SAP-C02 practice questions 311–320

1. Question 311 · 527 in bank

   Select 2

   A large company is migrating its entire IT portfolio to AWS. Each business unit in the company has a standalone AWS account that supports both development and test environments. New accounts to support production workloads will be needed soon. The finance department requires a centralized method for payment but must maintain visibility into each group's spending to allocate costs. The security team requires a centralized mechanism to control IAM usage in all the company’s accounts. What combination of the following options meets the company’s needs with the LEAST effort? (Choose two.)

   • AUse a collection of parameterized AWS CloudFormation templates defining common IAM permissions that are launched into each account. Require all new and existing accounts to launch the appropriate stacks to enforce the least privilege model.
   • BUse AWS Organizations to create a new organization from a chosen payer account and define an organizational unit hierarchy. Invite the existing accounts to join the organization and create new accounts using Organizations.
   • CRequire each business unit to use its own AWS accounts. Tag each AWS account appropriately and enable Cost Explorer to administer chargebacks.
   • DEnable all features of AWS Organizations and establish appropriate service control policies that filter IAM permissions for sub-accounts.
   • EConsolidate all of the company's AWS accounts into a single AWS account. Use tags for billing purposes and the IAM’s Access Advisor feature to enforce the least privilege model.

   Show answer

   Answer: BD

   Explanation

   Option BD not C: The management account has the responsibilities of a payer account and is responsible for paying all charges that are accrued by the member accounts. You can't change an organization's management account. https://docs.aws.amazon.com/organizations/latest/userguide/orgs_getting-started_concepts.html

   Source: Adapted from community discussion — TonytheTiger

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 312 · 527 in bank

   A company is using AWS Organizations to manage multiple AWS accounts. For security purposes, the company requires the creation of an Amazon Simple Notification Service (Amazon SNS) topic that enables integration with a third-party alerting system in all the Organizations member accounts. A solutions architect used an AWS CloudFormation template to create the SNS topic and stack sets to automate the deployment of CloudFormation stacks. Trusted access has been enabled in Organizations. What should the solutions architect do to deploy the CloudFormation StackSets in all AWS accounts?

   • ACreate a stack set in the Organizations member accounts. Use service-managed permissions. Set deployment options to deploy to an organization. Use CloudFormation StackSets drift detection.
   • BCreate stacks in the Organizations member accounts. Use self-service permissions. Set deployment options to deploy to an organization. Enable the CloudFormation StackSets automatic deployment.
   • CCreate a stack set in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets automatic deployment.
   • DCreate stacks in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets drift detection.

   Show answer

   Answer: C

   Explanation

   The best solution is C, because it involves creating the stack set in the management account of the organization, which is the central point of control for all the member accounts. This allows the solutions architect to manage the deployment of the stack set across all member accounts from a single location. Service-managed permissions are used, which allows the CloudFormation service to deploy the stack set to all member accounts. The deployment options are set to deploy to the organization and automatic deployment is enabled, which ensures that the stack set is automatically deployed to all member accounts as soon as it is created in the management account.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation

   Next question

3. Question 313 · 527 in bank

   A company has a solution that analyzes weather data from thousands of weather stations. The weather stations send the data over an Amazon API Gateway REST API that has an AWS Lambda function integration. The Lambda function calls a third-party service for data pre-processing. The third-party service gets overloaded and fails the pre-processing, causing a loss of data. A solutions architect must improve the resiliency of the solution. The solutions architect must ensure that no data is lost and that data can be processed later if failures occur. What should the solutions architect do to meet these requirements?

   • ACreate an Amazon Simple Queue Service (Amazon SQS) queue. Configure the queue as the dead-letter queue for the API.
   • BCreate two Amazon Simple Queue Service (Amazon SQS) queues: a primary queue and a secondary queue. Configure the secondary queue as the dead-letter queue for the primary queue. Update the API to use a new integration to the primary queue. Configure the Lambda function as the invocation target for the primary queue.
   • CCreate two Amazon EventBridge event buses: a primary event bus and a secondary event bus. Update the API to use a new integration to the primary event bus. Configure an EventBridge rule to react to all events on the primary event bus. Specify the Lambda function as the target of the rule. Configure the secondary event bus as the failure destination for the Lambda function.
   • DCreate a custom Amazon EventBridge event bus. Configure the event bus as the failure destination for the Lambda function.

   Show answer

   Answer: B

   Explanation

   B is the best solution. It uses two Amazon SQS queues to ensure that incoming data is not lost and can be processed later in case of failures. The primary queue acts as the initial landing point for data from the API Gateway, and the secondary queue serves as a dead-letter queue, capturing data that could not be processed due to third-party service failures or other issues. This setup maintains data integrity and allows for later processing, effectively improving the solution's resiliency.

   Source: Adapted from community discussion — heatblur

   References

   • AWS documentation

   Next question

4. Question 314 · 527 in bank

   Select 3

   A company built an ecommerce website on AWS using a three-tier web architecture. The application is Java-based and composed of an Amazon CloudFront distribution, an Apache web server layer of Amazon EC2 instances in an Auto Scaling group, and a backend Amazon Aurora MySQL database. Last month, during a promotional sales event, users reported errors and timeouts while adding items to their shopping carts. The operations team recovered the logs created by the web servers and reviewed Aurora DB cluster performance metrics. Some of the web servers were terminated before logs could be collected and the Aurora metrics were not sufficient for query performance analysis. Which combination of steps must the solutions architect take to improve application performance visibility during peak traffic events? (Choose three.)

   • AConfigure the Aurora MySQL DB cluster to publish slow query and error logs to Amazon CloudWatch Logs.
   • BImplement the AWS X-Ray SDK to trace incoming HTTP requests on the EC2 instances and implement tracing of SQL queries with the X-Ray SDK for Java.
   • CConfigure the Aurora MySQL DB cluster to stream slow query and error logs to Amazon Kinesis.
   • DInstall and configure an Amazon CloudWatch Logs agent on the EC2 instances to send the Apache logs to CloudWatch Logs.
   • EEnable and configure AWS CloudTrail to collect and analyze application activity from Amazon EC2 and Aurora
   • FEnable Aurora MySQL DB cluster performance benchmarking and publish the stream to AWS X-Ray.

   Show answer

   Answer: ABD

   Explanation

   ABD - Effectively we need to collect logs (from DB, Instance) and Trace the Request Response from the calls using XRay to understand what is happening. https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/USER_LogAccess.Concepts.MySQL.html#USER_LogAccess.MySQLDB.PublishAuroraMySQLtoCloudWatchLogs https://aws.amazon.com/blogs/mt/simplifying-apache-server-logs-with-amazon-cloudwatch-logs-insights/ https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-dotnet-messagehandler.html https://docs.aws.amazon.com/xray/latest/devguide/xray-sdk-java-sqlclients.html

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 315 · 527 in bank

   A company that provisions job boards for a seasonal workforce is seeing an increase in traffic and usage. The backend services run on a pair of Amazon EC2 instances behind an Application Load Balancer with Amazon DynamoDB as the datastore. Application read and write traffic is slow during peak seasons. Which option provides a scalable application architecture to handle peak seasons with the LEAST development effort?

   • AMigrate the backend services to AWS Lambda. Increase the read and write capacity of DynamoDB.
   • BMigrate the backend services to AWS Lambda. Configure DynamoDB to use global tables.
   • CUse Auto Scaling groups for the backend services. Use DynamoDB auto scaling.
   • DUse Auto Scaling groups for the backend services. Use Amazon Simple Queue Service (Amazon SQS) and an AWS Lambda function to write to DynamoDB.

   Show answer

   Answer: C

   Next question

6. Question 316 · 527 in bank

   A company is migrating to the cloud. It wants to evaluate the configurations of virtual machines in its existing data center environment to ensure that it can size new Amazon EC2 instances accurately. The company wants to collect metrics, such as CPU, memory, and disk utilization, and it needs an inventory of what processes are running on each instance. The company would also like to monitor network connections to map communications between servers. Which would enable the collection of this data MOST cost effectively?

   • AUse AWS Application Discovery Service and deploy the data collection agent to each virtual machine in the data center.
   • BConfigure the Amazon CloudWatch agent on all servers within the local environment and publish metrics to Amazon CloudWatch Logs.
   • CUse AWS Application Discovery Service and enable agentless discovery in the existing virtualization environment.
   • DEnable AWS Application Discovery Service in the AWS Management Console and configure the corporate firewall to allow scans over a VPN.

   Show answer

   Answer: A

   Explanation

   According to this link, VM utilization metrics are picked up by Agentless and not Agent-based. - https://docs.aws.amazon.com/application-discovery/latest/userguide/what-is-appdiscovery.html#Database%20Discovery . At the same time, network connections are pickedup by Agent-based and not Agentless. Was pretty confident about A, but now i see A doesn't suffice all criteria nor does C.

   Source: Adapted from community discussion — shaaam80

   References

   • AWS documentation

   Next question

7. Question 317 · 527 in bank

   A company provides a software as a service (SaaS) application that runs in the AWS Cloud. The application runs on Amazon EC2 instances behind a Network Load Balancer (NLB). The instances are in an Auto Scaling group and are distributed across three Availability Zones in a single AWS Region. The company is deploying the application into additional Regions. The company must provide static IP addresses for the application to customers so that the customers can add the IP addresses to allow lists. The solution must automatically route customers to the Region that is geographically closest to them. Which solution will meet these requirements?

   • ACreate an Amazon CloudFront distribution. Create a CloudFront origin group. Add the NLB for each additional Region to the origin group. Provide customers with the IP address ranges of the distribution’s edge locations.
   • BCreate an AWS Global Accelerator standard accelerator. Create a standard accelerator endpoint for the NLB in each additional Region. Provide customers with the Global Accelerator IP address.
   • CCreate an Amazon CloudFront distribution. Create a custom origin for the NLB in each additional Region. Provide customers with the IP address ranges of the distribution’s edge locations.
   • DCreate an AWS Global Accelerator custom routing accelerator. Create a listener for the custom routing accelerator. Add the IP address and ports for the NLB in each additional Region. Provide customers with the Global Accelerator IP address.

   Show answer

   Answer: B

   Explanation

   Answer is B not D. CloudFront does not work with NLB nor does it accept a fixed IP address A Standard accelerators automatically route traffic to a healthy endpoint that is nearest to your user. Since they're designed to load balance traffic, you can't deterministically route multiple users to a specific EC2 destination behind your accelerator. Custom routing accelerators allows you to do just that. Another difference is that standard routing accelerators support Network Load Balancers, Application Load Balancers, EC2 instances, and Elastic IPs as endpoints. Custom routing accelerators support only VPC subnet endpoints, each containing one or more EC2 instances that are running your application. https://aws.amazon.com/global-accelerator/faqs/#:~:text=A%3A%20Standard%20accelerators%20automatically%20route,you%20to%20do%20just%20that.

   Source: Adapted from community discussion — ayadmawla

   References

   • AWS documentation

   Next question

8. Question 318 · 527 in bank

   A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account. Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads. Which strategy will meet these requirements?

   • ACreate separate OUs in AWS Organizations for each development unit. Assign the created OUs to the company AWS accounts. Create separate SCP with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag that matches the development unit name. Assign the SCP to the corresponding OU.
   • BPass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Update the IAM policy for the developers’ assumed IAM role with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit.
   • CPass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Create an SCP with an allow action and a StringEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit. Assign the SCP to the root OU.
   • DCreate separate IAM policies for each development unit. For every IAM policy, add an allow action and a StringEquals condition for the DevelopmentUnit resource tag and the development unit name. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development unit name to the assumed IAM role.

   Show answer

   Answer: B

   Explanation

   B is the best answer. This approach involves tagging federated identity sessions with a DevelopmentUnit attribute and then using IAM policies to deny actions if the DevelopmentUnit tag of the resource does not match the aws:PrincipalTag/DevelopmentUnit. This method directly ties permissions to the federated identity, allowing for finer-grained access control that aligns with your requirements.

   Source: Adapted from community discussion — heatblur

   Next question

9. Question 319 · 527 in bank

   Select 3

   An enterprise company is building an infrastructure services platform for its users. The company has the following requirements: • Provide least privilege access to users when launching AWS infrastructure so users cannot provision unapproved services. • Use a central account to manage the creation of infrastructure services. • Provide the ability to distribute infrastructure services to multiple accounts in AWS Organizations. • Provide the ability to enforce tags on any infrastructure that is started by users. Which combination of actions using AWS services will meet these requirements? (Choose three.)

   • ADevelop infrastructure services using AWS CloudFormation templates. Add the templates to a central Amazon S3 bucket and add the IAM roles or users that require access to the S3 bucket policy.
   • BDevelop infrastructure services using AWS CloudFormation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the Organizations structure created for the company.
   • CAllow user IAM roles to have AWSCloudFormationFullAccess and AmazonS3ReadOnlyAccess permissions. Add an Organizations SCP at the AWS account root user level to deny all services except AWS CloudFormation and Amazon S3.
   • DAllow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an automation script to import the central portfolios to local AWS accounts, copy the TagOption, assign users access, and apply launch constraints.
   • EUse the AWS Service Catalog TagOption Library to maintain a list of tags required by the company. Apply the TagOption to AWS Service Catalog products or portfolios.
   • FUse the AWS CloudFormation Resource Tags property to enforce the application of tags to any CloudFormation templates that will be created for users.

   Show answer

   Answer: BDE

   Explanation

   I guess that the right answer should be BDE, because we uses Service catalog, so all other options should to refer on it.

   Source: Adapted from community discussion — HunkyBunky

   References

   • AWS documentation

   Next question

10. Question 320 · 527 in bank

    A company deploys a new web application. As part of the setup, the company configures AWS WAF to log to Amazon S3 through Amazon Kinesis Data Firehose. The company develops an Amazon Athena query that runs once daily to return AWS WAF log data from the previous 24 hours. The volume of daily logs is constant. However, over time, the same query is taking more time to run. A solutions architect needs to design a solution to prevent the query time from continuing to increase. The solution must minimize operational overhead. Which solution will meet these requirements?

    • ACreate an AWS Lambda function that consolidates each day's AWS WAF logs into one log file.
    • BReduce the amount of data scanned by configuring AWS WAF to send logs to a different S3 bucket each day.
    • CUpdate the Kinesis Data Firehose configuration to partition the data in Amazon S3 by date and time. Create external tables for Amazon Redshift. Configure Amazon Redshift Spectrum to query the data source.
    • DModify the Kinesis Data Firehose configuration and Athena table definition to partition the data by date and time. Change the Athena query to view the relevant partitions.

    Show answer

    Answer: D

    Explanation

    Answer: D Partitioning is a powerful technique for optimizing query performance and cost in Athena, especially for large, growing datasets.Firehose and Athena seamlessly support partitioning, making it easy to implement.

    Source: Adapted from community discussion — vibzr2023

    References

    • repost.aws documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 311. 527 questions available.