function's execution role. The function needs to access an S3 bucket in the same account. The trust policy is as shown. What is missing for the Lambda function to successfully assume the role?

Accepted Answer

An IAM policy must be attached to the role granting permissions to the S3 bucket. Option A is correct because the IAM trust policy only allows the Lambda service to assume the role, but it does not grant any permissions to access the S3 bucket. For the Lambda function to successfully read or write objects in the S3 bucket, an IAM permissions policy (e.g., s3:GetObject, s3:PutObject) must be attached to the role. Without this policy, the role has no effective permissions to perform actions on the bucket, even though the trust policy allows the role to be assumed.

Answer

A service control policy must allow Lambda to assume roles

Answer

The S3 bucket must have a resource-based policy allowing the Lambda function

Answer

The trust policy must specify the Lambda function name

Question 3

A company is designing a serverless application using AWS Lambda. The function needs to access a VPC resource. What is the correct way to configure this?

Accepted Answer

Assign the Lambda function to the VPC and configure a security group. Lambda functions must be attached to a VPC and assigned a security group to access resources within the VPC, such as an RDS database or an Elasticache cluster. This configuration creates an elastic network interface (ENI) in the VPC, allowing the function to communicate with VPC resources via private IP addresses. The security group acts as a virtual firewall to control inbound and outbound traffic for the Lambda function.

Answer

Attach an Internet Gateway to the VPC

Answer

Set up a VPC peering connection

Answer

Configure a NAT Gateway in the public subnet

Question 4

A company has a multi-account AWS environment and wants to enforce that all IAM roles in member accounts must include a specific tag (e.g., CostCenter). Which THREE steps should be taken to enforce this policy using AWS Organizations?

Accepted Answer

Attach the SCP to the root organizational unit to apply it to all accounts. Option C is correct because AWS Organizations allows you to attach a service control policy (SCP) to the root organizational unit (OU), which applies the policy to all member accounts in the organization. This ensures that the tag enforcement is centrally managed and cannot be bypassed by individual account administrators, as SCPs set permission boundaries that override IAM policies.

Answer

Create an IAM policy in each account that requires tags on role creation

Answer

Set up AWS Budgets to alert on untagged roles

Question 5

A company has a multi-account AWS environment with centralized logging. The security team wants to ensure that all VPC Flow Logs are published to a central S3 bucket in the logging account. Which combination of steps should be taken to achieve this?

Accepted Answer

Create VPC Flow Logs in each account with a custom S3 bucket ARN in the logging account, and configure the bucket policy to allow log delivery from source accounts. Option B is correct because VPC Flow Logs can be published directly to an S3 bucket in another account by specifying the bucket ARN in the logging account. The bucket policy must grant the `S3:PutObject` permission to the log delivery service principal (`delivery.logs.amazonaws.com`) for the source accounts, enabling cross-account log delivery without intermediate services.

Answer

Use Amazon Kinesis Data Firehose in each account to stream logs to the central S3 bucket

Answer

Create VPC endpoints in each account to connect to the central S3 bucket

Answer

Create VPC Flow Logs in each account and publish to a central CloudWatch Logs group

Question 6

A company uses AWS Organizations with multiple accounts. The security team requires that all S3 buckets across the organization have server-side encryption enabled. Which is the MOST efficient way to enforce this policy?

Accepted Answer

Apply a service control policy (SCP) that denies creation of S3 buckets without encryption. Option C is correct because a service control policy (SCP) can centrally deny the creation of S3 buckets that do not have server-side encryption enabled across all accounts in an AWS Organization. This approach enforces the security team's requirement at the organizational level, preventing non-compliant buckets from being created regardless of individual account configurations, which is the most efficient and scalable method.

Answer

Use AWS CloudTrail to monitor and alert on unencrypted buckets

Answer

Enable S3 default encryption in each account

Answer

Use S3 bucket policies to require encryption

Question 7

A company is designing a new application that will process streaming data from IoT devices. They need to ingest data in real time and apply transformations before storing it in Amazon S3. Which AWS service should they use?

Accepted Answer

Amazon Kinesis Data Analytics. Amazon Kinesis Data Analytics (now part of Amazon Managed Service for Apache Flink) is the correct choice because the question explicitly requires applying transformations to streaming data in real time before storing it in Amazon S3. Kinesis Data Analytics allows you to run SQL or Apache Flink applications directly on streaming data to perform transformations, aggregations, and filtering, and then output the results to a destination like Amazon S3 via Kinesis Data Firehose.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon SQS

Answer

AWS Lambda

Question 8

A company is monitoring a Lambda function named my-function. The function has an alias 'prod' that points to version 1. The above CLI output shows two metrics for the Errors metric. What is the likely reason for two metrics?

Accepted Answer

The function has two versions: $LATEST and version 1. The CLI output shows two metrics for the Errors metric because the function has two versions: $LATEST (the unpublished, mutable version) and version 1 (the published, immutable version). The alias 'prod' points to version 1, but CloudWatch metrics are emitted per version, so both $LATEST and version 1 generate separate error metric streams. This is why two distinct data points appear for the same metric name.

Answer

The function is invoked via two different triggers

Answer

The function is configured with two different reserved concurrency settings

Answer

The function is deployed in two different regions

Question 9

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web tier, an application tier, and a database tier. The company wants to decouple the tiers to improve scalability and resilience. Which AWS service should the company use to send messages from the web tier to the application tier asynchronously?

Accepted Answer

Amazon SQS. Amazon SQS is the correct choice because it provides a fully managed message queuing service that enables asynchronous communication between decoupled application tiers. The web tier can send messages to an SQS queue, and the application tier can poll and process those messages independently, which improves scalability and resilience by allowing each tier to scale and fail independently.

Answer

Amazon SNS

Answer

Amazon Kinesis Data Streams

Answer

AWS Step Functions

Question 10

A company is designing a new disaster recovery (DR) strategy for its critical applications. The DR plan must achieve a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 minute. The applications run on Amazon EC2 instances with Amazon EBS volumes. Which THREE actions should the company take to meet these requirements? (Choose three.)

Accepted Answer

Configure Amazon RDS Multi-AZ deployments.. Option A is correct because Amazon RDS Multi-AZ deployments provide synchronous replication to a standby instance in a different Availability Zone, enabling automatic failover with an RTO typically under 1-2 minutes and an RPO of effectively zero, which meets the 15-minute RTO and 1-minute RPO requirements for the database tier.

Answer

Use a single Availability Zone for EC2 instances to simplify failover.

Answer

Store backups in Amazon S3 Glacier.

Question 11

Refer to the exhibit. A CloudFormation template is used to create an IAM role for EC2. The stack creation fails with the error: "Resource creation cancelled". The IAM role is not created. What is the MOST likely reason?

Accepted Answer

The IAM role name already exists in the account. The error 'Resource creation cancelled' typically occurs when CloudFormation attempts to create a resource that already exists in the account and the resource is not configured for updates or replacement. Since the IAM role name is globally unique within an AWS account, if a role with the same name already exists, CloudFormation will fail to create it and cancel the operation, leaving the role uncreated.

Answer

The trust policy does not include the correct service principal for EC2

Answer

The template does not have the required IAM capabilities

Answer

The role does not have an instance profile

Question 12

A company has a multi-account AWS environment with a centralized logging account. The security team needs to collect all Amazon S3 access logs and AWS CloudTrail logs from all accounts into a centralized Amazon S3 bucket in the logging account. Which THREE steps are required to meet this requirement? (Choose THREE.)

Accepted Answer

Enable S3 server access logging on each source bucket to deliver logs to the central S3 bucket.. Option A is correct because S3 server access logging can be configured on each source bucket to deliver detailed access logs directly to a central S3 bucket in the logging account. This is a native S3 feature that writes log objects for every request made to the source bucket, satisfying the requirement to collect S3 access logs.

Answer

Create an Amazon CloudWatch Logs subscription filter to stream logs from each account to the central bucket.

Answer

Enable AWS CloudTrail Insights in each account to capture S3 access logs.

Question 13

Refer to the exhibit. An SCP is attached to an OU. A developer in an account under this OU tries to launch a t3.large EC2 instance. What will happen?

Accepted Answer

The instance launch is denied because the SCP denies any instance type not in the allowed list.. The SCP explicitly denies any EC2 instance launch where the instance type does not match the allowed list using `StringNotEquals`. Since `t3.large` is not in the allowed list (`t2.micro`, `t2.small`, `t2.medium`), the condition evaluates to true, triggering the explicit deny. SCPs act as a guardrail that overrides any IAM permissions, so the launch is denied regardless of the account's IAM policies.

Answer

The instance launch is allowed because the condition uses StringNotEquals, which is not evaluated correctly.

Answer

The instance launch is denied, but only if the account's IAM policy also denies it.

Answer

The instance launch is allowed because the SCP has an explicit deny, but it only applies to certain instance types.

Question 14

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

Accepted Answer

Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity. Option A is correct because cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Answer

Apply a service control policy to allow cross-account access

Answer

Create an IAM user in the production account and share the credentials with the development team

Answer

Configure security group rules to allow access from the development account

Question 15

Refer to the exhibit. A trust policy is attached to an IAM role named AuditRole in account 111111111111. The IAM role Admin in account 222222222222 attempts to assume AuditRole. The session is launched with source identity 'admin'. Will the assumption succeed?

Accepted Answer

No, because the source identity does not match.. The assumption fails because the trust policy on AuditRole includes a `sts:SourceIdentity` condition that requires the source identity to match a specific value (e.g., 'auditor'), but the session is launched with source identity 'admin'. Since the condition is not satisfied, AWS STS denies the AssumeRole API call, even though the principal (the Admin role in account 222222222222) is allowed by the `Principal` element. The `sts:SourceIdentity` condition key is evaluated at request time and must match exactly for the policy to grant access.

Answer

Yes, because the role in account 222222222222 is allowed by the principal.

Answer

No, because cross-account role assumption is not allowed.

Answer

Yes, because the source identity condition is optional.

Question 16

A company manages multiple AWS accounts and wants to centralize billing and cost tracking. They have enabled AWS Organizations and consolidated billing. Which additional step should they take to gain granular visibility into costs per department?

Accepted Answer

Implement cost allocation tags for resources and use AWS Cost Explorer to filter by tags. Option C is correct because cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Engineering'). Once enabled and activated in the Billing and Cost Management console, AWS Cost Explorer can filter and group costs by these tags, providing granular visibility into per-department spending across multiple accounts in an AWS Organization. This approach directly addresses the need for department-level cost tracking beyond the account-level view provided by consolidated billing.

Answer

Enable AWS Cost Explorer and use default groupings

Answer

Create AWS Budgets for each department

Answer

Use the consolidated billing feature to view costs per account

Question 17

A company has a multi-account AWS environment and wants to implement a secure, scalable cross-account network architecture using AWS Transit Gateway. Which TWO steps should be taken?

Accepted Answer

Create a Transit Gateway in a central networking account and share it with other accounts using AWS Resource Access Manager. Option B is correct because AWS Transit Gateway must be created in a central networking account and then shared with other accounts using AWS Resource Access Manager (RAM) to enable cross-account connectivity without VPC peering. This centralizes routing and simplifies network management across multiple VPCs and accounts.

Answer

Deploy VPC endpoints in each account for communication

Answer

Establish VPC peering connections between each account and the central networking account

Answer

Set up AWS Direct Connect between all accounts

Question 18

The above CLI output shows the state of a CloudWatch alarm. The EC2 instance's CPU utilization averaged 85% for the last 10 minutes. What is the alarm state?

Accepted Answer

ALARM. The CLI output indicates that the alarm state is 'ALARM' because the EC2 instance's CPU utilization averaged 85% for the last 10 minutes, which exceeds the alarm threshold (typically set at, for example, 80% for a standard CPU utilization alarm). CloudWatch alarms transition to ALARM when the metric breaches the threshold for the specified evaluation periods, and here the sustained high utilization over the 10-minute window meets that condition.

Answer

OK

Answer

INSUFFICIENT_DATA

Answer

ERROR

Question 19

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Redshift

Answer

Amazon RDS for PostgreSQL

Question 20

Refer to the exhibit. A company applies this SCP to all accounts in an AWS Organization. What is the effect of this policy?

Accepted Answer

Denies launching instances that are not t3.micro or t3.small for IAM users and roles, but not root.. The SCP uses a Deny effect with a condition that denies any EC2:RunInstances action unless the instance type is t3.micro or t3.small. However, SCPs do not affect the root user (the management account's root user) because SCPs cannot restrict the root user in the management account. Therefore, the policy denies launching non-compliant instance types for IAM users and roles, but not for the root user.

Answer

Allows only t3.micro and t3.small instances to be launched.

Answer

Has no effect because SCPs cannot deny actions.

Answer

Denies launching any instance except t3.micro and t3.small for all users including root.