Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 13

Question 120

A regional business application has S3 data and stateless compute deployed to two Regions, but the second Region requires a copy of the original KMS-encrypted secrets and regional IAM configuration. A disaster drill fails only at secret retrieval. Which dependency must the recovery design handle?

Replicate S3 objects but leave secret values and KMS permissions configured exclusively in the primary Region.
Replicate a Secrets Manager secret metadata record without decryptable regional KMS key access for the standby application role.
Grant the standby service broader s3:GetObject permissions and assume it can retrieve Secrets Manager secrets through the S3 data path.
Provision or replicate the secret in the secondary Region under a usable regional KMS key and authorize the recovery workload role.

Explanation

Correct Answer

A recovered app cannot start if a required secret remains accessible only with a primary-region encryption key or policy.

Incorrect Answers

S3 object replication does not automatically create regional Secrets Manager replicas or provide an authorized recovery-region KMS path.

Secret existence is insufficient when ciphertext depends on a key or permissions unavailable during primary-region isolation.

S3 object permissions are separate from Secrets Manager and KMS authorization; the missing dependency requires proper secret replication and access.

Question 121

A payment API uses multiple AWS Regions with database replication. The business asks to advertise a zero-minute RTO even though regional traffic failover, application warmup and transaction conflict checks take time during scheduled exercises. Which architectural conclusion is defensible?

Rely on synchronous replication and a warm recovery database alone, since the remaining application and identity tiers can be started during the incident.
Report only the database promotion time as RTO, excluding client reconnection and production transaction checks.
Report the measured end-to-end RTO and identify necessary standby capacity and automation changes before promising near-zero interruption.
Set very low Route 53 TTL values and use regional health checks as proof that recovery is instantaneous.

Explanation

Correct Answer

RTO is the elapsed time to restore usable business service, not just the time to detect regional failure or start database promotion.

Incorrect Answers

Replication reduces potential data loss but does not eliminate application initialization, identity dependencies, routing propagation, and session restoration time. The observed full recovery interval still matters.

Database promotion is one stage in restoring the service. The contractual RTO must measure end-to-end usable functionality, including traffic cutover and validation.

DNS TTL tuning and health routing improve a part of failover, but caching, connection retries, warmup, and application state can still extend effective recovery.

Question 122

A regulated team needs a safety window against accidental deletion of Amazon EBS snapshots and EBS-backed AMIs. Engineers may delete old recovery assets, but compliance requires a chance to restore accidentally deleted snapshots for 45 days without copying them to a second account. Which AWS mechanism provides this regional recovery window when configured before deletion?

Enable EBS fast snapshot restore only, expecting it to retain deleted snapshots and AMIs for 45 days.
Configure Amazon EBS Recycle Bin snapshot/AMI retention rules in the source Region for the required 45 days, verify scope and permissions, and restore eligible deleted resources before expiration.
Enable RDS automated backups and assume they preserve all manually deleted EBS snapshot and EBS-backed AMI IDs.
Create S3 Lifecycle rules on an unrelated bucket and assume deleted EBS recovery objects are automatically recovered by S3 archival.

Explanation

Correct Answer

EBS Recycle Bin can retain eligible deleted snapshots and EBS-backed AMIs under matching regional rules for the chosen period; they remain restorable until the rule retention expires.

Incorrect Answers

Fast snapshot restore accelerates first-access performance for retained snapshots, but does not prevent snapshot/AMI deletion or provide a retention window.

RDS database backups are a separate resource workflow and do not automatically intercept deletion of generic EBS snapshots and AMIs.

S3 Lifecycle applies to S3 objects and does not intercept EC2 AMI or EBS snapshot deletion without an EBS Recycle Bin rule.

Question 123

An enterprise is onboarding 120 AWS accounts. Security requires organization-wide API audit events in a dedicated log archive account and a separate, centrally visible record of configuration compliance. Which TWO components provide those distinct controls?

Configure an organization trail with a central S3 destination controlled by the log archive account.
Enable CloudTrail management-event history independently in each member account and query only the management account history during audits.
Use AWS Config organization aggregation, with recorders and required permissions configured in the member accounts.
Attach an SCP requiring CloudTrail usage, then treat the SCP compliance result as the requested centralized API-event archive.
Create a CloudTrail Lake event data store for selected events but do not establish the dedicated archive-account trail or Config recorders.

Explanation

Correct Answer

An organization trail can cover member accounts and deliver events centrally; the destination policy and organization trail configuration must explicitly permit delivery.

AWS Config organization aggregation provides central visibility of resource configuration and compliance, provided that source accounts and regions record the required data.

Incorrect Answers

Per-account event histories do not themselves deliver durable organization-wide events to the dedicated archive. An organization trail with governed delivery is required.

SCPs are preventive authorization boundaries, not a central trail or immutable event-delivery mechanism. A policy alone does not produce the archived API records.

CloudTrail Lake can support event querying, but it cannot by itself replace the separate required archive-account delivery AND AWS Config configuration-compliance aggregation.

Question 124

An enterprise needs a repeatable process for provisioning AWS accounts into approved OUs with centralized baseline logging, security guardrails and a self-service request path. Which capability best fits this multi-account governance need?

Use AWS Organizations CreateAccount and apply a CloudFormation StackSet after each request, with manual OU selection and control enrollment.
Deploy AWS Service Catalog products only into existing accounts and let teams request new accounts through ad hoc administrator tickets.
Automate AWS Organizations CreateAccount but provision landing-zone guardrails only when an auditor later detects missing resources.
Use AWS Control Tower Account Factory for governed account vending and consistent landing-zone guardrails.

Explanation

Correct Answer

Account Factory provisions managed member accounts into the governed landing zone and helps standardize approved account baselines.

Incorrect Answers

This can assemble pieces of account provisioning but leaves the governed vending, approvals and consistent landing-zone enrollment as bespoke operations rather than the requested managed Account Factory workflow.

Service Catalog governs products in accounts, not the complete account-vending lifecycle with OU enrollment, preventive controls and baseline logging.

Creating an account is not equivalent to enrolling it into the governed landing-zone workflow; delayed retrofit fails the requirement for consistent baseline controls on provisioning.

Question 125

A network OU owns shared subnets in a VPC, and application OUs must launch their own EC2 instances into those subnets while network routing stays under central control. All accounts belong to the same AWS Organization. Which design enables this ownership separation?

Share the entire VPC through VPC peering and let application accounts create instances in the owner account using their own IAM policies.
Share a Transit Gateway attachment with application accounts, allowing them to attach their separate VPCs rather than launch into centrally owned subnets.
Share selected VPC subnets using AWS Resource Access Manager with member accounts and keep subnet/routing ownership centralized.
Use AWS Resource Access Manager to share route tables and security groups only, without sharing the selected subnets.

Explanation

Correct Answer

AWS RAM VPC sharing lets participant accounts create eligible resources in shared subnets without owning the VPC or its routing resources.

Incorrect Answers

VPC peering provides packet reachability, not ownership-separated launch into the same subnet; IAM access and subnet sharing require distinct cross-account authorization.

TGW sharing is useful for routed multi-VPC connectivity but does not let an account place its EC2 ENIs inside the centrally managed VPC subnets in this scenario.

Those controls do not confer the participant subnet association necessary for EC2 launches into a shared VPC; the supported RAM subnet share is the enabling construct.

Question 126

A central security account must administer GuardDuty findings for dozens of AWS Organization member accounts while the management account remains minimally used. Which strategy preserves this delegated administrative model?

Create a security-account GuardDuty detector and export selected member findings with EventBridge rules, without member-account enrollment.
Designate an appropriate delegated administrator for GuardDuty and configure organization-wide member enrollment and coverage by Region.
Configure an AWS Organizations delegated administrator for Security Hub only, expecting it to enable every GuardDuty detector automatically.
Enable GuardDuty in the management account and grant it permission to query other members, omitting service-specific delegated administration.

Explanation

Correct Answer

Supported security services can use delegated administrator accounts, avoiding day-to-day operation in the management account while enabling central findings.

Incorrect Answers

Event routing is useful downstream but cannot compensate for absent GuardDuty detectors and organization membership across accounts and Regions.

Delegated administration is service specific. Security Hub delegation alone does not establish GuardDuty organization membership or per-Region threat detection coverage.

A management-account detector does not automatically provide the centrally governed member coverage and separate security-account operating model requested.

Question 127

A company wants sandbox accounts to have looser service experimentation policies than production accounts, while all accounts inherit mandatory identity and logging guardrails. Which OU structure supports this without copying every control to each account?

Use separate IAM identity groups for sandbox and production but keep both account populations in a single OU with identical SCP inheritance.
Attach baseline SCPs directly to each individual account and permit each sandbox owner to replace its copy independently.
Place production and sandbox accounts in distinct OUs under common inherited guardrails, with OU-specific SCPs where appropriate.
Place sandbox accounts in a separate AWS Organization so their SCP root does not inherit the mandatory logging and identity controls.

Explanation

Correct Answer

OU hierarchy permits inheritance of common boundaries while applying more restrictive policies to production and controlled flexibility to sandboxes.

Incorrect Answers

Identity-group differences can restrict named principals but cannot provide OU-specific preventive service policies while preserving organization-wide inherited controls.

Duplicated account policies increase drift and let inherited guardrails diverge, while the requirement calls for common mandatory control inheritance plus distinct OU-specific restrictions.

A separate organization removes the required shared parent-guardrail inheritance and adds governance complexity rather than using OU policy hierarchy.

Question 128

Finance requires mandatory department tags on new resources in all development accounts. The platform team proposes an AWS Organizations tag policy by itself as a hard provisioning deny. What architectural correction is necessary?

Use tag policies for consistent tag keys and values, and complement them with tested IAM or SCP conditions or service-specific controls for enforceable creation requirements.
Enforce tag-key capitalization and approved tag values in an Organizations tag policy, assuming that also rejects every create API request without a department tag.
Activate department tags for Cost Explorer and notify the owner after detecting an untagged charge instead of enforcing tags at creation.
Apply an IAM condition to some EC2 launch APIs only and assume the same condition and tag support cover every AWS resource creation call.

Explanation

Correct Answer

Tag policies standardize and report supported tag compliance but are not a universal authorization deny for untagged creation; permission controls are needed.

Incorrect Answers

Tag policies can govern supported tag-key/value compliance, but basic enforcement does not automatically deny resource creation when required tags are absent.

Billing attribution is detective, not the preventive IAM/SCP or service-specific create-time condition required for mandatory tagging.

Tag-on-create support and IAM condition keys vary by API and resource. A tested, service-specific preventive design is required; one EC2 condition is not universal.

Question 129

An organization manages 85 accounts and wants centralized policy deployment that creates matching VPC Flow Log configuration in every chosen member account and Region. It requires managed execution role handling with AWS Organizations integration. Which deployment mechanism fits?

Create one CloudFormation stack in the Organizations management account and specify an OU name as a template parameter.
Use CloudFormation StackSets with service-managed AWS Organizations permissions, target the approved OUs and Regions, and enable automatic deployment for later account additions.
Build one manually maintained CodePipeline action and cross-account IAM deployment role for each of the 85 accounts and each target Region.
Create AWS Config organization rules that detect missing VPC Flow Logs and assume the rules themselves automatically deploy the Flow Logs resources.

Explanation

Correct Answer

Service-managed StackSets deploy consistent templates to organization member accounts and Regions with supported automatic account targeting and role lifecycle, avoiding separately embedded member credentials.

Incorrect Answers

A normal stack manages the resources in its own deployment account and Region; an OU parameter does not automatically create corresponding regional stacks in member accounts.

Custom role-and-pipeline orchestration can be engineered but does not satisfy the desired Organizations-integrated, service-managed permissions model with minimal individual role maintenance.

Config organization rules evaluate compliance and can invoke explicitly configured remediation, but they do not by themselves constitute a managed multi-account CloudFormation baseline deployment.

Question 130

An enterprise uses AWS Organizations OUs for production and development. Security applies a common SCP at a parent OU and more restrictive SCPs to production. A developer says the production child policy should override a parent explicit Deny. What should the architect clarify?

Attach an account-level SCP allowing all AWS API actions and assume it cancels an inherited parent OU explicit Deny.
An explicit Deny inherited from a parent cannot be overridden by an Allow in a child; effective permission boundaries combine along the account path.
Child OU Allow statements automatically cancel parent Deny statements whenever their policy JSON is more recent.
Attach an AdministratorAccess IAM identity policy to the application role while retaining the parent OU explicit Deny.

Explanation

Correct Answer

SCP evaluation preserves explicit deny and requires applicable allows under the selected policy strategy across each relevant OU level.

Incorrect Answers

An account-level Allow cannot supersede an explicit Deny inherited anywhere along its AWS Organizations ancestry.

Explicit deny semantics are not superseded by newer allows in a lower-level organizational policy.

IAM grants are bounded by applicable SCP explicit denies; a broad IAM allow remains ineffective for the denied operation.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 120

Explanation

Correct Answer

Incorrect Answers

Question 121

Explanation

Correct Answer

Incorrect Answers

Question 122

Explanation

Correct Answer

Incorrect Answers

Question 123

Explanation

Correct Answer

Incorrect Answers

Question 124

Explanation

Correct Answer

Incorrect Answers

Question 125

Explanation

Correct Answer

Incorrect Answers

Question 126

Explanation

Correct Answer

Incorrect Answers

Question 127

Explanation

Correct Answer

Incorrect Answers

Question 128

Explanation

Correct Answer

Incorrect Answers

Question 129

Explanation

Correct Answer

Incorrect Answers

Question 130

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests