SAP-C02 practice questions 91–100

1. Question 91 · 527 in bank

   A company runs a processing engine in the AWS Cloud. The engine processes environmental data from logistics centers to calculate a sustainability index. The company has millions of devices in logistics centers that are spread across Europe. The devices send information to the processing engine through a RESTful API. The API experiences unpredictable bursts of traffic. The company must implement a solution to process all data that the devices send to the processing engine. Data loss is unacceptable. Which solution will meet these requirements?

   • ACreate an Application Load Balancer (ALB) for the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create a listener and a target group for the ALB Add the SQS queue as the target. Use a container that runs in Amazon Elastic Container Service (Amazon ECS) with the Fargate launch type to process messages in the queue.
   • BCreate an Amazon API Gateway HTTP API that implements the RESTful API. Create an Amazon Simple Queue Service (Amazon SQS) queue. Create an API Gateway service integration with the SQS queue. Create an AWS Lambda function to process messages in the SQS queue.
   • CCreate an Amazon API Gateway REST API that implements the RESTful API. Create a fleet of Amazon EC2 instances in an Auto Scaling group. Create an API Gateway Auto Scaling group proxy integration. Use the EC2 instances to process incoming data.
   • DCreate an Amazon CloudFront distribution for the RESTful API. Create a data stream in Amazon Kinesis Data Streams. Set the data stream as the origin for the distribution. Create an AWS Lambda function to consume and process data in the data stream.

   Show answer

   Answer: B

   Explanation

   Option A is incorrect because Application Load Balancer (ALB) can't directly target an Amazon SQS queue. Option C is incorrect because while Amazon API Gateway and EC2 Auto Scaling can handle high loads, they don't provide a built-in mechanism to ensure that all messages are processed without loss. Option D is incorrect because Amazon CloudFront is a content delivery network (CDN), and it is not typically used to handle incoming API requests. It is primarily used to cache and deliver content to users.

   Source: Adapted from community discussion — momo3321

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

2. Question 92 · 527 in bank

   A company is designing its network configuration in the AWS Cloud. The company uses AWS Organizations to manage a multi-account setup. The company has three OUs. Each OU contains more than 100 AWS accounts. Each account has a single VPC, and all the VPCs in each OU are in the same AWS Region. The CIDR ranges for all the AWS accounts do not overlap. The company needs to implement a solution in which VPCs in the same OU can communicate with each other but cannot communicate with VPCs in other OUs. Which solution will meet these requirements with the LEAST operational overhead?

   • ACreate an AWS CloudFormation stack set that establishes VPC peering between accounts in each OU. Provision the stack set in each OU.
   • BIn each OU, create a dedicated networking account that has a single VPC. Share this VPC with all the other accounts in the OU by using AWS Resource Access Manager (AWS RAM). Create a VPC peering connection between the networking account and each account in the OU.
   • CProvision a transit gateway in an account in each OU. Share the transit gateway across the organization by using AWS Resource Access Manager (AWS RAM). Create transit gateway VPC attachments for each VPC.
   • DIn each OU, create a dedicated networking account that has a single VPC. Establish a VPN connection between the networking account and the other accounts in the OU. Use third-party routing software to route transitive traffic between the VPCs.

   Show answer

   Answer: C

   Explanation

   C. Transit gateway and RAM is a regional service. AWS RAM is a Regional service, and a resource share is Regional. Therefore, a resource share can contain resources from the same AWS Region as the resource share, and any supported global resources. https://docs.aws.amazon.com/ram/latest/userguide/working-with-regional-vs-global.html https://docs.aws.amazon.com/ram/latest/userguide/getting-started-sharing.html#getting-started-sharing-orgs

   Source: Adapted from community discussion — rlf

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

3. Question 93 · 527 in bank

   A company is migrating an application to AWS. It wants to use fully managed services as much as possible during the migration. The company needs to store large important documents within the application with the following requirements: 1. The data must be highly durable and available 2. The data must always be encrypted at rest and in transit 3. The encryption key must be managed by the company and rotated periodically Which of the following solutions should the solutions architect recommend?

   • ADeploy the storage gateway to AWS in file gateway mode. Use Amazon EBS volume encryption using an AWS KMS key to encrypt the storage gateway volumes.
   • BUse Amazon S3 with a bucket policy to enforce HTTPS for connections to the bucket and to enforce server-side encryption and AWS KMS for object encryption.
   • CUse Amazon DynamoDB with SSL to connect to DynamoDB. Use an AWS KMS key to encrypt DynamoDB objects at rest.
   • DDeploy instances with Amazon EBS volumes attached to store this data. Use EBS volume encryption using an AWS KMS key to encrypt the data.

   Show answer

   Answer: B

   Explanation

   At least an easy one - the provided configuration for S3 in B satisfies the requirements for encryption, durability and availability

   Source: Adapted from community discussion — Maria2023

   References

   • AWS documentation

   Next question

4. Question 94 · 527 in bank

   A company’s public API runs as tasks on Amazon Elastic Container Service (Amazon ECS). The tasks run on AWS Fargate behind an Application Load Balancer (ALB) and are configured with Service Auto Scaling for the tasks based on CPU utilization. This service has been running well for several months. Recently, API performance slowed down and made the application unusable. The company discovered that a significant number of SQL injection attacks had occurred against the API and that the API service had scaled to its maximum amount. A solutions architect needs to implement a solution that prevents SQL injection attacks from reaching the ECS API service. The solution must allow legitimate traffic through and must maximize operational efficiency. Which solution meets these requirements?

   • ACreate a new AWS WAF web ACL to monitor the HTTP requests and HTTPS requests that are forwarded to the ALB in front of the ECS tasks.
   • BCreate a new AWS WAF Bot Control implementation. Add a rule in the AWS WAF Bot Control managed rule group to monitor traffic and allow only legitimate traffic to the ALB in front of the ECS tasks.
   • CCreate a new AWS WAF web ACL. Add a new rule that blocks requests that match the SQL database rule group. Set the web ACL to allow all other traffic that does not match those rules. Attach the web ACL to the ALB in front of the ECS tasks.
   • DCreate a new AWS WAF web ACL. Create a new empty IP set in AWS WAF. Add a new rule to the web ACL to block requests that originate from IP addresses in the new IP set. Create an AWS Lambda function that scrapes the API logs for IP addresses that send SQL injection attacks, and add those IP addresses to the IP set. Attach the web ACL to the ALB in front of the ECS tasks.

   Show answer

   Answer: C

   Explanation

   C. Yes, because The SQL database rule group contains rules to block request patterns associated with exploitation of SQL databases, like SQL injection attacks. This can help prevent remote injection of unauthorized queries. Evaluate this rule group for use if your application interfaces with an SQL database. https://docs.aws.amazon.com/waf/latest/developerguide/aws-managed-rule-groups-use-case.html A. No, because this does not prevent SQL injection attacks from reaching the ECS API service B. No, because with Bot Control, you can easily monitor, block, or rate limit bots such as scrapers, scanners, crawlers, status monitors, and search engines. https://docs.aws.amazon.com/waf/latest/developerguide/waf-bot-control.html D. No, because because this is a reactive response after a SQL injection attack has occurred for new IP addresses

   Source: Adapted from community discussion — dkx

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 95 · 527 in bank

   An environmental company is deploying sensors in major cities throughout a country to measure air quality. The sensors connect to AWS IoT Core to ingest timeseries data readings. The company stores the data in Amazon DynamoDB. For business continuity, the company must have the ability to ingest and store data in two AWS Regions. Which solution will meet these requirements?

   • ACreate an Amazon Route 53 alias failover routing policy with values for AWS IoT Core data endpoints in both Regions Migrate data to Amazon Aurora global tables.
   • BCreate a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 latency-based routing policy. Use AWS IoT Core data endpoints in both Regions as values. Migrate the data to Amazon MemoryDB for Redis and configure cross-Region replication.
   • CCreate a domain configuration for AWS IoT Core in each Region. Create an Amazon Route 53 health check that evaluates domain configuration health. Create a failover routing policy with values for the domain name from the AWS IoT Core domain configurations. Update the DynamoDB table to a global table.
   • DCreate an Amazon Route 53 latency-based routing policy. Use AWS IoT Core data endpoints in both Regions as values. Configure DynamoDB streams and cross-Region data replication.

   Show answer

   Answer: C

   Explanation

   https://aws.amazon.com/solutions/implementations/disaster-recovery-for-aws-iot/ A, B Wrong. No need to replace DynamoDB with any other DB. DynamoDB Global Table is enough D- Wrong, Not a use-case for Change Data Capture through Streams

   Source: Adapted from community discussion — F_Eldin

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 96 · 527 in bank

   A company uses AWS Organizations for a multi-account setup in the AWS Cloud. The company's finance team has a data processing application that uses AWS Lambda and Amazon DynamoDB. The company's marketing team wants to access the data that is stored in the DynamoDB table. The DynamoDB table contains confidential data. The marketing team can have access to only specific attributes of data in the DynamoDB table. The finance team and the marketing team have separate AWS accounts. What should a solutions architect do to provide the marketing team with the appropriate access to the DynamoDB table?

   • ACreate an SCP to grant the marketing team's AWS account access to the specific attributes of the DynamoDB table. Attach the SCP to the OU of the finance team.
   • BCreate an IAM role in the finance team's account by using IAM policy conditions for specific DynamoDB attributes (fine-grained access control). Establish trust with the marketing team's account. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account.
   • CCreate a resource-based IAM policy that includes conditions for specific DynamoDB attributes (fine-grained access control). Attach the policy to the DynamoDB table. In the marketing team's account, create an IAM role that has permissions to access the DynamoDB table in the finance team's account.
   • DCreate an IAM role in the finance team's account to access the DynamoDB table. Use an IAM permissions boundary to limit the access to the specific attributes. In the marketing team's account, create an IAM role that has permissions to assume the IAM role in the finance team's account.

   Show answer

   Answer: B

   Explanation

   Starting march 24', DynamoDB supports resource based policies : https://aws.amazon.com/about-aws/whats-new/2024/03/amazon-dynamodb-resource-based-policies/ So another way to achieve this would be to create an index for the marketing team, and have the policy restrict their role to that particular index. On the one hand the new index would incur more costs, on the other hand, having only certain attributes fetched would mean less read units consumed...

   Source: Adapted from community discussion — sse69

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 97 · 527 in bank

   Select 3

   A solutions architect is creating an application that stores objects in an Amazon S3 bucket. The solutions architect must deploy the application in two AWS Regions that will be used simultaneously. The objects in the two S3 buckets must remain synchronized with each other. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

   • ACreate an S3 Multi-Region Access Point Change the application to refer to the Multi-Region Access Point
   • BConfigure two-way S3 Cross-Region Replication (CRR) between the two S3 buckets
   • CModify the application to store objects in each S3 bucket
   • DCreate an S3 Lifecycle rule for each S3 bucket to copy objects from one S3 bucket to the other S3 bucket
   • EEnable S3 Versioning for each S3 bucket
   • FConfigure an event notification for each S3 bucket to invoke an AWS Lambda function to copy objects from one S3 bucket to the other S3 bucket

   Show answer

   Answer: ABE

   Explanation

   A - Multi Region Access points are like a proxy. It can dynamically request traffic to the nearest S3 bucket (latency based). [1] B - Two way replication must be enabled to have data in sync. [1] E - Versioning must be enabled for Replication. [3] [1] https://aws.amazon.com/s3/features/multi-region-access-points/ [2] https://aws.amazon.com/about-aws/whats-new/2020/12/amazon-s3-replication-adds-support-two-way-replication/ [3] https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication.html#two-way-replication-scenario:~:text=Both%20source%20and%20destination%20buckets%20must%20have%20versioning%20enabled.%20For%20more%20information%20about%20versioning%2C%20see%20Using%20versioning%20in%20S3%20buckets.

   Source: Adapted from community discussion — chathur

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 98 · 527 in bank

   Select 3

   A company has an IoT platform that runs in an on-premises environment. The platform consists of a server that connects to IoT devices by using the MQTT protocol. The platform collects telemetry data from the devices at least once every 5 minutes. The platform also stores device metadata in a MongoDB cluster. An application that is installed on an on-premises machine runs periodic jobs to aggregate and transform the telemetry and device metadata. The application creates reports that users view by using another web application that runs on the same on-premises machine. The periodic jobs take 120-600 seconds to run. However, the web application is always running. The company is moving the platform to AWS and must reduce the operational overhead of the stack. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

   • AUse AWS Lambda functions to connect to the IoT devices
   • BConfigure the IoT devices to publish to AWS IoT Core
   • CWrite the metadata to a self-managed MongoDB database on an Amazon EC2 instance
   • DWrite the metadata to Amazon DocumentDB (with MongoDB compatibility)
   • EUse AWS Step Functions state machines with AWS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Use Amazon CloudFront with an S3 origin to serve the reports
   • FUse an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Use an ingress controller in the EKS cluster to serve the reports

   Show answer

   Answer: BDE

   Explanation

   Not A - lambda to connect to IoT is no good Not C - ec2 instance to run MongoDB E or F - the job should be short 600 seconds top and serve the reports using Cloud Front - E

   Source: Adapted from community discussion — rbm2023

   References

   • AWS documentation

   Next question

9. Question 99 · 527 in bank

   A global manufacturing company plans to migrate the majority of its applications to AWS. However, the company is concerned about applications that need to remain within a specific country or in the company's central on-premises data center because of data regulatory requirements or requirements for latency of single-digit milliseconds. The company also is concerned about the applications that it hosts in some of its factory sites, where limited network infrastructure exists. The company wants a consistent developer experience so that its developers can build applications once and deploy on premises, in the cloud, or in a hybrid architecture. The developers must be able to use the same tools, APIs, and services that are familiar to them. Which solution will provide a consistent hybrid experience to meet these requirements?

   • AMigrate all applications to the closest AWS Region that is compliant. Set up an AWS Direct Connect connection between the central on-premises data center and AWS. Deploy a Direct Connect gateway.
   • BUse AWS Snowball Edge Storage Optimized devices for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Retain the devices on premises. Deploy AWS Wavelength to host the workloads in the factory sites.
   • CInstall AWS Outposts for the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds. Use AWS Snowball Edge Compute Optimized devices to host the workloads in the factory sites.
   • DMigrate the applications that have data regulatory requirements or requirements for latency of single-digit milliseconds to an AWS Local Zone. Deploy AWS Wavelength to host the workloads in the factory sites.

   Show answer

   Answer: C

   Explanation

   Key comment: "specific country or in the company's central on-premises data center because of data regulatory requirements or requirements for latency of single-digit milliseconds." A - No - Region doesn't assure you have in country presence for data soverignty B - No - Snowball part is correct. However, Wavelength access is only via mobile networks, and not in every country, so this is not possible unless all developers are connecting over the mobile network that will have speed variations D - No - Local Zones can be fast with a DX connection, but this option like Wavelenght is not in every country Correct answer is C. 100% of the time you are on premise providing single-digit milliseconds latency as Outposts (rack or server) and Snowball will be in the country for the requirements

   Source: Adapted from community discussion — geoakes

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 100 · 527 in bank

    Select 2

    A company is updating an application that customers use to make online orders. The number of attacks on the application by bad actors has increased recently. The company will host the updated application on an Amazon Elastic Container Service (Amazon ECS) cluster. The company will use Amazon DynamoDB to store application data. A public Application Load Balancer (ALB) will provide end users with access to the application. The company must prevent attacks and ensure business continuity with minimal service interruptions during an ongoing attack. Which combination of steps will meet these requirements MOST cost-effectively? (Choose two.)

    • ACreate an Amazon CloudFront distribution with the ALB as the origin. Add a custom header and random value on the CloudFront domain. Configure the ALB to conditionally forward traffic if the header and value match.
    • BDeploy the application in two AWS Regions. Configure Amazon Route 53 to route to both Regions with equal weight.
    • CConfigure auto scaling for Amazon ECS tasks Create a DynamoDB Accelerator (DAX) cluster.
    • DConfigure Amazon ElastiCache to reduce overhead on DynamoDB.
    • EDeploy an AWS WAF web ACL that includes an appropriate rule group. Associate the web ACL with the Amazon CloudFront distribution.

    Show answer

    Answer: AE

    Explanation

    From Olabiba.ai: Option A: By adding a custom header and random value on the CloudFront domain and configuring the ALB to conditionally forward traffic if the header and value match, you can implement a form of request validation. This helps to filter out potentially malicious requests and prevent attacks from reaching the application. - Option E: Deploying an AWS WAF web ACL that includes an appropriate rule group and associating it with the Amazon CloudFront distribution adds an additional layer of protection. The web ACL can include rules to block common attack patterns and provide protection against various types of attacks, such as SQL injection and cross-site scripting (XSS).

    Source: Adapted from community discussion — Jackhemo

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 91. 527 questions available.