SAP-C02 practice questions 191–200

1. Question 191 · 527 in bank

   A company is expanding. The company plans to separate its resources into hundreds of different AWS accounts in multiple AWS Regions. A solutions architect must recommend a solution that denies access to any operations outside of specifically designated Regions. Which solution will meet these requirements?

   • ACreate IAM roles for each account. Create IAM policies with conditional allow permissions that include only approved Regions for the accounts.
   • BCreate an organization in AWS Organizations. Create IAM users for each account. Attach a policy to each user to block access to Regions where an account cannot deploy infrastructure.
   • CLaunch an AWS Control Tower landing zone. Create OUs and attach SCPs that deny access to run services outside of the approved Regions.
   • DEnable AWS Security Hub in each account. Create controls to specify the Regions where an account can deploy infrastructure.

   Show answer

   Answer: C

   Explanation

   For this type of question (organization and policy for many accounts), we avoid options that require actions on each account/user. There's always better option to set policies at one place.

   Source: Adapted from community discussion — joleneinthebackyard

   Next question

2. Question 192 · 527 in bank

   A company wants to refactor its retail ordering web application that currently has a load-balanced Amazon EC2 instance fleet for web hosting, database API services, and business logic. The company needs to create a decoupled, scalable architecture with a mechanism for retaining failed orders while also minimizing operational costs. Which solution will meet these requirements?

   • AUse Amazon S3 for web hosting with Amazon API Gateway for database API services. Use Amazon Simple Queue Service (Amazon SQS) for order queuing. Use Amazon Elastic Container Service (Amazon ECS) for business logic with Amazon SQS long polling for retaining failed orders.
   • BUse AWS Elastic Beanstalk for web hosting with Amazon API Gateway for database API services. Use Amazon MQ for order queuing. Use AWS Step Functions for business logic with Amazon S3 Glacier Deep Archive for retaining failed orders.
   • CUse Amazon S3 for web hosting with AWS AppSync for database API services. Use Amazon Simple Queue Service (Amazon SQS) for order queuing. Use AWS Lambda for business logic with an Amazon SQS dead-letter queue for retaining failed orders.
   • DUse Amazon Lightsail for web hosting with AWS AppSync for database API services. Use Amazon Simple Email Service (Amazon SES) for order queuing. Use Amazon Elastic Kubernetes Service (Amazon EKS) for business logic with Amazon OpenSearch Service for retaining failed orders.

   Show answer

   Answer: C

   Explanation

   Option C combines Amazon S3 for web hosting, AWS AppSync for database API services, and AWS Lambda for business logic. This combination provides a decoupled and scalable architecture. Using Amazon SQS for order queuing ensures reliable message delivery, and utilizing an SQS dead-letter queue allows for retaining failed orders. This solution meets the requirements of the scenario while minimizing operational costs

   Source: Adapted from community discussion — Alabi

   Next question

3. Question 193 · 527 in bank

   A company hosts a web application on AWS in the us-east-1 Region. The application servers are distributed across three Availability Zones behind an Application Load Balancer. The database is hosted in a MySQL database on an Amazon EC2 instance. A solutions architect needs to design a cross-Region data recovery solution using AWS services with an RTO of less than 5 minutes and an RPO of less than 1 minute. The solutions architect is deploying application servers in us-west-2, and has configured Amazon Route 53 health checks and DNS failover to us-west-2. Which additional step should the solutions architect take?

   • AMigrate the database to an Amazon RDS for MySQL instance with a cross-Region read replica in us-west-2.
   • BMigrate the database to an Amazon Aurora global database with the primary in us-east-1 and the secondary in us-west-2.
   • CMigrate the database to an Amazon RDS for MySQL instance with a Multi-AZ deployment.
   • DCreate a MySQL standby database on an Amazon EC2 instance in us-west-2.

   Show answer

   Answer: B

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 194 · 527 in bank

   A company is using AWS Organizations to manage multiple accounts. Due to regulatory requirements, the company wants to restrict specific member accounts to certain AWS Regions, where they are permitted to deploy resources. The resources in the accounts must be tagged, enforced based on a group standard, and centrally managed with minimal configuration. What should a solutions architect do to meet these requirements?

   • ACreate an AWS Config rule in the specific member accounts to limit Regions and apply a tag policy.
   • BFrom the AWS Billing and Cost Management console, in the management account, disable Regions for the specific member accounts and apply a tag policy on the root.
   • CAssociate the specific member accounts with the root. Apply a tag policy and an SCP using conditions to limit Regions.
   • DAssociate the specific member accounts with a new OU. Apply a tag policy and an SCP using conditions to limit Regions.

   Show answer

   Answer: D

   Explanation

   D will only apply to the specific account in the new OU while C will apply SCP to the whole accounts with the organization

   Source: Adapted from community discussion — Don2021

   Next question

5. Question 195 · 527 in bank

   A company has an application that generates reports and stores them in an Amazon S3 bucket. When a user accesses their report, the application generates a signed URL to allow the user to download the report. The company's security team has discovered that the files are public and that anyone can download them without authentication. The company has suspended the generation of new reports until the problem is resolved. Which set of actions will immediately remediate the security issue without impacting the application's normal workflow?

   • ACreate an AWS Lambda function that applies a deny all policy for users who are not authenticated. Create a scheduled event to invoke the Lambda function.
   • BReview the AWS Trusted Advisor bucket permissions check and implement the recommended actions.
   • CRun a script that puts a private ACL on all of the objects in the bucket.
   • DUse the Block Public Access feature in Amazon S3 to set the IgnorePublicAcIs option to TRUE on the bucket.

   Show answer

   Answer: D

   Explanation

   D. IgnorePulicAcls : Setting this option to TRUE causes Amazon S3 to ignore all public ACLs on a bucket and any objects that it contains. This setting enables you to safely block public access granted by ACLs while still allowing PUT Object calls that include a public ACL (as opposed to BlockPublicAcls, which rejects PUT Object calls that include a public ACL). Enabling this setting doesn't affect the persistence of any existing ACLs and doesn't prevent new public ACLs from being set. https://docs.aws.amazon.com/AmazonS3/latest/userguide/access-control-block-public-access.html

   Source: Adapted from community discussion — rlf

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 196 · 527 in bank

   Select 3

   A company is planning to migrate an Amazon RDS for Oracle database to an RDS for PostgreSQL DB instance in another AWS account. A solutions architect needs to design a migration strategy that will require no downtime and that will minimize the amount of time necessary to complete the migration. The migration strategy must replicate all existing data and any new data that is created during the migration. The target database must be identical to the source database at completion of the migration process. All applications currently use an Amazon Route 53 CNAME record as their endpoint for communication with the RDS for Oracle DB instance. The RDS for Oracle DB instance is in a private subnet. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

   • ACreate a new RDS for PostgreSQL DB instance in the target account. Use the AWS Schema Conversion Tool (AWS SCT) to migrate the database schema from the source database to the target database.
   • BUse the AWS Schema Conversion Tool (AWS SCT) to create a new RDS for PostgreSQL DB instance in the target account with the schema and initial data from the source database.
   • CConfigure VPC peering between the VPCs in the two AWS accounts to provide connectivity to both DB instances from the target account. Configure the security groups that are attached to each DB instance to allow traffic on the database port from the VPC in the target account.
   • DTemporarily allow the source DB instance to be publicly accessible to provide connectivity from the VPC in the target account. Configure the security groups that are attached to each DB instance to allow traffic on the database port from the VPC in the target account.
   • EUse AWS Database Migration Service (AWS DMS) in the target account to perform a full load plus change data capture (CDC) migration from the source database to the target database. When the migration is complete, change the CNAME record to point to the target DB instance endpoint.
   • FUse AWS Database Migration Service (AWS DMS) in the target account to perform a change data capture (CDC) migration from the source database to the target database. When the migration is complete, change the CNAME record to point to the target DB instance endpoint.

   Show answer

   Answer: ACE

   Explanation

   ace - correct b - AWS SCT can't create RDS d - never make anything publicly accessible even if temporary f - you need initial data, not just changes

   Source: Adapted from community discussion — SmileyCloud

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 197 · 527 in bank

   A company has implemented an ordering system using an event-driven architecture. During initial testing, the system stopped processing orders. Further log analysis revealed that one order message in an Amazon Simple Queue Service (Amazon SQS) standard queue was causing an error on the backend and blocking all subsequent order messages. The visibility timeout of the queue is set to 30 seconds, and the backend processing timeout is set to 10 seconds. A solutions architect needs to analyze faulty order messages and ensure that the system continues to process subsequent messages. Which step should the solutions architect take to meet these requirements?

   • AIncrease the backend processing timeout to 30 seconds to match the visibility timeout.
   • BReduce the visibility timeout of the queue to automatically remove the faulty message.
   • CConfigure a new SQS FIFO queue as a dead-letter queue to isolate the faulty messages.
   • DConfigure a new SQS standard queue as a dead-letter queue to isolate the faulty messages.

   Show answer

   Answer: D

   Explanation

   It's D - can't be C because the queue is standard queue. "The dead-letter queue of a FIFO queue must also be a FIFO queue. Similarly, the dead-letter queue of a standard queue must also be a standard queue." https://docs.aws.amazon.com/AWSSimpleQueueService/latest/SQSDeveloperGuide/sqs-dead-letter-queues.html

   Source: Adapted from community discussion — SkyZeroZx

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 198 · 527 in bank

   Select 3

   A company has automated the nightly retraining of its machine learning models by using AWS Step Functions. The workflow consists of multiple steps that use AWS Lambda. Each step can fail for various reasons, and any failure causes a failure of the overall workflow. A review reveals that the retraining has failed multiple nights in a row without the company noticing the failure. A solutions architect needs to improve the workflow so that notifications are sent for all types of failures in the retraining process. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

   • ACreate an Amazon Simple Notification Service (Amazon SNS) topic with a subscription of type "Email" that targets the team's mailing list.
   • BCreate a task named "Email" that forwards the input arguments to the SNS topic.
   • CAdd a Catch field to all Task, Map, and Parallel states that have a statement of "ErrorEquals": [ "States.ALL" ] and "Next”: "Email".
   • DAdd a new email address to Amazon Simple Email Service (Amazon SES). Verify the email address.
   • ECreate a task named "Email" that forwards the input arguments to the SES email address.
   • FAdd a Catch field to all Task, Map, and Parallel states that have a statement of "ErrorEquals": [ "States.Runtime" ] and "Next": "Email".

   Show answer

   Answer: ABC

   Explanation

   "notifications are sent for all types of failures in the retraining process" - that means States.ALL. The rest is common sense. https://docs.aws.amazon.com/step-functions/latest/dg/concepts-error-handling.html

   Source: Adapted from community discussion — Maria2023

   References

   • AWS documentation

   Next question

9. Question 199 · 527 in bank

   A company plans to deploy a new private intranet service on Amazon EC2 instances inside a VPC. An AWS Site-to-Site VPN connects the VPC to the company's on-premises network. The new service must communicate with existing on-premises services. The on-premises services are accessible through the use of hostnames that reside in the company.example DNS zone. This DNS zone is wholly hosted on premises and is available only on the company's private network. A solutions architect must ensure that the new service can resolve hostnames on the company.example domain to integrate with existing services. Which solution meets these requirements?

   • ACreate an empty private zone in Amazon Route 53 for company.example. Add an additional NS record to the company's on-premises company.example zone that points to the authoritative name servers for the new private zone in Route 53.
   • BTurn on DNS hostnames for the VPC. Configure a new outbound endpoint with Amazon Route 53 Resolver. Create a Resolver rule to forward requests for company.example to the on-premises name servers.
   • CTurn on DNS hostnames for the VPConfigure a new inbound resolver endpoint with Amazon Route 53 Resolver. Configur&the on-premises DNS server to forward requests for company.example to the new resolver.
   • DUse AWS Systems Manager to configure a run document that will install a hosts file that contains any required hostnames. Use an Amazon EventBridge rule to run the document when an instance is entering the running state.

   Show answer

   Answer: B

   Explanation

   Outbound resolver endpoints will let you query your onprem DNS Inbound resolver endpoints will let your onprem DNS server to query the AWS VPC DNS server

   Source: Adapted from community discussion — bhanus

   Next question

10. Question 200 · 527 in bank

    A company uses AWS CloudFormation to deploy applications within multiple VPCs that are all attached to a transit gateway. Each VPC that sends traffic to the public internet must send the traffic through a shared services VPC. Each subnet within a VPC uses the default VPC route table, and the traffic is routed to the transit gateway. The transit gateway uses its default route table for any VPC attachment. A security audit reveals that an Amazon EC2 instance that is deployed within a VPC can communicate with an EC2 instance that is deployed in any of the company's other VPCs. A solutions architect needs to limit the traffic between the VPCs. Each VPC must be able to communicate only with a predefined, limited set of authorized VPCs. What should the solutions architect do to meet these requirements?

    • AUpdate the network ACL of each subnet within a VPC to allow outbound traffic only to the authorized VPCs. Remove all deny rules except the default deny rule.
    • BUpdate all the security groups that are used within a VPC to deny outbound traffic to security groups that are used within the unauthorized VPCs.
    • CCreate a dedicated transit gateway route table for each VPC attachment. Route traffic only to the authorized VPCs.
    • DUpdate the main route table of each VPC to route traffic only to the authorized VPCs through the transit gateway.

    Show answer

    Answer: C

    Explanation

    C is correct. Option C suggests creating a dedicated transit gateway route table for each VPC attachment. This allows fine-grained control over the routing of traffic between VPCs. By creating separate route tables, the architect can specify the allowed routes for each VPC attachment and limit traffic to only the authorized VPCs. This approach ensures that communication between VPCs is restricted and provides a secure and controlled network environment.

    Source: Adapted from community discussion — gd1

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 191. 527 questions available.