Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 761:

  A company is using multiple AWS accounts. The company has a shared services account and several other accounts (or different projects.

  A team has a VPC in a project account. The team wants to connect this VPC to a corporate network through an AWS Direct Connect gateway that exists in the shared services account. The team wants to automatically perform a virtual private gateway association with the Direct Connect gateway by using an already-tested AWS Lambda function while deploying its VPC networking stack. The Lambda function code can assume a role by using AWS Security Token Service (AWS STS). The team is using AWS Cloud Formation to deploy its infrastructure.

  Which combination of steps will meet these requirements? (Select THREE.)

  A. Deploy the Lambda function to the project account. Update the Lambda function's IAM role with the directconnect:* permission
  B. Create a cross-account IAM role in the shared services account that grants the Lambda function the directconnect:" permission. Add the sts:AssumeRo!e permission to the IAM role that is associated with the Lambda function in the shared services account.
  C. Add a custom resource to the Cloud Formation networking stack that references the Lambda function in the project account.
  D. Deploy the Lambda function that is performing the association to the shared services account. Update the Lambda function's IAM role with the directconnect:' permission.
  E. Create a cross-account IAM role in the shared services account that grants the sts: Assume Role permission to the Lambda function with the directconnect:" permission acting as a resource. Add the sts AssumeRole permission with this cross-account IAM role as a resource to the IAM role that belongs to the Lambda function in the project account.
  F. Add a custom resource to the Cloud Formation networking stack that references the Lambda function in the shared services account.
  B. Create a cross-account IAM role in the shared services account that grants the Lambda function the directconnect:" permission. Add the sts:AssumeRo!e permission to the IAM role that is associated with the Lambda function in the shared services account.
  C. Add a custom resource to the Cloud Formation networking stack that references the Lambda function in the project account.
  E. Create a cross-account IAM role in the shared services account that grants the sts: Assume Role permission to the Lambda function with the directconnect:" permission acting as a resource. Add the sts AssumeRole permission with this cross-account IAM role as a resource to the IAM role that belongs to the Lambda function in the project account.

• Question 762:

  A software as a service (SaaS) company uses AWS to host a service that is powered by AWS PrivateLink.

  The service consists of proprietary software that runs on three Amazon EC2 instances behind a Network Load Balancer (NL B). The instances are in private subnets in multiple Availability Zones in the eu-west-2 Region. All the company's customers are in eu-west-2.

  However, the company now acquires a new customer in the us-east-I Region. The company creates a new VPC and new subnets in us-east-I. The company establishes inter-Region VPC peering between the VPCs in the two Regions.

  The company wants to give the new customer access to the SaaS service, but the company does not want to immediately deploy new EC2 resources in us-east-I

  Which solution will meet these requirements?

  A. Configure a PrivateLink endpoint service in us-east-I to use the existing NL B that is in eu-west-2. Grant specific AWS accounts access to connect to the SaaS service.
  B. Create an NL B in us-east-I . Create an IP target group that uses the IP addresses of the company's instances in eu-west-2 that host the SaaS service. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-I . Grant specific AWS accounts access to connect to the SaaS service.
  C. Create an Application Load Balancer (ALB) in front of the EC2 instances in eu-west-2. Create an NLB in us-east-I . Associate the NLB that is in us-east-I with an ALB target group that uses the ALB that is in eu-west-2. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-I . Grant specific AWS accounts access to connect to the SaaS service.
  D. Use AWS Resource Access Manager (AWS RAM) to share the EC2 instances that are in eu-west-2. In us-east-I , create an NLB and an instance target group that includes the shared EC2 instances from eu-west-2. Configure a PrivateLink endpoint service that uses the NL B that is in us-east-I. Grant specific AWS accounts access to connect to the SaaS service.
  B. Create an NL B in us-east-I . Create an IP target group that uses the IP addresses of the company's instances in eu-west-2 that host the SaaS service. Configure a PrivateLink endpoint service that uses the NLB that is in us-east-I . Grant specific AWS accounts access to connect to the SaaS service.

• Question 763:

  A development team has created a new flight tracker application that provides near-real-time data to users. The application has a front end that consists of an Application Load Balancer (ALB) in front of two large Amazon EC2 instances in a single Availability Zone. Data is stored in a single Amazon RDS MySQL DB instance. An Amazon Route 53 DNS record points to the ALB.

  Management wants the development team to improve the solution to achieve maximum reliability with the least amount of operational overhead.

  Which set of actions should the team take?

  A. Create RDS MySQL read replicas. Deploy the application to multiple AWS Regions. Use a Route 53 latency-based routing policy to route to the application.
  B. Configure the DB instance as Multi-AZ. Deploy the application to two additional EC2 instances in different Availability Zones behind an ALB.
  C. Replace the DB instance with Amazon DynamoDB global tables. Deploy the application in multiple AWS Regions. Use a Route 53 latency-based routing policy to route to the application.
  D. Replace the DB instance with Amazon Aurora with Aurora Replicas. Deploy the application to mulliple smaller EC2 instances across multiple Availability Zones in an Auto Scaling group behind an ALB.
  D. Replace the DB instance with Amazon Aurora with Aurora Replicas. Deploy the application to mulliple smaller EC2 instances across multiple Availability Zones in an Auto Scaling group behind an ALB.

  ---

  Explanation

  Multi AZ ASG + ALB + Aurora = Less over head and automatic scaling

• Question 764:

  A company is refactoring its on-premises order-processing platform in the AWS Cloud. The platform includes a web front end that is hosted on a fleet of VMs RabbitMQ to connect the front end to the backend, and a Kubernetes cluster to run a containerized backend system to process the orders. The company does not want to make any major changes to the application.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Create an AMI of the web server VM Create an Amazon EC2 Auto Scaling group that uses the AMI and an Application Load Balancer Set up Amazon MQ to replace the on-premises messaging queue Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend
  B. Create a custom AWS Lambda runtime to mimic the web server environment Create an Amazon API Gateway API to replace the front-end web servers Set up Amazon MQ to replace the on-premises messaging queue Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend
  C. Create an AMI of the web server VM Create an Amazon EC2 Auto Scaling group that uses the AMI and an Application Load Balancer Set up Amazon MQ to replace the on-premises messaging queue Install Kubernetes on a fleet of different EC2 instances to host the order-processing backend
  D. Create an AMI of the web server VM Create an Amazon EC2 Auto Scaling group that uses the AMI and an Application Load Balancer Set up an Amazon Simple Queue Service (Amazon SQS) queue to replace the on-premises messaging queue Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend
  A. Create an AMI of the web server VM Create an Amazon EC2 Auto Scaling group that uses the AMI and an Application Load Balancer Set up Amazon MQ to replace the on-premises messaging queue Configure Amazon Elastic Kubernetes Service (Amazon EKS) to host the order-processing backend

  ---

  Explanation

  https://aws.amazon.com/about-aws/whats-new/2020/11/announcing-amazon-mq-rabbitmq/

• Question 765:

  A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company uses AWS Control Tower for governance and uses AWS Transit Gateway for VPC connectivity across accounts.

  In an AWS application account, the company's application team has deployed a web application that uses AWS Lambda and Amazon RDS. The company's database administrators have a separate DBA account and use the account to centrally manage all the databases across the organization. The database administrators use an Amazon EC2 instance that is deployed in the DBA account to access an RDS database that is deployed in the application account.

  The application team has stored the database credentials as secrets in AWS Secrets Manager in the application account. The application team is manually sharing the secrets with the database administrators. The secrets are encrypted by the default AWS managed key for Secrets Manager in the application account. A solutions architect needs to implement a solution that gives the database administrators access to the database and eliminates the need to manually share the secrets.

  Which solution will meet these requirements?

  A. Use AWS Resource Access Manager (AWS RAM) to share the secrets from the application account with the DBA account. In the DBA account, create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the shared secrets. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.
  B. In the application account, create an IAM role that is named DBA-Secret. Grant the role the required permissions to access the secrets. In the DBA account, create an IAM role that is named DBA-Admin. Grant the DBA-Admin role the required permissions to assume the DBA-Secret role in the application account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.
  C. In the DBA account, create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the secrets and the default AWS managed key in the application account. In the application account, attach resource-based policies to the key to allow access from the DBA account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.
  D. In the DBA account, create an IAM role that is named DBA-Admin. Grant the role the required permissions to access the secrets in the application account. Attach an SCP to the application account to allow access to the secrets from the DBA account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.
  B. In the application account, create an IAM role that is named DBA-Secret. Grant the role the required permissions to access the secrets. In the DBA account, create an IAM role that is named DBA-Admin. Grant the DBA-Admin role the required permissions to assume the DBA-Secret role in the application account. Attach the DBA-Admin role to the EC2 instance for access to the cross-account secrets.

  ---

  Explanation

  Option B is correct because creating an IAM role in the application account that has permissions to access the secrets and creating an IAM role in the DBA account that has permissions to assume the role in the application account eliminates the need to manually share the secrets. This approach uses cross-account IAM roles to grant access to the secrets in the application account. The database administrators can assume the role in the application account from their EC2 instance in the DBA account and retrieve the secrets without having to store them locally or share them manually2

  References:

  1: (https://docs.aws.amazon.com/ram/latest/userguide/what-is.html2:)

  https://docs.aws.amazon.com/IAM/latest/UserGuide/tutorial_cross-account-with-roles.html3:

  https://docs.aws.amazon.com/kms/latest/developerguide/concepts.html

  https://docs.aws.amazon.com/secretsmanager/latest/userguide/tutorials_basic.html

  https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html

• Question 766:

  A company runs an application on an Amazon EC2 instance in a private VPC. The application accesses data from an Amazon S3 bucket. Currently, the application has outbound internet access through existing NAT gateways. The company establishes an AWS Site-to-Site VPN connection from the company's on-premises office to the VPC. The company wants both the application and the on-premises users to access the S3 bucket without traversing the public internet. The company also wants to remove the NAT gateways.

  Which solution will meet these requirements?

  A. Create an S3 gateway endpoint with private DNS inside the VPC. Update the routing for the on-premises environment to route the traffic for the S3 bucket to the gateway endpoint that is inside the VPC. Update the on-premises DNS to use the private DNS names for the S3 bucket.
  B. Create both an S3 gateway endpoint and an S3 interface endpoint with private DNS inside the VPC. Update the routing for each of the VPC's subnets and the on-premises environment. Update the on-premises DNS to use the private DNS names for the S3 bucket.
  C. Install Mountpoint for Amazon S3 on the EC2 instance. Mount the S3 bucket directly to the EC2 instance. Configure the application to use the new mountpoint to access the S3 bucket.
  D. Install Storage Browser for S3 on the EC2 instance and add it to the application. Ensure that the users of the application use Storage Browser to access the S3 data.
  B. Create both an S3 gateway endpoint and an S3 interface endpoint with private DNS inside the VPC. Update the routing for each of the VPC's subnets and the on-premises environment. Update the on-premises DNS to use the private DNS names for the S3 bucket.

  ---

  Explanation

  Comprehensive and Detailed Explanation: This question tests knowledge of private access patterns to Amazon S3 from: resources inside a VPC, and users in an on-premises environment connected through Site-to-Site VPN.

  The correct answer is B because the company has two different traffic sources with different endpoint requirements.

  Why B is correct

  For the EC2 instance inside the private VPC: An S3 gateway endpoint is the standard and most cost-effective method for private access from resources in the VPC to Amazon S3. With a gateway endpoint, traffic from the VPC to S3 stays on the AWS network and does not require a NAT gateway or internet gateway. This satisfies the requirement to remove the NAT gateways for the application's S3 access.

  For the on-premises users over the Site-to-Site VPN: Gateway endpoints are for use within the VPC and are not accessed from on-premises networks over VPN or Direct Connect. To allow on-premises clients to access S3 privately through the VPC, the architecture needs an S3 interface endpoint with private DNS enabled. Interface endpoints create elastic network interfaces in the VPC and can be reached privately from connected on-premises environments, assuming routing and DNS are configured correctly.

  Therefore, the combination is required: S3 gateway endpoint for VPC resources

  S3 interface endpoint with private DNS for on-premises access through VPN This design allows both the EC2 application and on-premises users to access S3 without using the public internet.

  Why A is incorrect

  An S3 gateway endpoint works for VPC resources, but it does not provide private access for on-premises users over Site-to-Site VPN. On-premises networks cannot route directly to a gateway endpoint in the way described. That makes A incomplete and incorrect.

  Why C is incorrect Mountpoint for Amazon S3 is a way to mount an S3 bucket for file-like access from an EC2 instance or similar compute environment. It does not solve the connectivity requirement for on-premises users, and it does not address the broader network design requirement of private S3 access without NAT gateways for all stated users. It also does not replace the need for appropriate VPC endpoint architecture.

  Why D is incorrect Storage Browser for S3 is not the solution to provide private network connectivity for an application and on-premises users. It is unrelated to the core architecture requirement. The question is asking about private access paths to S3, not a user interface or client-side browser tool.

  Key design principle being tested.

  This question checks whether you know the distinction between: S3 gateway endpoints for traffic originating from within the VPC

  S3 interface endpoints for private access from on-premises environments over hybrid connectivity It also tests whether you understand that removing NAT gateways is possible for S3 access from private subnets when a VPC endpoint is used.

  Final justification Because the company needs: private S3 access from an EC2 instance in a private VPC, and private S3 access from on-premises users over VPN, while removing NAT gateways, the correct design is to use: an S3 gateway endpoint for the VPC application, and an S3 interface endpoint with private DNS for the on-premises users.

  That makes B the best answer.

  References:

  AWS Certified Solutions Architect - Professional (SAP-C02) Exam Guide

  Amazon VPC documentation for gateway endpoints Amazon VPC documentation for interface endpoints Amazon S3 private access patterns documentation AWS Site-to-Site VPN documentation

  AWS Certified Solutions Architect - Professional Official Study Guide

• Question 767:

  A company wants to migrate its website from its on-premises data center to AWS. The website service APIs are hosted on Docker containers in a self-managed container platform. To meet compliance requirements, the company has installed proprietary security agent software on each container platform node. MySQL databases are installed on two separate VMs in a source-replica setup. A solutions architect must design a solution to migrate the entire website environment to AWS.

  Which solution will meet these requirements with the LEAST operational overhead?

  A. Deploy website services as containers on Amazon EC2 instances. For the EC2 instances, use a custom AMI that has the proprietary security agent software and container management software pre-installed. Migrate the MySQL database data to an Amazon Aurora DB cluster by using AWS DMS. Add an additional read replica to the Aurora DB cluster.
  B. Create an Amazon EKS cluster that is configured with a managed node group. Use a custom AMI that has the proprietary security agent software pre-installed. Deploy website services as Kubernetes pods. Migrate the MySQL database data to an Amazon RDS for MySQL DB instance by using AWS DMS. Configure a Multi-AZ deployment for the RDS DB instance.
  C. Deploy website services as containers on AWS Lambda functions. Create an Amazon API Gateway API to serve incoming requests to Lambda functions on the backend. Save static content in an Amazon S3 bucket. Migrate the MySQL database data to an Amazon RDS for MySQL DB instance by using AWS DMS. Configure a Multi-AZ deployment for the RDS DB instance.
  D. Create an Amazon ECS cluster that uses the Fargate launch type. Configure Fargate with a custom AMI that has the proprietary security agent software pre-installed. Deploy website services as ECS tasks. Migrate the MySQL database data to an Amazon Aurora DB cluster by using AWS DMS. Add an additional read replica to the Aurora DB cluster.
  B. Create an Amazon EKS cluster that is configured with a managed node group. Use a custom AMI that has the proprietary security agent software pre-installed. Deploy website services as Kubernetes pods. Migrate the MySQL database data to an Amazon RDS for MySQL DB instance by using AWS DMS. Configure a Multi-AZ deployment for the RDS DB instance.

  ---

  Explanation

  The existing application already runs in containers on a self-managed container platform, and compliance requires proprietary agent software on each container platform node. Amazon EKS with managed node groups is the best fit because it preserves the Kubernetes operating model and allows custom AMIs for worker nodes, where the agent can be pre-installed. This minimizes migration effort because Kubernetes manifests and container deployment patterns can remain largely intact. AWS DMS is appropriate for migrating the existing MySQL database to Amazon RDS for MySQL, and a Multi-AZ RDS deployment improves availability with less operational overhead than managing source-replica VMs. Option D is invalid because Fargate does not allow custom AMIs or node-level agents.

  Option A requires more self-management.

  Option C changes the application architecture too aggressively. (AWS Documentation)

• Question 768:

  A company runs a highly available data collection application on Amazon EC2 in the eu-north-1 Region.

  The application collects data from end-user devices and writes records to an Amazon Kinesis data stream and a set of AWS Lambda functions that process the records. The company persists the output of the record processing to an Amazon S3 bucket in eu-north-1. The company uses the data in the S3 bucket as a data source for Amazon Athena.

  The company wants to increase its global presence. A solutions architect must launch the data collection capabilities in the sa-east-1 and ap-northeast-1 Regions. The solutions architect deploys the application, the Kinesis data stream, and the Lambda functions in the two new Regions. The solutions architect keeps the S3 bucket in eu-north-1 to meet a requirement to centralize the data analysis.

  During testing of the new setup, the solutions architect notices a significant lag on the arrival of data from the new Regions to the S3 bucket.

  Which solution will improve this lag time the MOST?

  A. In each of the Iwo new Regions set up the Lambda functions to run in a VPC Set up an S3 gateway endpoint in that VPC
  B. Turn on S3 Transfer Acceleration on the S3 bucket in eu-north-1 Change the application to use the new S3 accelerated endpoint when the application uploads data to the S3 bucket
  C. Create an S3 bucket in each of the two new Regions. Set the application in each new Region to upload to its respective S3 bucket. Set up S3 Cross-Region Replication to replicate data to the S3 bucket in eu-north-1.
  D. Increase the memory requirements of the Lambda functions to ensure that they have multiple cores available Use the multipart upload feature when the application uploads data to Amazon S3 Lambda
  C. Create an S3 bucket in each of the two new Regions. Set the application in each new Region to upload to its respective S3 bucket. Set up S3 Cross-Region Replication to replicate data to the S3 bucket in eu-north-1.

• Question 769:

  A solutions architect must update an application environment within AWS Elastic Beanstalk using a With green deployment methodology. The solutions architect creates an environment that is identical to the existing application environment and deploys the application to the new environment.

  What should be done next to complete the update?

  A. Redirect to the new environment using Amazon Route 53
  B. Select the Swap Environment URLs option.
  C. Replace the Auto Scaling launch configuration
  D. Update the DNS records to point to the green environment
  B. Select the Swap Environment URLs option.

  ---

  Explanation

  https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/using-features.CNAMESwap.html

• Question 770:

  A company plans to refactor a monolithic application into a modern application designed deployed or AWS.

  The CLCD pipeline needs to be upgraded to support the modem design for the application with the following requirements

  1. It should allow changes to be released several times every hour.

  2. It should be able to roll back the changes as quickly as possible

  Which design will meet these requirements?

  A. Deploy a Cl-CD pipeline that incorporates AMIs to contain the application and their configurations Deploy the application by replacing Amazon EC2 instances
  B. Specify AWS Elastic Beanstak to sage in a secondary environment as the deployment target for the CI/ CD pipeline of the application. To deploy swap the staging and production environment URLs.
  C. Use AWS Systems Manager to re-provision the infrastructure for each deployment Update the Amazon EC2 user data to pull the latest code art-fact from Amazon S3 and use Amazon Route 53 weighted routing to point to the new environment
  D. Roll out At application updates as pan of an Auto Scaling event using prebuilt AMIs. Use new versions of the AMIs to add instances, and phase out all instances that use the previous AMI version with the configured termination policy during a deployment event.
  B. Specify AWS Elastic Beanstak to sage in a secondary environment as the deployment target for the CI/ CD pipeline of the application. To deploy swap the staging and production environment URLs.

  ---

  Explanation

  It is the fastest when it comes to rollback and deploying changes every hour