SAP-C02 practice questions 461–470

1. Question 461 · 527 in bank

   Select 2

   A company operates a static content distribution platform that serves customers globally. The customers consume content from their own AWS accounts. The company serves its content from an Amazon S3 bucket. The company uploads the content from its on-premises environment to the S3 bucket by using an S3 File Gateway. The company wants to improve the platform’s performance and reliability by serving content from the AWS Region that is geographically closest to customers. The company must route the on-premises data to Amazon S3 with minimal latency and without public internet exposure. Which combination of steps will meet these requirements with the LEAST operational overhead? (Choose two.)

   • AImplement S3 Multi-Region Access Points
   • BUse S3 Cross-Region Replication (CRR) to copy content to different Regions
   • CCreate an AWS Lambda function that tracks the routing of clients to Regions
   • DUse an AWS Site-to-Site VPN connection to connect to a Multi-Region Access Point.
   • EUse AWS PrivateLink and AWS Direct Connect to connect to a Multi-Region Access Point.

   Show answer

   Answer: AE

   Explanation

   The company wants to improve the platform’s performance and reliability by serving content from the AWS Region that is geographically closest to customers: s3 multi region access point. (A) The company must route the on-premises data to Amazon S3 with minimal latency and without public internet exposure: PrivateLink and Direct Connect to the MRAP. (E)

   Source: Adapted from community discussion — Daniel76

   Next question

2. Question 462 · 527 in bank

   A company is migrating its data center to the AWS Cloud and needs to complete the migration as quickly as possible. The company has many applications that are running on hundreds of VMware VMs in the data center. Each VM is configured with a shared Windows folder that contains common shared files. The file share is larger than 100 GB in size. The company’s compliance team requires a change request to be fled and approved for every software installation and modification to each VM. The company has an AWS Direct Connect connection with 10 GB of bandwidth between AWS and the data center. Which set of steps should the company take to complete the migration in the LEAST amount of time?

   • AUse VM ImporvExport to create images of each VM. Use AWS Application Migration Service to manage and view the images. Copy the Windows file share data to an Amazon Elastic File System (Amazon EFS) file system. After migration, remap the file share to the EFS file system.
   • BDeploy the AWS Application Discovery Service agentless appliance to VMware vCenter. Review the portfolio of discovered VMs in AWS Migration Hub.
   • CDeploy the AWS Application Migration Service agentless appliance to VMware vCenter. Copy the Windows file share data to a new Amazon FSx for Windows File Server file system. After migration, remap the file share on each VM to the FSx for Windows File Server file system. C. Create and review a portfolio in AWS Migration Hub. Order an AWS Snowcone device. Deploy AWS Application Migration Service to VMware vCenter and export all the VMs to the Snowcone device. Copy all Windows file share data to the Snowcone device. Ship the Snowcone device to AWS. Use Application Migration Service to deploy all the migrated instances.
   • DDeploy the AWS Application Discovery Service Agent and the AWS Application Migration Service Agent onto each VMware hypervisor directly. Review the portfolio in AWS Migration Hub. Copy each VM’s file share data to a new Amazon FSx for Windows File Server file system. After migration, remap the file share on each VM to the FSx for Windows File Server file system.

   Show answer

   Answer: C

   Explanation

   C1 is correct. The AWS Application Migration Service (AMS) agentless appliance can quickly be deployed into the VMware environment via VMware vCenter. It simplifies migration by eliminating the need for installing agents on each individual VM, reducing time and complexity. Because AMS is agentless, you don’t need to install additional software on the VMs themselves, which aligns with the company's requirement to file and approve change requests for any software installation or modifications on VMs. By copying the shared Windows folder to Amazon FSx for Windows File Server, the company can maintain a native Windows environment for file sharing. After migration, it will be easy to remap the file share from the VMs to the new FSx file system, which minimizes disruptions and downtime.

   Source: Adapted from community discussion — JoeTromundo

   Next question

3. Question 463 · 527 in bank

   A company has multiple AWS accounts that are in an organization in AWS Organizations. The company needs to store AWS account activity and query the data from a central location by using SQL. Which solution will meet these requirements?

   • ACreate an AWS CloudTraii trail in each account. Specify CloudTrail management events for the trail. Configure CloudTrail to send the events to Amazon CloudWatch Logs. Configure CloudWatch cross-account observability. Query the data in CloudWatch Logs Insights.
   • BUse a delegated administrator account to create an AWS CloudTrail Lake data store. Specify CloudTrail management events for the data store. Enable the data store for all accounts in the organization. Query the data in CloudTrail Lake.
   • CUse a delegated administrator account to create an AWS CloudTral trail. Specify CloudTrail management events for the trail. Enable the trail for all accounts in the organization. Keep all other settings as default. Query the CloudTrail data from the CloudTrail event history page.
   • DUse AWS CloudFormation StackSets to deploy AWS CloudTrail Lake data stores in each account. Specify CloudTrail management events for the data stores. Keep all other settings as default, Query the data in CloudTrail Lake.

   Show answer

   Answer: B

   Explanation

   By leveraging AWS CloudTrail Lake and a delegated administrator account in AWS Organizations, Option B provides a centralized and managed solution for ingesting, storing, and querying AWS account activity using SQL, meeting the company's requirements efficiently. The other options have drawbacks or do not fully meet the requirements: Option A: While it uses CloudWatch Logs and CloudWatch Logs Insights, it requires creating and managing CloudTrail trails in each account, which can be more complex and less centralized than using CloudTrail Lake. Option C: This option suggests using the CloudTrail event history page for querying, which does not provide the SQL querying capabilities required by the company. Additionally, it may not offer the same level of centralization and advanced analytics as CloudTrail Lake. Option D: While it uses CloudTrail Lake, deploying data stores in each account using CloudFormation StackSets can be more complex and less centralized than using a delegated administrator account to manage the data store for all accounts.

   Source: Adapted from community discussion — 0b43291

   References

   • AWS documentation

   Next question

4. Question 464 · 527 in bank

   A company is using AWS to develop and manage its production web application. The application includes an Amazon API Gateway HTTP API that invokes an AWS Lambda function. The Lambda function processes and then stores data in a database. The company wants to implement user authorization for the web application in an integrated way. The company already uses a third-party identity provider that issues OAuth tokens for the company’s other applications. Which solution will meet these requirements?

   • AIntegrate the company’s third-party identity provider with API Gateway. Configure an API Gateway Lambda authorizer to validate tokens from the identity provider. Require the Lambda authorizer on all API routes. Update the web application to get tokens from the identity provider and include the tokens in the Authorization header when calling the API Gateway HTTP API.
   • BIntegrate the company's third-party identity provider with AWS Directory Service. Configure Directory Service as an API Gateway authorizer to validate tokens from the identity provider. Require the Directory Service authorizer on all API routes. Configure AWS IAM Identity Center as a SAML 2.0 identity Provider. Configure the web application as a custom SAML 2.0 application.
   • CIntegrate the company’s third-party identity provider with AWS IAM Identity Center. Configure API Gateway to use IAM Identity Center for zero-configuration authentication and authorization. Update the web application to retrieve AWS Security Token Service (AWS STS) tokens from IAM Identity Center and include the tokens in the Authorization header when calling the API Gateway HTTP API.
   • DIntegrate the company’s third-party identity provider with AWS IAM Identity Center. Configure IAM users with permissions to call the API Gateway HTTP API. Update the web application to extract request parameters from the IAM users and include the parameters in the Authorization header when calling the API Gateway HTTP API.

   Show answer

   Answer: A

   Explanation

   By integrating the third-party identity provider with API Gateway and using a Lambda authorizer to validate OAuth tokens, Option A provides a seamless and integrated solution for user authorization in the web application, while leveraging the company's existing identity management infrastructure. The other options have drawbacks or do not fully meet the requirements: Option B: Integrating with AWS Directory Service and configuring it as an API Gateway authorizer may be unnecessary since the company already has a third-party identity provider. Option C: Requiring the web application to retrieve AWS STS tokens may be unnecessary since the company already has OAuth tokens issued by the third-party identity provider. Option D: Creating IAM users and extracting request parameters can be more complex and may not leverage the existing third-party identity provider and OAuth token issuance process.

   Source: Adapted from community discussion — 0b43291

   References

   • AWS documentation

   Next question

5. Question 465 · 527 in bank

   A company has deployed applications to thousands of Amazon EC2 instances in an AWS account. A security audit discovers that several unencrypted Amazon Elastic Block Store (Amazon EBS) volumes are attached to the EC2 instances. The company’s security policy requires the EBS volumes to be encrypted. The company needs to implement an automated solution to encrypt the EBS volumes. The solution also must prevent development teams from creating unencrypted EBS volumes. Which solution will meet these requirements?

   • AConfigure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an automatic remediation action. Associate an AWS Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Create an AWS Key Management Service (AWS KMS) customer managed key. In the key policy, include a statement to deny the creation of unencrypted EBS volumes.
   • BUse AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes, Create a Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Create an SCP to deny the creation of unencrypted EBS volumes.
   • CUse AWS Systems Manager Fleet Manager to create a list of unencrypted EBS volumes. Create a Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Modify the AWS account setting for EBS encryption to always encrypt new EBS volumes.
   • DConfigure the AWS Config managed rule that identifies unencrypted EBS volumes. Configure an automatic remediation action. Associate an AWS Systems Manager Automation runbook that includes the steps to create a new encrypted EBS volume. Modify the AWS account setting for EBS encryption to always encrypt new EBS volumes.

   Show answer

   Answer: D

   Explanation

   https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/automatically-encrypt-existing-and-new-amazon-ebs-volumes.html 1. Use AWS Config to detects an unencrypted EBS volume. Not fleet manager. B and C out. 2. System manager runbook is the automation that create encrypted copy of the EBS snapshot and replace the encrypted EBS with the encrypted copy. The KMS is used for the encryption and it cannot be used to deny creation of unencrypted EBS volume (A is out).

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation

   Next question

6. Question 466 · 527 in bank

   A company is running a large containerized workload in the AWS Cloud. The workload consists of approximately 100 different services. The company uses Amazon Elastic Container Service (Amazon ECS) to orchestrate the workload. Recently the company’s development team started using AWS Fargate instead of Amazon EC2 instances in the ECS cluster. In the past, the workload has come close to running the maximum number of EC2 instances that are available in the account. The company is worried that the workload could reach the maximum number of ECS tasks that are allowed. A solutions architect must implement a solution that will notify the development team when Fargate reaches 80% of the maximum number of tasks. What should the solutions architect do to meet this requirement?

   • AUse Amazon CloudWatch to monitor the Sample Count statistic for each service in the ECS cluster. Set an alarm for when the math expression sample count/SERVICE_QUOTA(service)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
   • BUse Amazon CloudWatch to monitor service quotas that are published under the AWS/Usage metric namespace. Set an alarm for when the math expression metric/SERVICE_QUOTA(metric)*100 is greater than 80. Notify the development team by using Amazon Simple Notification Service (Amazon SNS).
   • CCreate an AWS Lambda function to poll detailed metrics from the ECS cluster. When the number of running Fargate tasks is greater than 80, invoke Amazon Simple Email Service (Amazon SES) to notify the development team.
   • DCreate an AWS Config rule to evaluate whether the Fargate SERVICE_QUOTA is greater than 80. Use Amazon Simple Email Service (Amazon SES) to notify the development team when the AWS Config rule is not compliant.

   Show answer

   Answer: B

   Explanation

   Why this is the correct choice: AWS/Usage metric namespace: This namespace provides detailed metrics for service usage and quotas, including the number of running ECS Fargate tasks. You can use this data to monitor how close you are to the service quotas. Service quota monitoring: The math expression metric/SERVICE_QUOTA(metric)*100 allows you to calculate the percentage of the quota being used, making it easy to set an alarm when usage reaches 80%. CloudWatch Alarm: This is a native and efficient way to monitor service usage, and you can easily configure notifications via Amazon SNS to alert the development team when the threshold is crossed.

   Source: Adapted from community discussion — Chakanetsa

   References

   • AWS documentation

   Next question

7. Question 467 · 527 in bank

   A company is running a web application in the AWS Cloud. The application consists of dynamic content that is created on a set of Amazon EC2 instances. The EC2 instances run in an Auto Scaling group that is configured as a target group for an Application Load Balancer (ALB). The company is using an Amazon CloudFront distribution to distribute the application globally. The CloudFront distribution uses the ALB as an origin. The company uses Amazon Route 53 for DNS and has created an A record of www.example.com for the CloudFront distribution. A solutions architect must configure the application so that itis highly available and fault tolerant. Which solution meets these requirements?

   • AProvision a full, secondary application deployment in a different AWS Region. Update the Route 53 A record to be a failover record. Add both of the CloudFront distributions as values. Create Route 53 health checks.
   • BProvision an ALB, an Auto Scaling group, and EC2 instances in a different AWS Region. Update the CloudFront distribution, and create a second origin for the new ALCreate an origin group for the two origins. Configure one origin as primary and one origin as secondary.
   • CProvision an Auto Scaling group and EC2 instances in a different AWS Region. Create a second target for the new Auto Scaling group in the ALB. Set up the failover routing algorithm on the ALB.
   • DProvision a full, secondary application deployment in a different AWS Region. Create a second CloudFront distribution, and add the new application setup as an origin. Create an AWS Global Accelerator accelerator. Add both of the CloudFront distributions as endpoints.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Provisioning an ALB, an Auto Scaling group, and EC2 instances in a different AWS region provides redundancy and failover capability for the application. By creating a second origin for the new ALB in the second region, the CloudFront distribution can automatically route traffic to the healthy origin in case of an issue with the primary origin. This ensures that the application remains highly available and fault-tolerant. Option A is not correct because it uses Route 53 failover records, which can result in increased latency and DNS resolution time for clients. Option C is not correct because it doesn't provide redundancy for the load balancer, which is a critical component of the application. Option D is not correct because it does not provide redundancy for the application in case of an issue with the primary origin in the first region.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation

   Next question

8. Question 468 · 527 in bank

   Select 3

   A company has several AWS Lambda functions written in Python. The functions are deployed with the .zip package deployment type. The functions use a Lambda layer that contains common libraries and packages in a .zip file. The Lambda .zip packages and Lambda layer .zip file are stored in an Amazon S3 bucket. The company must implement automatic scanning of the Lambda functions and the Lambda layer to identify CVEs. A subset of the Lambda functions must receive automated code scans to detect potential data leaks and other vulnerabilities. The code scans must occur only for selected Lambda functions, not all the Lambda functions. Which combination of actions will meet these requirements? (Choose three.)

   • AActivate Amazon Inspector. Start automated CVE scans.
   • BActivate Lambda standard scanning and Lambda code scanning in Amazon Inspector.
   • CEnable Amazon GuardDuty. Enable the Lambda Protection feature in GuardDuty.
   • DEnable scanning in the Monitor settings of the Lambda functions that need code scans.
   • ETag Lambda functions that do not need code scans. In the tag, include a key of InspectorCodeExclusion and a value of LambdaCodeScanning.
   • FUse Amazon Inspector to scan the 3 bucket that contains the Lambda .zip packages and the Lambda layer .zip file for code scans.

   Show answer

   Answer: ABE

   Explanation

   A: Amazon Inspector can automatically scan your Lambda functions for known vulnerabilities (CVEs) in the dependencies of the functions. This action will initiate the security scanning of Lambda functions and Lambda layers to detect vulnerabilities. B: Amazon Inspector provides enhanced scanning features for Lambda functions. This includes both standard scanning (for CVEs in dependencies and layers) and code scanning (for potential vulnerabilities, like data leaks, directly in the code). E: https://docs.aws.amazon.com/lambda/latest/dg/governance-code-scanning.html#:~:text=To%20exclude%20a%20Lambda%20function,Value%3ALambdaStandardScanning. "To exclude a Lambda function from code scans, tag the function with the following key-value pair: Key:InspectorCodeExclusion Value:LambdaCodeScanning"

   Source: Adapted from community discussion — JoeTromundo

   References

   • AWS documentation
   • AWS documentation

   Next question

9. Question 469 · 527 in bank

   A company is changing the way that it handles patching of Amazon EC2 instances in its application account. The company currently patches instances over the internet by using a NAT gateway in a VPC in the application account. The company has EC2 instances set up as a patch source repository in a dedicated private VPC in a core account. The company wants to use AWS Systems Manager Patch Manager and the patch source repository in the core account to patch the EC2 instances in the application account. The company must prevent all EC2 instances in the application account from accessing the internet. The EC2 instances in the application account need to access Amazon S3, where the application data is stored. These EC2 instances need connectivity to Systems Manager and to the patch source repository in the private VPC in the core account. Which solution will meet these requirements?

   • ACreate a network ACL that blocks outbound traffic on port 80. Associate the network ACL with all subnets in the application account. In the application account and the core account, deploy one EC2 instance that runs a custom VPN server. Create a VPN tunnel to access the private VPC. Update the route table in the application account.
   • BCreate private VIFs for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route table in the core account.
   • CCreate VPC endpoints for Systems Manager and Amazon S3. Delete the NAT gateway from the VPC in the application account. Create a VPC peering connection to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.
   • DCreate a network ACL that blocks inbound traffic on port 80. Associate the network ACL with all subnets in the application account. Create a transit gateway to access the patch source repository EC2 instances in the core account. Update the route tables in both accounts.

   Show answer

   Answer: C

   Explanation

   Aftee delete NAT gateway theres no need to block outbound port 80. Use vpc interface endpoint to keep traffic private. https://docs.aws.amazon.com/systems-manager/latest/userguide/setup-create-vpc.html

   Source: Adapted from community discussion — Daniel76

   References

   • AWS documentation

   Next question

10. Question 470 · 527 in bank

    A company in the United States (US) has acquired a company in Europe. Both companies use the AWS Cloud. The US company has built a new application with a microservices architecture. The US company is hosting the application across five VPCs in the us-east-2 Region. The application must be able to access resources in one VPC in the eu-west-1 Region. However, the application must not be able to access any other VPCs. The VPCs in both Regions have no overlapping CIDR ranges. All accounts are already consolidated in one organization in AWS Organizations. Which solution will meet these requirements MOST cost-effectively?

    • ACreate one transit gateway in eu-west-1. Attach the VPCs in us-east-2 and the VPC in eu-west-1 to the transit gateway. Create the necessary route entries in each VPC so that the traffic is routed through the transit gateway.
    • BCreate one transit gateway in each Region. Attach the involved subnets to the regional transit gateway. Create the necessary route entries in the associated route tables for each subnet so that the traffic is routed through the regional transit gateway. Peer the two transit gateways.
    • CCreate a full mesh VPC peering connection configuration between all the VPCs. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.
    • DCreate one VPC peering connection for each VPC in us-east-2 to the VPC in eu-west-1. Create the necessary route entries in each VPC so that the traffic is routed through the VPC peering connection.

    Show answer

    Answer: D

    Explanation

    VPC peer-to-peer connection is a free service in AWS used for communication between VPCs. AWS's Transit Gateway is mainly used for connecting across multiple VPCs or accounts and does not directly support cross regional VPC connections.

    Source: Adapted from community discussion — liuliangzhou

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 461. 527 questions available.