Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 251:

  A company is running an application in the AWS Cloud. Recent application metrics show inconsistent response times and a significant increase in error rates. Calls to third-party services are causing the delays. Currently, the application calls third-party services synchronously by directly invoking an AWS Lambda function.

  A solutions architect needs to decouple the third-party service calls and ensure that all the calls are eventually completed.

  Which solution will meet these requirements?

  A. Use an Amazon Simple Queue Service (Amazon SQS) queue to store events and invoke the Lambda function.
  B. Use an AWS Step Functions state machine to pass events to the Lambda function.
  C. Use an Amazon EventBridge rule to pass events to the Lambda function.
  D. Use an Amazon Simple Notification Service (Amazon SNS) topic to store events and Invoke the Lambda function.
  A. Use an Amazon Simple Queue Service (Amazon SQS) queue to store events and invoke the Lambda function.

  ---

  Explanation

  Using an SQS queue to store events and invoke the Lambda function will decouple the third-party service calls and ensure that all the calls are eventually completed. SQS allows you to store messages in a queue and process them asynchronously, which eliminates the need for the application to wait for a response from the third-party service. The messages will be stored in the SQS queue until they are processed by the Lambda function, even if the Lambda function is currently unavailable or busy. This will ensure that all the calls are eventually completed, even if there are delays or errors. AWS Step Functions state machines can also be used to pass events to the Lambda function, but it would require additional management and configuration to set up the state machine, which would increase operational overhead. Amazon EventBridge rule can also be used to pass events to the Lambda function, but it would not provide the same level of decoupling and reliability as SQS. Using Amazon Simple Notification Service (Amazon SNS) topic to store events and Invoke the Lambda function, is similar to SQS, but SNS is a publish-subscribe messaging service and SQS is a queue service. SNS is used for sending messages to multiple recipients, SQS is used for sending messages to a single recipient, so SQS is more appropriate for this use case.

  References:

  AWS SQS

  AWS Step Functions

  AWS EventBridge

  AWS SNS

• Question 252:

  A life sciences company is using a combination of open source tools to manage data analysis workflows and Docker containers running on servers in its on-premises data center to process genomics data Sequencing data is generated and stored on a local storage area network (SAN), and then the data is processed. The research and development teams are running into capacity issues and have decided to re-architect their genomics analysis platform on AWS to scale based on workload demands and reduce the turnaround time from weeks to days The company has a high-speed AWS Direct Connect connection Sequencers will generate around 200 GB of data for each genome, and individual jobs can take several hours to process the data with ideal compute capacity. The end result will be stored in Amazon S3.

  The company is expecting 10-15 job requests each day Which solution meets these requirements?

  A. Use regularly scheduled AWS Snowball Edge devices to transfer the sequencing data into AWS When AWS receives the Snowball Edge device and the data is loaded into Amazon S3 use S3 events to trigger an AWS Lambda function to process the data
  B. Use AWS Data Pipeline to transfer the sequencing data to Amazon S3 Use S3 events to trigger an Amazon EC2 Auto Scaling group to launch custom-AMI EC2 instances running the Docker containers to process the data
  C. Use AWS DataSync to transfer the sequencing data to Amazon S3 Use S3 events to trigger an AWS Lambda function that starts an AWS Step Functions workflow Store the Docker images in Amazon Elastic Container Registry (Amazon ECR) and trigger AWS Batch to run the container and process the sequencing data
  D. Use an AWS Storage Gateway file gateway to transfer the sequencing data to Amazon S3 Use S3 events to trigger an AWS Batch job that runs on Amazon EC2 instances running the Docker containers to process the data
  C. Use AWS DataSync to transfer the sequencing data to Amazon S3 Use S3 events to trigger an AWS Lambda function that starts an AWS Step Functions workflow Store the Docker images in Amazon Elastic Container Registry (Amazon ECR) and trigger AWS Batch to run the container and process the sequencing data

  ---

  Explanation

  AWS DataSync can be used to transfer the sequencing data to Amazon S3, which is a more efficient and faster method than using Snowball Edge devices. Once the data is in S3, S3 events can trigger an AWS Lambda function that starts an AWS Step Functions workflow. The Docker images can be stored in Amazon Elastic Container Registry (Amazon ECR) and AWS Batch can be used to run the container and process the sequencing data.

• Question 253:

  A company is deploying AWS Lambda functions that access an Amazon RDS for PostgreSQL database.

  The company needs to launch the Lambda functions in a QA environment and in a production environment.

  The company must not expose credentials within application code and must rotate passwords automatically.

  Which solution will meet these requirements?

  A. Store the database credentials for both environments in AWS Systems Manager Parameter Store. Encrypt the credentials by using an AWS Key Management Service (AWS KMS) key. Within the application code of the Lambda functions, pull the credentials from the Parameter Store parameter by using the AWS SDK for Python (Bot03). Add a role to the Lambda functions to provide access to the Parameter Store parameter.
  B. Store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Turn on rotation. Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions.
  C. Store the database credentials for both environments in AWS Key Management Service (AWS KMS). Turn on rotation. Provide a reference to the credentials that are stored in AWS KMS as an environment variable for the Lambda functions.
  D. Create separate S3 buckets for the QA environment and the production environment. Turn on server-side encryption with AWS KMS keys (SSE-KMS) for the S3 buckets. Use an object naming pattern that gives each Lambda function's application code the ability to pull the correct credentials for the function's corresponding environment. Grant each Lambda function's execution role access to Amazon S3.
  B. Store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. Turn on rotation. Provide a reference to the Secrets Manager key as an environment variable for the Lambda functions.

  ---

  Explanation

  The best solution is to store the database credentials for both environments in AWS Secrets Manager with distinct key entry for the QA environment and the production environment. AWS Secrets Manager is a web service that can securely store, manage, and retrieve secrets, such as database credentials. AWS Secrets Manager also supports automatic rotation of secrets by using Lambda functions or built-in rotation templates. By storing the database credentials for both environments in AWS Secrets Manager, the company can avoid exposing credentials within application code and rotate passwords automatically. By providing a reference to the Secrets Manager key as an environment variable for the Lambda functions, the company can easily access the credentials from the code by using the AWS SDK. This solution meets all the requirements of the company.

  References:

  AWS Secrets Manager Documentation, Using AWS Lambda with AWS Secrets Manager, Using environment variables - AWS Lambda

• Question 254:

  A new startup is running a serverless application using AWS Lambda as the primary source of compute New versions of the application must be made available to a subset of users before deploying changes to all users Developers should also have the ability to stop the deployment and have access to an easy rollback mechanism A solutions architect decides to use AWS CodeDeploy to deploy changes when a new version is available.

  Which CodeDeploy configuration should the solutions architect use?

  A. A blue/green deployment
  B. A linear deployment
  C. A canary deployment
  D. An all-at-once deployment
  C. A canary deployment

• Question 255:

  A company is using GitHub Actions to run a CI/CD pipeline that accesses resources on AWS. The company has an IAM user that uses a secret key in the pipeline to authenticate to AWS. An existing IAM role with an attached policy grants the required permissions to deploy resources.

  The company's security team implements a new requirement that pipelines can no longer use long-lived secret keys. A solutions architect must replace the secret key with a short-lived solution.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create an IAM SAML 2.0 identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Update GitHub to use SAML authentication for the pipeline.
  B. Create an IAM OpenID Connect (OIDC) identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub OIDC IdP. Update GitHub to assume the role for the pipeline.
  C. Create an Amazon Cognito identity pool. Configure the authentication provider to use GitHub. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub authentication provider. Configure the pipeline to use Cognito as its authentication provider.
  D. Create a trust anchor to AWS Private Certificate Authority. Generate a client certificate to use with AWS IAM Roles Anywhere. Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRole API call. Attach the existing IAM policy to the new IAM role. Configure the pipeline to use the credential helper tool and to reference the client certificate public key to assume the new IAM role.
  B. Create an IAM OpenID Connect (OIDC) identity provider (IdP) in AWS Identity and Access Management (IAM). Create a new IAM role with the appropriate trust policy that allows the sts:AssumeRoleWithWebIdentity API call from the GitHub OIDC IdP. Update GitHub to assume the role for the pipeline.

• Question 256:

  A company established a data-sharing agreement with a supplier. A solutions architect must establish bidirectional access to Amazon S3 buckets for the company's organization in AWS Organizations and the supplier's organization. The company's S3 buckets are in the us-east-1 Region. The supplier's buckets are in the us-west-1 Region. The company must encrypt data at rest and collect logs of all S3 bucket access.

  Which solution will meet these requirements?

  A. Create S3 Access Grants that have specific permissions in the source accounts. Use AWS Resource Access Manager (AWS RAM) to share the access grants with both organizations. Use server-side encryption with AWS KMS keys (SSE-KMS) to encrypt the data. Grant the target accounts access to the KMS keys. Configure AWS CloudTrail to log S3 data events.
  B. Set up VPC peering connections between the VPCs of the two organizations. Use AWS PrivateLink to implement S3 interface endpoints. Configure IAM policies in each organization to control endpoint access. Use Amazon S3 server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. Enable VPC Flow Logs.
  C. Create S3 Access Points for both organizations, and use AWS Resource Access Manager (AWS RAM) to share the access points. Attach IAM policies that grant cross-organization access to the access points. Use customer managed AWS KMS keys to encrypt the data. Enable AWS CloudTrail in both Regions.
  D. Configure S3 Cross-Region Replication. Create an SCP to allow S3:GetObject and S3:PutObject actions. Share the SCP between both organizations. Use Amazon S3 server-side encryption with Amazon S3 managed keys (SSE-S3) to encrypt the data. Implement S3 server access logging.
  C. Create S3 Access Points for both organizations, and use AWS Resource Access Manager (AWS RAM) to share the access points. Attach IAM policies that grant cross-organization access to the access points. Use customer managed AWS KMS keys to encrypt the data. Enable AWS CloudTrail in both Regions.

  ---

  Explanation

  Comprehensive and Detailed Explanation: Why C is the best answer.

  This question requires all of the following: Bidirectional access between two separate AWS Organizations Access to S3 buckets across accounts and organizational boundaries Encryption at rest Logging of all S3 bucket access Buckets exist in different Regions Option C is the best match because S3 Access Points are purpose-built to simplify and scale access management for shared S3 datasets. For cross-account or multi-team sharing scenarios, S3 Access Points let you define dedicated access paths and policies instead of overloading a single bucket policy. For encryption at rest, customer managed AWS KMS keys are the strongest fit when cross-account access must be explicitly controlled. For logging bucket-level object access, AWS CloudTrail is the correct service because S3 data events record object-level API activity such as GetObject and PutObject.

  Why the other options are not correct

  A. S3 Access Grants is not the best fit here S3 Access Grants is designed primarily to grant S3 access to identities mapped from identity sources and simplify data access at scale. It is not the standard primary design choice for bidirectional bucket sharing between two separate organizations. The exam-focused architectural pattern for controlled cross-account S3 sharing is S3 Access Points plus policies, combined with KMS permissions and CloudTrail data events. Even though SSE-KMS and CloudTrail data events are good parts of the design, the access mechanism in A is not the best answer.

  B. VPC networking services do not solve the main requirement VPC peering, PrivateLink, and endpoint access controls are network connectivity controls. Amazon S3 is not shared between organizations by building VPC peering between their VPCs. Also, VPC Flow Logs record network flow metadata, not S3 object access. That means B fails the logging requirement and uses the wrong control plane for the access-sharing requirement.

  D. Replication and SCPs do not provide bidirectional shared access S3 Cross-Region Replication copies objects; it does not establish bidirectional shared access for both organizations to each other's buckets. Service Control Policies also do not work the way this option describes. SCPs are guardrails within an AWS Organization; they are not shared between separate organizations to grant object access. In addition, S3 server access logging is not the best answer when the requirement is to collect logs of all S3 bucket access in an auditable way for object-level API actions. CloudTrail data events are the stronger and more exam-aligned choice for logging object access activity. Key technical reasoning Cross-account / cross-organization S3 access: S3 Access Points are commonly used to provide distinct permissions and simplified policy management for different consumers of the same bucket. This is especially useful in multi-account environments. Encryption at rest: When access spans accounts or organizations, customer managed KMS keys are preferred because key policies and grants can explicitly authorize external principals. This gives finer control than SSE-S3 when cross-account governance matters. Logging: For S3 object-level operations, CloudTrail data events are the standard answer in AWS architecture questions. They record API activity such as GetObject, PutObject, and DeleteObject. This is more appropriate than VPC Flow Logs or relying only on S3 server access logging. Regional aspect: The fact that buckets are in us-east-1 and us-west-1 does not prevent cross-account access. S3 access control, KMS permissions, and CloudTrail can be configured in the relevant Regions.

• Question 257:

  A company recently deployed a new application that runs on a group of Amazon EC2 Linux instances in a VPC In a peered VPC the company launched an EC2 Linux instance that serves as a bastion host.

  The security group of the application instances allows access only on TCP port 22 from the private IP of the bastion host.

  The security group of the bastion host allows access to TCP port 22 from 0 0 0.0/0 so that system administrators can use SSH to remotely log in to the application instances from several branch offices While looking through operating system logs on the bastion host, a cloud engineer notices thousands of failed SSH logins to the bastion host from locations around the world.

  The cloud engineer wants to change how remote access is granted to the application instances and wants to meet the following requirements:

  1. Eliminate brute-force SSH login attempts

  2. Retain a log of commands run during an SSH session

  3. Retain the ability to forward ports

  Which solution meets these requirements for remote access to the application instances?

  A. Configure the application instances to communicate with AWS Systems Manager Grant access to the system administrators to use Session Manager to establish a session with the application instances Terminate the bastion host
  B. Update the security group of the bastion host to allow traffic from only the public IP addresses of the branch offices
  C. Configure an AWS Client VPN endpoint and provision each system administrator with a certificate to establish a VPN connection to the application VPC Update the security group of the application instances to allow traffic from only the Client VPN IPv4 CIDR. Terminate the bastion host.
  D. Configure the application instances to communicate with AWS Systems Manager. Grant access to the system administrators to issue commands to the application instances by using Systems Manager Run Command. Terminate the bastion host.
  A. Configure the application instances to communicate with AWS Systems Manager Grant access to the system administrators to use Session Manager to establish a session with the application instances Terminate the bastion host

  ---

  Explanation

  "Session Manager removes the need to open inbound ports, manage SSH keys, or use bastion hosts"

  Ref:

  https://docs.aws.amazon.com/systems-manager/latest/userguide/session-manager.html

• Question 258:

  An e-commerce company is revamping its IT infrastructure and is planning to use AWS services. The company's CIO has asked a solutions architect to design a simple, highly available, and loosely coupled order processing application. The application is responsible (or receiving and processing orders before storing them in an Amazon DynamoDB table. The application has a sporadic traffic pattern and should be able to scale during markeling campaigns to process the orders with minimal delays.

  Which of the following is the MOST reliable approach to meet the requirements?

  A. Receive the orders in an Amazon EC2-hosted database and use EC2 instances to process them.
  B. Receive the orders in an Amazon SOS queue and trigger an AWS Lambda function lo process them.
  C. Receive the orders using the AWS Step Functions program and trigger an Amazon ECS container lo process them.
  D. Receive the orders in Amazon Kinesis Data Streams and use Amazon EC2 instances to process them.
  B. Receive the orders in an Amazon SOS queue and trigger an AWS Lambda function lo process them.

  ---

  Explanation

  Q: How does Amazon Kinesis Data Streams differ from Amazon SQS?

  Amazon Kinesis Data Streams enables real-time processing of streaming big data. It provides ordering of records, as well as the ability to read and/or replay records in the same order to multiple Amazon Kinesis Applications. The Amazon Kinesis Client Library (KCL) delivers all records for a given partition key to the same record processor, making it easier to build multiple applications reading from the same Amazon Kinesis data stream (for example, to perform counting, aggregation, and filtering).

  https://aws.amazon.com/kinesis/data-streams/faqs/

  https://aws.amazon.com/blogs/big-data/unite-real-time-and-batch-analytics-using-the-big-data-lambda-architecture-without-servers/

• Question 259:

  A company has multiple business units that each have separate accounts on AWS. Each business unit manages its own network with several VPCs that have CIDR ranges that overlap. The company's marketing team has created a new internal application and wants to make the application accessible to all the other business units. The solution must use private IP addresses only.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Instruct each business unit to add a unique secondary CIDR range to the business unit's VPC. Peer the VPCs and use a private NAT gateway in the secondary range to route traffic to the marketing team.
  B. Create an Amazon EC2 instance to serve as a virtual appliance in the marketing account's VPC. Create an AWS Site-to-Site VPN connection between the marketing team and each business unit's VPC. Perform NAT where necessary.
  C. Create an AWS PrivateLink endpoint service to share the marketing application. Grant permission to specific AWS accounts to connect to the service. Create interface VPC endpoints in other accounts to access the application by using private IP addresses.
  D. Create a Network Load Balancer (NLB) in front of the marketing application in a private subnet. Create an API Gateway API. Use the Amazon API Gateway private integration to connect the API to the NLB. Activate IAM authorization for the API. Grant access to the accounts of the other business units.
  C. Create an AWS PrivateLink endpoint service to share the marketing application. Grant permission to specific AWS accounts to connect to the service. Create interface VPC endpoints in other accounts to access the application by using private IP addresses.

  ---

  Explanation

  With AWS PrivateLink, the marketing team can create an endpoint service to share their internal application with other accounts securely using private IP addresses. They can grant permission to specific AWS accounts to connect to the service and create interface VPC endpoints in the other accounts to access the application by using private IP addresses. This option does not require any changes to the network of the other business units, and it does not require peering or NATing. This solution is both scalable and secure.

  https://aws.amazon.com/blogs/networking-and-content-delivery/connecting-networks-with-overlapping-ip-ranges/

• Question 260:

  A company is using AWS CloudFormation to deploy its infrastructure. The company is concerned that if a production CloudFormation stack is deleted, important data stored in Amazon RD5 databases or Amazon EBS volumes might also be deleted.

  Now can the company prevent users from accidentally deleting data m this way?

  A. Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.
  B. Configure a stack policy that disallows the deletion of RDS and EBS resources.
  C. Modify IAM policies to deny deleting RDS and EBS resources that ate lagged with an "aws:cloudformation:stack-name'' tag.
  D. Use AWS Config rules to prevent deleting RDS and EBS resources.
  A. Modify the CloudFormation templates to add a DeletionPolicy attribute to RDS and EBS resources.

  ---

  Explanation

  With the DeletionPolicy attribute you can preserve or (in some cases) backup a resource when its stack is deleted. You specify a DeletionPolicy attribute for each resource that you want to control. If a resource has no DeletionPolicy attribute, AWS CloudFormation deletes the resource by default. To keep a resource when its stack is deleted, specify Retain for that resource. You can use retain for any resource. For example, you can retain a nested stack, Amazon S3 bucket, or EC2 instance so that you can continue to use or modify those resources after you delete their stacks.

  https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html