Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 731:

  A company has an IoT data lake that is stored in Amazon S3. Data scientists in a separate AWS account need to analyze the data on Amazon EC2 instances in a VPC. Company policy requires that only authorized networks access the IoT data. The EC2 instances already have an IAM role that allows access to Amazon S3. An S3 access point exists on the data lake S3 bucket. The company needs to provide secure access to the S3 data lake for the EC2 instances while complying with the policy that requires access from only authorized networks.

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Create a gateway VPC endpoint for Amazon S3 in the data scientists' VPC.
  B. Update the S3 access point settings to block public access.
  C. Update the EC2 instance role. Add a policy with a condition that denies the s3:GetObject action when the value for the s3:DataAccessPointArn condition key is a valid access point ARN.
  D. Update the VPC route table to route S3 traffic to the S3 access point.
  E. Add an S3 bucket policy with a condition that allows the s3:GetObject action when the value for the s3: DataAccessPointArn condition key is a valid access point ARN.
  A. Create a gateway VPC endpoint for Amazon S3 in the data scientists' VPC.
  E. Add an S3 bucket policy with a condition that allows the s3:GetObject action when the value for the s3: DataAccessPointArn condition key is a valid access point ARN.

  ---

  Explanation

  The data scientists' EC2 instances in a separate account must access S3 data in a controlled way that satisfies the policy: only authorized networks may access the IoT data. "Authorized networks" in this context means traffic must originate from approved VPCs and must not traverse the public internet. First, traffic from the EC2 instances to S3 must stay on the AWS network without using public endpoints. A gateway VPC endpoint for S3 in the data scientists' VPC (option A) allows EC2 instances in that VPC to reach S3 over private connectivity. When using a gateway VPC endpoint, the route tables of the subnets associated with the endpoint automatically route S3 traffic through the endpoint. This ensures that access to S3 is from an authorized network (the VPC) instead of from the public internet.

  Second, access must be constrained such that only calls made through the intended S3 access mechanism are allowed. The data lake bucket already has an S3 access point. S3 access points can be restricted by policy and can be referenced in bucket policies through the s3:DataAccessPointArn condition key. By using an S3 bucket policy that allows s3:GetObject only when s3:DataAccessPointArn matches the expected access point ARN (option E), the company can enforce that all valid access uses the approved access point configuration. Combined with the access point's own network configuration and the VPC endpoint, access is limited to authorized networks.

  Option B, blocking public access on the access point, is a good general security practice but does not by itself guarantee that access is restricted to authorized VPC networks. The main enforcement must be through VPC endpoints and bucket/access point policies.

  Option C denies s3:GetObject when s3:DataAccessPointArn is a valid access point ARN, which is the opposite of what is required. This would prevent intended access via the access point rather than allow it.

  Option D is not correct because gateway VPC endpoints for S3 are configured via endpoint associations with route tables, not by directly routing to an access point in the route table. Traffic to S3 is routed to the VPC endpoint, and the endpoint plus S3 policies determine access.

  Therefore, creating a gateway VPC endpoint for S3 in the data scientists' VPC (option A) and using a bucket policy condition on s3:DataAccessPointArn to allow access only through the authorized access point (option E) together meet the requirement of secure, network-restricted access from authorized networks.

  References:

  AWS documentation on S3 gateway VPC endpoints for private access to S3 from VPCs.AWS documentation on S3 access points and the use of s3:DataAccessPointArn condition keys in bucket policies to control access paths.

• Question 732:

  A company is processing videos in the AWS Cloud by using Amazon EC2 instances in an Auto Scaling group. It takes 30 minutes to process a video. Several EC2 instances scale in and out depending on the number of videos in an Amazon Simple Queue Service (Amazon SQS) queue.

  The company has configured the SQS queue with a redrive policy that specifies a target dead-letter queue and a maxReceiveCount of 1. The company has set the visibility timeout for the SQS queue to 1 hour. The company has set up an Amazon CloudWatch alarm to notify the development team when there are messages in the dead-letter queue.

  Several times during the day, the development team receives notification that messages are in the dead-letter queue and that videos have not been processed properly. An investigation finds no errors in the application logs.

  How can the company solve this problem?

  A. Turn on termination protection for the EC2 instances.
  B. Update the visibility timeout for the SOS queue to 3 hours.
  C. Configure scale-in protection for the instances during processing.
  D. Update the redrive policy and set maxReceiveCount to 0.
  C. Configure scale-in protection for the instances during processing.

