SAP-C02 Mock Exam 93 — 25 Questions

Question 1

A company has a multi-account AWS environment and wants to centralize the management of IAM roles. The security team needs to ensure that all IAM roles across all accounts trust the same identity provider (IdP) for federated access. The company uses AWS IAM Identity Center (successor to AWS SSO) for user management. Which solution should be implemented?

Accepted Answer

Use AWS IAM Identity Center to create permission sets that grant access to accounts. IAM Identity Center automatically creates and manages the necessary IAM roles with the IdP trust.. AWS IAM Identity Center (formerly AWS SSO) is designed to centralize user access across multiple AWS accounts. When you create permission sets in IAM Identity Center, it automatically provisions the necessary IAM roles in each target account with a trust policy that trusts the IAM Identity Center's own identity provider. This eliminates the need to manually create or manage IAM roles and their trust policies, ensuring all accounts use the same IdP for federated access.

Answer

Use an SCP to require that all IAM roles trust the corporate IdP.

Answer

Create IAM roles in each account with a trust policy that allows the corporate IdP.

Answer

Use AWS CloudFormation StackSets to deploy IAM roles with the IdP trust policy to all accounts.

Question 2

A large e-commerce company uses a multi-account AWS Organizations setup with a central logging account. The company has enabled AWS CloudTrail in all accounts and configured it to deliver logs to a centralized Amazon S3 bucket in the logging account. Recently, the security team noticed that some log files are missing for a period of 2 hours. The CloudTrail console shows that trails are still enabled and delivering to the bucket, but no new log files were created during that time. The team verified that there were API calls made during that period. Which action is most likely to resolve the issue and prevent recurrence?

Accepted Answer

Check the S3 bucket policy in the logging account to ensure it grants the required permissions to the CloudTrail service principal from all accounts.. The most likely cause is that the S3 bucket policy in the central logging account does not grant the necessary permissions for CloudTrail from all accounts to write log files. Even though trails are enabled and appear to be delivering, a missing or misconfigured bucket policy can silently drop log deliveries when the CloudTrail service principal (cloudtrail.amazonaws.com) attempts to write objects. The security team verified API calls occurred, so the issue is at the delivery destination, not the trail configuration itself.

Answer

Review the SCPs attached to the organization root; there might be a policy that denies CloudTrail actions.

Answer

Ensure that the KMS key used for encryption is accessible by the CloudTrail service.

Answer

Enable AWS Config to monitor CloudTrail delivery status and automatically restart the trail if logs are missing.

Question 3

A company has a multi-account AWS environment with over 500 accounts managed through AWS Organizations. The accounts are organized into OUs by business unit. The security team wants to enforce a policy that all S3 buckets must have server-side encryption enabled (SSE-S3 or SSE-KMS). They also want to automatically remediate any existing non-compliant buckets and prevent creation of new non-compliant buckets. Currently, there is no centralized logging or monitoring. The team has tried using AWS Config rules with auto-remediation, but they found that Config rules are not triggered for buckets created before the rule was enabled, and some teams are creating buckets via AWS CloudFormation that bypass the Config rule evaluation. The team needs a solution that covers all buckets, regardless of creation method or time. What should the team do?

Accepted Answer

Apply an SCP that denies s3:CreateBucket if encryption is not specified, and use AWS Config rules with Lambda auto-remediation to fix existing non-compliant buckets.. Option B is correct because an SCP applied at the root or OU level can deny s3:CreateBucket when encryption settings are not specified, preventing creation of non-compliant buckets regardless of the method (console, CLI, CloudFormation). For existing non-compliant buckets, AWS Config rules with Lambda auto-remediation can scan and fix them, and Config rules can be configured to evaluate all existing resources by running a manual or scheduled evaluation after the rule is enabled, addressing the gap where buckets created before the rule was enabled were not evaluated.

Answer

Use AWS CloudFormation StackSets to deploy a bucket template that enforces encryption across all accounts.

Answer

Use AWS CloudTrail to detect non-compliant bucket creation and send alerts to administrators.

Answer

Use S3 bucket policies to deny PutObject if encryption is not set.

Question 4

A company has a multi-account AWS environment with a centralized logging account. The security team wants to ensure that all CloudTrail logs from all accounts are delivered to a single S3 bucket in the logging account. The logging account's S3 bucket policy allows CloudTrail to write logs from other accounts. The CloudTrail trail in each account is configured to deliver to the centralized bucket. However, logs from some accounts are not appearing. The security team has verified that the IAM permissions for CloudTrail are correct. What is the most likely reason for the missing logs?

Accepted Answer

The S3 bucket policy does not grant CloudTrail write access from the source accounts. Option C is correct because the most likely reason for missing logs is that the S3 bucket policy in the logging account does not explicitly grant CloudTrail write access from the source accounts. Even though the bucket policy allows CloudTrail to write logs, it must include a principal that identifies the source account's CloudTrail service (e.g., `AWS:SourceAccount` or `AWS:SourceArn`) to authorize cross-account writes. Without this, CloudTrail from other accounts cannot deliver logs to the centralized bucket, regardless of correct IAM permissions in the source accounts.

Answer

CloudTrail cannot deliver logs to a bucket in a different AWS account

Answer

The S3 bucket policy does not include a condition for aws:SourceOrgID

Answer

The accounts need to enable VPC endpoints for S3 to communicate with the logging account

Question 5

A company is designing a new cloud-native application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application handles user authentication using Amazon Cognito User Pools. During a stress test, the team notices that some requests are failing with HTTP 503 (Service Unavailable) errors. The CloudWatch logs show that Lambda functions are being throttled, and the DynamoDB table is experiencing high write throttling. The team needs to resolve these issues while maintaining low latency. Which solution is the MOST effective?

Accepted Answer

Set Lambda reserved concurrency to a value that covers peak load and enable DynamoDB auto scaling with a target utilization of 70%.. Option A is correct because setting Lambda reserved concurrency ensures that the function always has capacity available to handle peak load without being throttled by the account-level concurrency limit, while DynamoDB auto scaling with a target utilization of 70% dynamically adjusts write capacity to match traffic patterns, preventing write throttling. This combination directly addresses both throttling issues without introducing additional latency from buffering or caching layers.

Answer

Use Amazon SQS to buffer requests to Lambda and configure a DynamoDB Accelerator (DAX) cluster for caching.

Answer

Increase the DynamoDB write capacity units to the maximum expected peak and configure Lambda provisioned concurrency.

Answer

Replace AWS Lambda with Amazon ECS on Fargate and use an Application Auto Scaling target tracking policy.

Question 6

A company has a multi-account AWS environment with a central networking account that hosts all VPCs and a shared services account that hosts common resources like directory services. The company wants to allow all accounts to use the same VPC for their workloads instead of creating separate VPCs. The security team requires that traffic between accounts is encrypted in transit and that accounts cannot directly access each other's resources without going through the central networking account. The network team proposes using AWS Transit Gateway with inter-region peering and VPC attachments. However, the security team is concerned about compliance with encryption requirements. What should the network team do to meet the requirements?

Accepted Answer

Use AWS Transit Gateway with VPN attachments between the central networking account and each member account VPC.. Option D is correct because AWS Transit Gateway with VPN attachments enables encrypted traffic between the central networking account and each member account VPC using IPsec tunnels. This satisfies the encryption-in-transit requirement while ensuring all traffic routes through the central networking account, preventing direct account-to-account access. Transit Gateway also allows all accounts to share a single VPC for workloads without creating separate VPCs.

Answer

Use AWS Client VPN to connect each account to the central VPC.

Answer

Use VPC Peering between the central VPC and each member account VPC.

Answer

Use AWS Direct Connect between accounts.

Question 7

A company uses AWS Organizations with multiple accounts. The network team wants to centrally manage Amazon VPC IP addresses using Amazon VPC IP Address Manager (IPAM). They have enabled IPAM in the management account and delegated an administrator account. However, the delegated administrator account cannot create IPAM pools. What is the most likely cause?

Accepted Answer

The delegated administrator account does not have the required IAM permissions to manage IPAM. Option A is correct because when you delegate an administrator account for IPAM in AWS Organizations, that account still requires explicit IAM permissions to perform IPAM actions such as creating pools. The delegation only allows the account to manage IPAM resources on behalf of the organization; it does not automatically grant the necessary IAM permissions. Without a policy that allows actions like `ec2:CreateIpamPool`, the delegated administrator will receive an authorization error.

Answer

IPAM must be used only from the management account and cannot be delegated

Answer

IPAM is not supported in the AWS Region where the delegated administrator account operates

Answer

An SCP in the organization denies IPAM actions for all accounts

Question 8

A company is designing a new application that will run on Amazon ECS with Fargate. The application consists of three microservices: Service A, Service B, and Service C. Service A receives HTTP requests from an Application Load Balancer and sends messages to an Amazon SQS queue. Service B polls the SQS queue and processes the messages, storing results in Amazon DynamoDB. Service C reads from DynamoDB and sends notifications via Amazon SNS. The company expects variable traffic and wants to minimize costs. During a load test, the team observes that Service B is not scaling fast enough, causing the SQS queue to grow. The team also notices that Service C is idle most of the time. Which solution should the company implement to improve scaling and reduce costs?

Accepted Answer

Configure Service B with a target tracking scaling policy based on the SQS queue backlog and convert Service C to an AWS Lambda function triggered by DynamoDB Streams.. Option C is correct because it addresses both scaling and cost issues: Service B's scaling is improved by using a target tracking scaling policy based on the SQS queue backlog (ApproximateNumberOfMessagesVisible), which directly correlates to the work demand, ensuring faster and more precise scaling. Converting Service C to a Lambda function triggered by DynamoDB Streams eliminates idle compute costs from a constantly running Fargate service, as Lambda only runs when new data appears in DynamoDB, reducing costs significantly.

Answer

Use AWS Lambda with Provisioned Concurrency for Service B and keep Service C as a Fargate service.

Answer

Use a step scaling policy for Service B based on CPU utilization and keep Service C as is.

Answer

Increase the number of ECS tasks for Service B manually and use a scheduled scaling policy for Service C.

Question 9

A company is running a production web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application uses a MySQL database hosted on Amazon RDS with Multi-AZ enabled. Recently, during a traffic spike, some users experienced increased latency and occasional 503 errors. The operations team noticed that the database CPU utilization reached 100% and the number of database connections peaked at the maximum limit. The application team confirmed that the application uses connection pooling on the EC2 instances but the pool size is fixed. Which solution should the solutions architect recommend to prevent recurrence?

Accepted Answer

Implement Amazon RDS Proxy to manage database connections.. Option C is correct because the issue stems from database connections hitting the maximum limit, causing CPU saturation and 503 errors. Amazon RDS Proxy sits between the application and the database, efficiently managing and pooling connections from the EC2 instances, reducing the number of open connections to the RDS instance and preventing connection exhaustion. This allows the existing connection pooling on the EC2 side to scale without overwhelming the database, directly addressing the root cause.

Answer

Add read replicas to offload read queries.

Answer

Increase the DB instance class to a larger size.

Answer

Increase the maximum number of EC2 instances in the Auto Scaling group.

Question 10

A company is designing a new event-driven architecture on AWS for processing orders. When a new order is placed, it must be validated, inventory checked, payment processed, and notification sent. Each step is independent and may take variable time. The company wants to decouple the steps and ensure that failures do not block the entire workflow. Which solution should a Solutions Architect recommend?

Accepted Answer

Use AWS Step Functions to define a state machine that invokes Lambda functions for each step, with retry and error handling.. AWS Step Functions is the correct choice because it provides a fully managed state machine that can orchestrate multiple Lambda functions with built-in retry logic, error handling, and parallel execution. This decouples each step (validation, inventory, payment, notification) while ensuring that failures in one step do not block the entire workflow, as Step Functions can handle errors gracefully with configurable retries and fallback states.

Answer

Use Amazon SQS queues for each step, with Lambda functions polling each queue and forwarding to the next step.

Answer

Use Amazon SNS to publish order events, and subscribe separate Lambda functions for validation, inventory, payment, and notification.

Answer

Create a single Lambda function that performs all steps sequentially.

Question 11

A company is deploying a new microservices application on Amazon ECS using Fargate. The application consists of several services that need to communicate with each other. The company wants to use service discovery so that services can find each other by name. Additionally, the company needs to ensure that traffic between services is encrypted in transit. The security team requires that all inter-service traffic uses TLS. Which combination of services should be used to meet these requirements?

Accepted Answer

Use AWS Cloud Map for service discovery and AWS App Mesh with TLS enforcement for inter-service communication.. Option A is correct because AWS Cloud Map provides service discovery and AWS App Mesh can enforce TLS encryption for inter-service traffic. Option B: Service discovery via Cloud Map works, but ALB is for external traffic, not inter-service mTLS. Option C: Service discovery is not provided by default in ECS; you need Cloud Map. Option D: ALB can route traffic but does not provide service discovery by service name.

Answer

Use AWS Cloud Map for service discovery and an Application Load Balancer for inter-service communication with TLS termination.

Answer

Use the built-in service discovery in Amazon ECS and encrypt traffic using AWS Certificate Manager (ACM) certificates.

Answer

Use an Application Load Balancer with target groups for each service and enable TLS on the load balancer.

Question 12

A company is building a new data analytics platform on AWS. The platform ingests streaming data from multiple sources, processes it in real time, and stores the results in Amazon S3 for later analysis. The data volume is expected to be up to 50 GB per day. The company needs to choose a service for real-time stream processing. Which AWS service is most appropriate for this use case?

Accepted Answer

Amazon Kinesis Data Analytics. Option A is correct because Amazon Kinesis Data Analytics enables real-time stream processing using SQL or Apache Flink. Option B: Kinesis Data Streams is for data ingestion, not processing. Option C: Kinesis Data Firehose is for loading data into stores, not for real-time processing. Option D: Amazon EMR is for batch processing, not real-time.

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Kinesis Data Streams

Answer

Amazon EMR

Question 13

A company is deploying a new web application that uses Amazon S3 to store static content and Amazon CloudFront for content delivery. The application also uses an API Gateway with Lambda for backend logic. The company wants to protect the API from common web exploits like SQL injection and cross-site scripting. Which AWS service should be added to the architecture?

Accepted Answer

AWS WAF. Option B is correct because AWS WAF integrates with API Gateway and CloudFront to protect against web exploits. Option A: Shield Advanced provides DDoS protection, not application-layer filtering. Option C: GuardDuty is for threat detection, not inline protection. Option D: Inspector is for vulnerability assessment.

Answer

Amazon GuardDuty

Answer

Amazon Inspector

Answer

AWS Shield Advanced

Question 14

A company is designing a new application that will run on AWS. The application needs to store and retrieve user session data with low latency. The session data is small (less than 1 KB per user) and must be highly available. The company expects up to 10 million active users per day. Which AWS service should be used as the session store?

Accepted Answer

Amazon ElastiCache for Redis. Option B is correct because Amazon ElastiCache for Redis is designed for low-latency session storage and can scale to millions of users. Option A: DynamoDB is good for persistence but has higher latency than in-memory stores. Option C: RDS is relational and slower for session data. Option D: S3 has high latency for small, frequent reads/writes.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 15

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

Accepted Answer

Amazon DynamoDB. Option D is correct because Amazon DynamoDB is a NoSQL database that supports high availability and automatic scaling. Option A: RDS for MySQL is relational, not NoSQL. Option B: Aurora is relational. Option C: DocumentDB is NoSQL but is MongoDB-compatible; DynamoDB is more fully managed and serverless.

Answer

Amazon Aurora Serverless

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for MySQL with Multi-AZ deployment

Question 16

A financial services company is designing a new application that processes sensitive transactions. The application runs on Amazon ECS with Fargate. The compliance team requires that all data in transit between the application and the database must be encrypted. The database is an Amazon RDS for PostgreSQL instance. The application connects to the database using a connection string that includes the database endpoint. The security team has enabled encryption in transit on the RDS instance using a certificate. The application is currently failing to connect to the database with an error related to SSL/TLS. The development team verified that the connection string includes the sslmode=require parameter. What is the most likely cause of the connection failure?

Accepted Answer

The RDS DB parameter group does not have the 'rds.force_ssl' parameter set to 1.. Option C is correct. By default, TLS is not enforced on RDS; you must set the rds.force_ssl parameter to 1. Option A is wrong because Fargate containers can use SSL. Option B is wrong because security groups don't block SSL/TLS. Option D is wrong because the parameter group is correctly assigned.

Answer

The RDS instance is using a public certificate that is not trusted by the application.

Answer

The security group for the RDS instance does not allow inbound traffic on port 443.

Answer

The Fargate task does not have the necessary SSL libraries installed.

Question 17

A company wants to build a serverless backend for a mobile application. The backend provides user authentication, a REST API for data access, and stores data in a NoSQL database. The company expects the application to have unpredictable traffic, and wants to minimize costs. Which solution should a Solutions Architect recommend?

Accepted Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon DynamoDB for the database.. Option B is correct because Cognito provides authentication, API Gateway + Lambda provides serverless API, and DynamoDB is a NoSQL database that scales automatically. Option A is wrong because RDS is relational, not NoSQL. Option C is wrong because EC2 instances are not serverless. Option D is wrong because S3 is not a database; it can store data but not suitable for transactional data access.

Answer

Use IAM for authentication, EC2 instances behind an ALB for the API, and DynamoDB for the database.

Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon RDS for the database.

Answer

Use Amazon Cognito for authentication, API Gateway with Lambda for the API, and Amazon S3 for the database.

Question 18

A company is deploying a new web application on AWS that requires a highly available and scalable architecture. The application consists of a stateless web tier and a stateful database tier. The web tier runs on Amazon EC2 instances behind an Application Load Balancer. The database tier uses Amazon Aurora MySQL. The company expects variable traffic patterns and wants to automatically scale the web tier based on CPU utilization. Additionally, the company wants to ensure that the database can handle increased read traffic without manual intervention. Which combination of actions should the company take?

Accepted Answer

Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Enable Aurora Auto Scaling to add read replicas based on CPU or connections.. Option D is correct because Auto Scaling based on CPU utilization scales the web tier, and Aurora Auto Scaling adds read replicas automatically. Option A: DynamoDB is not the database; the question specifies Aurora. Option B: ElastiCache is not the database; it's a cache. Option C: SQS does not scale the web tier.

Answer

Use an Auto Scaling group with a target tracking scaling policy based on CPU utilization. Use Amazon SQS to queue read requests during peak traffic.

Answer

Use an Auto Scaling group with a simple scaling policy based on CPU utilization. Use DynamoDB Auto Scaling for the database.

Answer

Use an Auto Scaling group with a step scaling policy based on CPU utilization. Use ElastiCache Auto Scaling to add cache nodes for read traffic.

Question 19

A company is building a new application that will run on AWS Lambda. The application needs to store and retrieve user preferences in a key-value format. The data is accessed frequently and must be highly available. The company expects low latency for reads and writes. Which AWS service should be used as the data store?

Accepted Answer

Amazon DynamoDB. Option B is correct because Amazon DynamoDB is a key-value store designed for low-latency, high-availability access. Option A: S3 is object storage, not key-value. Option C: RDS is relational. Option D: ElastiCache is in-memory but not persistent by default.

Answer

Amazon S3

Answer

Amazon ElastiCache for Memcached

Answer

Amazon RDS for PostgreSQL

Question 20

A company is migrating a monolithic e-commerce application to AWS. The application consists of a web frontend, a REST API, and a PostgreSQL database. The migration plan is to containerize the frontend and API using Amazon ECS with Fargate, and use Amazon RDS for PostgreSQL. The company expects variable traffic with peak loads during promotional events. The architecture must be highly available and cost-effective. The operations team wants to minimize manual scaling interventions. Which solution should a Solutions Architect recommend?

Accepted Answer

Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon RDS for PostgreSQL with Multi-AZ deployment and Auto Scaling for storage.. Option D is correct because it combines ECS with Auto Scaling using target tracking based on CPU/memory, which is cost-effective and handles variable traffic automatically. Option A is wrong because ECS with manual scaling is not automated. Option B is wrong because DynamoDB is not the right database for this relational workload. Option C is wrong because EC2 instances with Auto Scaling add management overhead and Fargate is more serverless.

Answer

Deploy the API and frontend on Amazon ECS with Fargate. Use Application Auto Scaling with target tracking based on average CPU and memory utilization. Use Amazon DynamoDB for the database with on-demand capacity mode.

Answer

Deploy the API and frontend on Amazon EC2 instances behind an Application Load Balancer. Use Auto Scaling groups with dynamic scaling policies. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.

Answer

Deploy the API and frontend on Amazon ECS with Fargate. Configure a scheduled task to scale out during known promotional events. Use Amazon RDS for PostgreSQL with Multi-AZ deployment.