Amazon SAP-C02 Online Practice Questions and Exam Preparation

Amazon SAP-C02 Online Questions & Answers

• Question 831:

  A company is building an electronic document management system in which users upload their documents. The application stack is entirely serverless and runs on AWS in the eu-central-1 Region. The system includes a web application that uses an Amazon CloudFront distribution for delivery with Amazon

  S3 as the origin. The web application communicates with Amazon API Gateway Regional endpoints. The API Gateway APIs call AWS Lambda functions that store metadata in an Amazon Aurora Serverless database and put the documents into an S3 bucket.

  The company is growing steadily and has completed a proof of concept with its largest customer. The company must improve latency outside of Europe.

  Which combination of actions will meet these requirements? (Select TWO.)

  A. Enable S3 Transfer Acceleration on the S3 bucket. Ensure that the web application uses the Transfer Acceleration signed URLs.
  B. Create an accelerator in AWS Global Accelerator. Attach the accelerator to the CloudFront distribution.
  C. Change the API Gateway Regional endpoints to edge-optimized endpoints.
  D. Provision the entire stack in two other locations that are spread across the world. Use global databases on the Aurora Serverless cluster.
  E. Add an Amazon RDS proxy between the Lambda functions and the Aurora Serverless database.
  A. Enable S3 Transfer Acceleration on the S3 bucket. Ensure that the web application uses the Transfer Acceleration signed URLs.
  C. Change the API Gateway Regional endpoints to edge-optimized endpoints.

  ---

  Explanation

  https://aws.amazon.com/global-accelerator/faqs/

• Question 832:

  A company is migrating its three-tier web application from on-premises to the AWS Cloud. The company has the following requirements for the migration process:

  1. Ingest machine images from the on-premises environment.

  2. Synchronize changes from the on-premises environment to the AWS environment until the production cutover.

  3. Minimize downtime when executing the production cutover.

  4. Migrate the virtual machines' root volumes and data volumes.

  Which solution will satisfy these requirements with minimal operational overhead?

  A. Use AWS Server Migration Service (SMS) to create and launch a replication job for each tier of the application. Launch instances from the AMIs created by AWS SMS. After initial testing, perform a final replication and create new instances from the updated AMIs.
  B. Create an AWS CLIVM Import/Export script to migrate each virtual machine. Schedule the script to run incrementally to maintain changes in the application. Launch instances from the AMIs created by VM Import/Export. Once testing is done, rerun the script to do a final import and launch the instances from the AMIs.
  C. Use AWS Server Migration Service (SMS) to upload the operating system volumes. Use the AWS CLI import-snaps hot command 'or the data volumes. Launch instances from the AMIs created by AWS SMS and attach the data volumes to the instances. After initial testing, perform a final replication, launch new instances from the replicated AMIs. and attach the data volumes to the instances.
  D. Use AWS Application Discovery Service and AWS Migration Hub to group the virtual machines as an application. Use the AWS CLI VM Import/Export script to import the virtual machines as AMIs. Schedule the script to run incrementally to maintain changes in the application. Launch instances from the AMIs. After initial testing, perform a final virtual machine import and launch new instances from the AMIs.
  A. Use AWS Server Migration Service (SMS) to create and launch a replication job for each tier of the application. Launch instances from the AMIs created by AWS SMS. After initial testing, perform a final replication and create new instances from the updated AMIs.

  ---

  Explanation

  SMS can handle migrating the data volumes:

  https://aws.amazon.com/about-aws/whats-new/2018/09/aws-server-migration-service-adds-support-for-migrating-larger-data-volumes/

• Question 833:

  Question: A company mandates that all internal AWS communications useprivate IPs. A solutions architect createdinterface VPC endpointsfor public AWS services like S3. However, service names are still resolving topublic IP addresses, and the internal apps cannot connect.

  What should the architect do to resolve this issue?

  A. Update the subnet route table with a route to the interface endpoint.
  B. Enable the private DNS option on the VPC attributes.
  C. Configure the security group on the interface endpoint to allow access.
  D. Configure a private hosted zone with conditional forwarding.
  B. Enable the private DNS option on the VPC attributes.

  ---

  Explanation

  B is correct. WhenPrivate DNSis enabled for an interface endpoint, AWS automatically updates the public service DNS names (e.g., s3.amazonaws.com) to resolve toprivate IPsinside the VPC. This ensures all traffic stays within the AWS network and complies with the private IP policy.

  A is not necessary - VPC endpoints already route via local network.

  C only affects security group rules, not DNS resolution.

  D is unnecessary unless using custom DNS resolution systems.

  References:

  VPC Endpoints and Private DNS

• Question 834:

  A company needs to migrate a 2 TB MySQL database from an on-premises data center to an Amazon Aurora cluster. The database receives hundreds of updates every minute. The on-premises database server is not accessible through the internet. The migration solution must ensure that no data is lost between the start of migration and cutover. The migration must begin as soon as possible and must minimize downtime.

  Which solution will meet these requirements?

  A. Create an AWS Site-to-Site VPN connection between the on-premises data center and the VPC that hosts the Aurora duster. Create a dump of the on-premises database by using mysqldump. Upload the dump to Amazon S3 by using multipart upload. Use an Amazon EC2 instance with appropriate permissions to import the dump to the Aurora cluster.
  B. Create an AWS Site-to-Site VPN connection between the on-premises data center and the VPC that hosts the Aurora cluster. Specify the on-premises database as the source endpoint in AWS DMS. Specify the Aurora duster as the target endpoint. Configure a DMS task with ongoing replication.
  C. Set up an AWS Direct Connect connection between the on-premises data center and the VPC that hosts the Aurora duster. Create a dump of the on-premises database by using mysqldump. Upload the dump to Amazon S3 by using multipart upload. Use an Amazon EC2 instance with appropriate permissions to import the dump to the Aurora cluster. Set up replication between the data center and the Aurora cluster.
  D. Set up an AWS Direct Connect connection between the on-premises data center and the VPC that hosts the Aurora cluster. Specify the on-premises database as the source endpoint in AWS DMS. Specify the Aurora duster as the target endpoint Configure a DMS task with ongoing replication.
  B. Create an AWS Site-to-Site VPN connection between the on-premises data center and the VPC that hosts the Aurora cluster. Specify the on-premises database as the source endpoint in AWS DMS. Specify the Aurora duster as the target endpoint. Configure a DMS task with ongoing replication.

• Question 835:

  Example Corp uses an organization in AWS Organizations with all features enabled to manage multiple AWS accounts. Example Corp acquires AnyCompany, which currently hosts its AWS environment in a single AWS account. Example Corp wants to add AnyCompany's AWS account to Example Corp's existing organization.

  Which solution will meet this requirement?

  A. From AnyCompany's AWS account, invite Example Corp's existing AWS management account to start the join process. Ensure that Organizations creates the OrganizationAccountAccessRole IAM role with the required permissions.
  B. From Example Corp's management AWS account, send an AWS Support request to AWS to add AnyCompany's AWS account to the existing organization. Ensure that Organizations creates the OrganizationAccountAccessRole IAM role with the required permissions.
  C. From Example Corp's management AWS account, send an invitation to AnyCompany's AWS account. Accept the invitation in AnyCompany's account. Create an OrganizationAccountAccessRole IAM role with the appropriate managed IAM policy.
  D. From AnyCompany's AWS account, create an OrganizationAccountAccessRole IAM role with the appropriate managed IAM policy. Configure AnyCompany's AWS account to be a member of Example Corp's organization.
  C. From Example Corp's management AWS account, send an invitation to AnyCompany's AWS account. Accept the invitation in AnyCompany's account. Create an OrganizationAccountAccessRole IAM role with the appropriate managed IAM policy.

  ---

  Explanation

  The correct answer is C. To add an existing standalone AWS account to an organization, the invitation must be initiated from the organization's management account. The invited account then accepts the invitation. For accounts that are invited into an organization, the OrganizationAccountAccessRole role is not automatically created in the same way it is when an account is created through Organizations. AWS documentation explains that an equivalent administrator role can be created manually in the invited member account.

  Option A reverses the invitation flow.

  Option B is unnecessary because AWS Support is not required for the standard account invitation process.

  Option D is incomplete because a standalone account cannot independently configure itself as a member without accepting an invitation from the management account. (AWS Documentation)

• Question 836:

  A retail company runs a business-critical web service on an Amazon Elastic Container Service (Amazon ECS) cluster that runs on Amazon EC2 instances.

  The web service receives POST requests from end users and writes data to a MySQL database that runs on a separate EC2 instance.

  The company needs to ensure that data loss does not occur. The current code deployment process includes manual updates of the ECS service During a recent deployment, end users encountered intermittent 502 Bad Gateway errors in response to valid web requests

  The company wants to implement a reliable solution to prevent this issue from recurring. The company also wants to automate code deployments. The solution must be highly available and must optimize cost-effectiveness.

  Which combination of steps will meet these requirements? (Select THREE.)

  A. Run the web service on an ECS cluster that has a Fargate launch type Use AWS CodePipeline and AWS CodeDeploy to perform a blue/green deployment with validation testing to update the ECS service.
  B. Migrate the MySQL database to run on an Amazon RDS for MySQL Multi-AZ DB instance that uses Provisioned IOPS SSD (io2) storage
  C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an event source to receive the POST requests from the web service Configure an AWS Lambda function to poll the queue Write the data to the database.
  D. Run the web service on an ECS cluster that has a Fargate launch type Use AWS CodePipeline and AWS CodeDeploy to perform a canary deployment to update the ECS service.
  C. Configure an Amazon Simple Queue Service (Amazon SQS) queue as an event source to receive the POST requests from the web service Configure an AWS Lambda function to poll the queue Write the data to the database.
  D. Run the web service on an ECS cluster that has a Fargate launch type Use AWS CodePipeline and AWS CodeDeploy to perform a canary deployment to update the ECS service.

• Question 837:

  A company has implemented a global multiplayer gaming platform.

  The platform requires gaming clients to have reliable, low-latency access to the server infrastructure that is hosted on a fleet of Amazon EC2 instances in a single AWS Region

  The gaming clients use a custom TCP protocol to connect to the server infrastructure.

  The application architecture requires client IP addresses to be available to the server software.

  Which solution meets these requirements?

  A. Create a Network Load Balancer (NLB), and add the EC2 instances to a target group Create an Amazon CloudFront Real Time Messaging Protocol (RTMP) distribution and configure the origin to point to the DNS endpoint of the NLB Use proxy protocol version 2 headers to preserve client IP addresses
  B. Use an AWS Direct Connect gateway to connect multiple Direct Connect locations in different Regions globally Configure Amazon Route 53 with geolocation routing to send traffic to the nearest Direct Connect location Associate the VPC that contains the EC2 instances with the Direct Connect gateway
  C. Create an accelerator in AWS Global Accelerator and configure the listener to point to a single endpoint group Add each of the EC2 instances as endpoints to the endpoint group Configure the endpoint group weighting equally across all of the EC2 endpoints
  D. Create an Application Load Balancer (ALB) and add the EC2 instances to a target group Create a set of Amazon Route 53 latency-based alias records that point to the DNS endpoint of the ALB Use X- Forwarded-For headers to preserve client IP addresses
  B. Use an AWS Direct Connect gateway to connect multiple Direct Connect locations in different Regions globally Configure Amazon Route 53 with geolocation routing to send traffic to the nearest Direct Connect location Associate the VPC that contains the EC2 instances with the Direct Connect gateway

• Question 838:

  An enterprise company is building an infrastructure services platform for its users. The company has the following requirements:

  1. Provide least privilege access to users when launching AWS infrastructure so users cannot provision unapproved services.

  2. Use a central account to manage the creation of infrastructure services. Provide the ability to distribute infrastructure services to multiple accounts in AWS Organizations.

  3. Provide the ability to enforce tags on any infrastructure that is started by users.

  Which combination of actions using AWS services will meet these requirements? (Choose three.)

  A. Develop infrastructure services using AWS Cloud Formation templates. Add the templates to a central Amazon S3 bucket and add the-IAM roles or users that require access to the S3 bucket policy.
  B. Develop infrastructure services using AWS Cloud Formation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the Organizations structure created for the company.
  C. Allow user IAM roles to have AWSCloudFormationFullAccess and AmazonS3ReadOnlyAccess permissions. Add an Organizations SCP at the AWS account root user level to deny all services except AWS CloudFormation and Amazon S3.
  D. Allow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an automation script to import the central portfolios to local AWS accounts, copy the TagOption assign users access and apply launch constraints.
  E. Use the AWS Service Catalog TagOption Library to maintain a list of tags required by the company. Apply the TagOption to AWS Service Catalog products or portfolios.
  F. Use the AWS CloudFormation Resource Tags property to enforce the application of tags to any CloudFormation templates that will be created for users.
  B. Develop infrastructure services using AWS Cloud Formation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the Organizations structure created for the company.
  D. Allow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an automation script to import the central portfolios to local AWS accounts, copy the TagOption assign users access and apply launch constraints.
  E. Use the AWS Service Catalog TagOption Library to maintain a list of tags required by the company. Apply the TagOption to AWS Service Catalog products or portfolios.

  ---

  Explanation

  Developing infrastructure services using AWS CloudFormation templates and uploading them as AWS Service Catalog products to portfolios created in a central AWS account will enable the company to centrally manage the creation of infrastructure services and control who can use them1. AWS Service Catalog allows you to create and manage catalogs of IT services that are approved for use on AWS2. You can organize products into portfolios, which are collections of products along with configuration information3. You can share portfolios with other accounts in your organization using AWS Organizations4.

  Allowing user IAM roles to have ServiceCatalogEndUserAccess permissions only and using an automation script to import the central portfolios to local AWS accounts, copy the TagOption, assign users access, and apply launch constraints will enable the company to provide least privilege access to users when launching AWS infrastructure services. ServiceCatalogEndUserAccess is a managed IAM policy that grants users permission to list and view products and launch product instances. An automation script can help import the shared portfolios from the central account to the local accounts, copy the TagOption from the central account, assign users access to the portfolios, and apply launch constraints that specify which IAM role or user can provision a product. Using the AWS Service Catalog TagOption Library to maintain a list of tags required by the company and applying the TagOption to AWS Service Catalog products or portfolios will enable the company to enforce tags on any infrastructure that is started by users. TagOptions are key-value pairs that you can use to classify your AWS Service Catalog resources. You can create a TagOption Library that contains all the tags that you want to use across your organization. You can apply TagOptions to products or portfolios, and they will be automatically applied to any provisioned product instances.

  References:

  Creating a product from an existing CloudFormation template.

  What is AWS Service Catalog?

  Working with portfolios

  Sharing a portfolio with AWS Organizations

  [Providing least privilege access for users]

  [AWS managed policies for job functions]

  [Importing shared portfolios]

  [Enforcing tag policies]

  [Working with TagOptions]

  [Creating a TagOption Library]

  [Applying TagOptions]

• Question 839:

  A company is running a large containerized workload in the AWS Cloud using Amazon ECS. The development team recently started using AWS Fargate instead of EC2 in the ECS cluster. The company is worried about reaching the maximum number of ECS tasks allowed in the account.

  A solutions architect must implement a solution that notifies the development team when Fargate usage reaches 80% of the quota.

  What should the architect do?

  A. Use CloudWatch to monitor the Sample Count for each service. Alert when usage exceeds 80%.
  B. Use CloudWatch to monitor ECS service quotas under the AWS/Usage namespace. Create an alarm when utilization exceeds 80%. Notify via SNS.
  C. Use a Lambda function to poll Fargate metrics. Notify via SES when usage exceeds 80%.
  D. Use AWS Config to monitor Fargate quotas. Notify via SES if non-compliant.
  B. Use CloudWatch to monitor ECS service quotas under the AWS/Usage namespace. Create an alarm when utilization exceeds 80%. Notify via SNS.

  ---

  Explanation

  Option B is correct because AWS/Usage namespace in CloudWatch provides built-in metrics for service quota usage. You can create an alarm for Fargate task count usageand notify the dev team using SNS when it reaches 80% of the quota. A misuses "Sample Count" and doesn't relate to service quota. Option

  C is overly complex and not needed -- native metrics exist. Option D misuses Config (meant for compliance, not utilization).

  References:

  https://docs.aws.amazon.com/servicequotas/latest/userguide/monitoring-using-cloudwatch.html

• Question 840:

  A company needs to create and manage multiple AWS accounts for a number of departments from a central location. The security team requires read-only access to all accounts from its own AWs account.

  The company is using AWS Organizations and created an account tor the security team.

  How should a solutions architect meet these requirements?

  A. Use the OrganizationAccountAccessRole IAM role to create a new IAM policy with read-only access in each member account. Establish a trust relationship between the IAM policy in each member account and the security account. Ask the security team to use the IAM policy to gain access.
  B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.
  C. Ask the security team to use AWS Security Token Service (AWS STS) lo call the AssumeRole API tor the Organization AccountAccessRole IAM role in the management account from the security account. Use the generated temporary credentials to gain access.
  D. Ask the security team to use AWS Security Token Service (AWS STS) to call the AssumeRole API for the Organization AccountAccessRole IAM role in the member account from the security account. Use the generated temporary credentials to gain access.
  B. Use the OrganizationAccountAccessRole IAM role to create a new IAM role with read-only access in each member account. Establish a trust relationship between the IAM role in each member account and the security account. Ask the security team to use the IAM role to gain access.

  ---

  Explanation

  https://docs.aws.amazon.com/organizations/latest/userguide/orgs_manage_accounts_access.html#orgs_manage_accounts_access-cross-account-role

  "When you

  create a member account using the AWS Organizations console, AWS Organizations automatically creates an IAM role named OrganizationAccountAccessRole in the account" you need OrganizationAccountAccessRole in member account to create an read-only role and use role from security team to assume this read-only role.