  ---

  Explanation

  The issue is that the messages are being moved to the dead-letter queue because the visibility timeout is not long enough for the processing time of the videos. The visibility timeout is the amount of time that a message is invisible in the queue after a worker retrieves it. If a worker does not delete or extend the visibility timeout before the timeout expires, the message becomes visible again and another worker can process it. By updating the visibility timeout for the SQS queue to 3 hours, the company can ensure that the messages are not moved to the dead-letter queue before the processing is complete, solving the problem. You can refer to the AWS SQS documentation for more information on how to use this service:

  https://aws.amazon.com/sqs/You

  can refer to the AWS CloudWatch Alarms documentation for more information on how to use this service:

  https:// aws.amazon.com/cloudwatch/And you can refer to the AWS EC2 documentation for more information on how to use this service:

  https://aws.amazon.com/ec2/

  It's worth mentioning that the other options are not directly related to the problem, Termination protection helps to prevent accidental termination, Scale-in protection prevents instances from being terminated when scale in occurs, and maxReceiveCount is the number of times a message is delivered to the queue before being moved to the dead-letter queue.

• Question 733:

  A company has a legacy monolithic application that is critical to the company's business. The company hosts the application on an Amazon EC2 instance that runs Amazon Linux 2. The company's application team receives a directive from the legal department to back up the data from the instance's encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon S3 bucket. The application team does not have the administrative SSH key pair for the instance. The application must continue to serve the users.

  Which solution will meet these requirements?

  A. Attach a role to the instance with permission to write to Amazon S3. Use the AWS Systems Manager Session Manager option to gain access to the instance and run commands to copy data into Amazon S3.
  B. Create an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.
  C. Take a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM). Copy the data to Amazon S3.
  D. Create an image of the instance. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.
  A. Attach a role to the instance with permission to write to Amazon S3. Use the AWS Systems Manager Session Manager option to gain access to the instance and run commands to copy data into Amazon S3.

• Question 734:

  A company is using AWS Organizations with a multi-account architecture. The company's current security configuration for the account architecture includes SCPs, resource-based policies, identity-based policies, trust policies, and session policies.

  A solutions architect needs to allow an IAM user in Account A to assume a role in Account.

  Which combination of steps must the solutions architect take to meet this requirement? (Select THREE.)

  A. Configure the SCP for Account A to allow the action.
  B. Configure the resource-based policies to allow the action.
  C. Configure the identity-based policy on the user in Account A to allow the action.
  D. Configure the identity-based policy on the user in Account B to allow the action.
  E. Configure the trust policy on the target role in Account B to allow the action.
  F. Configure the session policy to allow the action and to be passed programmatically by the GetSessionToken API operation.
  B. Configure the resource-based policies to allow the action.
  C. Configure the identity-based policy on the user in Account A to allow the action.
  E. Configure the trust policy on the target role in Account B to allow the action.

  ---

  Explanation

  Resource-based policies are policies that you attach to a resource, such as an IAM role, to specify who can access the resource and what actions they can perform on it. Identity-based policies are policies that you attach to an IAM user, group, or role to specify what actions they can perform on which resources.

  Trust policies are special types of resource-based policies that define which principals (such as IAM users or roles) can assume a role.

  To allow an IAM user in Account A to assume a role in Account B, the solutions architect needs to do the following:

  Configure the resource-based policy on the target role in Account B to allow the action sts:AssumeRole for the IAM user in Account A. This policy grants permission to the IAM user to assume the role. Configure the identity-based policy on the user in Account A to allow the action sts:AssumeRole for the target role in Account B. This policy grants permission to the user to perform the action of assuming the role5. Configure the trust policy on the target role in Account B to allow the principal of the IAM user in Account A. This policy defines who can assume the role.

  References:

  Resource-based policies

  Identity-based policies

  Trust policies

  Granting a user permissions to switch roles Switching roles [Modifying a role trust policy]

• Question 735:

  An online retail company is migrating its legacy on-premises .NET application to AWS. The application runs on load-balanced frontend web servers, load-balanced application servers, and a Microsoft SQL Server database.

  The company wants to use AWS managed services where possible and does not want to rewrite the application. A solutions architect needs to implement a solution to resolve scaling issues and minimize licensing costs as the application scales.

  Which solution will meet these requirements MOST cost-effectively?

  A. Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SOL Server database.
  B. Create images of all the servers by using AWS Database Migration Service (AWS DMS). Deploy Amazon EC2 instances that are based on the on-premises imports. Deploy the instances in an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon DynamoDB as the database tier.
  C. Containerize the web frontend tier and the application tier. Provision an Amazon Elastic Kubernetes Service (Amazon EKS) cluster. Create an Auto Scaling group behind a Network Load Balancer for the web tier and for the application tier. Use Amazon RDS for SOL Server to host the database.
  D. Separate the application functions into AWS Lambda functions. Use Amazon API Gateway for the web frontend tier and the application tier. Migrate the data to Amazon S3. Use Amazon Athena to query the data.
  A. Deploy Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer for the web tier and for the application tier. Use Amazon Aurora PostgreSQL with Babelfish turned on to replatform the SOL Server database.

