SAP-C02 Hard Questions — 25 Difficult Questions

Question 1

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 2

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 3

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 4

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. Option B is correct because PostgreSQL listens on TCP port 5432, and referencing the web tier's security group as the source in the RDS security group's inbound rule allows only those EC2 instances to reach the database on that port. Option D is correct because placing the web tier instances in a private subnet removes them from direct internet exposure while still allowing outbound access to the RDS endpoint. Option E is correct because setting the RDS instance's 'Publicly accessible' option to 'No' ensures the database receives only a private IP address and cannot be reached from the internet. Option A is wrong because a public subnet would expose the database to internet routing, contradicting the requirement. Option C, while a good credential-management practice, does not control network access or port restrictions and is therefore not part of the required steps.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 5

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

Accepted Answer

Use Amazon RDS for MySQL or PostgreSQL with read replicas.. Using Amazon RDS with the same database engine (MySQL or PostgreSQL) minimizes code changes, as the application can connect via standard SQL drivers. Read replicas can help with read scaling without altering the codebase. Option B is wrong because Aurora Serverless may require configuration changes and does not necessarily minimize code changes. Option C is wrong because S3 and Athena are not suitable for transactional relational queries and would require significant architectural changes. Option D is wrong because DynamoDB would require schema redesign and application changes to use NoSQL.

Answer

Use Amazon Aurora Serverless to reduce management.

Answer

Store data in Amazon S3 and use Athena for queries.

Answer

Migrate to Amazon DynamoDB for scalability.

Question 6

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO).. Option A is correct because RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) are the foundational business requirements that drive every DR design decision, such as whether to use pilot light, warm standby, or multi-site active-active. Option B is correct because the data replication strategy determines actual data loss and recovery behavior: synchronous replication (e.g., Aurora Global Database or Multi-AZ) gives near-zero RPO but adds latency, while asynchronous replication (e.g., S3 Cross-Region Replication, RDS read replicas) lowers latency but risks losing recent writes. Option C is correct because Amazon Route 53 failover routing with health checks is the mechanism that redirects client traffic to the standby Region during a disaster, making it essential for reducing RTO in a multi-tier application. Option D is not one of the three because deploying across multiple Availability Zones addresses high availability within a single Region, not disaster recovery across Regions, which is the scope of a DR plan. Option E is not one of the three because instance sizing affects performance and cost, not recovery time, recovery point, or failover capability, so it is irrelevant to DR design.

Answer

Deploying the application across multiple Availability Zones.

Answer

Using larger instance sizes for better performance.

Question 7

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. For an ECS Fargate task to reach an RDS instance in a private subnet, the simplest and most secure configuration is to launch the task in the same private subnet (or a private subnet with a route to the RDS subnet). Fargate tasks in a public subnet with a public IP cannot initiate connections to a private RDS endpoint without a NAT or peering path, and placing them in the private subnet keeps traffic on the private network. This also avoids exposing the task to the internet.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 8

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

Accepted Answer

Use a step scaling policy with a lower scale-out threshold and a larger adjustment. A step scaling policy allows the team to define multiple scaling adjustments based on the magnitude of the alarm breach. By lowering the scale-out threshold, ECS will add tasks sooner when traffic begins to rise, and a larger adjustment adds more tasks per step, quickly absorbing the spike. This directly addresses the issue of tasks becoming unhealthy due to insufficient capacity during sudden load increases.

Answer

Increase the task memory allocation to improve performance

Answer

Increase the health check interval to reduce the number of tasks marked unhealthy

Answer

Use a target tracking scaling policy with a higher target value

Question 9

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Accepted Answer

The subnet's auto-assign public IP setting is disabled. The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Answer

The internet gateway is not attached to the VPC

Answer

The subnet needs a NAT gateway for internet access

Answer

The subnet's route table does not have a route to the internet gateway

Question 10

A company runs a high-traffic web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences intermittent latency spikes during peak hours. Analysis shows that the latency spikes correlate with high CPU utilization on the EC2 instances. The company wants to reduce latency without over-provisioning. Which solution is MOST cost-effective and scalable?

