SAP-C02 practice questions 151–160

1. Question 151 · 527 in bank

   A company wants to use AWS for disaster recovery for an on-premises application. The company has hundreds of Windows-based servers that run the application. All the servers mount a common share. The company has an RTO of 15 minutes and an RPO of 5 minutes. The solution must support native failover and fallback capabilities. Which solution will meet these requirements MOST cost-effectively?

   • ACreate an AWS Storage Gateway File Gateway. Schedule daily Windows server backups. Save the data to Amazon S3. During a disaster, recover the on-premises servers from the backup. During tailback, run the on-premises servers on Amazon EC2 instances.
   • BCreate a set of AWS CloudFormation templates to create infrastructure. Replicate all data to Amazon Elastic File System (Amazon EFS) by using AWS DataSync. During a disaster, use AWS CodePipeline to deploy the templates to restore the on-premises servers. Fail back the data by using DataSync.
   • CCreate an AWS Cloud Development Kit (AWS CDK) pipeline to stand up a multi-site active-active environment on AWS. Replicate data into Amazon S3 by using the s3 sync command. During a disaster, swap DNS endpoints to point to AWS. Fail back the data by using the s3 sync command.
   • DUse AWS Elastic Disaster Recovery to replicate the on-premises servers. Replicate data to an Amazon FSx for Windows File Server file system by using AWS DataSync. Mount the file system to AWS servers. During a disaster, fail over the on-premises servers to AWS. Fail back to new or existing servers by using Elastic Disaster Recovery.

   Show answer

   Answer: D

   Explanation

   Considering RTO and RPO, D is correct answer A is incorrect because, thought backups are in s3, its not possible to recover ec2 within 15-minute RTO and a 5-minute RPO

   Source: Adapted from community discussion — bhanus

   References

   • AWS documentation

   Next question

2. Question 152 · 527 in bank

   Select 3

   A company has built a high performance computing (HPC) cluster in AWS for a tightly coupled workload that generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster size to 1.000 EC2 instances, overall performance was well below expectations. Which collection of design choices should a solutions architect make to achieve the maximum performance from the HPC cluster? (Choose three.)

   • AEnsure the HPC cluster is launched within a single Availability Zone.
   • BLaunch the EC2 instances and attach elastic network interfaces in multiples of four.
   • CSelect EC2 instance types with an Elastic Fabric Adapter (EFA) enabled.
   • DEnsure the cluster is launched across multiple Availability Zones.
   • EReplace Amazon EFS with multiple Amazon EBS volumes in a RAID array.
   • FReplace Amazon EFS with Amazon FSx for Lustre.

   Show answer

   Answer: ACF

   Explanation

   A. Ensure the HPC cluster is launched within a single Availability Zone: This choice ensures that the EC2 instances in the cluster have low network latency and high bandwidth, as they are located within the same data center. C. Select EC2 instance types with an Elastic Fabric Adapter (EFA) enabled: EFA is a network interface that provides low-latency, high-bandwidth communication between EC2 instances. By selecting instance types with EFA enabled, the cluster can benefit from improved inter-instance communication. F. Replace Amazon EFS with Amazon FSx for Lustre: Amazon FSx for Lustre is a high-performance file system optimized for HPC workloads. By using FSx for Lustre instead of Amazon EFS, the cluster can achieve better performance for the large number of shared files generated by the workload. And what about a cluster placement group?

   Source: Adapted from community discussion — aviathor

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 153 · 527 in bank

   A company is designing an AWS Organizations structure. The company wants to standardize a process to apply tags across the entire organization. The company will require tags with specific values when a user creates a new resource. Each of the company's OUs will have unique tag values. Which solution will meet these requirements?

   • AUse an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
   • BUse an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the organization's management account.
   • CUse an SCP to allow the creation of resources only when the resources have the required tags. Create a tag policy that includes the tag values that the company has assigned to each OU. Attach the tag policies to the OUs.
   • DUse an SCP to deny the creation of resources that do not have the required tags. Define the list of tags. Attach the SCP to the OUs.

   Show answer

   Answer: A

   Explanation

   The most suitable solution for applying standardized tags across the organization with specific values for each OU is A. Use an SCP to deny the creation of resources that do not have the required tags. Create a tag policy that includes the tag values for each OU. Attach the tag policies to the OUs. Here's why: Enforce tag standardization: An SCP applied to the entire organization denies resource creation unless the required tags are present, ensuring consistent tagging across all accounts. OU-specific tags: Tag policies attached to each OU define the specific tag values for that OU, allowing customization without compromising overall standardization. Granular control: Attaching tag policies to OUs instead of the management account provides more granular control and flexibility for managing tags within each OU.

   Source: Adapted from community discussion — duriselvan

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

4. Question 154 · 527 in bank

   A company has more than 10,000 sensors that send data to an on-premises Apache Kafka server by using the Message Queuing Telemetry Transport (MQTT) protocol. The on-premises Kafka server transforms the data and then stores the results as objects in an Amazon S3 bucket. Recently, the Kafka server crashed. The company lost sensor data while the server was being restored. A solutions architect must create a new design on AWS that is highly available and scalable to prevent a similar occurrence. Which solution will meet these requirements?

   • ALaunch two Amazon EC2 instances to host the Kafka server in an active/standby configuration across two Availability Zones. Create a domain name in Amazon Route 53. Create a Route 53 failover policy. Route the sensors to send the data to the domain name.
   • BMigrate the on-premises Kafka server to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create a Network Load Balancer (NLB) that points to the Amazon MSK broker. Enable NLB health checks. Route the sensors to send the data to the NLB.
   • CDeploy AWS IoT Core, and connect it to an Amazon Kinesis Data Firehose delivery stream. Use an AWS Lambda function to handle data transformation. Route the sensors to send the data to AWS IoT Core.
   • DDeploy AWS IoT Core, and launch an Amazon EC2 instance to host the Kafka server. Configure AWS IoT Core to send the data to the EC2 instance. Route the sensors to send the data to AWS IoT Core.

   Show answer

   Answer: C

   Explanation

   Answer: C To me C is still the best option as it is not wrong and there is an uncertainty regarding NLB support for MQTT protocol. You can, yes, however, not out of the box, you would need solutions like HiveMQ, for example: https://github.com/mqtt/mqtt.org/wiki/Server%20support Now, when I read this part of the question "Recently, the Kafka server crashed. The company lost sensor data while the server was being restored", to me it seems that it would be OK for the company to look for different ways in having their data stored in S3, be it using a Kafka server or not. Therefore and, just because the question doesn't say anything regarding cost effectiveness, least operational overhead, least dev overhead and so on, it's safe to assume (to me) that IoT Core would be the option AWS wants us to think about.

   Source: Adapted from community discussion — chico2023

   References

   • AWS documentation
   • AWS documentation

   Next question

5. Question 155 · 527 in bank

   Select 3

   A company recently started hosting new application workloads in the AWS Cloud. The company is using Amazon EC2 instances. Amazon Elastic File System (Amazon EFS) file systems, and Amazon RDS DB instances. To meet regulatory and business requirements, the company must make the following changes for data backups: • Backups must be retained based on custom daily, weekly, and monthly requirements. • Backups must be replicated to at least one other AWS Region immediately after capture. • The backup solution must provide a single source of backup status across the AWS environment. • The backup solution must send immediate notifications upon failure of any resource backup. Which combination of steps will meet these requirements with the LEAST amount of operational overhead? (Choose three.)

   • ACreate an AWS Backup plan with a backup rule for each of the retention requirements.
   • BConfigure an AWS Backup plan to copy backups to another Region.
   • CCreate an AWS Lambda function to replicate backups to another Region and send notification if a failure occurs.
   • DAdd an Amazon Simple Notification Service (Amazon SNS) topic to the backup plan to send a notification for finished jobs that have any status except BACKUP_JOB_COMPLETED.
   • ECreate an Amazon Data Lifecycle Manager (Amazon DLM) snapshot lifecycle policy for each of the retention requirements.
   • FSet up RDS snapshots on each database.

   Show answer

   Answer: ABD

   Explanation

   ABD E is incorrect because Amazon Data Lifecycle Manager to used to automate the creation, retention, and deletion of EBS snapshots and EBS-backed AMIs. It CANNOT be used for backups for ec2, EFS, RDS https://docs.aws.amazon.com/AWSEC2/latest/WindowsGuide/snapshot-lifecycle.html

   Source: Adapted from community discussion — bhanus

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 156 · 527 in bank

   A company is developing a gene reporting device that will collect genomic information to assist researchers with collecting large samples of data from a diverse population. The device will push 8 KB of genomic data every second to a data platform that will need to process and analyze the data and provide information back to researchers. The data platform must meet the following requirements: • Provide near-real-time analytics of the inbound genomic data • Ensure the data is flexible, parallel, and durable • Deliver results of processing to a data warehouse Which strategy should a solutions architect use to meet these requirements?

   • AUse Amazon Kinesis Data Firehose to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon RDS instance.
   • BUse Amazon Kinesis Data Streams to collect the inbound sensor data, analyze the data with Kinesis clients, and save the results to an Amazon Redshift cluster using Amazon EMR.
   • CUse Amazon S3 to collect the inbound device data, analyze the data from Amazon SQS with Kinesis, and save the results to an Amazon Redshift cluster.
   • DUse an Amazon API Gateway to put requests into an Amazon SQS queue, analyze the data with an AWS Lambda function, and save the results to an Amazon Redshift cluster using Amazon EMR.

   Show answer

   Answer: B

   Explanation

   Answer B. Option A might be close enough, near-real time, which is Firehose, but the target is RDS but the ask is for Datawarehouse (Redshift)

   Source: Adapted from community discussion — shaaam80

   Next question

7. Question 157 · 527 in bank

   A company is developing a new service that will be accessed using TCP on a static port. A solutions architect must ensure that the service is highly available, has redundancy across Availability Zones, and is accessible using the DNS name my.service.com, which is publicly accessible. The service must use fixed address assignments so other companies can add the addresses to their allow lists. Assuming that resources are deployed in multiple Availability Zones in a single Region, which solution will meet these requirements?

   • ACreate Amazon EC2 instances with an Elastic IP address for each instance. Create a Network Load Balancer (NLB) and expose the static TCP port. Register EC2 instances with the NLB. Create a new name server record set named my.service.com, and assign the Elastic IP addresses of the EC2 instances to the record set. Provide the Elastic IP addresses of the EC2 instances to the other companies to add to their allow lists.
   • BCreate an Amazon ECS cluster and a service definition for the application. Create and assign public IP addresses for the ECS cluster. Create a Network Load Balancer (NLB) and expose the TCP port. Create a target group and assign the ECS cluster name to the NLCreate a new A record set named my.service.com, and assign the public IP addresses of the ECS cluster to the record set. Provide the public IP addresses of the ECS cluster to the other companies to add to their allow lists.
   • CCreate Amazon EC2 instances for the service. Create one Elastic IP address for each Availability Zone. Create a Network Load Balancer (NLB) and expose the assigned TCP port. Assign the Elastic IP addresses to the NLB for each Availability Zone. Create a target group and register the EC2 instances with the NLB. Create a new A (alias) record set named my.service.com, and assign the NLB DNS name to the record set.
   • DCreate an Amazon ECS cluster and a service definition for the application. Create and assign public IP address for each host in the cluster. Create an Application Load Balancer (ALB) and expose the static TCP port. Create a target group and assign the ECS service definition name to the ALB. Create a new CNAME record set and associate the public IP addresses to the record set. Provide the Elastic IP addresses of the Amazon EC2 instances to the other companies to add to their allow lists.

   Show answer

   Answer: C

   Explanation

   Logical answer : Non http port like TCP should hint to NLB immediately.(ALB does not fit here) Sharing IP address of EC2 is not apt whether it is from individual EC2 instances or those from ECS cluster.this eliminates A,B.D, infact the NLB's address which stays in front of / associates to ec2 instances need to be shared. So, only solution is C

   Source: Adapted from community discussion — God_Is_Love

   References

   • AWS documentation
   • repost.aws documentation

   Next question

8. Question 158 · 527 in bank

   Select 3

   A solutions architect needs to define a reference architecture for a solution for three-tier applications with web. application, and NoSQL data layers. The reference architecture must meet the following requirements: • High availability within an AWS Region • Able to fail over in 1 minute to another AWS Region for disaster recovery • Provide the most efficient solution while minimizing the impact on the user experience Which combination of steps will meet these requirements? (Choose three.)

   • AUse an Amazon Route 53 weighted routing policy set to 100/0 across the two selected Regions. Set Time to Live (TTL) to 1 hour.
   • BUse an Amazon Route 53 failover routing policy for failover from the primary Region to the disaster recovery Region. Set Time to Live (TTL) to 30 seconds.
   • CUse a global table within Amazon DynamoDB so data can be accessed in the two selected Regions.
   • DBack up data from an Amazon DynamoDB table in the primary Region every 60 minutes and then write the data to Amazon S3. Use S3 cross-Region replication to copy the data from the primary Region to the disaster recovery Region. Have a script import the data into DynamoDB in a disaster recovery scenario.
   • EImplement a hot standby model using Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use zonal Reserved Instances for the minimum number of servers and On-Demand Instances for any additional resources.
   • FUse Auto Scaling groups for the web and application layers across multiple Availability Zones in the Regions. Use Spot Instances for the required resources.

   Show answer

   Answer: BCE

   Explanation

   not sure how these answers are generated, poor quality! Correct answer - BCE Hot standby, DynamoDB Global tables, Route53 failover routing policy.

   Source: Adapted from community discussion — shaaam80

   Next question

9. Question 159 · 527 in bank

   A company manufactures smart vehicles. The company uses a custom application to collect vehicle data. The vehicles use the MQTT protocol to connect to the application. The company processes the data in 5-minute intervals. The company then copies vehicle telematics data to on-premises storage. Custom applications analyze this data to detect anomalies. The number of vehicles that send data grows constantly. Newer vehicles generate high volumes of data. The on-premises storage solution is not able to scale for peak traffic, which results in data loss. The company must modernize the solution and migrate the solution to AWS to resolve the scaling challenges. Which solution will meet these requirements with the LEAST operational overhead?

   • AUse AWS IoT Greengrass to send the vehicle data to Amazon Managed Streaming for Apache Kafka (Amazon MSK). Create an Apache Kafka application to store the data in Amazon S3. Use a pretrained model in Amazon SageMaker to detect anomalies.
   • BUse AWS IoT Core to receive the vehicle data. Configure rules to route data to an Amazon Kinesis Data Firehose delivery stream that stores the data in Amazon S3. Create an Amazon Kinesis Data Analytics application that reads from the delivery stream to detect anomalies.
   • CUse AWS IoT FleetWise to collect the vehicle data. Send the data to an Amazon Kinesis data stream. Use an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use the built-in machine learning transforms in AWS Glue to detect anomalies.
   • DUse Amazon MQ for RabbitMQ to collect the vehicle data. Send the data to an Amazon Kinesis Data Firehose delivery stream to store the data in Amazon S3. Use Amazon Lookout for Metrics to detect anomalies.

   Show answer

   Answer: B

   Explanation

   A - too complex B - It's B. You se IoT Code, Kinesis Firehose and Kinesis Data Analytics for anomalies https://docs.aws.amazon.com/kinesisanalytics/latest/dev/app-anomaly-detection.html C - IoT FleetWise is a perfect use case but this solution does not detect anomalies. You need Lookout for this as described here. https://docs.aws.amazon.com/kinesisanalytics/latest/dev/app-anomaly-detection.html D - This is also possible, but the use case for RabbitMQ is different.

   Source: Adapted from community discussion — SmileyCloud

   References

   • AWS documentation
   • AWS documentation

   Next question

10. Question 160 · 527 in bank

    During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository. The security team wants to automatically find and remediate instances of this security vulnerability. Which solution will ensure that the credentials are appropriately secured automatically?

    • ARun a script nightly using AWS Systems Manager Run Command to search for credentials on the development instances. If found, use AWS Secrets Manager to rotate the credentials
    • BUse a scheduled AWS Lambda function to download and scan the application code from CodeCommit. If credentials are found, generate new credentials and store them in AWS KMS.
    • CConfigure Amazon Macie to scan for credentials in CodeCommit repositories. If credentials are found, trigger an AWS Lambda function to disable the credentials and notify the user.
    • DConfigure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for credentials. If credentials are found, disable them in AWS IAM and notify the user.

    Show answer

    Answer: D

    Explanation

    A - AWS Secrets Manager can't rotate the credentials if they are part of the code B - You don't store creds in KMS, that's the job of Secrets Manager C - Macie can do S3 only. CodeCommit backend is also S3 but it's transparent for us, so you can't use Macie. D - Correct. See this use case https://aws.amazon.com/blogs/compute/discovering-sensitive-data-in-aws-codecommit-with-aws-lambda-2/

    Source: Adapted from community discussion — SmileyCloud

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 151. 527 questions available.