100% Free Amazon SAP-C02 Practice Test Questions

Question 1

A company is running several workloads in a single AWS account. A new company policy states that

engineers can provision only approved resources and that engineers must use AWS CloudFormation to

provision these resources. A solutions architect needs to create a solution to enforce the new restriction on the

IAM role that the engineers use for access.

What should the solutions architect do to create the solution?

A : Upload AWS CloudFormation templates that contain approved resources to an Amazon S3 bucket.Update the IAM policy for the engineers' IAM role to only allow access to Amazon S3 and AWSCloudFormation. Use AWS CloudFormation templates to provision resources.

B : Update the IAM policy for the engineers' IAM role with permissions to only allow provisioning ofapproved resources and AWS CloudFormation. Use AWS CloudFormation templates to create stackswith approved resources.

C : Update the IAM policy for the engineers' IAM role with permissions to only allow AWSCloudFormation actions. Create a new IAM policy with permission to provision approved resources,and assign the policy to a new IAM service role. Assign the IAM service role to AWS CloudFormationduring stack creation.

D : Provision resources in AWS CloudFormation stacks. Update the IAM policy for the engineers' IAM roleto only allow access to their own AWS CloudFormation stack.

Answer: B

Question 2

A company has built a high performance computing (HPC) cluster in AWS for a tightly coupled workload that

generates a large number of shared files stored in Amazon EFS. The cluster was performing well when the

number of Amazon EC2 instances in the cluster was 100. However, when the company increased the cluster

size to 1,000 EC2 instances, overall performance was well below expectations

Which collection of design choices should a solutions architect make to achieve the maximum performance

from the HPC cluster? (Select THREE.)

A : Ensure the HPC cluster is launched within a single Availability Zone.

B : Launch the EC2 instances and attach elastic network interfaces in multiples of four.

C : Select EC2 instance types with an Elastic Fabric Adapter (EFA) enabled

D : Ensure the cluster is launched across multiple Availability Zones.

E : Replace Amazon EFS with multiple Amazon EBS volumes in a RAID array.

F : Replace Amazon EFS with Amazon FSx for Lustre.

Answer: A,C

Question 3

A research company is running daily simul-ations in the AWS Cloud to meet high demand. The simu-lations run on several hundred Amazon EC2 instances that are based on Amazon Linux 2. Occasionally, a simu-lation gets stuck and requires a cloud operations engineer to solve the problem by connecting to an EC2 instance through SSH. Company policy states that no EC2 instance can use the same SSH key and that all connections must be logged in AWS CloudTrail. How can a solutions architect meet these requirements?

A : Launch new EC2 instances, and generate an individual SSH key for each instance. Store the SSH key in AWS Secrets Manager. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the GetSecretValue action. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.

B : Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH key. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement to run Systems Manager documents. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.

C : Launch new EC2 instances without setting up any SSH key for the instances. Set up EC2 Instance Connect on each instance. Create a new IAM policy, and attach it to the engineers' IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the instance by using a browser-based SSH client from the EC2 console.

D : Set up AWS Secrets Manager to store the EC2 SSH key. Create a new AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2 instance. Configure Secrets Manager to use the Lambda function for automatic rotation once daily. Instruct the engineers to fetch the SSH key from Secrets Manager when they connect through any SSH client.

Answer: C

Question 4

A large software company has an on-premises LDAP server and a web application hosted on its VPC in AWS. The solutions architect has established an IPSec VPN connection between the AWS VPC and the company’s on-premises network. The company wants to enable employees to access the web application and other AWS resources using the same corporate account used inside the company network.

Which of the following actions should the solutions architect implement to achieve the company requirements? (SELECT TWO.)

A : Create an identity broker that authenticates against STS to assume an IAM role to generate temporary AWS security credentials. For user authentication, configure the web application to call the identity broker to get AWS temporary security credentials.

B : Integrate the on-premises LDAP server with IAM so the users can log into IAM using their corporate LDAP credentials. Once authenticated, they can use the temporary credentials to access any AWS resource.

C : Launch an identity broker that authenticates against LDAP server and then calls STS to get IAM federated user credentials. Configure the web application to call the identity broker that you created to get IAM federated user credentials with access to the appropriate AWS service

D : Configure the web application to authenticate against the on-premises LDAP server and retrieve the name of an IAM role associated with the user. The application then calls the STS to assume that IAM role. The application can use the temporary credentials to access any AWS resource

Answer: C,D

Question 5

A delivery company needs to migrate its third-party route planning application to AWS. The third party

supplies a supported Docker image from a public registry. The image can run in as many containers as

required to generate the route map.

The company has divided the delivery area into sections with supply hubs so that delivery drivers travel the

shortest distance possible from the hubs to the customers. To reduce the time necessary to generate route

maps, each section uses its own set of Docker containers with a custom configuration that processes orders

only in the section's area.

The company needs the ability to allocate resources cost-effectively based on the number of running

containers.

Which solution will meet these requirements with the LEAST operational overhead?

A : Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on Amazon EC2. Use the AmazonEKS CLI to launch the planning application in pods by using the -tags option to assign a custom tag tothe pod.

B : Create an Amazon Elastic Kubernetes Service (Amazon EKS) cluster on AWS Fargate. Use the AmazonEKS CLI to launch the planning application. Use the AWS CLI tag-resource API call to assign a customtag to the pod.

C : Create an Amazon Elastic Container Service (Amazon ECS) cluster on Amazon EC2. Use the AWS CLIwith run-tasks set to true to launch the planning application by using the -tags option to assign a customtag to the task.

D : Create an Amazon Elastic Container Service (Amazon ECS) cluster on AWS Fargate. Use the AWSCLI run-task command and set enableECSManagedTags to true to launch the planning application. Usethe --tags option to assign a custom tag to the task.

Answer: D

Free Practice Amazon SAP-C02 Exam Questions 2026