Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 481:

  A company has a policy that all Amazon EC2 instances that are running a database must exist within the same subnets in a shared VPC Administrators must follow security compliance requirements and are not allowed to directly log in to the shared account All company accounts are members of the same organization in AWS Organizations. The number of accounts will rapidly increase as the company grows.

  A solutions architect uses AWS Resource Access Manager to create a resource share in the shared account.

  What is the MOST operationally efficient configuration to meet these requirements?

  A. Add the VPC to the resource share. Add the account IDs as principals
  B. Add all subnets within the VPC to the resource share. Add the account IDs as principals
  C. Add all subnets within the VPC to the resource share. Add the organization as a principal.
  D. Add the VPC to the resource share. Add the organization as a principal
  C. Add all subnets within the VPC to the resource share. Add the organization as a principal.

  ---

  Explanation

  https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-createTorestrictresourcesharingtoonlyprincipalsinyourorganization,chooseAllowsharingwithprincipalsinyourorganizationonly.

  https://docs.aws.amazon.com/ram/latest/userguide/ram-ug.pdf

• Question 482:

  A company is using Amazon OpenSearch Service to analyze data. The company loads data into an OpenSearch Service cluster with 10 data nodes from an Amazon S3 bucket that uses S3 Standard storage. The data resides in the cluster for 1 month for read-only analysis. After 1 month, the company deletes the index that contains the data from the cluster. For compliance purposes, the company must retain a copy of all input data.

  The company is concerned about ongoing costs and asks a solutions architect to recommend a new solution.

  Which solution will meet these requirements MOST cost-effectively?

  A. Replace all the data nodes with UltraWarm nodes to handle the expected capacity. Transition the input data from S3 Standard to S3 Glacier Deep Archive when the company loads the data into the cluster.
  B. Reduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacity. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the data. Transition the input data to S3 Glacier Deep Archive after 1 month by using an S3 Lifecycle policy.
  C. Reduce the number of data nodes in the cluster to 2. Add UltraWarm nodes to handle the expected capacity. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the data. Add cold storage nodes to the cluster Transition the indexes from UltraWarm to cold storage. Delete the input data from the S3 bucket after 1 month by using an S3 Lifecycle policy.
  D. Reduce the number of data nodes in the cluster to 2. Add instance-backed data nodes to handle the expected capacity. Transition the input data from S3 Standard to S3 Glacier Deep Archive when the company loads the data into the cluster.
  B. Reduce the number of data nodes in the cluster to 2 Add UltraWarm nodes to handle the expected capacity. Configure the indexes to transition to UltraWarm when OpenSearch Service ingests the data. Transition the input data to S3 Glacier Deep Archive after 1 month by using an S3 Lifecycle policy.

  ---

  Explanation

  By reducing the number of data nodes in the cluster to 2 and adding UltraWarm nodes to handle the expected capacity, the company can reduce the cost of running the cluster. Additionally, configuring the indexes to transition to UltraWarm when OpenSearch Service ingests the data will ensure that the data is stored in the most cost-effective manner. Finally, transitioning the input data to S3 Glacier Deep Archive after 1 month by using an S3 Lifecycle policy will ensure that the data is retained for compliance purposes, while also reducing the ongoing costs.

• Question 483:

  A flood monitoring agency has deployed more than 10.000 water-level monitoring sensors. Sensors send continuous data updates, and each update Is less than 1 MB in size. The agency has a fleet of on-premises application servers. These servers receive updates from the sensors, convert the raw data into a human readable format, and write the results to an on-premises relational database server Data analysts then use simple SQL queries to monitor the data.

  The agency wants to increase overall application availability and reduce the effort that is required to perform maintenance tasks. These maintenance tasks, which include updates and patches to the application servers, cause downtime. While an application server is down, data is lost from sensors because the remaining servers cannot handle the entire workload.

  The agency wants a solution that optimizes operational overhead and costs. A solutions architect recommends the use of AWS loT Core to collect the sensor data.

  What else should the solutions architect recommend to meet these requirements?