  ---

  Explanation

  The best solution is to create a tag policy that contains the allowed project tag values in the organization's management account and create an SCP that denies the cloudformation:CreateStack API operation unless a project tag is added. A tag policy is a type of policy that can help standardize tags across resources in the organization's accounts. A tag policy can specify the allowed tag keys, values, and case treatment for compliance. A service control policy (SCP) is a type of policy that can restrict the actions that users and

  roles can perform in the organization's accounts. An SCP can deny access to specific API operations unless certain conditions are met, such as having a specific tag. By creating a tag policy in the management account and attaching it to each OU, the organization can enforce consistent tagging across all accounts. By creating an SCP that denies the cloudformation:CreateStack API operation unless a project tag is added, the organization can prevent users from creating new resources without proper tagging. This solution will meet the requirements with the least effort, as it does not involve creating additional resources or modifying existing ones.

  References:

  Tag policies - AWS Organizations, Service control policies - AWS Organizations, AWS CloudFormation User Guide

• Question 736:

  IoT sensors are manufactured with certificates from a private CA. They must only connect to AWS after physical installation.

  A. Use Lambda as a pre-provisioning hook to validate serial number before registration.
  B. Use Step Functions to validate before provisioning.
  C. Use Lambda hook but register CA and enable auto-registration.
  D. Use provisioning template and claim certificates without validation.
  A. Use Lambda as a pre-provisioning hook to validate serial number before registration.

  ---

  Explanation

  AWS IoT Core'spre-provisioning hookallows custom logic (like serial number validation) beforea device is registered. This ensures that only installed devices connect. Lambda is ideal for such logic.

• Question 737:

  A company runs an ecommerce website on Amazon ECS behind an Application Load Balancer (ALB). The container images are stored in Amazon ECR. The website stores data in an Amazon Aurora MySQL DB cluster. The ALB uses an HTTPS listener with a public SSL certificate that is saved in AWS Certificate Manager (ACM). The website domain is registered with Amazon Route 53. The company wants to duplicate this setup in a second AWS Region in an active-active configuration. The website can tolerate minor latency for data replication between Regions. The company has already deployed an ECS cluster with an ALB in the secondary Region. The ECS cluster is registered for geolocation routing with Route 53.

  Which combination of steps will meet these requirements with the LEAST operational overhead? (Select THREE.)

  A. Request a new ACM certificate for the company website in the secondary Region. Configure the ALB in the secondary Region with an HTTPS listener. Set the new ACM certificate as the default certificate.
  B. Share the ACM certificate with the secondary Region by using AWS Resource Access Manager (AWS RAM). Configure the ALB in the secondary Region with an HTTPS listener. Set the shared ACM certificate as the default certificate.
  C. Create a VPC endpoint for Amazon ECR in the secondary Region. Configure Amazon EC2 instances to download container images from the primary Region.
  D. Enable Cross-Region Replication for ECR repositories to the secondary Region. Re-push the existing images to ECR repositories with a new tag.
  E. Configure an Aurora global database in the primary Region. Enable write forwarding to the secondary Region.
  F. Use an Aurora DB cluster that has multiple writer instances in the primary Region. Create a secondary Aurora DB instance in the secondary Region. Enable cross-Region writes between the DB clusters.
  A. Request a new ACM certificate for the company website in the secondary Region. Configure the ALB in the secondary Region with an HTTPS listener. Set the new ACM certificate as the default certificate.
  D. Enable Cross-Region Replication for ECR repositories to the secondary Region. Re-push the existing images to ECR repositories with a new tag.
  E. Configure an Aurora global database in the primary Region. Enable write forwarding to the secondary Region.

  ---

  Explanation

  The company is building an active-active, multi-Region architecture for an ECS-based web application behind ALBs, with shared container images in ECR and a relational database in Aurora MySQL. The goal is to duplicate the setup in a second Region with minimal operational overhead while allowing minor replication latency. A is required because ACM certificates are Regional for use with Regional resources like an Application Load Balancer. An ALB in the secondary Region needs an ACM certificate that exists in that same Region to terminate HTTPS. Requesting (or importing) a certificate in the secondary Region and attaching it to the ALB HTTPS listener is the standard managed approach with low operational overhead.

  B is not correct because ACM certificates are not shared "across Regions" for direct use by a Regional ALB in another Region. Sharing via AWS RAM is used for sharing resources across accounts within a Region (and for supported resource types), but it does not provide a mechanism to use an ACM certificate issued in one Region directly on an ALB in a different Region.

  D is required because the application runs in both Regions and must be able to pull container images locally with minimal operational work. Amazon ECR supports cross-Region replication so images pushed in the primary Region can be replicated automatically to the secondary Region's ECR repositories. This avoids building custom copy pipelines and reduces the chance of drift. Once replication is enabled, updating images in the primary Region can automatically populate the secondary Region repository.

  C is not the best fit. A VPC endpoint for ECR is about private connectivity to ECR within a Region. It does not solve the multi-Region image availability problem by itself, and it introduces the idea of pulling images from the primary Region, which is unnecessary and less optimal when cross-Region replication can keep images local to each Region.

  E is required because the database must support multi-Region application operation with tolerable replication latency. Aurora Global Database is the managed feature designed to replicate an Aurora cluster to a secondary Region with low-latency replication and minimal operational overhead compared to custom replication. Enabling write forwarding allows applications in the secondary Region to send write requests to the secondary cluster endpoint, with Aurora forwarding those writes to the primary writer. This reduces application changes compared to forcing all writes to go directly to the primary Region endpoints, and it supports an active-active application deployment pattern where both Regions can accept traffic.

  F is not correct because "cross-Region writes between DB clusters" and "multiple writer instances in the primary Region" do not provide a managed, multi-Region, multi-writer Aurora design as described.

  Aurora's managed multi-Region pattern is Aurora Global Database with a single primary writer in one Region (with the option to promote a secondary Region during failover) and optional write forwarding from a secondary Region to the primary. The option's described cross-Region multi-writer behavior is not a standard supported Aurora configuration and would not be the least operational overhead approach.

  Therefore, the least operational overhead combination that correctly addresses HTTPS termination in the secondary Region, image availability in both Regions, and managed multi-Region database replication is A, D, and E.

  References:

  AWS documentation on AWS Certificate Manager regional certificates and attaching ACM certificates to Application Load Balancer HTTPS listeners in the same Region.AWS documentation on Amazon ECR cross-Region replication for automatically replicating container images to repositories in another Region.AWS documentation on Amazon Aurora Global Database and write forwarding to support multi-Region application deployments with managed replication and reduced application changes.

• Question 738:

  A company is building a software-as-a-service (SaaS) solution on AWS. The company has deployed an Amazon API Gateway REST API with AWS Lambda integration in multiple AWS Regions and in the same production account.

  The company offers tiered pricing that gives customers the ability to pay for the capacity to make a certain number of API calls per second. The premium tier offers up to 3,000 calls per second, and customers are identified by a unique API key. Several premium tier customers in various Regions report that they receive error responses of 429 Too Many Requests from multiple API methods during peak usage hours. Logs indicate that the Lambda function is never invoked.

  What could be the cause of the error messages for these customers?

  A. The Lambda function reached its concurrency limit.
  B. The Lambda function its Region limit for concurrency.
  C. The company reached its API Gateway account limit for calls per second.
  D. The company reached its API Gateway default per-method limit for calls per second.
  C. The company reached its API Gateway account limit for calls per second.

  ---

  Explanation

  https://docs.aws.amazon.com/apigateway/latest/developerguide/api-gateway-request-throttling.html#apig-request-throttling-account-level-limits

• Question 739:

  A company has a web application that uses Amazon API Gateway. AWS Lambda, and Amazon DynamoDB. A recent marketing campaign has increased demand. Monitoring software reports that many requests have significantly longer response times than before the marketing campaign.

  A solutions architect enabled Amazon CloudWatch Logs for API Gateway and noticed that errors are occurring on 20% of the requests. In CloudWatch, the Lambda function Throttles metric represents 1% of the requests and the Errors metric represents 10% of the requests. Application logs indicate that, when errors occur, there is a call to DynamoDB.

  What change should the solutions architect make to improve the current response times as the web application becomes more popular?

  A. Increase the concurrency limit of the Lambda function.
  B. Implement DynamoDB auto scaling on the table.
  C. Increase the API Gateway throttle limit.
  D. Re-create the DynamoDB table with a better-partitioned primary index.
  B. Implement DynamoDB auto scaling on the table.

• Question 740:

  How can applications in multiple AWS accounts privately access a PostgreSQL RDS instance in a separate AWS account, while managing the number of connections?

  A. Transit Gateway + NAT Gateway
  B. RDS Proxy + PrivateLink via NLB
  C. VPC Peering + Application Load Balancer
  D. VPC Peering + NAT Gateway
  B. RDS Proxy + PrivateLink via NLB

  ---

  Explanation

  RDS Proxy optimizes and pools DB connections. By combining this withPrivateLink + NLB , other accounts can securely access the proxy endpoint without going over the internet or setting up peering for every new account.

  RDS Proxy Docs