Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 221:

  A research company is running daily simulations in the AWS Cloud to meet high demand. The simulations run on several hundred Amazon EC2 instances that are based on Amazon Linux 2. Occasionally, a simulation gets stuck and requires a cloud operations engineer to solve the problem by connecting to an

  EC2 instance through SSH.

  Company policy states that no EC2 instance can use the same SSH key and that all connections must be logged in AWS CloudTrail.

  How can a solutions architect meet these requirements?

  A. Launch new EC2 instances, and generate an individual SSH key for each instance. Store the SSH key in AWS Secrets Manager. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the GetSecretValue action. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.
  B. Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH key. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement to run Systems Manager documents. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.
  C. Launch new EC2 instances without setting up any SSH key for the instances. Set up EC2 Instance Connect on each instance. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the instance by using a browser-based SSH client from the EC2 console.
  D. Set up AWS Secrets Manager to store the EC2 SSH key. Create a new AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2 instance. Configure Secrets Manager to use the Lambda function for automatic rotation once daily. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.
  C. Launch new EC2 instances without setting up any SSH key for the instances. Set up EC2 Instance Connect on each instance. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the instance by using a browser-based SSH client from the EC2 console.

• Question 222:

  A software company is using three AWS accounts for each of its 1 0 development teams.

  The company has developed an AWS CloudFormation standard VPC template that includes three NAT gateways.

  The template is added to each account for each team.

  The company is concerned that network costs will increase each time a new development team is added A solutions architect must maintain the reliability of the company's solutions and minimize operational complexity.

  What should the solutions architect do to reduce the network costs while meeting these requirements?

  A. Create a single VPC with three NAT gateways in a shared services account Configure each account VPC with a default route through a transit gateway to the NAT gateway in the shared services account VPC Remove all NAT gateways from the standard VPC template
  B. Create a single VPC with three NAT gateways in a shared services account Configure each account VPC with a default route through a VPC peering connection to the NAT gateway in the shared services account VPC Remove all NAT gateways from the standard VPC template
  C. Remove two NAT gateways from the standard VPC template Rely on the NAT gateway SLA to cover reliability for the remaining NAT gateway.
  D. Create a single VPC with three NAT gateways in a shared services account Configure a Site-to-Site VPN connection from each account to the shared services account Remove all NAT gateways from the standard VPC template
  A. Create a single VPC with three NAT gateways in a shared services account Configure each account VPC with a default route through a transit gateway to the NAT gateway in the shared services account VPC Remove all NAT gateways from the standard VPC template

• Question 223:

  A company needs to establish a connection from its on-premises data center to AWS. The company needs to connect all of its VPCs that are located in different AWS Regions with transitive routing capabilities between VPC networks. The company also must reduce network outbound traffic costs, increase bandwidth throughput, and provide a consistent network experience for end users.

  Which solution will meet these requirements?

  A. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Create VPC peering connections that initiate from the central VPC to all other VPCs.
  B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.
  C. Create an AWS Site-to-Site VPN connection between the on-premises data center and a new central VPC. Use a transit gateway with dynamic routing. Connect the transit gateway to all other VPCs.
  D. Create an AWS Direct Connect connection between the on-premises data center and AWS Establish an AWS Site-to-Site VPN connection between all VPCs in each Region. Create VPC peering connections that initiate from the central VPC to all other VPCs.
  B. Create an AWS Direct Connect connection between the on-premises data center and AWS. Provision a transit VIF, and connect it to a Direct Connect gateway. Connect the Direct Connect gateway to all the other VPCs by using a transit gateway in each Region.

  ---

  Explanation

  Transit GW + Direct Connect GW + Transit VIF + enabled SiteLink if two different DX locations

  https://aws.amazon.com/blogs/networking-and-content-delivery/introducing-aws-direct-connect-sitelink/

• Question 224:

  A manufacturing company is building an inspection solution for its factory. The company has IP cameras at the end of each assembly line. The company has used Amazon SageMaker to train a machine learning (ML) model to identify common defects from still images.

  The company wants to provide local feedback to factory workers when a defect is detected. The company must be able to provide this feedback even if the factory's internet connectivity is down. The company has a local Linux server that hosts an API that provides local feedback to the workers.

  How should the company deploy the ML model to meet these requirements?

  A. Set up an Amazon Kinesis video stream from each IP camera to AWS. Use Amazon EC2 instances to take still images of the streams. Upload the images to an Amazon S3 bucket. Deploy a SageMaker endpoint with the ML model. Invoke an AWS Lambda function to call the inference endpoint when new images are uploaded. Configure the Lambda function to call the local API when a defect is detected.
  B. Deploy AWS IoT Greengrass on the local server. Deploy the ML model to the Greengrass server. Create a Greengrass component to take still images from the cameras and run inference. Configure the component to call the local API when a defect is detected.
  C. Order an AWS Snowball device. Deploy a SageMaker endpoint the ML model and an Amazon EC2 instance on the Snowball device. Take still images from the cameras. Run inference from the EC2 instance. Configure the instance to call the local API when a defect is detected.
  D. Deploy Amazon Monitron devices on each IP camera. Deploy an Amazon Monitron Gateway on premises. Deploy the ML model to the Amazon Monitron devices. Use Amazon Monitron health state alarms to call the local API from an AWS Lambda function when a defect is detected.
  B. Deploy AWS IoT Greengrass on the local server. Deploy the ML model to the Greengrass server. Create a Greengrass component to take still images from the cameras and run inference. Configure the component to call the local API when a defect is detected.

  ---

  Explanation

  The company should use AWS IoT Greengrass to deploy the ML model to the local server and provide local feedback to the factory workers. AWS IoT Greengrass is a service that extends AWS cloud capabilities to local devices, allowing them to collect and analyze data closer to the source of information, react autonomously to local events, and communicate securely with each other on local networks1. AWS

  IoT Greengrass also supports ML inference at the edge, enabling devices to run ML models locally without requiring internet connectivity2.

  The other options are not correct because: Setting up an Amazon Kinesis video stream from each IP camera to AWS would not work if the factory's internet connectivity is down. It would also incur unnecessary costs and latency to stream video data to the cloud and back. Ordering an AWS Snowball device would not be a scalable or cost-effective solution for deploying the ML model. AWS Snowball is a service that provides physical devices for data transfer and edge computing, but it is not designed for continuous operation or frequent updates3.

  Deploying Amazon Monitron devices on each IP camera would not work because Amazon Monitron is a service that monitors the condition and performance of industrial equipment using sensors and machine learning, not cameras4.

  References:

  https://aws.amazon.com/greengrass/

  https://docs.aws.amazon.com/greengrass/v2/developerguide/use-machine-learning-inference.html

  https://aws.amazon.com/snowball/

  https://aws.amazon.com/monitron/

• Question 225:

  A company runs a test application on an Amazon EC2 instance. Testing clients across the United States send data to the application by using a REST API. As traffic increases, application response times increase. The company wants to migrate to a serverless architecture and stream data to clients through WebSockets.

  Which solution will meet these requirements?

  A. Create a new Amazon API Gateway REST API. Implement the business logic in AWS Lambda functions. Set the Lambda functions as integrations to the new REST API. Create a new AWS Step Functions state machine and set the clients as targets. Use the state machine to send data back to the clients.
  B. Create a new Amazon API Gateway HTTP API and an Amazon SQS queue. Configure the HTTP API to integrate with the SQS queue. Implement the business logic in an AWS Lambda function. Use the SQS queue to invoke the Lambda function. Configure the Lambda function to write data to an AWS AppSync Events channel. Ensure that the clients subscribe to the AWS AppSync Events channel.
  C. Create a new AWS AppSync API and a new Amazon SQS queue. Integrate the SQS queue with the AWS AppSync API. Update the current business logic to consume from the SQS queue. Create a new Amazon EventBridge event bus and an EventBridge rule. Set the clients as targets for the rule. Use the EventBridge event bus to send data back to the clients.
  D. Create a new Amazon CloudFront distribution. Implement the business logic in a CloudFront function. Set the CloudFront function as an origin of the CloudFront distribution. Enable AWS IoT Core. Configure the CloudFront function to write data to an MQTT topic. Ensure that the clients subscribe to the IoT Core MQTT topic through WebSockets.
  B. Create a new Amazon API Gateway HTTP API and an Amazon SQS queue. Configure the HTTP API to integrate with the SQS queue. Implement the business logic in an AWS Lambda function. Use the SQS queue to invoke the Lambda function. Configure the Lambda function to write data to an AWS AppSync Events channel. Ensure that the clients subscribe to the AWS AppSync Events channel.

  ---

  Explanation

  B is correct because it implements a fully serverless ingestion-and-streaming design that decouples request intake from processing and delivers real-time updates to clients over WebSockets. The HTTP API provides a serverless front door for REST requests. Sending requests to Amazon SQS buffers bursts and smooths spikes, preventing the backend from being overwhelmed as traffic grows. The SQS # Lambda

  pattern provides scalable, asynchronous processing. For the "stream data to clients through WebSockets" requirement, AWS AppSync Events (real-time publish/subscribe) allows clients to subscribe over persistent WebSocket connections and receive pushed updates with minimal latency, while producers (the Lambda function) publish events to channels that subscribers receive.

  Why the other options are incorrect:

  A: AWS Step Functions is an orchestration service for workflows. It does not provide a native mechanism to "set clients as targets" and push data back to arbitrary REST clients over WebSockets.

  C: Amazon EventBridge rules can target AWS services (Lambda, SQS, SNS, etc.), but clients are not valid EventBridge targets for direct WebSocket streaming. This does not solve "stream to clients through WebSockets."

  D: CloudFront Functions are for lightweight request/response manipulation at the edge and cannot act as an origin or run complex business logic. Also, writing to an MQTT topic from a CloudFront Function is not a supported pattern. While AWS IoT Core can support MQTT over WebSockets for clients, the proposed CloudFront Function integration is not valid.

  References:

  Amazon API Gateway Documentation: HTTP APIs, service integrations, and serverless API front doors Amazon SQS Documentation: queue-based buffering/decoupling to handle traffic spikes and asynchronous processing with Lambda AWS Lambda Documentation: event source mapping with SQS for scalable, serverless processing AWS AppSync Documentation (AppSync real-time / Events capabilities): publish/subscribe and real-time delivery to clients over WebSockets

  AWS Certified Solutions Architect - Professional (SAP-C02) Exam Guide: designing scalable serverless

  architectures, asynchronous decoupling, and real-time client delivery patterns

• Question 226:

  A company is running a two-tier web-based application in an on-premises data center. The application layer consists of a single server running a stateful application. The application connects to a PostgreSQL database running on a separate server.

  The application's user base is expected to grow significantly, so the company is migrating the application and database to AWS The solution will use Amazon Aurora PostgreSQL. Amazon EC2 Auto Scaling, and Elastic Load Balancing.

  Which solution will provide a consistent user experience that will allow the application and database tiers to scale?

  A. Enable Aurora Auto Scaling for Aurora Replicas. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled
  B. Enable Aurora Auto Scaling for Aurora writers. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled
  C. Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.
  D. Aurora Auto Scaling for Aurora writers. Use a Network Load Balancer with the least outstanding requests routing algorithm and sticky sessions enabled.
  C. Aurora Auto Scaling for Aurora Replicas. Use an Application Load Balancer with the round robin routing algorithm and sticky sessions enabled.

  ---

  Explanation

  Aurora Auto Scaling enables your Aurora DB cluster to handle sudden increases in connectivity or workload. When the connectivity or workload decreases, Aurora Auto Scaling removes unnecessary Aurora Replicas so that you don't pay for unused provisioned DB instances

• Question 227:

  A company has an application that generates reports and stores them in an Amazon S3 bucket. When a user accesses their report, the application generates a signed URL to allow the user to download the report. The company's security team has discovered that the files are public and that anyone can download them without authentication. The company has suspended the generation of new reports until the problem is resolved.

  Which set of actions will immediately remediate the security issue without impacting the application's normal workflow?

  A. Create an AWS Lambda function that applies a deny all policy for users who are not authenticated. Create a scheduled event to invoke the Lambda function.
  B. Review the AWS Trusted Advisor bucket permissions check and implement the recommended actions.
  C. Run a script that puts a private ACL on all of the objects in the bucket.
  D. Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcls option to TRUE on the bucket.
  D. Use the Block Public Access feature in Amazon S3 to set the IgnorePublicAcls option to TRUE on the bucket.

  ---

  Explanation

  The S3 bucket is allowing public access and this must be immediately disabled. Setting the IgnorePublicAcls option to TRUE causes Amazon S3 to ignore all public ACLs on a bucket and any objects that it contains.

  The other settings you can configure with the Block Public Access Feature are:

  1. BlockPublicAcls - PUT bucket ACL and PUT objects requests are blocked if granting public access.

  2. BlockPublicPolicy - Rejects requests to PUT a bucket policy if granting public access.

  3. RestrictPublicBuckets - Restricts access to principles in the bucket owners' AWS account.

  https://aws.amazon.com/s3/features/block-public-access/

• Question 228:

  Question: A company needs to migratesome Oracle databases to AWSwhile keeping otherson-premisesfor compliance. The on-prem databases containspatial dataand runcron jobs. The solution must allowquerying on-prem data as foreign tablesfrom AWS.

  A. Use DynamoDB, SCT, and Lambda. Move spatial data to S3 and query with Athena.
  B. Use RDS for SQL Server and AWS Glue crawlers for Oracle access.
  C. Use EC2-hosted Oracle with Application Migration Service. Use Step Functions for cron.
  D. Use RDS for PostgreSQL with DMS and SCT. Use PostgreSQL foreign data wrappers. Connectvia Direct Connect.
  D. Use RDS for PostgreSQL with DMS and SCT. Use PostgreSQL foreign data wrappers. Connectvia Direct Connect.

  ---

  Explanation

  D is correct becauseRDS for PostgreSQLsupportsforeign data wrappers (FDW)that allow querying remote Oracle databases. WithAWS Schema Conversion Tool (SCT)andDatabase Migration Service (DMS), schema and data can be migrated effectively.AWS Direct Connectensures secure, private connectivity to on-prem databases. Cron jobs can be run via EventBridge or external orchestration.

  A doesn ' t support relational/spatial querying.

  B doesn't support FDW or spatial types.

  C introduces unnecessary complexity.

  References:

  https://www.postgresql.org/docs/current/postgres-fdw.htmlhttps://docs.aws.amazon.com/dms/latest/userguide/CHAP_Target.PostgreSQL.html

• Question 229:

  A company is running applications on AWS in a multi-account environment. The company's sales team and marketing team use separate AWS accounts in AWS Organizations.

  The sales team stores petabytes of data in an Amazon S3 bucket. The marketing team uses Amazon QuickSight for data visualizations. The marketing team needs access to data that the sates team stores in the S3 bucket. The company has encrypted the S3 bucket with an AWS Key Management Service (AWS KMS) key. The marketing team has already created the IAM service role for QuickSight to provide QuickSight access in the marketing AWS account. The company needs a solution that will provide secure access to the data in the S3 bucket across AWS accounts.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create a new S3 bucket in the marketing account. Create an S3 replication rule in the sales account to copy the objects to the new S3 bucket in the marketing account. Update the QuickSight permissions in the marketing account to grant access to the new S3 bucket.
  B. Create an SCP to grant access to the S3 bucket to the marketing account. Use AWS Resource Access Manager (AWS RAM) to share the KMS key from the sates account with the marketing account. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket.
  C. Update the S3 bucket policy in the marketing account to grant access to the QuickSight role. Create a KMS grant for the encryption key that is used in the S3 bucket. Grant decrypt access to the QuickSight role. Update the QuickSight permissions in the marketing account to grant access to the S3 bucket.
  D. Create an IAM role in the sales account and grant access to the S3 bucket. From the marketing account, assume the IAM role in the sales account to access the S3 bucket. Update the QuickSight rote, to create a trust relationship with the new IAM role in the sales account.
  D. Create an IAM role in the sales account and grant access to the S3 bucket. From the marketing account, assume the IAM role in the sales account to access the S3 bucket. Update the QuickSight rote, to create a trust relationship with the new IAM role in the sales account.

  ---

  Explanation

  Create an IAM role in the sales account and grant access to the S3 bucket. From the marketing account, assume the IAM role in the sales account to access the S3 bucket. Update the QuickSight role, to create a trust relationship with the new IAM role in the sales account.

  This approach is the most secure way to grant cross-account access to the data in the S3 bucket while minimizing operational overhead. By creating an IAM role in the sales account, the marketing team can assume the role in their own account, and have access to the S3 bucket. And updating the QuickSight role, to create a trust relationship with the new IAM role in the sales account will grant the marketing team to access the data in the S3 bucket and use it for data visualization using QuickSight. AWS Resource Access Manager (AWS RAM) also allows sharing of resources between accounts, but it would require additional management and configuration to set up the sharing, which would increase operational overhead. Using

  S3 replication would also replicate the data to the marketing account, but it would not provide the marketing team access to the original data, and also it would increase operational overhead with managing the replication process. IAM roles and policies, KMS grants and trust relationships are a powerful combination for managing cross-account access in a secure and efficient manner.

  References:

  AWS IAM Roles

  AWS KMS - Key Grants

  AWS RAM

• Question 230:

  A company stores all its infrastructure code in a central Git repository that is hosted on GitHub Enterprise.

  The company wants to implement a process that submits every infrastructure update by using a pull request. Each pull request must automatically receive an AWS CloudFormation change set. After the pull request is approved, CloudFormation must apply the updates directly. The process must not require custom pipelines or manual template processing.

  Which solution will meet these requirements?

  A. Use CloudFormation to invoke an AWS CodePipeline action. Configure the CodePipeline action to validate the template and publish the validation results as pull request comments.
  B. Use CloudFormation Git sync to link CloudFormation with the repository. Configure automatic change set creation for pull request updates. Configure CloudFormation to post the change set summary and apply the update when the pull request is approved and merged.
  C. Use CloudFormation drift detection. Create an Amazon EventBridge rule that reacts to pull request updates. Configure the EventBridge rule to produce drift comparison results and send the results as comments before the stack is updated.
  D. Use CloudFormation Lambda Hooks. Configure Lambda Hooks to evaluate the updated template and write the planned changes into the pull request when a stack update is requested.
  B. Use CloudFormation Git sync to link CloudFormation with the repository. Configure automatic change set creation for pull request updates. Configure CloudFormation to post the change set summary and apply the update when the pull request is approved and merged.

  ---

  Explanation

  Option B is correct because CloudFormation Git sync is built specifically to connect CloudFormation stacks to source-controlled templates and deployment files in Git repositories. It supports GitHub Enterprise as a provider, can monitor repository changes, and can update stacks after approved changes are merged.

  AWS documentation states that Git sync works with pull requests and can post comments explaining what changes will be made before a stack update. This directly satisfies the requirement for automatic change set visibility on pull requests without building custom CodePipeline logic or manually processing templates.

  Option A introduces a custom pipeline, which the question explicitly rejects. Drift detection compares deployed resources against expected configuration; it does not create pull-request change sets. Lambda Hooks evaluate resources during CloudFormation operations but do not provide native Git pull-request synchronization.