Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 44

Question 430

A security platform already enforces S3 Block Public Access and has resolved external bucket-policy findings. The remaining problem is granting hundreds of workforce users and groups short-lived, least-privilege access to distinct project prefixes within shared approved buckets, without maintaining a separate broad IAM bucket policy for every user. Which S3 capability should it evaluate?

Use one broadly scoped S3 bucket policy granting each workforce group access to all project prefixes, without an individual prefix grant system.
Configure S3 Access Grants with registered bucket or prefix locations and scoped grants for approved IAM or directory identities, using vended temporary access credentials.
Create S3 Access Points with unrestricted bucket paths and treat each access point policy as a time-limited credential-vending workflow for directory groups.
Give each user an IAM Identity Center account permission set with s3:* on every shared project bucket and omit per-prefix authorization.

Explanation

Correct Answer

S3 Access Grants maps verified identities to specific S3 locations and provides short-lived scoped credentials for eligible object access.

Incorrect Answers

A shared broad bucket policy does not meet prefix-level least privilege or vend scoped temporary credentials for distinct workforce identities.

Access Points can scope resource access but do not by themselves implement S3 Access Grants' short-lived, identity-to-prefix credential vending.

A broad permission set does not grant separate resource-prefix scope and unnecessarily exposes unrelated project data.

Question 431

A payments application already revoked a previously exposed third-party API token and now retrieves a fresh token from Secrets Manager. The partner API supports rotating the credential through a service API; security policy requires a new valid token every 30 days while validating that old and new versions transition safely. What supported implementation should the team build?

Rotate the AWS KMS key encrypting the Secrets Manager secret but leave the credential accepted by the partner service unchanged.
Create a Secrets Manager rotation schedule with a supported Lambda rotation function that creates, applies, tests and finalizes token versions with scoped network and IAM access.
Configure a scheduled PutSecretValue call that writes a fresh random string but does not invoke the partner’s credential-rotation API.
Rotate an SSM Parameter Store SecureString version on a schedule and assume its history automatically updates the external API credential.

Explanation

Correct Answer

For supported non-database secrets, Lambda-backed Secrets Manager rotation can manage create/set/test/finish steps and coordinate service credentials and staging labels.

Incorrect Answers

KMS key rotation changes cryptographic key material for stored encryption, not the third-party service token itself.

Storing a new value without updating the external partner identity store breaks consistency between the application secret and the actual credential.

Parameter Store versions and encryption are not a coordinated partner-side credential rotation workflow with verified staged cutover.

Question 432

A data center team wants EC2 SSH access only through approved Systems Manager sessions and no open port 22. An audit finds 0.0.0.0/0 ingress on several production security groups. Which approach improves the architecture?

Use EC2 Instance Connect for every administrator but leave a broad 0.0.0.0/0 inbound port-22 rule in place on private instances.
Restrict SSH ingress and enforce approved Session Manager access with IAM, logging and suitable managed-instance connectivity.
Leave SSH open to the internet and use instance termination protection as the only remote access restriction.
Require SSH key rotation every 30 days while continuing to allow inbound SSH from the public internet on all production instances.

Explanation

Correct Answer

Session Manager can provide controlled administrative sessions without a publicly reachable SSH port, while policy and logs preserve accountability.

Incorrect Answers

Instance Connect can improve short-lived SSH key delivery, but retaining unrestricted port 22 contradicts the strict no-SSH network boundary.

Termination protection does not filter inbound port 22 or establish authorized administrative session controls.

Key rotation helps credentials but does not remove the exposed inbound network path or provide the Session Manager audit model.

Question 433

A security architect is designing permission sets for thousands of AWS workforce identities. Analysts should receive access based on verified department attributes and should not be able to self-assign a department tag. Which authorization model fits?

Permit users to set any privileged role session tag and assume a matching resource-tag condition guarantees segregation.
Use only a resource naming convention with no IAM condition on the department attribute.
Assign IAM Identity Center permission sets from groups without any reliable trusted department attribute or matching IAM resource conditions.
Use verified identity or principal tags in IAM ABAC conditions, with tightly controlled tag issuance and change permissions.

Explanation

Correct Answer

Attribute-based policies can restrict actions to matching resources only when principal attributes are trustworthy and cannot be forged.

Incorrect Answers

Untrusted principal tags allow callers to impersonate approved attributes and bypass the intended separation.

Names are human governance hints but do not enforce dynamic principal-to-resource authorization.

Permission sets control account access but do not by themselves enforce the requested department-based per-resource relationship without trusted tags and conditions.

