Amazon SAP-C02 Exam Practice Test Instant Access

Question 1

A company has an application that uses AWS Key Management Service (AWS KMS) to encrypt and decrypt dat

a. The application stores data in an Amazon S3 bucket in an AWS Region. Company security policies require the data to be encrypted before the data is placed into the S3 bucket. The application must decrypt the data when the application reads files from the S3 bucket.

The company replicates the S3 bucket to other Regions. A solutions architect must design a solution so that the application can encrypt and decrypt data across Regions. The application must use the same key to decrypt the data in each Region.

Which solution will meet these requirements?

ACreate a KMS multi-Region primary key. Use the KMS multi-Region primary key to create a KMS multi-Region replica key in each additional Region where the application is running. Update the application code to use the specific replica key in each Region.

BCreate a new customer managed KMS key in each additional Region where the application is running. Update the application code to use the specific KMS key in each Region.

CUse AWS Private Certificate Authority to create a new certificate authority (CA) in the primary Region. Issue a new private certificate from the CA for the application's website URL. Share the CA with the additional Regions by using AWS Resource Access Manager (AWS RAM). Update the application code to use the shared CA certificates in each Region.

DUse AWS Systems Manager Parameter Store to create a parameter in each additional Region where the application is running. Export the key material from the KMS key in the primary Region. Store the key material in the parameter in each Region. Update the application code to use the key data from the parameter in each Region.

Answer : A

Question 2

A company needs to modernize a legacy .NET Framework application. The application uses an application server and a Microsoft SQL Server database.

The company also needs to perform the following tasks:

Containerize the application into microservices.

* Keep control of the operating system patches and storage for the application layer.

* Add load balancing for the web servers.

* Make the application highly available.

Which solution will meet these requirements?

AConvert the application into a containerized application by using AWS App2Container. Deploy the containerized application on Amazon Elastic Container Service (Amazon ECS). Run the ECS cluster on Amazon EC2 instances in an Auto Scaling group. Place an Application Load Balancer in front of the Auto Scaling group. Use Amazon RDS for SOL Server with a Multi-AZ deployment to host the database.

BConvert the application into a containerized application by using AWS App2Container. Deploy the containerized application on Amazon Elastic Container Service (Amazon ECS). Run the ECS cluster on EC2 instances in an Auto Scaling group. Place a Network Load Balancer in front of the Auto Scaling group. Use Amazon Aurora MySQL with a Multi-AZ deployment to host the database.

CConvert the application into a containerized application by using the Porting Assistant for .NET tool. Deploy the containerized application on Amazon Elastic Kubernetes Service (Amazon EKS). Run the EKS cluster by using AWS Fargate. Place a Network Load Balancer in front of the Auto Scaling group. Host the database on Amazon Aurora MySQL. Configure cross-Region read replicas for the database.

DConvert the application into a containerized application by using the Porting Assistant for .NET tool. Deploy the containerized application on Amazon Elastic Kubernetes Service (Amazon EKS). Run the EKS cluster by using AWS Fargate. Place an Application Load Balancer in front of the Auto Scaling group. Use Amazon RDS for SQL Server with a Multi-AZ deployment to host the database.

Answer : A

Question 3

A company requires that all internal application connectivity use private IP addresses. To facilitate this policy, a solutions architect has created interface endpoints to connect to AWS public services. Upon testing, the solutions architect notices that the service names are resolving to public IP addresses, and that internal services cannot connect to the interlace endpoints.

Which step should the solutions architect take to resolve this issue?

AUpdate the subnet route table with a route to the interface endpoint.

BEnable the private DNS option on the VPC attributes.

CConfigure the security group on the interface endpoint to allow connectivity to the AWS services.

DConfigure an Amazon Route 53 private hosted zone with a conditional forwarder for the internal application.

Answer : B

Question 4

A company has a new requirement to store all database backups in an isolated AWS account. The company is using AWS Organizations and has created a central write-once, read-many (WORM) account for the backups.

The company has 40 Amazon RDS tor MySQL databases in its production account. The databases are encrypted with the default RDS AWS Key Management Service (AWS KMS) key. RDS automated backups of the databases occur daily and have a retention period of 30 days.

Which solution will successfully copy the database backups to the central account?

AEnable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create 1AM policies and backup policies. Enable cross-account management. Create a backup vault in the central account. Create a KMS key for the backup vault and share the key with the production account. In the production account, restore the databases from a snapshot and apply the shared KMS key to the new DB instances. Create a backup plan in the central account to back up the databases to The backup vault.

BEnable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create 1AM policies and backup policies. Enable cross-account management. In the production account, share the default RDS KMS key with the central account. Create a backup vault in the central account. Apply the shared default RDS KMS key to the backup vault. Create a backup plan in the central account to back up the databases to the backup vault.

CCreate an Amazon EventBridge rule to invoke an AWS Lambda function every day. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account. After the copy job is complete, create a new KMS key. Use the new KMS key to encrypt the database snapshots in the central account.

DCreate an Amazon EventBridge rule to invoke an AWS Lambda function every day. In the production account, share the default RDS KMS key with the central account. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account. After the copy job is complete, encrypt the database snapshots with the shared default RDS KMS key in the central account.

Answer : B

Question 5

A solutions architect is importing a VM from an on-premises environment by using the Amazon EC2 VM Import feature of AWS Import/Export. The solutions architect has created an AMI and has provisioned an Amazon EC2 instance that is based on that AMI. The EC2 instance runs inside a public subnet in a VPC and has a public IP address assigned.

The EC2 instance does not appear as a managed instance in the AWS Systems Manager console.

Which combination of steps should the solutions architect take to troubleshoot this issue? (Select TWO.)

AVerify that Systems Manager Agent is installed on the instance and is running.

BVerify that the instance is assigned an appropriate 1AM role for Systems Manager.

CVerify the existence of a VPC endpoint on the VPC.

DVerify that the AWS Application Discovery Agent is configured.

EVerify the correct configuration of service-linked roles for Systems Manager.

Answer : A, B

Question 6

A company is planning to migrate an application from on premises to the AWS Cloud The company will begin the migration by moving the application underlying data storage to AWS The application data is stored on a shared tile system on premises and the application servers connect to the shared file system through SMB

A solutions architect must implement a solution that uses an Amazon S3 bucket for shared storage. Until the application is fully migrated and code is rewritten to use native Amazon S3 APIs the application must continue to have access to the data through SMB The solutions architect must migrate the application data to AWS (o its new location while still allowing the on-premises application to access the data

Which solution will meet these requirements?

ACreate a new Amazon FSx for Windows File Server file system Configure AWS DataSync with one location for the on-premises file share and one location for the new Amazon FSx file system Create a new DataSync task to copy the data from the on-premises file share location to the Amazon FSx file system

BCreate an S3 bucket for the application Copy the data from the on-premises storage to the S3 bucket

CDeploy an AWS Server Migration Service (AWS SMS) VM to the on-premises environment Use AWS SMS to migrate the file storage server from on premises to an Amazon EC2 instance

DCreate an S3 bucket for the application Deploy a new AWS Storage Gateway file gateway on an on-premises VM Create a new file share that stores data in the S3 bucket and is associated with the file gateway Copy the data from the on-premises storage to the new file gateway endpoint

Answer : D

Create an S3 Bucket:

Create a new S3 bucket that will serve as the destination for the application data.

Deploy AWS Storage Gateway:

Download and deploy the AWS Storage Gateway virtual machine (VM) on your on-premises environment. This VM can be deployed on VMware ESXi, Microsoft Hyper-V, or Linux KVM.

Configure the File Gateway:

Configure the deployed Storage Gateway as a file gateway. This will enable it to present Amazon S3 buckets as SMB file shares to your on-premises applications.

Create a New File Share:

Within the Storage Gateway configuration, create a new file share that is associated with the S3 bucket you created earlier. This file share will use the SMB protocol, allowing your on-premises applications to access the S3 bucket as if it were a local SMB file share.

Copy Data to the File Gateway:

Use your preferred method (such as robocopy, rsync, or similar tools) to copy data from the on-premises storage to the newly created file gateway endpoint. This data will be stored in the S3 bucket, maintaining accessibility through SMB.

Ensure Secure and Efficient Data Transfer:

AWS Storage Gateway ensures that all data in transit is encrypted using TLS, providing secure data transfer to AWS. It also provides local caching for frequently accessed data, improving access performance for on-premises applications.

This approach allows your existing on-premises applications to continue accessing data via SMB while leveraging the scalability and durability of Amazon S3.

Reference

AWS Storage Gateway Overview67.

AWS DataSync and Storage Gateway Hybrid Architecture66.

AWS S3 File Gateway Details68.

Question 7

A solutions architect is creating an AWS CloudFormation template from an existing manually created non-production AWS environment The CloudFormation template can be destroyed and recreated as needed The environment contains an Amazon EC2 instance The EC2 instance has an instance profile that the EC2 instance uses to assume a role in a parent account

The solutions architect recreates the role in a CloudFormation template and uses the same role name When the CloudFormation template is launched in the child account, the EC2 instance can no longer assume the role in the parent account because of insufficient permissions

What should the solutions architect do to resolve this issue?

AIn the parent account edit the trust policy for the role that the EC2 instance needs to assume Ensure that the target role ARN in the existing statement that allows the sts AssumeRole action is correct Save the trust policy

BIn the parent account edit the trust policy for the role that the EC2 instance needs to assume Add a statement that allows the sts AssumeRole action for the root principal of the child account Save the trust policy

CUpdate the CloudFormation stack again Specify only the CAPABILITY_NAMED_IAM capability

DUpdate the CloudFormation stack again Specify the CAPABIUTYJAM capability and the CAPABILITY_NAMEDJAM capability

Answer : A

Edit the Trust Policy:

Go to the IAM console in the parent account and locate the role that the EC2 instance needs to assume.

Edit the trust policy of the role to ensure that it correctly allows the sts

action for the role ARN in the child account.

Update the Role ARN:

Verify that the target role ARN specified in the trust policy matches the role ARN created by the CloudFormation stack in the child account.

If necessary, update the ARN to reflect the correct role in the child account.

Save and Test:

Save the updated trust policy and ensure there are no syntax errors.

Test the setup by attempting to assume the role from the EC2 instance in the child account. Verify that the instance can successfully assume the role and perform the required actions.

This ensures that the EC2 instance in the child account can assume the role in the parent account, resolving the permission issue.

Reference

AWS IAM Documentation on Trust Policies51.

Amazon SAP-C02 AWS Certified Solutions Architect - Professional Exam Practice Test