SAP-C02 practice questions 481–490

1. Question 481 · 527 in bank

   An AWS customer has a web application that runs on premises. The web application fetches data from a third-party API that is behind a firewall. The third party accepts only one public CIDR block in each client’s allow list. The customer wants to migrate their web application to the AWS Cloud. The application will be hosted on a set of Amazon EC2 instances behind an Application Load Balancer (ALB) in a VPC. The ALB is located in public subnets. The EC2 instances are located in private subnets. NAT gateways provide internet access to the private subnets. How should a solutions architect ensure that the web application can continue to call the third-party API after the migration?

   • AAssociate a block of customer-owned public IP addresses to the VPC. Enable public IP addressing for public subnets in the VPC.
   • BRegister a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC.
   • CCreate Elastic IP addresses from the block of customer-owned IP addresses. Assign the static Elastic IP addresses to the ALB.
   • DRegister a block of customer-owned public IP addresses in the AWS account. Set up AWS Global Accelerator to use Elastic IP addresses from the address block. Set the ALB as the accelerator endpoint.

   Show answer

   Answer: B

   Explanation

   The correct solution is B. Register a block of customer-owned public IP addresses in the AWS account. Create Elastic IP addresses from the address block and assign them to the NAT gateways in the VPC. This will ensure that the web application can continue to call the third-party API after the migration by using the customer-owned public IP addresses that were assigned to the NAT gateways. This ensures that the third-party API will only see traffic coming from the customer-owned IP addresses that are on the allow list. Option A,C and D doesn't make sense in this context.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation

   Next question

2. Question 482 · 527 in bank

   A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS account 1111-1111-1111:

   

   Developers working in account 1111-1111-1111 complain that they cannot create Amazon S3 buckets. How should the administrator address this problem?

   • AAdd s3:CreateBucket with “Allow” effect to the SCP.
   • BRemove the account from the OU, and attach the SCP directly to account 1111-1111-1111.
   • CInstruct the developers to add Amazon S3 permissions to their IAM entities.
   • DRemove the SCP from account 1111-1111-1111.

   Show answer

   Answer: C

   Explanation

   SCPs alone are not sufficient to granting permissions to the accounts in your organization. No permissions are granted by an SCP. An SCP defines a guardrail, or sets limits, on the actions that the account's administrator can delegate to the IAM users and roles in the affected accounts. The administrator must still attach identity-based or resource-based policies to IAM users or roles, or to the resources in your accounts to actually grant permissions. The effective permissions are the logical intersection between what is allowed by the SCP and what is allowed by the IAM and resource-based policies.

   Source: Adapted from community discussion — c73bf38

   Next question

3. Question 483 · 527 in bank

   A company has a monolithic application that is critical to the company’s business. The company hosts the application on an Amazon EC2 instance that runs Amazon Linux 2. The company’s application team receives a directive from the legal department to back up the data from the instance’s encrypted Amazon Elastic Block Store (Amazon EBS) volume to an Amazon S3 bucket. The application team does not have the administrative SSH key pair for the instance. The application must continue to serve the users. Which solution will meet these requirements?

   • AAttach a role to the instance with permission to write to Amazon S3. Use the AWS Systems Manager Session Manager option to gain access to the instance and run commands to copy data into Amazon S3.
   • BCreate an image of the instance with the reboot option turned on. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.
   • CTake a snapshot of the EBS volume by using Amazon Data Lifecycle Manager (Amazon DLM). Copy the data to Amazon S3.
   • DCreate an image of the instance. Launch a new EC2 instance from the image. Attach a role to the new instance with permission to write to Amazon S3. Run a command to copy data into Amazon S3.

   Show answer

   Answer: A

   Explanation

   Not B and D. because when you create an image of the instance, by default Amazon EC2 shuts down the instance, takes snapshots of any attached volumes, creates AMI, and then reboots the instance. This breaks the requirement to keep the app running https://docs.aws.amazon.com/toolkit-for-visual-studio/latest/user-guide/tkv-create-ami-from-instance.html Not C. Because EBS snapshots taken by DLM are stored on S3 that is not accessible from users. also you cannot copy snapshots to S3 (you can copy across regions and across accounts, but still in S3 not accessible from users) https://repost.aws/knowledge-center/ebs-copy-snapshot-data-s3-create-volume A does the job, this is not very clean options as to properly run commands via SSM we need SSM Agents installed (this is in the scenario as Amazon Linux 2 comes with the agent) and IAM Role with SSM permission and this specific point is not stated in the scenario.

   Source: Adapted from community discussion — ninomfr64

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

4. Question 484 · 527 in bank

   Select 3

   A solutions architect needs to copy data from an Amazon S3 bucket m an AWS account to a new S3 bucket in a new AWS account. The solutions architect must implement a solution that uses the AWS CLI. Which combination of steps will successfully copy the data? (Choose three.)

   • ACreate a bucket policy to allow the source bucket to list its contents and to put objects and set object ACLs in the destination bucket. Attach the bucket policy to the destination bucket.
   • BCreate a bucket policy to allow a user in the destination account to list the source bucket’s contents and read the source bucket’s objects. Attach the bucket policy to the source bucket.
   • CCreate an IAM policy in the source account. Configure the policy to allow a user in the source account to list contents and get objects in the source bucket, and to list contents, put objects, and set object ACLs in the destination bucket. Attach the policy to the user.
   • DCreate an IAM policy in the destination account. Configure the policy to allow a user in the destination account to list contents and get objects in the source bucket, and to list contents, put objects, and set objectACLs in the destination bucket. Attach the policy to the user.
   • ERun the aws s3 sync command as a user in the source account. Specify the source and destination buckets to copy the data.
   • FRun the aws s3 sync command as a user in the destination account. Specify the source and destination buckets to copy the data.

   Show answer

   Answer: BDF

   Explanation

   "The above command should be executed with destination AWS IAM user account credentials only otherwise the copied objects in destination S3 bucket will still have the source account permissions and won’t be accessible by destination account users." According to https://medium.com/tensult/copy-s3-bucket-objects-across-aws-accounts-e46c15c4b9e1.

   Source: Adapted from community discussion — icassp

   References

   • AWS documentation
   • repost.aws documentation
   • AWS documentation
   • AWS documentation

   Next question

5. Question 485 · 527 in bank

   A retail company needs to provide a series of data files to another company, which is its business partner. These files are saved in an Amazon S3 bucket under Account A, which belongs to the retail company. The business partner company wants one of its IAM users, User_DataProcessor, to access the files from its own AWS account (Account B). Which combination of steps must the companies take so that User_DataProcessor can access the S3 bucket successfully? (Choose two.)

   • ATurn on the cross-origin resource sharing (CORS) feature for the S3 bucket in Account A.
   • BIn Account A, set the S3 bucket policy to the following:
   • CIn Account A, set the S3 bucket policy to the following:
   • DIn Account B, set the permissions of User_DataProcessor to the following:
   • EIn Account B, set the permissions of User_DataProcessor to the following:

   Show answer

   Answer: C

   Explanation

   C & D To allow User_DataProcessor to access the S3 bucket from Account B, the following steps need to be taken: In Account A, set the S3 bucket policy to allow access to the bucket from the IAM user in Account B. This is done by adding a statement to the bucket policy that allows the IAM user in Account B to perform the necessary actions (GetObject and ListBucket) on the bucket and its contents. In Account B, create an IAM policy that allows the IAM user (User_DataProcessor) to perform the necessary actions (GetObject and ListBucket) on the S3 bucket and its contents. The policy should reference the ARN of the S3 bucket and the actions that the user is allowed to perform. Note: turning on the cross-origin resource sharing (CORS) feature for the S3 bucket in Account A is not necessary for this scenario as it is typically used for allowing web browsers to access resources from different domains.

   Source: Adapted from community discussion — higashikumi

   References

   • AWS documentation
   • AWS documentation
   • repost.aws documentation

   Next question

6. Question 486 · 527 in bank

   A company built an application based on AWS Lambda deployed in an AWS CloudFormation stack. The last production release of the web application introduced an issue that resulted in an outage lasting several minutes. A solutions architect must adjust the deployment process to support a canary release. Which solution will meet these requirements?

   • ACreate an alias for every new deployed version of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load.
   • BDeploy the application into a new CloudFormation stack. Use an Amazon Route 53 weighted routing policy to distribute the load.
   • CCreate a version for every new deployed Lambda function. Use the AWS CLI update-function-configuration command with the routing-config parameter to distribute the load.
   • DConfigure AWS CodeDeploy and use CodeDeployDefault.OneAtATime in the Deployment configuration to distribute the load.

   Show answer

   Answer: A

   Explanation

   A. Create an alias for every new deployed version of the Lambda function. Use the AWS CLI update-alias command with the routing-config parameter to distribute the load is the correct answer as it meets the requirement of supporting a canary release. Option B is not correct because while it would allow for a canary release, it would involve deploying the new version of the application into a separate CloudFormation stack, which would be a more complex and time-consuming process compared to creating an alias for a new version of the Lambda function. Option C is not correct because while it would allow for a canary release, it would involve creating a version for every new deployed Lambda function, which would be more complex and time-consuming process compared to creating an alias for a new version of the Lambda function.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

7. Question 487 · 527 in bank

   A finance company hosts a data lake in Amazon S3. The company receives financial data records over SFTP each night from several third parties. The company runs its own SFTP server on an Amazon EC2 instance in a public subnet of a VPC. After the files are uploaded, they are moved to the data lake by a cron job that runs on the same instance. The SFTP server is reachable on DNS sftp.example.com through the use of Amazon Route 53. What should a solutions architect do to improve the reliability and scalability of the SFTP solution?

   • AMove the EC2 instance into an Auto Scaling group. Place the EC2 instance behind an Application Load Balancer (ALB). Update the DNS record sftp.example.com in Route 53 to point to the ALB.
   • BMigrate the SFTP server to AWS Transfer for SFTP. Update the DNS record sftp.example.com in Route 53 to point to the server endpoint hostname.
   • CMigrate the SFTP server to a file gateway in AWS Storage Gateway. Update the DNS record sftp.example.com in Route 53 to point to the file gateway endpoint.
   • DPlace the EC2 instance behind a Network Load Balancer (NLB). Update the DNS record sftp.example.com in Route 53 to point to the NLB.

   Show answer

   Answer: B

   Explanation

   A=ALB cannot be used with SFTP B = Correct C=Storage Gateway is not an SFTP Server D=NLB can be used with SFTP, but EC2 is single

   Source: Adapted from community discussion — tinyflame

   Next question

8. Question 488 · 527 in bank

   A company wants to migrate an application to Amazon EC2 from VMware Infrastructure that runs in an on-premises data center. A solutions architect must preserve the software and configuration settings during the migration. What should the solutions architect do to meet these requirements?

   • AConfigure the AWS DataSync agent to start replicating the data store to Amazon FSx for Windows File Server. Use the SMB share to host the VMware data store. Use VM Import/Export to move the VMs to Amazon EC2.
   • BUse the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format. Create an Amazon S3 bucket to store the image in the destination AWS Region. Create and apply an IAM role for VM Import. Use the AWS CLI to run the EC2 import command.
   • CConfigure AWS Storage Gateway for files service to export a Common Internet File System (CIFS) share. Create a backup copy to the shared folder. Sign in to the AWS Management Console and create an AMI from the backup copy. Launch an EC2 instance that is based on the AMI.
   • DCreate a managed-instance activation for a hybrid environment in AWS Systems Manager. Download and install Systems Manager Agent on the on-premises VM. Register the VM with Systems Manager to be a managed instance. Use AWS Backup to create a snapshot of the VM and create an AMI. Launch an EC2 instance that is based on the AMI.

   Show answer

   Answer: B

   Explanation

   The correct answer is B. Use the VMware vSphere client to export the application as an image in Open Virtualization Format (OVF) format. Create an Amazon S3 bucket to store the image in the destination AWS Region. Create and apply an IAM role for VM Import. Use the AWS CLI to run the EC2 import command. This approach allows the solutions architect to export the application as an image in OVF format, which preserves the software and configuration settings, and then import it into Amazon EC2 using the EC2 import command.

   Source: Adapted from community discussion — masetromain

   References

   • AWS documentation
   • AWS documentation
   • AWS documentation

   Next question

9. Question 489 · 527 in bank

   Select 2

   A video processing company has an application that downloads images from an Amazon S3 bucket, processes the images, stores a transformed image in a second S3 bucket, and updates metadata about the image in an Amazon DynamoDB table. The application is written in Node.js and runs by using an AWS Lambda function. The Lambda function is invoked when a new image is uploaded to Amazon S3. The application ran without incident for a while. However, the size of the images has grown significantly. The Lambda function is now failing frequently with timeout errors. The function timeout is set to its maximum value. A solutions architect needs to refactor the application’s architecture to prevent invocation failures. The company does not want to manage the underlying infrastructure. Which combination of steps should the solutions architect take to meet these requirements? (Choose two.)

   • AModify the application deployment by building a Docker image that contains the application code. Publish the image to Amazon Elastic Container Registry (Amazon ECR).
   • BCreate a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of AWS Fargate. Configure the task definition to use the new image in Amazon Elastic Container Registry (Amazon ECR). Adjust the Lambda function to invoke an ECS task by using the ECS task definition when a new file arrives in Amazon S3.
   • CCreate an AWS Step Functions state machine with a Parallel state to invoke the Lambda function. Increase the provisioned concurrency of the Lambda function.
   • DCreate a new Amazon Elastic Container Service (Amazon ECS) task definition with a compatibility type of Amazon EC2. Configure the task definition to use the new image in Amazon Elastic Container Registry (Amazon ECR). Adjust the Lambda function to invoke an ECS task by using the ECS task definition when a new file arrives in Amazon S3.
   • EModify the application to store images on Amazon Elastic File System (Amazon EFS) and to store metadata on an Amazon RDS DB instance. Adjust the Lambda function to mount the EFS file share.

   Show answer

   Answer: AB

   Explanation

   A: create Docker image and save it to ECR B: run this image on Fargate No answer should have Lambda the will be time out

   Source: Adapted from community discussion — zhangyu20000

   Next question

10. Question 490 · 527 in bank

    A company has an organization in AWS Organizations. The company is using AWS Control Tower to deploy a landing zone for the organization. The company wants to implement governance and policy enforcement. The company must implement a policy that will detect Amazon RDS DB instances that are not encrypted at rest in the company’s production OU. Which solution will meet this requirement?

    • ATurn on mandatory guardrails in AWS Control Tower. Apply the mandatory guardrails to the production OU.
    • BEnable the appropriate guardrail from the list of strongly recommended guardrails in AWS Control Tower. Apply the guardrail to the production OU.
    • CUse AWS Config to create a new mandatory guardrail. Apply the rule to all accounts in the production OU.
    • DCreate a custom SCP in AWS Control Tower. Apply the SCP to the production OU.

    Show answer

    Answer: B

    Explanation

    The correct answer is B. AWS Control Tower provides a set of "strongly recommended guardrails" that can be enabled to implement governance and policy enforcement. One of these guardrails is "Encrypt Amazon RDS instances" which will detect RDS DB instances that are not encrypted at rest. By enabling this guardrail and applying it to the production OU, the company will be able to enforce encryption for RDS instances in the production environment. Option A is incorrect because mandatory guardrails are pre-defined by AWS and cannot be customized. Option C is incorrect because AWS Config does not provide mandatory guardrails for RDS instances. Option D is incorrect because AWS Control Tower does not provide a feature called custom SCP (Service Control Policy), it uses guardrails instead.

    Source: Adapted from community discussion — masetromain

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

SAP-C02 practice, question 481. 527 questions available.