Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 161:

  An education company is running a web application used by college students around the world. The application runs in an Amazon Elastic Container Service {Amazon ECS) cluster in an Auto Scaling group behind an Application Load Balancer (ALB). A system administrator detects a weekly spike in the number of failed login attempts, which overwhelm the application's authentication service. All the failed login attempts originate from about 500 different IP addresses that change each week, A solutions architect must prevent the failed login attempts from overwhelming the authentication service.

  Which solution meets these requirements with the MOST operational efficiency?

  A. Use AWS Firewall Manager to create a security group and security group policy to deny access from the IP addresses.
  B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the ALB.
  C. Use AWS Firewall Manager to create a security group and security group policy to allow access only to specific CIOR ranges.
  D. Create an AWS WAF web ACL with an IP set match rule, and set the rule action to Block. Connect the web ACL to the ALB.
  B. Create an AWS WAF web ACL with a rate-based rule, and set the rule action to Block. Connect the web ACL to the ALB.

  ---

  Explanation

  https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

  The IP set match statement inspects the IP address of a web request against a set of IP addresses and address ranges. Use this to allow or block web requests based on the IP addresses that the requests originate from. By default, AWS WAF uses the IP address from the web request origin, but you can configure the rule to use an HTTP header like X- Forwarded-For instead.

  https://docs.aws.amazon.com/

  waf/latest/developerguide/waf-rule-statement-type-ipset-match.html

  https://docs.aws.amazon.com/waf/latest/developerguide/waf-rule-statement-type-rate-based.html

• Question 162:

  An adventure company has launched a new feature on its mobile app. Users can use the feature to upload their hiking and ratting photos and videos anytime. The photos and videos are stored in Amazon S3 Standard storage in an S3 bucket and are served through Amazon CloudFront.

  The company needs to optimize the cost of the storage. A solutions architect discovers that most of the uploaded photos and videos are accessed infrequently after 30 days. However, some of the uploaded photos and videos are accessed frequently after 30 days. The solutions architect needs to implement a solution that maintains millisecond retrieval availability of the photos and videos at the lowest possible cost.

  Which solution will meet these requirements?

  A. Configure S3 Intelligent-Tiering on the S3 bucket.
  B. Configure an S3 Lifecycle policy to transition image objects and video objects from S3 Standard to S3 Glacier Deep Archive after 30 days.
  C. Replace Amazon S3 with an Amazon Elastic File System (Amazon EFS) file system that is mounted on Amazon EC2 instances.
  D. Add a Cache-Control: max-age header to the S3 image objects and S3 video objects. Set the header to 30 days.
  A. Configure S3 Intelligent-Tiering on the S3 bucket.

  ---

  Explanation

  The correct answer is A. Configure S3 Intelligent-Tiering on the S3 bucket.

  Amazon S3 Intelligent-Tiering is a storage class that automatically moves objects between two access tiers based on changing access patterns. Objects that are accessed frequently are stored in the frequent access tier and objects that are accessed infrequently are stored in the infrequent access tier. This allows for cost optimization without requiring manual intervention. This makes it an ideal solution for the scenario described, as it can automatically move objects that are infrequently accessed after 30 days to a lower-cost storage tier while still maintaining millisecond retrieval availability.

• Question 163:

  A company runs an application that gives users the ability to search for videos and related information by using keywords that are curated from content providers. The application data is stored in an on-premises Oracle database that is 800 GB in size.

  The company wants to migrate the data to an Amazon Aurora MySQL DB instance. A solutions architect plans to use the AWS Schema Conversion Tool and AWS Database Migration Service (AWS DMS) for the migration. During the migration, the existing database must serve ongoing requests. The migration must be completed with minimum downtime.

  Which solution will meet these requirements?

  A. Create primary key indexes, secondary indexes, and referential integrity constraints in the target database before starting the migration process
  B. Use AWS DMS to run the conversion report for Oracle to Aurora MySQL. Remediate any issues Then use AWS DMS to migrate the data
  C. Use the M5 or CS DMS replication instance type for ongoing replication
  D. Turn off automatic backups and logging of the target database until the migration and cutover processes are complete
  B. Use AWS DMS to run the conversion report for Oracle to Aurora MySQL. Remediate any issues Then use AWS DMS to migrate the data

  ---

  Explanation

  https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/Aurora.Managing.Backups.html

• Question 164:

  A company's compliance audit reveals that some Amazon Elastic Block Store (Amazon EBS) volumes that were created in an AWS account were not encrypted. A solutions architect must implement a solution to encrypt all new EBS volumes at rest.

  Which solution will meet this requirement with the LEAST effort?

  A. Create an Amazon EventBridge rule to detect the creation of unencrypted EBS volumes. Invoke an AWS Lambda function to delete noncompliant volumes.
  B. Use AWS Audit Manager with data encryption.
  C. Create an AWS Config rule to detect the creation of a new EBS volume. Encrypt the volume by using AWS Systems Manager Automation.
  D. Turn on EBS encryption by default in all AWS Regions.
  D. Turn on EBS encryption by default in all AWS Regions.

• Question 165:

  A company is using an Amazon ECS cluster to run a data-processing application. Different business groups share ECS services in the ECS cluster. The ECS cluster runs on Amazon EC2 instances. ECS cluster auto scaling is enabled. The company needs to assign EC2 costs of ECS tasks to the appropriate business groups.

  Which solution will meet this requirement with the LEAST operational overhead?

  A. Create a cost allocation tag on the EC2 Auto Scaling group to indicate the business group. Use AWS Cost Explorer to assign EC2 costs to the appropriate business group.
  B. Enable split cost allocation data in AWS Cost Explorer. Create an AWS Cost and Usage Report that uses tags to assign EC2 costs to the appropriate business group.
  C. Create a separate ECS cluster for each business group. Use AWS Cost Explorer to assign EC2 costs to the appropriate business group.
  D. Create an AWS cost category for each business group. Define split charge rules for the ECS cluster for the business groups. Create an AWS Cost and Usage Report.
  B. Enable split cost allocation data in AWS Cost Explorer. Create an AWS Cost and Usage Report that uses tags to assign EC2 costs to the appropriate business group.

  ---

  Explanation

  B is correct because the requirement is to allocate shared EC2 infrastructure costs (ECS on EC2, shared cluster) down to the business groups with the least operational effort. With shared compute, the EC2 line-item charges are not naturally per "task," so you need a cost allocation feature that can split shared costs using workload metadata. Split cost allocation data combined with the AWS Cost and Usage Report (CUR) and resource tags provides the standard AWS mechanism to distribute ("split") shared resource costs across consumers for chargeback/showback reporting. This avoids operationally heavy changes (like redesigning clusters) and supports automated reporting.

  Why the other options are incorrect:

  A: Tagging the Auto Scaling group can only attribute costs at the ASG level, not split costs between multiple business groups sharing the same cluster capacity. It does not solve per-business-group allocation when capacity is shared.

  C: Separate clusters per group would work but is higher operational overhead (more clusters to manage, scaling policies, capacity planning, governance), which violates the "least operational overhead" requirement.

  D: Cost Categories are useful for mapping and organizing costs, but by themselves they do not solve the underlying need to split shared EC2 costs among multiple consumers unless you already have an accurate split basis. Option B directly targets split allocation of shared costs with tagging and CUR.

  References:

  AWS Cost Explorer Documentation: split cost allocation data and cost analysis capabilities AWS Cost and Usage Report Documentation: detailed line-item reporting and tag-based cost allocation AWS Billing and Cost Management Documentation: activating and using cost allocation tags AWS Certified Solutions Architect - Professional (SAP-C02) Exam Guide: cost allocation, tagging strategies, and chargeback/showback design for shared platforms

• Question 166:

  A large mobile gaming company has successfully migrated all of its on-premises infrastructure to the AWS Cloud. A solutions architect is reviewing the environment to ensure that it was built according to the design and that it is running in alignment with the Well-Architected Framework.

  While reviewing previous monthly costs in Cost Explorer, the solutions architect notices that the creation and subsequent termination of several large instance types account for a high proportion of the costs. The solutions architect finds out that the company's developers are launching new Amazon EC2 instances as part of their testing and that the developers are not using the appropriate instance types.

  The solutions architect must implement a control mechanism to limit the instance types that only the developers can launch.

  Which solution will meet these requirements?

  A. Create a desired-instance-type managed rule in AWS Config. Configure the rule with the instance types that are allowed. Attach the rule to an event to run each time a new EC2 instance is launched.
  B. In the EC2 console, create a launch template that specifies the instance types that are allowed. Assign the launch template to the developers' IAM accounts.
  C. Create a new IAM policy. Specify the instance types that are allowed. Attach the policy to an IAM group that contains the IAM accounts for the developers
  D. Use EC2 Image Builder to create an image pipeline for the developers and assist them in the creation of a golden image.
  C. Create a new IAM policy. Specify the instance types that are allowed. Attach the policy to an IAM group that contains the IAM accounts for the developers

  ---

  Explanation

  This is doable with IAM policy creation to restrict users to specific instance types. Found the below article.

  https://blog.vizuri.com/limiting-allowed-aws-instance-type-with-iam-policy

• Question 167:

  A company built an application based on AWS Lambda deployed in an AWS CloudFormation stack. The last production release of the web application introduced an issue that resulted in an outage lasting several minutes. A solutions architect must adjust the deployment process to support a canary release.

  Which solution will meet these requirements?

  A. Create an alias for every new deployed version of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load.
  B. Deploy the application into a new CloudFormation stack. Use an Amazon Route 53 weighted routing policy to distribute the load.
  C. Create a version for every new deployed Lambda function. Use the AWS CLI update-function- configuration command with the routing-config parameter to distribute the load.
  D. Configure AWS CodeDeploy and use CodeDeployDefault.OneAtATime in the Deployment configuration to distribute the load.
  A. Create an alias for every new deployed version of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load.

  ---

  Explanation

  https://aws.amazon.com/blogs/compute/implementing-canary-deployments-of-aws-lambda-functions-with-alias-traffic-shifting/

  https://docs.aws.amazon.com/lambda/latest/dg/configuration-aliases.html

• Question 168:

  A company's web application has reliability issues. The application serves customers globally. The application runs on a single Amazon EC2 instance and performs read-intensive operations on an Amazon RDS for MySQL database.

  During high load, the application becomes unresponsive and requires a manual restart of the EC2 instance. A solutions architect must improve the application's reliability.

  Which solution will meet this requirement with the LEAST development effort?

  A. Create an Amazon CloudFront distribution. Specify the EC2 instance as the distribution's origin. Configure a Multi-AZ deployment for the RDS for MySQL database. Use the standby DB instance for the read-intensive operations.
  B. Run the application on EC2 instances that are in an Auto Scaling group. Place the EC2 instances behind an Elastic Load Balancing (ELB) load balancer. Replace the database service with Amazon Aurora. Use Aurora Replicas for the read-intensive operations.
  C. Deploy AWS Global Accelerator. Configure a Multi-AZ deployment for the RDS for MySQL database. Use the standby DB instance for the read-intensive operations.
  D. Migrate the application to AWS Lambda functions. Create read replicas for the RDS for MySQL database. Use the read replicas for the read-intensive operations.
  B. Run the application on EC2 instances that are in an Auto Scaling group. Place the EC2 instances behind an Elastic Load Balancing (ELB) load balancer. Replace the database service with Amazon Aurora. Use Aurora Replicas for the read-intensive operations.

• Question 169:

  A company is migrating some of its applications to AWS. The company wants to migrate and modernize the applications quickly after it finalizes networking and security strategies. The company has set up an AWS Direct Connection connection in a central network account.

  The company expects to have hundreds of AWS accounts and VPCs in the near future. The corporate network must be able to access the resources on AWS seamlessly and also must be able to communicate with all the VPCs. The company also wants to route its cloud resources to the internet through its on-premises data center.

  Which combination of steps will meet these requirements? (Choose three.)

  A. Create a Direct Connect gateway in the central account. In each of the accounts, create an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway.
  B. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
  C. Provision an internet gateway. Attach the internet gateway to subnets. Allow internet traffic through the gateway.
  D. Share the transit gateway with other accounts. Attach VPCs to the transit gateway.
  E. Provision VPC peering as necessary.
  F. Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.
  B. Create a Direct Connect gateway and a transit gateway in the central network account. Attach the transit gateway to the Direct Connect gateway by using a transit VIF.
  D. Share the transit gateway with other accounts. Attach VPCs to the transit gateway.
  F. Provision only private subnets. Open the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center.

  ---

  Explanation

  Option A is incorrect because creating a Direct Connect gateway in the central account and creating an association proposal by using the Direct Connect gateway and the account ID for every virtual private gateway does not enable active-passive failover between the regions. A Direct Connect gateway is a globally available resource that enables you to connect your AWS Direct Connect connection over a private virtual interface (VIF) to one or more VPCs in any AWS Region. A virtual private gateway is the VPN concentrator on the Amazon side of a VPN connection. You can associate a Direct Connect gateway with either a transit gateway or a virtual private gateway. However, a Direct Connect gateway does not provide any load balancing or failover capabilities by itself1

  Option B is correct because creating a Direct Connect gateway and a transit gateway in the central network account and attaching the transit gateway to the Direct Connect gateway by using a transit VIF meets the requirement of enabling the corporate network to access the resources on AWS seamlessly and also to communicate with all the VPCs. A transit VIF is a type of private VIF that you can use to connect your AWS Direct Connect connection to a transit gateway or a Direct Connect gateway. A transit gateway is a network transit hub that you can use to interconnect your VPCs and on-premises networks. By using a transit VIF, you can route traffic between your on-premises network and multiple VPCs across different AWS accounts and Regions through a single connection23

  Option C is incorrect because provisioning an internet gateway, attaching the internet gateway to subnets, and allowing internet traffic through the gateway does not meet the requirement of routing cloud resources to the internet through its on-premises data center. An internet gateway is a horizontally scaled, redundant, and highly available VPC component that allows communication between your VPC and the internet. An internet gateway serves two purposes: to provide a target in your VPC route tables for internet-routable traffic, and to perform network address translation (NAT) for instances that have been assigned public IPv4 addresses. By using an internet gateway, you are routing cloud resources directly to the internet, not through your on-premises data center.

  Option D is correct because sharing the transit gateway with other accounts and attaching VPCs to the transit gateway meets the requirement of enabling the corporate network to access the resources on AWS seamlessly and also to communicate with all the VPCs. You can share your transit gateway with other AWS accounts within the same organization by using AWS Resource Access Manager (AWS RAM). This allows you to centrally manage connectivity from multiple accounts without having to create individual peering connections between VPCs or duplicate network appliances in each account. You can attach VPCs from different accounts and Regions to your shared transit gateway and enable routing between them.

  Option E is incorrect because provisioning VPC peering as necessary does not meet the requirement of enabling the corporate network to access the resources on AWS seamlessly and also to communicate with all the VPCs. VPC peering is a networking connection between two VPCs that enables you to route traffic between them using private IPv4 addresses or IPv6 addresses. You can create a VPC peering connection between your own VPCs, or with a VPC in another AWS account within a single Region. However, VPC peering does not allow you to route traffic from your on-premises network to your VPCs or between multiple Regions. You would need to create multiple VPN connections or Direct Connect connections for each VPC peering connection, which increases operational complexity and costs.

  Option F is correct because provisioning only private subnets, opening the necessary route on the transit gateway and customer gateway to allow outbound internet traffic from AWS to flow through NAT services that run in the data center meets the requirement of routing cloud resources to the internet through its on-premises data center. A private subnet is a subnet that's associated with a route table that has no route to an internet gateway. Instances in a private subnet can communicate with other instances in the same VPC but cannot access resources on the internet directly. To enable outbound internet access from instances in private subnets, you can use NAT devices such as NAT gateways or NAT instances that are deployed in public subnets. A public subnet is a subnet that's associated with a route table that has a route to an internet gateway. Alternatively, you can use your on-premises data center as a NAT device by configuring routes on your transit gateway and customer gateway that direct outbound internet traffic from your private subnets through your VPN connection or Direct Connect connection. This way, you can route cloud resources to the internet through your on-premises data center instead of using an internet gateway.

  References:

  https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

  https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-transit-virtual-interfaces.html

  https://docs.aws.amazon.com/vpc/latest/tgw/what-is-transit-gateway.html

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Internet_Gateway.html

  https://docs.aws.amazon.com/vpc/latest/tgw/tgw-sharing.html

  https://docs.aws.amazon.com/vpc/latest/peering/what-is-vpc-peering.html

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario2.html

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_Scenario3.html

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Instance.html

  https://docs.aws.amazon.com/vpc/latest/userguide/VPC_NAT_Gateway.html

• Question 170:

  A company is migrating a large on-prem Oracle database (withstored procedures) to AWS. The solution must usemanaged services, behighly available, and enable afast migrationwithminimal downtime.

  A. Use AWS DMS to replicate data to RDS for Oracle. Store database files in S3.
  B. Use backup and restore into EC2-hosted Oracle cluster.
  C. Use DMS to move data to DynamoDB. Recreate stored procedures in Lambda.
  D. Use DMS to migrate toAmazon Aurora PostgreSQL. UseAWS SCTto convert stored procedures.
  D. Use DMS to migrate toAmazon Aurora PostgreSQL. UseAWS SCTto convert stored procedures.

  ---

  Explanation

  Aurora PostgreSQLis a fully managed, high-availability database engine. Use AWS DMS to migrate data and AWS Schema Conversion Tool (SCT) to convert stored procedures from Oracle to Aurora-compatible code. This meets the requirements ofminimal downtime,managed services, andstored procedure support.

  Ais not valid--RDS doesn't allow custom S3 integration for storage. Binvolves EC2, which violates the "managed services" constraint. Crequires complete rewrite of the application logic, which contradicts the minimal downtime requirement.

  References:

  https://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.Aurora.html

  https://docs.aws.amazon.com/SchemaConversionTool/latest/userguide/Welcome.html