Question 1

A large company with hundreds of AWS accounts has a newly established centralized internal process for purchasing new or modifying existing Reserved Instances. This process requires all business units that want to purchase or modify Reserved Instances to submit requests to a dedicated team for procurement or execution. Previously, business units would directly purchase or modify Reserved Instances in their own respective AWS accounts autonomously. Which combination of steps should be taken to proactively enforce the new process in the MOST secure way possible? (Select TWO.)

Options :

A : Ensure all AWS accounts are part of an AWS Organizations structure operating in all features mode

B : Use AWS Contig lo report on the attachment of an IAM policy that denies access to the ec2:PurchaseReservedlnstancesOffering and ec2:ModifyReservedlnstances actions.

C : In each AWS account, create an IAM policy with a DENY rule to the ec2:PurchaseReservedlnstancesOffering and ec2:ModifyReservedInstances actions

D : Create an SCP that contains a deny rule to the ec2:PurchaseReservedlnstancesOffering and ec2: Modify Reserved Instances actions. Attach the SCP to each organizational unit (OU) of the AWS Organizations structure.

E : Ensure that all AWS accounts are part of an AWS Organizations structure operating in consolidated billing features mode.

Answer: A,D

Question 2

A company is launching a new web application on Amazon EC2 instances. Development and production

workloads exist in separate AWS accounts.

According to the company's security requirements, only automated configuration tools are allowed to access

the production account. The company's security team wants to receive immediate notification if any manual

access to the production AWS account or EC2 instances occurs

Which combination of actions should a solutions architect take in the production account to meet these

requirements? (Select THREE.)

Options :

A : Turn on AWS CloudTrail logs in the application-s primary AWS Region Use Amazon Athena to queiy the logs for AwsConsoleSignln events.

B : Configure Amazon Simple Email Service (Amazon SES) to send email to the security team when an alarm is activated.

C : Deploy EC2 instances in an Auto Scaling group Configure the launch template to deploy instances without key pairs Configure Amazon CloudWatch Logs to capture system access logs Create an Amazon CloudWatch alarm that is based on the logs to detect when a user logs in to aEC2 instance

D : Configure an Amazon Simple Notification Service (Amazon SNS) topic to send a message to the security team when an alarm is activated

E : Turn on AWS CloudTrail logs for all AWS Regions. Configure Amazon CloudWatch alarms to provide an alert when an AwsConsoleSignin event is detected.

F : Deploy EC2 instances in an Auto Scaling group. Configure the launch template to delete the key pair after launch. Configure Amazon CloudWatch Logs for the system access logs Create an Amazon CloudWatch dashboard to show user logins over time.

Answer: A,C,D

Question 3

A company uses Amazon S3 to store files and images in a variety of storage classes. The company's S3 costs

have increased substantially during the past year.

A solutions architect needs to review data trends for the past 12 months and identity the appropriate storage

class for the objects.

Which solution will meet these requirements?

Options :

A :

Download AWS Cost and Usage Reports for the last 12 months of S3 usage. Review AWS Trusted

Advisor recommendations for cost savings.

B :

Use S3 storage class analysis. Import data trends into an Amazon QuickSight dashboard to analyze

storage trends.

C :

Use Amazon S3 Storage Lens. Upgrade the default dashboard to include advanced metrics for storage

trends.

D :

Use Access Analyzer for S3. Download the Access Analyzer for S3 report for the last 12 months. Import

the csvfile to an Amazon QuickSight dashboard.

Answer: B

Question 4

A company is planning to set up a REST API application on AWS. The application team wants to set up a new

identity store on AWS The IT team does not want to maintain any infrastructure or servers for this

deployment.

What is the MOST operationally efficient solution that meets these requirements?

Options :

A :

Deploy the application as AWS Lambda functions. Set up Amazon API Gateway REST API endpoints

for the application Create a Lambda function, and configure a Lambda authorizer

B :

Deploy the application in AWS AppSync, and configure AWS Lambda resolvers Set up an Amazon

Cognito user pool, and configure AWS AppSync to use the user pool for authorization

C :

Deploy the application as AWS Lambda functions. Set up Amazon API Gateway REST API endpoints

for the application Set up an Amazon Cognito user pool, and configure an Amazon Cognito authorizer

D :

Deploy the application in Amazon Elastic Kubemetes Service (Amazon EKS) clusters. Set up an

Application Load Balancer for the EKS pods Set up an Amazon Cognito user pool and service pod for

authentication.

Answer: C

Question 5

A shipping firm runs its web applications on its on-premises data center. The servers have a dependency on non-x86 hardware and the management plans to use AWS to scale its on-premises data storage. However, the backup application is only able to write to POSIX-compatible block-based storage. There is a total of 1,000 TB of data files that need to be mounted to a single folder on the file server. Existing users must also be able to access portions of this data while the backups are taking place.

Which of the following backup solutions would be most appropriate to meet the above requirements?

Options :

A : Use Amazon S3 as the target for your data backups.

B : Use Amazon Glacier as the target for your data backups.

C : Provision Gateway Cached Volumes from AWS Storage Gateway.

D : Provision Gateway Stored Volumes from AWS Storage Gateway.

Answer: C

Free SAP-C02 Mock Exam – Practice Online Confidently

Buying Options: