Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 551:

  A company is storing data on premises on a Windows file server. The company produces 5 GB of new data daily.

  The company migrated part of its Windows-based workload to AWS and needs the data to be available on a file system in the cloud. The company already has established an AWS Direct Connect connection between the on-premises network and AWS.

  Which data migration strategy should the company use?

  A. Use the file gateway option in AWS Storage Gateway to replace the existing Windows file server, and point the existing file share to the new file gateway.
  B. Use AWS DataSync to schedule a daily task to replicate data between the on-premises Windows file server and Amazon FSx.
  C. Use AWS Data Pipeline to schedule a daily task to replicate data between the on-premises Windows file server and Amazon Elastic File System (Amazon EFS).
  D. Use AWS DataSync to schedule a daily task lo replicate data between the on-premises Windows file server and Amazon Elastic File System (Amazon EFS),
  B. Use AWS DataSync to schedule a daily task to replicate data between the on-premises Windows file server and Amazon FSx.

  ---

  Explanation

  https://aws.amazon.com/storagegateway/file/

  https://docs.aws.amazon.com/fsx/latest/WindowsGuide/migrate-files-to-fsx-datasync.html

  https://docs.aws.amazon.com/systems-manager/latest/userguide/prereqs-operating-systems.html#prereqs-os-windows-server

• Question 552:

  A company is running a compute workload by using Amazon EC2 Spot Instances in an Auto Scaling group. The launch template uses two placement groups and one instance type. Recently, a monitoring system reported Auto Scaling instance launch failures that correlated with longer wait times for system users. The company needs to improve the overall reliability of the workload.

  Which solution will meet these requirements?

  A. Create a launch configuration that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch configuration.
  B. Create a launch configuration that uses a larger instance type. Configure the Auto Scaling group to use the launch configuration and the launch template.
  C. Create a new launch template version that increases the number of placement groups to 3. Configure the Auto Scaling group to use the new launch template version.
  D. Create a new launch template version that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch template version.
  D. Create a new launch template version that uses attribute-based instance type selection. Configure the Auto Scaling group to use the new launch template version.

  ---

  Explanation

  The workload uses EC2 Spot Instances, which are subject to capacity availability constraints. Using a single instance type significantly increases the risk of launch failures when Spot capacity for that instance type is constrained. This directly impacts application reliability and increases user wait times.

  Attribute-based instance type selection allows Auto Scaling to choose from multiple compatible instance types based on defined requirements such as vCPU count, memory, and architecture. This improves the probability that Spot capacity is available at launch time because Auto Scaling can select from a broader pool of instance types instead of a single one.

  Option D correctly applies attribute-based instance type selection within a new version of the existing launch template. Auto Scaling groups are designed to work with launch templates, and updating the template version is the modern and recommended approach. This change increases Spot placement flexibility and reliability without altering application behavior or introducing additional infrastructure.

  Option A is incorrect because launch configurations are an older construct and do not support attribute-based instance type selection. They are also not recommended for new or updated Auto Scaling designs.

  Option B does not address the root cause of Spot launch failures. Simply using a larger instance type may actually reduce available Spot capacity and worsen reliability.

  Option C increases the number of placement groups, but placement groups do not solve Spot capacity shortages. They influence instance placement for networking or latency characteristics, not Spot availability across instance types. Therefore, updating the launch template to use attribute-based instance type selection is the most effective way to improve reliability for a Spot-based Auto Scaling workload.

  References:

  AWS documentation on EC2

  Auto Scaling with Spot Instances and capacity-optimized and flexible instance selection strategies.AWS documentation on attribute-based instance type selection in EC2 launch templates for improving Spot capacity availability and reliability.

• Question 553:

  A company creates an Amazon API Gateway API and shares the API with an external development team.

  The API uses AWS Lambda functions and is deployed to a stage that is named Production.

  The external development team is the sole consumer of the API. The API experiences sudden increases of usage at specific times, leading to concerns about increased costs. The company needs to limit cost and usage without reworking the Lambda functions.

  Which solution will meet these requirements MOST cost-effectively?

  A. Configure the API to send requests to Amazon Simple Queue Service (Amazon SQS) queues instead of directly to the Lambda functions. Update the Lambda functions to consume messages from the queues and to process the requests. Set up the queues to invoke the Lambda functions when new messages arrive.
  B. Configure provisioned concurrency for each Lambda function. Use AWS Application Auto Scaling to register the Lambda functions as targets. Set up scaling schedules to increase and decrease capacity to match changes in API usage.
  C. Create an API Gateway API key and an AWS WAF Regional web ACL. Associate the web ACL with the Production stage. Add a rate-based rule to the web ACL. In the rule, specify the rate limit and a custom request aggregation that uses the X-API-Key header. Share the API key with the external development team.
  D. Create an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team.
  D. Create an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team.

• Question 554:

  A solutions architect has an operational workload deployed on Amazon EC2 instances in an Auto Scaling group. The VPC architecture spans two Availability Zones (AZ) with a subnet in each that the Auto Scaling group is targeting. The VPC is connected to an on-premises environment and connectivity cannot be interrupted. The maximum size ol the Auto Scaling group is 20 instances in service. The VPC IPv4 addressing is as follows:

  VPC CIDR: 10.0.0.0/23

  AZ1 subnet CIDR: 10.0.0.0/24

  AZ2 subnet CIDR: 10.0.1.0/24

  Since deployment, a third AZ has become available in the Region. The solutions architect wants to adopt the new AZ without adding additional IPv4 address space and without service downtime.

  Which solution will meet these requirements?

  A. Update the Auto Scaling group to use the AZ2 subnet only. Delete and re-create the AZ1 subnet using hall the previous address space. Adjust the Auto Seating group to also use the new AZ1 subnet. When the instances are healthy, adjust the Auto Scaling group to use the AZ1 subnet only. Remove the current AZ2 subnet. Create a new AZ2 subnet using the second half of the address space from the original AZ1 subnet. Create a new AZ3 subnet using half the original AZ2 subnet address space, then update the Auto Scaling group to target all three new subnets.
  B. Terminate the EC2 instances in the AZ1 subnet. Delete and re-create the AZ1 subnet using half the address space. Update the Auto Scaling group to use this new subnet. Repeat this for the second AZ. Define a new subnet in AZ3, then update the Auto Scaling group to target all three new subnets.
  C. Create a new VPC with the same IPv4 address space and define three subnets, with one for each AZ. Update the existing Auto Scaling group to target the new subnets in the new VPC.
  D. Update the Auto Scaling group to use the AZ2 subnet only. Update the AZ1 subnet to have half the previous address space. Adjust the Auto Scaling group to also use the AZ1 subnet again. When the instances are healthy, adjust the Auto Scaling group to use the AZ1 subnet only. Update the current AZ2 subnet and assign the second half of the address space from the original AZ1 subnet. Create a new AZ3 subnet using halt the original AZ2 subnet address space, then update the Auto Scaling group to target all three new subnets.
  A. Update the Auto Scaling group to use the AZ2 subnet only. Delete and re-create the AZ1 subnet using hall the previous address space. Adjust the Auto Seating group to also use the new AZ1 subnet. When the instances are healthy, adjust the Auto Scaling group to use the AZ1 subnet only. Remove the current AZ2 subnet. Create a new AZ2 subnet using the second half of the address space from the original AZ1 subnet. Create a new AZ3 subnet using half the original AZ2 subnet address space, then update the Auto Scaling group to target all three new subnets.

  ---

  Explanation

  https://aws.amazon.com/premiumsupport/knowledge-center/vpc-ip-address-range/?nc1=h_ls

  It's not possible to modify the IP address range of an existing virtual private cloud (VPC) or subnet. You must delete the VPC or subnet, and then create a new VPC or subnet with your preferred CIDR block.

• Question 555:

  A company is deploying a third-party web application to an AWS account. The company wants to deploy the application across multiple Amazon EC2 instances. The company must have the ability to scale horizontally when necessary. The application uses browser cookies for session state management. The application requires session affinity.

  Which solution will meet these requirements?

  A. Assign each EC2 instance a public IP address. Configure an Amazon Route 53 multivalue A record for the application. Enable health checks for the A record. Configure a Route 53 Resolver rule that ensures a specific cookie value will consistently return the same EC2 instance. Access the application by using the Route 53 A record.
  B. Place the EC2 instances in an Auto Scaling group. Configure an Amazon CloudFront distribution and set the Auto Scaling group as the origin. Create a CloudFront function to handle viewer requests. Include cookie processing logic to ensure that users are directed to the correct EC2 instance. Access the application by using the CloudFront distribution URL.
  C. Place the EC2 instances in an Auto Scaling group. Configure a public Application Load Balancer (ALB), and configure the ALB to direct traffic for the application to the Auto Scaling group. Enable sticky sessions on the target group for the application cookies. Access the application by using the ALB domain name.
  D. Configure a Gateway Load Balancer (GWLB). Register the EC2 instances as a target group by using their instance IDs. Enable flow stickiness on the target group. Access the application by using the GWLB domain name.
  C. Place the EC2 instances in an Auto Scaling group. Configure a public Application Load Balancer (ALB), and configure the ALB to direct traffic for the application to the Auto Scaling group. Enable sticky sessions on the target group for the application cookies. Access the application by using the ALB domain name.

  ---

  Explanation

  Comprehensive and Detailed Explanation: This question is testing the correct load balancing design for a stateful web application that: runs on multiple EC2 instances, must scale horizontally, uses browser cookies for session management, requires session affinity.

  The correct solution is to place the EC2 instances in an Auto Scaling group behind an Application Load Balancer and enable sticky sessions on the target group. This allows the application to scale out across multiple instances while ensuring that repeat requests from the same client are routed to the same target for the duration of the stickiness configuration.

  Why C is correct

  An Application Load Balancer is designed for Layer 7 HTTP/HTTPS traffic, which is exactly what a browser-based web application uses. Because the application uses cookies and requires session affinity, ALB is the correct AWS service since it supports sticky sessions for target groups. The EC2 instances can be placed in an Auto Scaling group so the application can add or remove instances as demand changes.

  This directly satisfies the horizontal scaling requirement. ALB also integrates natively with Auto Scaling groups, health checks, and target groups. For web applications that rely on session persistence, ALB stickiness is the standard design choice. The application is third-party, so changing the application to externalize sessions may not be possible. Therefore, keeping requests bound to the same backend instance is the appropriate architecture.

  Why A is incorrect Route 53 does not provide cookie-based session affinity to specific EC2 instances. Multivalue answer routing can return multiple healthy records, but it is a DNS-level mechanism, not an HTTP session persistence mechanism. Route 53 Resolver rules also do not inspect browser cookies and do not ensure that a given cookie value maps consistently to one EC2 instance.

  In addition, exposing each EC2 instance with a public IP is not the right scalable architecture for a horizontally scaled web application. This option lacks proper load balancer behavior and does not provide real application-layer stickiness.

  Why B is incorrect CloudFront cannot use an Auto Scaling group directly as an origin. CloudFront origins are typically an Application Load Balancer, Network Load Balancer, S3 bucket, custom HTTP origin, or similar endpoint.

  An Auto Scaling group itself is not a valid origin endpoint for CloudFront. Also, CloudFront Functions are used for lightweight request and response manipulation at the edge. They are not the correct mechanism to implement instance-level session affinity for a fleet of EC2 instances. Even if cookies are forwarded, CloudFront is not the service that should manage sticky routing among application servers. That role belongs to the load balancer.

  Why D is incorrect Gateway Load Balancer is designed for deploying, scaling, and managing third-party virtual appliances such as firewalls, IDS, and deep packet inspection systems. It is not intended to front standard web applications for browser traffic.

  Flow stickiness on GWLB is not the same as HTTP cookie-based session affinity for a web application.

  GWLB operates for appliance insertion use cases, not for traditional user-facing web application request distribution. Therefore, it does not meet the application requirement appropriately.

• Question 556:

  A company hosts a web application that tuns on a group of Amazon EC2 instances that ate behind an Application Load Balancer (ALB) in a VPC. The company wants to analyze the network payloads lo reverse-engineer a sophisticated attack of the application.

  Which approach should the company take to achieve this goal?

  A. Enable VPC Flow Logs. Store the flow logs in an Amazon S3 bucket for analysis.
  B. Enable Traffic Mirroring on the network interface of the EC2 instances. Send the mirrored traffic lo a target for storage and analysis.
  C. Create an AWS WAF web ACL. and associate it with the ALB. Configure AWS WAF logging.
  D. Enable logging for the ALB. Store the logs in an Amazon S3 bucket for analysis.
  A. Enable VPC Flow Logs. Store the flow logs in an Amazon S3 bucket for analysis.

• Question 557:

  A company has multiple AWS accounts and manages these accounts with AWS Organizations. A developer was given IAM user credentials to access AWS resources. The developer should have read-only access to all Amazon S3 buckets in the account. However, when the developer tries to access the S3 buckets from the console, they receive an access denied error message with no buckets listed. A solutions architect reviews the permissions and finds that the developer ' s IAM user is listed as having read-only access to all S3 buckets in the account.

  Which additional steps should the solutions architect take to troubleshoot the issue? (Select TWO.)

  A. Check the bucket policies for all S3 buckets.
  B. Check the ACLs for all S3 buckets.
  C. Check the SCPs set at the organizational units (OUs).
  D. Check for the permissions boundaries set for the IAM user.
  E. Check if an appropriate IAM role is attached to the IAM user.
  C. Check the SCPs set at the organizational units (OUs).
  D. Check for the permissions boundaries set for the IAM user.

  ---

  Explanation

  When an IAM user appears to have the correct permissions but still receives Access Denied errors, especially in an AWS Organizations environment, the effective permissions must be evaluated across all permission layers. In AWS, permissions are the intersection of all applicable controls, and an explicit deny at any layer overrides any allow.

  First, because the company uses AWS Organizations, service control policies (SCPs) must be evaluated.

  SCPs define the maximum permissions that accounts or organizational units can have. Even if an IAM user or IAM policy allows an action, an SCP attached to the account or OU can explicitly or implicitly deny that action. If an SCP does not allow s3:ListAllMyBuckets or related S3 read actions, the IAM user will not be able to list buckets in the S3 console and will see no buckets at all. Therefore, checking the SCPs applied to the OU or account is a required troubleshooting step. Second, IAM permissions boundaries can further restrict the effective permissions of an IAM user. A permissions boundary defines the maximum permissions that an IAM user can exercise, regardless of what their attached policies allow. If the permissions boundary does not include the required Amazon S3 read-only permissions (such as s3:ListAllMyBuckets or s3:GetBucketLocation), the user will receive access denied errors even though the user's IAM policy appears to allow read-only access. Reviewing whether a permissions boundary is attached, and whether it allows the necessary S3 actions, is essential.

  Option A (checking bucket policies) can be relevant for access to specific buckets or objects, but a user seeing no buckets at all in the S3 console is more commonly caused by missing or denied account-level list permissions rather than individual bucket policies. Bucket policies generally do not control the ability to list all buckets in an account unless they contain explicit denies, which is less common as a first troubleshooting step in an Organizations setup.

  Option B (checking ACLs) is less relevant because ACLs primarily control object-level and bucket-level access and are not typically used to manage console-level visibility of all buckets in an account. ACLs also do not commonly block the ListAllMyBuckets action.

  Option E is incorrect because IAM users do not require IAM roles to access AWS services. Roles are assumed by users or services, but the presence or absence of a role attached to an IAM user does not affect the user's direct permissions. Therefore, the most appropriate troubleshooting steps are to check the SCPs applied through AWS Organizations and to verify whether an IAM permissions boundary is restricting the user's effective permissions.

  References:

  AWS documentation on AWS Organizations service control policies and how SCPs define the maximum available permissions for accounts and OUs.AWS documentation on IAM permissions boundaries and how they limit the effective permissions of IAM users and roles, regardless of attached IAM policies.

• Question 558:

  A SaaS web app runs on EC2 Linux behind an ALB. It stores user sessions in an RDS Multi-AZ database.

  During high traffic, the app suffers latency due to session read/write.

  What is the best way to reduce session latency?

  A. Store session data in Amazon S3.
  B. Use FSx for Windows and mount it.
  C. Use Multi-Attach EBS volumes.
  D. Use ElastiCache for Redis to store sessions.
  D. Use ElastiCache for Redis to store sessions.

  ---

  Explanation

  Dis the AWS best practice forsession storage: Use ElastiCache for Redis-- a fast, in-memory data store that handles high throughput with microsecond latency. It's highly scalable, fault-tolerant, and optimized for temporary, fast-access session data.

  Incorrect:

  Option A: S3 is slow and object-based -- not for session I/O.

  Option B: FSx is Windows-only and not ideal for this use case.

  Option C: EBS Multi-Attach has limitations, complexity, and is not suitable for high-performance shared memory.

