SAP-C02 Practice Questions

Question 1

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption with SSE-KMS on the S3 bucket.. Option A is correct because enabling default encryption with SSE-KMS on the S3 bucket ensures all objects are encrypted at rest using AWS KMS-managed keys, satisfying the encryption requirement without relying on each uploader to set encryption headers. Option E is correct because an S3 bucket policy that allows access only from specific IAM roles enforces least-privilege authorization, ensuring that only the intended IAM principals can read or write the Parquet data. Option B is not required because server-side encryption with SSE-KMS already meets the encryption-at-rest requirement, and client-side encryption adds key-management complexity without being mandated. Option C is incorrect because S3 server access logging only records request activity for auditing; it does not control access or encrypt data. Option D is incorrect because bucket ACLs are legacy, coarse-grained access mechanisms and cannot express the fine-grained, role-based authorization that a bucket policy provides.

Answer

Use client-side encryption before uploading to S3.

Answer

Enable S3 server access logging.

Answer

Use a bucket ACL to grant access to the data lake.

Question 2

A company is migrating a multi-tier web application to AWS and wants to use Infrastructure as Code (IaC) to automate provisioning. Which AWS services can the company use to define and manage infrastructure declaratively? (Choose TWO.)

Accepted Answer

AWS CloudFormation. AWS CloudFormation (B) is correct because it lets you define infrastructure declaratively in JSON or YAML templates, and CloudFormation provisions and manages those resources as stacks. AWS Cloud Development Kit (CDK) (D) is also correct because it allows infrastructure to be defined declaratively using familiar programming languages, which then synthesizes into CloudFormation templates for deployment. AWS Elastic Beanstalk (A) is not the best fit because it is a PaaS that deploys applications from code or configuration but does not itself provide a general declarative IaC language for defining arbitrary infrastructure. AWS OpsWorks (C) uses Chef/Puppet for configuration management and is more procedural/imperative in practice, not a declarative IaC service in the CloudFormation/CDK sense. AWS CodeDeploy (E) is a deployment orchestration service for applications, not an infrastructure definition or provisioning service.

Answer

AWS Elastic Beanstalk

Answer

AWS OpsWorks

Answer

AWS CodeDeploy

Question 3

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 4

A solutions architect is designing a new serverless application using AWS Lambda for business logic, Amazon API Gateway for RESTful APIs, and Amazon DynamoDB for data storage. The application will experience unpredictable traffic spikes. What is the MOST cost-effective way to handle concurrency and scaling?

Accepted Answer

Use Lambda reserved concurrency to set a limit on concurrent executions.. Lambda reserved concurrency sets a hard limit on the number of concurrent executions for a function, preventing runaway scaling and controlling costs during unpredictable traffic spikes. It ensures that the function does not consume more concurrency than allocated, which avoids excessive DynamoDB read/write capacity usage and keeps costs predictable without needing to pre-warm instances.

Answer

Use Lambda provisioned concurrency to pre-warm instances.

Answer

Configure DynamoDB auto scaling to handle traffic spikes.

Answer

Set a usage plan in API Gateway with a throttling limit.

Question 5

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

Accepted Answer

Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.. A Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Answer

Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

Answer

Use AWS CloudFormation templates that specify t3.micro.

Answer

Use AWS Config rules to terminate non-compliant instances.

Question 6

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. Option B is correct because PostgreSQL listens on TCP port 5432, and referencing the web tier's security group as the source in the RDS security group's inbound rule allows only those EC2 instances to reach the database on that port. Option D is correct because placing the web tier instances in a private subnet removes them from direct internet exposure while still allowing outbound access to the RDS endpoint. Option E is correct because setting the RDS instance's 'Publicly accessible' option to 'No' ensures the database receives only a private IP address and cannot be reached from the internet. Option A is wrong because a public subnet would expose the database to internet routing, contradicting the requirement. Option C, while a good credential-management practice, does not control network access or port restrictions and is therefore not part of the required steps.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 7

A company is migrating a critical application to AWS and needs to ensure business continuity during the migration. The application must remain available with minimal downtime. Which AWS service should be used to replicate data continuously?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication. AWS Database Migration Service (DMS) with ongoing replication (Option B) provides continuous, near-real-time data replication from source to target, enabling minimal-downtime cutover during a migration. It supports homogeneous and heterogeneous migrations and keeps the target in sync until the application is switched over, which is exactly what business continuity during migration requires.

Answer

AWS Direct Connect

Answer

Amazon S3 Transfer Acceleration

Answer

AWS Snowball Edge

Question 8

A company wants to centralize AWS CloudTrail logs from all accounts in AWS Organizations into a single S3 bucket. Which configuration is required?

Accepted Answer

Create an organization trail in the management account that is enabled for all accounts. AWS Organizations supports creating an organization trail in the management account that automatically applies to all accounts in the organization. This centralizes CloudTrail logs from every account into a single S3 bucket without requiring per-account configuration, ensuring consistent logging and simplifying management.

Answer

Configure each account's CloudTrail to send logs to a central CloudWatch Logs group

Answer

Create a CloudTrail trail in each account and deliver logs to the same S3 bucket

Answer

Use S3 replication to copy logs from individual account buckets to a central bucket

Question 9

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

Accepted Answer

VPC Reachability Analyzer.. VPC Reachability Analyzer (D) is correct because it performs static analysis of the VPC configuration and traces the path between a source and destination (such as two EC2 instances) to determine whether packets can reach the target, identifying blocking components like security groups, NACLs, route tables, and gateways. VPC Flow Logs (E) is correct because it captures IP traffic metadata (source/destination IP, ports, protocol, ACCEPT/REJECT) for ENIs, subnets, or VPCs, which is used to diagnose connectivity and traffic-filtering issues between EC2 instances. Amazon Inspector (A) is wrong because it is a vulnerability management service that scans workloads for software vulnerabilities and unintended network exposure, not a connectivity troubleshooting tool. AWS CloudTrail (B) is wrong because it records API activity and account actions for auditing, not packet-level or path-level network reachability. AWS Config (C) is wrong because it evaluates resource configuration compliance and changes over time, not live network connectivity between instances.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Answer

AWS Config.

Question 10

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has a relational database with complex queries. The team wants to minimize changes to the existing codebase. Which database migration strategy should be recommended?

Accepted Answer

Use Amazon RDS for MySQL or PostgreSQL with read replicas.. Using Amazon RDS with the same database engine (MySQL or PostgreSQL) minimizes code changes, as the application can connect via standard SQL drivers. Read replicas can help with read scaling without altering the codebase. Option B is wrong because Aurora Serverless may require configuration changes and does not necessarily minimize code changes. Option C is wrong because S3 and Athena are not suitable for transactional relational queries and would require significant architectural changes. Option D is wrong because DynamoDB would require schema redesign and application changes to use NoSQL.

Answer

Use Amazon Aurora Serverless to reduce management.

Answer

Store data in Amazon S3 and use Athena for queries.

Answer

Migrate to Amazon DynamoDB for scalability.

Question 11

A solutions architect is reviewing an application that writes millions of small records per hour to an Amazon DynamoDB table. The table uses a partition key of customer ID, and a few very large customers generate most of the traffic. During peak periods, the application receives ProvisionedThroughputExceededException errors even though total consumed capacity is below the provisioned amount. Which action will resolve the throttling MOST effectively?

Accepted Answer

Redesign the table to use a composite partition key that appends a random or calculated suffix to the customer ID, distributing writes across more partitions.. The throttling is caused by hot partitions, where a few high-traffic customer IDs exceed the per-partition throughput ceiling despite ample table-level capacity. Appending a random or calculated suffix to the partition key spreads each large customer's writes across many partitions, eliminating the bottleneck. Simply adding capacity, switching to on-demand, or moving to an index with the same skewed key does not redistribute the load.

Answer

Switch the table from provisioned capacity to on-demand capacity mode so DynamoDB automatically handles all traffic spikes.

Answer

Create a global secondary index on the customer ID attribute and direct all reads and writes to the index instead of the base table.

Answer

Enable DynamoDB auto scaling to increase the provisioned read and write capacity units when consumed capacity approaches the limit.

Question 12

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO).. Option A is correct because RTO (maximum tolerable downtime) and RPO (maximum tolerable data loss) are the foundational business requirements that drive every DR design decision, such as whether to use pilot light, warm standby, or multi-site active-active. Option B is correct because the data replication strategy determines actual data loss and recovery behavior: synchronous replication (e.g., Aurora Global Database or Multi-AZ) gives near-zero RPO but adds latency, while asynchronous replication (e.g., S3 Cross-Region Replication, RDS read replicas) lowers latency but risks losing recent writes. Option C is correct because Amazon Route 53 failover routing with health checks is the mechanism that redirects client traffic to the standby Region during a disaster, making it essential for reducing RTO in a multi-tier application. Option D is not one of the three because deploying across multiple Availability Zones addresses high availability within a single Region, not disaster recovery across Regions, which is the scope of a DR plan. Option E is not one of the three because instance sizing affects performance and cost, not recovery time, recovery point, or failover capability, so it is irrelevant to DR design.

Answer

Deploying the application across multiple Availability Zones.

Answer

Using larger instance sizes for better performance.

Question 13

A company is migrating a web application to AWS and wants to automatically scale the application based on CPU utilization. The application runs on a set of EC2 instances behind an Application Load Balancer. Which combination of AWS services should they use?

Accepted Answer

Auto Scaling group with a simple scaling policy based on CloudWatch CPU alarm. Auto Scaling group with a simple scaling policy based on a CloudWatch CPU alarm. This directly scales EC2 instances in response to CPU utilization, providing automatic scaling. Option A is incorrect because AWS Lambda with scheduled scaling does not dynamically respond to CPU utilization; it's time-based. Option B (Amazon CloudFront) is a content delivery network, not a scaling mechanism. Option C (Elastic Beanstalk) manages environments but the underlying scaling relies on Auto Scaling groups; the question asks for the combination of services, and the core scaling service is the Auto Scaling group. Therefore, D is the correct choice.

Answer

AWS Lambda with scheduled scaling

Answer

Amazon CloudFront with origin scaling

Answer

AWS Elastic Beanstalk with environment scaling

Question 14

A company is designing a new microservices architecture on AWS. Each service must be independently deployable and scale based on demand. The company wants to minimize operational overhead for container orchestration. Which AWS service should the company use?

Accepted Answer

Amazon Elastic Container Service (ECS) with AWS Fargate. Amazon ECS with AWS Fargate is the correct choice because it provides a fully managed container orchestration service that eliminates the need to provision, configure, or scale underlying EC2 instances. Fargate runs each container in its own isolated compute environment, allowing each microservice to scale independently based on demand while minimizing operational overhead for cluster management.

Answer

Amazon Elastic Kubernetes Service (EKS)

Answer

Amazon EC2 with Auto Scaling

Answer

AWS Lambda

Question 15

Refer to the exhibit. A solutions architect is troubleshooting why EC2 instances launched in subnet-11111111 cannot access the internet. The subnet is in a VPC with an internet gateway attached. The route table for the subnet has a default route (0.0.0.0/0) pointing to the internet gateway. What is the MOST likely cause?

Accepted Answer

The subnet's auto-assign public IP setting is disabled. The most likely cause is that the subnet's auto-assign public IP setting is disabled. Even though the subnet has a default route (0.0.0.0/0) pointing to an internet gateway, EC2 instances launched in that subnet will not receive a public IP address automatically unless the subnet's 'Auto-assign public IPv4 address' setting is enabled. Without a public IP (or an Elastic IP), the instance cannot communicate with the internet through the internet gateway, as the internet gateway requires a public IP for return traffic routing.

Answer

The internet gateway is not attached to the VPC

Answer

The subnet needs a NAT gateway for internet access

Answer

The subnet's route table does not have a route to the internet gateway

AWS Certified Solutions Architect Professional SAP-C02 practice test

Three ways to study

Study SAP-C02 by domain

Study SAP-C02 by topic

Design for New Solutions practice questions

Design Solutions for Organizational Complexity practice questions

Accelerate Workload Migration and Modernization practice questions

Continuous Improvement for Existing Solutions practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Top SAP-C02 questions

AWS Certified Solutions Architect Professional SAP-C02 practice questions