100% Free Amazon SAP-C02 Practice Test Questions

Question 1

A FinTech startup has recently consolidated its multiple AWS accounts using AWS Organizations. It currently has two teams in its organization, a security team and a development team. The former is responsible for protecting their cloud infrastructure and making sure that all of their resources are compliant, while the latter is responsible for developing new applications that are deployed to EC2 instances. The security team is required to set up a system that will check if all of the running EC2 instances are using an approved AMI. However, the solution should not stop the development team from deploying an EC2 instance running on a non-approved AMI. The disruption is only allowed once the deployment has been completed. In addition, they have to set up a notification system that sends the compliance state of the resources to determine whether they are compliant.

Which of the following options is the most suitable solution that the security team should implement?

A : Set up a Trusted Advisor check that will verify whether the running EC2 instances in your VPCs are using approved AMIs. Create a CloudWatch alarm and integrate it with the Trusted Advisor metrics that will check all of the AMIs being used by your EC2 instances and that will send a notification if there is a running instance which uses an unapproved AMI

B : Create and assign an SCP and an IAM policy that restricts the AWS accounts and the development team from launching an EC2 instance using an unapproved AMI. Create a CloudWatch alarm that will automatically notify the security team if there are non-compliant EC2 instances running in their VPCs.

C : Use an AWS Config Managed Rule and specify a list of approved AMI IDs. This rule will check whether running EC2 instances are using specified AMIs. Configure AWS Config to stream configuration changes and notifications to an Amazon SNS topic which will send a notification for non-compliant instances.

D : Use the Amazon Inspector service to automatically check all of the AMIs that are being used by your EC2 instances. Set up an SNS topic that will send a notification to both the security and development teams if there is a non-compliant EC2 instance running in their VPCs.

Answer: C

Question 2

A company that provisions job boards for a seasonal workforce is seeing an increase in traffic and usage. The backend services run on a pair of Amazon EC2 instances behind an Application Load Balancer with Amazon DynamoDB as the datastore. Application read and write traffic is slow during peak seasons. Which option provides a scalable application architecture to handle peak seasons with the LEAST development effort?

A : Migrate the backend services to AWS Lambda. Increase the read and write capacity of DynamoDB.

B : Migrate the backend services to AWS Lambda. Configure DynamoDB to use global tables.

C : Use Auto Scaling groups for the backend services. Use DynamoDB auto scaling.

D : Use Auto Scaling groups for the backend services. Use Amazon Simple Queue Service (Amazon SQS) and an AWS Lambda function to write to DynamoDB.

Answer: C

Question 3

A software-as-a-service (SaaS) provider exposes APIs through an Application Load Balancer (ALB). The ALB connects to an Amazon Elastic Kubernetes Service (Amazon EKS) cluster that is deployed in the us-east-I Region. The exposed APIs contain usage of a few non-standard REST methods: LINK, UNLINK, LOCK, and UNLOCK.

Users outside the United States are reporting long and inconsistent response times for these APIs. A solutions architect needs to resolve this problem with a solution that minimizes operational overhead.

Which solution meets these requirements?

A : Add an Amazon CloudFront distribution. Configure the ALB as the origin.

B : Add an Amazon API Gateway edge-optimized API endpoint to expose the APIs. Configure the ALB as the target.

C : Add an accelerator in AWS Global Accelerator. Configure the ALB as the origin.

D : Deploy the APIs to two additional AWS Regions: eu-west-l and ap-southeast-2. Add latency-based routing records in Amazon Route 53.

Answer: C

Question 4

A company is using a lift-and-shift strategy to migrate applications from several on-premises Windows servers

to AWS. The Windows servers will be hosted on Amazon EC2 instances in the us-east-1 Region.

The company's security policy allows the installation of migration tools on servers. The migration data must

be encrypted in transit and encrypted at rest. The applications are business critical. The company needs to

minimize the cutover window and minimize the downtime that results from the migration. The company wants

to use Amazon CloudWatch and AWS CloudTrail for monitoring.

Which solution will meet these requirements?

A : Use AWS Application Migration Service (CloudEnsure Migration) to migrate the Windows servers toAWS. Create a Replication Settings template. Install the AWS Replication Agent on the source servers

B : Use AWS DataSync to migrate the Windows servers to AWS. Install the DataSync agent on the sourceservers. Configure a blueprint for the target servers. Begin the replication process.

C : Use AWS Server Migration Service (AWS SMS) to migrate the Windows servers to AWS. Install theSMS Connector on the source servers. Replicate the source servers to AWS. Convert the replicatedvolumes to AMIs to launch EC2 instances.

D : Use AWS Migration Hub to migrate the Windows servers to AWS. Create a project in Migration Hub.Track the progress of server migration by using the built-in dashboard.

Answer: A

Question 5

A company has 50 AWS accounts that are members of an organization in AWS Organizations Each account

contains multiple VPCs The company wants to use AWS Transit Gateway to establish connectivity between

the VPCs in each member account Each time a new member account is created, the company wants to

automate the process of creating a new VPC and a transit gateway attachment.

Which combination of steps will meet these requirements? (Select TWO)

A : From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager

B : Prom the management account, share the transit gateway with member accounts by using an AWS Organizations SCP

C : Launch an AWS CloudFormation stack set from the management account that automatical^/ creates a new VPC and a VPC transit gateway attachment in a member account. Associate the attachment with the transit gateway in the management account by using the transit gateway ID.

D : Launch an AWS CloudFormation stack set from the management account that automatical^ creates a new VPC and a peering transit gateway attachment in a member account. Share the attachment with the transit gateway in the management account by using a transit gateway service-linked role.

E : From the management account, share the transit gateway with member accounts by using AWS Service Catalog

Answer: A,C

Free Practice Amazon SAP-C02 Exam Questions 2025