Question 434

A security audit finds customer-managed KMS keys are shared between development and regulated production applications. Administrators want to rotate keys safely without losing access to old ciphertext and limit key use by environment. Which change is sensible?

Delete every key immediately after rotation and assume the new unrelated key decrypts all existing encrypted objects.
Grant both environments kms:* on every key and depend solely on friendly key aliases for isolation.
Enable automatic key rotation on the existing shared key but leave its broad development-and-production decrypt policy unchanged.
Separate keys by trust boundary, restrict their policies and grants, and use supported key rotation while preserving old ciphertext access.

Explanation

Correct Answer

Distinct KMS authorization scopes limit blast radius, and supported rotation retains the historical key material needed to decrypt prior data.

Incorrect Answers

Deleting a key breaks dependent ciphertext and is not a safe equivalent of cryptographic rotation.

Aliases are identification conveniences and do not replace least-privilege key and identity authorization.

Rotation preserves key material security but does not reduce unauthorized cross-environment use when identity and key policies remain overly broad.

Question 435

A security organization already enabled AWS Security Hub in 60 member accounts in three Regions, and its delegated administrator can view the findings when it switches to each individual Region. The security operations center now needs to inspect findings from all three enabled Regions in a single chosen home Region, with the linked Regions updated centrally. Which additional Security Hub configuration is required?

Configure a Security Hub cross-Region finding aggregator with the intended home and linked Regions after confirming member enablement in each Region.
Create new Security Hub member-account associations only in the existing home Region, even though all accounts are already enabled and visible in their own Regions.
Disable Security Hub in the remote Regions and assume the home Region automatically scans every former resource across AWS Regions.
Create a Security Hub insight in each Region and expect the individual regional insight definitions to replicate raw findings into the home Region.

Explanation

Correct Answer

A Security Hub finding aggregator collects enabled linked-Region findings into a designated home Region for centralized security investigation.

Incorrect Answers

Member onboarding concerns source coverage, not the missing cross-Region finding aggregation across already enabled Regions.

Disabling regional service coverage removes sources of findings and cannot create a complete consolidated posture view.

Insights aggregate/filter local finding data; they do not configure cross-Region findings replication into a designated home Region.

Question 436

A platform account defines organization-wide WAF policies for internet-facing load balancers in dozens of member accounts. Security needs central enforcement and awareness when teams deviate from approved web ACLs. Which governance service should it assess?

Use AWS Firewall Manager with an AWS Organizations administrator account and supported WAF policies for the target resources.
Manually configure unrelated network ACLs only and assume they inspect HTTP URI fields like a WAF rule.
Use AWS Organizations SCPs to deny manual WAF edits but do not create any managed Firewall Manager WAF policies for the required load balancers.
Enable Security Hub CSPM findings only and assume detective posture reports automatically attach the required WAF web ACLs to every ALB.

Explanation

Correct Answer

Firewall Manager centrally administers supported security policies across organization accounts and can identify noncompliant resources.

Incorrect Answers

VPC network ACLs do not implement layer-seven WAF expressions or central organization policy rollout.

An SCP can restrict who edits resources but does not deploy, monitor and remediate approved organization-wide WAF protections as Firewall Manager does.

Security posture detection is not equivalent to Firewall Manager’s centralized security-policy rollout and compliance management.

Question 437

A company uses AWS Config to flag S3 buckets that lose public-access blocking. It has a repair automation but auditors require evidence of which resource configuration triggered the decision and which runbook action was executed. Which design supports both?

Keep only CloudTrail control-plane policy changes and discard AWS Config compliance history and the related Automation execution records.
Retain AWS Config resource configuration history and compliance evaluations, and invoke auditable Systems Manager Automation remediation under scoped roles.
Enable S3 server access logging on the monitored bucket and treat ordinary object GET records as the history of AWS Config rule compliance and runbook steps.
Disable AWS Config after first failure and run privileged shell scripts without execution logging.

Explanation

Correct Answer

Configuration snapshots and logged remediation executions show the triggering state and corrective action for a compliance incident.

Incorrect Answers

CloudTrail can attribute API calls but does not alone preserve the exact Config evaluated resource state plus runbook execution needed to explain remediation.

S3 access logs capture request activity, not AWS Config resource configuration evaluations or SSM runbook step outcomes.

Stopping evaluation and logs removes the audit evidence explicitly required by compliance.

