Question 1

A publishing company's design team updates the icons and other static assets that an ecommerce web

application uses. The company serves the icons and assets from an Amazon S3 bucket that is hosted in the

company's production account. The company also uses a development account that members of the design

team can access.

After the design team tests the static assets in the development account, the design team needs to load the

assets into the S3 bucket in the production account. A solutions architect must provide the design team with

access to the production account without exposing other parts of the web application to the risk of unwanted

changes.

Which combination of steps will meet these requirements? (Select THREE.)

Options :

A : In the production account, create a new IAM policy that allows read and write access to the S3 bucket.

B : In the development account, create a new IAM policy that allows read and write access to the S3 bucket.

C : In the production account, create a role. Attach the new policy to the role. Define the development account as a trusted entity.

D : In the development account, create a role. Attach the new policy to the role. Define the production account as a trusted entity.

E : In the development account, create a group that contains all the IAM users of the design team. Attach a different IAM policy to the group to allow the sts:AssumeRole action on the role in the production account.

F : In the development account, create a group that contains all tfje IAM users of the design team. Attach a different IAM policy to the group to allow the sts;AssumeRole action on the role in the development account.

Answer: A,C,E

Question 2

During an audit, a security team discovered that a development team was putting IAM user secret access keys

in their code and then committing it to an AWS CodeCommit repository . The security team wants to

automatically find and remediate instances of this security vulnerability

Which solution will ensure that the credentials are appropriately secured automatically?

Options :

A :

Run a script nightly using AWS Systems Manager Run Command to search for credentials on the

development instances If found use AWS Secrets Manager to rotate the credentials.

B :

Use a scheduled AWS Lambda function to download and scan the application code from CodeCommit

If credentials are found, generate new credentials and store them in AWS KMS

C :

Configure Amazon Macie to scan for credentials in CodeCommit repositories If credentials are found,

trigger an AWS Lambda function to disable the credentials and notify the user

D :

Configure a CodeCommit trigger to invoke an AWS Lambda function to scan new code submissions for

credentials If credentials are found, disable them in AWS IAM and notify the user.

Answer: A

Question 3

A company needs to migrate its customer transactions database from on premises to AWS. The database resides on an Oracle DB instance that runs on a Linux server. According to a new security requirement, the company must rotate the database password each year. Which solution will meet these requirements with the LEAST operational overhead?

Options :

A : Convert the database to Amazon DynamoDB by using the AWS Schema Conversion Tool (AWS SCT). Store the password in AWS Systems Manager Parameter Store. Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.

B : Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation. Configure a yearly rotation schedule.

C : Migrate the database to an Amazon EC2 instance. Use AWS Systems Manager Parameter Store to keep and rotate the connection string by using an AWS Lambda function on a yearly schedule

D : Migrate the database to Amazon Neptune by using the AWS Schema Conversion Tool {AWS SCT). Create an Amazon CloudWatch alarm to invoke an AWS Lambda function for yearly password rotation.

Answer: B

Question 4

An international foreign exchange company has a serverless forex trading application that was built using AWS SAM and is hosted on AWS Serverless Application Repository. They have millions of users worldwide who use their online portal 24/7 to trade currencies. However, they are receiving a lot of complaints that it takes a few minutes for their users to log in to their portal lately, including occasional HTTP 504 errors. As the Solutions Architect, you are tasked to optimize the system and to significantly reduce the time to log in to improve the customers' satisfaction.

Which of the following should you implement in order to improve the performance of the application with minimal cost? (Select TWO.)

Options :

A : Use Lambda@Edge to allow your Lambda functions to customize content that CloudFront delivers and to execute the authentication process in AWS locations closer to the users.

B : Set up multiple and geographically disperse VPCs to various AWS regions then create a transit VPC to connect all of your resources. Deploy the Lambda function in each region using AWS SAM, in order to handle the requests faster.

C : Set up an origin failover by creating an origin group with two origins. Specify one as the primary origin and the other as the second origin which CloudFront automatically switches to when the primary origin returns specific HTTP status code failure responses.

D : Increase the cache hit ratio of your CloudFront distribution by configuring your origin to add a Cache-Control max-age directive to your objects, and specify the longest practical value for max-age.

E : Deploy your application to multiple AWS regions to accommodate your users around the world. Set up a Route 53 record with latency routing policy to route incoming traffic to the region that provides the best latency to the user.

Answer: A,C

Question 5

a company needs to create a centralized logging architecture for all of its AWS accounts. The architecture

should provide near-real-time data analysis for all AWS CloudTrail logs and VPC Flow logs across an AWS

accounts. The company plans to use Amazon Elasticsearch Service (Amazon ES) to perform log analyses in

me logging account.

Which strategy should a solutions architect use to meet These requirements?

Options :

A :

Configure CloudTrail and VPC Flow Logs m each AWS account to send data to a centralized Amazon

S3 Ducket in the fogging account. Create an AWS Lambda function to load data from the S3 bucket to

Amazon ES m the togging account

B :

Configure CloudTrail and VPC Flow Logs to send data to a fog group m Amazon CloudWatch Logs n

each AWS account Configure a CloudWatch subscription filter m each AWS account to send data to

Amazon Kinesis Data Firehose In the fogging account Load data from Kinesis Data Firehose Into

Amazon ES in the logging account

C :

Configure CloudTrail and VPC Flow Logs to send data to a separate Amazon S3 bucket In each AWS

account. Create an AWS Lambda function triggered by S3 evens to copy the data to a centralized

logging bucket. Create another Lambda function lo load data from the S3 bucket to Amazon ES in the

logging account.

D :

Configure CloudTrail and VPC Flow Logs to send data to a fog group in Amazon CloudWatch Logs n

each AWS account Create AWS Lambda functions in each AWS account to subscribe to the tog groups

and stream the data to an Amazon S3 bucket in the togging account. Create another Lambda function to

toad data from the S3 bucket to Amazon ES in the logging account.

Answer: A

Free SAP-C02 Mock Exam – Practice Online Confidently

Buying Options: