Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 581:

  A company wants to use AWS IAM Identity Center (AWS Single Sign-On) to manage employee access to AWS services. The company uses AWS Organizations to manage its AWS accounts.

  Each employee has their own IAM user. Each IAM user is a member of at least one IAM group. Each IAM group has an attached policy that allows members to assume specific roles across the accounts. The roles contain appropriate policies for the expected activities of each group of users in each account. All relevant accounts exist inside a single OU.

  The company has already created new users and groups in IAM Identity Center to match the permissions that exist in IAM.

  How should the company use IAM Identity Center to implement the existing permissions?

  A. For each group, create policies in each account. Give the policies the same name in each account. Create a new permission set. Add the name of the new policies to the permission set. Assign user access to the AWS accounts in IAM Identity Center.
  B. For each group, create a new permission set. Attach the relevant existing IAM roles in each account to the permission set. Create a new customer managed policy that allows the group to assume the roles. Assign user access to the AWS accounts in IAM Identity Center.
  C. For each group, create a new permission set. Create policies in each account. Give each policy a unique name. Set the path of each policy to match the name of the permission set. Assign user access to the AWS accounts in IAM Identity Center.
  D. Add the OU to the accounts configuration in IAM Identity Center. For each group, create policies in each account. Create a new permission set. Add the new policies to the permission set as customer managed policies. Attach each new policy to the correct account in the account configuration in IAM Identity Center.
  B. For each group, create a new permission set. Attach the relevant existing IAM roles in each account to the permission set. Create a new customer managed policy that allows the group to assume the roles. Assign user access to the AWS accounts in IAM Identity Center.

  ---

  Explanation

  This option uses IAM Identity Center to create permission sets that map to the existing IAM roles in each account. This way, the company can leverage the existing policies and roles that are already configured for the expected activities of each group of users in each account. The company also needs to create a customer managed policy that allows the group to assume the roles and attach it to the permission set.

  This policy grants the necessary permissions for IAM Identity Center to assume the roles on behalf of the users. Finally, the company can assign user access to the AWS accounts in IAM Identity Center, which will automatically create IAM users and groups in each account based on the permission sets.

  Option A is incorrect because it requires creating new policies in each account and giving them the same name. This is not necessary and adds complexity and overhead. The company can use the existing IAM roles and policies that are already configured for each account.

  Option C is incorrect because it requires creating new policies in each account and giving them unique names. This is also not necessary and adds complexity and overhead. The company can use the existing IAM roles and policies that are already configured for each account.

  Option D is incorrect because it requires adding the OU to the accounts configuration in IAM Identity Center. This is not supported by IAM Identity Center, which only allows adding individual accounts or all accounts in an organization.

  References:

  AWS Single Sign-On Permission Sets

• Question 582:

  A solutions architect is importing a VM from an on-premises environment by using the Amazon EC2 VM

  Import feature of AWS Import/Export The solutions architect has created an AMI and has provisioned an

  Amazon EC2 instance that is based on that AMI The EC2 instance runs inside a public subnet in a VPC and has a public IP address assigned

  The EC2 instance does not appear as a managed instance in the AWS Systems Manager console.

  Which combination of steps should the solutions architect take to troubleshoot this issue"? (Select TWO )

  A. Verify that Systems Manager Agent is installed on the instance and is running
  B. Verify that the instance is assigned an appropriate IAM role for Systems Manager
  C. Verify the existence of a VPC endpoint on the VPC
  D. Verify that the AWS Application Discovery Agent is configured
  E. Verify the correct configuration of service-linked roles for Systems Manager
  A. Verify that Systems Manager Agent is installed on the instance and is running
  B. Verify that the instance is assigned an appropriate IAM role for Systems Manager

• Question 583:

  The company needs to determine which costs on the monthly AWS bill are attributable to each application or team. The company also must be able to create reports to compare costs from the last 12 months and to help forecast costs for the next 12 months. A solutions architect must recommend an AWS Billing and Cost Management solution that provides these cost reports.

  Which combination of actions will meet these requirements? (Select THREE.)

  A. Activate the user-defined cost allocation tags that represent the application and the team.
  B. Activate the AWS generated cost allocation tags that represent the application and the team.
  C. Create a cost category for each application in Billing and Cost Management.
  D. Activate IAM access to Billing and Cost Management.
  E. Create a cost budget.
  F. Enable Cost Explorer.
  A. Activate the user-defined cost allocation tags that represent the application and the team.
  C. Create a cost category for each application in Billing and Cost Management.
  F. Enable Cost Explorer.

  ---

  Explanation

  https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-cost-categories.html

  https://aws.amazon.com/premiumsupport/knowledge-center/cost-explorer-analyze-spending-and-usage/

  https://docs.aws.amazon.com/awsaccountbilling/latest/aboutv2/manage-cost-categories.html

  https://docs.aws.amazon.com/cost-management/latest/userguide/ce-enable.htmlThebestcombinationofactionstomeetthecompany'srequirementsisOptionsA,C,andF.

  Option A involves activating the user-defined cost allocation tags that represent the application and the team. This will allow the company to assign costs to different applications or teams, and will allow them to be tracked in the monthly AWS bill. Option C involves creating a cost category for each application in Billing and Cost Management. This will allow the company to easily identify and compare costs across different applications and teams. Option F involves enabling Cost Explorer. This will allow the company to view the costs of their AWS resources over the last 12 months and to create forecasts for the next 12 months. These recommendations are in line with the official Amazon Textbook and Resources for the AWS Certified Solutions Architect - Professional certification. In particular, the book states that "You can use cost allocation tags to group your costs by application, team, or other categories" (Source:

  https://d1.awsstatic.com/training-and-certification/docs-sa-pro/AWS_Certified_Solutions_Architect_Professional_Exam_Guide_EN_v1.5.pdf).Additionally,

  the book states that "Cost Explorer enables you to view the costs of your AWS resources over the last 12 months and to create forecasts for the next 12 months" (Source:

  https://d1.awsstatic.com/training-and-certification/docs-sa-pro/AWS_Certified_Solutions_Architect_Professional_Exam_Guide_EN_v1.5.pdf).

• Question 584:

  A company is migrating its on-premises IoT platform to AWS. The platform consists of the following components:

  ? A MongoDB cluster as a data store for all collected and processed IoT data.

  ? An application that uses Message Queuing Telemetry Transport (MQTT) to connect to IoT devices every 5 minutes to collect data. ? An application that runs jobs periodically to generate reports from the IoT data.

  The jobs take 120-600 seconds to finish running. ? A web application that runs on a web server. End users use the web application to generate reports that are accessible to the general public.

  The company needs to migrate the platform to AWS to reduce operational overhead while maintaining performance.

  Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

  A. Create AWS Step Functions state machines with AUS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Configure an Amazon CloudFront distribution that has an S3 origin to serve the reports
  B. Create an AWS Lambda function. Program the Lambda function to connect to the IoT devices. process the data, and write the data to the data store. Configure a Lambda layer to temporarily store messages for processing.
  C. Configure an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Create an ingress controller on the EKS cluster to serve the reports.
  D. Connect the IoT devices to AWS IoT Core to publish messages. Create an AWS IoT rule that runs when a message is received. Configure the rule to call an AWS Lambda function. Program the Lambda function to parse, transform, and store device message data to the data store.
  E. Migrate the MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility).
  F. Migrate the MongoDB cluster to Amazon EC2 instances.
  A. Create AWS Step Functions state machines with AUS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Configure an Amazon CloudFront distribution that has an S3 origin to serve the reports
  D. Connect the IoT devices to AWS IoT Core to publish messages. Create an AWS IoT rule that runs when a message is received. Configure the rule to call an AWS Lambda function. Program the Lambda function to parse, transform, and store device message data to the data store.
  E. Migrate the MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility).

• Question 585:

  A developer reports receiving an Error 403: Access Denied message when they try to download an object from an Amazon S3 bucket. The S3 bucket is accessed using an S3 endpoint inside a VPC. and is encrypted with an AWS KMS key. A solutions architect has verified that (he developer is assuming the correct IAM role in the account that allows the object to be downloaded. The S3 bucket policy and the NACL are also valid.

  Which additional step should the solutions architect take to troubleshoot this issue?

  A. Ensure that blocking all public access has not been enabled in the S3 bucket.
  B. Verify that the IAM rote has permission to decrypt the referenced KMS key.
  C. Verify that the IAM role has the correct trust relationship configured.
  D. Check that local firewall rules are not preventing access to the S3 endpoint.
  B. Verify that the IAM rote has permission to decrypt the referenced KMS key.

• Question 586:

  A company uses AWS Organizations to manage its AWS accounts. The company needs a list of all its Amazon EC2 instances that have underutilized CPU or memory usage. The company also needs recommendations for how to downsize these underutilized instances.

  Which solution will meet these requirements with the LEAST effort?

  A. Install a CPU and memory monitoring tool from AWS Marketplace on all the EC2 Instances. Store the findings in Amazon S3. Implement a Python script to identify underutilized instances. Reference EC2 instance pricing information for recommendations about downsizing options.
  B. Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager. Retrieve the resource op! nization recommendations from AWS Cost Explorer in the organization's management account. Use the recommendations to downsize underutilized instances in all accounts of the organization.
  C. Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager. Retrieve the resource optimization recommendations from AWS Cost Explorer in each account of the organization. Use the recommendations to downsize underutilized instances in all accounts of the organization.
  D. Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager Create an AWS Lambda function to extract CPU and memory usage from all the EC2 instances. Store the findings as files in Amazon S3. Use Amazon Athena to find underutilized instances. Reference EC2 instance pricing information for recommendations about downsizing options.
  B. Install the Amazon CloudWatch agent on all the EC2 instances by using AWS Systems Manager. Retrieve the resource op! nization recommendations from AWS Cost Explorer in the organization's management account. Use the recommendations to downsize underutilized instances in all accounts of the organization.

• Question 587:

  A company used Amazon EC2 instances to deploy a web fleet to host a blog site.

  The EC2 instances are behind an Application Load Balancer (ALB) and are configured in an Auto ScaSng group.

  The web application stores all blog content on an Amazon EFS volume.

  The company recently added a feature 'or Moggers to add video to their posts, attracting 10 times the previous user traffic At peak times of day. users report buffering and timeout issues while attempting to reach the site or watch videos.

  Which is the MOST cost-efficient and scalable deployment that win resolve the issues for users?

  A. Reconfigure Amazon EFS to enable maximum I/O.
  B. Update the Nog site to use instance store volumes tor storage. Copy the site contents to the volumes at launch and to Amazon S3 al shutdown.
  C. Configure an Amazon CloudFront distribution. Point the distribution to an S3 bucket, and migrate the videos from EFS to Amazon S3.
  D. Set up an Amazon CloudFront distribution for all site contents, and point the distribution at the ALB.
  C. Configure an Amazon CloudFront distribution. Point the distribution to an S3 bucket, and migrate the videos from EFS to Amazon S3.

  ---

  Explanation

  https://aws.amazon.com/premiumsupport/knowledge-center/cloudfront-https-connection-fails/

  Using an Amazon S3 bucket Using a MediaStore container or a MediaPackage channel Using an Application Load Balancer Using a Lambda function URL Using Amazon EC2 (or another custom origin) Using CloudFront origin groups

  https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/restrict-access-to-load-balancer.html

• Question 588:

  A company operates quick-service restaurants. The restaurants follow a predictable model with high sales traffic for -4 hours daily Sates traffic is lower outside of those peak hours.

  The point of sale and management platform is deployed in the AWS Cloud and has a backend that is based or Amazon DynamoDB.

  The database table uses provisioned throughput mode with 100.000 RCUs and 80.000 WCUs to match Known peak resource consumption.

  The company wants to reduce its DynamoDB cost and minimize the operational overhead for the IT staff.

  Which solution meets these requirements MOST cost-effectively?

  A. Reduce the provisioned RCUs and WCUs
  B. Change the DynamoDB table to use on-demand capacity
  C. Enable Dynamo DB auto seating for the table.
  D. Purchase 1-year reserved capacity that is sufficient to cover the peak load for 4 hours each day.
  C. Enable Dynamo DB auto seating for the table.

  ---

  Explanation

  https://aws.amazon.com/blogs/database/amazon-dynamodb-auto-scaling-performance-and-cost-optimization-at-any-scale/

  " As you can see, there are compelling reasons to use DynamoDB auto scaling with actively changing traffic. Auto scaling responds quickly and simplifies capacity management, which lowers costs by scaling your table's provisioned capacity and reducing operational overhead."

• Question 589:

  A solutions architect has deployed a web application that serves users across two AWS Regions under a custom domain. The application uses Amazon Route 53 latency-based routing. The solutions architect has associated weighted record sets with a pair of web servers in separate Availability Zones for each Region.

  The solutions architect runs a disaster recovery scenario. When all the web servers in one Region are stopped, Route 53 does not automatically redirect users to the other Region.

  Which of the following are possible root causes of this issue? (Choose two.)

  A. The weight for the Region where the web servers were stopped is higher than the weight for the other Region
  B. One of the web servers in the secondary Region did not pass its HTTP health check
  C. Latency resource record sets cannot be used in combination with weighted resource record sets
  D. The setting to evaluate target health is not turned on for the latency alias resource record set that is associated with the domain in the Region where the web servers were stopped
  E. An HTTP health check has not been set up for one or more of the weighted resource record sets associated with the stopped web servers
  D. The setting to evaluate target health is not turned on for the latency alias resource record set that is associated with the domain in the Region where the web servers were stopped
  E. An HTTP health check has not been set up for one or more of the weighted resource record sets associated with the stopped web servers

• Question 590:

  A company is developing a new on-demand video application that is based on microservices. The application will have 5 million users at launch and will have 30 million users after 6 months. The company has deployed the application on Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The company developed the application by using ECS services that use the HTTPS protocol.

  A solutions architect needs to implement updates to the application by using blue/green deployments. The solution must distribute traffic to each ECS service through a load balancer. The application must automatically adjust the number of tasks in response to an Amazon CloudWatch alarm.

  Which solution will meet these requirements?

  A. Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Request increases to the service quota for tasks per service to meet the demand.
  B. Configure the ECS services to use the blue/green deployment type and a Network Load Balancer. Implement an Auto Scaling group for each ECS service by using the Cluster Autoscaler.
  C. Configure the ECS services to use the blue/green deployment type and an Application Load Balancer. Implement an Auto Seating group for each ECS service by using the Cluster Autoscaler.
  D. Configure the ECS services to use the blue/green deployment type and an Application Load Balancer. Implement Service Auto Scaling for each ECS service.ng for each ECS service.
  D. Configure the ECS services to use the blue/green deployment type and an Application Load Balancer. Implement Service Auto Scaling for each ECS service.ng for each ECS service.

  ---

  Explanation

  https://repost.aws/knowledge-center/ecs-fargate-service-auto-scaling