Accepted Answer

Configure an Auto Scaling group with a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy based on average CPU utilization automatically adjusts the number of EC2 instances in the Auto Scaling group to maintain a target CPU utilization level. This directly addresses the latency spikes caused by high CPU utilization during peak hours by scaling out horizontally, while scaling in during low traffic to avoid over-provisioning, making it both cost-effective and scalable.

Answer

Add Amazon ElastiCache to cache database queries.

Answer

Use Spot Instances to reduce costs and scale horizontally.

Answer

Increase the EC2 instance size to handle peak loads.

Question 11

A financial services company runs a critical trading application on Amazon EC2 instances behind an Application Load Balancer (ALB) in three Availability Zones. The application uses a MySQL-compatible Amazon RDS for MariaDB database with Multi-AZ deployment. Recently, the operations team noticed that during periods of heavy trading, the database CPU utilization spikes to 100%, causing query timeouts and application errors. The team has already reviewed slow query logs and enabled Performance Insights, but the issue persists. The application is read-heavy with frequent writes. The team needs to reduce database load with minimal changes to the application code. Which solution is the MOST effective and scalable?

Accepted Answer

Create read replicas of the RDS for MariaDB instance and configure the application to send read queries to the read replicas.. (RDS for MariaDB read replicas with read-only database connections) offloads read traffic without code changes, as read replicas can be used by modifying the connection string. Option A (Aurora) would require migration. Option B (ElastiCache) requires application code to cache data. Option C (DynamoDB Accelerator) is for DynamoDB, not MariaDB.

Answer

Migrate the database to Amazon Aurora MySQL-Compatible Edition with Auto Scaling and enable performance insights.

Answer

Implement an in-memory caching layer using Amazon ElastiCache for Memcached and modify the application to check the cache first.

Answer

Replace the RDS database with Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching.

Question 12

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Accepted Answer

AWS Organizations. AWS Organizations (A) is correct because it provides the multi-account governance foundation, enabling consolidated management of all accounts in the organization so that policies such as service control policies (SCPs) can be applied centrally to restrict IAM permissions across every member account. AWS IAM Access Analyzer (C) is correct because it analyzes resource-based policies and IAM policies to identify resources shared with external entities or unused permissions, giving the security team centralized findings to audit and refine IAM permissions. AWS CloudTrail (D) is correct because it records API activity across all accounts, and when combined with an organization trail delivering logs to a central security account, it provides the audit trail needed to review IAM-related actions centrally. AWS Config (B) is not among the marked answers because, while it tracks resource configuration changes and compliance, it is not one of the three services specified for centrally managing and auditing IAM permissions in this scenario. Amazon GuardDuty (E) is not marked because it is a threat-detection service that identifies malicious activity and compromised credentials, not a tool for centrally managing or auditing IAM permissions.

Answer

AWS Config

Answer

Amazon GuardDuty

Question 13

An organization has deployed the above CloudFormation template. They want to ensure that all uploads to the bucket are encrypted in transit. However, users are still able to upload objects over unencrypted HTTP. What is the MOST likely reason?

Accepted Answer

The condition operator should be 'BoolIfExists' instead of 'Bool' to handle cases where the 'aws:SecureTransport' key is not present in the request.. The condition key 'aws:SecureTransport' may not be present in all requests (e.g., anonymous requests or certain SDK versions). Using 'Bool' will cause the policy to evaluate to false when the key is missing, allowing unencrypted uploads. 'BoolIfExists' returns true if the key does not exist, effectively blocking requests without the key, which enforces encryption in transit more robustly.

Answer

The 'aws:SecureTransport' condition key is misspelled; it should be 'aws:SecureTransport' with a capital T.

Answer

The bucket policy is missing an 'Allow' statement for HTTPS requests.

Answer

The resource ARN should be 'arn:aws:s3:::my-unique-bucket-123' without the '/*' to cover PutObject actions.

Question 14

A company uses AWS Organizations with a multi-account strategy. They want to allow a centralized DevOps team to manage EC2 instances across all accounts using AWS Systems Manager. The DevOps team should not have direct IAM access to the target accounts. How can this be achieved?

Accepted Answer

Set up a Systems Manager inventory in each account and grant the DevOps team IAM roles with AssumeRole permissions to each account.. It uses AWS Systems Manager's cross-account management capability combined with IAM roles. By setting up Systems Manager inventory in each target account and granting the DevOps team IAM roles with AssumeRole permissions, the team can centrally manage EC2 instances without having direct IAM access to those accounts. This leverages the AWS Security Token Service (STS) to assume a role in each target account, allowing Systems Manager actions like Run Command or Patch Manager to be executed from a central account.

Answer

Install Systems Manager agent on all instances and manage them from a central account without any IAM roles.

Answer

Create an SCP that allows Systems Manager actions in all accounts and assign it to the DevOps IAM role.

Answer

Share the EC2 console credentials of each account with the DevOps team.

Question 15

A company uses AWS Organizations and has shared a subnet from the VPC shown in the exhibit using AWS Resource Access Manager (RAM). A workload account launches an EC2 instance in the shared subnet. The instance needs to communicate with an RDS database in a different private subnet within the same VPC. What additional configuration is required?

Accepted Answer

The workload account must configure security groups for the EC2 instance to allow traffic to the RDS database's security group.. When an EC2 instance is launched into a shared subnet via AWS RAM, the workload account can manage its own security groups, but the underlying VPC and its route tables remain under the management of the VPC owner. Since the instance and the RDS database are in the same VPC, no inter-VPC connectivity (like VPC peering or Transit Gateway) is needed. The only missing piece is that the workload account must configure its EC2 instance's security group to allow outbound traffic to the RDS database's security group, and the RDS database's security group must allow inbound traffic from the EC2 instance's security group, both of which are standard security group rules within the same VPC.

Answer

The workload account must create a route table entry in the shared VPC to allow communication.

Answer

Establish a VPC peering connection between the workload account's VPC and the shared VPC.

Answer

Attach an AWS Transit Gateway to both VPCs to enable communication.

Question 16

A healthcare startup is building a HIPAA-compliant application on AWS. The application uses Amazon RDS for MySQL to store patient data. The compliance team requires that all database changes be audited, including SELECT statements. The current solution enables general query logs on the RDS instance, but the logs are stored locally and are lost when the instance is rebooted. Additionally, the logs are consuming significant storage on the instance. The startup needs a durable, scalable, and cost-effective solution for storing and querying database audit logs. Which solution meets these requirements?

Accepted Answer

Configure RDS to publish audit logs to Amazon CloudWatch Logs, then export logs to Amazon S3 using a subscription filter and Lambda. Use Athena to query the logs in S3.. The most suitable solution. RDS for MySQL supports publishing audit logs to CloudWatch Logs. From there, you can set up a subscription filter to a Lambda function that exports logs to Amazon S3 for durable storage. Athena can then be used to query the logs cost-effectively. This approach is durable, scalable, and cost-effective, meeting the compliance requirement for auditing changes including SELECT statements.

Option A: While Kinesis Data Firehose can stream to S3, enabling audit logs on RDS for MySQL does not directly integrate with Kinesis; this option is more complex and unnecessary. Option C: Storing logs in a table on RDS consumes instance storage and does not provide durable, scalable storage; logs are still lost on reboot. Option D: CloudWatch Logs Insights is not cost-effective for long-term querying of large volumes and does not offer the same query flexibility as Athena on S3.

Answer

Enable audit logs on RDS and use Amazon Kinesis Data Firehose to stream logs to Amazon S3. Use Amazon Athena to query the logs.

Answer

Enable the general query log on RDS and set the log_output to TABLE. Write a scheduled script to copy the log table to Amazon S3.

Answer

Enable audit logs on RDS and stream them to Amazon CloudWatch Logs. Use CloudWatch Logs Insights to query logs.

Question 17

A large enterprise has a multi-account AWS environment with over 200 accounts organized under AWS Organizations. The central platform team uses AWS CloudFormation StackSets to deploy a standard VPC with a CIDR of 10.0.0.0/16 into each account. Recently, a business unit created a new account that was not included in the StackSet deployment, and the team manually deployed the VPC using a CloudFormation template. Now, the central team wants to ensure that all accounts have exactly the same VPC configuration and that any drift is automatically corrected. The team also wants to prevent unauthorized changes to the VPC configuration. What is the MOST efficient and secure solution?

Accepted Answer

Enable drift detection on the StackSet and configure automatic stack drift remediation. Additionally, apply an SCP that denies ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute, and similar actions unless they are performed by the StackSet's service role.. The most efficient and secure solution because it uses StackSets drift detection with automatic remediation to continuously detect and correct any deviations from the intended VPC configuration across all accounts. Additionally, applying an SCP that denies VPC-related actions (e.g., ec2:CreateVpc, ec2:DeleteVpc, ec2:ModifyVpcAttribute) unless performed by the StackSet's service role prevents unauthorized changes at the organization level. Option A is reactive and does not prevent drift; Option B requires manual provisioning and does not enforce consistent configuration automatically; Option C requires custom coding (Lambda function) and is less integrated than StackSets' built-in remediation.

Answer

Create a custom Amazon EventBridge rule that catches VPC modification events and automatically re-deploys the CloudFormation stack.

Answer

Use AWS Service Catalog to create a VPC product and require all accounts to provision VPCs through the product.

Answer

Use AWS Config rules to detect VPC changes and trigger a Lambda function to revert them.

Question 18

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an S3 bucket. The ECS task role has the necessary S3 permissions. However, the application is unable to upload files to S3. What is the MOST likely cause?

Accepted Answer

The task definition does not specify the correct task role ARN. For an ECS Fargate task to access S3, the task role with the necessary permissions must be specified in the task definition. If the task role ARN is incorrect or missing, the container will not be able to assume the role, causing S3 access failures. Option A is wrong because the task execution role is used only by the ECS agent to pull container images and send logs, not for application-level S3 access. Option B is wrong because the question states that the task role already has the required S3 permissions, so the bucket policy is likely not the issue. Option C is wrong because an S3 VPC endpoint is not required if the task can reach S3 through the internet or a NAT gateway; its absence would not prevent uploads if proper routing exists.

Answer

The Task execution role is missing S3 permissions

Answer

The S3 bucket policy denies access to the task role

Answer

The VPC does not have an S3 VPC endpoint

Question 19

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Accepted Answer

S3 Intelligent-Tiering. S3 Intelligent-Tiering is the correct choice because it automatically moves data between access tiers (frequent, infrequent, and archive instant retrieval) based on changing access patterns, ensuring that frequently queried data remains in low-latency tiers for immediate query performance with Athena and Redshift Spectrum, while reducing storage costs for data that becomes less active. This is ideal for a petabyte-scale data lake where access patterns are unpredictable or vary over time, as it avoids manual tier management and the retrieval delays of archive classes.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 20

A company is using AWS Organizations with hundreds of accounts. They need to ensure that no account can modify the VPC default security group. Which SCP should they apply to the root OU?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroup*","Resource":"*"}]}. Which denies all ec2:ModifySecurityGroup* actions on any security group. This ensures that no account can modify the default security group, as required. Option C is incorrect because it only denies the ec2:ModifySecurityGroupRules action and uses a condition that applies to all VPCs, not specifically the default security group. Option A only prevents deletion, not modification. Option D prevents creation but not modification.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:DeleteSecurityGroup","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:ModifySecurityGroupRules","Resource":"arn:aws:ec2:*:*:security-group/*","Condition":{"StringEquals":{"ec2:Vpc":"arn:aws:ec2:*:*:vpc/*"}}}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Deny","Action":"ec2:CreateSecurityGroup","Resource":"*"}]}