AWS Certified Solutions Architect Professional SAP-C02 SAP-C02 Questions 1651–1660 | Page 23/23

1651

MCQhard

A global e-commerce company uses AWS Organizations with over 500 accounts. They have a central security account that aggregates CloudTrail logs and VPC Flow Logs from all accounts. The security team needs to analyze these logs using Amazon Athena and visualize the results in Amazon QuickSight. The logs are stored in an S3 bucket in the security account, and each member account writes its own prefix. The current setup uses a bucket policy to allow member accounts to write logs. Recently, the security team has been unable to query logs for the past week. They suspect the issue is related to a new SCP that was applied to the root. The SCP denies s3:PutObject unless the request includes a specific tag. Which action should the security team take to restore log delivery without compromising security?

A.Remove the SCP from the root.

B.Modify the bucket policy to allow s3:PutObject without tags.

C.Modify the SCP to allow s3:PutObject for the CloudTrail and VPC Flow Logs service principals without requiring the tag.

D.Create a new S3 bucket without the tag requirement and reconfigure logging to use that bucket.

AnswerC

This allows the logging services to write logs while still requiring tags for other PutObject calls.

Why this answer

The SCP denies s3:PutObject unless the request includes a specific tag. CloudTrail and VPC Flow Logs do not automatically include tags. The solution is to modify the SCP to allow the necessary services even without the tag.

Option C allows the services to bypass the tag requirement.

Full explanation →

1652

MCQhard

A company wants to implement a least-privilege permission model across all AWS accounts. The security team needs to ensure that no IAM user has full administrator access. However, the operations team occasionally needs emergency access. Which solution meets these requirements?

A.Configure AWS IAM Identity Center with permission sets that grant temporary elevated access, and require approval for emergency access.

B.Use an SCP that denies all IAM actions except those from a specific admin account.

C.Use an IAM password policy that requires multi-factor authentication for all users.

D.Create an IAM role in each account with full administrator access and use a break-glass process to assume it.

AnswerA

IAM Identity Center allows time-limited, auditable access elevation.

Why this answer

AWS IAM Identity Center (formerly AWS SSO) allows you to define permission sets that grant temporary, scoped access to AWS accounts. By requiring approval for emergency access, you enforce a least-privilege model while still providing a controlled break-glass mechanism. This avoids permanent admin rights and ensures all elevated access is auditable and time-limited.

Exam trap

The trap here is that candidates often confuse a static IAM role with a break-glass process (Option D) as sufficient for least privilege, but they overlook that without temporary credentials and approval workflows, the role grants persistent full admin access to anyone who can assume it, violating the least-privilege principle.

How to eliminate wrong answers

Option B is wrong because an SCP that denies all IAM actions except from a specific admin account would block the operations team from assuming any role or performing IAM operations, including the emergency access they need, and does not provide a temporary elevation mechanism. Option C is wrong because an IAM password policy requiring MFA only controls password-based authentication for IAM users; it does not prevent a user from having full administrator access or provide a way to grant temporary elevated permissions. Option D is wrong because creating an IAM role with full administrator access in each account and using a break-glass process to assume it does not enforce least privilege—it grants permanent full admin access to anyone who can assume the role, and the 'break-glass' process is not inherently controlled or audited without additional mechanisms like approval workflows.

Full explanation →

1653

MCQeasy

A company uses AWS CloudFormation to manage infrastructure as code. They have a production stack that includes an EC2 instance, an RDS database, and an S3 bucket. Recently, an engineer manually terminated the EC2 instance from the console. The CloudFormation stack status shows UPDATE_ROLLBACK_FAILED. The company wants to recover the stack to a consistent state. What should they do?

A.Manually recreate the EC2 instance with the same configuration, then tell CloudFormation to continue the update rollback.

B.Create a change set to update the stack to ignore the EC2 instance.

C.Update the stack with a new template that removes the EC2 instance.

D.Delete the stack and recreate it using a new template.

AnswerA

Fixing the drift allows CloudFormation to continue the rollback and reach a consistent state.

Why this answer

When a stack update fails and rolls back, but the rollback itself fails due to a resource (like the EC2 instance) being manually terminated, the stack enters UPDATE_ROLLBACK_FAILED. The recommended recovery is to manually resolve the issue (recreate the EC2 instance with the same configuration) and then use the 'ContinueUpdateRollback' operation to finish the rollback to a consistent state. Option A correctly describes this process.

Option B is incorrect because creating a change set does not address the failed rollback. Option C is incorrect because updating the stack without fixing the underlying drift may fail. Option D is incorrect because deleting and recreating the stack is more drastic and may not be necessary.

Full explanation →

1654

Multi-Selecthard

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

Select 2 answers

A.Increase the SQS queue's visibility timeout to 6 minutes.

B.Set the Lambda function's reserved concurrency to 1.

C.Switch to a FIFO SQS queue and enable content-based deduplication.

D.Reduce the SQS batch size to 1.

E.Configure a dead-letter queue for the SQS queue.

AnswersA, C

Longer visibility timeout ensures messages are not reprocessed while being handled.

Why this answer

To prevent duplicate processing, the team should increase the SQS queue's visibility timeout to 6 minutes (option A). Since each message takes about 30 seconds to process, the default 60-second visibility timeout is too short; if processing exceeds 60 seconds, the message becomes visible again and is reprocessed. Increasing the timeout to 6 minutes (well above the 30-second processing time) ensures the message remains invisible until processing is complete.

Additionally, switching to a FIFO SQS queue with content-based deduplication (option C) provides exactly-once processing semantics, eliminating duplicates regardless of visibility timeout. Option B is incorrect because reserved concurrency limits the number of concurrent Lambda executions but does not prevent duplicates from visibility timeout issues. Option D is incorrect because reducing batch size limits how many messages are polled at once but does not address the root cause of duplicate processing.

Option E is incorrect because a dead-letter queue handles messages that fail repeatedly, not duplicates.

Exam trap

Candidates may mistakenly choose reducing batch size or setting reserved concurrency, thinking that limiting parallelism stops duplicates. However, duplicates here are caused by insufficient visibility timeout, not by concurrency.

Full explanation →

1655

Multi-Selectmedium

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Select 2 answers

A.AWS Key Management Service (KMS)

B.AWS Organizations Service Control Policies (SCPs)

C.AWS Config

D.AWS Identity and Access Management (IAM) Access Analyzer

E.AWS CloudTrail

AnswersB, D

SCPs can restrict permissions at the account level, enforcing least privilege.

Why this answer

AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Exam trap

The trap here is that candidates often confuse AWS Config (which detects compliance) with a service that enforces policies, or they think KMS or CloudTrail can restrict permissions, when in fact only SCPs and IAM Access Analyzer (for validating policies against least-privilege) directly support enforcing or validating a least-privilege model across multiple accounts.

Full explanation →

1656

MCQmedium

A company is implementing a data lake on Amazon S3. The data lake must be accessible from multiple accounts within the same AWS Organization. Objects must be encrypted at rest, and the company wants to use a single AWS KMS key for simplicity. Which solution meets these requirements?

A.Use SSE-S3 encryption. Grant cross-account access via bucket policy.

B.Use SSE-C encryption. Provide the same customer key to all accounts.

C.Use a customer managed AWS KMS key with a key policy that allows access from all accounts in the organization.

D.Use SSE-KMS with a key per account and use S3 bucket policy to allow cross-account access.

AnswerC

Allows centralized key management and cross-account access via key policy.

Why this answer

A multi-region key is not needed, and cross-account access requires key policy. Option A is wrong because SSE-S3 does not allow cross-account access control. Option B is wrong because SSE-C requires managing keys externally.

Option D is wrong because S3 bucket policies cannot grant access to KMS keys.

Full explanation →

1657

Multi-Selecthard

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Select 3 answers

A.Amazon CloudWatch Logs subscription filter in each account.

B.AWS CloudTrail in the central account only.

C.A central S3 bucket in the logging account.

D.A bucket policy on the central bucket that grants write access to the source accounts.

E.IAM roles in each source account with permissions to write to the central bucket.

AnswersC, D, E

Destination for logs.

Why this answer

A central S3 bucket in a dedicated logging account is the foundational component for aggregating logs from multiple AWS accounts. This bucket serves as the single destination for all log data, enabling centralized storage, analysis, and retention without exposing logs to individual source accounts.

Exam trap

The trap here is that candidates often assume CloudWatch Logs subscription filters are mandatory for S3-based logging, but they are actually used for real-time streaming to other services, not for writing logs directly to S3 from multiple accounts.

Full explanation →

1658

MCQhard

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

A.The application is using strongly consistent reads.

B.The DynamoDB write capacity is insufficient.

C.The application is updating the same item in multiple regions concurrently, and the last-writer-wins conflict resolution is causing data loss.

D.The DynamoDB global tables are not properly configured with conflict resolution.

AnswerC

Concurrent updates cause conflicts; LWW may overwrite data.

Why this answer

DynamoDB global tables use last-writer-wins (LWW) conflict resolution, and if the same item is updated concurrently in multiple regions, conflicts occur. Using conditional writes and application-level conflict resolution can help. Option A is wrong because strongly consistent reads are not supported for global tables; they only support eventual consistency.

Option B is wrong because write capacity insufficient would cause throttling, not write conflicts. Option D is wrong because DynamoDB global tables do have automatic conflict resolution via LWW; the issue is not misconfiguration but the concurrent updates.

Full explanation →

1659

MCQhard

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

A.AWS Storage Gateway File Gateway

B.Amazon EFS

C.Amazon EBS with multi-attach enabled

D.Amazon S3

AnswerB

EFS provides a fully managed, scalable NFS file system that can be mounted by many instances with strong consistency.

Why this answer

Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Exam trap

The trap here is that candidates often confuse Amazon EBS multi-attach with a shared file system, but EBS multi-attach is a block-level shared volume limited to a single AZ and does not provide file-level locking or POSIX semantics, making it unsuitable for concurrent file system access.

How to eliminate wrong answers

Option A is wrong because AWS Storage Gateway File Gateway provides on-premises caching of S3 objects via NFS/SMB, but it is designed for hybrid cloud access with higher latency and not optimized for low-latency concurrent EC2 mounting. Option C is wrong because Amazon EBS with multi-attach enabled supports only up to 16 Nitro-based EC2 instances in a single Availability Zone, lacks cross-AZ support, and does not provide a shared file system interface (it is a block device). Option D is wrong because Amazon S3 is an object storage service accessed via HTTPS API, not a file system that can be mounted with POSIX semantics, and it does not support concurrent file-level locking or low-latency NFS access.

Full explanation →

1660

MCQmedium

Refer to the exhibit. A company has attached this IAM policy to an IAM role used by an application running on an EC2 instance in a VPC with CIDR 10.0.0.0/16. The application is unable to read objects from the S3 bucket. What is the most likely cause?

A.The EC2 instance does not have an IAM instance profile.

B.The policy does not allow the s3:ListBucket action.

C.The condition key aws:SourceIp uses the private IP of the instance, but S3 sees the public IP.

D.The S3 bucket policy denies access.

AnswerC

The condition fails because traffic to S3 originates from the public IP.

Why this answer

The IAM policy uses the `aws:SourceIp` condition key with the private IP address of the EC2 instance (10.0.0.x). However, when the instance accesses S3, the request originates from the instance's public IP address (or the NAT gateway's public IP). Since the `aws:SourceIp` condition checks the source IP of the request, and it expects the private IP, the condition fails and denies access to the S3 bucket.

Therefore, the most likely cause is that the condition key uses the private IP but S3 sees the public IP (option C). Option A is incorrect because the instance has an IAM role attached (implied by the policy being attached to the role). Option B is incorrect because the `s3:GetObject` action is allowed, and `s3:ListBucket` is not required to read objects if the bucket policy allows it.

Option D is incorrect because the bucket policy is not mentioned and the issue lies with the IAM policy condition.

Full explanation →

AWS Certified Solutions Architect Professional SAP-C02 (SAP-C02) — Questions 1651–1660