Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 531:

  A company is migrating mobile banking applications to run on Amazon EC2 instances in a VPC. Backend service applications run in an on-premises data center.

  The data center has an AWS Direct Connect connection into AWS. The applications that run in the VPC need to resolve DNS requests to an on-premises Active Directory domain that runs in the data center.

  Which solution will meet these requirements with the LEAST administrative overhead?

  A. Provision a set of EC2 instances across two Availability Zones in the VPC as caching DNS servers to resolve DNS queries from the application servers within the VPC.
  B. Provision an Amazon Route 53 private hosted zone. Configure NS records that point to on-premises DNS servers.
  C. Create DNS endpoints by using Amazon Route 53 Resolver Add conditional forwarding rules to resolve DNS namespaces between the on-premises data center and the VPC.
  D. Provision a new Active Directory domain controller in the VPC with a bidirectional trust between this new domain and the on-premises Active Directory domain.
  C. Create DNS endpoints by using Amazon Route 53 Resolver Add conditional forwarding rules to resolve DNS namespaces between the on-premises data center and the VPC.

• Question 532:

  An EC2-based ticketing service pulls a frequently updated pricing file (stored in S3) on startup. Sometimes EC2s have stale pricing, causing charge issues.

  A. Lambda updates DynamoDB with new prices.
  B. Lambda updates Amazon EFS.
  C. Use Mountpoint for S3 to mount the pricing file to EC2.
  D. Use Multi-Attach EBS volume for price file.
  C. Use Mountpoint for S3 to mount the pricing file to EC2.

  ---

  Explanation

  Mountpoint for Amazon S3 allows EC2 instances to directly access files in S3 as aPOSIX-compliant mount point, ensuring they always get the latest data without copying or syncing.

  It's simple and cost-effective for read-heavy patterns.

• Question 533:

  A company has developed a new billing application that will be released in two weeks. Developers are testing the application running on 10 EC2 instances managed by an Auto Scaling group in subnet 172.31.0.0/24 within VPC A with CIDR block 172.31.0.0/16. The developers noticed connection timeout errors in the application logs while connecting to an Oracle database running on an Amazon EC2 instance in the same region within VPC B with CIDR block 172.50.0.0/16. The IP of the database instance is hard-

  coded in the application instances.

  Which recommendations should a solutions architect present to the developers to solve the problem in a secure way with minimal maintenance and overhead?

  A. Disable the SrcDestCheck attribute for all instances running the application and Oracle Database. Change the default route of VPC A to point ENI of the Oracle Database that has an IP address assigned within the range of 172.50.0.0/16
  B. Create and attach internet gateways for both VPCs. Configure default routes to the internet gateways for both VPCs. Assign an Elastic IP for each Amazon EC2 instance in VPC A
  C. Create a VPC peering connection between the two VPCs and add a route to the routing table of VPC A that points to the IP address range of 172.50.0.0/16
  D. Create an additional Amazon EC2 instance for each VPC as a customer gateway; create one virtual private gateway (VGW) for each VPC. configure an end-to-end VPC, and advertise the routes for 172.50.0.0/16
  C. Create a VPC peering connection between the two VPCs and add a route to the routing table of VPC A that points to the IP address range of 172.50.0.0/16

• Question 534:

  A company is migrating a document processing workload to AWS. Client applications upload documents to an Amazon S3 bucket for processing. A document processing engine runs on an Amazon EC2 Linux instance and requires Portable Operating System Interface (POSIX)-compliant file system access to read, generate, and modify files during processing. The processed documents must be automatically available in the S3 bucket for client applications to download. The company cannot directly modify the document processing engine to use the S3 API. The company needs a solution that provides the EC2 instance with file system access. The solution must maintain automatic synchronization with the S3 bucket for both input and output files.

  Which solution will meet these requirements?

  A. Configure AWS DataSync to connect to the EC2 instance without an agent. Configure a DataSync task in enhanced mode to synchronize the processed documents to and from Amazon S3.
  B. Configure an Amazon FSx for Lustre file system with import and export policies that are linked to the S3 bucket. Install the Lustre client on the EC2 instance and mount the file system.
  C. Create an Amazon EFS file system. Set the data repository associations to the S3 bucket. Install the EFS client and mount the file system. Create an automatic import and export policy for new and changed objects.
  D. Set up an Amazon S3 File Gateway. Initiate a RefreshCache API call to update the S3 File Gateway when changes occur in Amazon S3.
  B. Configure an Amazon FSx for Lustre file system with import and export policies that are linked to the S3 bucket. Install the Lustre client on the EC2 instance and mount the file system.

  ---

  Explanation

  B is correct because Amazon FSx for Lustre provides a high-performance, POSIX-compliant file system that can be directly linked with Amazon S3 using data repository integration. This allows the EC2-based processing engine (which requires POSIX file operations) to read/write files through a mounted Lustre file system while automatically importing objects from S3 and exporting results back to S3 using Lustre's S3 integration policies. This satisfies all requirements: POSIX file access, no need to change the application to use the S3 API, and automated synchronization for both inputs and outputs.

  Why the other options are incorrect:

  A: DataSync is designed for scheduled or task-based data transfers. It does not provide a mounted POSIX file system interface for the application to read/write "in place," and the "without an agent" requirement is not a fit for an EC2-hosted POSIX workflow that needs continuous file semantics.

  C: Amazon EFS is POSIX and mountable, but "data repository associations to S3" is not an EFS capability in the way described. EFS does not provide native bidirectional automatic sync with S3 using import/export policies like FSx for Lustre's S3 integration.

  D: S3 File Gateway provides a file interface backed by S3, but keeping cache coherent with explicit RefreshCache calls is operationally complex and not truly "automatic synchronization" in the sense required. It also introduces caching behaviors that can complicate immediate availability expectations.

  References:

  Amazon FSx for Lustre Documentation: POSIX-compliant Lustre file system data repository integration with S3 import/export behavior and policies Amazon S3 Documentation: object storage model and integration patterns with file systems AWS Storage Gateway Documentation: S3 File Gateway behavior, caching, and RefreshCache operations AWS Certified Solutions Architect - Professional (SAP-C02) Exam Guide: selecting storage services for migration constraints (POSIX needs, minimal refactoring, S3 integration)

• Question 535:

  A company has an organization in AWS Organizations. In a linked AWS account, the company has Amazon EC2 instances that are running for different projects. The company uses cost allocation tags for the EC2 instances and the Amazon EBS volumes to map the resources to the different projects. After a project is finished, the company terminates the EC2 instances and the EBS volumes. Occasionally, EC2 instances and EBS volumes are not tagged. In these cases, the company struggles to map the resources to the correct project. A solutions architect must create an SCP to prevent the creation of EC2 instances and EBS volumes without the project tags.

  Which SCP will meet these requirements?

  A. Create an SCP that denies ec2:RunInstances when the aws:RequestTag/Project condition key is null for EC2 instance and EBS volume resources.
  B. Create an SCP that denies ec2:StartInstances when the aws:RequestTag/Project condition key is null for EC2 instance and EBS volume resources.
  C. Create an SCP that denies ec2:RunInstances when the aws:CostAllocationTag/Project condition key is null for EC2 instance and EBS volume resources.
  D. Create an SCP that denies ec2:StartInstances when the aws:CostAllocationTag/Project condition key is null for EC2 instance and EBS volume resources.
  A. Create an SCP that denies ec2:RunInstances when the aws:RequestTag/Project condition key is null for EC2 instance and EBS volume resources.

  ---

  Explanation

  The correct answer is A because the control must prevent creation of new EC2 instances and EBS volumes unless the required Project tag is supplied in the launch request. The relevant API action is ec2:RunInstances, not ec2:StartInstances. AWS supports enforcing tags at resource creation by using request tag condition keys such as aws:RequestTag/Project. A deny statement with the Null condition set to true blocks the request when the tag is missing. aws:CostAllocationTag is not the correct condition key for authorization at launch time; cost allocation tags are for billing categorization after tags exist. AWS tagging guidance specifically shows deny policies for ec2:RunInstances when a required cost allocation-style tag is not present in the request. (AWS Documentation)

• Question 536:

  During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository . The security team wants to automatically find and remediate instances of this security vulnerability.

  Which solution will ensure that the credentials are appropriately secured automatically?

  A. Run a script nightly using AWS Systems Manager Run Command to search for credentials on the development instances If found use AWS Secrets Manager to rotate the credentials.
  B. Use a scheduled AWS Lambda function to download and scan the application code from CodeCommit If credentials are found, generate new credentials and store them in AWS KMS
  C. Configure Amazon Macie to scan for credentials in CodeCommit repositories If credentials are found, trigger an AWS Lambda function to disable the credentials and notify the user
  D. Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials If credentials are found, disable them in AWS IAM and notify the user.
  D. Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials If credentials are found, disable them in AWS IAM and notify the user.

  ---

  Explanation

  CodeCommit may use S3 on the back end (and it also uses DynamoDB on the back end) but I don't think they're stored in buckets that you can see or point Macie to. In fact, there are even solutions out there describing how to copy your repo from CodeCommit into S3 to back it up:

  https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automate-event-driven-backups-from-codecommit-to-amazon-s3-using-codebuild-and-cloudwatch-events.html

• Question 537:

  A company operates an on-premises software-as-a-service (SaaS) solution that ingests several files daily.

  The company provides multiple public SFTP endpoints to its customers to facilitate the file transfers. The customers add the SFTP endpoint IP addresses to their firewall allow list for outbound traffic. Changes to the SFTP endmost IP addresses are not permitted.

  The company wants to migrate the SaaS solution to AWS and decrease the operational overhead of the file transfer service.

  Which solution meets these requirements?

  A. Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.
  B. Add a subnet containing the customer-owned block of IP addresses to a VPC Create Elastic IP addresses from the address pool and assign them to an Application Load Balancer (ALB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the ALB. Store the files in attached Amazon Elastic Block Store (Amazon EBS) volumes.
  C. Register the customer-owned block of IP addresses with Amazon Route 53. Create alias records in Route 53 that point to a Network Load Balancer (NLB). Launch EC2 instances hosting FTP services in an Auto Scaling group behind the NLB. Store the files in Amazon S3.
  D. Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an Amazon S3 VPC endpoint. Enable SFTP support on the S3 bucket.
  A. Register the customer-owned block of IP addresses in the company's AWS account. Create Elastic IP addresses from the address pool and assign them to an AWS Transfer for SFTP endpoint. Use AWS Transfer to store the files in Amazon S3.

  ---

  Explanation

  Bring your own IP addresses (BYOIP) You can bring part or all of your publicly routable IPv4 or IPv6 address range from your on-premises network to your AWS account. You continue to own the address range, but AWS advertises it on the internet by default. After you bring the address range to AWS, it appears in your AWS account as an address pool.

  https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-byoip.html

  AWS Transfer for SFTP enables you to easily move your file transfer workloads that use the Secure Shell File Transfer Protocol (SFTP) to AWS without needing to modify your applications or manage any SFTP servers.

  https://aws.amazon.com/about-aws/whats-new/2018/11/aws-transfer-for-sftp-fully-managed-sftp-for-s3/

• Question 538:

  A company's AWS architecture currently uses access keys and secret access keys stored on each instance to access AWS services Database credentials are hard-coded on each instance SSH keys for command-line remote access are stored in a secured Amazon S3 bucket.

  The company has asked its solutions architect to improve the security posture of the architecture without adding operational complexly.

  Which combination of steps should the solutions architect take to accomplish this? (Select THREE.)

  A. Use Amazon EC2 instance profiles with an IAM role
  B. Use AWS Secrets Manager to store access keys and secret access keys
  C. Use AWS Systems Manager Parameter Store to store database credentials
  D. Use a secure fleet of Amazon EC2 bastion hosts for remote access
  E. Use AWS KMS to store database credentials
  F. Use AWS Systems Manager Session Manager for remote access
  A. Use Amazon EC2 instance profiles with an IAM role
  C. Use AWS Systems Manager Parameter Store to store database credentials
  F. Use AWS Systems Manager Session Manager for remote access

• Question 539:

  A development team s Deploying new APIs as serverless applications within a company. The team is currently using the AWS Maragement Console to provision Amazon API Gateway.

  AWS Lambda, and Amazon DynamoDB resources A solutions architect has been tasked with automating the future deployments of these serveriess APIs How can this be accomplished?

  A. Use AWS CloudFonTiation with a Lambda-backed custom resource to provision API Gateway Use the MfS: :OynMoDB::Table and AWS::Lambda::Function resources to create the Amazon DynamoOB table and Lambda functions Write a script to automata the deployment of the CloudFormation template.
  B. Use the AWS Serverless Application Model to define the resources Upload a YAML template and application files to the code repository Use AWS CodePipeline to conned to the code repository and to create an action to build using AWS CodeBuild. Use the AWS CloudFormabon deployment provider m CodePipeline to deploy the solution.
  C. Use AWS CloudFormation to define the serverless application. Implement versioning on the Lambda functions and create aliases to point to the versions. When deploying, configure weights to implement shifting traffic to the newest version, and gradually update the weights as traffic moves over
  D. Commit the application code to the AWS CodeCommit code repository. Use AWS CodePipeline and connect to the CodeCommit code repository Use AWS CodeBuild to build and deploy the Lambda functions using AWS CodeDeptoy Specify the deployment preference type in CodeDeploy to gradually shift traffic over to the new version.
  B. Use the AWS Serverless Application Model to define the resources Upload a YAML template and application files to the code repository Use AWS CodePipeline to conned to the code repository and to create an action to build using AWS CodeBuild. Use the AWS CloudFormabon deployment provider m CodePipeline to deploy the solution.

