Question 1

A retail company is planning to deploy its business analytics application on AWS to gather insights on customer behaviors and preferences. With a large amount of data that needs to be processed, the application requires 10,000 hours of computing time every month. Since this is for analytics, the company is flexible when it comes to the availability of compute resources and wants the solution to be as cost-effective as possible. Supplementing the analytics application, a reporting service needs to run continuously to distribute analytical reports.

Which of the following is a cost-effective solution that will satisfy the company's requirements?

Options :

A : Create a container for the analytics application and run it on Amazon ECS with AWS Fargate. Configure a custom metric with Service Auto Scaling to scale the analytics application and meet the needed capacity. Deploy the reporting service on a fleet of Amazon EC2 Spot instances.

B : Deploy the analytics service on a fleet of Amazon EC2 Spot instances in an Auto Scaling group. Configure a custom metric to scale the Spot fleet to meet the needed capacity. Create a container for the reporting service and run it on Amazon ECS with AWS Fargate.

C : Deploy the analytics service on a combination of Amazon EC2 On-Demand instances and Reserved Instances with a 3-year term. Configure a custom metric in Auto Scaling to scale the fleet to meet the needed capacity. Deploy the reporting service container on AWS App Runner to reduce cost and operational overhead.

D : Deploy the analytics service on AWS App Runner to reduce operational overhead. Configure Auto Scaling to the service to meet the needed capacity. Deploy the reporting service on an Amazon EC2 On-Demand instance.

Answer: B

Question 2

How can a company patch EC2 instanceswithout internet access, using apatch source in another account, while accessing Systems Manager and S3?

Options :

A : Custom VPN servers

B : Transit Gateway + private VIFs

C : VPC endpoints+VPC peeringwith patch source

D : Network ACLs + Transit Gateway

Answer: C

Question 3

A company has a few AWS accounts for development and wants to move its production application to AWS. The company needs to enforce Amazon Elastic Block Store (Amazon EBS) encryption at rest current production accounts and future production accounts only. The company needs a solution that includes built-in blueprints and guardrails.

Which combination of steps will meet these requirements? (Choose three.)

Options :

A : Use AWS CloudFormation StackSets to deploy AWS Config rules on production accounts.

B : Create a new AWS Control Tower landing zone in an existing developer account. Create OUs for accounts. Add production and development accounts to production and development OUs, respectively.

C : Create a new AWS Control Tower landing zone in the company-s management account. Add production and development accounts to production and development OUs. respectively.

D : Invite existing accounts to join the organization in AWS Organizations. Create SCPs to ensure compliance.

E : Create a guardrail from the management account to detect EBS encryption.

F : Create a guardrail for the production OU to detect EBS encryption.

Answer: C,D,F

Question 4

A large mobile gaming company has successfully migrated all of its on-premises infrastructure to the AWS

Cloud. A solutions architect is reviewing the environment to ensure that it was built according to the design

and that it is running in alignment with the Well-Architected Framework.

While reviewing previous monthly costs in Cost Explorer, the solutions architect notices that the creation and

subsequent termination of several large instance types account for a high proportion of the costs. The solutions

architect finds out that the company's developers are launching new Amazon EC2 instances as part of their

testing and that the developers are not using the appropriate instance types.

The solutions architect must implement a control mechanism to limit the instance types that only the

developers can launch.

Which solution will meet these requirements?

Options :

A :

Create a desired-instance-type managed rule in AWS Config. Configure the rule with the instance types

that are allowed. Attach the rule to an event to run each time a new EC2 instance is launched.

B :

In the EC2 console, create a launch template that specifies the instance types that are allowed. Assign

the launch template to the developers' IAM accounts.

C :

Create a new IAM policy. Specify the instance types that are allowed. Attach the policy to an IAM

group that contains the IAM accounts for the developers

D :

Use EC2 Image Builder to create an image pipeline for the developers and assist them in the creation of

a golden image.

Answer: C

Question 5

A company with several AWS accounts is using AWS Organizations and service control policies (SCPs). An

Administrator created the following SCP and has attached it to an organizational unit (OU) that contains AWS

account 1111-1111-1111:

Developers working in account 1111-1111-1111 complain that they cannot create Amazon S3 buckets. How

should the Administrator address this problem?

Options :

A : Add s3:CreateBucket with €Allow€ effect to the SCP.

B : Remove the account from the OU, and attach the SCP directly to account 1111-1111-1111.

C : Instruct the Developers to add Amazon S3 permissions to their IAM entities.

D : Remove the SCP from account 1111-1111-1111.

Answer: C

Free SAP-C02 Mock Exam – Practice Online Confidently

Buying Options: