Free SAP-C02 sample questions

Correct answer: Deploy the third-party appliances into an Auto Scaling group behind a Gateway Load Balancer (GWLB). Create GWLB endpoints in each application subnet AZ. Modify the application subnet route tables to route all traffic destined for the database subnet through the local GWLB endpoint.

This is the correct architecture for transparently inserting a fleet of security appliances into a network path. The Gateway Load Balancer is specifically designed for this purpose, acting as a transparent bump-in-the-wire. It allows you to scale the appliance fleet while the GWLB endpoints in each AZ provide a highly available, fixed next-hop for routing. This ensures all traffic from the application servers to the database is inspected without any changes to the application code and maintains high availability.

Correct answer: Use AWS Control Tower to set up a new landing zone. This will create a multi-account environment with AWS Organizations, provide pre-configured OUs for different workloads, and enable preventive and detective guardrails (SCPs and AWS Config rules). Use Account Factory to provision new accounts.

AWS Control Tower is the most comprehensive and recommended solution for establishing a secure, well-architected multi-account environment. It automates the setup of a landing zone using best practices, including creating a foundational set of OUs, accounts (Log Archive, Audit), centralized logging with AWS CloudTrail and AWS Config, and a set of guardrails using SCPs. This directly addresses the startup's need for better security, cost visibility, and governance without requiring extensive manual setup.

Correct answer: Provision an Amazon ElastiCache for Redis cluster. Modify the application to cache the product catalog data in Redis, serving read requests from the cache and falling back to the RDS database only when the data is not in the cache.

Given that 80% of the load is from read-heavy product catalog queries, implementing a caching layer is the most effective strategy. Amazon ElastiCache for Redis provides an in-memory data store with sub-millisecond latency. By caching frequently accessed data, the application can significantly reduce the read load on the primary RDS database, freeing up its CPU for write operations. This directly addresses the root cause of the performance bottleneck and is more effective than just scaling the database, which may still become a bottleneck under extreme load.

Correct answer: Use AWS Elastic Disaster Recovery (DRS) to continuously replicate the source servers' block devices to a low-cost staging area in the DR Region. In a disaster, launch fully provisioned recovery instances from the replicated data within minutes.

AWS Elastic Disaster Recovery (DRS) is specifically designed for this use case. It provides low-RPO, low-RTO disaster recovery at a minimal cost. DRS continuously replicates block-level data to a lightweight staging area in the target Region. This keeps costs low because full-size recovery instances are not running. During a DR event, DRS automates the process of launching recovery instances, allowing the environment to be brought online within minutes, thus meeting the strict RTO and RPO requirements in a cost-effective manner. This is more cost-effective than Warm Standby and faster than Backup and Restore.

Correct answer: Create an interface VPC endpoint (AWS PrivateLink) for Amazon S3 in the VPC. Configure on-premises DNS to resolve the S3 bucket hostname to the private IP address of the interface endpoint. Access S3 via the Direct Connect private VIF.

This is the correct solution for private S3 access from on-premises over Direct Connect. A gateway VPC endpoint for S3 is only accessible from within the VPC itself, not from an on-premises network. An interface VPC endpoint for S3, however, places an Elastic Network Interface (ENI) with a private IP address inside your VPC. This ENI can be reached from your on-premises network over a Direct Connect private VIF. By configuring DNS appropriately, the on-premises application can resolve the S3 endpoint to this private IP, ensuring all traffic stays on the private network path.

Correct answer: False

This is false. In AWS Organizations, SCPs act as guardrails and define the maximum permissions available to an account. An explicit deny in an SCP always takes precedence over any allow in an IAM policy. If an SCP denies an action, no principal in the affected account can perform that action, regardless of their IAM permissions. The effective permissions are the intersection of what the SCP allows and what the IAM policy allows.

Correct answers: From the management account, create an organization trail in AWS CloudTrail, specifying the S3 bucket in the Log Archive account as the destination.; In the Log Archive account, create an Amazon S3 bucket and apply a bucket policy that allows the CloudTrail service from all accounts in the organization to write logs.; In the management account, apply a Service Control Policy (SCP) to all member accounts that denies the `cloudtrail:StopLogging` and `cloudtrail:DeleteTrail` actions.; In the Audit account, create an IAM role that the security team can assume. Attach a policy to this role granting read access to the central S3 bucket and permissions to run Athena queries. Modify the S3 bucket policy in the Log Archive account to allow access from this IAM role.

This must be the first step. Creating an organization trail from the management account is the feature that automatically enables CloudTrail on all member accounts (including new ones) and configures them to send logs to the central bucket.

This step is a prerequisite for creating the organization trail. The destination S3 bucket must exist and have the correct permissions to accept logs from the entire organization.

This step ensures that member accounts cannot tamper with the logging configuration, fulfilling a key security requirement.

This final step enables the cross-account query capability for the security team, completing the solution. The correct order is: Create and configure the bucket -> Create the organization trail -> Apply SCPs for enforcement -> Grant cross-account read access for auditing.

Correct answer: Implement AWS App Mesh and configure virtual nodes and services for each microservice. Enforce traffic routing and policies through App Mesh. Enable Envoy access logging and export metrics to Amazon CloudWatch.

AWS App Mesh is a service mesh that provides application-level networking, making it easy to manage microservice communications. It uses Envoy proxies to handle all traffic, providing a perfect point for logging, inspection, and policy enforcement. App Mesh allows for fine-grained traffic control (e.g., routing, retries) and integrates with AWS services like CloudWatch and X-Ray for deep observability, including service maps. This solution meets all requirements for traffic logging, fine-grained policy enforcement, and native Kubernetes integration with rich observability.

Correct answer: Implement short query acceleration (SQA) as part of the Workload Management (WLM) configuration. Create separate user groups for BI users and ETL processes and assign them to different WLM queues.

Workload Management (WLM) is the Redshift feature designed specifically for managing and prioritizing different types of queries. By creating separate queues for BI users and ETL jobs, you can allocate resources and set priorities independently. Short Query Acceleration (SQA) is a key part of WLM that uses machine learning to identify short-running queries and move them to a dedicated queue, allowing them to bypass longer-running queries. This directly solves the problem of dashboard queries getting stuck behind ETL jobs.