SAP-C02 practice questions 301–310

1. Question 301 · 527 in bank

   A company is hosting a three-tier web application in an on-premises environment. Due to a recent surge in traffic that resulted in downtime and a significant financial impact, company management has ordered that the application be moved to AWS. The application is written in .NET and has a dependency on a MySQL database. A solutions architect must design a scalable and highly available solution to meet the demand of 200,000 daily users. Which steps should the solutions architect take to design an appropriate solution?

   • AUse AWS Elastic Beanstalk to create a new application with a web server environment and an Amazon RDS MySQL Multi-AZ DB instance. The environment should launch a Network Load Balancer (NLB) in front of an Amazon EC2 Auto Scaling group in multiple Availability Zones. Use an Amazon Route 53 alias record to route traffic from the company’s domain to the NLB.
   • BUse AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon EC2 Auto Scaling group spanning three Availability Zones. The stack should launch a Multi-AZ deployment of an Amazon Aurora MySQL DB cluster with a Retain deletion policy. Use an Amazon Route 53 alias record to route traffic from the company’s domain to the ALB.
   • CUse AWS Elastic Beanstalk to create an automatically scaling web server environment that spans two separate Regions with an Application Load Balancer (ALB) in each Region. Create a Multi-AZ deployment of an Amazon Aurora MySQL DB cluster with a cross-Region read replica. Use Amazon Route 53 with a geoproximity routing policy to route traffic between the two Regions.
   • DUse AWS CloudFormation to launch a stack containing an Application Load Balancer (ALB) in front of an Amazon ECS cluster of Spot instances spanning three Availability Zones. The stack should launch an Amazon RDS MySQL DB instance with a Snapshot deletion policy. Use an Amazon Route 53 alias record to route traffic from the company’s domain to the ALB.

   Show answer

   Answer: B

   Explanation

   Agree with B. Not A: we will not use NLB for web app Not C: Beanstalk is region service. It CANNOT "automatically scaling web server environment that spans two separate Regions" Not D: spot instances cant meet 'highly available'

   Source: Adapted from community discussion — robertohyena

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 302 · 527 in bank

   Select 2

   A company has multiple AWS accounts. The company recently had a security audit that revealed many unencrypted Amazon Elastic Block Store (Amazon EBS) volumes attached to Amazon EC2 instances. A solutions architect must encrypt the unencrypted volumes and ensure that unencrypted volumes will be detected automatically in the future. Additionally, the company wants a solution that can centrally manage multiple AWS accounts with a focus on compliance and security. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

   • ACreate an organization in AWS Organizations. Set up AWS Control Tower, and turn on the strongly recommended controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
   • BUse the AWS CLI to list all the unencrypted volumes in all the AWS accounts. Run a script to encrypt all the unencrypted volumes in place.
   • CCreate a snapshot of each unencrypted volume. Create a new encrypted volume from the unencrypted snapshot. Detach the existing volume, and replace it with the encrypted volume.
   • DCreate an organization in AWS Organizations. Set up AWS Control Tower, and turn on the mandatory controls (guardrails). Join all accounts to the organization. Categorize the AWS accounts into OUs.
   • ETurn on AWS CloudTrail. Configure an Amazon EventBridge rule to detect and automatically encrypt unencrypted volumes.

   Show answer

   Answer: AC

   Explanation

   A: strongly recommended controls - detects whether the Amazon EBS volumes attached to an Amazon EC2 instance are encrypted C: Best way to encrypt an unencrypted volume

   Source: Adapted from community discussion — J0n102

   References

   • AWS documentation
   • AWS documentation

   Next question

3. Question 303 · 527 in bank

   A company hosts an intranet web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Currently, users authenticate to the application against an internal user database. The company needs to authenticate users to the application by using an existing AWS Directory Service for Microsoft Active Directory directory. All users with accounts in the directory must have access to the application. Which solution will meet these requirements?

   • ACreate a new app client in the directory. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule. Configure the listener rule with the appropriate issuer, client ID and secret, and endpoint details for the Active Directory service. Configure the new app client with the callback URL that the ALB provides.
   • BConfigure an Amazon Cognito user pool. Configure the user pool with a federated identity provider (ldP) that has metadata from the directory. Create an app client. Associate the app client with the user pool. Create a listener rule for the ALSpecify the authenticate-cognito action for the listener rule. Configure the listener rule to use the user pool and app client.
   • CAdd the directory as a new IAM identity provider (ldP). Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Configure the new role as the default authenticated user role for the ldP. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule.
   • DEnable AWS IAM Identity Center (AWS Single Sign-On). Configure the directory as an external identity provider (ldP) that uses SAML. Use the automatic provisioning method. Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Attach the new role to all groups. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule.

   Show answer

   Answer: B

   Explanation

   There are two options either via Cognito or Auth0 and then attach an IDP to one of them. See: https://docs.aws.amazon.com/elasticloadbalancing/latest/application/listener-authenticate-users.html https://aws.amazon.com/blogs/aws/built-in-authentication-in-alb/

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation
   • AWS documentation

   Next question

4. Question 304 · 527 in bank

   A company has a website that serves many visitors. The company deploys a backend service for the website in a primary AWS Region and a disaster recovery (DR) Region. A single Amazon CloudFront distribution is deployed for the website. The company creates an Amazon Route 53 record set with health checks and a failover routing policy for the primary Region’s backend service. The company configures the Route 53 record set as an origin for the CloudFront distribution. The company configures another record set that points to the backend service's endpoint in the DR Region as a secondary failover record type. The TTL for both record sets is 60 seconds. Currently, failover takes more than 1 minute. A solutions architect must design a solution that will provide the fastest failover time. Which solution will achieve this goal?

   • ADeploy an additional CloudFront distribution. Create a new Route 53 failover record set with health checks for both CloudFront distributions.
   • BSet the TTL to 4 second for the existing Route 53 record sets that are used for the backend service in each Region.
   • CCreate new record sets for the backend services by using a latency routing policy. Use the record sets as an origin in the CloudFront distribution.
   • DCreate a CloudFront origin group that includes two origins, one for each backend service Region. Configure origin failover as a cache behavior for the CloudFront distribution.

   Show answer

   Answer: D

   Explanation

   In summary, CloudFront Origin Failover fails over immediately when it detects a failure from the origin. However, it may also introduce latency as it tries to forward every request to the primary origin first. Route53 DNS Failover offers more stability, but it requires more time to detect failure from the origin. However, you can combine both solutions to increase availability without affecting performance. See: https://aws.amazon.com/blogs/networking-and-content-delivery/improve-web-application-availability-with-cloudfront-and-route53-hybrid-origin-failover/#:~:text=In%20summary%2C%20CloudFront%20Origin%20Failover,detect%20failure%20from%20the%20origin.

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation

   Next question

5. Question 305 · 527 in bank

   Select 3

   A company is using multiple AWS accounts and has multiple DevOps teams running production and non-production workloads in these accounts. The company would like to centrally-restrict access to some of the AWS services that the DevOps teams do not use. The company decided to use AWS Organizations and successfully invited all AWS accounts into the Organization. They would like to allow access to services that are currently in-use and deny a few specific services. Also they would like to administer multiple accounts together as a single unit. What combination of steps should the solutions architect take to satisfy these requirements? (Choose three.)

   • AUse a Deny list strategy.
   • BReview the Access Advisor in AWS IAM to determine services recently used
   • CReview the AWS Trusted Advisor report to determine services recently used.
   • DRemove the default FullAWSAccess SCP.
   • EDefine organizational units (OUs) and place the member accounts in the OUs.
   • FRemove the default DenyAWSAccess SCP.

   Show answer

   Answer: ABE

   Explanation

   ABE is the answer: A: This approach involves explicitly denying access to specific AWS services that the company wants to restrict. It allows all other services to be accessible, which aligns with the company's requirement to allow services that are currently in use. B: AWS IAM Access Advisor shows the service permissions granted to a user and when those services were last accessed. This information is valuable to understand which AWS services are actively used and which are not, helping to make informed decisions about which services to restrict. E: Organizational Units allow for grouping AWS accounts that have similar needs or requirements. This structure enables the solutions architect to apply policies at the OU level, making it easier to manage permissions and restrictions across multiple accounts.

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation
   • AWS documentation

   Next question

6. Question 306 · 527 in bank

   A live-events company is designing a scaling solution for its ticket application on AWS. The application has high peaks of utilization during sale events. Each sale event is a one-time event that is scheduled. The application runs on Amazon EC2 instances that are in an Auto Scaling group. The application uses PostgreSQL for the database layer. The company needs a scaling solution to maximize availability during the sale events. Which solution will meet these requirements?

   • AUse a predictive scaling policy for the EC2 instances. Host the database on an Amazon Aurora PostgreSQL Serverless v2 Multi-AZ DB instance with automatically scaling read replicas. Create an AWS Step Functions state machine to run parallel AWS Lambda functions to pre-warm the database before a sale event. Create an Amazon EventBridge rule to invoke the state machine.
   • BUse a scheduled scaling policy for the EC2 instances. Host the database on an Amazon RDS for PostgreSQL Mulli-AZ DB instance with automatically scaling read replicas. Create an Amazon EventBridge rule that invokes an AWS Lambda function to create a larger read replica before a sale event. Fail over to the larger read replica. Create another EventBridge rule that invokes another Lambda function to scale down the read replica after the sale event.
   • CUse a predictive scaling policy for the EC2 instances. Host the database on an Amazon RDS for PostgreSQL MultiAZ DB instance with automatically scaling read replicas. Create an AWS Step Functions state machine to run parallel AWS Lambda functions to pre-warm the database before a sale event. Create an Amazon EventBridge rule to invoke the state machine.
   • DUse a scheduled scaling policy for the EC2 instances. Host the database on an Amazon Aurora PostgreSQL Multi-AZ DB cluster. Create an Amazon EventBridge rule that invokes an AWS Lambda function to create a larger Aurora Replica before a sale event. Fail over to the larger Aurora Replica. Create another EventBridge rule that invokes another Lambda function to scale down the Aurora Replica after the sale event.

   Show answer

   Answer: D

   Explanation

   D is the best answer. It leverages scheduled scaling for EC2 instances, which is ideal for handling predictable, high-traffic event peaks. Amazon Aurora PostgreSQL is a high-performance database solution that provides the reliability needed for such critical operations. The use of a larger Aurora Replica during the event and scaling down afterward allows for efficient resource utilization, aligning the database capacity with the fluctuating demand. While it introduces some complexity in terms of manual replica management, this approach offers a good balance between performance, reliability, and cost-effectiveness, making it well-suited for the described scenario.

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation

   Next question

7. Question 307 · 527 in bank

   Select 3

   A company runs an intranet application on premises. The company wants to configure a cloud backup of the application. The company has selected AWS Elastic Disaster Recovery for this solution. The company requires that replication traffic does not travel through the public internet. The application also must not be accessible from the internet. The company does not want this solution to consume all available network bandwidth because other applications require bandwidth. Which combination of steps will meet these requirements? (Choose three.)

   • ACreate a VPC that has at least two private subnets, two NAT gateways, and a virtual private gateway.
   • BCreate a VPC that has at least two public subnets, a virtual private gateway, and an internet gateway.
   • CCreate an AWS Site-to-Site VPN connection between the on-premises network and the target AWS network.
   • DCreate an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network.
   • EDuring configuration of the replication servers, select the option to use private IP addresses for data replication.
   • FDuring configuration of the launch settings for the target servers, select the option to ensure that the Recovery instance’s private IP address matches the source server's private IP address.

   Show answer

   Answer: ADE

   Explanation

   ADE Option D: Create an AWS Direct Connect connection and a Direct Connect gateway between the on-premises network and the target AWS network. Option E: During configuration of the replication servers, select the option to use private IP addresses for data replication. Option A: could be considered if the private subnets are used without the NAT gateways, ensuring internal-only network access

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation

   Next question

8. Question 308 · 527 in bank

   A company that provides image storage services wants to deploy a customer-facing solution to AWS. Millions of individual customers will use the solution. The solution will receive batches of large image files, resize the files, and store the files in an Amazon S3 bucket for up to 6 months. The solution must handle significant variance in demand. The solution must also be reliable at enterprise scale and have the ability to rerun processing jobs in the event of failure. Which solution will meet these requirements MOST cost-effectively?

   • AUse AWS Step Functions to process the S3 event that occurs when a user stores an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
   • BUse Amazon EventBridge to process the S3 event that occurs when a user uploads an image. Run an AWS Lambda function that resizes the image in place and replaces the original file in the S3 bucket. Create an S3 Lifecycle expiration policy to expire all stored images after 6 months.
   • CUse S3 Event Notifications to invoke an AWS Lambda function when a user stores an image. Use the Lambda function to resize the image in place and to store the original file in the S3 bucket. Create an S3 Lifecycle policy to move all stored images to S3 Standard-Infrequent Access (S3 Standard-IA) after 6 months.
   • DUse Amazon Simple Queue Service (Amazon SQS) to process the S3 event that occurs when a user stores an image. Run an AWS Lambda function that resizes the image and stores the resized file in an S3 bucket that uses S3 Standard-Infrequent Access (S3 Standard-IA). Create an S3 Lifecycle policy to move all stored images to S3 Glacier Deep Archive after 6 months.

   Show answer

   Answer: D

   Explanation

   B is for sure A no because Step Function is not in list of s3 event destinations https://docs.aws.amazon.com/AmazonS3/latest/userguide/notification-how-to-event-types-and-destinations.html C and D has option for storing data longer than 6 months which is not required

   Source: Adapted from community discussion — yuliaqwerty

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 309 · 527 in bank

   A company has an organization in AWS Organizations that includes a separate AWS account for each of the company’s departments. Application teams from different departments develop and deploy solutions independently. The company wants to reduce compute costs and manage costs appropriately across departments. The company also wants to improve visibility into billing for individual departments. The company does not want to lose operational flexibility when the company selects compute resources. Which solution will meet these requirements?

   • AUse AWS Budgets for each department. Use Tag Editor to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
   • BConfigure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use SCPs to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
   • CConfigure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use Tag Editor to apply tags to appropriate resources. Purchase Compute Savings Plans.
   • DUse AWS Budgets for each department. Use SCPs to apply tags to appropriate resources. Purchase Compute Savings Plans.

   Show answer

   Answer: C

   Explanation

   C appears to be the most suitable solution. The combination of consolidated billing, a comprehensive tagging strategy using Tag Editor, and the purchase of Compute Savings Plans provides a balanced approach. This solution offers a centralized view and management of costs, ensures accurate cost allocation through tagging, and maintains flexibility in compute resource selection with the Compute Savings Plans. The Compute Savings Plans are particularly beneficial as they provide savings not only on EC2 instances but also on AWS Fargate and AWS Lambda, offering a broader range of applicability than EC2 Instance Savings Plans.

   Source: Adapted from community discussion — heatblur

   Next question

10. Question 310 · 527 in bank

    A company has a web application that securely uploads pictures and videos to an Amazon S3 bucket. The company requires that only authenticated users are allowed to post content. The application generates a presigned URL that is used to upload objects through a browser interface. Most users are reporting slow upload times for objects larger than 100 MB. What can a solutions architect do to improve the performance of these uploads while ensuring only authenticated users are allowed to post content?

    • ASet up an Amazon API Gateway with an edge-optimized API endpoint that has a resource as an S3 service proxy. Configure the PUT method for this resource to expose the S3 PutObject operation. Secure the API Gateway using a COGNITO_USER_POOLS authorizer. Have the browser interface use API Gateway instead of the presigned URL to upload objects.
    • BSet up an Amazon API Gateway with a regional API endpoint that has a resource as an S3 service proxy. Configure the PUT method for this resource to expose the S3 PutObject operation. Secure the API Gateway using an AWS Lambda authorizer. Have the browser interface use API Gateway instead of the presigned URL to upload objects.
    • CEnable an S3 Transfer Acceleration endpoint on the S3 bucket. Use the endpoint when generating the presigned URL. Have the browser interface upload the objects to this URL using the S3 multipart upload API.
    • DConfigure an Amazon CloudFront distribution for the destination S3 bucket. Enable PUT and POST methods for the CloudFront cache behavior. Update the CloudFront origin to use an origin access identity (OAI). Give the OAI user 3: PutObject permissions in the bucket policy. Have the browser interface upload objects using the CloudFront distribution.

    Show answer

    Answer: C

    Explanation

    Considering the primary concern of improving upload performance for large files while maintaining secure access for authenticated users, Option C (Enable S3 Transfer Acceleration and use it in the presigned URL) is the most suitable solution. It directly addresses the issue of slow uploads for large objects by leveraging CloudFront’s edge locations for accelerated data transfer to S3, and it works seamlessly with the existing mechanism of generating presigned URLs for authenticated users.

    Source: Adapted from community discussion — thala

    References

    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 301. 527 questions available.