SAP-C02 practice questions 451–460

1. Question 451 · 527 in bank

   Select 3

   A company is migrating its on-premises IoT platform to AWS. The platform consists of the following components: • A MongoDB cluster as a data store for all collected and processed IoT data. • An application that uses Message Queuing Telemetry Transport (MQTT) to connect to IoT devices every 5 minutes to collect data. • An application that runs jobs periodically to generate reports from the IoT data. The jobs take 120-600 seconds to finish running. • A web application that runs on a web server. End users use the web application to generate reports that are accessible to the general public. The company needs to migrate the platform to AWS to reduce operational overhead while maintaining performance. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose three.)

   • ACreate AWS Step Functions state machines with AUS Lambda tasks to prepare the reports and to write the reports to Amazon S3. Configure an Amazon CloudFront distribution that has an S3 origin to serve the reports
   • BCreate an AWS Lambda function. Program the Lambda function to connect to the IoT devices. process the data, and write the data to the data store. Configure a Lambda layer to temporarily store messages for processing.
   • CConfigure an Amazon Elastic Kubernetes Service (Amazon EKS) cluster with Amazon EC2 instances to prepare the reports. Create an ingress controller on the EKS cluster to serve the reports.
   • DConnect the IoT devices to AWS IoT Core to publish messages. Create an AWS IoT rule that runs when a message is received. Configure the rule to call an AWS Lambda function. Program the Lambda function to parse, transform, and store device message data to the data store.
   • EMigrate the MongoDB cluster to Amazon DocumentDB (with MongoDB compatibility).
   • FMigrate the MongoDB cluster to Amazon EC2 instances.

   Show answer

   Answer: ADE

   Explanation

   Step Functions and Lambda for Report Generation (A): AWS Step Functions and Lambda can manage the periodic jobs to generate reports with minimal operational overhead. By using Amazon S3 for storage and Amazon CloudFront for distribution, the solution provides scalability and reliability with minimal management. AWS IoT Core for MQTT Messaging (D): AWS IoT Core is a managed service that simplifies the connection and management of IoT devices. Using IoT rules and Lambda functions ensures efficient message processing and data storage with minimal overhead. Amazon DocumentDB for MongoDB Compatibility (E): Amazon DocumentDB is a managed database service compatible with MongoDB, which reduces the operational burden of managing a MongoDB cluster while maintaining performance and scalability.

   Source: Adapted from community discussion — awsaz

   Next question

2. Question 452 · 527 in bank

   A company creates an Amazon API Gateway API and shares the API with an external development team. The API uses AWS Lambda functions and is deployed to a stage that is named Production. The external development team is the sole consumer of the API. The API experiences sudden increases of usage at specific times, leading to concerns about increased costs. The company needs to limit cost and usage without reworking the Lambda functions. Which solution will meet these requirements MOST cost-effectively?

   • AConfigure the API to send requests to Amazon Simple Queue Service (Amazon SQS) queues instead of directly to the Lambda functions. Update the Lambda functions to consume messages from the queues and to process the requests. Set up the queues to invoke the Lambda functions when new messages arrive.
   • BConfigure provisioned concurrency for each Lambda function. Use AWS Application Auto Scaling to register the Lambda functions as targets. Set up scaling schedules to increase and decrease capacity to match changes in API usage.
   • CCreate an API Gateway API key and an AWS WAF Regional web ACL. Associate the web ACL with the Production stage. Add a rate-based rule to the web ACL. In the rule, specify the rate limit and a custom request aggregation that uses the X-API-Key header. Share the API key with the external development team.
   • DCreate an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team.

   Show answer

   Answer: D

   Explanation

   The most cost-effective solution to limit cost and usage for the API Gateway API with minimal code changes is: D. Create an API Gateway API Key and usage plan. Define throttling limits and quotas in the usage plan. Associate the usage plan with the Production stage and the API key. Share the API key with the external development team. Here's why this approach is most cost-effective: API Key and Usage Plan: This restricts access to the API only for the development team using the provided API key. The usage plan allows defining throttling limits (maximum requests per unit time) and quotas (total requests allowed) for the API key. This controls resource utilization and costs. Minimal Code Changes: No modifications are required to the existing Lambda functions, reducing development effort.

   Source: Adapted from community discussion — Chakanetsa

   References

   • AWS documentation

   Next question

3. Question 453 · 527 in bank

   An entertainment company hosts a ticketing service on a fleet of Linux Amazon EC2 instances that are in an Auto Scaling group. The ticketing service uses a pricing file. The pricing file is stored in an Amazon S3 bucket that has S3 Standard storage. A central pricing solution that is hosted by a third party updates the pricing file. The pricing file is updated every 1-15 minutes and has several thousand line items. The pricing file is downloaded to each EC2 instance when the instance launches. The EC2 instances occasionally use outdated pricing information that can result in incorrect charges for customers. Which solution will resolve this problem MOST cost-effectively?

   • ACreate an AWS Lambda function to update an Amazon DynamoDB table with new prices each time the pricing file is updated. Update the ticketing service to use DynramoDB to look up pricing
   • BCreate an AWS Lambda function to update an Amazon Elastic File System (Amazon EFS) file share with the pricing file each time the file is updated. Update the ticketing service to use Amazon EFS to access the pricing file.
   • CLoad Mountpoint for Amazon S3 onto the AMI of the EC2 instances. Configure Mountpoint for Amazon S3 to mount the S3 bucket that contains the pricing file. Update the ticketing service to point to the mount point and path to access the $3 object,
   • DCreate an Amazon Elastic Block Store (Amazon EBS) volume. Use EBS Multi-Attach to attach the volume to every EC2 instance. When a new EC2 instance launches, configure the new instance to update the pricing file on the EBS volume. Update the ticketing service to point to the new local source.

   Show answer

   Answer: C

   Explanation

   Mountpoint for Amazon S3: This solution allows the EC2 instances to directly access the S3 bucket as if it were a local file system. This ensures that the instances always access the latest version of the pricing file without having to download it each time. Cost-Effective: This approach avoids the need to constantly download and store the file on each instance, which can save on both S3 GET requests and local storage costs. Simplicity: By mounting the S3 bucket, you ensure that all instances are using the most current file without additional logic or processes to manage file updates.

   Source: Adapted from community discussion — awsaz

   References

   • AWS documentation

   Next question

4. Question 454 · 527 in bank

   A company has an application that uses Amazon EC2 instances in an Auto Scaling group. The quality assurance (QA) department needs to launch a large number of short-lived environments to test the application. The application environments are currently launched by the manager of the department using an AWS CloudFormation template. To launch the stack, the manager uses a role with permission to use CloudFormation, EC2, and Auto Scaling APIs. The manager wants to allow testers to launch their own environments, but does not want to grant broad permissions to each user. Which set up would achieve these goals?

   • AUpload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to assume the manager’s role and add a policy that restricts the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
   • BCreate an AWS Service Catalog product from the environment template. Add a launch constraint to the product with the existing role. Give users in the QA department permission to use AWS Service Catalog APIs only. Train users to launch the template from the AWS Service Catalog console.
   • CUpload the AWS CloudFormation template to Amazon S3. Give users in the QA department permission to use CloudFormation and S3 APIs, with conditions that restrict the permissions to the template and the resources it creates. Train users to launch the template from the CloudFormation console.
   • DCreate an AWS Elastic Beanstalk application from the environment template. Give users in the QA department permission to use Elastic Beanstalk permissions only. Train users to launch Elastic Beanstalk environments with the Elastic Beanstalk CLI, passing the existing role to the environment as a service role.

   Show answer

   Answer: B

   Next question

5. Question 455 · 527 in bank

   Select 3

   A company is using a single AWS Region for its ecommerce website. The website includes a web application that runs on several Amazon EC2 instances behind an Application Load Balancer (ALB). The website also includes an Amazon DynamoDB table. A custom domain name in Amazon Route 53 is linked to the ALB. The company created an SSL/TLS certificate in AWS Certificate Manager (ACM) and attached the certificate to the ALB. The company is not using a content delivery network as part of its design. The company wants to replicate its entire application stack in a second Region to provide disaster recovery, plan for future growth, and provide improved access time to users. A solutions architect needs to implement a solution that achieves these goals and minimizes administrative overhead. Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)

   • ACreate an AWS CloudFormation template for the current infrastructure design. Use parameters for important system values, including Region. Use the CloudFormation template to create the new infrastructure in the second Region.
   • BUse the AWS Management Console to document the existing infrastructure design in the first Region and to create the new infrastructure in the second Region.
   • CUpdate the Route 53 hosted zone record for the application to use weighted routing. Send 50% of the traffic to the ALB in each Region.
   • DUpdate the Route 53 hosted zone record for the application to use latency-based routing. Send traffic to the ALB in each Region.
   • EUpdate the configuration of the existing DynamoDB table by enabling DynamoDB Streams. Add the second Region to create a global table.
   • FCreate a new DynamoDB table. Enable DynamoDB Streams for the new table. Add the second Region to create a global table. Copy the data from the existing DynamoDB table to the new table as a one-time operation.

   Show answer

   Answer: ADE

   Next question

6. Question 456 · 527 in bank

   A health insurance company stores personally identifiable information (PII) in an Amazon S3 bucket. The company uses server-side encryption with S3 managed encryption keys (SSE-S3) to encrypt the objects. According to a new requirement, all current and future objects in the S3 bucket must be encrypted by keys that the company’s security team manages. The S3 bucket does not have versioning enabled. Which solution will meet these requirements?

   • AIn the S3 bucket properties, change the default encryption to SSE-S3 with a customer managed key. Use the AWS CLI to re-upload all objects in the S3 bucket. Set an S3 bucket policy to deny unencrypted PutObject requests.
   • BIn the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.
   • CIn the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to automatically encrypt objects on GetObject and PutObject requests.
   • DIn the S3 bucket properties, change the default encryption to AES-256 with a customer managed key. Attach a policy to deny unencrypted PutObject requests to any entities that access the S3 bucket. Use the AWS CLI to re-upload all objects in the S3 bucket.

   Show answer

   Answer: B

   Explanation

   https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html So the correct answer is B. In the S3 bucket properties, change the default encryption to server-side encryption with AWS KMS managed encryption keys (SSE-KMS). Set an S3 bucket policy to deny unencrypted PutObject requests. Use the AWS CLI to re-upload all objects in the S3 bucket.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 457 · 527 in bank

   Select 2

   A company wants to create a single Amazon S3 bucket for its data scientists to store work-related documents. The company uses AWS IAM Identity Center to authenticate all users. A group for the data scientists was created. The company wants to give the data scientists access to only their own work. The company also wants to create monthly reports that show which documents each user accessed. Which combination of steps will meet these requirements? (Choose two.)

   • ACreate a custom IAM Identity Center permission set to grant the data scientists access to an S3 bucket prefix that matches their username tag. Use a policy to limit access to paths with the ${aws:PrincipalTag/userName}/* condition.
   • BCreate an IAM Identity Center role for the data scientists group that has Amazon S3 read access and write access. Add an S3 bucket policy that allows access to the IAM Identity Center role.
   • CConfigure AWS CloudTrail to log S3 data events and deliver the logs to an S3 bucket. Use Amazon Athena to run queries on the CloudTrail logs in Amazon S3 and generate reports.
   • DConfigure AWS CloudTrail to log S3 management events to CloudWatch. Use Amazon Athena’s CloudWatch connector to query the logs and generate reports.
   • EEnable S3 access logging to EMR File System (EMRFS). Use Amazon S3 Select to query logs and generate reports.

   Show answer

   Answer: AC

   Explanation

   By combining a custom IAM Identity Center permission set with path-based access control and CloudTrail logging with Athena querying, the company can achieve the desired access control and reporting requirements for the data scientists' work-related documents stored in the S3 bucket. The other options are either incorrect or do not fully meet the requirements: B. Creating an IAM Identity Center role with S3 read and write access and adding an S3 bucket policy would not provide the granular access control required to restrict each user to their own work. D. Configuring CloudTrail to log S3 management events to CloudWatch and using Athena's CloudWatch connector would not capture the necessary data events for generating reports on which documents each user accessed. E. Enabling S3 access logging to EMRFS and using S3 Select would not provide the necessary logging and reporting capabilities for this use case.

   Source: Adapted from community discussion — 0b43291

   Next question

8. Question 458 · 527 in bank

   A company hosts a data-processing application on Amazon EC2 instances. The application polls an Amazon Elastic File System (Amazon EFS) file system for newly uploaded files. When a new file is detected, the application extracts data from the file and runs logic to select a Docker container image to process the file. The application starts the appropriate container image and passes the file location as a parameter. The data processing that the container performs can take up to 2 hours. When the processing is complete, the code that runs inside the container writes the file back to Amazon EFS and exits. The company needs to refactor the application to eliminate the EC2 instances that are running the containers. Which solution will meet these requirements?

   • ACreate an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Extract the container selection logic to run as an Amazon EventBridge rule that starts the appropriate Fargate task. Configure the EventBridge rule to run when files are added to the EFS file system.
   • BCreate an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Update and containerize the container selection logic to run as a Fargate service that starts the appropriate Fargate task. Configure an EFS event notification to invoke the Fargate service when files are added to the EFS file system.
   • CCreate an Amazon Elastic Container Service (Amazon ECS) cluster. Configure the processing to run as AWS Fargate tasks. Extract the container selection logic to run as an AWS Lambda function that starts the appropriate Fargate task. Migrate the storage of file uploads to an Amazon S3 bucket. Update the processing code to use Amazon S3. Configure an S3 event notification to invoke the Lambda function when objects are created.
   • DCreate AWS Lambda container images for the processing. Configure Lambda functions to use the container images. Extract the container selection logic to run as a decision Lambda function that invokes the appropriate Lambda processing function. Migrate the storage of file uploads to an Amazon S3 bucket. Update the processing code to use Amazon S3. Configure an S3 event notification to invoke the decision Lambda function when objects are created.

   Show answer

   Answer: C

   Explanation

   By combining Amazon ECS with Fargate tasks, AWS Lambda for the container selection logic, and Amazon S3 for event-driven processing, Option C provides a serverless and scalable solution that meets the requirements while minimizing the need for EC2 instances and leveraging the strengths of each AWS service. While this solution requires migrating the file storage from Amazon EFS to Amazon S3, it addresses the requirement of eliminating EC2 instances by leveraging AWS Fargate for the processing tasks and AWS Lambda for the container selection logic. Additionally, it utilizes the event notification capabilities of Amazon S3 to trigger the Lambda function when new files are uploaded. The other options are either not feasible due to the limitations of Amazon EFS (Options A and B) or introduce additional constraints by using AWS Lambda for the long-running data processing tasks (Option D).

   Source: Adapted from community discussion — 0b43291

   Next question

9. Question 459 · 527 in bank

   A media company has a 30-T8 repository of digital news videos. These videos are stored on tape in an on-premises tape library and referenced by a Media Asset Management (MAM) system. The company wants to enrich the metadata for these videos in an automated fashion and put them into a searchable catalog by using a MAM feature. The company must be able to search based on information in the video, such as objects, scenery items, or people’s faces. A catalog is available that contains faces of people who have appeared in the videos that include an image of each person. The company would like to migrate these videos to AWS. The company has a high-speed AWS Direct Connect connection with AWS and would like to move the MAM solution video content directly from its current file system. How can these requirements be met by using the LEAST amount of ongoing management overhead and causing MINIMAL disruption to the existing system?

   • ASet up an AWS Storage Gateway, file gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the file gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Rekognition pull the video from the Amazon S3 files backing the file gateway, retrieve the required metadata, and push the metadata into the MAM solution.
   • BSet up an AWS Storage Gateway, tape gateway appliance on-premises. Use the MAM solution to extract the videos from the current archive and push them into the tape gateway. Use the catalog of faces to build a collection in Amazon Rekognition. Build an AWS Lambda function that invokes the Rekognition Javascript SDK to have Amazon Rekognition process the video in the tape gateway, retrieve the required metadata, and push the metadata into the MAM solution.
   • CConfigure a video ingestion stream by using Amazon Kinesis Video Streams. Use the catalog of faces to build a collection in Amazon Rekognition. Stream the videos from the MAM solution into Kinesis Video Streams. Configure Amazon Rekognition to process the streamed videos. Then, use a stream consumer to retrieve the required metadata, and push the metadata into the MAM solution. Configure the stream to store the videos in Amazon S3.
   • DSet up an Amazon EC2 instance that runs the OpenCV libraries. Copy the videos, images, and face catalog from the on-premises library into an Amazon EBS volume mounted on this EC2 instance. Process the videos to retrieve the required metadata, and push the metadata into the MAM solution, while also copying the video files to an Amazon S3 bucket.

   Show answer

   Answer: A

   Explanation

   AWS Rekognition is capable of processing both images and videos from the following sources: Amazon S3, directly passed images, Kinesis Video Streams. Although option C mentions Kinesis Video Streams, it would be an overkill for a scenario where videos are not being streamed in real time, and it introduces unnecessary complexity. So the solution using the LEAST amount of ongoing management overhead and causing MINIMAL disruption to the existing system is A.

   Source: Adapted from community discussion — JoeTromundo

   References

   • AWS documentation

   Next question

10. Question 460 · 527 in bank

    A company needs to optimize the cost of an AWS environment that contains multiple accounts in an organization in AWS Organizations. The company conducted cost optimization activities 3 years ago and purchased Amazon EC2 Standard Reserved Instances that recently expired. The company needs EC2 instances for 3 more years. Additionally, the company has deployed a new serverless workload. Which strategy will provide the company with the MOST cost savings?

    • APurchase the same Reserved Instances for an additional 3-year term with All Upfront payment. Purchase a 3-year Compute Savings Plan with All Upfront payment in the management account to cover any additional compute costs
    • BPurchase a 1-year Compute Savings Plan with No Upfront payment in each member account. Use the Savings Plans recommendations in the AWS Cost Management console to choose the Compute Savings Plan.
    • CPurchase a 3-year EC2 Instance Savings Plan with No Upfront payment in the management account to cover EC2 costs in each AWS Region. Purchase a 3-year Compute Savings Plan with No Upfront payment in the management account to cover any additional compute costs.
    • DPurchase a 3-year EC2 Instance Savings Plan with All Upfront payment in each member account. Use the Savings Plans recommendations in the AWS Cost Management console to choose the EC2 Instance Savings Plan.

    Show answer

    Answer: A

    Explanation

    Since there are no special requirements in the problem statement other than cost (e.g., workload consistency, specific instance size, future changes), simply select the least expensive plan. Compared to on-demand instances, Reserved Instances (RI) offer discounts of up to 75%, Compute Savings Plans up to 66%, and EC2 Instance Savings Plans up to 72%. In each case, the higher the upfront payment, the greater the discount.

    Source: Adapted from community discussion — 053081f

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 451. 527 questions available.