SAP-C02PRACTICE QUESTIONS

SAP-C02 practice questions with answers

4 example questions from the AWS Certified Solutions Architect - Professional question bank, grouped by exam domain. Pick an answer and check it to see the explanation.

Design Solutions for Organizational Complexity

Question 1Select 1

null Prescribe security controls

A company is onboarding a third-party cost-optimization provider that serves many customers from one AWS account. The provider's Collector IAM role will obtain temporary credentials to assume a CostReader role in each of the company's accounts. Each CostReader role grants only the required read permissions and trusts the provider's Collector role. The Collector role has permission to assume the customer roles. The provider's API allows authenticated customers to register target role ARNs. A security review identifies that another customer could register one of the company's role ARNs and cause the provider to collect the company's data on that customer's behalf. Role ARNs and onboarding configuration values must not be treated as secrets. The provider can modify its application and onboarding process. Which solution prevents this misuse while preserving automated cross-account collection?

A. Have the provider generate a unique external ID for the company and bind it to the company's authenticated customer record. Require that value through an sts:ExternalId condition in each CostReader trust policy, while retaining trust in the Collector role. Have the provider supply the external ID from the authenticated customer's stored record when calling AWS STS AssumeRole, without allowing customers to select another customer's value.

B. Add an aws:SourceAccount condition to each CostReader trust policy that requires the provider's AWS account ID. Have the Collector role continue calling AWS STS AssumeRole for any role ARN registered by an authenticated customer.

C. Require sts:ExternalId in each CostReader trust policy, using the CostReader role ARN as the required value. Modify the provider to accept a role ARN and external ID from each customer and pass both values unchanged to AWS STS AssumeRole.

D. Require a session policy on every AWS STS AssumeRole request that permits only the approved cost-reading actions. Keep the existing CostReader trust policies, and have the provider accept target role ARNs from authenticated customers.

Design for New Solutions

Question 1Select 1

null Determine security controls based on requirements

A healthcare company is deploying an Amazon ECS service on AWS Fargate platform version 1.4.0 in two private subnets across two Availability Zones. Tasks pull Linux container images from a private Amazon ECR repository in the same AWS Region and send application logs to Amazon CloudWatch Logs by using the awslogs driver. All image layers are stored in Amazon ECR; the repository does not use pull-through caching. Security policy prohibits internet access and routed connectivity to other VPCs. The task subnets have no default routes, and the company must not add NAT gateways or internet gateways. Tasks must continue to use the standard Regional service hostnames without application or DNS overrides. Task execution role permissions are already configured correctly. VPC DNS support and DNS hostnames are enabled. Which configuration will allow new tasks to pull images and deliver logs while maintaining the required network isolation?

A. Create interface VPC endpoints for the Regional ECR Docker registry and CloudWatch Logs services with private DNS enabled. Create an S3 gateway endpoint associated with both task subnet route tables. Allow the required HTTPS traffic. Omit the ECR API endpoint because the task execution role already grants permission to retrieve registry authorization tokens.

B. Create interface VPC endpoints for the Regional ECR API, ECR Docker registry, and CloudWatch Logs services with private DNS enabled. Allow HTTPS from the task security group to the endpoint security group. No additional endpoints are necessary because ECR delivers image layers through its Docker registry endpoint.

C. Create interface VPC endpoints for the Regional ECR API, ECR Docker registry, and CloudWatch Logs services with private DNS disabled. Create an S3 gateway endpoint associated with both task subnet route tables. Allow the required HTTPS traffic and retain the existing service hostname resolution.

D. Create interface VPC endpoints for the Regional ECR API, ECR Docker registry, and CloudWatch Logs services with private DNS enabled. Allow HTTPS from the task security group to the endpoint security group. Create an S3 gateway endpoint and associate it with both task subnet route tables. Permit the required endpoint traffic in task security groups, network ACLs, and endpoint policies.

Continuous Improvement for Existing Solutions

Question 1Select 1

null Determine a strategy to improve performance

A company operates a stateless HTTP API on an Amazon EC2 Auto Scaling group behind an Application Load Balancer (ALB). The group uses a target tracking scaling policy based on average CPU utilization. The ALB target group uses round robin routing with stickiness disabled. The Auto Scaling group's default instance warmup is explicitly set to 0 seconds. During unpredictable traffic increases, newly launched instances quickly become healthy and enter the InService state. However, each instance needs approximately 180 additional seconds of production traffic to populate an in-memory cache. Receiving a full share of requests during this period causes high response latency. The initializing instances also have low CPU utilization, which lowers the group's average CPU metric and delays further scale-out while established instances remain overloaded. The company wants to gradually introduce traffic to newly healthy instances and prevent their initialization period from distorting scaling decisions. The solution must not require application changes or additional idle instances. Which solution meets these requirements?

A. Configure the target group's deregistration delay to 180 seconds and leave slow start disabled. Set the Auto Scaling group's default instance warmup to 180 seconds.

B. Configure the target group's slow start duration to 180 seconds. Set the Auto Scaling group's default cooldown to 180 seconds, and retain the default instance warmup of 0 seconds.

C. Configure the target group's slow start duration to 180 seconds. Set the Auto Scaling group's default instance warmup to 180 seconds.

D. Leave slow start disabled. Set the Auto Scaling group's health check grace period to 180 seconds, and retain the default instance warmup of 0 seconds.

Accelerate Workload Migration and Modernization

Question 1Select 1

null Determine the optimal migration approach for existing workloads

A company is migrating application waves into 60 member accounts in an AWS Organizations organization with all features enabled. Workloads run in two AWS Regions, and new accounts are added each month. Before each cutover, a central governance team must evaluate deployed resources against a version-controlled baseline of 12 configuration rules. Auditors also require configuration history that preserves changes even when a resource becomes noncompliant and is corrected later the same day. The solution must automatically extend governance to new accounts, provide organization-wide compliance reporting, and leave remediation under application-team control. No resource configuration recording is currently enabled. Which solution meets these requirements with the LEAST ongoing operational effort?

A. Attach service control policies that enforce the baseline to all workload organizational units. Automatically deploy continuous configuration recorders to member accounts by using service-managed CloudFormation StackSets, and create an AWS Config organization aggregator to report baseline compliance without deploying rules.

B. Use service-managed CloudFormation StackSets with automatic deployment to enable daily configuration recording in both Regions of member accounts. Deploy the baseline as organization conformance packs without remediation actions, and create an organization aggregator in a delegated administrator account.

C. Register a governance account as an AWS Config delegated administrator. Use service-managed CloudFormation StackSets with automatic deployment to enable continuous configuration recording in both Regions of member accounts. Deploy the baseline as an organization conformance pack in each Region without remediation actions. Create an organization aggregator in the governance account.

D. Register a governance account as an AWS Config delegated administrator. Create an organization aggregator covering both Regions, enable continuous configuration recording only in the governance account, and deploy the baseline conformance pack only in that account. Use the aggregator to evaluate member-account resources centrally.

PRACTICE EXAMSAP-C02 exam simulator

789 questions covering every domain and task, full-length exams, explanations for every answer and a pass probability indicator.

Open the simulator →