SAP-C02 practice questions 261–270

1. Question 261 · 527 in bank

   A company hosts a community forum site using an Application Load Balancer (ALB) and a Docker application hosted in an Amazon ECS cluster. The site data is stored in Amazon RDS for MySQL and the container image is stored in ECR. The company needs to provide their customers with a disaster recovery SLA with an RTO of no more than 24 hours and RPO of no more than 8 hours. Which of the following solutions is the MOST cost-effective way to meet the requirements?

   • AUse AWS CloudFormation to deploy identical ALB, EC2, ECS and RDS resources in two regions. Schedule RDS snapshots every 8 hours. Use RDS multi-region replication to update the secondary region's copy of the database. In the event of a failure, restore from the latest snapshot, and use an Amazon Route 53 DNS failover policy to automatically redirect customers to the ALB in the secondary region.
   • BStore the Docker image in ECR in two regions. Schedule RDS snapshots every 8 hours with snapshots copied to the secondary region. In the event of a failure, use AWS CloudFormation to deploy the ALB, EC2, ECS and RDS resources in the secondary region, restore from the latest snapshot, and update the DNS record to point to the ALB in the secondary region.
   • CUse AWS CloudFormation to deploy identical ALB, EC2, ECS, and RDS resources in a secondary region. Schedule hourly RDS MySQL backups to Amazon S3 and use cross-region replication to replicate data to a bucket in the secondary region. In the event of a failure, import the latest Docker image to Amazon ECR in the secondary region, deploy to the EC2 instance, restore the latest MySQL backup, and update the DNS record to point to the ALB in the secondary region.
   • DDeploy a pilot light environment in a secondary region with an ALB and a minimal resource EC2 deployment for Docker in an AWS Auto Scaling group with a scaling policy to increase instance size and number of nodes. Create a cross-region read replica of the RDS data. In the event of a failure, promote the replica to primary, and update the DNS record to point to the ALB in the secondary region.

   Show answer

   Answer: B

   Explanation

   With an RTO of 24 hours, using the 'Cold' DR solution option B is the cheapest. Option D is a partial on DR solution which I would think would be more expensive in the long run then the 2nd ECR container in another region.

   Source: Adapted from community discussion — enk

   Next question

2. Question 262 · 527 in bank

   A company is migrating its infrastructure to the AWS Cloud. The company must comply with a variety of regulatory standards for different projects. The company needs a multi-account environment. A solutions architect needs to prepare the baseline infrastructure. The solution must provide a consistent baseline of management and security, but it must allow flexibility for different compliance requirements within various AWS accounts. The solution also needs to integrate with the existing on-premises Active Directory Federation Services (AD FS) server. Which solution meets these requirements with the LEAST amount of operational overhead?

   • ACreate an organization in AWS Organizations. Create a single SCP for least privilege access across all accounts. Create a single OU for all accounts. Configure an IAM identity provider for federation with the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with conformance packs for all accounts.
   • BCreate an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Add OUs as necessary. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server.
   • CCreate an organization in AWS Organizations. Create SCPs for least privilege access. Create an OU structure, and use it to group AWS accounts. Connect AWS IAM Identity Center (AWS Single Sign-On) to the on-premises AD FS server. Configure a central logging account with a defined process for log generating services to send log events to the central account. Enable AWS Config in the central account with aggregators and conformance packs.
   • DCreate an organization in AWS Organizations. Enable AWS Control Tower on the organization. Review included controls (guardrails) for SCPs. Check AWS Config for areas that require additions. Configure an IAM identity provider for federation with the on-premises AD FS server.

   Show answer

   Answer: B

   Explanation

   B. because: (1) “Least amount of operational overhead”requirement is met with Control Tower. Control Tower automates the creation of a well-architected, multi-account environment using best-practice blueprints, and (2) IAM Identity Center is the recommended approach for workforce authentication and authorization

   Source: Adapted from community discussion — dankositzke

   Next question

3. Question 263 · 527 in bank

   Select 2

   An online magazine will launch its latest edition this month. This edition will be the first to be distributed globally. The magazine's dynamic website currently uses an Application Load Balancer in front of the web tier, a fleet of Amazon EC2 instances for web and application servers, and Amazon Aurora MySQL. Portions of the website include static content and almost all traffic is read-only. The magazine is expecting a significant spike in internet traffic when the new edition is launched. Optimal performance is a top priority for the week following the launch. Which combination of steps should a solutions architect take to reduce system response times for a global audience? (Choose two.)

   • AUse logical cross-Region replication to replicate the Aurora MySQL database to a secondary Region. Replace the web servers with Amazon S3. Deploy S3 buckets in cross-Region replication mode.
   • BEnsure the web and application tiers are each in Auto Scaling groups. Introduce an AWS Direct Connect connection. Deploy the web and application tiers in Regions across the world.
   • CMigrate the database from Amazon Aurora to Amazon RDS for MySQL. Ensure all three of the application tiers – web, application, and database – are in private subnets.
   • DUse an Aurora global database for physical cross-Region replication. Use Amazon S3 with cross-Region replication for static content and resources. Deploy the web and application tiers in Regions across the world.
   • EIntroduce Amazon Route 53 with latency-based routing and Amazon CloudFront distributions. Ensure the web and application tiers are each in Auto Scaling groups.

   Show answer

   Answer: DE

   Next question

4. Question 264 · 527 in bank

   An online gaming company needs to optimize the cost of its workloads on AWS. The company uses a dedicated account to host the production environment for its online gaming application and an analytics application. Amazon EC2 instances host the gaming application and must always be available. The EC2 instances run all year. The analytics application uses data that is stored in Amazon S3. The analytics application can be interrupted and resumed without issue. Which solution will meet these requirements MOST cost-effectively?

   • APurchase an EC2 Instance Savings Plan for the online gaming application instances. Use On-Demand Instances for the analytics application.
   • BPurchase an EC2 Instance Savings Plan for the online gaming application instances. Use Spot Instances for the analytics application.
   • CUse Spot Instances for the online gaming application and the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.
   • DUse On-Demand Instances for the online gaming application. Use Spot Instances for the analytics application. Set up a catalog in AWS Service Catalog to provision services at a discount.

   Show answer

   Answer: B

   Next question

5. Question 265 · 527 in bank

   Select 3

   A company runs applications in hundreds of production AWS accounts. The company uses AWS Organizations with all features enabled and has a centralized backup operation that uses AWS Backup. The company is concerned about ransomware attacks. To address this concern, the company has created a new policy that all backups must be resilient to breaches of privileged-user credentials in any production account. Which combination of steps will meet this new requirement? (Choose three.)

   • AImplement cross-account backup with AWS Backup vaults in designated non-production accounts.
   • BAdd an SCP that restricts the modification of AWS Backup vaults.
   • CImplement AWS Backup Vault Lock in compliance mode. C. Implement least privilege access for the IAM service role that is assigned to AWS Backup.
   • DConfigure the backup frequency, lifecycle, and retention period to ensure that at least one backup always exists in the cold tier.
   • EConfigure AWS Backup to write all backups to an Amazon S3 bucket in a designated non-production account. Ensure that the S3 bucket has S3 Object Lock enabled.

   Show answer

   Answer: ABC

   Explanation

   The solution is A, B and C1. We need to create a Cross Account Backup -> Put it in a Backup Account -> Control modification to the backup account with SCP. A. Implement cross-account backup with AWS Backup vaults in designated non-production accounts. https://docs.aws.amazon.com/aws-backup/latest/devguide/manage-cross-account.html B. Add an SCP that restricts the modification of AWS Backup vaults. https://aws.amazon.com/blogs/storage/managing-access-to-backups-using-service-control-policies-with-aws-backup/ C1. Implement AWS Backup Vault Lock in compliance mode. https://docs.aws.amazon.com/aws-backup/latest/devguide/vault-lock.html

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

6. Question 266 · 527 in bank

   Select 3

   A company needs to aggregate Amazon CloudWatch logs from its AWS accounts into one central logging account. The collected logs must remain in the AWS Region of creation. The central logging account will then process the logs, normalize the logs into standard output format, and stream the output logs to a security tool for more processing. A solutions architect must design a solution that can handle a large volume of logging data that needs to be ingested. Less logging will occur outside normal business hours than during normal business hours. The logging solution must scale with the anticipated load. The solutions architect has decided to use an AWS Control Tower design to handle the multi-account logging process. Which combination of steps should the solutions architect take to meet the requirements? (Choose three.)

   • ACreate a destination Amazon Kinesis data stream in the central logging account.
   • BCreate a destination Amazon Simple Queue Service (Amazon SQS) queue in the central logging account.
   • CCreate an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Kinesis data stream. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a subscription filter for each log group to send data to the Kinesis data stream.
   • DCreate an IAM role that grants Amazon CloudWatch Logs the permission to add data to the Amazon Simple Queue Service (Amazon SQS) queue. Create a trust policy. Specify the trust policy in the IAM role. In each member account, create a single subscription filter for all log groups to send data to the SQS queue.
   • ECreate an AWS Lambda function. Program the Lambda function to normalize the logs in the central logging account and to write the logs to the security tool.
   • FCreate an AWS Lambda function. Program the Lambda function to normalize the logs in the member accounts and to write the logs to the security tool.

   Show answer

   Answer: ACE

   Explanation

   A vs B: Kinesis data stream is a possible destination of CloudWatch Logs subscriptions, SQS isn't --> A C vs. D: As we had to choose Kinesis only C makes sense. E vs. F: Difference is that E runs the Lambda function in the central logging account while F runs the Lambda function in the member accounts. So clearly E, as we have streamed the logs to the central accounts Kinesis, which easily can use Lambda for the final processing etc.

   Source: Adapted from community discussion — carpa_jo

   Next question

7. Question 267 · 527 in bank

   Select 2

   A company is migrating a legacy application from an on-premises data center to AWS. The application consists of a single application server and a Microsoft SQL Server database server. Each server is deployed on a VMware VM that consumes 500 TB of data across multiple attached volumes. The company has established a 10 Gbps AWS Direct Connect connection from the closest AWS Region to its on-premises data center. The Direct Connect connection is not currently in use by other services. Which combination of steps should a solutions architect take to migrate the application with the LEAST amount of downtime? (Choose two.)

   • AUse an AWS Server Migration Service (AWS SMS) replication job to migrate the database server VM to AWS.
   • BUse VM Import/Export to import the application server VM.
   • CExport the VM images to an AWS Snowball Edge Storage Optimized device.
   • DUse an AWS Server Migration Service (AWS SMS) replication job to migrate the application server VM to AWS.
   • EUse an AWS Database Migration Service (AWS DMS) replication instance to migrate the database to an Amazon RDS DB instance.

   Show answer

   Answer: DE

   Explanation

   3 limit here: RDS volume - 16TB DMS - 30TB EBS - 64TB none of them matching the 500TB of size. so only possible here: write forgot the size limit but made the question only focus on comparision between DX and Snowball. Or, the 500TB size of file is no db or not a single file which can be split to different volumes. And in either case above, DE would be the answer that author is looking for, Simple as Do you know what DMS is.

   Source: Adapted from community discussion — pangchn

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

8. Question 268 · 527 in bank

   A company has created an OU in AWS Organizations for each of its engineering teams. Each OU owns multiple AWS accounts. The organization has hundreds of AWS accounts. A solutions architect must design a solution so that each OU can view a breakdown of usage costs across its AWS accounts. Which solution meets these requirements?

   • ACreate an AWS Cost and Usage Report (CUR) for each OU by using AWS Resource Access Manager. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.
   • BCreate an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.
   • CCreate an AWS Cost and Usage Report (CUR) in each AWS Organizations member account. Allow each team to visualize the CUR through an Amazon QuickSight dashboard.
   • DCreate an AWS Cost and Usage Report (CUR) by using AWS Systems Manager. Allow each team to visualize the CUR through Systems Manager OpsCenter dashboards.

   Show answer

   Answer: B

   Explanation

   B is the correct answer. The solution would be to create an AWS Cost and Usage Report (CUR) from the AWS Organizations management account. This would allow the management account to view the usage costs across all the member accounts, and the teams can visualize the CUR through an Amazon QuickSight dashboard. This allows the organization to have a centralized place to view the cost breakdown and the teams to access the cost breakdown in an easy way.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation

   Next question

9. Question 269 · 527 in bank

   Select 3

   A company operates a fleet of servers on premises and operates a fleet of Amazon EC2 instances in its organization in AWS Organizations. The company's AWS accounts contain hundreds of VPCs. The company wants to connect its AWS accounts to its on-premises network. AWS Site-to-Site VPN connections are already established to a single AWS account. The company wants to control which VPCs can communicate with other VPCs. Which combination of steps will achieve this level of control with the LEAST operational effort? (Choose three.)

   • ACreate a transit gateway in an AWS account. Share the transit gateway across accounts by using AWS Resource Access Manager (AWS RAM).
   • BConfigure attachments to all VPCs and VPNs.
   • CSetup transit gateway route tables. Associate the VPCs and VPNs with the route tables.
   • DConfigure VPC peering between the VPCs.
   • EConfigure attachments between the VPCs and VPNs.
   • FSetup route tables on the VPCs and VPNs.

   Show answer

   Answer: ABC

   Explanation

   As transit gateway follows a hub and spoke model connecting all VPCs and VPNs to it makes more sense. Moreover, between VPCs and VPNs is invalid.

   Source: Adapted from community discussion — HappyPrince

   References

   • AWS documentation

   Next question

10. Question 270 · 527 in bank

    A company needs to optimize the cost of its application on AWS. The application uses AWS Lambda functions and Amazon Elastic Container Service (Amazon ECS) containers that run on AWS Fargate. The application is write-heavy and stores data in an Amazon Aurora MySQL database. The load on the application is not consistent. The application experiences long periods of no usage, followed by sudden and significant increases and decreases in traffic. The database runs on a memory optimized DB instance that cannot handle the load. A solutions architect must design a solution that can scale to handle the changes in traffic. Which solution will meet these requirements MOST cost-effectively?

    • AAdd additional read replicas to the database. Purchase Instance Savings Plans and RDS Reserved Instances.
    • BMigrate the database to an Aurora DB cluster that has multiple writer instances. Purchase Instance Savings Plans.
    • CMigrate the database to an Aurora global database. Purchase Compute Savings Plans and RDS Reserved instances.
    • DMigrate the database to Aurora Serverless v1. Purchase Compute Savings Plans.

    Show answer

    Answer: D

    Explanation

    Per scenario, the application is write intensive and the load varies due to burst. Aurora Serverless with compute saving plans is the correct answer

    Source: Adapted from community discussion — Russs99

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 261. 527 questions available.