SAP-C02 Multiple Select — 10 Questions

Question 1

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 2

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

Accepted Answer

AWS Storage Gateway (File Gateway). AWS Storage Gateway (File Gateway) provides a low-latency, on-premises cache for frequently accessed data while asynchronously uploading the underlying data to Amazon S3 for durable backup. This hybrid architecture allows applications to access data with local file-system performance while leveraging S3 as the backup target, meeting both the low-latency and backup requirements.

Answer

Amazon EFS

Answer

AWS Snowball Edge

Answer

AWS Direct Connect

Question 3

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 4

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the correct ingestion service because it provides a durable, scalable, real-time data streaming platform that can handle the high throughput from thousands of IoT devices. It stores data in shards for up to 365 days, enabling Apache Flink to consume and process the data with exactly-once semantics and low latency.

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

Question 5

A company is modernizing a monolithic application into microservices on AWS. The application currently uses a single SQL database. Which THREE AWS services can help decouple the data layer and enable event-driven communication between microservices?

Accepted Answer

Amazon Simple Notification Service (SNS). Amazon SQS provides message queuing for async communication. Amazon SNS enables pub/sub messaging. Amazon EventBridge provides event bus for decoupled communication. Amazon RDS is a relational database, not for decoupling. Amazon ElastiCache is caching.

Answer

Amazon RDS

Answer

Amazon ElastiCache

Question 6

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 7

A company is migrating a legacy application to AWS. The application currently runs on a single on-premises server with a local MySQL database. The company wants to minimize changes and reduce operational overhead. Which TWO strategies should the solutions architect recommend? (Select TWO.)

Accepted Answer

Replatform the database to Amazon RDS for MySQL. Rehost (lift-and-shift) minimizes changes by moving the application as-is. Replatforming the database to RDS reduces operational overhead by offloading database management. Retire is not applicable. Refactor would require changes. Repurchase involves buying new software.

Answer

Refactor the application to use microservices

Answer

Retire the application

Answer

Repurchase a SaaS alternative

Question 8

A company uses AWS Organizations with multiple OUs. The security team wants to ensure that no account in the 'Production' OU can disable AWS CloudTrail or delete CloudTrail log files. Which two steps should be taken? (Choose TWO.)

Accepted Answer

Create an SCP attached to the 'Production' OU that denies CloudTrail and S3 actions related to stopping or deleting trails and logs.. Service Control Policies (SCPs) attached to an OU can deny specific AWS actions for all accounts within that OU, including actions like cloudtrail:StopLogging, cloudtrail:DeleteTrail, and s3:DeleteObject on the CloudTrail log bucket. This ensures that no account in the 'Production' OU can disable CloudTrail or delete its log files, regardless of IAM permissions within the account. Option D is correct because an S3 bucket policy on the CloudTrail log bucket that explicitly denies s3:DeleteObject for all principals in the 'Production' OU adds a second layer of defense, preventing deletion of log files even if an account gains elevated privileges.

Answer

Enable AWS CloudTrail Insights to detect unusual activity.

Answer

Use IAM roles with a permissions boundary that restricts CloudTrail actions.

Question 9

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Accepted Answer

Configure RDS Multi-AZ in the primary region.. RDS Multi-AZ provides automatic failover to a standby in a different Availability Zone within the same region, achieving an RTO typically under 1-2 minutes and an RPO of zero (synchronous replication). This meets the 15-minute RTO and 1-minute RPO for intra-region failures, but it does not address cross-region DR. Option B is correct because Amazon Aurora Global Database uses asynchronous replication with a typical RPO of 1 second or less and can promote a secondary region in under 1 minute, satisfying both the 15-minute RTO and 1-minute RPO for a full regional disaster.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 10

A company uses AWS Organizations and wants to centrally manage Amazon GuardDuty across all accounts. Which TWO steps are required to enable GuardDuty in all accounts from a single management account?

Accepted Answer

Use the GuardDuty delegated administrator account to enable GuardDuty for all accounts in the organization. AWS Organizations allows you to designate a GuardDuty delegated administrator account, which can then enable GuardDuty for all member accounts in the organization with a single API call or via the console. This eliminates the need to manually enable GuardDuty in each account, as the delegated administrator manages the service centrally across the entire organization.

Answer

Use AWS CloudFormation StackSets to deploy GuardDuty in each account

Answer

Enable GuardDuty manually in each member account by logging into each account

Answer

Create a service control policy to force GuardDuty to be enabled