SAP-C02 Practice Questions

Question 1

A company is designing a new multi-tier web application on AWS. The application uses an Auto Scaling group of EC2 instances for the web tier and an Amazon RDS for PostgreSQL DB instance for the database. To improve security, the company wants to ensure that the web tier instances can connect to the database only through a specific port and that the database is not accessible from the internet. Which steps should the company take? (Choose THREE.)

Accepted Answer

Configure the database security group to allow inbound traffic on port 5432 from the web tier security group.. The database security group should allow inbound traffic on port 5432 (the default PostgreSQL port) from the web tier security group. This creates a security group-level firewall rule that restricts database access to only the web tier instances, ensuring no other sources can connect.

Answer

Launch the database instance in a public subnet.

Answer

Store database credentials in AWS Systems Manager Parameter Store.

Question 2

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 3

A company wants to provide its developers with access to a shared development environment in AWS. The developers are in different AWS accounts, and they need to assume an IAM role in the development account. What is the secure way to allow cross-account access?

Accepted Answer

Create an IAM role in the development account with a trust policy that allows the developers' accounts to assume it. It uses an IAM role with a trust policy that explicitly grants principals from other AWS accounts permission to assume the role. This is the standard secure method for cross-account access, as it avoids sharing long-term credentials and allows temporary, scoped access via AWS Security Token Service (STS) AssumeRole API.

Answer

Use a service control policy to allow access from other accounts

Answer

Create IAM users in the development account for each developer

Answer

Share the access keys of an IAM user in the development account

Question 4

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by business unit. Each business unit has its own AWS account. The team needs a solution that allows them to generate cost reports filtered by business unit without additional overhead. Which action should be taken?

Accepted Answer

Apply tags to resources and enable cost allocation tags in Billing and Cost Management.. Applying tags to resources and enabling cost allocation tags in AWS Billing and Cost Management allows the finance team to categorize costs by business unit without additional overhead. Each business unit's AWS account can have resources tagged with a key like 'BusinessUnit', and once cost allocation tags are activated, Cost Explorer and cost reports can filter and group by these tags, providing automated cost tracking across accounts in AWS Organizations.

Answer

Use Cost Explorer to filter by linked account, which automatically groups by business unit.

Answer

Use AWS Budgets to create budgets per account and manually aggregate.

Answer

Create a separate payer account for each business unit.

Question 5

A company is using AWS Organizations and wants to centralize the management of Amazon EC2 instance security groups. The security team needs to enforce that certain ports are not open to the internet across all accounts. The company currently uses AWS Firewall Manager. Which approach should the security team use to enforce this policy?

Accepted Answer

Use AWS Firewall Manager to create a security group policy that defines rules, and apply it across all accounts. Firewall Manager will automatically create and manage security groups.. AWS Firewall Manager can centrally create, apply, and manage security group policies across all accounts in an AWS Organization. By defining a security group policy with rules that block specific ports from 0.0.0.0/0, Firewall Manager automatically creates the required security groups and attaches them to the designated resources, ensuring compliance without manual intervention. This approach directly enforces the policy rather than just detecting or reporting violations.

Answer

Use AWS Config rules to detect non-compliant security groups and trigger a Lambda function to remediate.

Answer

Use AWS Firewall Manager to audit security groups against a baseline policy and generate reports.

Answer

Use an SCP to deny ec2:AuthorizeSecurityGroupIngress for ports that should not be open.

Question 6

A company is designing a disaster recovery solution for a critical application running on EC2 with data in an Amazon RDS MySQL Multi-AZ DB instance. The recovery time objective (RTO) is 15 minutes and recovery point objective (RPO) is 1 hour. Which strategy meets these requirements?

Accepted Answer

Create a cross-Region read replica of the RDS DB instance.. A cross-Region read replica of an Amazon RDS MySQL DB instance provides asynchronous replication with a typical replication lag of seconds to minutes, meeting the RPO of 1 hour and RTO of 15 minutes by promoting the replica to a standalone instance in the event of a disaster. This approach minimizes data loss and allows rapid failover without relying on snapshot restoration or backup copying.

Answer

Enable Multi-AZ in a different Region.

Answer

Take daily snapshots of the RDS DB instance and copy them to another Region.

Answer

Use Amazon S3 cross-Region replication for database backups.

Question 7

A company wants to store application logs in a centralized location for analysis. The logs are generated by EC2 instances in an Auto Scaling group. The solution must be cost-effective and support real-time analysis. Which service should be used to collect and analyze the logs?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is the correct choice because it natively integrates with EC2 instances via the CloudWatch Logs agent to collect, monitor, and analyze log data in real time. It provides a centralized log storage with built-in metric filters and subscription filters for real-time analysis, making it cost-effective for logs generated by Auto Scaling groups without requiring additional infrastructure.

Answer

Amazon S3

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Elasticsearch Service

Question 8

A company has a centralized AWS account for security tools and multiple member accounts. They want to use AWS GuardDuty to detect threats across all accounts. They have enabled GuardDuty in the management account and invited all member accounts. GuardDuty is set to send findings to a central S3 bucket in the security account. However, findings from member accounts are not appearing in the central S3 bucket. The security account has a bucket policy that allows the GuardDuty service principal to write findings. What is the most likely cause?

Accepted Answer

Each member account must individually configure the S3 bucket as a publishing destination for its own findings.. For GuardDuty to send findings to a central S3 bucket, each member account must configure the publishing destination as well. Simply enabling GuardDuty in the management account does not automatically forward findings from member accounts to a central bucket. Option A is wrong because the bucket policy is already in place. Option B is wrong because GuardDuty supports cross-account. Option C is wrong because there is no such setting.

Answer

The GuardDuty detector in the management account is not configured to publish findings to S3.

Answer

GuardDuty cannot send findings from member accounts to a central S3 bucket; it only supports CloudWatch Events.

Answer

The S3 bucket policy does not grant the GuardDuty service principal from member accounts write access.

Question 9

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that uses standard SQL to analyze data directly in Amazon S3. It is optimized for querying large datasets with a pay-per-query model, and it automatically minimizes data scanned by leveraging features like columnar data formats (Parquet, ORC), partitioning, and compression to reduce the amount of data read per query.

Answer

Amazon Redshift Spectrum

Answer

Amazon EMR

Answer

Amazon QuickSight

Question 10

A company is migrating to AWS and plans to use a multi-account strategy. The management account will be used solely for administrative purposes. Which best practice should be followed when setting up AWS Organizations?

Accepted Answer

Restrict access to the management account and use it only for organization management tasks.. The management account in AWS Organizations should be strictly restricted and used only for organization-wide administrative tasks, such as managing member accounts, applying service control policies (SCPs), and consolidating billing. This follows the AWS Well-Architected Framework's security pillar, which recommends isolating the management account from any workload or resource deployment to minimize the blast radius of a potential compromise. Using the management account for anything other than organization management violates the principle of least privilege and increases security risk.

Answer

Enable all AWS services in the management account to centrally manage them.

Answer

Use the management account as the payer account and also host production workloads.

Answer

Use the management account for development environments to avoid creating additional accounts.

Question 11

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

Accepted Answer

Define an IAM task role with S3 access policies and reference it in the ECS task definition.. An IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Answer

Attach an IAM role to the underlying EC2 instance.

Answer

Assign an IAM role to the ECS service using the ECS service-linked role.

Answer

Store AWS credentials in the container environment variables.

Question 12

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

Accepted Answer

AWS Storage Gateway (File Gateway). AWS Storage Gateway (File Gateway) provides a low-latency, on-premises cache for frequently accessed data while asynchronously uploading the underlying data to Amazon S3 for durable backup. This hybrid architecture allows applications to access data with local file-system performance while leveraging S3 as the backup target, meeting both the low-latency and backup requirements.

Answer

Amazon EFS

Answer

AWS Snowball Edge

Answer

AWS Direct Connect

Question 13

A company uses AWS Config to evaluate resource compliance across multiple accounts. The security team wants to automatically remediate non-compliant resources using AWS Systems Manager Automation documents. Which solution is MOST scalable and secure?

Accepted Answer

Enable AWS Config rules with automatic remediation using SSM Automation documents in each account, and use an AWS Config aggregator to monitor compliance across all accounts. It leverages AWS Config's native automatic remediation feature, which directly associates SSM Automation documents with Config rules to remediate non-compliant resources as soon as they are detected. This approach is scalable as it operates within each account without requiring custom Lambda functions or external triggers, and it is secure because remediation actions are defined and controlled by the SSM Automation documents, which can be centrally managed. The use of an AWS Config aggregator provides a single-pane-of-glass view across all accounts for monitoring compliance, meeting the security team's requirements efficiently.

Answer

Create a Lambda function in each account that periodically checks Config rules and triggers remediation

Answer

Set up Amazon CloudWatch Events rules in each account to detect Config compliance changes and invoke remediation Lambda functions

Answer

Use AWS Organizations service control policies to automatically remediate non-compliant resources

Question 14

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 15

A company is designing a new application that will process streaming data from thousands of IoT devices. The data must be ingested in real time and then processed using Apache Flink. Which services should be used? (Choose TWO.)

Accepted Answer

Amazon Kinesis Data Streams. Amazon Kinesis Data Streams is the correct ingestion service because it provides a durable, scalable, real-time data streaming platform that can handle the high throughput from thousands of IoT devices. It stores data in shards for up to 365 days, enabling Apache Flink to consume and process the data with exactly-once semantics and low latency.

Answer

AWS Lambda

Answer

Amazon Kinesis Data Firehose

Answer

Amazon Simple Queue Service (SQS)

AWS Certified Solutions Architect Professional SAP-C02 practice test

Three ways to study

Study SAP-C02 by domain

Study SAP-C02 by topic

Design Solutions for Organizational Complexity practice questions

Design for New Solutions practice questions

Continuous Improvement for Existing Solutions practice questions

Accelerate Workload Migration and Modernization practice questions

SAA-C03 VPC practice questions

SAA-C03 S3 lifecycle policy questions

SAA-C03 RDS Multi-AZ questions

SAA-C03 IAM policy practice questions

SAA-C03 Route 53 failover questions

SAA-C03 CloudFront practice questions

SAA-C03 NAT gateway questions

SAA-C03 VPC endpoint questions

Top SAP-C02 questions

AWS Certified Solutions Architect Professional SAP-C02 practice questions

How to use these SAP-C02 questions

Quick answer