Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 28

Question 270

A private VPC workload must call DynamoDB without NAT, and security needs to restrict the permitted table operations through the approved private route. Which integrated solution supplies the correct network path and authorization controls?

Use a DynamoDB gateway endpoint but leave all endpoint and IAM access unrestricted instead of limiting the approved table operations.
Use a DynamoDB interface endpoint security group alone without enforcing the table-level IAM permissions requested.
Create a DynamoDB gateway VPC endpoint associated with the appropriate route tables, and apply scoped endpoint and identity permissions for the table operations.
Create the DynamoDB gateway endpoint but omit associating the route tables used by the private application subnets.

Explanation

Correct Answer

A DynamoDB gateway endpoint supplies private service routing for selected subnets, while endpoint and IAM policies govern what actions and principals may use the service.

Incorrect Answers

The gateway endpoint provides private routing, but without scoped endpoint and identity policies it does not satisfy the requested action boundary.

Network reachability controls do not replace the IAM or endpoint-policy authorization for selected DynamoDB operations.

The endpoint only routes traffic for the associated VPC route tables; unassociated private subnets may not use its path.

Question 271

A private data processing service uses an S3 gateway endpoint, but a bucket policy currently allows access from any source in the organization. Security needs to require the protected requests to arrive through one known endpoint. Which bucket policy condition supports the network boundary?

Use an S3 bucket policy with aws:PrincipalOrgID only while allowing member-account requests through any network path.
Allow Principal:* on every bucket object and assume the VPC endpoint name remains impossible to guess.
Use aws:SourceVpce with the allowed endpoint ID for supported direct S3 requests, plus least-privilege identity/resource permissions.
Use aws:SourceVpc with a permitted VPC ID but do not restrict to the particular gateway endpoint used by the workload.

Explanation

Correct Answer

SourceVpce constrains request origin through a VPC endpoint rather than trusting organization membership alone.

Incorrect Answers

Organization membership is distinct from a requirement that the request arrive via a particular approved VPC endpoint.

An open resource policy without a network-origin restriction defeats the intended private boundary.

SourceVpc can narrow origin to a VPC, but does not necessarily enforce the stricter identified endpoint ID requirement.

Question 272

A company enforces TLS for all access to a regulated S3 bucket, including requests that might otherwise use plain HTTP. It wants the bucket to deny those unencrypted requests at authorization time. Which condition is appropriate?

Enable Transfer Acceleration and assume the feature implicitly blocks all insecure operations to every bucket endpoint.
Add a bucket policy explicit deny for requests where aws:SecureTransport is false, with appropriate principal/service exceptions.
Enable only default S3 SSE-S3 encryption and assume encryption at rest forces every caller to use HTTPS.
Enable S3 Bucket Keys for SSE-KMS and assume a storage encryption setting denies unencrypted HTTP transport.

Explanation

Correct Answer

The SecureTransport condition tests whether the request uses TLS and can reject insecure request paths.

Incorrect Answers

Acceleration is not a universal enforce-TLS authorization rule for the bucket.

Object encryption at rest does not by itself prevent unencrypted network transport.

Bucket Keys reduce KMS call cost for object encryption, but do not enforce HTTPS at request-authorization time.

Question 273

A multi-account data lake is switching to S3 bucket-owner-enforced Object Ownership. Old uploader code still requires object ACLs to grant the owning account permission to read newly uploaded files. What design change is necessary?

Require every uploader to attach an object ACL granting bucket-owner-full-control and assume ACL grants remain authoritative after bucket-owner-enforced is enabled.
Switch to S3 bucket-owner-preferred Object Ownership and keep object ACL grants as mandatory, while claiming ACLs are disabled.
Update producers and bucket policies for bucket-owner-enforced ownership, remove dependence on object ACL grants and validate cross-account writes.
Retain a requirement that every upload supply an ACL granting another account full control while assuming ACLs remain authoritative.

Explanation

Correct Answer

Bucket owner enforced disables ACL-based permissions and gives ownership semantics controlled through policies rather than per-object ACLs.

Incorrect Answers

With bucket-owner-enforced, ACLs no longer control object permissions; legacy ACL-dependent ownership logic must be removed.

Bucket-owner-preferred still has ACL-related behavior; the specified bucket-owner-enforced mode requires authorization by policies instead.

Object ACLs are disabled under bucket-owner-enforced Object Ownership, making the legacy workflow incompatible.

Question 274

A regulated S3 data lake wants to provide different departments narrowly scoped aliases to the same bucket while enforcing department-specific access policies and restricted VPC network entry. Which service feature fits?

Use S3 Access Points with per-access-point policies and VPC restrictions as needed, retaining a restrictive underlying bucket policy.
Create only one unrestricted bucket policy with Principal:* and assume department names in object keys are authorization.
Create S3 Multi-Region Access Points only and assume their global routing aliases provide separate department-specific object authorization policies.
Use AWS Organizations cost allocation tags to label each department but leave the shared bucket policy unrestricted.

Explanation

Correct Answer

Access Points provide distinct named policy scopes over shared storage and can limit network origin for approved clients.

Incorrect Answers

Object key naming cannot replace explicit department and source network policy restrictions.

MRAPs optimize global access to regional buckets; they are not a substitute for separate per-department S3 Access Point policies and VPC scoping.

Billing attribution cannot enforce object reads, writes or VPC network-source restrictions per department.

Question 275

An application stores a database credential in AWS Systems Manager Parameter Store as a SecureString encrypted under a customer-managed KMS key. A role can read parameter names but cannot retrieve decrypted values. What permission is still needed?

Replace the SecureString type with a plain String without business approval to make every role able to read it.
Authorize the consuming role for relevant ssm:GetParameter calls with decryption and KMS decrypt rights on the chosen key.
Give the role permission only to list Parameter Store names and expect SecureString ciphertext to decrypt automatically.
Permit a role ssm:GetParameter on all paths but exclude kms:Decrypt for the customer-managed key that encrypts the SecureString.

Explanation

Correct Answer

A SecureString value is encrypted with KMS; parameter read permission alone may not allow decryption under the configured key policy.

Incorrect Answers

Removing encryption defeats the requirement to protect the credential at rest.

Metadata listing does not authorize reading or decrypting the protected value.

GetParameter authorization by itself cannot return decrypted values when KMS use of the selected customer key is denied.

Question 276

A Lambda function connects to an RDS MySQL database. Security wants to reduce long-lived database passwords and use short-lived IAM tokens where the engine and deployment support them. What database authentication design should be evaluated?

Use a long-lived Secrets Manager password in Lambda and rely only on automatic secret rotation instead of using supported IAM DB authentication tokens.
Use an RDS Proxy with ordinary permanent database user/password authentication and assume the proxy automatically generates IAM auth tokens for clients.
Enable supported IAM database authentication and grant the role rds-db:connect to the exact database user/resource, with TLS and token handling.
Grant only broad rds:DescribeDBInstances permission to the Lambda execution role without authorizing rds-db:connect to its database user.

Explanation

Correct Answer

IAM DB authentication uses temporary signed tokens and scoped IAM actions for supported RDS engines and configurations.

Incorrect Answers

Secrets Manager rotation is an alternative credential-management pattern but does not meet the explicitly requested token-based database IAM authentication.

RDS Proxy manages pooling and supports authentication configurations, but does not automatically replace static client credentials with the requested IAM database auth.

Management-plane describe permissions are not the RDS database connect authorization needed for IAM authentication.

Question 277

A public web application uses Cognito user pools for customer sign-in. The frontend currently accepts an arbitrary userId query parameter and returns private profiles without checking tokens. Which authorization improvement belongs in the backend?

Validate Cognito token signatures but accept the arbitrary userId query parameter without comparing it to the authenticated principal or resource rights.
Require a Cognito session cookie at CloudFront but deliver every private profile from an S3 public URL without backend ownership checks.
Validate the appropriate Cognito-issued JWT and enforce profile resource ownership or role claims before returning account-specific data.
Trust any userId parameter because Cognito authenticated a different user at login time.

Explanation

Correct Answer

Identity tokens establish authenticated caller context, but backend resource authorization still needs a subject-to-profile entitlement check.

Incorrect Answers

Token authentication by itself does not stop an authorized user from requesting a different customer’s profile without resource-level authorization.

Front-end sign-in does not authorize a separate public object path or the requested customer profile resource.

A caller-controlled identifier is not proof of permission to another account’s records.

Question 278

A security team wants to deploy a customer-managed AWS KMS key in two Regions and needs application ciphertext decryptable in either Region after a controlled failover, without manually synchronizing unrelated independent key material. Which KMS feature should it evaluate?

Use AWS KMS multi-Region keys where supported, with separate regional key policies and application failover design.
Create two unrelated single-Region KMS keys with the same alias and assume identical aliases imply identical key material.
Create ordinary single-Region customer-managed keys with identical aliases in both Regions and assume they share key material.
Use multi-Region keys but omit replica key permissions in the recovery Region, assuming policies automatically replicate with key material.

Explanation

Correct Answer

Multi-Region keys share compatible cryptographic key material across replicas while retaining distinct regional authorization and usage boundaries.

Incorrect Answers

Matching key aliases do not make independent KMS keys cryptographically interchangeable.

Alias names do not replicate cryptographic material; multi-Region key replicas are specifically designed to share related key material.

Multi-Region key material is related across Regions but key policies and grants are independently controlled and must authorize recovery principals.

Question 279

A team encrypts finance objects under an AWS KMS multi-Region key and assumes its key policy and grants automatically follow to every replica Region. A recovery-region workload is denied decrypt even though the key exists there. What must be corrected?

Replicate the KMS key material into the second Region and keep the regional replica key-policy permissions empty.
Configure appropriate permissions on the regional replica key policy and IAM principal; key material replication does not duplicate policy authorization.
Assume the primary Region key policy automatically grants all actions on every replica, regardless of its actual policy.
Grant S3 GetObject on the recovery bucket while leaving the requested KMS Decrypt denied under the replica key policy.

Explanation

Correct Answer

Multi-Region keys share key material and identifiers but authorization policies remain managed independently per Region.

Incorrect Answers

Material replication makes cryptographic operations potentially compatible but does not grant principals permission to use the replica.

Regional key policies are separate and can deny a caller despite matching key material.

S3 object read permissions do not bypass KMS key policy authorization for SSE-KMS-protected content.

Question 280

An internal application requires TLS certificates for private service names that are not publicly verifiable domain names. The enterprise needs certificate issuance under its private PKI trust and controlled renewal. Which AWS capability should it evaluate?

Use AWS Private Certificate Authority with supported ACM private certificate issuance and approved trust distribution.
Request a public ACM certificate for an arbitrary unowned private hostname and skip domain validation.
Use ACM public certificate issuance for a private, unowned internal DNS suffix without validating an eligible public domain.
Issue an ACM private certificate but omit distributing the private CA trust anchor to its intended service clients.

Explanation

Correct Answer

A private CA can issue certificates for internal names under a managed enterprise trust hierarchy without public domain validation.

Incorrect Answers

Public certificates require approved domain validation and cannot be issued for arbitrary private namespaces.

Public ACM issuance depends on publicly verifiable domain control and is not a general private internal PKI for arbitrary hostnames.

Private certificates require a trusted enterprise CA chain on clients; issuance without trust distribution does not establish usable authenticated TLS.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 270

Explanation

Correct Answer

Incorrect Answers

Question 271

Explanation

Correct Answer

Incorrect Answers

Question 272

Explanation

Correct Answer

Incorrect Answers

Question 273

Explanation

Correct Answer

Incorrect Answers

Question 274

Explanation

Correct Answer

Incorrect Answers

Question 275

Explanation

Correct Answer

Incorrect Answers

Question 276

Explanation

Correct Answer

Incorrect Answers

Question 277

Explanation

Correct Answer

Incorrect Answers

Question 278

Explanation

Correct Answer

Incorrect Answers

Question 279

Explanation

Correct Answer

Incorrect Answers

Question 280

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests