SAP-C02 practice questions 371–380

1. Question 371 · 527 in bank

   A company wants to migrate its website to AWS. The website uses microservices and runs on containers that are deployed in an on-premises, self-managed Kubernetes cluster. All the manifests that define the deployments for the containers in the Kubernetes deployment are in source control. All data for the website is stored in a PostgreSQL database. An open source container image repository runs alongside the on-premises environment. A solutions architect needs to determine the architecture that the company will use for the website on AWS. Which solution will meet these requirements with the LEAST effort to migrate?

   • ACreate an AWS App Runner service. Connect the App Runner service to the open source container image repository. Deploy the manifests from on premises to the App Runner service. Create an Amazon RDS for PostgreSQL database.
   • BCreate an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that has managed node groups. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Deploy the manifests from on premises to the EKS cluster. Create an Amazon Aurora PostgreSQL DB cluster.
   • CCreate an Amazon Elastic Container Service (Amazon ECS) cluster that has an Amazon EC2 capacity pool. Copy the application containers to a new Amazon Elastic Container Registry (Amazon ECR) repository. Register each container image as a new task definition. Configure ECS services for each task definition to match the original Kubernetes deployments. Create an Amazon Aurora PostgreSQL DB cluster.
   • DRebuild the on-premises Kubernetes cluster by hosting the cluster on Amazon EC2 instances. Migrate the open source container image repository to the EC2 instances. Deploy the manifests from on premises to the new cluster on AWS. Deploy an open source PostgreSQL database on the new cluster.

   Show answer

   Answer: B

   Explanation

   Answer is B - because only in that case - we don't need to do any changes in application A - is out, because we will need to create deployments for many micro-services C - is out, because we will need to create ecs deployments for many micro-services D - is out, because it will require a lot of overhead and efforts for self-managed K8S setup

   Source: Adapted from community discussion — HunkyBunky

   References

   • AWS documentation
   • AWS documentation

   Next question

2. Question 372 · 527 in bank

   A company uses a mobile app on AWS to run online contests. The company selects a winner at random at the end of each contest. The contests run for variable lengths of time. The company does not need to retain any data from a contest after the contest is finished. The company uses custom code that is hosted on Amazon EC2 instances to process the contest data and select a winner. The EC2 instances run behind an Application Load Balancer and store contest entries on Amazon RDS DB instances. The company must design a new architecture to reduce the cost of running the contests. Which solution will meet these requirements MOST cost-effectively?

   • AMigrate storage of the contest entries to Amazon DynamoDB. Create a DynamoDB Accelerator (DAX) cluster. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. At the end of the contest, delete the DynamoDB table.
   • BMigrate the storage of the contest entries to Amazon Redshift. Rewrite the code as AWS Lambda functions. At the end of the contest, delete the Redshift cluster.
   • CAdd an Amazon ElastiCache for Redis cluster in front of the RDS DB instances to cache the contest entries. Rewrite the code to run as Amazon Elastic Container Service (Amazon ECS) containers that use the Fargate launch type. Set the ElastiCache TTL attribute on each entry to expire each entry at the end of the contest.
   • DMigrate the storage of the contest entries to Amazon DynamoDB. Rewrite the code as AWS Lambda functions. Set the DynamoDB TTL attribute on each entry to expire each entry at the end of the contest.

   Show answer

   Answer: D

   Explanation

   D is the most cost-effective solution. It leverages DynamoDB for efficient, scalable storage with automatic data expiration via TTL and AWS Lambda for flexible, event-driven processing. This setup minimizes costs by using resources only when needed and automatically scaling to match demand without the need for manual intervention or over-provisioning.

   Source: Adapted from community discussion — nharaz

   Next question

3. Question 373 · 527 in bank

   A company has implemented a new security requirement. According to the new requirement, the company must scan all traffic from corporate AWS instances in the company's VPC for violations of the company's security policies. As a result of these scans, the company can block access to and from specific IP addresses. To meet the new requirement, the company deploys a set of Amazon EC2 instances in private subnets to serve as transparent proxies. The company installs approved proxy server software on these EC2 instances. The company modifies the route tables on all subnets to use the corresponding EC2 instances with proxy software as the default route. The company also creates security groups that are compliant with the security policies and assigns these security groups to the EC2 instances. Despite these configurations, the traffic of the EC2 instances in their private subnets is not being properly forwarded to the internet. What should a solutions architect do to resolve this issue?

   • ADisable source/destination checks on the EC2 instances that run the proxy software.
   • BAdd a rule to the security group that is assigned to the proxy EC2 instances to allow all traffic between instances that have this security group. Assign this security group to all EC2 instances in the VPC.
   • CChange the VPCs DHCP options set. Set the DNS server options to point to the addresses of the proxy EC2 instances.
   • DAssign one additional elastic network interface to each proxy EC2 instance. Ensure that one of these network interfaces has a route to the private subnets. Ensure that the other network interface has a route to the internet.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

4. Question 374 · 527 in bank

   A company is running its solution on AWS in a manually created VPC. The company is using AWS CloudFormation to provision other parts of the infrastructure. According to a new requirement, the company must manage all infrastructure in an automatic way. What should the company do to meet this new requirement with the LEAST effort?

   • ACreate a new AWS Cloud Development Kit (AWS CDK) stack that strictly provisions the existing VPC resources and configuration. Use AWS CDK to import the VPC into the stack and to manage the VPC.
   • BCreate a CloudFormation stack set that creates the VPC. Use the stack set to import the VPC into the stack.
   • CCreate a new CloudFormation template that strictly provisions the existing VPC resources and configuration. From the CloudFormation console, create a new stack by importing the Existing resources.
   • DCreate a new CloudFormation template that creates the VPC. Use the AWS Serverless Application Model (AWS SAM) CLI to import the VPC.

   Show answer

   Answer: C

   Explanation

   D - SAM cannot used for importing and currently we are already using Cloudformation B - Stacksets used to create multiple stacks and currently we are using Cloudformation A - CDK , we will need to change all the entire stack from Cloudformation to CDK C - We can import existing resources in Cloudformation: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/resource-import.html

   Source: Adapted from community discussion — saggy4

   References

   • AWS documentation

   Next question

5. Question 375 · 527 in bank

   A company has developed a new release of a popular video game and wants to make it available for public download. The new release package is approximately 5 GB in size. The company provides downloads for existing releases from a Linux-based, publicly facing FTP site hosted in an on-premises data center. The company expects the new release will be downloaded by users worldwide. The company wants a solution that provides improved download performance and low transfer costs, regardless of a user's location.

   • AStore the game files on Amazon EBS volumes mounted on Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.
   • BStore the game files on Amazon EFS volumes that are attached to Amazon EC2 instances within an Auto Scaling group. Configure an FTP service on each of the EC2 instances. Use an Application Load Balancer in front of the Auto Scaling group. Publish the game download URL for users to download the package.
   • CConfigure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Use Amazon CloudFront for the website. Publish the game download URL for users to download the package.
   • DConfigure Amazon Route 53 and an Amazon S3 bucket for website hosting. Upload the game files to the S3 bucket. Set Requester Pays for the S3 bucket. Publish the game download URL for users to download the package.

   Show answer

   Answer: C

   Explanation

   Option C provides a scalable, secure, and cost-effective solution for serving the game files worldwide. Here's why: • Amazon Route 53: Provides fast and reliable DNS resolution for users to access the game files. • Amazon S3 bucket: Stores the game files in a highly available and durable storage system. Upload the game files (5 GB) to the S3 bucket, which will be charged at the standard rate (approximately $0.023 per GB). • Amazon CloudFront: A content delivery network (CDN) that caches frequently accessed resources like the game files. This reduces the latency experienced by users worldwide and provides better download performance.

   Source: Adapted from community discussion — AzureDP900

   Next question

6. Question 376 · 527 in bank

   Select 3

   A company runs an application in the cloud that consists of a database and a website. Users can post data to the website, have the data processed, and have the data sent back to them in an email. Data is stored in a MySQL database running on an Amazon EC2 instance. The database is running in a VPC with two private subnets. The website is running on Apache Tomcat in a single EC2 instance in a different VPC with one public subnet. There is a single VPC peering connection between the database and website VPC. The website has suffered several outages during the last month due to high traffic. Which actions should a solutions architect take to increase the reliability of the application? (Choose three.)

   • APlace the Tomcat server in an Auto Scaling group with multiple EC2 instances behind an Application Load Balancer.
   • BProvision an additional VPC peering connection.
   • CMigrate the MySQL database to Amazon Aurora with one Aurora Replica.
   • DProvision two NAT gateways in the database VPC.
   • EMove the Tomcat server to the database VPC.
   • FCreate an additional public subnet in a different Availability Zone in the website VPC.

   Show answer

   Answer: ACF

   Explanation

   Answer: ACF These increase reliability of the app. F. Create an additional public subnet in a different Availability Zone in the website VPC. A. Place the Tomcat server in an Auto Scaling group with multiple EC2 instances behind an Application Load Balancer. C. Migrate the MySQL database to Amazon Aurora with one Aurora Replica. These do not. B. Provision an additional VPC peering connection. D. Provision two NAT gateways in the database VPC. E. Move the Tomcat server to the database VPC. (good idea for security, but we're after reliability)

   Source: Adapted from community discussion — kejam

   Next question

7. Question 377 · 527 in bank

   Select 2

   A company wants to migrate an Amazon Aurora MySQL DB cluster from an existing AWS account to a new AWS account in the same AWS Region. Both accounts are members of the same organization in AWS Organizations. The company must minimize database service interruption before the company performs DNS cutover to the new database. Which migration strategy will meet this requirement? (Choose two.)

   • ATake a snapshot of the existing Aurora database. Share the snapshot with the new AWS account. Create an Aurora DB cluster in the new account from the snapshot.
   • BCreate an Aurora DB cluster in the new AWS account. Use AWS Database Migration Service (AWS DMS) to migrate data between the two Aurora DB clusters.
   • CUse AWS Backup to share an Aurora database backup from the existing AWS account to the new AWS account. Create an Aurora DB cluster in the new AWS account from the snapshot.
   • DCreate an Aurora DB cluster in the new AWS account. Use AWS Application Migration Service to migrate data between the two Aurora DB clusters.

   Show answer

   Answer: AB

   Explanation

   I guess that the right answer - A \ B A - Snapshots can be easily shared cross AWS accounts B - With AWS DMS - you can sync databases C - Out because - as I understood - you can't just SHARE AWS Backup with another AWS Account, you need to setup cross account AWS backup to store backups in both accounts D - Out because AWS Application migration service - can't migrate RDS databases

   Source: Adapted from community discussion — HunkyBunky

   References

   • AWS documentation

   Next question

8. Question 378 · 527 in bank

   A company has 10 accounts that are part of an organization in AWS Organizations. AWS Config is configured in each account. All accounts belong to either the Prod OU or the NonProd OU. The company has set up an Amazon EventBridge rule in each AWS account to notify an Amazon Simple Notification Service (Amazon SNS) topic when an Amazon EC2 security group inbound rule is created with 0.0.0.0/0 as the source. The company’s security team is subscribed to the SNS topic. For all accounts in the NonProd OU, the security team needs to remove the ability to create a security group inbound rule that includes 0.0.0.0/0 as the source. Which solution will meet this requirement with the LEAST operational overhead?

   • AModify the EventBridge rule to invoke an AWS Lambda function to remove the security group inbound rule and to publish to the SNS topic. Deploy the updated rule to the NonProd OU.
   • BAdd the vpc-sg-open-only-to-authorized-ports AWS Config managed rule to the NonProd OU.
   • CConfigure an SCP to allow the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is not 0.0.0.0/0. Apply the SCP to the NonProd OU.
   • DConfigure an SCP to deny the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is 0.0.0.0/0. Apply the SCP to the NonProd OU.

   Show answer

   Answer: D

   Explanation

   The solution that meets this requirement with the LEAST operational overhead is D. Configuring an SCP to deny the ec2:AuthorizeSecurityGroupIngress action when the value of the aws:SourceIp condition key is 0.0.0.0/0, and applying the SCP to the NonProd OU. This solution would prevent the security group inbound rule from being created in the first place and will not require any additional steps or actions to be taken in order to remove the rule. This is less operationally intensive than modifying the EventBridge rule to invoke an AWS Lambda function, adding a Config rule or allowing the ec2:AuthorizeSecurityGroupIngress action with a specific IP.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 379 · 527 in bank

   Select 2

   A software as a service (SaaS) company provides a media software solution to customers. The solution is hosted on 50 VPCs across various AWS Regions and AWS accounts. One of the VPCs is designated as a management VPC. The compute resources in the VPCs work independently. The company has developed a new feature that requires all 50 VPCs to be able to communicate with each other. The new feature also requires one-way access from each customer's VPC to the company's management VPC. The management VPC hosts a compute resource that validates licenses for the media software solution. The number of VPCs that the company will use to host the solution will continue to increase as the solution grows. Which combination of steps will provide the required VPC connectivity with the LEAST operational overhead? (Choose two.)

   • ACreate a transit gateway. Attach all the company's VPCs and relevant subnets to the transit gateway.
   • BCreate VPC peering connections between all the company's VPCs.
   • CCreate a Network Load Balancer (NLB) that points to the compute resource for license validation. Create an AWS PrivateLink endpoint service that is available to each customer's VPAssociate the endpoint service with the NLB.
   • DCreate a VPN appliance in each customer's VPC. Connect the company's management VPC to each customer's VPC by using AWS Site-to-Site VPN.
   • ECreate a VPC peering connection between the company's management VPC and each customer's VPC.

   Show answer

   Answer: AC

   Explanation

   AC; AWS Transit Gateway allows you to connect resources across different AWS regions. Here’s how you can achieve this: Create Transit Gateways: Begin by creating Transit Gateways in the respective regions where you want to establish peering. Ensure that the necessary VPCs are attached to each Transit Gateway. Enable Peering: Navigate to the AWS Management Console and select the Transit Gateway service. Initiate the peering connection between the two Transit Gateways in different regions. Update Route Tables: Configure the route tables associated with each Transit Gateway to allow traffic between the regions. Security Groups and Network ACLs: Adjust security groups and network ACLs to permit the necessary traffic flow. Connectivity Testing: Verify connectivity by testing communication between resources in different regions.

   Source: Adapted from community discussion — ca5e9ba

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

10. Question 380 · 527 in bank

    Select 2

    A company has multiple lines of business (LOBs) that roll up to the parent company. The company has asked its solutions architect to develop a solution with the following requirements: • Produce a single AWS invoice for all of the AWS accounts used by its LOBs. • The costs for each LOB account should be broken out on the invoice. • Provide the ability to restrict services and features in the LOB accounts, as defined by the company's governance policy. • Each LOB account should be delegated full administrator permissions, regardless of the governance policy. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

    • AUse AWS Organizations to create an organization in the parent account for each LOB. Then invite each LOB account to the appropriate organization.
    • BUse AWS Organizations to create a single organization in the parent account. Then, invite each LOB's AWS account to join the organization.
    • CImplement service quotas to define the services and features that are permitted and apply the quotas to each LOB. as appropriate.
    • DCreate an SCP that allows only approved services and features, then apply the policy to the LOB accounts.
    • EEnable consolidated billing in the parent account's billing console and link the LOB accounts.

    Show answer

    Answer: BD

    Explanation

    E: Is wrong --> Consolidated billing is already enabled by default when you create an organization B: obvious D: since there are no OUs, I assume that the SCP applies to each LOB account

    Source: Adapted from community discussion — 7f6aef3

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 371. 527 questions available.