CertBlaze

Amazon

SAP-C02 Free Practice Questions — Page 14

Question 132

An enterprise company is building an infrastructure services platform for its users. The company has the following requirements: • Provide least privilege access to users when launching AWS infrastructure so users cannot provision unapproved services. • Use a central account to manage the creation of infrastructure services. • Provide the ability to distribute infrastructure services to multiple accounts in AWS Organizations. • Provide the ability to enforce tags on any infrastructure that is started by users. Which combination of actions using AWS services will meet these requirements? (Choose three.)

A. Develop infrastructure services using AWS CloudFormation templates. Add the templates to a central Amazon S3 bucket and add the IAM roles or users that require access to the S3 bucket policy.
B. Develop infrastructure services using AWS CloudFormation templates. Upload each template as an AWS Service Catalog product to portfolios created in a central AWS account. Share these portfolios with the Organizations structure created for the company.
C. Allow user IAM roles to have AWSCloudFormationFullAccess and AmazonS3ReadOnlyAccess permissions. Add an Organizations SCP at the AWS account root user level to deny all services except AWS CloudFormation and Amazon S3.
D. Allow user IAM roles to have ServiceCatalogEndUserAccess permissions only. Use an automation script to import the central portfolios to local AWS accounts, copy the TagOption, assign users access, and apply launch constraints.
E. Use the AWS Service Catalog TagOption Library to maintain a list of tags required by the company. Apply the TagOption to AWS Service Catalog products or portfolios.
F. Use the AWS CloudFormation Resource Tags property to enforce the application of tags to any CloudFormation templates that will be created for users.
Show Answer
Correct Answer: B, D, E
Explanation:
AWS Service Catalog is designed for centrally managed, approved infrastructure with least privilege. Option B uses CloudFormation templates as Service Catalog products shared across AWS Organizations, satisfying central management and multi-account distribution. Option D restricts users to ServiceCatalogEndUserAccess and uses launch constraints and automation, enforcing least privilege and controlled provisioning. Option E uses Service Catalog TagOption Library to enforce mandatory tags on all provisioned infrastructure. Other options lack proper enforcement or bypass Service Catalog controls.

Question 133

A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account. Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads. Which strategy will meet these requirements?

A. Create separate OUs in AWS Organizations for each development unit. Assign the created OUs to the company AWS accounts. Create separate SCP with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag that matches the development unit name. Assign the SCP to the corresponding OU.
B. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Update the IAM policy for the developers’ assumed IAM role with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit.
C. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Create an SCP with an allow action and a StringEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit. Assign the SCP to the root OU.
D. Create separate IAM policies for each development unit. For every IAM policy, add an allow action and a StringEquals condition for the DevelopmentUnit resource tag and the development unit name. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development unit name to the assumed IAM role.
Show Answer
Correct Answer: B
Explanation:
The production workloads run in a single shared account, so organizational units and SCPs cannot distinguish between development units inside that account. The correct approach is to use attribute-based access control (ABAC). By passing the DevelopmentUnit attribute as an AWS STS session tag during SAML federation, the assumed role is tagged with the developer’s unit. An IAM policy with an explicit deny using StringNotEquals between the resource tag (DevelopmentUnit) and aws:PrincipalTag/DevelopmentUnit prevents developers from modifying resources owned by other units, while still allowing them to manage their own instances.

Question 134

A company has an organization in AWS Organizations that includes a separate AWS account for each of the company’s departments. Application teams from different departments develop and deploy solutions independently. The company wants to reduce compute costs and manage costs appropriately across departments. The company also wants to improve visibility into billing for individual departments. The company does not want to lose operational flexibility when the company selects compute resources. Which solution will meet these requirements?

A. Use AWS Budgets for each department. Use Tag Editor to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
B. Configure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use SCPs to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
C. Configure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use Tag Editor to apply tags to appropriate resources. Purchase Compute Savings Plans.
D. Use AWS Budgets for each department. Use SCPs to apply tags to appropriate resources. Purchase Compute Savings Plans.
Show Answer
Correct Answer: C
Explanation:
The company needs centralized cost visibility across multiple accounts, accurate cost allocation by department, cost reduction without limiting compute choices, and preserved operational flexibility. AWS Organizations with consolidated billing provides unified billing and volume discounts. A tagging strategy enables per-department cost allocation and reporting, and Tag Editor is the correct service to apply or manage tags across existing resources (SCPs cannot apply tags). Compute Savings Plans offer the greatest flexibility because they apply to EC2, AWS Fargate, and AWS Lambda, unlike EC2 Instance Savings Plans, which are more restrictive. Therefore, option C best meets all requirements.

Question 135

A company is using multiple AWS accounts and has multiple DevOps teams running production and non-production workloads in these accounts. The company would like to centrally-restrict access to some of the AWS services that the DevOps teams do not use. The company decided to use AWS Organizations and successfully invited all AWS accounts into the Organization. They would like to allow access to services that are currently in-use and deny a few specific services. Also they would like to administer multiple accounts together as a single unit. What combination of steps should the solutions architect take to satisfy these requirements? (Choose three.)

A. Use a Deny list strategy.
B. Review the Access Advisor in AWS IAM to determine services recently used
C. Review the AWS Trusted Advisor report to determine services recently used.
D. Remove the default FullAWSAccess SCP.
E. Define organizational units (OUs) and place the member accounts in the OUs.
F. Remove the default DenyAWSAccess SCP.
Show Answer
Correct Answer: A, B, E
Explanation:
To centrally restrict unused AWS services while managing multiple accounts together, the company should use AWS Organizations with Service Control Policies (SCPs) applied at the organizational unit (OU) level. A (Use a Deny list strategy): An SCP deny list allows all services by default and explicitly denies only the specific services the DevOps teams should not use, which matches the requirement to allow currently used services while restricting a few. B (Review the Access Advisor in AWS IAM): IAM Access Advisor shows which AWS services have been recently accessed, helping identify services that are actively used versus those that can be safely denied in SCPs. E (Define organizational units (OUs) and place the member accounts in the OUs): OUs enable administering multiple AWS accounts as a single unit and applying SCPs consistently across groups of accounts. The other options do not fit: Trusted Advisor does not provide per-service usage data for access decisions, and removing the default FullAWSAccess SCP is unnecessary because explicit deny statements in SCPs override it.

Question 136

A company has a website that serves many visitors. The company deploys a backend service for the website in a primary AWS Region and a disaster recovery (DR) Region. A single Amazon CloudFront distribution is deployed for the website. The company creates an Amazon Route 53 record set with health checks and a failover routing policy for the primary Region’s backend service. The company configures the Route 53 record set as an origin for the CloudFront distribution. The company configures another record set that points to the backend service's endpoint in the DR Region as a secondary failover record type. The TTL for both record sets is 60 seconds. Currently, failover takes more than 1 minute. A solutions architect must design a solution that will provide the fastest failover time. Which solution will achieve this goal?

A. Deploy an additional CloudFront distribution. Create a new Route 53 failover record set with health checks for both CloudFront distributions.
B. Set the TTL to 4 second for the existing Route 53 record sets that are used for the backend service in each Region.
C. Create new record sets for the backend services by using a latency routing policy. Use the record sets as an origin in the CloudFront distribution.
D. Create a CloudFront origin group that includes two origins, one for each backend service Region. Configure origin failover as a cache behavior for the CloudFront distribution.
Show Answer
Correct Answer: D
Explanation:
The slow failover is caused by DNS-based Route 53 health checks and TTL, which inherently take time to detect failure and propagate changes. CloudFront origin failover works at the edge and switches to the secondary origin immediately when the primary origin returns errors, without waiting for DNS updates. Creating a CloudFront origin group with both regional backends therefore provides the fastest possible failover.

Question 137

A company hosts an intranet web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Currently, users authenticate to the application against an internal user database. The company needs to authenticate users to the application by using an existing AWS Directory Service for Microsoft Active Directory directory. All users with accounts in the directory must have access to the application. Which solution will meet these requirements?

A. Create a new app client in the directory. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule. Configure the listener rule with the appropriate issuer, client ID and secret, and endpoint details for the Active Directory service. Configure the new app client with the callback URL that the ALB provides.
B. Configure an Amazon Cognito user pool. Configure the user pool with a federated identity provider (ldP) that has metadata from the directory. Create an app client. Associate the app client with the user pool. Create a listener rule for the ALSpecify the authenticate-cognito action for the listener rule. Configure the listener rule to use the user pool and app client.
C. Add the directory as a new IAM identity provider (ldP). Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Configure the new role as the default authenticated user role for the ldP. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule.
D. Enable AWS IAM Identity Center (AWS Single Sign-On). Configure the directory as an external identity provider (ldP) that uses SAML. Use the automatic provisioning method. Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Attach the new role to all groups. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule.
Show Answer
Correct Answer: B
Explanation:
An Application Load Balancer can natively authenticate users by integrating with Amazon Cognito user pools using the authenticate-cognito listener action. Amazon Cognito can federate with AWS Directory Service for Microsoft Active Directory using SAML, allowing all existing directory users to authenticate without changing the application. Options A, C, and D misuse OIDC/SAML or IAM/Identity Center concepts that do not integrate directly with ALB authentication for web applications.

Question 138

A company hosts a community forum site using an Application Load Balancer (ALB) and a Docker application hosted in an Amazon ECS cluster. The site data is stored in Amazon RDS for MySQL and the container image is stored in ECR. The company needs to provide their customers with a disaster recovery SLA with an RTO of no more than 24 hours and RPO of no more than 8 hours. Which of the following solutions is the MOST cost-effective way to meet the requirements?

A. Use AWS CloudFormation to deploy identical ALB, EC2, ECS and RDS resources in two regions. Schedule RDS snapshots every 8 hours. Use RDS multi-region replication to update the secondary region's copy of the database. In the event of a failure, restore from the latest snapshot, and use an Amazon Route 53 DNS failover policy to automatically redirect customers to the ALB in the secondary region.
B. Store the Docker image in ECR in two regions. Schedule RDS snapshots every 8 hours with snapshots copied to the secondary region. In the event of a failure, use AWS CloudFormation to deploy the ALB, EC2, ECS and RDS resources in the secondary region, restore from the latest snapshot, and update the DNS record to point to the ALB in the secondary region.
C. Use AWS CloudFormation to deploy identical ALB, EC2, ECS, and RDS resources in a secondary region. Schedule hourly RDS MySQL backups to Amazon S3 and use cross-region replication to replicate data to a bucket in the secondary region. In the event of a failure, import the latest Docker image to Amazon ECR in the secondary region, deploy to the EC2 instance, restore the latest MySQL backup, and update the DNS record to point to the ALB in the secondary region.
D. Deploy a pilot light environment in a secondary region with an ALB and a minimal resource EC2 deployment for Docker in an AWS Auto Scaling group with a scaling policy to increase instance size and number of nodes. Create a cross-region read replica of the RDS data. In the event of a failure, promote the replica to primary, and update the DNS record to point to the ALB in the secondary region.
Show Answer
Correct Answer: B
Explanation:
The requirements allow a relatively slow recovery (RTO ≤ 24 hours) and moderate data loss tolerance (RPO ≤ 8 hours), which aligns with a cold standby disaster recovery strategy. Option B is the most cost-effective because it avoids running duplicate infrastructure continuously. RDS snapshots every 8 hours meet the RPO, copying snapshots to a secondary region protects against regional failure, and CloudFormation can deploy the full stack on demand within the RTO window. Storing the container image in ECR in two regions ensures application availability during recovery. Options A and D maintain active or partially active resources (higher cost), and C introduces unnecessary complexity and less efficient backup/restore mechanisms.

Question 139

A company orchestrates a multi-account structure on AWS by using AWS Control Tower. The company is using AWS Organizations, AWS Config, and AWS Trusted Advisor. The company has a specific OU for development accounts that developers use to experiment on AWS. The company has hundreds of developers, and each developer has an individual development account. The company wants to optimize costs in these development accounts. Amazon EC2 instances and Amazon RDS instances in these accounts must be burstable. The company wants to disallow the use of other services that are not relevant. What should a solutions architect recommend to meet these requirements?

A. Create a custom SCP in AWS Organizations to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the SCP to the development OU.
B. Create a custom detective control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
C. Create a custom preventive control (guardrail) in AWS Control Tower. Configure the control (guardrail) to allow the deployment of only burstable instances and to disallow services that are not relevant. Apply the control (guardrail) to the development OU.
D. Create an AWS Config rule in the AWS Control Tower account. Configure the AWS Config rule to allow the deployment of only burstable instances and to disallow services that are not relevant. Deploy the AWS Config rule to the development OU by using AWS CloudFormation StackSets.
Show Answer
Correct Answer: A
Explanation:
The requirement is to *prevent* non‑burstable EC2/RDS usage and *disallow* irrelevant services across hundreds of development accounts. This is a preventive, account‑level enforcement best achieved with AWS Organizations Service Control Policies (SCPs). SCPs can deny ec2:RunInstances and rds:CreateDBInstance actions unless the instance class/type matches burstable families, and can deny entire services outright. Option C is incorrect because AWS Control Tower does **not** support creating arbitrary custom preventive controls; its preventive controls are predefined and implemented internally via SCPs. For custom requirements like restricting instance families and blocking specific services, architects must create and attach custom SCPs directly to the OU. AWS Config and detective controls cannot prevent usage, only report after the fact. Therefore, creating a custom SCP and attaching it to the development OU is the correct recommendation.

Question 140

A company maintains information on premises in approximately 1 million.csv files that are hosted on a VM. The data initially is 10 TB in size and grows at a rate of 1 TB each week. The company needs to automate backups of the data to the AWS Cloud. Backups of the data must occur daily. The company needs a solution that applies custom filters to back up only a subset of the data that is located in designated source directories. The company has set up an AWS Direct Connect connection. Which solution will meet the backup requirements with the LEAST operational overhead?

A. Use the Amazon S3 CopyObject API operation with multipart upload to copy the existing data to Amazon S3. Use the CopyObject API operation to replicate new data to Amazon S3 daily.
B. Create a backup plan in AWS Backup to back up the data to Amazon S3. Schedule the backup plan to run daily.
C. Install the AWS DataSync agent as a VM that runs on the on-premises hypervisor. Configure a DataSync task to replicate the data to Amazon S3 daily.
D. Use an AWS Snowball Edge device for the initial backup. Use AWS DataSync for incremental backups to Amazon S3 daily.
Show Answer
Correct Answer: C
Explanation:
The requirements include daily automated backups, custom filters to back up only specific source directories, very large data volume (millions of files, 10+ TB with growth), use of Direct Connect, and least operational overhead. AWS DataSync is specifically designed for large-scale file transfers and ongoing replication from on-premises environments to Amazon S3. It supports include/exclude filters and directory-level selection, integrates efficiently with Direct Connect, handles incremental transfers automatically, and requires minimal ongoing management once the agent and task are configured. AWS Backup does not natively back up on-premises file systems directly to Amazon S3 nor provide fine-grained file/directory filtering for this scenario. Snowball adds unnecessary operational complexity for ongoing daily backups, and S3 CopyObject is not suitable for on-premises data or selective directory-based backups. Therefore, installing the AWS DataSync agent and scheduling a daily task to Amazon S3 best meets all requirements with the least operational overhead.

Question 141

A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are managed in an organization in AWS Organizations. The SaaS platform uses many AWS resources globally. For regulatory compliance, all API calls to AWS resources must be audited, tracked for changes, and stored in a durable and secure data store. Which solution will meet these requirements with the LEAST operational overhead?

A. Create a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization's management account to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 bucket.
B. Create a new AWS CloudTrail trail in each member account of the organization. Create new Amazon S3 buckets to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 buckets.
C. Create a new AWS CloudTrail trail in the organization's management account. Create a new Amazon S3 bucket with versioning turned on to store the logs. Deploy the trail for all accounts in the organization. Enable MFA delete and encryption on the S3 bucket.
D. Create a new AWS CloudTrail trail in the organization's management account. Create a new Amazon S3 bucket to store the logs. Configure Amazon Simple Notification Service (Amazon SNS) to send log-file delivery notifications to an external management system that will track the logs. Enable MFA delete and encryption on the S3 bucket.
Show Answer
Correct Answer: C
Explanation:
An organization-level AWS CloudTrail created in the management account can capture API activity for all member accounts across all Regions with a single configuration, minimizing operational overhead. Storing logs centrally in a new, encrypted S3 bucket with versioning and MFA delete provides a durable, tamper-resistant audit store that meets regulatory requirements without managing separate trails or buckets per account.

$19

Get all 516 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SAP-C02 study guide →