Question 438

A private HTTP service protected by AWS Verified Access authenticates users successfully, but devices that are not enrolled in the approved endpoint security system are still allowed. The current policy checks only user group membership. Which policy gap must be fixed?

Add and validate the supported device trust context conditions in the Verified Access access policy, with test cases for unenrolled devices.
Configure a Verified Access user trust provider and verify identity-group claims while omitting conditions for the device trust provider context.
Disable the device trust provider and rely on the successful workforce sign-in to prove endpoint compliance.
Associate the device trust provider with Verified Access but leave the access policy checking only user group membership.

Explanation

Correct Answer

Identity alone does not enforce device posture; the policy must explicitly evaluate the configured device trust signals.

Incorrect Answers

Identity authentication is already healthy; the missing authorization criterion is explicit enrolled-device posture from the configured device provider.

Authenticating a person does not prove that their endpoint satisfies the required device posture.

Defining a device trust provider without referencing its contextual conditions in the policy does not enforce the device-enrollment requirement.

Question 439

An enterprise has enabled Amazon Inspector EC2 vulnerability scanning, but several newly launched instances show Not scanning in the Inspector coverage view. The affected instances lack working Systems Manager managed-node registration and also fail at least one supported agentless scan eligibility requirement. Which investigation best addresses the missing EC2 coverage?

Enable Inspector enhanced ECR repository scanning and assume an unregistered EC2 host is scanned merely because the host pulls a container image from ECR.
Enable Security Hub cross-Region finding aggregation and assume it creates missing Inspector EC2 host package scans without changing scan prerequisites.
Turn on Inspector agentless scanning without verifying supported operating system, EBS-backed filesystems, volume limits or exclusion tags, and assume every EC2 instance becomes eligible.
Inspect Inspector EC2 coverage reasons and restore supported SSM-managed agent scanning or valid hybrid/agentless eligibility, required permissions and regional scan enablement.

Explanation

Correct Answer

Inspector EC2 package scanning depends on a supported SSM agent-managed path or eligible agentless EBS snapshot scanning; coverage status and scan-mode prerequisites identify why an instance is unscanned.

Incorrect Answers

ECR repository scanning concerns container images in the registry, not direct visibility into unmanaged EC2 host package inventories.

Security Hub can aggregate supported findings that already exist; it cannot repair Inspector EC2 host collection when the scanning configuration or instance eligibility is invalid.

Agentless EC2 scanning still has eligibility limits including supported OS, EBS filesystems and attached-volume limits; bypassing those checks does not guarantee scanning.

Question 440

A platform team publishes application container images into Amazon ECR. Security needs vulnerability findings at image push and another scan when a newly disclosed CVE affects a monitored image during its supported re-scan eligibility window. The findings must be available to the security workflow. Which ECR scanning mode should be configured?

Enable basic on-push image scanning only, and assume old images are rescanned automatically every time the vulnerability database publishes a new CVE.
Enable ECR enhanced scanning through Amazon Inspector with continuous scanning and an appropriate image monitoring/re-scan duration.
Enable only Amazon Inspector EC2 host package scanning on the container hosts, leaving ECR image repositories without continuous scanning.
Enable ECR tag immutability and image lifecycle expiration rules, assuming these controls continuously analyze packages in existing image layers for newly published CVEs.

Explanation

Correct Answer

Amazon Inspector enhanced continuous ECR scanning detects vulnerabilities on image push and rescan-eligible existing images when relevant new CVEs appear, with configurable monitoring duration and event-driven finding integration.

Incorrect Answers

Basic/on-push scanning checks images when pushed; it does not provide the required continuous CVE-triggered rechecks for eligible existing images.

Inspector EC2 scanning evaluates host software inventory and does not by itself configure ECR repositories to rescan stored container images when new CVEs affect those images.

Tag immutability and lifecycle retention preserve release identity and manage storage, but they are not vulnerability scanning engines and do not update image package findings.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 430

Explanation

Correct Answer

Incorrect Answers

Question 431

Explanation

Correct Answer

Incorrect Answers

Question 432

Explanation

Correct Answer

Incorrect Answers

Question 433

Explanation

Correct Answer

Incorrect Answers

Question 434

Explanation

Correct Answer

Incorrect Answers

Question 435

Explanation

Correct Answer

Incorrect Answers

Question 436

Explanation

Correct Answer

Incorrect Answers

Question 437

Explanation

Correct Answer

Incorrect Answers

Question 438

Explanation

Correct Answer

Incorrect Answers

Question 439

Explanation

Correct Answer

Incorrect Answers

Question 440

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests