Question 1

A leading commercial bank has a hybrid network architecture and is extensively using AWS for its day-to-day operations. The bank uses an Amazon S3 bucket to store sensitive bank records. It has versioning enabled and does not have any encryption. The new solutions architect for the company was asked to implement Server-Side Encryption with Customer-Provided Encryption Keys (SSE-C) for the Amazon S3 bucket to ensure data inside it is secured both at rest and in transit.

Which of the following options should the solutions architect implement to achieve the company requirements? (Select TWO.)

Options :

A : For presigned URLs, specify the algorithm using the x-amz-server-side-encryption-customer-key-MD5 request header

B : For Amazon S3 REST API calls, use the following HTTP Request Headers: x-amz-server-side-encryption-customer-algorithm x-amz-server-side-encryption-customer-key x-amz-server-side-encryption-customer-key-MD5

C :

Only use the S3 console to upload and update objects with SSE-C encryption.

D : Use WSS (WebSocket Secure)

E : For presigned URLs, specify the algorithm using the x-amz-server-side-encryption-customer-algorithm request header

Answer: A,B

Question 2

A company's solutions architect is analyzing costs of a multi-application environment. The environment is deployed across multiple Availability Zones in a single AWS Region. After a recent acquisition, the company manages two organizations in AWS Organizations. The company has created multiple service provider applications as AWS PrivateLink-powered VPC endpoint services in one organization. The company has created multiple service consumer applications in the other organization. Data transfer charges are much higher than the company expected, and the solutions architect needs to reduce the costs. The solutions architect must recommend guidelines for developers to follow when they deploy services. These guidelines must minimize data transfer charges for the whole environment. Which guidelines meet these requirements? (Select TWO.)

Options :

A :

Use AWS Resource Access Manager to share the subnets that host the service provider applications with other accounts in the organization.

B :

Place the service provider applications and the service consumer applications in AWS accounts in the same organization.

C :

Turn off cross-zone load balancing for the Network Load Balancer in all service provider application deployments.

D :

Ensure that service consumer compute resources use the Availability Zone-specific endpoint service by using the endpoint-s local DNS name.

E :

Create a Savings Plan that provides adequate coverage for the organization-s planned inter-Availability Zone data transfer usage

Answer: C,D

Question 3

A company with global offices has a single 1 Gbps AWS Direct Connect connection to a single AWS Region.

The company's on-premises network uses the connection to communicate with the company's resources in the

AWS Cloud. The connection has a single private virtual interface that connects to a single VPC.

A solutions architect must implement a solution that adds a redundant Direct Connect connection in the same

Region. The solution also must provide connectivity to other Regions through the same pair of Direct Connect

connections as the company expands into other Regions.

Which solution meets these requirements?

Options :

A :

Provision a Direct Connect gateway. Delete the existing private virtual interface from the existing

connection. Create the second Direct Connect connection. Create a new private virtual interlace on each

connection, and connect both private victual interfaces to the Direct Connect gateway. Connect the

Direct Connect gateway to the single VPC.

B :

Keep the existing private virtual interface. Create the second Direct Connect connection. Create a new

private virtual interface on the new connection, and connect the new private virtual interface to the

single VPC.

C :

Keep the existing private virtual interface. Create the second Direct Connect connection. Create a new

public virtual interface on the new connection, and connect the new public virtual interface to the single

VPC.

D :

Provision a transit gateway. Delete the existing private virtual interface from the existing connection.

Create the second Direct Connect connection. Create a new private virtual interface on each connection,

and connect both private virtual interfaces to the transit gateway. Associate the transit gateway with the

single VPC.

Answer: A

Question 4

There was a major incident that occurred in your company wherein the web application that you are supporting unexpectedly went down in the production environment. Upon investigation, it was found that a junior DevOps engineer terminated the EC2 instance in production which caused the disruption of service. Only the Solutions Architects should be allowed to stop or terminate instances in the production environment. You also found out that there are a lot of developers who have full access to your production AWS account.

Which of the following options will fix this security vulnerability in your cloud architecture and prevent this kind of failure from happening again? (Select TWO.)

Options :

A : Modify the associated IAM Role assigned to the developers by removing the policy that allows them to terminate EC2 instances in production.

B : Replace the Security Group of all of the EC2 instances in Production to prevent developers from accessing it.

C : Modify the IAM policy of the developers to require MFA before deleting EC2 instances.

D : Add tags to the EC2 instances in the production environment and add resource-level permissions to the developers with an explicit deny on terminating the instance which contains the tag.

E : Attach a PowerUserAccess AWS managed policy to the developers.

Answer: A,D

Question 5

A company has an on-premises data center that is hosting its gaming service. Its primary function is player-matching and is accessible from players around the world. The gaming service prioritizes network speed for the users so all traffic to the servers uses User Datagram Protocol (UDP). As more players join, the company is having difficulty scaling its infrastructure so it plans to migrate the service to the AWS cloud. The Solutions Architect has been tasked with the migration and AWS Shield Advanced has been enabled already to protect all public-facing resources.

Which of the following actions should the Solutions Architect implement to achieve the company requirements? (Select TWO.)

Options :

A : Create an Amazon CloudFront distribution and set the Load Balancer as the origin. Use only secure protocols on the distribution origin settings.

B : Place the Auto Scaling of Amazon EC2 instances behind a Network Load Balancer (NLB). For the domain name, create an Amazon Route 53 entry that points to the Elastic IP address of the NLB.

C :

Place the Auto Scaling of Amazon EC2 instances behind an Internet-facing Application Load Balancer (ALB). For the domain name, create an Amazon Route 53 entry that is Aliased to the FQDN of the ALB.

D : Create an AWS WAF rule that will explicitly block all non-UDP traffic. Ensure that the AWS WAF rule is associated with the load balancer of the EC2 instances.

E : Set up network ACL rules on the VPC to deny all non-UDP traffic. Ensure that the NACL is associated with the load balancer subnets.

Answer: A,B

Smartly Prepare Exam with Free Online SAP-C02 Practice Test

Buying Options: