Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 321:

  A company uses AWS Organizations AWS account. A solutions architect must design a solution in which only administrator roles are allowed to use IAM actions. However the solutions archited does not have access to all the AWS account throughout the company.

  Which solution meets these requirements with the LEAST operational overhead?

  A. Create an SCP that applies to at the AWS accounts to allow I AM actions only for administrator roles. Apply the SCP to the root OLI.
  B. Configure AWS CloudTrai to invoke an AWS Lambda function for each event that is related to 1AM actions. Configure the function to deny the action. If the user who invoked the action is not an administator.
  C. Create an SCP that applies to all the AWS accounts to deny 1AM actions for all users except for those with administrator roles. Apply the SCP to the root OU.
  D. Set an 1AM permissions boundary that allows 1AM actions. Attach the permissions boundary to every administrator role across all the AWS accounts.
  A. Create an SCP that applies to at the AWS accounts to allow I AM actions only for administrator roles. Apply the SCP to the root OLI.

  ---

  Explanation

  To restrict IAM actions to only administrator roles across all AWS accounts in an organization, the most operationally efficient solution is to create a Service Control Policy (SCP) that allows IAM actions exclusively for administrator roles and apply this SCP to the root Organizational Unit (OU) of AWS Organizations. This method ensures a centralized governance mechanism that uniformly applies the policy across all accounts, thereby minimizing the need for individual account-level configurations and reducing operational complexity.

  References:

  AWS Documentation on AWS Organizations and Service Control Policies offers comprehensive information on creating and managing SCPs for organizational-wide policy enforcement.

  This approach aligns with AWS best practices for managing permissions and ensuring secure and compliant account configurations within an AWS Organization.

• Question 322:

  Accompany is building an application to collect and transmit sensor data from a factory. The application will use AWS IoT Core to send data from hundreds of devices to an Amazon S3 data lake. The company must enrich the data before loading the data into Amazon S3.

  The application will transmit the sensor data every 5 seconds. New sensor data must be available in Amazon S3 less than 30 minutes after the application collects the data. No other applications are processing the sensor data from AWS IoT Core.

  Which solution will meet these requirements MOST cost-effectively?

  A. Create a topic in AWS IoT Core to ingest the sensor data. Create an AWS Lambda function to enrich the data and to write the data to Amazon S3. Configure an AWS IoT rule action to invoke the Lambda function.
  B. Use AWS IoT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Firehose. Set the Kinesis Data Firehose buffering interval to 900 seconds. Use Kinesis Data Firehose to invoke an AWS Lambda function to enrich the data, Configure Kinesis Data Firehose to deliver the data to Amazon S3.
  C. Create a topic in AWS IoT Core to ingest the sensor data. Configure an AWS IoT rule action to send the data to an Amazon Timestream table. Create an AWS Lambda, function to read the data from Timestream. Configure the Lambda function to enrich the data and to write the data to Amazon S3.
  D. Use AWS loT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Streams. Create a consumer AWS Lambda function to process the data from Kinesis Data Streams and to enrich the data. Call the S3 PutObject API operation from the Lambda function to write the data to Amazon S3.
  B. Use AWS IoT Core Basic Ingest to ingest the sensor data. Configure an AWS IoT rule action to write the data to Amazon Kinesis Data Firehose. Set the Kinesis Data Firehose buffering interval to 900 seconds. Use Kinesis Data Firehose to invoke an AWS Lambda function to enrich the data, Configure Kinesis Data Firehose to deliver the data to Amazon S3.

• Question 323:

  A company is migrating its blog platform to AWS. The company's on-premises servers connect to AWS through an AWS Site-to-Site VPN connection. The blog content is updated several times a day by multiple authors and is served from a file share on a network-attached storage (NAS) server.

  The company needs to migrate the blog platform without delaying the content updates. The company has deployed Amazon EC2 instances across multiple Availability Zones to run the blog platform behind an Application Load Balancer. The company also needs to move 200 TB of archival data from its on-premises servers to Amazon S3 as soon as possible.

  Which combination of stops will meet these requirements? (Choose two.)

  A. Create a weekly cron job in Amazon EventBridge. Use the cron job to invoke an AWS Lambda function to update the EC2 instances from the NAS server.
  B. Configure an Amazon Elastic Block Store (Amazon EBS) Multi-Attach volume for the EC2 instances to share for content access. Write code to synchronize the EBS volume with the NAS server weekly.
  C. Mount an Amazon Elastic File System (Amazon EFS) file system to the on-premises servers to act as the NAS server. Copy the blog data to the EFS file system. Mount the EFS file system to the C2 instances to serve the content.
  D. Order an AWS Snowball Edge Storage Optimized device. Copy the static data artifacts to the device. Ship the device to AWS.
  E. Order an AWS Snowcons SSD device. Copy the static data artifacts to the device. Ship the device to AWS.
  C. Mount an Amazon Elastic File System (Amazon EFS) file system to the on-premises servers to act as the NAS server. Copy the blog data to the EFS file system. Mount the EFS file system to the C2 instances to serve the content.
  D. Order an AWS Snowball Edge Storage Optimized device. Copy the static data artifacts to the device. Ship the device to AWS.

• Question 324:

  A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution.

  The company requires that replication traffic does not travel through the public internet. The application also must not be accessible from the internet. The company does not want this solution to consume all available network bandwidth because other applications require bandwidth.

  Which combination of steps will meet these requirements? (Select THREE.)

  A. Create a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.
  B. Create a VPC that has at least two public subnets, a virtual private gateway, and an internet gateway.
  C. Create an AWS Site-to-Site VPN connection between the on-premises network and the target AWS network.
  D. Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.
  E. During configuration of the replication servers, select the option to use private IP addresses for data replication.
  F. During configuration of the launch settings for the target servers, select the option to ensure that the Recovery instance's private IP address matches the source server's private IP address.
  A. Create a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.
  D. Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.
  E. During configuration of the replication servers, select the option to use private IP addresses for data replication.

  ---

  Explanation

  ADE Option D: Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.

  Option E: During configuration of the replication servers, select the option to use private IP addresses for data replication.

  Option A: could be considered if the private subnets are used without the NAT gateways, ensuring internal-only network access

• Question 325:

  A company runs production workloads on EC2 On-Demand Instances and RDS for PostgreSQL. They want to reduce costs without compromising availability or capacity.

  A. Use CUR and Lambda to terminate underutilized instances. Buy Savings Plans.
  B. Use Budgets and Trusted Advisor, then manually terminate and buy RIs.
  C. UseCompute OptimizerandTrusted Advisorfor recommendations. Apply rightsizing, auto scaling, and purchase a Compute Savings Plan.
  D. Use Cost Explorer, alerts, and replace with Spot Instances.
  C. UseCompute OptimizerandTrusted Advisorfor recommendations. Apply rightsizing, auto scaling, and purchase a Compute Savings Plan.

  ---

  Explanation

  Option C is correct:AWS Compute Optimizeruses machine learning to analyze usage patterns and recommends rightsizing.Trusted Advisoradds further insights. Combining these with Savings Plansgives the best cost optimizationwithout reducing availability.

  Option A is risky due to using Lambda for termination.

  Option B and Option D offer partial or manual solutions.

  References:

  AWS Compute Optimizer

• Question 326:

  A video processing company wants to build a machine learning (ML) model by using 600 TB of compressed data that is stored as thousands of files in the company's on-premises network attached storage system. The company does not have the necessary compute resources on premises for ML experiments and wants to use AWS.

  The company needs to complete the data transfer to AWS within 3 weeks. The data transfer will be a one-time transfer. The data must be encrypted in transit. The measured upload speed of the company's internet connection is 100 Mbps, and multiple departments share the connection.

  Which solution will meet these requirements MOST cost-effectively?

  A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console. Configure the devices with a destination S3 bucket. Copy the data to the devices. Ship the devices back to AWS.
  B. Set up a 10 Gbps AWS Direct Connect connection between the company location and the nearest AWS Region. Transfer the data over a VPN connection into the Region to store the data in Amazon S3.
  C. Create a VPN connection between the on-premises network storage and the nearest AWS Region. Transfer the data over the VPN connection.
  D. Deploy an AWS Storage Gateway file gateway on premises. Configure the file gateway with a destination S3 bucket. Copy the data to the file gateway.
  A. Order several AWS Snowball Edge Storage Optimized devices by using the AWS Management Console. Configure the devices with a destination S3 bucket. Copy the data to the devices. Ship the devices back to AWS.

  ---

  Explanation

  This solution will meet the requirements of the company as it provides a secure, cost-effective and fast way of transferring large data sets from on-premises to AWS. Snowball Edge devices encrypt the data during transfer, and the devices are shipped back to AWS for import into S3. This option is more cost effective than using Direct Connect or VPN connections as it does not require the company to pay for long-term dedicated connections.

• Question 327:

  A company has multiple AWS accounts and manages these accounts with AWS Organizations. A developer was given IAM user credentials to access AWS resources. The developer should have read-only access to all Amazon S3 buckets in the account. However, when the developer tries to access the S3 buckets from the console, they receive an access denied error message with no buckets listed. A solutions architect reviews the permissions and finds that the developer's IAM user is listed as having read-only access to all S3 buckets in the account.

  Which additional steps should the solutions architect take to troubleshoot the issue? (Select TWO.)

  A. Check the bucket policies for all S3 buckets.
  B. Check the ACLs for all S3 buckets.
  C. Check the SCPs set at the organizational units (OUs).
  D. Check for the permissions boundaries set for the IAM user.
  E. Check if an appropriate IAM role is attached to the IAM user.
  C. Check the SCPs set at the organizational units (OUs).
  D. Check for the permissions boundaries set for the IAM user.

  ---

  Explanation

  The correct answers are C and D. The IAM user appears to have read-only S3 permissions, but AWS authorization is the result of multiple policy layers. In AWS Organizations, a service control policy can set the maximum permissions available to principals in member accounts. If an OU-level SCP denies or does not allow S3 actions, the IAM user's read-only policy will not be enough. A permissions boundary can also restrict the maximum permissions an IAM user can exercise, even if an identity-based policy appears to allow access. Bucket policies can affect access to specific buckets and objects, but the symptom says no buckets are listed in the console, which points more strongly to identity-side effective permission limits.

  ACLs are legacy resource controls and are not the primary place to troubleshoot this issue. (AWS Documentation)

• Question 328:

  A company has introduced a new policy that allows employees to work remotely from their homes if they connect by using a VPN

  The company Is hosting Internal applications with VPCs in multiple AWS accounts Currently the applications are accessible from the company's on-premises office network through an AWS Site-to-Site VPN connection.

  The VPC in the company's main AWS account has peering connections established with VPCs in other AWS accounts.

  A solutions architect must design a scalable AWS Client VPN solution for employees to use while they work from home.

  What is the MOST cost-effective solution that meets these requirements?

  A. Create a Client VPN endpoint in each AWS account Configure required routing that allows access to internal applications
  B. Create a Client VPN endpoint in the mam AWS account Configure required routing that allows access to internal applications
  C. Create a Client VPN endpoint in the main AWS account Provision a transit gateway that is connected to each AWS account Configure required routing that allows access to internal applications
  D. Create a Client VPN endpoint in the mam AWS account Establish connectivity between the Client VPN endpoint and the AWS Site-to-Site VPN
  B. Create a Client VPN endpoint in the mam AWS account Configure required routing that allows access to internal applications

  ---

  Explanation

  https://docs.aws.amazon.com/vpn/latest/clientvpn-admin/scenario-peered.html

• Question 329:

  A software company hosts an application on AWS with resources in multiple AWS accounts and Regions.

  The application runs on a group of Amazon EC2 instances in an application VPC located in the us-east-1 Region with an IPv4 CIDR block of 10.10.0.0/16. In a different AWS account, a shared services VPC is located in the us-east-2 Region with an IPv4 CIDR block of 10.10.10.0/24. When a cloud engineer uses AWS CloudFormation to attempt to peer the application

  VPC with the shared services VPC, an error message indicates a peering failure.

  Which factors could cause this error? (Choose two.)

  A. The IPv4 CIDR ranges of the two VPCs overlap
  B. The VPCs are not in the same Region
  C. One or both accounts do not have access to an Internet gateway
  D. One of the VPCs was not shared through AWS Resource Access Manager
  E. The IAM role in the peer accepter account does not have the correct permissions
  A. The IPv4 CIDR ranges of the two VPCs overlap
  E. The IAM role in the peer accepter account does not have the correct permissions

  ---

  Explanation

  https://aws.amazon.com/about-aws/whats-new/2017/11/announcing-support-for-inter-region-vpc-peering/

• Question 330:

  A company wants to migrate its website to AWS. The website uses containers that are deployed in an on-premises, self-managed Kubernetes cluster. All data for the website is stored in an on-premises PostgreSQL database.

  The company has decided to migrate the on-premises Kubernetes cluster to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. The EKS cluster will use EKS managed node groups with a static number of nodes. The company will also migrate the on-premises database to an Amazon RDS for PostgreSQL database.

  A solutions architect needs to estimate the total cost of ownership (TCO) for this workload before the migration.

  Which solution will provide the required TCO information?

  A. Request access to Migration Evaluator. Run the Migration Evaluator Collector and import the data. Configure a scenario. Export a Quick Insights report from Migration Evaluator.
  B. Launch AWS Database Migration Service (AWS DMS) for the on-premises database. Generate an assessment report. Create an estimate in AWS Pricing Calculator for the costs of the EKS migration.
  C. Initialize AWS Application Migration Service. Add the on-premises servers as source servers. Launch a test instance. Output a TCO report from Application Migration Service.
  D. Access the AWS Cloud Economics Center webpage to assess the AWS Cloud Value Framework. Create an AWS Cost and Usage report from the Cloud Value Framework.
  A. Request access to Migration Evaluator. Run the Migration Evaluator Collector and import the data. Configure a scenario. Export a Quick Insights report from Migration Evaluator.