SAP-C02 Timed Hard Questions — 25 Difficult Questions

Question 1

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

15 minute time limit — choose an answer to begin.

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 2

A company is planning to modernize a legacy Java application that runs on a single on-premises server. The application uses a proprietary file-based storage system. The company wants to migrate to AWS with the following goals: reduce operational overhead, improve availability, and minimize code changes. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Use AWS Application Migration Service (MGN) to migrate the application server to Amazon EC2. AWS Application Migration Service (MGN) enables lift-and-shift of the application server to Amazon EC2 with minimal code changes, reducing operational overhead. Amazon EFS provides a managed NFS file system that can replace the proprietary file-based storage without code modifications, improving availability. Option D (RDS) is incorrect because migrating file-based data to a relational database would require significant application changes, contradicting the goal of minimizing code changes.

Answer

Migrate the proprietary storage to Amazon S3

Answer

Migrate the proprietary storage to Amazon RDS for PostgreSQL

Answer

Refactor the application into microservices and deploy on Amazon EKS

Question 3

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

Accepted Answer

Each member account must individually configure the S3 bucket as a publishing destination for its own findings.. For GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place. Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Answer

The GuardDuty detector in the management account is not configured to publish findings to S3.

Answer

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Answer

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

Question 4

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

Accepted Answer

Define an IAM task role with S3 access policies and reference it in the ECS task definition.. An IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Answer

Attach an IAM role to the underlying EC2 instance.

Answer

Assign an IAM role to the ECS service using the ECS service-linked role.

Answer

Store AWS credentials in the container environment variables.

Question 5

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 6

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 7

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the correct ingestion service because it provides a durable, scalable, real-time data streaming platform that can handle the high throughput from thousands of IoT devices. It stores data in shards for up to 365 days, enabling Apache Flink to consume and process the data with exactly-once semantics and low latency.

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

Question 8

A financial services company needs to store sensitive customer data in Amazon S3 with encryption at rest. They require that the encryption keys be stored in AWS CloudHSM and that the S3 bucket must not be able to access the keys without explicit permission. Which S3 encryption option should they use?

Accepted Answer

SSE-C. SSE-C (Server-Side Encryption with Customer-Provided Keys) is correct because it allows the customer to supply their own encryption keys, which can be stored in AWS CloudHSM, and S3 will use those keys to encrypt data at rest. With SSE-C, the customer manages the keys outside of AWS, and S3 cannot access the keys without explicit permission because the keys are provided per request and not stored by AWS. This meets the requirement of storing keys in CloudHSM and ensuring S3 has no independent access to them.

Answer

SSE-S3

Answer

Client-side encryption

Answer

SSE-KMS

Question 9

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

Accepted Answer

Configure the environment’s load balancer to listen on port 443 with the ACM certificate and port 80 with a redirect rule.. Elastic Beanstalk environments using a load balancer (ALB or CLB) can be configured to listen on port 443 with the ACM certificate for HTTPS termination, and simultaneously define a listener on port 80 with a redirect action that sends HTTP traffic to HTTPS. This is the simplest and most scalable approach, as it offloads SSL termination and redirection to the load balancer, eliminating the need to manage certificates or redirection logic on individual instances.

Answer

Use a NAT instance to perform SSL termination and redirect.

Answer

Install the certificate on each EC2 instance and configure the web server to redirect HTTP to HTTPS.

Answer

Deploy a CloudFront distribution with the ACM certificate and redirect HTTP to HTTPS at the distribution level.

Question 10

A company is modernizing a monolithic application into microservices on AWS. The application currently uses a single SQL database. Which THREE AWS services can help decouple the data layer and enable event-driven communication between microservices?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SQS provides message queuing for async communication. Amazon SNS enables pub/sub messaging. Amazon EventBridge provides event bus for decoupled communication. Amazon RDS is a relational database, not for decoupling. Amazon ElastiCache is caching.

Answer

Amazon RDS

Answer

Amazon ElastiCache

Question 11

A company is migrating a stateful application to AWS. The application uses sticky sessions (session affinity) on the current on-premises load balancer. The company wants to use an Application Load Balancer (ALB) in AWS. Which feature should be enabled?

Accepted Answer

Sticky sessions (session affinity) using a cookie generated by the load balancer.. ALB supports sticky sessions (session affinity) using a cookie generated by the load balancer, which meets the requirement to maintain session state from the on-premises environment. Option A (connection draining) is used to allow in-flight requests to complete during instance deregistration, not for session affinity. Option C (health checks) ensures traffic is only sent to healthy instances, but does not maintain session stickiness. Option D (cross-zone load balancing) distributes traffic evenly across all availability zones, but does not affect session affinity.

Answer

Connection draining (deregistration delay).

Answer

Health checks to ensure only healthy instances receive traffic.

Answer

Cross-zone load balancing.

Question 12

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

Accepted Answer

Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.. Option D meets the RPO of less than 5 minutes because RDS cross-Region read replicas use asynchronous replication with a typical lag of seconds. It meets the RTO of less than 30 minutes because the read replica can be promoted to a standalone primary in minutes. The standby EC2 environment with Auto Scaling set to 0 (scaling up based on health check alarms) minimizes cost when not in use. Route 53 failover routing redirects traffic to us-west-2 after promotion. Option A is incorrect because a single hot standby EC2 instance incurs ongoing cost, and it does not meet the cost minimization requirement. Option B is incorrect because automated snapshots have an RPO of up to 24 hours (not <5 minutes), and restoring to S3-mounted volumes is not a functional database serving solution. Option C is incorrect because Multi-AZ in both regions is costly (always running instances) and cross-Region load balancing with ALB is not a native feature for failover; plus Multi-AZ does not provide a separate read replica in another region for DR without additional replication.

Answer

Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

Answer

Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

Answer

Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

Question 13

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 14

A company hosts a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL database. Recently, the application has become slow during peak hours. The operations team notices that the database CPU utilization is high, but the number of connections is within limits. The application is read-heavy. The team wants to improve performance with minimal changes to the application code. The database is currently a single Aurora instance. Which solution should the team implement?

Accepted Answer

Add an Aurora Replica and configure the application to use the reader endpoint for read-only queries.. Adding an Aurora Replica distributes read traffic, reducing load on the primary instance. The application must be configured to use the reader endpoint for read queries.

Answer

Use Amazon DynamoDB Accelerator (DAX) to cache database queries.

Answer

Add an Amazon ElastiCache Redis cluster in front of the database.

Answer

Increase the instance size of the Aurora primary instance.

Question 15

A financial services company runs a critical trading application on Amazon EC2 instances behind an Application Load Balancer (ALB) in three Availability Zones. The application uses a MySQL-compatible Amazon RDS for MariaDB database with Multi-AZ deployment. Recently, the operations team noticed that during periods of heavy trading, the database CPU utilization spikes to 100%, causing query timeouts and application errors. The team has already reviewed slow query logs and enabled Performance Insights, but the issue persists. The application is read-heavy with frequent writes. The team needs to reduce database load with minimal changes to the application code. Which solution is the MOST effective and scalable?

Accepted Answer

Create read replicas of the RDS for MariaDB instance and configure the application to send read queries to the read replicas.. (RDS for MariaDB read replicas with read-only database connections) offloads read traffic without code changes, as read replicas can be used by modifying the connection string. Option A (Aurora) would require migration. Option B (ElastiCache) requires application code to cache data. Option C (DynamoDB Accelerator) is for DynamoDB, not MariaDB.

Answer

Migrate the database to Amazon Aurora MySQL-Compatible Edition with Auto Scaling and enable performance insights.

Answer

Implement an in-memory caching layer using Amazon ElastiCache for Memcached and modify the application to check the cache first.

Answer

Replace the RDS database with Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching.

Question 16

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

Accepted Answer

Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.. It uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Answer

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Answer

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Answer

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

Question 17

A company has multiple AWS accounts managed through AWS Organizations. The central IT team wants to allow developers to launch EC2 instances only in specific Regions, but allow full access to all other services. What is the BEST approach?

Accepted Answer

Apply an SCP that allows EC2 actions only in the allowed Regions.. Service Control Policies (SCPs) in AWS Organizations allow central governance over member accounts by specifying maximum permissions. An SCP that allows EC2 actions only in permitted Regions effectively restricts developers without affecting access to other services, as SCPs are account-level permission guards that do not interfere with service-specific IAM policies for non-EC2 actions.

Answer

Configure IAM permissions boundaries on all developer roles to restrict EC2 actions to allowed Regions.

Answer

Use AWS Config rules to terminate EC2 instances launched in disallowed Regions.

Answer

Create a Service Control Policy (SCP) that denies EC2 actions in disallowed Regions.

Question 18

A company uses AWS Organizations with a large number of accounts. The networking team wants to centrally manage VPCs and subnets using AWS Resource Access Manager (RAM) and share subnets to member accounts. What must be done in the member accounts to use shared subnets?

Accepted Answer

Nothing, shared subnets are automatically available to all accounts in the organization.. When AWS Organizations is configured with all features enabled and sharing is enabled within the organization, Resource Access Manager (RAM) automatically shares resources with all accounts in the organization without requiring individual acceptance. Therefore, shared subnets are immediately available to member accounts for launching resources, and no additional action is needed in the member accounts.

Answer

The member account must create an IAM role to assume for launching resources in the shared subnet.

Answer

The member account must create a VPC and then associate the shared subnet.

Answer

The member account must accept the resource share invitation.

Question 19

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 20

A company has a multi-account AWS environment with a central security account. The security team wants to implement a solution that allows them to centrally manage and audit IAM permissions across all accounts. Which THREE services should be combined to achieve this?

Accepted Answer

AWS Organizations. AWS Organizations is correct because it provides a centralized governance framework for managing multiple AWS accounts, enabling the security team to apply service control policies (SCPs) that centrally restrict IAM permissions across all member accounts. This allows the security account to enforce permission boundaries and audit IAM actions at the organizational level.

Answer

AWS Config

Answer

Amazon GuardDuty