SAP-C02 (Page 29)

During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository.The security team wants to automatically find and remediate instances of this security vulnerability.Which solution will ensure that the credentials are appropriately secured automatically?Read More →

A company has automated the nightly retraining of its machine learning models by using AWS Step Functions.The workflow consists of multiple steps that use AWS Lambda.Each step can fail for various reasons, and any failure causes a failure of the overall workflow.A review reveals that the retraining has failed multiple nights in a row without the company noticing the failure.A solutions architect needs to improve the workflow so that notifications are sent for all types of failures in the retraining process.Which combination of steps should the solutions architect take to meet these requirements? (Choose three.)Read More →

A company’s solutions architect is reviewing a web application that runs on AWS.The application references static assets in an Amazon S3 bucket in the us-east-1 Region.The company needs resiliency across multiple AWS Regions.The company already has created an S3 bucket in a second Region.Which solution will meet these requirements with the LEAST operational overhead?Read More →

A company is storing data on premises on a Windows file server.The company produces 5 GB of new data daily.The company migrated part of its Windows-based workload to AWS and needs the data to be available on a file system in the cloud.The company already has established an AWS Direct Connect connection between the on-premises network and AWS.Which data migration strategy should the company use?Read More →

A company has created an OU in AWS Organizations for each of its engineering teams.Each OU owns multiple AWS accounts.The organization has hundreds of AWS accounts.A solutions architect must design a solution so that each OU can view a breakdown of usage costs across its AWS accounts.Which solution meets these requirements?Read More →

An enterprise company wants to allow its developers to purchase third-party software through AWS Marketplace.The company uses an AWS Organizations account structure with full features enabled, and has a shared services account in each organizational unit (OU) that will be used by procurement managers.The procurement team’s policy indicates that developers should be able to obtain third-party software from an approved list only and use Private Marketplace in AWS Marketplace to achieve this requirement.The procurement team wants administration of Private Marketplace to be restricted to a role named procurement-manager-role, which could be assumed by procurement managers.Other IAM users, groups, roles, and account administrators in the company should be denied Private Marketplace administrative access.What is the MOST efficient way to design an architecture to meet these requirements?Read More →

A company has 50 AWS accounts that are members of an organization in AWS Organizations.Each account contains multiple VPCs.The company wants to use AWS Transit Gateway to establish connectivity between the VPCs in each member account.Each time a new member account is created, the company wants to automate the process of creating a new VPC and a transit gateway attachment.Which combination of steps will meet these requirements? (Choose two.)Read More →

A company that has multiple AWS accounts is using AWS Organizations.The company’s AWS accounts host VPCs, Amazon EC2 instances, and containers.The company’s compliance team has deployed a security tool in each VPC where the company has deployments.The security tools run on EC2 instances and send information to the AWS account that is dedicated for the compliance team.The company has tagged all the compliance-related resources with a key of “costCenter” and a value or “compliance”.The company wants to identify the cost of the security tools that are running on the EC2 instances so that the company can charge the compliance team’s AWS account.The cost calculation must be as accurate as possible.What should a solutions architect do to meet these requirements?Read More →

A company is storing data in several Amazon DynamoDB tables.A solutions architect must use a serverless architecture to make the data accessible publicly through a simple API over HTTPS.The solution must scale automatically in response to demand.Which solutions meet these requirements? (Choose two.)Read More →

A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3.For the next version of the application, the security engineer wants to implement the following application design changes to improve security:The database must use strong, randomly generated passwords stored in a secure AWS managed service.The application resources must be deployed through AWS CloudFormation.The application must rotate credentials for the database every 90 days.A solutions architect will generate a CloudFormation template to deploy the application.Which resources specified in the CloudFormation template will meet the security engineer’s requirements with the LEAST amount of operational overhead?Read More →