Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 771:

  A company is migrating its on-premises file transfer solution to AWS Transfer Family. The current system includes an SFTP server, a transformation application, and a messaging server. Transformations run every 5 minutes and notify the messaging server when complete.

  The company wants to simplify and reduce operational overhead.

  A. Use Amazon EFS and a cron job to perform the transformations. Notify using SNS.
  B. Use Amazon EMR to perform the transformations and notify via SNS.
  C. Use Amazon S3 as storage with AWS Glue triggered by S3 events for transformations, and notify via SQS.
  D. Use Amazon EFS with a time-based AWS Glue job every 5 minutes.
  C. Use Amazon S3 as storage with AWS Glue triggered by S3 events for transformations, and notify via SQS.

  ---

  Explanation

  Option C is correct: AWS Transfer Family can store uploaded files directly into Amazon S3.S3 event notification scan trigger AWS Glue jobs to transform the data. Upon successful transformation, Glue can send a message to Amazon SQS, enabling event-driven architecture with minimal management.

  Option A and Option D involve cron jobs or scheduled Glue jobs, which increase operational overhead and delay.

  Option B (EMR) is overkill for frequent, lightweight transformations.

  References:

  AWS Transfer Family with S3

• Question 772:

  A company has set up its entire infrastructure on AWS. The company uses Amazon EC2 instances to host its ecommerce website and uses Amazon S3 to store static data. Three engineers at the company handle the cloud administration and development through one AWS account. Occasionally, an engineer alters an EC2 security group configuration of another engineer and causes noncompliance issues in the environment.

  A solutions architect must set up a system that tracks changes that the engineers make. The system must send alerts when the engineers make noncompliant changes to the security settings for the EC2 instances.

  What is the FASTEST way for the solutions architect to meet these requirements?

  A. Set up AWS Organizations for the company. Apply SCPs to govern and track noncompliant security group changes that are made to the AWS account.
  B. Enable AWS CloudTrail to capture the changes to EC2 security groups. Enable Amazon CtoudWatch rules to provide alerts when noncompliant security settings are detected.
  C. Enable SCPs on the AWS account to provide alerts when noncompliant security group changes are made to the environment.
  D. Enable AWS Config on the EC2 security groups to track any noncompliant changes Send the changes as alerts through an Amazon Simple Notification Service (Amazon SNS) topic.
  D. Enable AWS Config on the EC2 security groups to track any noncompliant changes Send the changes as alerts through an Amazon Simple Notification Service (Amazon SNS) topic.

  ---

  Explanation

  https://aws.amazon.com/es/blogs/industries/how-to-monitor-alert-and-remediate-non-compliant-hipaa-findings-on-aws/

• Question 773:

  A retail company is hosting an ecommerce website on AWS across multiple AWS Regions. The company wants the website to be operational at all times for online purchases. The website stores data in an Amazon RDS for MySQL DB instance.

  Which solution will provide the HIGHEST availability for the database?

  A. Configure automated backups on Amazon RDS. In the case of disruption, promote an automated backup to be a standalone DB instance. Direct database traffic to the promoted DB instance. Create a replacement read replica that has the promoted DB instance as its source.
  B. Configure global tables and read replicas on Amazon RDS. Activate the cross-Region scope. In the case of disruption, use AWS Lambda to copy the read replicas from one Region to another Region.
  C. Configure global tables and automated backups on Amazon RDS. In the case of disruption, use AWS Lambda to copy the read replicas from one Region to another Region.
  D. Configure read replicas on Amazon RDS. In the case of disruption, promote a cross-Region and read replica to be a standalone DB instance. Direct database traffic to the promoted DB instance. Create a replacement read replica that has the promoted DB instance as its source.
  D. Configure read replicas on Amazon RDS. In the case of disruption, promote a cross-Region and read replica to be a standalone DB instance. Direct database traffic to the promoted DB instance. Create a replacement read replica that has the promoted DB instance as its source.

  ---

  Explanation

  This solution will provide the highest availability for the database, as the read replicas will allow the database to be available in multiple Regions, thus reducing the chances of disruption. Additionally, the promotion of the cross-Region read replica to become a standalone DB instance will ensure that the database is still available even if one of the Regions experiences disruptions.

• Question 774:

  A solutions architect must create a business case for migration of a company's on-premises data center to the AWS Cloud. The solutions architect will use a configuration management database (CMDB) export of all the company's servers to create the case.

  Which solution will meet these requirements MOST cost-effectively?

  A. Use AWS Well-Architected Tool to import the CMDB data to perform an analysis and generate recommendations.
  B. Use Migration Evaluator to perform an analysis. Use the data import template to upload the data from the CMDB export.
  C. Implement resource matching rules. Use the CMDB export and the AWS Price List Bulk API to query CMDB data against AWS services in bulk.
  D. Use AWS Application Discovery Service to import the CMDB data to perform an analysis.
  B. Use Migration Evaluator to perform an analysis. Use the data import template to upload the data from the CMDB export.

  ---

  Explanation

  https://aws.amazon.com/blogs/architecture/accelerating-your-migration-to-aws/

  Build a business case with AWS Migration Evaluator The foundation for a successful migration starts with a defined business objective (for example, growth or new offerings). In order to enable the business drivers, the established business case must then be aligned to a technical capability (increased security and elasticity). AWS Migration Evaluator (formerly known as TSO Logic) can help you meet these objectives. To get started, you can choose to upload exports from third- party tools such as Configuration Management Database (CMDB) or install a collector agent to monitor. You will receive an assessment after data collection, which includes a projected cost estimate and savings of running your on- premises workloads in the AWS Cloud. This estimate will provide a summary of the projected costs to re-host onAWSbasedonusagepatterns.Itwillshowthebreakdownofcostsbyinfrastructureandsoftwarelicenses.Withthisinformation,youcanmakethebusinesscaseandplannextsteps.

• Question 775:

  A company uses an AWS CloudFormation template to deploy an Amazon ECS service into a production environment. The template includes an Amazon S3 bucket that is named by using a common prefix with the CloudFormation stack name. The company uses the same template to create temporary environments for development and continuous integration. Developers can create environments successfully, but they receive errors from CloudFormation when they attempt to delete the environments. The developers often need to delete and recreate stacks with the same names as part of the development and testing process.

  Which combination of steps should a solutions architect take to modify the solution to resolve this issue? (Select TWO.)

  A. Associate an AWS Lambda function with a CloudFormation custom resource to delete all keys that are present in a given S3 bucket. Implement this custom resource as part of the application ' s CloudFormation template.
  B. Modify the S3 bucket resource in the CloudFormation template by specifying Delete for the DeletionPolicy attribute. Specify the CAPABILITY_DELETE_NONEMPTY capability to process CloudFormation delete operations.
  C. Modify the S3 bucket resource in the CloudFormation template by specifying Retain for the DeletionPolicy attribute. Configure an AWS Config custom rule to run every 24 hours to identify, empty, and delete buckets that are no longer owned by a CloudFormation stack.
  D. Ensure that CloudFormation operations are being invoked by a role that has s3:DeleteObject permissions on all objects in the bucket.
  E. Modify the S3 bucket resource in the CloudFormation template to configure a bucket policy that grants s3:DeleteObject permissions on all objects in the bucket.
  A. Associate an AWS Lambda function with a CloudFormation custom resource to delete all keys that are present in a given S3 bucket. Implement this custom resource as part of the application ' s CloudFormation template.
  D. Ensure that CloudFormation operations are being invoked by a role that has s3:DeleteObject permissions on all objects in the bucket.

  ---

  Explanation

  CloudFormation cannot delete an S3 bucket that contains objects. When the developers attempt to delete temporary stacks, the delete operation fails if the associated S3 bucket still has objects. Because the bucket name is derived from the stack name, failed deletions can also prevent re-creation of stacks with the same names until the bucket is manually emptied and deleted. This causes friction for development and continuous integration workflows.

  To resolve this, the solution must ensure that, during stack deletion, all objects are removed from the S3 bucket so that CloudFormation can delete the bucket successfully. CloudFormation does not natively support automatic deletion of bucket contents. However, CloudFormation custom resources can be used to perform custom actions during stack lifecycle events.

  Option A proposes associating a Lambda function with a CloudFormation custom resource. The custom resource can be invoked during stack deletion to list and delete all objects (and object versions if versioning is enabled) in the specified bucket. Once the bucket is emptied by the Lambda function, the standard CloudFormation deletion process can successfully delete the bucket resource. In addition to emptying the bucket, the IAM role used by CloudFormation must have permissions to delete objects in the bucket. If CloudFormation uses an execution role that lacks s3:DeleteObject (and potentially s3: ListBucket) permissions, the bucket-cleanup Lambda function or CloudFormation itself would not be able to remove objects.

  Option D ensures that CloudFormation operations are invoked by a role that has s3: DeleteObject permissions on bucket objects, enabling the custom resource to perform the deletions.

  Option B is incorrect because, although DeletionPolicy can be set to Delete, there is no such capability as CAPABILITY_DELETE_NONEMPTY in CloudFormation, and DeletionPolicy alone does not override the S3 service requirement that buckets must be empty before deletion. Option C's Retain DeletionPolicy leaves the bucket behind when the stack is deleted. While an external AWS Config rule could clean up stale buckets, it complicates the design and does not directly solve the problem of re-creating stacks with the same bucket name in a predictable, immediate way.

  Option E configures a bucket policy to grant s3:DeleteObject permissions, but this is not sufficient alone.

  CloudFormation still must assume a role with the appropriate permissions. Bucket policy and IAM role permissions must both be considered, but the key action to resolve the deletion failure is to explicitly empty the bucket through a custom resource, as in option A, and ensure the execution role has delete permissions, as in option D.

  Therefore, implementing a Lambda-backed custom resource to empty the S3 bucket during stack deletion (option A) and ensuring the CloudFormation execution role has s3:DeleteObject permissions (option D) resolves the deletion errors and allows developers to delete and recreate stacks freely.

  References:

  AWS documentation on CloudFormation behavior with S3 bucket deletion and the requirement that buckets must be empty before deletion.AWS documentation on CloudFormation custom resources and Lambda-backed custom resources for performing custom actions during stack operations.

• Question 776:

  A media company has a 30-TB repository of digital news videos. These videos are stored on tape in an on-premises tape library and referenced by a Media Asset Management (MAM) system. The company wants to enrich the metadata for these videos in an automated fashion and put them into a searchable catalog by using a MAM feature. The company must be able to search based on information in the video, such as objects, scenery items, or people's faces. A catalog is available that contains faces of people who have appeared in the videos that include an image of each person. The company would like to migrate these videos to AWS.

  The company has a high-speed AWS Direct Connect connection with AWS and would like to move the MAM solution video content directly from its current file system.

  How can these requirements be met by using the LEAST amount of ongoing management overhead and causing MINIMAL disruption to the existing system?

  A. Set up an AWS Storage Gateway, file gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the file gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Rekognition pull the video from the Amazon S3 files backing the file gateway, retrieve the required metadata, and push the metadata into the MAM solution.
  B. Set up an AWS Storage Gateway, tape gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the tape gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Amazon Rekognition process the video in the tape gateway, retrieve the required metadata, and push the metadata into the MAM solution.
  C. Configure a video ingestion stream by using Amazon Kinesis Video Streams. Use the catalog of faces to build a collection in Amazon Rekognition. Stream the videos from the MAM solution into Kinesis Video Streams. Configure Amazon Rekognition to process the streamed videos. Then, use a stream consumer to retrieve the required metadata, and push the metadata into the MAM solution. Configure the stream to store the videos in Amazon S3.
  D. Set up an Amazon EC2 instance that runs the OpenCV libraries. Copy the videos, images, and face catalog from the on-premises library into an Amazon EBS volume mounted on this EC2 instance. Process the videos to retrieve the required metadata, and push the metadata into the MAM solution, while also copying the video files to an Amazon S3 bucket.
  A. Set up an AWS Storage Gateway, file gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the file gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Rekognition pull the video from the Amazon S3 files backing the file gateway, retrieve the required metadata, and push the metadata into the MAM solution.

• Question 777:

  A retail business runs an orders and payments solution that uses more than 100 AWS Lambda functions that are written in Python. As the company ' s product catalog grows, the company observes that many of the functions time out. The company reconfigures the functions to have the maximum available timeout values, and the company increases memory for the functions. However, the functions continue to time out.

  The company investigates the timeout issue and finds that most failures occur when several functions have been chained together, which results in the initial function timing out while it waits for responses. A solutions architect must resolve these timeout issues while maintaining the cost and operational benefits of using Lambda functions.

  Which solution will meet these requirements with the MINIMUM amount of application changes?

  A. Convert the solution to run in containers. Deploy an Amazon EKS cluster and enable auto scaling for the containers.
  B. Rewrite the Lambda functions in Java. Implement Amazon SQS queues between functions.
  C. Convert the solution to use an AWS Step Functions workflow to invoke the Lambda functions. Remove the direct function-to-function invocations.
  D. Combine groups of linked functions together in a single container image. Deploy the container by using Amazon ECS on Amazon EC2 Spot Instances.
  C. Convert the solution to use an AWS Step Functions workflow to invoke the Lambda functions. Remove the direct function-to-function invocations.

  ---

  Explanation

  C is correct because the root cause is synchronous chaining of Lambda functions that causes the initial function to wait and time out. AWS Step Functions is designed to orchestrate multiple steps (including Lambda invocations) with managed state, retries, and timeouts at the workflow level. By moving the chaining logic into a Step Functions state machine and removing direct function-to-function invocations, the initial Lambda no longer needs to remain running while waiting for downstream functions. Step Functions can coordinate the sequence (or parallel branches), handle transient failures with retries/ backoff, and maintain execution state without requiring a long-lived "waiting" Lambda invocation. This resolves timeouts while preserving the operational and cost advantages of a serverless Lambda-based architecture and typically requires minimal code change compared to rewriting or migrating platforms.

  Why the other options are incorrect:

  A: Migrating to containers/EKS is a major architectural change and increases operational overhead, violating "minimum application changes" and the desire to keep Lambda benefits.

  B: Rewriting in Java is extensive and unnecessary. Adding SQS between functions changes invocation style and error handling and still requires significant redesign (and does not inherently solve orchestration / branching as cleanly as Step Functions).

  D: Grouping functions into containers and running on ECS Spot changes the compute model and introduces more operational overhead and larger application changes than adopting Step Functions.

  References:

  AWS Step Functions Documentation: workflow orchestration for Lambda, managed state, retries, error handling, and long-running coordination without keeping a Lambda function running AWS Lambda Documentation: timeout behavior and best practices for designing asynchronous and orchestrated serverless workflows AWS Well-Architected Framework (Operational Excellence / Reliability): using managed orchestration for complex workflows, reducing tight coupling, and improving resilience AWS Certified Solutions Architect - Professional (SAP-C02) Exam Guide: designing scalable serverless architectures and selecting Step Functions for multi-step workflows

• Question 778:

  A company that designs multiplayer online games wants to expand its user base outside of Europe. The company transfers a significant amount of UDP traffic to keep all the live and interactive sessions of the games. The company has plans for rapid expansion and wants to build its architecture to provide an optimized online experience to its users.

  Which architecture will meet these requirements with the LOWEST latency for users?

  A. Set up a Multi-AZ environment in a single AWS Region Use Amazon CloudFront to cache user sessions
  B. Set up environments in multiple AWS Regions Create an accelerator in AWS Global Accelerator, and add endpoints from different Regions to it
  C. Set up environments in multiple AWS Regions Use Amazon Route 53. and select latency-based routing
  D. Set up a Multi-AZ environment in a single AWS Region. Use AWS Lambda@Edge to update sessions closer to the users
  B. Set up environments in multiple AWS Regions Create an accelerator in AWS Global Accelerator, and add endpoints from different Regions to it

• Question 779:

  A company is migrating an on-premises content management system (CMS) to AWS Fargate. The company uses the CMS for blog posts that include text, images, and videos. The company has observed that traffic to blog posts drops by more than 80% after the posts are more than 30 days old

  The CMS runs on multiple VMs and stores application state on disk.

  This application state is shared across all instances across multiple Availability Zones Images and other media are stored on a separate NFS file share. The company needs to reduce the costs of the existing solution while minimizing the impact on performance.

  Which combination of steps will meet these requirements MOST cost-effectively? (Select TWO.)

  A. Store media in an Amazon S3 Standard bucket Create an S3 Lifecycle configuration that transitions objects that are older than 30 days to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
  B. Store media on an Amazon Elastic File System (Amazon EFS) volume Attach the EFS volume to all Fargate instances.
  C. Store application state on an Amazon Elastic File System (Amazon EFS) volume Attach the EFS volume to all Fargate instances.
  D. Store application state on an Amazon Elastic Block Store (Amazon EBS) volume Attach the EBS volume to all Fargate instances.
  E. Store media in an Amazon S3 Standard bucket Create an S3 Lifecycle configuration that transitions objects that are older than 30 days to the S3 Glacier storage class
  A. Store media in an Amazon S3 Standard bucket Create an S3 Lifecycle configuration that transitions objects that are older than 30 days to the S3 Standard-Infrequent Access (S3 Standard-IA) storage class.
  C. Store application state on an Amazon Elastic File System (Amazon EFS) volume Attach the EFS volume to all Fargate instances.

• Question 780:

  A healthcare company is designing a patient portal. The portal must use a database to store patient data.

  The portal must encrypt all data at rest and in transit. The portal must audit all data access. Database users must not be able to tamper with the audit trail. The company must retain the audit data for 10 years.

  The audit data must be immutable.

  Which combination of steps will meet these requirements? (Select TWO.)

  A. Store data in an Amazon Aurora PostgreSQL encrypted database. Enforce the use of TLS for all connections.
  B. Store data in an Amazon RDS for PostgreSQL encrypted database. Enforce the use of TLS for all connections.
  C. Create a database activity stream in the database cluster. Use Amazon Data Firehose to send the data to an Amazon S3 bucket. Enable S3 Object Lock in compliance mode with a 10-year retention period.
  D. Install pgAudit in the database cluster. Store the data in Amazon CloudWatch Logs. Use Amazon Data Firehose to send the data to an Amazon S3 bucket. Enable S3 Object Lock in compliance mode with a 10-year retention period.
  E. Install pgAudit in the database cluster. Store the data in Amazon CloudWatch Logs. Use Amazon Data Firehose to send the data to an Amazon S3 bucket. Enable S3 Object Lock in governance mode with a 10-year retention period.
  A. Store data in an Amazon Aurora PostgreSQL encrypted database. Enforce the use of TLS for all connections.
  C. Create a database activity stream in the database cluster. Use Amazon Data Firehose to send the data to an Amazon S3 bucket. Enable S3 Object Lock in compliance mode with a 10-year retention period.

  ---

  Explanation

  A and C are correct. Aurora PostgreSQL can store patient data in an encrypted database and can enforce TLS for encrypted connections in transit. For tamper-resistant auditing, Aurora Database Activity Streams are the stronger choice because they monitor database activity and send the stream to Amazon Kinesis for external consumption. AWS documentation states that activity streams monitor and report activities and that the activity stream is collected and transmitted to Kinesis. Sending those audit records to Amazon S3 and enabling S3 Object Lock in compliance mode provides immutable retention. Compliance mode prevents protected object versions from being overwritten or deleted by any user, including the root user, during the retention period. pgAudit logs in CloudWatch are useful, but they do not provide the same database activity stream control and immutability pattern.