  A. Send the sensor data to Amazon Kinesis Data Firehose. Use an AWS Lambda function to read the Kinesis Data Firehose data, convert it to .csv format, and insert it into an Amazon Aurora MySQL DB Instance. Instruct the data analysts to query the data directly from the DB Instance.
  B. Send the sensor data to Amazon Kinesis Data Firehose. Use an AWS Lambda function to read the Kinesis Data Firehose data, convert it to Apache Parquet format, and save it to an Amazon S3 bucket. Instruct the data analysts to query the data by using Amazon Athena.
  C. Send the sensor data to an Amazon Kinesis Data Analytics application to convert the data to csv format and store it in an Amazon S3 bucket. Import the data Into an Amazon Aurora MySQL DB instance. Instruct the data analysts to query the data directly from the DB instance
  D. Send the sensor data to an Amazon Kinesis Data Analytics application to convert the data to Apache Parquet format and store it in an Amazon S3 bucket. Instruct the data analysts to query the data by using Amazon Athena.
  B. Send the sensor data to Amazon Kinesis Data Firehose. Use an AWS Lambda function to read the Kinesis Data Firehose data, convert it to Apache Parquet format, and save it to an Amazon S3 bucket. Instruct the data analysts to query the data by using Amazon Athena.

• Question 484:

  A company needs a highly available database solution for an application. The solution must be able to fail over to a secondary AWS Region with an RPO of 5 minutes and an RTO of 20 minutes. The database is approximately 10 TB in size.

  Which solution will meet these requirements?

  A. Deploy an Amazon Aurora DB cluster and take snapshots of the cluster every 5 minutes. When each snapshot is complete, copy the snapshot to a secondary Region.
  B. Deploy an Amazon RDS Multi-AZ DB cluster with a cross-Region read replica in a secondary Region. Use an Amazon CloudWatch alarm to invoke an AWS Lambda function that promotes the read replica to become the primary in the event of a failure.
  C. Deploy an Amazon Aurora DB cluster in the primary Region. Configure Amazon EventBridge to target Amazon RDS to create a second cluster in the event of a failure. Use AWS DMS to keep the secondary Region in sync with the primary Region.
  D. Deploy an Amazon RDS Multi-AZ DB cluster in the primary Region with a cross-Region read replica in a secondary Region. Configure automated backups and enable automated failover to promote the read replica to become the primary in the secondary Region.
  B. Deploy an Amazon RDS Multi-AZ DB cluster with a cross-Region read replica in a secondary Region. Use an Amazon CloudWatch alarm to invoke an AWS Lambda function that promotes the read replica to become the primary in the event of a failure.

  ---

  Explanation

  The requirements specify cross-Region failover with an RPO of 5 minutes and an RTO of 20 minutes for a large (10 TB) database. Achieving a low RPO in a secondary Region typically requires near-continuous replication, not periodic snapshots. Achieving a 20-minute RTO requires that the standby data store already exists in the secondary Region and can be promoted quickly.

  A cross-Region read replica provides continuous asynchronous replication from the primary Region to a replica in the secondary Region. This is the standard managed approach for cross-Region disaster recovery for Amazon RDS engines that support read replicas. With a read replica already running in the secondary Region, failover can be accomplished by promoting the replica to a standalone primary database instance. This supports an RTO target like 20 minutes because the data is already present and the promotion operation is typically faster than restoring from a full snapshot, especially at 10 TB scale.

  Option B describes creating an RDS Multi-AZ DB cluster in the primary Region and a cross-Region read replica in the secondary Region. Multi-AZ addresses high availability within the primary Region, while the cross-Region replica addresses disaster recovery. The option also includes automation using CloudWatch alarms and a Lambda function to promote the replica when a failure is detected. This supports the required RTO by reducing manual intervention time and supports the RPO by using continuous replication.

  Option A is not practical for RPO 5 minutes at 10 TB. Taking and copying snapshots every 5 minutes would be operationally heavy and would not complete within the required window; snapshot creation and cross-Region copy are not designed for such high-frequency near-real-time DR. It also risks missing the

  RPO due to snapshot completion time.

  Option C introduces unnecessary complexity and additional services. Creating a second cluster only at failure time is not compatible with a 20-minute RTO for a 10 TB database, and using DMS for continuous sync is more development and operational work than using native RDS replication. This is not the least overhead or most direct DR design.

  Option D is incorrect as stated because cross-Region read replicas are not automatically failed over and promoted by an "automated failover" feature in the way Multi-AZ failover works within a Region. Automated backups do not provide near-real-time cross-Region recovery to meet a 5-minute RPO. The usual approach for cross-Region is to create the replica and then promote it through a controlled process, which can be automated via monitoring and Lambda as in

  option B.

  Therefore, using a cross-Region read replica with automation to promote it provides the necessary RPO/ RTO with a managed service approach.

  References:

  AWS documentation on Amazon RDS cross-Region read replicas for disaster recovery and replica promotion procedures.AWS documentation on Multi-AZ deployments for high availability within a Region and combining Multi-AZ with cross-Region read replicas for DR.AWS best practices for meeting RPO/ RTO using continuous replication rather than periodic snapshots for large databases.

• Question 485:

  A company is developing an application that will display financial reports. The company needs a solution that can store financial Information that comes from multiple systems. The solution must provide the reports through a web interface and must serve the data will less man 500 milliseconds or latency to end users. The solution also must be highly available and must have an RTO or 30 seconds.

  Which solution will meet these requirements?

  A. Use an Amazon Redshift cluster to store the data. Use a state website that is hosted on Amazon S3 with backend APIs that ate served by an Amazon Elastic Cubemates Service (Amazon EKS) cluster to provide the reports to the application.
  B. Use Amazon S3 to store the data Use Amazon Athena to provide the reports to the application. Use AWS App Runner to serve the application to view the reports.
  C. Use Amazon DynamoDB to store the data, use an embedded Amazon QuickStight dashboard with direct Query datasets to provide the reports to the application.
  D. Use Amazon Keyspaces (for Apache Cassandra) to store the data, use AWS Elastic Beanstalk to provide the reports to the application.
  C. Use Amazon DynamoDB to store the data, use an embedded Amazon QuickStight dashboard with direct Query datasets to provide the reports to the application.

  ---

  Explanation

  For an application requiring low-latency access to financial information and high availability with a Recovery Time Objective (RTO) of 30 seconds, using Amazon DynamoDB for data storage and Amazon QuickSight for reporting is the most suitable solution. DynamoDB offers fast, consistent, and single-digit millisecond latency for data retrieval, meeting the latency requirements. QuickSight's ability to directly query DynamoDB datasets and provide embedded dashboards for reporting enables real-time financial report generation. This combination ensures high availability and meets the RTO requirement, providing a robust solution for the application's needs.

  References:

  Amazon DynamoDB Documentation: Describes the features and benefits of DynamoDB, emphasizing its performance and scalability for applications requiring low-latency access to data. Amazon QuickSight Documentation: Provides information on using QuickSight for creating and embedding interactive dashboards, including direct querying of DynamoDB datasets for real-time data visualization.

• Question 486:

  A company has a serverless multi-tenant content management system on AWS. The architecture contains a web-based front end that interacts with an Amazon API Gateway API that uses a custom AWS Lambda authorizes.

  The authorizer authenticates a user to its tenant ID and encodes the information in a JSON Web Token (JWT) token. After authentication, each API call through API Gateway targets a Lambda function that interacts with a single Amazon DynamoOB table to fulfill requests.

  To comply with security standards, the company needs a stronger isolation between tenants. The company will have hundreds of customers within the first year.

  Which solution will meet these requirements with the LEAST operational?

  A. Create a DynamoDB table for each tenant by using the tenant ID in the table name. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach IAM policies to the execution role to allow access only to the DynamoDB table for the tenant.
  B. Add tenant ID information to the partition key of the DynamoDB table. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach IAM policies to the execution role to allow access to items in the table only when the key matches the tenant ID.
  C. Create a separate AWS account for each tenant of the application. Use dedicated infrastructure for each tenant. Ensure that no cross-account network connectivity exists.
  D. Add tenant ID as a sort key in every DynamoDB table. Add logic to each Lambda function to use the tenant ID that comes from the JWT token as the sort key in every operation on the DynamoDB table.
  B. Add tenant ID information to the partition key of the DynamoDB table. Create a service that uses the JWT token to retrieve the appropriate Lambda execution role that is tenant-specific. Attach IAM policies to the execution role to allow access to items in the table only when the key matches the tenant ID.

• Question 487:

  A financial services company logs personally identifiable information 10 its application logs stored in Amazon S3. Due to regulatory compliance requirements, the log files must be encrypted at rest. The security team has mandated that the company's on-premises hardware security modules (HSMs) be used to generate the CMK material.

  Which steps should the solutions architect take to meet these requirements?

  A. Create an AWS CloudHSM cluster. Create a new CMK in AWS KMS using AWS_CloudHSM as the source (or the key material and an origin of AWS_CLOUDHSM. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the togging bucket thai disallows uploads of unencrypted data and requires that the encryption source be AWS KMS.
  B. Provision an AWS Direct Connect connection, ensuring there is no overlap of the RFC 1918 address space between on-premises hardware and the VPCs. Configure an AWS bucket policy on the logging bucket that requires all objects to be encrypted. Configure the logging application to query the on-premises HSMs from the AWS environment for the encryption key material, and create a unique CMK for each logging event.
  C. Create a CMK in AWS KMS with no key material and an origin of EXTERNAL. Import the key material generated from the on-premises HSMs into the CMK using the public key and import token provided by AWS. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.
  D. Create a new CMK in AWS KMS with AWS-provided key material and an origin of AWS_KMS. Disable this CMK. and overwrite the key material with the key material from the on-premises HSM using the public key and import token provided by AWS. Re-enable the CMK. Enable automatic key rotation on the CMK with a duration of 1 year. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.
  C. Create a CMK in AWS KMS with no key material and an origin of EXTERNAL. Import the key material generated from the on-premises HSMs into the CMK using the public key and import token provided by AWS. Configure a bucket policy on the logging bucket that disallows uploads of non-encrypted data and requires that the encryption source be AWS KMS.

  ---

  Explanation

  https://aws.amazon.com/blogs/security/how-to-byok-bring-your-own-key-to-aws-kms-for-less-than-15-00-a-year-using-aws-cloudhsm/

  https://docs.aws.amazon.com/kms/latest/developerguide/importing-keys-create-cmk.html

• Question 488:

  A company is running a containerized application in the AWS Cloud. The application is running by using Amazon Elastic Container Service (Amazon ECS) on a set Amazon EC2 instances. The EC2 instances run in an Auto Scaling group.

  The company uses Amazon Elastic Container Registry (Amazon ECRJ to store its container images.

  When a new image version is uploaded, the new image version receives a unique tag

  The company needs a solution that inspects new image versions for common vulnerabilities and exposures.

  The solution must automatically delete new image tags that have Critical or High severity findings.

  The solution also must notify the development team when such a deletion occurs.

  Which solution meets these requirements?

  A. Configure scan on push on the repository. Use Amazon EventBridge (Amazon CloudWatch Events) to invoke an AWS Step Functions state machine when a scan is complete for images that have Critical or High severity findings Use the Step Functions state machine to delete the image tag for those images and to notify the development team through Amazon Simple Notification Service (Amazon SNS)
  B. Configure scan on push on the repository Configure scan results to be pushed to an Amazon Simple Queue Service (Amazon SQS) queue Invoke an AWS Lambda function when a new message is added to the SOS queue Use the Lambda function to delete the image tag for images that have Critical or High seventy findings. Notify the development team by using Amazon Simple Email Service (Amazon SES).
  C. Schedule an AWS Lambda function to start a manual image scan every hour Configure Amazon EventBridge (Amazon CloudWatch Events) to invoke another Lambda function when a scan is complete. Use the second Lambda function to delete the image tag for images that have Cnocal or High severity findings. Notify the development team by using Amazon Simple Notification Service (Amazon SNS)
  D. Configure periodic image scan on the repository Configure scan results to be added to an Amazon Simple Queue Service (Amazon SQS) queue Invoke an AWS Step Functions state machine when a new message is added to the SQS queue Use the Step Functions state machine to delete the image tag for images that have Critical or High severity findings. Notify the development team by using Amazon Simple Email Service (Amazon SES).
  A. Configure scan on push on the repository. Use Amazon EventBridge (Amazon CloudWatch Events) to invoke an AWS Step Functions state machine when a scan is complete for images that have Critical or High severity findings Use the Step Functions state machine to delete the image tag for those images and to notify the development team through Amazon Simple Notification Service (Amazon SNS)

• Question 489:

  A solutions architect is building a web application that uses an Amazon RDS for PostgreSQL DB instance

  The DB instance is expected to receive many more reads than writes.

  The solutions architect needs to ensure that the large amount of read traffic can be accommodated and that the DB instance is highly available.

  Which steps should the solutions architect take to meet these requirements? (Select THREE.)

  A. Create multiple read replicas and put them into an Auto Scaling group
  B. Create multiple read replicas in different Availability Zones.
  C. Create an Amazon Route 53 hosted zone and a record set for each read replica with a TTL and a weighted routing policy
  D. Create an Application Load Balancer (ALBJ and put the read replicas behind the ALB.
  E. Configure an Amazon CloudWatch alarm to detect a failed read replica Set the alarm to directly invoke an AWS Lambda function to delete its Route 53 record set.
  F. Configure an Amazon Route 53 health check for each read replica using its endpoint
  B. Create multiple read replicas in different Availability Zones.
  C. Create an Amazon Route 53 hosted zone and a record set for each read replica with a TTL and a weighted routing policy
  F. Configure an Amazon Route 53 health check for each read replica using its endpoint

  ---

  Explanation

  https://aws.amazon.com/premiumsupport/knowledge-center/requests-rds-read-replicas/

  You can use Amazon Route 53 weighted record sets to distribute requests across your read replicas.WithinaRoute53hostedzone,createindividualrecordsetsforeachDNSendpointassociatedwithyourreadreplicasandgivethemthesameweight.Then,directrequeststotheendpointoftherecordset.YoucanincorporateRoute53healthcheckstobesurethatRoute53directstrafficawayfromunavailablereadreplicas

• Question 490:

  A company is planning a one-time migration of an on-premises MySQL database to Amazon Aurora MySQL in the us-east-1 Region. The company's current internet connection has limited bandwidth. The on-premises MySQL database is 60 TB in size.

  The company estimates that it will take a month to transfer the data to AWS over the current internet connection.

  The company needs a migration solution that will migrate the database more quickly.

  Which solution will migrate the database in the LEAST amount of time?

  A. Request a 1 Gbps AWS Direct Connect connection between the on-premises data center and AWS Use AWS Database Migration Service (AWS DMS) to migrate the on-premises MySQL database to Aurora MySQL.
  B. Use AWS DataSync with the current internet connection to accelerate the data transfer between the on-premises data center and AWS Use AWS Application Migration Service to migrate the on-premises MySQL database to Aurora MySQL.
  C. Order an AWS Snowball Edge Device Load the data into an Amazon S3 bucket by using the S3 interface Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazon S3 to Aurora MySQL
  D. Order an AWS Snowball Device Load the data into an Amazon S3 bucket by using the S3 Adapter for Snowball Use AWS Application Migration Service to migrate the data from Amazon S3 to Aurora MySQL.
  C. Order an AWS Snowball Edge Device Load the data into an Amazon S3 bucket by using the S3 interface Use AWS Database Migration Service (AWS DMS) to migrate the data from Amazon S3 to Aurora MySQL