• Question 540:

  A company runs a website on Amazon ECS containers that use the AWS Fargate launch type. The company configures AWS Application Auto Scaling by using a target tracking scaling policy. The company sets the request count as the scaling metric. An Application Load Balancer (ALB) serves traffic to the ECS containers. The website serves images on request and resizes the images to a predefined size to match the viewers ' screens. After the website resizes an image, the website caches the image locally in a container and serves subsequent requests from the cache. During periods of high traffic, the company observed that images load slowly and with high latency. The company wants to minimize the latency to serve images.

  Which solution will meet this requirement with the LEAST operational overhead?

  A. Create a new Amazon CloudFront distribution and an Amazon S3 bucket. Set the ALB as one origin for the distribution and the S3 bucket as a second origin. Configure a cache behavior that routes image requests to the S3 origin, and configure a default cache behavior for the ALB origin. Pre-scale all images and upload the images to the S3 bucket.
  B. Create an Amazon ElastiCache (Memcached) cluster. Update the application to read and write the resized images to the ElastiCache (Memcached) cluster by using the image name and size as the key.
  C. Create an Amazon Aurora cluster and an Amazon S3 bucket. Update the application to store resized images in the S3 bucket and to store a cache key in the Aurora cluster. Configure the application to load the cache key from the Aurora cluster and to serve images from the S3 bucket.
  D. Create an Amazon API Gateway HTTP API and enable API request caching. Replace the ALB with the HTTP API and remove the local caching in the application code.
  A. Create a new Amazon CloudFront distribution and an Amazon S3 bucket. Set the ALB as one origin for the distribution and the S3 bucket as a second origin. Configure a cache behavior that routes image requests to the S3 origin, and configure a default cache behavior for the ALB origin. Pre-scale all images and upload the images to the S3 bucket.

  ---

  Explanation

  The core issue is high latency when serving images during traffic spikes. The current design resizes images dynamically and caches them locally inside ECS containers. With AWS Fargate, containers are ephemeral and scale in and out based on load. Local container caches are not shared across tasks, so cache hit rates drop during scaling events, forcing repeated image resizing. This increases CPU usage, startup latency, and response times under load.

  The lowest operational overhead and most effective solution is to offload image delivery entirely from the application layer and use edge caching. Amazon CloudFront is designed to cache static content at edge locations close to end users, dramatically reducing latency and backend load. Amazon S3 is a durable, highly scalable object store that is well suited for serving static assets such as images.

  Option A moves image delivery to a CloudFront + S3 architecture. By pre-scaling images and storing them in S3, the application no longer performs on-demand image resizing during requests. CloudFront caches the images at edge locations, so subsequent requests are served directly from the edge with minimal latency. The ALB remains the origin for dynamic content, while image requests are routed to the S3 origin using cache behaviors. This approach is fully managed, highly scalable, and requires minimal changes to the application logic once images are pre-generated.

  Option B introduces ElastiCache, which adds operational overhead and complexity. The application must manage cache keys, eviction, and failure scenarios. ElastiCache is better suited for low-latency data access patterns rather than large static objects like images, and it does not provide global edge caching.

  Option C adds unnecessary complexity by introducing an Aurora database as part of the caching layer.

  Databases are not designed to manage cache metadata for static assets at scale, and this design increases operational overhead without improving latency compared to CloudFront. Option D is not appropriate because API Gateway caching is intended for API responses, not for efficient delivery of large static binary objects such as images. Replacing the ALB with API Gateway also introduces request size, payload, and cost considerations and does not provide global edge caching comparable to CloudFront for image delivery. Therefore, using Amazon CloudFront with Amazon S3 for pre-scaled images provides the lowest latency, highest scalability, and least operational overhead.

  References:

  AWS documentation on Amazon CloudFront for low-latency delivery of static content through global edge caching.AWS documentation on Amazon S3 as a scalable origin for static assets and integration with CloudFront.AWS best practices for separating static content delivery from dynamic application workloads to reduce backend load and improve performance.