SAP-C02 Timed Practice Test 4 — 10 Questions

Question 1

A company is using AWS Organizations with multiple organizational units (OUs). The security team needs to enforce that all newly created S3 buckets in the production OU have versioning enabled and are encrypted with AWS KMS. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Apply a service control policy (SCP) at the production OU level that denies s3:CreateBucket unless versioning and KMS encryption are specified in the request.. A service control policy (SCP) at the OU level can deny the s3:CreateBucket action unless the request includes both the x-amz-bucket-object-locked-enabled-for-bucket-creation header (for versioning) and the x-amz-server-side-encryption-aws-kms-key-id header (for KMS encryption). This enforces compliance at the API level with no ongoing overhead, as the SCP is evaluated before the bucket is created, preventing noncompliant buckets from existing at all.

Answer

Use AWS CloudTrail to monitor bucket creation and send alerts to the security team.

Answer

Create an IAM policy that requires versioning and KMS encryption when creating buckets, and attach it to all users.

Answer

Use AWS Config rules to detect noncompliant buckets and auto-remediate with Lambda.

Question 2

A financial services company is designing a multi-account strategy using AWS Control Tower. The company has strict data residency requirements: customer data must remain in the country of origin. The company operates in three countries: US, UK, and Germany. Each country has a set of accounts for production, development, and testing. The company needs to ensure that IAM roles in UK accounts cannot access resources in German accounts, and vice versa. Which architecture should be used?

Accepted Answer

Create separate OUs for each country (US, UK, Germany) under Control Tower. Apply SCPs at each country OU that deny access to resources in other country OUs.. Option D is correct because AWS Control Tower allows you to create separate Organizational Units (OUs) for each country, and Service Control Policies (SCPs) can be applied at the OU level to explicitly deny access to resources in other country OUs. This enforces data residency by preventing IAM roles in UK accounts from accessing German resources, and vice versa, using a deny-all-cross-region or deny-all-cross-account approach scoped to the specific country OUs.

Answer

Create one OU per account type (Prod, Dev, Test) and use SCPs to restrict access to resources based on tags.

Answer

Create a single OU for all accounts and use IAM permissions boundaries to restrict access.

Answer

Use AWS Resource Access Manager to share resources only within the same country and use IAM policies to restrict cross-country access.

Question 3

A company is designing a new application on AWS that requires a highly available and scalable web tier. The web servers must be stateless and scale automatically based on CPU utilization. Which TWO actions should the company take to meet these requirements?

Accepted Answer

Configure an Auto Scaling group with a launch template that includes a user data script to bootstrap the web server. Option A is correct because a launch template with user data allows the Auto Scaling group to bootstrap web server software automatically when new instances launch, ensuring they are stateless and ready to serve traffic. Option B is correct because attaching an Application Load Balancer (ALB) distributes incoming traffic across the Auto Scaling group's instances, enabling horizontal scaling and high availability. Together, these actions support stateless web servers that scale based on CPU utilization via Auto Scaling policies.

Answer

Configure lifecycle hooks in the Auto Scaling group to drain connections

Answer

Use a single large EC2 instance (e.g., c5n.18xlarge) to handle all traffic

Answer

Use a Network Load Balancer to distribute traffic to web servers

Question 4

A company wants to migrate a monolithic application to AWS and redesign it using microservices. The application uses a MySQL database. The company wants to minimize operational overhead and enable each microservice to have its own database. Which AWS service should the company use to implement the database layer?

Accepted Answer

Amazon RDS for MySQL. Amazon RDS for MySQL is the correct choice because it provides a managed MySQL database service that minimizes operational overhead through automated backups, patching, and scaling. Each microservice can have its own RDS instance, enabling database-per-service isolation while offloading administrative tasks like replication and failover to AWS.

Answer

Amazon DynamoDB

Answer

Amazon Redshift

Answer

Amazon Aurora

Question 5

A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?

Accepted Answer

Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.. AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.

Answer

Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.

Answer

Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.

Answer

Store the configuration data in environment variables in the ECS task definition.

Question 6

A company is migrating a monolithic application to microservices on Amazon ECS with Fargate. The application has variable traffic patterns, with high traffic during business hours and low traffic at night. They want to optimize costs while maintaining performance. Which scaling strategy should they implement?

Accepted Answer

Use target tracking scaling with a schedule to increase minimum capacity during business hours.. Option A is correct because combining target tracking scaling with a scheduled action allows the application to dynamically adjust capacity based on actual demand while ensuring a higher baseline during peak business hours. This hybrid approach optimizes costs by scaling down at night and maintains performance by preventing cold starts or lag during traffic spikes, which is ideal for variable patterns on ECS Fargate.

Answer

Use step scaling policies based on memory utilization.

Answer

Use scheduled scaling to increase capacity during business hours.

Answer

Use simple scaling policies based on CPU utilization.

Question 7

A company is designing a serverless application using AWS Lambda functions. The application processes events from an Amazon SQS queue. The company wants to ensure that the Lambda function can scale to handle a sudden increase in messages without losing any messages. The Lambda function must process each message at least once. Which configuration should the company use?

Accepted Answer

Configure the SQS queue as a Lambda event source with a reserved concurrency of 1000 for the Lambda function.. Option A is correct because configuring the SQS queue as a Lambda event source with a reserved concurrency of 1000 ensures that Lambda can scale up to 1000 concurrent executions to handle a sudden burst of messages. The SQS event source uses long polling and synchronously invokes Lambda, which processes messages in batches and automatically deletes them from the queue only upon successful completion, guaranteeing at-least-once processing. Reserved concurrency prevents throttling and ensures that the function has sufficient capacity to scale without losing messages.

Answer

Configure the SQS queue to invoke the Lambda function asynchronously and set the Lambda function timeout to 5 minutes.

Answer

Set the SQS queue visibility timeout to 30 seconds and the Lambda batch size to 100. Configure a dead-letter queue for failed messages.

Answer

Use an SQS FIFO queue with a Lambda function that has a reserved concurrency of 1.

Question 8

Drag and drop the steps to deploy a serverless application using AWS SAM in the correct order.

Question 9

Drag and drop the steps to set up a cross-region VPC peering connection in the correct order.

Question 10

Drag and drop the steps to set up AWS CloudTrail for logging API activity in the correct order.