SAP-C02 Multiple Select — 40 Questions

Question 1

A company is implementing AWS Control Tower to manage a multi-account environment. The security team needs to ensure that all accounts in the organization follow the principle of least privilege for IAM roles. Which TWO actions should the team take?

Accepted Answer

Apply service control policies (SCPs) to deny the creation of IAM roles with overly broad permissions, such as 'Action: *' and 'Resource: *'.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts within an organizational unit (OU). By applying an SCP that denies the creation of IAM roles with 'Action: *' and 'Resource: *', the security team enforces the principle of least privilege at the organization level, preventing any account from creating overly permissive roles regardless of the account's own IAM policies.

Answer

Use AWS CloudTrail to monitor IAM role creation and alert when roles with broad permissions are created.

Answer

Use AWS IAM Roles Anywhere to manage temporary credentials for workloads outside AWS.

Answer

Enable AWS Resource Access Manager to share resources only with trusted accounts.

Question 2

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. Option A is correct because StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 3

A company is designing a new application that will process sensitive financial data. They need to ensure encryption at rest and in transit. Which of the following should they use? (Select TWO.)

Accepted Answer

TLS for all data in transit. TLS (Transport Layer Security) is the industry-standard protocol for encrypting data in transit, ensuring confidentiality and integrity between client and server. AWS services like ELB, CloudFront, and API Gateway enforce TLS for all communications, making it the correct choice for securing data in transit.

Answer

AWS Certificate Manager (ACM) for all encryption

Answer

SSL certificates for all connections

Answer

AWS Identity and Access Management (IAM) for data encryption

Question 4

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 5

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Option D is correct because switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Question 6

A company is migrating a multi-tier application to AWS and wants to modernize by using containers and serverless technologies. The application consists of a Node.js frontend, a Java backend, and a PostgreSQL database. The company wants to reduce operational overhead and improve scalability. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Migrate the database to Amazon RDS for PostgreSQL. Option B is correct because Amazon RDS for PostgreSQL reduces operational overhead by managing backups, patching, and replication, while providing scalability through read replicas and storage auto-scaling. This aligns with the goal of modernizing the database layer without changing the database engine, avoiding the need to refactor the application to use a NoSQL database like DynamoDB.

Answer

Refactor the Node.js frontend to run on AWS Lambda with Amazon API Gateway

Answer

Migrate the database to Amazon DynamoDB

Answer

Deploy the Java backend on Amazon EC2 with Auto Scaling

Question 7

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Option A is correct because Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.

Question 8

A company is migrating to a multi-account AWS environment using AWS Control Tower. The security team must ensure that all accounts have AWS Config enabled and that logs are delivered to a central S3 bucket. Which THREE steps should the security team take?

Accepted Answer

Use an SCP to prevent disabling of AWS Config in any account.. Option B is correct because AWS Control Tower uses Service Control Policies (SCPs) to enforce guardrails. An SCP can be applied to the root or OUs to prevent any account from disabling AWS Config, ensuring compliance across the multi-account environment without requiring per-account manual intervention.

Answer

Manually create an S3 bucket in each account to store Config logs.

Answer

Create an IAM role in each account to allow the management account to access Config logs.

Question 9

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server. Option A is correct because a launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Answer

Configure lifecycle hooks in the Auto Scaling group to drain connections

Answer

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Answer

Use a Network Load Balancer to distribute traffic to web servers

Question 10

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Accepted Answer

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.. Option A is correct because Route 53 health checks can monitor the primary application's endpoint, and DNS failover to a secondary Region enables automatic traffic redirection within minutes, aligning with the 1-hour RTO. This approach provides a simple, stateless failover mechanism without requiring complex routing changes.

Answer

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Answer

Deploy the application on Amazon Aurora Global Database.

Question 11

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Kinesis Data Stream with 10 shards.. Option C is correct because with a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Answer

Use DynamoDB Streams to trigger the Lambda function for each record.

Answer

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Answer

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Question 12

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. Option B is correct because IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 13

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 14

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. Option A is correct because a scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 15

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

Accepted Answer

Add an Amazon RDS Read Replica in the same AWS Region.. Option D is correct because adding an Amazon RDS Read Replica offloads read traffic from the primary MySQL database, allowing read queries to be served by the replica and reducing load on the source instance. This directly addresses the high number of read queries causing the bottleneck, as read replicas are designed for read-heavy workloads and can be promoted to a standalone instance if needed.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Implement DynamoDB Accelerator (DAX) in front of the database.

Answer

Scale up the RDS instance to a larger instance type.

Question 16

A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which THREE statements should be included in the IAM policy? (Choose three.)

Accepted Answer

{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}. Option A is correct because the EC2 instance only needs to read objects from the S3 bucket, so the least-privilege action is s3:GetObject. The resource ARN 'arn:aws:s3:::my-bucket/*' correctly targets all objects within the bucket, which is required for reading objects. This adheres to the principle of granting only the necessary permissions.

Answer

{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}

Answer

{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}

Question 17

An e-commerce company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL DB cluster with one writer and two reader instances. During a sales event, the database CPU utilization is high, and read replicas show high replica lag. The company needs to improve the read scalability and reduce replica lag. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Add more reader instances to the cluster to distribute the read traffic.. Adding more reader instances (Option A) distributes the read workload across additional nodes, reducing the load on each reader and helping to lower replica lag. Aurora Auto Scaling (Option E) automatically adjusts the number of reader instances based on metrics like CPU utilization or replica lag, providing dynamic scaling during traffic spikes. Increasing the instance size of reader instances (Option D) provides more CPU and memory resources to each reader, enabling them to process more read queries and apply changes from the writer faster, which directly reduces replica lag.

Answer

Enable Multi-AZ for the cluster to improve read availability.

Answer

Increase the instance size of the writer instance to improve write throughput.

Question 18

A company is planning to modernize a legacy Java application that runs on a single on-premises server. The application uses a proprietary file-based storage system. The company wants to migrate to AWS with the following goals: reduce operational overhead, improve availability, and minimize code changes. Which THREE strategies should the company use? (Choose three.)

Accepted Answer

Use AWS Application Migration Service (MGN) to migrate the application server to Amazon EC2. AWS Application Migration Service (MGN) is correct because it automates the lift-and-shift migration of the on-premises server to Amazon EC2 with minimal downtime and no code changes, directly addressing the goal of reducing operational overhead and minimizing code changes. It replicates the entire server, including the proprietary file-based storage, to AWS, allowing the application to run unchanged.

Answer

Migrate the proprietary storage to Amazon S3

Answer

Refactor the application into microservices and deploy on Amazon EKS

Question 19

A company is planning to migrate a legacy application to AWS. The application runs on a single server with a monolithic architecture and uses an Oracle database. The migration team wants to reduce licensing costs and improve scalability. Which TWO strategies should the team consider?

Accepted Answer

Replatform the application to use AWS Elastic Beanstalk and Amazon RDS for PostgreSQL.. Option A is correct because replatforming the application to AWS Elastic Beanstalk reduces operational overhead by automating capacity provisioning, load balancing, and scaling, while migrating from Oracle to Amazon RDS for PostgreSQL eliminates Oracle licensing costs and provides a managed database service with built-in high availability and scalability. This approach directly addresses the company's goals of reducing licensing costs and improving scalability without requiring a full application rewrite.

Answer

Refactor the application into microservices and use Amazon DynamoDB for data storage.

Answer

Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with license-included.

Answer

Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with BYOL.

Question 20

A company is migrating a large e-commerce platform to AWS using a lift-and-shift approach. The application consists of a web tier, application tier, and a MySQL database. After migration, users report intermittent slow page loads. The operations team notices high CPU utilization on the application tier instances. Which THREE steps should the team take to address the performance issues?

Accepted Answer

Implement Amazon CloudFront to cache static content and reduce load on the web tier.. Option A is correct because implementing Amazon CloudFront to cache static content offloads requests from the web tier, reducing the number of dynamic requests that reach the application tier. This directly lowers CPU utilization on the application instances by minimizing the processing overhead for repeated static asset deliveries.

Answer

Replace the current application tier instances with larger instance types.

Answer

Move the MySQL database to Amazon RDS for MySQL and enable Multi-AZ deployment.