AWS SAP-C02 Free Practice Questions — Page 3

Correct Answers: B. Enable resource sharing from the AWS Organizations management account.; D. Create a resource share in AWS Resource Access Manager in the infrastructure account. Select the specific AWS Organizations OU that will use the shared network. Select each subnet to associate with the resource share.

Option B is required to enable AWS Resource Access Manager (RAM) sharing from the AWS Organizations management account - this is a prerequisite for sharing resources across accounts in an organization. Option D creates a resource share in RAM within the infrastructure account and shares specific subnets with the designated OU, allowing other accounts to launch resources in those shared subnets while the infrastructure account maintains network control. This meets the requirement that individual accounts cannot manage their own networks but can create resources within subnets. Option A is incorrect because Transit Gateway is for connecting multiple VPCs, but the requirement is to share a single VPC's network. Option C is incorrect because it creates separate VPCs in each account (violating the "share a common network" requirement) and VPC peering doesn't allow sharing of subnets for resource creation. Option E is incorrect because you share subnets, not prefix lists - prefix lists are used for routing and security group rules, not for sharing network infrastructure.

Correct Answer: A. Create an AWS PrivateLink interface VPC endpoint. Connect this endpoint to the endpoint service that the third-party SaaS application provides. Create a security group to limit the access to the endpoint. Associate the security group with the endpoint.

AWS PrivateLink interface VPC endpoint allows the company to privately access the third-party SaaS application without traversing the internet. The company creates the interface endpoint in their VPC, which connects to the endpoint service that the third-party provider has already set up. The security group limits access according to least privilege principles. This is the correct direction - the consumer creates the interface endpoint to connect to the provider's endpoint service. Option B is incorrect because Site-to-Site VPN requires configuration on both sides and doesn't align with the SaaS consumption model. Option C is incorrect because VPC peering requires both parties to manage routing and doesn't provide the same level of isolation as PrivateLink. Option D is incorrect because it has the roles reversed - the third-party SaaS provider should create the endpoint service, and the company creates the interface endpoint to consume it.

Correct Answer: A. Use AWS Systems Manager to manage patches on the on-premises servers and EC2 instances. Use Systems Manager to generate patch compliance reports

AWS Systems Manager Patch Manager provides unified patch management for both on-premises servers and EC2 instances through a single service. It supports multiple operating systems, can manage hybrid environments via the Systems Manager agent, and generates comprehensive patch compliance reports showing the status of all managed instances in a single dashboard. This directly meets the requirement for a single report across all servers. Option B is incorrect because OpsWorks is primarily a configuration management service, not designed for patch management, and QuickSight integration doesn't provide native patch compliance reporting. Option C is incorrect because EventBridge with patch remediation doesn't provide the comprehensive reporting needed, and Amazon Inspector is for vulnerability assessments, not patch compliance reporting. Option D is incorrect because OpsWorks doesn't manage patches, and X-Ray is for application tracing, not patch management.

Correct Answer: B. Create an AWS Systems Manager document with a script to copy log files to Amazon S3. Create an Auto Scaling lifecycle hook and an Amazon EventBridge (Amazon CloudWatch Events) rule to detect lifecycle events from the Auto Scaling group. Invoke an AWS Lambda function on the autoscaling:EC2_INSTANCE_TERMINATING transition to call the AWS Systems Manager API SendCommand operation to run the document to copy the log files and send CONTINUE to the Auto Scaling group to terminate the instance.

This solution uses Auto Scaling lifecycle hooks to intercept the termination process, putting the instance in a "Terminating:Wait" state. When EventBridge detects the autoscaling:EC2_INSTANCE_TERMINATING event, it triggers a Lambda function that uses Systems Manager SendCommand to execute the document/script that copies log files to S3. After the logs are copied, the Lambda sends CONTINUE to the Auto Scaling group, allowing the instance to terminate gracefully. This is the proper pattern for ensuring data is saved before termination. Option A is incorrect because sending ABANDON prevents termination indefinitely and then manually terminating via SDK bypasses Auto Scaling's lifecycle management. Option C is incorrect because user data only runs at instance launch, not termination, and EventBridge detecting termination happens too late. Option D is incorrect because SNS notification adds unnecessary complexity, and sending ABANDON (rather than CONTINUE) after copying logs would prevent proper termination.

Correct Answers: C. Create an authorization to associate the private hosted zone in Account A with the new VPC in Account B.; E. Associate a new VPC in Account B with a hosted zone in Account A. Delete the association authorization in Account A.

For cross-account Route 53 private hosted zone resolution, you need a two-step process: Option C creates an authorization in Account A to allow the private hosted zone to be associated with VPCs in Account B - this is the first step that grants permission. Option E completes the process by associating the new VPC in Account B with the hosted zone in Account A, then deleting the authorization (which is no longer needed after association). This allows EC2 instances in Account B's VPC to resolve DNS records from Account A's private hosted zone. Option A is incorrect because it changes the architecture unnecessarily. Option B is incorrect because manually editing /etc/resolv.conf is not a scalable or proper solution and would need to be updated if the RDS endpoint changes. Option D is incorrect because Route 53 doesn't have cross-account replication - you use cross-account association instead.