Question 1

A leading blockchain company is getting ready to do a major announcement of their latest product next month on their public website which is hosted in AWS. It is running on an Auto Scaling group of Spot EC2 instances deployed across multiple Availability Zones with a MySQL RDS database instance. The website performs a high number of read operations to load the articles for their clients around the globe and a relatively low number of write operations to store the comments and inquiries of customers on their products. Before the major announcement, the solutions architect did some performance testing and found out that the database could not handle a surge of incoming requests.

Which of the following options are cost-effective and suitable options to solve the database performance issue? (Select TWO.)

Options :

A : Launch a Read Replica in each Availability Zone.

B : Use Provisioned IOPS storage to improve the read performance of your database.

C : Implement sharding to the RDS instances and set up database caching with Amazon Elasticsearch Service (Amazon ES).

D : Upgrade the RDS MySQL Instance size and increase the Provisioned IOPS for both read and write capacity.

E : Implement database caching with CloudFront.

Answer: A,B

Question 2

A multinational software provider in the US hosts both of its development and test environments in the AWS cloud. The CTO decided to use separate AWS accounts in hosting each environment. The solutions architect has enabled Consolidated Billing to link each of the accounts' bill to a Master AWS account. To make sure that each account is kept within the budget, the administrators in the master account must have the power to stop, delete, and/or terminate resources in both development and test environment AWS accounts.

Which of the following options is the recommended action to meet the requirements for this scenario?

Options :

A : In the master account, you are to create IAM users and a cross-account role that has full admin permissions to the Dev and Test accounts.

B : By linking all accounts under Consolidated Billing, you will be able to provide IAM users in the master account access to Dev and Test account resources.

C : IAM users with full admin permissions will be created in the master account. In both Dev and Test accounts, generate cross-account roles that would grant the master account access to Dev and Test account resources through permissions inherited from the master account.

D : First, create IAM users in the master account. Then in the Dev and Test accounts, generate cross-account roles that have full admin permissions while granting access for the master account.

Answer: D

Question 3

A company is planning to launch a mobile app for the Department of Transportation that allows government staff to upload the latest photos of ongoing construction works such as bridges, roads culverts, and dams all over the country. The mobile app should send the photos to a web server hosted on an EC2 instance which then adds a watermark to each photo that contains the project details and the date it was taken. The solutions architect must design a solution in which the photos generated by the server will be uploaded to an S3 bucket for durable storage.

Which of the following solutions is a secure architecture and allows the EC2 instance to upload photos to S3?

Options :

A : Set up a service control policy (SCP) with permissions to list and write objects to the S3 bucket. Attach the SCP to the EC2 instance which will enable it to retrieve temporary security credentials from the instance metadata and use that access to upload the photos to the S3 bucket.

B : Set up an IAM service role with permissions to list and write objects to the S3 bucket. Attach the IAM role to the EC2 instance which will enable it to retrieve temporary security credentials from the instance userdata and use that access to upload the photos to the S3 bucket.

C : Set up an IAM role with permissions to list and write objects to the S3 bucket. Attach the IAM role to the EC2 instance which will enable it to retrieve temporary security credentials from the instance metadata and use that access to upload the photos to the S3 bucket.

D : Set up an IAM user with permissions to list and write objects to the S3 bucket. Launch the instance as the IAM user which will enable the EC2 instance to retrieve temporary security credentials from the instance userdata and use that access to upload the photos to the S3 bucket.

Answer: C

Question 4

An enterprise company wants to allow its developers to purchase third-party software through AWS

Marketplace. The company uses an AWS Organizations account structure with full features enabled, and has a

shared services account in each organizational unit (OU) that will be used by procurement managers. The

procurement team's policy indicates that developers should be able to obtain third-party software from an

approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement . The

procurement team wants administration of Private Marketplace to be restricted to a role named

procurement-manager-role, which could be assumed by procurement managers Other IAM users groups, roles,

and account administrators in the company should be denied Private Marketplace administrative access

What is the MOST efficient way to design an architecture to meet these requirements?

Options :

A :

Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the

PowerUserAccess managed policy to the role Apply an inline policy to all IAM users and roles in every

AWS account to deny permissions on the AWSPrivateMarketplaceAdminFullAccess managed policy.

B :

Create an IAM role named procurement-manager-role in all AWS accounts in the organization Add the

AdministratorAccess managed policy to the role Define a permissions boundary with the

AWSPrivateMarketplaceAdminFullAccess managed policy and attach it to all the developer roles.

C :

Create an IAM role named procurement-manager-role in all the shared services accounts in the

organization Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role Create an

organization root-level SCP to deny permissions to administer Private Marketplace to everyone except

the role named procurement-manager-role Create another organization root-level SCP to deny

permissions to create an IAM role named procurement-manager-role to everyone in the organization.

D :

Create an IAM role named procurement-manager-role in all AWS accounts that will be used by

developers. Add the AWSPrivateMarketplaceAdminFullAccess managed policy to the role. Create an

SCP in Organizations to deny permissions to administer Private Marketplace to everyone except the role

named procurement-manager-role. Apply the SCP to all the shared services accounts in the organization.

Answer: C

Question 5

A company hosts an intranet web application on Amazon EC2 instances behind an Application Load Balancer (ALB). Currently, users authenticate to the application against an internal user database. The company needs to authenticate users to the application by using an existing AWS Directory Service for Microsoft Active Directory directory. All users with accounts in the directory must have access to the application. Which solution will meet these requirements?

Options :

A :

Create a new app client in the directory. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule. Configure the listener rule with the appropriate issuer, client ID and secret, and endpoint details for the Active Directory service. Configure the new app client with the callback URL that the ALB provides.

B :

Configure an Amazon Cognito user pool. Configure the user pool with a federated identity provider (IdP) that has metadata from the directory. Create an app client. Associate the app client with the user pool. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule. Configure the listener rule to use the user pool and app client.

C :

Add the directory as a new 1AM identity provider (IdP). Create a new 1AM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Configure the new role as the default authenticated user role for the IdP. Create a listener rule for the ALB. Specify the authenticate-oidc action for the listener rule

D :

Enable AWS 1AM Identity Center (AWS Single Sign-On). Configure the directory as an external identity provider (IdP) that uses SAML. Use the automatic provisioning method. Create a new 1AM role that has an entity type of SAML 2.0 federation. Configure a role policy that allows access to the ALB. Attach the new role to all groups. Create a listener rule for the ALB. Specify the authenticate-cognito action for the listener rule.

Answer: A

Smartly Prepare Exam with Free Online SAP-C02 Practice Test

Buying Options: