Amazon SAP-C01 Online Practice Questions and Exam Preparation

Amazon SAP-C01 Online Questions & Answers

• Question 201:

  A company that tracks medical devices in hospitals wants to migrate its existing storage solution to the AWS Cloud. The company equips all of its devices with sensors that collect location and usage information. This sensor data is sent in unpredictable patterns with large spikes. The data is stored in a MySQL database running on premises at each hospital. The company wants the cloud storage solution to scale with usage.

  The company's analytics team uses the sensor data to calculate usage by device type and hospital. The team needs to keep analysis tools running locally while fetching data from the cloud. The team also needs to use existing Java application and SQL queries with as few changes as possible.

  How should a solutions architect meet these requirements while ensuring the sensor data is secure?

  A. Store the data in an Amazon Aurora Serverless database. Serve the data through a Network Load Balancer (NLB). Authenticate users using the NLB with credentials stored in AWS Secrets Manager.
  B. Store the data in an Amazon S3 bucket. Serve the data through Amazon QuickSight using an IAM user authorized with AWS Identity and Access Management (IAM) with the S3 bucket as the data source.
  C. Store the data in an Amazon Aurora Serverless database. Serve the data through the Aurora Data API using an IAM user authorized with AWS Identity and Access Management (IAM) and the AWS Secrets Manager ARN.
  D. Store the data in an Amazon S3 bucket. Serve the data through Amazon Athena using AWS PrivateLink to secure the data in transit.
  C. Store the data in an Amazon Aurora Serverless database. Serve the data through the Aurora Data API using an IAM user authorized with AWS Identity and Access Management (IAM) and the AWS Secrets Manager ARN.

• Question 202:

  During a security audit of a Service team's application, a Solutions Architect discovers that a username and password for an Amazon RDS database and a set of AWS IAM user credentials can be viewed in the AWS Lambda function code. The Lambda function uses the username and password to run queries on the database, and it uses the IAM credentials to call AWS services in a separate management account.

  The Solutions Architect is concerned that the credentials could grant inappropriate access to anyone who can view the Lambda code. The management account and the Service team's account are in separate AWS Organizations organizational units (OUs).

  Which combination of changes should the Solutions Architect make to improve the solution's security? (Choose two.)

  A. Configure Lambda to assume a role in the management account with appropriate access to AWS.
  B. Configure Lambda to use the stored database credentials in AWS Secrets Manager and enable automatic rotation.
  C. Create a Lambda function to rotate the credentials every hour by deploying a new Lambda version with the updated credentials.
  D. Use an SCP on the management account's OU to prevent IAM users from accessing resources in the Service team's account.
  E. Enable AWS Shield Advanced on the management account to shield sensitive resources from unauthorized IAM access.
  B. Configure Lambda to use the stored database credentials in AWS Secrets Manager and enable automatic rotation.
  D. Use an SCP on the management account's OU to prevent IAM users from accessing resources in the Service team's account.

• Question 203:

  True or false: In a CloudFormation template, you can reuse the same logical ID several times to reference the resources in other parts of the template.

  A. True, a logical ID can be used several times to reference the resources in other parts of the template.
  B. False, a logical ID must be unique within the template.
  C. False, you can mention a resource only once and you cannot reference it in other parts of a template.
  D. False, you cannot reference other parts of the template.
  B. False, a logical ID must be unique within the template.

• Question 204:

  The AWS IT infrastructure that AWS provides, complies with the following IT security standards, including:

  A. SOC 1/SSAE 16/ISAE 3402 (formerly SAS 70 Type II), SOC 2 and SOC 3
  B. FISMA, DIACAP, and FedRAMP
  C. PCI DSS Level 1, ISO 27001, ITAR and FIPS 140-2
  D. HIPAA, Cloud Security Alliance (CSA) and Motion Picture Association of America (MPAA)
  E. All of the above
  E. All of the above

• Question 205:

  You're trying to delete an SSL certificate from the IAM certificate store, and you're getting the message "Certificate: is being used by CloudFront." Which of the following statements is probably the reason why you are getting this error?

  A. Before you can delete an SSL certificate you need to set up https on your server.
  B. Before you can delete an SSL certificate, you need to set up the appropriate access level in IAM
  C. Before you can delete an SSL certificate, you need to either rotate SSL certificates or revert from using a custom SSL certificate to using the default CloudFront certificate.
  D. You can't delete SSL certificates. You need to request it from AWS.
  C. Before you can delete an SSL certificate, you need to either rotate SSL certificates or revert from using a custom SSL certificate to using the default CloudFront certificate.

• Question 206:

  A company wants to move a web application to AWS. The application stores session information locally on each web server, which will make auto scaling difficult. As part of the migration, the application will be rewritten to decouple the session data from the web servers. The company requires low latency, scalability, and availability.

  Which service will meet the requirements for storing the session information in the MOST cost-effective way?

  A. Amazon ElastiCache with the Memcached engine
  B. Amazon S3
  C. Amazon RDS MySQL
  D. Amazon ElastiCache with the Redis engine
  D. Amazon ElastiCache with the Redis engine

• Question 207:

  A company has deployed an application to multiple environments in AWS, including production and testing. The company has separate accounts for production and testing, and users are allowed to create additional application users for team members or services, as needed. The Security team has asked the Operations team for better isolation between production and testing with centralized controls on security credentials and improved management of permissions between environments.

  Which of the following options would MOST securely accomplish this goal?

  A. Create a new AWS account to hold user and service accounts, such as an identity account. Create users and groups in the identity account. Create roles with appropriate permissions in the production and testing accounts. Add the identity account to the trust policies for the roles.
  B. Modify permissions in the production and testing accounts to limit creating new IAM users to members of the Operations team. Set a strong IAM password policy on each account. Create new IAM users and groups in each account to limit developer access to just the services required to complete their job function.
  C. Create a script that runs on each account that checks user accounts for adherence to a security policy. Disable any user or service accounts that do not comply.
  D. Create all user accounts in the production account. Create roles for access in the production account and testing accounts. Grant cross-account access from the production account to the testing account.
  A. Create a new AWS account to hold user and service accounts, such as an identity account. Create users and groups in the identity account. Create roles with appropriate permissions in the production and testing accounts. Add the identity account to the trust policies for the roles.

• Question 208:

  A company is using AWS to run an internet-facing production application written in Node.js. The Development team is responsible for pushing new versions of their software directly to production. The application software is updated multiple times a day. The team needs guidance from a Solutions Architect to help them deploy the software to the production fleet quickly and with the least amount of disruption to the service.

  Which option meets these requirements?

  A. Prepackage the software into an AMI and then use Auto Scaling to deploy the production fleet. For software changes, update the AMI and allow Auto Scaling to automatically push the new AMI to production.
  B. Use AWS CodeDeploy to push the prepackaged AMI to production. For software changes, reconfigure CodeDeploy with new AMI identification to push the new AMI to the production fleet.
  C. Use AWS Elastic Beanstalk to host the production application. For software changes, upload the new application version to Elastic Beanstalk to push this to the production fleet using a blue/green deployment method.
  D. Deploy the base AMI through Auto Scaling and bootstrap the software using user data. For software changes, SSH to each of the instances and replace the software with the new version.
  A. Prepackage the software into an AMI and then use Auto Scaling to deploy the production fleet. For software changes, update the AMI and allow Auto Scaling to automatically push the new AMI to production.

• Question 209:

  You want to use AWS CodeDeploy to deploy an application to Amazon EC2 instances running within an Amazon Virtual Private Cloud (VPC). What criterion must be met for this to be possible?

  A. The AWS CodeDeploy agent installed on the Amazon EC2 instances must be able to access only the public AWS CodeDeploy endpoint.
  B. The AWS CodeDeploy agent installed on the Amazon EC2 instances must be able to access only the public Amazon S3 service endpoint.
  C. The AWS CodeDeploy agent installed on the Amazon EC2 instances must be able to access the public AWS CodeDeploy and Amazon S3 service endpoints.
  D. It is not currently possible to use AWS CodeDeploy to deploy an application to Amazon EC2 instances running within an Amazon Virtual Private Cloud (VPC.)
  C. The AWS CodeDeploy agent installed on the Amazon EC2 instances must be able to access the public AWS CodeDeploy and Amazon S3 service endpoints.

• Question 210:

  A large payroll company recently merged with a small staffing company. The unified company now has multiple business units, each with its own existing AWS account.

  A solutions architect must ensure that the company can centrally manage the billing and access policies for all the AWS accounts. The solutions architect configures AWS Organizations by sending an invitation to all member accounts of the

  company from a centralized management account.

  What should the solutions architect do next to meet these requirements?

  A. Create the OrganizationAccountAccess IAM group in each member account. Include the necessary IAM roles for each administrator.
  B. Create the OrganizationAccountAccessPolicy IAM policy in each member account. Connect the member accounts to the management account by using cross-account access.
  C. Create the OrganizationAccountAccessRole IAM role in each member account. Grant permission to the management account to assume the IAM role.
  D. Create the OrganizationAccountAccessRole IAM role in the management account Attach the Administrator Access AWS managed policy to the IAM role. Assign the IAM role to the administrators in each member account.
  C. Create the OrganizationAccountAccessRole IAM role in each member account. Grant permission to the management account to assume the IAM role.