SAP-C02 Mock Exam 92 — 25 Questions

Question 1

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 2

A company is designing a new system that will use Amazon S3 to store sensitive data. Which THREE methods can be used to encrypt data at rest in S3?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows you to encrypt data at rest in S3 using your own encryption keys, which you manage outside of AWS. You provide the encryption key as part of your PUT request, and S3 uses it to encrypt the object before writing it to disk, then discards the key from memory. This method gives you full control over the key lifecycle while still leveraging S3's server-side encryption infrastructure.

Answer

Client-side encryption

Answer

AWS IAM

Question 3

A company is designing a disaster recovery solution that must recover an application in a different AWS Region within 15 minutes of a failure. The application uses an Amazon Aurora MySQL DB cluster. Which combination of strategies will meet the recovery time objective (RTO) while minimizing costs?

Accepted Answer

Configure an Aurora cross-Region replica in the DR Region. Use Amazon Route 53 to fail over DNS.. Option C is correct because an Aurora cross-Region replica asynchronously replicates data to a DR Region with minimal performance impact, and you can promote it to a standalone cluster within minutes. Combined with Amazon Route 53 DNS failover, this achieves an RTO under 15 minutes while keeping costs low, as you only pay for the replica storage and minimal compute until failover.

Answer

Deploy a standby Aurora cluster in the DR Region and use synchronous replication.

Answer

Use Aurora Global Database with a secondary cluster in the DR Region.

Answer

Take daily snapshots and restore them in the DR Region using cross-Region snapshot copy.

Question 4

A company is deploying a containerized microservices architecture on Amazon ECS with Fargate. They need to securely store and rotate database credentials. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, automatically rotating, and managing the lifecycle of database credentials. It integrates natively with Amazon ECS and Fargate via task role permissions, allowing containers to retrieve secrets at runtime without hardcoding them. Secrets Manager also supports automatic rotation of credentials for Amazon RDS, Aurora, and other databases, which directly addresses the requirement for credential rotation.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM) roles

Answer

AWS Systems Manager Parameter Store

Question 5

A startup is building a serverless application using AWS Lambda. They need to store session state that can be shared across multiple Lambda invocations. Which AWS service should they use?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a low-latency, in-memory data store that can be shared across multiple Lambda invocations. Redis supports data structures like strings, hashes, and lists, making it ideal for storing session state that needs to be accessed and updated quickly by concurrent serverless functions.

Answer

Amazon S3

Answer

Amazon DynamoDB

Answer

Amazon CloudFront

Question 6

A company is designing a multi-region disaster recovery solution for a critical application. The application uses Amazon RDS for MySQL with Multi-AZ in the primary region. The recovery point objective (RPO) is 5 seconds, and the recovery time objective (RTO) is 1 minute. Which solution meets these requirements?

Accepted Answer

Use Amazon Aurora Global Database with a primary instance in the primary region and one secondary in the secondary region.. Amazon Aurora Global Database is the only solution that can achieve an RPO of 5 seconds and an RTO of 1 minute for a multi-region disaster recovery setup. It uses storage-based replication with typical latency under 1 second, and failover to a secondary region can be completed in about 1 minute by promoting the secondary cluster. Aurora Global Database also avoids the replication lag and promotion delays inherent in cross-region read replicas or DMS-based replication.

Answer

Create an RDS MySQL cross-region read replica in the secondary region and promote it during a disaster.

Answer

Take manual snapshots of the RDS instance every 5 seconds and copy them to the secondary region.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate to a database in the secondary region.

Question 7

An administrator runs the above commands on an S3 bucket. What is the effect of these configurations on an object uploaded to the bucket?

Accepted Answer

Objects cannot be deleted or overwritten for 365 days unless special permissions are granted.. The configuration shown enables S3 Object Lock in compliance mode with a retention period of 365 days. In compliance mode, an object cannot be deleted or overwritten by any user, including the root user, until the retention period expires. This is why option C is correct: objects cannot be deleted or overwritten for 365 days unless special permissions (such as those needed to shorten the retention period, which are not granted here) are involved.

Answer

Objects are locked indefinitely until the lock is manually removed.

Answer

Objects can be deleted immediately because versioning is enabled.

Answer

Objects can be deleted only by the root user.

Question 8

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

Accepted Answer

Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.. Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Answer

Store the Docker image in Amazon S3 instead of ECR.

Answer

Use the 'latest' tag for all images.

Answer

Retry the failed pipeline step after a delay.

Question 9

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL database. Recently, the application has become slow during peak hours. The operations team notices that the database CPU utilization is high, but the number of connections is within limits. The application is read-heavy. The team wants to improve performance with minimal changes to the application code. The database is currently a single Aurora instance. Which solution should the team implement?

Accepted Answer

Add an Aurora Replica and configure the application to use the reader endpoint for read-only queries.. Adding an Aurora Replica distributes read traffic, reducing load on the primary instance. The application must be configured to use the reader endpoint for read queries.

Answer

Use Amazon DynamoDB Accelerator (DAX) to cache database queries.

Answer

Add an Amazon ElastiCache Redis cluster in front of the database.

Answer

Increase the instance size of the Aurora primary instance.

Question 10

A financial services company runs a critical trading application on Amazon EC2 instances behind an Application Load Balancer (ALB) in three Availability Zones. The application uses a MySQL-compatible Amazon RDS for MariaDB database with Multi-AZ deployment. Recently, the operations team noticed that during periods of heavy trading, the database CPU utilization spikes to 100%, causing query timeouts and application errors. The team has already reviewed slow query logs and enabled Performance Insights, but the issue persists. The application is read-heavy with frequent writes. The team needs to reduce database load with minimal changes to the application code. Which solution is the MOST effective and scalable?

Accepted Answer

Create read replicas of the RDS for MariaDB instance and configure the application to send read queries to the read replicas.. Option D (RDS for MariaDB read replicas with read-only database connections) offloads read traffic without code changes, as read replicas can be used by modifying the connection string. Option A (Aurora) would require migration. Option B (ElastiCache) requires application code to cache data. Option C (DynamoDB Accelerator) is for DynamoDB, not MariaDB.

Answer

Migrate the database to Amazon Aurora MySQL-Compatible Edition with Auto Scaling and enable performance insights.

Answer

Implement an in-memory caching layer using Amazon ElastiCache for Memcached and modify the application to check the cache first.

Answer

Replace the RDS database with Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching.

Question 11

A company has a multi-account AWS environment with a central logging account and multiple workload accounts. The security team requires that all VPC Flow Logs be delivered to a central S3 bucket in the logging account. The VPC Flow Logs are encrypted with a customer-managed KMS key in the logging account. The workload accounts have created VPC Flow Logs, but the logs are not appearing in the central S3 bucket. The IAM role used by VPC Flow Logs in the workload accounts has the necessary permissions to deliver logs to the central S3 bucket. What is the most likely cause of the issue?

Accepted Answer

The KMS key policy in the logging account does not grant the VPC Flow Logs service principal permission to use the key.. Option A is correct because the KMS key policy must grant the VPC Flow Logs service principal permission to use the key for encryption. Even if the IAM role has permissions, the key policy is separate and must be explicitly set. Option B is wrong because bucket policies are evaluated after key policy; bucket policy is not the issue here. Option C is wrong because VPC Flow Logs do not use CloudWatch Logs for S3 delivery directly. Option D is wrong because bucket policies are not the primary issue; the key policy is missing.

Answer

The VPC Flow Logs are being delivered to CloudWatch Logs instead of S3.

Answer

The S3 bucket policy denies access to the workload accounts.

Answer

The S3 bucket has a bucket policy that requires encryption in transit.

Question 12

A company uses AWS Organizations and wants to centrally manage AWS Config rules across all member accounts. They have enabled AWS Config in the management account and used AWS Config aggregator to view compliance status across accounts. However, they want to enforce a specific Config rule in all accounts automatically. Which solution should they use?

Accepted Answer

Use AWS Config conformance packs with AWS Organizations to deploy the rule across all accounts.. Option B is correct because AWS Config rules can be deployed across accounts using AWS Organizations by enabling the rule with 'All accounts' option. Option A is wrong because SCPs cannot enforce Config rules. Option C is wrong because CloudFormation StackSets can deploy rules but requires manual management. Option D is wrong because Config aggregator only aggregates, not enforces.

Answer

Use the AWS Config aggregator to manually enable the rule in each account.

Answer

Use AWS CloudFormation StackSets to deploy a Config rule template to each account.

Answer

Create an SCP that requires all accounts to enable AWS Config.

Question 13

A company uses AWS Organizations with a management account and multiple member accounts. The management account has a trail in AWS CloudTrail that logs all management events for all accounts. The security team wants to also log data events for S3 buckets across all accounts. They create a new trail in the management account with data events enabled for all S3 buckets in all accounts. However, data events from member accounts are not appearing in the CloudTrail logs. What is the most likely cause?

Accepted Answer

Data events for S3 buckets are not logged centrally by a trail created in the management account; each account must have its own trail for data events.. Option B is correct because a trail in the management account can log management events for all accounts, but to log data events for member accounts, the trail must be created in each member account or use a trail in the management account with the 'Include global services' option not applicable. Data events are per-account unless using advanced event selectors with cross-account support, but standard trails require account-specific settings. Option A is wrong because CloudTrail does not require S3 bucket policies for logging. Option C is wrong because there is no such limitation. Option D is wrong because encryption does not affect logging.

Answer

The S3 bucket in the management account does not have a bucket policy that allows CloudTrail to write logs from member accounts.

Answer

The trail is not configured to log data events for all S3 buckets; it only logs for specific buckets.

Answer

The S3 bucket is encrypted with a KMS key that CloudTrail does not have permission to use.

Question 14

A company has a single AWS account that hosts multiple applications for different business units. Each business unit wants to have its own set of IAM users and permissions. The company wants to minimize administrative overhead while maintaining separation. They are considering using AWS Organizations with multiple accounts. However, the CFO is concerned about increased costs due to separate accounts. What is the best solution to address the business units' needs while managing costs?

Accepted Answer

Use IAM policies with conditions based on resource tags to restrict access within the single account.. Option D is correct because it provides logical separation using IAM policies and resource tags without the overhead of multiple accounts. Option A is wrong because multiple accounts increase costs due to minimum services per account. Option B is wrong because OUs do not provide IAM user management. Option C is wrong because SCPs are for account-level restrictions, not user-level.

Answer

Create an Organizational Unit for each business unit within the existing account.

Answer

Create a separate AWS account for each business unit and use consolidated billing to manage costs.

Answer

Use Service Control Policies to restrict each business unit's access to specific services.

Question 15

A company has a multi-account AWS environment with a central network account and multiple workload accounts. They want to share a VPC subnet in the network account with the workload accounts so that they can launch EC2 instances directly into the shared subnet. The network team has created a VPC with a subnet and shared it using AWS Resource Access Manager (RAM) with the workload accounts. However, the workload accounts cannot see the shared subnet when launching EC2 instances. What is the most likely cause?

Accepted Answer

The workload accounts have not accepted the resource share invitation.. Option A is correct because RAM requires an explicit acceptance of the resource share by the workload accounts. Until they accept, the subnet is not visible. Option B is wrong because IAM permissions are needed but the issue is acceptance. Option C is wrong because sharing is not limited to the same region. Option D is wrong because default VPC does not affect shared subnets.

Answer

The workload accounts have a default VPC that conflicts with the shared subnet.

Answer

The workload accounts do not have the necessary IAM permissions to use shared subnets.

Answer

The subnet is in a different AWS Region than the workload accounts.

Question 16

A financial services company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application is deployed across multiple Availability Zones. The company recently experienced a DDoS attack that overwhelmed the ALB and caused downtime. The security team wants to implement a solution that can absorb DDoS attacks at the edge and only forward legitimate traffic to the ALB. Additionally, the company needs to protect sensitive data in transit using TLS 1.3. What should the solutions architect do?

Accepted Answer

Deploy Amazon CloudFront in front of the ALB with AWS Shield Advanced and enforce TLS 1.3.. Option C is correct. AWS Shield Advanced provides DDoS protection and can be combined with CloudFront or Global Accelerator. Using CloudFront with Shield Advanced provides edge protection and can enforce TLS 1.3. Option A is incorrect because Shield Standard is free but provides limited protection; it may not be sufficient. Option B is incorrect because NACLs are not effective against DDoS attacks at the edge. Option D is incorrect because WAF is for web application filtering, not for absorbing DDoS traffic at the edge.

Answer

Use AWS WAF with rate-based rules and associate it with the ALB.

Answer

Use an AWS Network Firewall and configure stateful rules to block malicious IPs.

Answer

Enable AWS Shield Standard and use security groups to restrict traffic.

Question 17

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

Accepted Answer

Host the frontend on Amazon S3 with static website hosting and the backend as AWS Lambda functions behind Amazon API Gateway.. Option B is correct. S3 for static hosting and API Gateway with Lambda provides a serverless, scalable solution with low overhead. Option A is wrong because EC2 requires management. Option C is wrong because Lightsail has limited scalability. Option D is wrong because Elastic Beanstalk has more overhead than serverless.

Answer

Host the frontend and backend on a single EC2 instance using Amazon Lightsail.

Answer

Host the frontend on EC2 instances behind an ALB and the backend on EC2 instances behind another ALB.

Answer

Host the frontend on S3 and the backend on Amazon Elastic Beanstalk with a load balancer.

Question 18

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

Accepted Answer

The transit gateway route tables are not associated with the application VPC attachments.. The most likely cause is that the transit gateway route tables are not associated with the application VPC attachments. Even if the VPN routes are propagated into the transit gateway route tables, the application VPCs will not receive those routes unless their VPC attachments are explicitly associated with the correct transit gateway route table. Without this association, the transit gateway does not propagate routes to the attached VPCs, leaving them unable to reach the on-premises network.

Answer

The application VPCs have route tables that override the transit gateway routes with local routes.

Answer

The VPN connection is not configured to advertise the on-premises CIDR to the transit gateway.

Answer

The application VPCs have security groups that block traffic to the on-premises network.

Question 19

A company has a multi-account AWS environment with over 500 accounts. The security team uses AWS Config to evaluate resource compliance across all accounts. They have set up an AWS Config aggregator in the security account to collect configuration snapshots from all member accounts. Recently, the team noticed that some member accounts are not showing up in the aggregator. The accounts are active and have AWS Config enabled. What should the security team do to troubleshoot this issue?

Accepted Answer

Verify that the AWS Config aggregator in the security account has the correct authorization to assume a role in each member account.. Option D is correct because AWS Config aggregators require cross-account authorization to collect configuration data from member accounts. Even if AWS Config is enabled in member accounts, the aggregator in the security account must have the correct IAM role permissions (via an IAM role in each member account) to assume and retrieve configuration snapshots. Without this authorization, the aggregator cannot access the member accounts' data, causing them to not appear.

Answer

Ensure that the member accounts have enabled AWS Config in the same region as the aggregator.

Answer

Check if the member accounts have exceeded the AWS Config resource limits.

Answer

Check if the AWS Config recorder in the member accounts is configured to record all resource types.

Question 20

A company has multiple AWS accounts and wants to centralize the management of security policies. The security team needs to enforce that all IAM users in all accounts must use multi-factor authentication (MFA) to access the AWS Management Console. The solution must be centrally managed and automatically applied to new accounts as they are added. Which approach should be taken?

Accepted Answer

Create an SCP that denies console access for IAM users if MFA is not present.. AWS Organizations Service Control Policies (SCPs) can centrally deny AWS API actions (including console access) for all IAM users across multiple accounts if the `aws:MultiFactorAuthPresent` condition key is false. This approach is centrally managed from the management account and automatically applies to new accounts added to the organization, meeting the requirement for centralized enforcement and scalability.

Answer

Use AWS Config to detect IAM users without MFA and send alerts.

Answer

Use AWS IAM Identity Center to enforce MFA for all users accessing the console.

Answer

Create an IAM policy in each account that denies console access without MFA.