CertBlaze

Amazon

SAP-C02 Free Practice Questions — Page 14

Question 127

A company wants to design a disaster recovery (DR) solution for an application that runs in the company’s data center. The application writes to an SMB file share and creates a copy on a second file share. Both file shares are in the data center. The application uses two types of files: metadata files and image files. The company wants to store the copy on AWS. The company needs the ability to use SMB to access the data from either the data center or AWS if a disaster occurs. The copy of the data is rarely accessed but must be available within 5 minutes.

A. Deploy AWS Outposts with Amazon S3 storage. Configure a Windows Amazon EC2 instance on Outposts as a file server.
B. Deploy an Amazon FSx File Gateway. Configure an Amazon FSx for Windows File Server Multi-AZ file system that uses SSD storage.
C. Deploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and to use S3 Glacier Deep Archive for the image files.
D. Deploy an Amazon S3 File Gateway. Configure the S3 File Gateway to use Amazon S3 Standard-Infrequent Access (S3 Standard-IA) for the metadata files and image files.
Show Answer
Correct Answer: D
Explanation:
Amazon S3 File Gateway provides SMB access while storing files as objects in Amazon S3, making it suitable for keeping a DR copy in AWS. Using S3 Standard-IA aligns with the requirement that the data is rarely accessed but must be rapidly available (within minutes). Option C is incorrect because Glacier Deep Archive retrieval is far too slow. Option B provides SMB through FSx for Windows but is designed for active Windows file systems and SSD-backed storage, which is unnecessarily expensive for a rarely accessed DR copy stored in AWS. Option A does not fit the stated DR storage requirement.

Question 128

Accompany is deploying a new cluster for big data analytics on AWS. The cluster will run across many Linux Amazon EC2 instances that are spread across multiple Availability Zones. All of the nodes in the cluster must have read and write access to common underlying file storage. The file storage must be highly available, must be resilient, must be compatible with the Portable Operating System Interface (POSIX), and must accommodate high levels of throughput. Which storage solution will meet these requirements?

A. Provision an AWS Storage Gateway file gateway NFS file share that is attached to an Amazon S3 bucket. Mount the NFS file share on each EC2 instance in the cluster.
B. Provision a new Amazon Elastic File System (Amazon EFS) file system that uses General Purpose performance mode. Mount the EFS file system on each EC2 instance in the cluster.
C. Provision a new Amazon Elastic Block Store (Amazon EBS) volume that uses the io2 volume type. Attach the EBS volume to all of the EC2 instances in the cluster.
D. Provision a new Amazon Elastic File System (Amazon EFS) file system that uses Max I/O performance mode. Mount the EFS file system on each EC2 instance in the cluster.
Show Answer
Correct Answer: D
Explanation:
Amazon EFS is the appropriate shared POSIX-compliant file system for Linux EC2 instances across multiple Availability Zones. Amazon EBS cannot provide a shared multi-AZ POSIX file system, and Storage Gateway File Gateway is intended for hybrid access rather than as native shared storage for an EC2 analytics cluster. Given the emphasis on a large big data analytics cluster with many EC2 instances and high aggregate throughput, EFS Max I/O performance mode best matches the exam intent, trading slightly higher latency for higher aggregate throughput and scalability.

Question 131

A company deploys a new web application. As part of the setup, the company configures AWS WAF to log to Amazon S3 through Amazon Kinesis Data Firehose. The company develops an Amazon Athena query that runs once daily to return AWS WAF log data from the previous 24 hours. The volume of daily logs is constant. However, over time, the same query is taking more time to run. A solutions architect needs to design a solution to prevent the query time from continuing to increase. The solution must minimize operational overhead. Which solution will meet these requirements?

A. Create an AWS Lambda function that consolidates each day's AWS WAF logs into one log file.
B. Reduce the amount of data scanned by configuring AWS WAF to send logs to a different S3 bucket each day.
C. Update the Kinesis Data Firehose configuration to partition the data in Amazon S3 by date and time. Create external tables for Amazon Redshift. Configure Amazon Redshift Spectrum to query the data source.
D. Modify the Kinesis Data Firehose configuration and Athena table definition to partition the data by date and time. Change the Athena query to view the relevant partitions.
Show Answer
Correct Answer: D
Explanation:
Athena query performance degrades as more objects and unpartitioned data accumulate because it must scan more metadata and data. Partitioning the Firehose output in Amazon S3 by date/time and defining corresponding Athena partitions allows the daily query to read only the relevant partitions (for the previous 24 hours), keeping scan size and query time roughly constant as data grows. This has lower operational overhead than Lambda-based consolidation, and Redshift Spectrum is unnecessary for this use case.

Question 133

A company is running multiple workloads in the AWS Cloud. The company has separate units for software development. The company uses AWS Organizations and federation with SAML to give permissions to developers to manage resources in their AWS accounts. The development units each deploy their production workloads into a common production account. Recently, an incident occurred in the production account in which members of a development unit terminated an EC2 instance that belonged to a different development unit. A solutions architect must create a solution that prevents a similar incident from happening in the future. The solution also must allow developers the possibility to manage the instances used for their workloads. Which strategy will meet these requirements?

A. Create separate OUs in AWS Organizations for each development unit. Assign the created OUs to the company AWS accounts. Create separate SCP with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag that matches the development unit name. Assign the SCP to the corresponding OU.
B. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Update the IAM policy for the developers’ assumed IAM role with a deny action and a StringNotEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit.
C. Pass an attribute for DevelopmentUnit as an AWS Security Token Service (AWS STS) session tag during SAML federation. Create an SCP with an allow action and a StringEquals condition for the DevelopmentUnit resource tag and aws:PrincipalTag/DevelopmentUnit. Assign the SCP to the root OU.
D. Create separate IAM policies for each development unit. For every IAM policy, add an allow action and a StringEquals condition for the DevelopmentUnit resource tag and the development unit name. During SAML federation, use AWS Security Token Service (AWS STS) to assign the IAM policy and match the development unit name to the assumed IAM role.
Show Answer
Correct Answer: B
Explanation:
Using SAML federation with AWS STS session tags (PrincipalTags) enables attribute-based access control (ABAC). By passing a DevelopmentUnit session tag and enforcing an IAM policy that denies access when the resource's DevelopmentUnit tag does not match aws:PrincipalTag/DevelopmentUnit, developers can manage only the EC2 instances tagged for their own development unit within the shared production account. SCP-based approaches are not appropriate here because all workloads reside in the same production account, and SCPs cannot implement this per-principal matching in the proposed way. Separate IAM policies per unit are less scalable than ABAC with session tags.

Question 134

A company has an organization in AWS Organizations that includes a separate AWS account for each of the company’s departments. Application teams from different departments develop and deploy solutions independently. The company wants to reduce compute costs and manage costs appropriately across departments. The company also wants to improve visibility into billing for individual departments. The company does not want to lose operational flexibility when the company selects compute resources. Which solution will meet these requirements?

A. Use AWS Budgets for each department. Use Tag Editor to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
B. Configure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use SCPs to apply tags to appropriate resources. Purchase EC2 Instance Savings Plans.
C. Configure AWS Organizations to use consolidated billing. Implement a tagging strategy that identifies departments. Use Tag Editor to apply tags to appropriate resources. Purchase Compute Savings Plans.
D. Use AWS Budgets for each department. Use SCPs to apply tags to appropriate resources. Purchase Compute Savings Plans.
Show Answer
Correct Answer: C
Explanation:
Consolidated billing in AWS Organizations provides centralized billing visibility across department accounts. A tagging strategy with Tag Editor supports cost allocation by department. SCPs cannot apply tags; they can restrict actions but not tag existing resources. Compute Savings Plans provide the greatest operational flexibility because they apply across EC2 instance families, sizes, Regions, OSs, and also AWS Fargate and AWS Lambda, unlike EC2 Instance Savings Plans.

Question 135

A company is using multiple AWS accounts and has multiple DevOps teams running production and non-production workloads in these accounts. The company would like to centrally-restrict access to some of the AWS services that the DevOps teams do not use. The company decided to use AWS Organizations and successfully invited all AWS accounts into the Organization. They would like to allow access to services that are currently in-use and deny a few specific services. Also they would like to administer multiple accounts together as a single unit. What combination of steps should the solutions architect take to satisfy these requirements? (Choose three.)

A. Use a Deny list strategy.
B. Review the Access Advisor in AWS IAM to determine services recently used
C. Review the AWS Trusted Advisor report to determine services recently used.
D. Remove the default FullAWSAccess SCP.
E. Define organizational units (OUs) and place the member accounts in the OUs.
F. Remove the default DenyAWSAccess SCP.
Show Answer
Correct Answer: A, B, E
Explanation:
Use a deny-list SCP strategy to block only the specific AWS services the company does not want while leaving all other services available. Review IAM Access Advisor to identify which AWS services have been recently used so the deny list does not block required services. Create Organizational Units (OUs) to manage multiple AWS accounts as a single administrative unit. Removing the default FullAWSAccess SCP is not required for a deny-list strategy because explicit Deny statements in attached SCPs override the broad allow. There is no default DenyAWSAccess SCP to remove.

Question 137

A company hosts an intranet web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Currently, users authenticate to the application against an internal user database. The company needs to authenticate users to the application by using an existing AWS Directory Service for Microsoft Active Directory directory. All users with accounts in the directory must have access to the application. Which solution will meet these requirements?

A. Create a new app client in the directory. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule. Configure the listener rule with the appropriate issuer, client ID and secret, and endpoint details for the Active Directory service. Configure the new app client with the callback URL that the ALB provides.
B. Configure an Amazon Cognito user pool. Configure the user pool with a federated identity provider (ldP) that has metadata from the directory. Create an app client. Associate the app client with the user pool. Create a listener rule for the ALSpecify the authenticate-cognito action for the listener rule. Configure the listener rule to use the user pool and app client.
C. Add the directory as a new IAM identity provider (ldP). Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Configure the new role as the default authenticated user role for the ldP. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule.
D. Enable AWS IAM Identity Center (AWS Single Sign-On). Configure the directory as an external identity provider (ldP) that uses SAML. Use the automatic provisioning method. Create a new IAM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Attach the new role to all groups. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule.
Show Answer
Correct Answer: B
Explanation:
Application Load Balancer supports user authentication through Amazon Cognito user pools or directly with OIDC identity providers. AWS Directory Service for Microsoft Active Directory is not itself an OIDC provider, so it cannot be configured directly with authenticate-oidc. The appropriate pattern is to federate the existing directory into an Amazon Cognito user pool (using a SAML identity provider backed by the directory), create an app client, and configure the ALB listener with the authenticate-cognito action. The IAM and IAM Identity Center options are for AWS access and SSO use cases, not ALB application authentication.

Question 138

A company hosts a community forum site using an Application Load Balancer (ALB) and a Docker application hosted in an Amazon ECS cluster. The site data is stored in Amazon RDS for MySQL and the container image is stored in ECR. The company needs to provide their customers with a disaster recovery SLA with an RTO of no more than 24 hours and RPO of no more than 8 hours. Which of the following solutions is the MOST cost-effective way to meet the requirements?

A. Use AWS CloudFormation to deploy identical ALB, EC2, ECS and RDS resources in two regions. Schedule RDS snapshots every 8 hours. Use RDS multi-region replication to update the secondary region's copy of the database. In the event of a failure, restore from the latest snapshot, and use an Amazon Route 53 DNS failover policy to automatically redirect customers to the ALB in the secondary region.
B. Store the Docker image in ECR in two regions. Schedule RDS snapshots every 8 hours with snapshots copied to the secondary region. In the event of a failure, use AWS CloudFormation to deploy the ALB, EC2, ECS and RDS resources in the secondary region, restore from the latest snapshot, and update the DNS record to point to the ALB in the secondary region.
C. Use AWS CloudFormation to deploy identical ALB, EC2, ECS, and RDS resources in a secondary region. Schedule hourly RDS MySQL backups to Amazon S3 and use cross-region replication to replicate data to a bucket in the secondary region. In the event of a failure, import the latest Docker image to Amazon ECR in the secondary region, deploy to the EC2 instance, restore the latest MySQL backup, and update the DNS record to point to the ALB in the secondary region.
D. Deploy a pilot light environment in a secondary region with an ALB and a minimal resource EC2 deployment for Docker in an AWS Auto Scaling group with a scaling policy to increase instance size and number of nodes. Create a cross-region read replica of the RDS data. In the event of a failure, promote the replica to primary, and update the DNS record to point to the ALB in the secondary region.
Show Answer
Correct Answer: B
Explanation:
A cold standby approach best matches the stated objectives while minimizing cost. An RTO of up to 24 hours allows infrastructure to be created after a disaster using CloudFormation, and an RPO of 8 hours is met by taking RDS snapshots every 8 hours and copying them to the secondary Region. Keeping the container image available in ECR in the secondary Region avoids delays. Options A and D maintain warm/active resources continuously, increasing cost beyond what the RTO requires. Option C relies on manual database backup/restore to S3 rather than the more appropriate RDS snapshot approach and adds unnecessary complexity.

Question 140

A company maintains information on premises in approximately 1 million.csv files that are hosted on a VM. The data initially is 10 TB in size and grows at a rate of 1 TB each week. The company needs to automate backups of the data to the AWS Cloud. Backups of the data must occur daily. The company needs a solution that applies custom filters to back up only a subset of the data that is located in designated source directories. The company has set up an AWS Direct Connect connection. Which solution will meet the backup requirements with the LEAST operational overhead?

A. Use the Amazon S3 CopyObject API operation with multipart upload to copy the existing data to Amazon S3. Use the CopyObject API operation to replicate new data to Amazon S3 daily.
B. Create a backup plan in AWS Backup to back up the data to Amazon S3. Schedule the backup plan to run daily.
C. Install the AWS DataSync agent as a VM that runs on the on-premises hypervisor. Configure a DataSync task to replicate the data to Amazon S3 daily.
D. Use an AWS Snowball Edge device for the initial backup. Use AWS DataSync for incremental backups to Amazon S3 daily.
Show Answer
Correct Answer: C
Explanation:
AWS DataSync is designed for large-scale data transfers from on-premises to Amazon S3, supports scheduled daily transfers, integrates with Direct Connect, and supports include/exclude filters so only designated directories or files are transferred. AWS Backup does not back up arbitrary on-premises CSV files directly into Amazon S3, CopyObject is not suitable for this migration workflow, and Snowball Edge is unnecessary given an existing Direct Connect and adds operational overhead.

Question 141

A financial services company sells its software-as-a-service (SaaS) platform for application compliance to large global banks. The SaaS platform runs on AWS and uses multiple AWS accounts that are managed in an organization in AWS Organizations. The SaaS platform uses many AWS resources globally. For regulatory compliance, all API calls to AWS resources must be audited, tracked for changes, and stored in a durable and secure data store. Which solution will meet these requirements with the LEAST operational overhead?

A. Create a new AWS CloudTrail trail. Use an existing Amazon S3 bucket in the organization's management account to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 bucket.
B. Create a new AWS CloudTrail trail in each member account of the organization. Create new Amazon S3 buckets to store the logs. Deploy the trail to all AWS Regions. Enable MFA delete and encryption on the S3 buckets.
C. Create a new AWS CloudTrail trail in the organization's management account. Create a new Amazon S3 bucket with versioning turned on to store the logs. Deploy the trail for all accounts in the organization. Enable MFA delete and encryption on the S3 bucket.
D. Create a new AWS CloudTrail trail in the organization's management account. Create a new Amazon S3 bucket to store the logs. Configure Amazon Simple Notification Service (Amazon SNS) to send log-file delivery notifications to an external management system that will track the logs. Enable MFA delete and encryption on the S3 bucket.
Show Answer
Correct Answer: C
Explanation:
An AWS Organizations organization trail created in the management account provides centralized logging across all member accounts and Regions with the least operational overhead. Using a dedicated new S3 bucket for CloudTrail logs is a best practice, and enabling versioning, MFA delete, and encryption helps meet durability and security/compliance requirements. Creating separate trails and buckets in each account increases operational overhead, while SNS notifications do not satisfy the core auditing and secure storage requirement.

$19

Get all 513 questions with detailed answers and explanations

  • Instant download HTML + PDF delivered the moment payment clears.
  • Secure Stripe checkout we never see or store your card details.
  • 7-day refund if files are defective see our refund policy.

Full SAP-C02 study guide →