AWS SAP-C02 Free Practice Questions — Page 2

Correct Answers: C. In Account A, set the S3 bucket policy to the following: { "Effect": "Allow", "Principal": { "AWS": "arn:aws:iam::AccountB:user/User_DataProcessor" }, "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::AccountABucketName/*" ] }; D. In Account B, set the permissions of User_DataProcessor to the following: { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": "arn:aws:s3:::AccountABucketName/*" }

For cross-account S3 access, you need both the resource-based policy (bucket policy in Account A) and the identity-based policy (IAM permissions in Account B). Option C correctly sets the bucket policy in Account A with a Principal specifying the exact IAM user ARN from Account B, along with the necessary actions (GetObject and ListBucket). Option D correctly grants the IAM user in Account B permissions to access the specific S3 bucket resources. Both policies must work together - the bucket policy grants permission TO the user, and the IAM policy grants permission FOR the user to perform those actions. Option A is wrong because CORS is for web browser cross-origin requests, not cross-account access. Option B is wrong because it lacks the Principal field, making it invalid. Option E is wrong because IAM user policies don't use the Principal field - that's only for resource-based policies.

Correct Answer: B. Upload the container images to Amazon Elastic Container Registry (Amazon ECR). Configure two auto scaled Amazon Elastic Container Service (Amazon ECS) clusters with the Fargate launch type to handle the expected load. Deploy tasks from the ECR images. Configure two separate Application Load Balancers to direct traffic to the ECS clusters.

ECS with Fargate is the most cost-effective serverless container solution that meets all requirements. Fargate provides true serverless container orchestration with auto-scaling capabilities, allowing you to handle variable load efficiently while only paying for resources used. Using two separate ECS clusters for production and testing environments provides clear separation and independent scaling. Option A is incorrect because Lambda has limitations for container workloads (15-minute timeout, 10GB memory limit, and containers must comply with Lambda's runtime interface). Option C is incorrect because EKS adds unnecessary complexity and cost compared to ECS - EKS is overkill for this use case and has higher operational overhead. Option D is incorrect because Elastic Beanstalk, while simpler, is not truly serverless and doesn't minimize operational complexity as effectively as ECS Fargate for containerized microservices.

Correct Answer: B. Create an AWS Lambda function in the backup Region to promote the read replica and modify the Auto Scaling group values. Configure Route 53 with a health check that monitors the web application and sends an Amazon Simple Notification Service (Amazon SNS) notification to the Lambda function when the health check status is unhealthy. Update the application's Route 53 record with a failover policy that routes traffic to the ALB in the backup Region when a health check failure occurs.

This solution provides automated failover within the 15-minute RTO requirement. Route 53 health checks actively monitor the application's availability and can trigger failover by updating DNS records with a failover routing policy. The Lambda function in the backup region automates the critical failover tasks: promoting the read replica to become the primary database and scaling up the Auto Scaling group from zero to handle traffic. SNS provides reliable notification triggering for the Lambda function. Option A is incorrect because latency-based routing doesn't provide failover - it routes based on latency, not health, so traffic would still go to a failed primary region. Option C is incorrect because it describes an active-active setup (same Auto Scaling values in both regions), which violates the budget constraint, and RDS doesn't support cross-region replication via S3 snapshots in real-time. Option D is incorrect because Global Accelerator doesn't solve the RTO problem - it would still route traffic to unhealthy targets, and using 5XX errors as a trigger is less reliable than Route 53 health checks.

Correct Answers: A. Use an Elastic Load Balancer to distribute traffic across multiple EC2 instances. Ensure that the EC2 instances are part of an Auto Scaling group that has a minimum capacity of two instances.; D. Modify the DB instance to create a Multi-AZ deployment that extends across two Availability Zones.; F. Create a replication group for the ElastiCache for Redis cluster. Enable Multi-AZ on the cluster.

Option A provides high availability for the EC2 application tier by distributing traffic across multiple instances in an Auto Scaling group with minimum capacity of 2, ensuring automatic recovery if an instance fails. Option D enables RDS Multi-AZ deployment, which automatically replicates data synchronously to a standby instance in another AZ and provides automatic failover (typically 1-2 minutes). Option F creates an ElastiCache replication group with Multi-AZ enabled, providing automatic failover for the in-memory cache layer. Option B is incorrect because "unlimited mode" relates to T-instance CPU credits, not high availability. Option C is incorrect because a read replica in the same AZ doesn't protect against AZ failure, and manual promotion doesn't meet the "automatically recover" requirement. Option E is incorrect because ElastiCache doesn't use Auto Scaling groups - it uses replication groups with cluster mode or Multi-AZ configurations.

Correct Answers: A. Create an Amazon S3 bucket. Configure the S3 bucket to host a static webpage. Upload the custom error pages to Amazon S3.; E. Add a custom error response by configuring a CloudFront custom error page. Modify DNS records to point to a publicly accessible web page.

Option A creates an S3 bucket to host the custom error page content - this is a simple, low-overhead solution for static error pages. Option E configures CloudFront to serve custom error pages by adding a custom error response configuration, which intercepts 502 errors from the ALB origin and displays the S3-hosted custom page instead. This is the least operational overhead because CloudFront handles the error interception automatically without additional logic or monitoring. Options B and D are incorrect because they involve complex CloudWatch alarms and Lambda functions to modify ALB forwarding rules, which is excessive operational overhead and doesn't actually solve the problem of displaying custom error pages. Option C is incorrect because Route 53 health checks and DNS failover don't address displaying custom error pages - they redirect to different endpoints entirely, which doesn't help when the issue is intermittent malformed headers.