SAP-C02 Mock Exam 91 — 25 Questions

Question 1

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Accepted Answer

Encrypt traffic between VPCs using VPN or AWS PrivateLink.. PCI DSS Requirement 4.1 mandates that cardholder data transmitted across open, public networks must be encrypted. Using VPN (IPsec) or AWS PrivateLink ensures that traffic between VPCs is encrypted in transit, meeting this compliance requirement. This approach also avoids exposing data to the public internet.

Answer

Use VPC endpoints to keep traffic within the AWS network.

Answer

Use a single Availability Zone to reduce complexity.

Question 2

A company runs a critical workload on EC2 instances in an Auto Scaling group. The application is stateless and can handle instance failures. The architect needs to ensure that the application remains available during a regional outage. What is the MOST cost-effective and resilient architecture?

Accepted Answer

Use an active-passive configuration with Auto Scaling groups in two Regions and Route 53 failover. It provides multi-Region resilience using an active-passive architecture, which is the most cost-effective approach for a stateless application that must survive a regional outage. The active-passive setup uses Route 53 failover routing to direct traffic to the primary Region under normal conditions and automatically fail over to the secondary Region only when the primary is unhealthy, minimizing ongoing costs by keeping the secondary infrastructure idle or minimal until needed.

Answer

Deploy the Auto Scaling group in a single Region with instances spread across two AZs

Answer

Deploy the Auto Scaling group in three Availability Zones within a single Region

Answer

Use an active-active configuration across two Regions with Route 53 weighted routing

Question 3

A company has a multi-account AWS environment. The security team needs to centrally manage and audit IAM roles that allow cross-account access. Which solution meets these requirements?

Accepted Answer

Enable AWS IAM Access Analyzer in the management account and delegate admin to the security account.. AWS IAM Access Analyzer helps identify resources shared with external principals, including cross-account IAM roles. By enabling it in the management account and delegating administration to the security account, the security team gains a centralized view of all cross-account access findings across the organization without needing to enable it in each account individually. This meets the requirement for central management and auditing of cross-account IAM roles.

Answer

Use AWS Organizations service control policies to deny cross-account access.

Answer

Use AWS Trusted Advisor to check for unused cross-account roles.

Answer

Enable AWS CloudTrail across all accounts and use Athena to query for AssumeRole events.

Question 4

A company is running a stateful web application on EC2 instances in an Auto Scaling group behind an ALB. The application stores session data locally on the instance. The company notices that users are frequently logged out and lose session data during scaling events. What is the MOST operationally efficient way to preserve session state?

Accepted Answer

Migrate session data to ElastiCache for Redis and modify the application to use it.. Migrating session state to ElastiCache for Redis provides a centralized, external, and highly available session store that persists independently of EC2 instance lifecycles. This ensures that when instances are terminated or added during Auto Scaling events, session data remains intact and accessible from any instance, eliminating user logouts and data loss. It is operationally efficient as it requires minimal application code changes and leverages a fully managed, in-memory data store optimized for low-latency access.

Answer

Create a custom AMI that pre-populates session data from Amazon S3.

Answer

Increase the Auto Scaling group's cooldown period to 600 seconds.

Answer

Enable sticky sessions (session affinity) on the ALB.

Question 5

Match each AWS migration service to its function.

Accepted Answer

AWS Migration Hub: Centralized tracking of migration progress. AWS Migration Hub centralizes tracking, SMS automates server replication, DMS handles database migration, and Application Discovery Service discovers on-premises assets.

Answer

AWS Migration Hub: Migrates databases to AWS with minimal downtime

Answer

AWS Server Migration Service: Discovers on-premises applications and dependencies

Question 6

A company uses AWS Organizations with a multi-account strategy. The central IT team needs to enforce that all Amazon S3 buckets across the organization are encrypted with AWS KMS using a specific customer managed key. The security policy must be applied without modifying individual bucket policies. Which approach meets these requirements?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key.. A service control policy (SCP) can centrally enforce encryption requirements across all accounts in an AWS Organization without modifying individual bucket policies. The SCP denies s3:PutBucketPolicy and s3:PutObject actions unless the request includes the specified KMS key, ensuring compliance at the organization level.

Answer

Use the S3 default encryption feature to automatically encrypt new objects with the specified KMS key.

Answer

Use AWS Config rules to detect unencrypted buckets and trigger a Lambda function to remediate.

Answer

Create an S3 bucket policy in each account that denies PutObject if the object is not encrypted with the specified KMS key.

Question 7

Drag and drop the steps to recover an Amazon RDS Multi-AZ DB instance after a primary instance failure in the correct order.

Accepted Answer

1) Detect failure, 2) Wait for automatic failover to complete, 3) Verify that the standby instance is promoted to primary, 4) Update application endpoints to point to the new primary, 5) Investigate the root cause of the failure.. First identify failure, wait for failover, verify promotion, update endpoints, then investigate.

Answer

1) Detect failure, 2) Immediately update application endpoints, 3) Verify promotion, 4) Wait for failover to complete, 5) Investigate the cause.

Answer

1) Investigate the root cause of the failure, 2) Detect failure, 3) Wait for automatic failover, 4) Verify promotion, 5) Update endpoints.

Answer

1) Detect failure, 2) Verify promotion, 3) Update endpoints, 4) Wait for failover, 5) Investigate.

Question 8

Refer to the exhibit. An administrator runs this command and sees the output. Which statement about the accounts is correct?

Accepted Answer

The Suspended account cannot be used until it is reactivated.. The command output shows the account status as 'SUSPENDED'. In AWS Organizations, a suspended account cannot be used for any AWS operations until it is reactivated by the management account. This is a hard state enforced by the service, regardless of how the account was added to the organization.

Answer

The Suspended account was invited to the organization.

Answer

The Production account is the management account.

Answer

The Management account was created directly.

Question 9

Refer to the exhibit. A solutions architect has attached this IAM policy to an IAM role used by an application. The application is trying to upload an object to the S3 bucket example-bucket with server-side encryption using AWS KMS (SSE-KMS). What will happen?

Accepted Answer

The upload fails because the policy requires SSE-S3.. The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` header to be set to `AES256` (SSE-S3) via the `StringEquals` condition. Since the application is attempting to use SSE-KMS, the encryption header will be `aws:kms`, which does not match the required value. Therefore, the condition fails, and the `s3:PutObject` action is denied, causing the upload to fail.

Answer

The upload succeeds because the policy allows s3:PutObject for the bucket.

Answer

The upload fails because the bucket policy does not allow SSE-KMS.

Answer

The upload succeeds because the condition only applies to encryption at rest.

Question 10

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.. The 'Enable for all accounts in my organization' option in CloudTrail automatically creates a trail that applies to all accounts in the AWS Organization, delivering logs from every account to the specified S3 bucket in the management account without requiring per-account configuration. Option E is correct because the S3 bucket policy must explicitly grant the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects from any AWS account in the organization, ensuring cross-account delivery succeeds.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.

Question 11

A company wants to implement a cost allocation strategy using tags across multiple accounts in AWS Organizations. Which TWO practices should be followed?

Accepted Answer

Define a standardized set of tags (e.g., CostCenter, Owner, Project) and enforce them using AWS Config rules.. Defining a standardized set of tags and enforcing them with AWS Config rules ensures consistent cost allocation tagging across all accounts in AWS Organizations. AWS Config rules can evaluate resources for tag compliance and trigger remediation actions, such as automatically tagging resources or sending notifications, which is essential for accurate cost tracking. This approach aligns with the AWS Well-Architected Framework's cost optimization pillar by enabling granular cost allocation and chargeback.

Answer

Enable AWS-generated tags automatically for all resources.

Answer

Use service control policies (SCPs) to require tags on all resources.

Answer

Apply tags only at the resource creation time; they cannot be added later.

Question 12

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application must maintain session state. The company expects steady traffic with occasional spikes. Which solution is MOST scalable and cost-effective?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Amazon ElastiCache for Redis provides a highly scalable, low-latency, and durable external session store that decouples session state from EC2 instances. This allows the Auto Scaling group to add or remove instances freely without losing session data, and Redis supports replication and persistence for reliability. Compared to DynamoDB, Redis offers lower latency for session access, and compared to Memcached, it provides data structures and persistence that are beneficial for session management.

Answer

Use sticky sessions (session affinity) on the ALB with a session cookie.

Answer

Use Amazon ElastiCache for Memcached to store session data.

Answer

Store session data in Amazon DynamoDB tables.

Question 13

A company uses AWS Organizations with a dedicated security account. They want to centralize the management of AWS Config rules and ensure that all accounts are compliant with the same set of rules. Which THREE steps should they take?

Accepted Answer

Create an AWS Config aggregator in the security account to view compliance status across accounts.. An AWS Config aggregator in the security account collects compliance data from all member accounts, providing a centralized view of rule compliance across the organization. This enables the security team to monitor and audit compliance without logging into each account individually.

Answer

Apply a service control policy (SCP) that requires AWS Config to be enabled.

Answer

Use AWS CloudTrail to monitor compliance status.

Question 14

A company manages multiple AWS accounts using AWS Organizations. They want to enforce that any EC2 instance launched with a public IP address must have a specific security group attached. What is the MOST effective way to enforce this?

Accepted Answer

Apply a service control policy (SCP) that denies ec2:RunInstances when the instance has a public IP and does not include the required security group.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By crafting an SCP with a condition that denies ec2:RunInstances when the instance has a public IP (using ec2:AssociatePublicIpAddress) and does not include the required security group (using ec2:SecurityGroup), you can proactively prevent non-compliant instances from being launched at the API level, rather than detecting and remediating after the fact.

Answer

Create an IAM policy that requires the security group when launching instances with a public IP.

Answer

Use AWS Config rules to detect non-compliant instances and automatically terminate them.

Answer

Use AWS CloudFormation StackSets to deploy a template that only allows instances with the required security group.

Question 15

A company uses AWS Organizations with a single OU for all production accounts. The central security team wants to prevent any user from disabling Amazon GuardDuty in any production account. What is the MOST effective way to enforce this?

Accepted Answer

Apply an SCP to the production OU that denies guardduty:Disable* and guardduty:Delete* actions.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in an OU. By attaching an SCP that explicitly denies `guardduty:Disable*` and `guardduty:Delete*` actions to the production OU, the security team ensures that no principal (including the root user) in any production account can disable or delete GuardDuty, regardless of IAM policies or direct account-level actions.

Answer

Use AWS Lambda to re-enable GuardDuty if it is disabled.

Answer

Create an AWS Config rule to detect disabled GuardDuty and send alerts.

Answer

Attach an IAM policy to each user that denies guardduty:Disable* actions.

Question 16

A company with multiple AWS accounts wants to centrally manage network security policies. The security team needs to inspect all traffic between VPCs in different accounts and block malicious traffic. Which solution is MOST operationally efficient?

Accepted Answer

AWS Network Firewall with AWS Firewall Manager and AWS Resource Access Manager to deploy across accounts.. AWS Network Firewall, combined with AWS Firewall Manager and AWS Resource Access Manager, provides a centralized, policy-based approach to deploy and manage network security rules across multiple accounts and VPCs. Firewall Manager allows you to define common security policies (e.g., domain filtering, intrusion prevention) and automatically apply them to new and existing VPCs, while RAM enables sharing the firewall subnet across accounts. This eliminates the need for manual per-account configuration, making it the most operationally efficient solution for centrally inspecting and blocking malicious traffic between VPCs in different accounts.

Answer

AWS PrivateLink to route traffic through a centralized security appliance in a single account.

Answer

VPC Peering connections between all VPCs and use security groups to control traffic.

Answer

AWS Transit Gateway with a centralized inspection VPC using a Gateway Load Balancer.

Question 17

A company has multiple VPCs across different AWS accounts and wants to establish private connectivity between them. They also need to centrally manage network traffic for security inspection. Which architecture should they use?

Accepted Answer

Deploy an AWS Transit Gateway with a central inspection VPC that hosts security appliances, and configure route tables to route traffic through the inspection VPC. AWS Transit Gateway acts as a central hub to interconnect multiple VPCs across accounts, and by deploying a dedicated inspection VPC with security appliances (e.g., firewalls, IDS/IPS), you can centrally route all inter-VPC traffic through those appliances for security inspection. This is achieved by configuring Transit Gateway route tables to propagate routes from the inspection VPC and using static routes to force traffic through the inspection VPC's attachments, enabling granular traffic steering without complex peering meshes.

Answer

Create VPC peering connections between all VPCs and use security groups for inspection

Answer

Configure a VPN between each VPC and a central virtual appliance

Answer

Use AWS Direct Connect to connect all VPCs to a common router

Question 18

A company is designing a multi-account AWS Organizations architecture. Which TWO considerations should be taken into account when designing the organizational structure?

Accepted Answer

AWS CloudTrail can be configured to log management events across all accounts from the management account.. AWS CloudTrail can be configured from the management account to log management events for all accounts in the organization. This is done by creating a CloudTrail trail that applies to all accounts in the organization, which centralizes logging and eliminates the need to configure CloudTrail individually in each account.

Answer

Accounts cannot be moved between OUs once created.

Answer

Each organizational unit (OU) should contain only one account for security isolation.

Answer

SCPs can only be applied to root accounts, not OUs.

Question 19

A company uses a central IT team to manage multiple AWS accounts. The team wants to provide developers with the ability to launch EC2 instances but restrict them to using only specific instance types. How should this be enforced?

Accepted Answer

Create an IAM policy that denies ec2:RunInstances unless the instance type matches an allowed list, and attach it to the developers' IAM group.. An IAM policy with a condition key like ec2:InstanceType can deny or allow ec2:RunInstances based on specific instance types. This policy is attached to the developers' IAM group, ensuring that only permitted instance types can be launched, while still allowing other EC2 actions. This approach directly controls the API call at the IAM level, which is the most precise and scalable method for restricting resource creation across multiple accounts managed by a central IT team.

Answer

Create a service control policy in AWS Organizations that restricts instance types for all accounts.

Answer

Use AWS Config to automatically terminate instances that are not of allowed types.

Answer

Configure an S3 bucket policy that only allows specific instance types to be used.

Question 20

A company has a centralized logging account that receives VPC flow logs from all accounts. The logs are stored in an S3 bucket. The security team needs to analyze these logs to detect anomalous traffic patterns. Which solution provides the most cost-effective and scalable analysis?

Accepted Answer

Use Amazon Athena to run SQL queries directly on the S3 bucket containing the flow logs.. Amazon Athena is the most cost-effective and scalable solution because it allows querying VPC flow logs directly in S3 using standard SQL without requiring data loading or infrastructure management. Athena's serverless, pay-per-query model eliminates idle costs and scales automatically to handle any volume of log data, making it ideal for ad-hoc security analysis of historical logs.

Answer

Use Amazon QuickSight to create dashboards from the flow logs.

Answer

Set up Amazon Kinesis Data Analytics to process the flow logs in real time.

Answer

Load the flow logs into Amazon Redshift and run SQL queries.