  References:

  https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/WhatIs.html

• Question 559:

  A company has registered 10 new domain names. The company uses the domains for online marketing.

  The company needs a solution that will redirect online visitors to a specific URL for each domain. All domains and target URLs are defined in a JSON document. All DNS records are managed by Amazon Route 53.

  A solutions architect must implement a redirect service that accepts HTTP and HTTPS requests.

  Which combination of steps should the solutions architect take to meet these requirements with the LEAST amount of operational effort? (Choose three.)

  A. Create a dynamic webpage that runs on an Amazon EC2 instance. Configure the webpage to use the JSON document in combination with the event message to look up and respond with a redirect URL.
  B. Create an Application Load Balancer that includes HTTP and HTTPS listeners.
  C. Create an AWS Lambda function that uses the JSON document in combination with the event message to look up and respond with a redirect URL.
  D. Use an Amazon API Gateway API with a custom domain to publish an AWS Lambda function.
  E. Create an Amazon CloudFront distribution. Deploy a Lambda@Edge function.
  F. Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names.
  C. Create an AWS Lambda function that uses the JSON document in combination with the event message to look up and respond with a redirect URL.
  E. Create an Amazon CloudFront distribution. Deploy a Lambda@Edge function.
  F. Create an SSL certificate by using AWS Certificate Manager (ACM). Include the domains as Subject Alternative Names.

  ---

  Explanation

  https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/lambda-edge-how-it-works-tutorial.html

• Question 560:

  A company is planning to migrate 1,000 on-premises servers to AWS. The servers run on several VMware clusters in the company's data center. As part of the migration plan, the company wants to gather server metrics such as CPU details, RAM usage, operating system information, and running processes. The company then wants to query and analyze the data.

  Which solution will meet these requirements?

  A. Deploy and configure the AWS Agentless Discovery Connector virtual appliance on the on-premises hosts. Configure Data Exploration in AWS Migration Hub. Use AWS Glue to perform an ETL job against the data. Query the data by using Amazon S3 Select.
  B. Export only the VM performance information from the on-premises hosts. Directly import the required data into AWS Migration Hub. Update any missing information in Migration Hub. Query the data by using Amazon QuickSight.
  C. Create a script to automatically gather the server information from the on-premises hosts. Use the AWS CLI to run the put-resource-attributes command to store the detailed server data in AWS Migration Hub. Query the data directly in the Migration Hub console.
  D. Deploy the AWS Application Discovery Agent to each on-premises server. Configure Data Exploration in AWS Migration Hub. Use Amazon Athena to run predefined queries against the data in Amazon S3.
  D. Deploy the AWS Application Discovery Agent to each on-premises server. Configure Data Exploration in AWS Migration Hub. Use Amazon Athena to run predefined queries against the data in Amazon S3.

  ---

  Explanation

  The correct answer is D: Deploy the AWS Application Discovery Agent to each on-premises server.

  Configure Data Exploration in AWS Migration Hub. Use Amazon Athena to run predefined queries against the data in Amazon S3.

  A. Deploy and configure the AWS Agentless Discovery Connector virtual appliance on the on-premises hosts. Configure Data Exploration in AWS Migration Hub. Use AWS Glue to perform an ETL job against the data. Query the data by using Amazon S3 Select. - AWS Agentless Discovery Connector will help in discovering and inventory servers but it does not provide the same level of detailed metrics as the AWS Application Discovery Agent, it also does not cover process information.

  B. Export only the VM performance information from the on-premises hosts. Directly import the required data into AWS Migration Hub. Update any missing information in Migration Hub. Query the data by using Amazon QuickSight. - It does not cover process information and it's not the best way to collect the required data, it's not efficient and it might miss some important information.

  C. Create a script to automatically gather the server information from the on-premises hosts. Use the AWS CLI to run the put-resource-attributes command to store the detailed server data in AWS Migration Hub. Query the data directly in the Migration Hub console. - this solution might not be very reliable and it does not cover process information, also it does not provide a way to query and analyze the data.

  D. Deploy the AWS Application Discovery Agent to each on-premises server. Configure Data Exploration in AWS Migration Hub. Use Amazon Athena to run predefined queries against the data in Amazon S3. - This is the correct answer as it covers all the requirements mentioned in the question, it will allow collecting the detailed metrics, including process information and it provides a way to query and analyze the data using Amazon Athena.