Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 45

Question 440

A platform team publishes application container images into Amazon ECR. Security needs vulnerability findings at image push and another scan when a newly disclosed CVE affects a monitored image during its supported re-scan eligibility window. The findings must be available to the security workflow. Which ECR scanning mode should be configured?

Enable basic on-push image scanning only, and assume old images are rescanned automatically every time the vulnerability database publishes a new CVE.
Enable ECR enhanced scanning through Amazon Inspector with continuous scanning and an appropriate image monitoring/re-scan duration.
Enable only Amazon Inspector EC2 host package scanning on the container hosts, leaving ECR image repositories without continuous scanning.
Enable ECR tag immutability and image lifecycle expiration rules, assuming these controls continuously analyze packages in existing image layers for newly published CVEs.

Explanation

Correct Answer

Amazon Inspector enhanced continuous ECR scanning detects vulnerabilities on image push and rescan-eligible existing images when relevant new CVEs appear, with configurable monitoring duration and event-driven finding integration.

Incorrect Answers

Basic/on-push scanning checks images when pushed; it does not provide the required continuous CVE-triggered rechecks for eligible existing images.

Inspector EC2 scanning evaluates host software inventory and does not by itself configure ECR repositories to rescan stored container images when new CVEs affect those images.

Tag immutability and lifecycle retention preserve release identity and manage storage, but they are not vulnerability scanning engines and do not update image package findings.

Question 441

An organization wants to investigate unusual EC2 instance communications to a malicious domain identified by GuardDuty. Security needs linked AWS entity and event context to understand the affected instance, role and associated activity. Which investigation service is designed to assist?

Use only a GuardDuty finding summary without navigating correlated role/entity relationships or events over the incident timeline.
Use Amazon Detective where supported to explore GuardDuty-linked entities, relationships and activity timelines.
Query CloudTrail Lake manually for selected API calls and assume it provides the entire GuardDuty-related host/network entity graph by default.
Launch a GuardDuty malware scan of an attached EBS volume and treat a clean file scan as a complete role-and-API activity correlation.

Explanation

Correct Answer

Detective can correlate security signal context into investigation views rather than relying only on a standalone alert name.

Incorrect Answers

GuardDuty identifies the initial suspicious behavior, but the requested linked entity and event graph requires a deeper correlation workflow.

CloudTrail queries can aid investigation but are not the same managed entity-link and timeline analysis that Detective offers.

Malware scanning addresses file evidence; it does not replace the requested relationship and activity-context investigation.

Question 442

A security program aggregates VPC Flow Logs, Route 53 Resolver logs and CloudTrail records across many AWS accounts. Its analysts want a standardized data lake with managed normalization into security schemas and controlled access for investigation tools. Which AWS service is relevant?

Use CloudTrail Lake exclusively for management API events, without collecting the VPC Flow Logs and DNS logs required for normalized multi-source correlation.
Evaluate Amazon Security Lake with organizational sources, supported OCSF normalization and governed S3-based access.
Upload raw CloudTrail, DNS and VPC logs to one S3 prefix and assume incompatible record schemas are automatically normalized and securely shared.
Enable Security Hub finding aggregation only and assume it archives the original VPC Flow Log and Route 53 Resolver event records in OCSF form.

Explanation

Correct Answer

Security Lake centralizes supported security logs and normalizes records for cross-source investigation under explicit access controls.

Incorrect Answers

CloudTrail Lake queries trail data, but the specified multi-source OCSF-normalized security data lake needs supported additional log sources and governance.

A raw S3 bucket can contain all three formats but does not itself transform them into OCSF with Security Lake’s source management and governed subscriber model.

Finding aggregation centralizes security conclusions, not the full raw telemetry lake or required OCSF-normalized source logs.

Question 443

Security analysts detect a suspicious shell script execution on EC2 and want additional malware detection evidence while preserving response options. Their current program uses GuardDuty only for AWS API and DNS anomalies. Which optional capability should they assess?

Delete the instance immediately before evidence collection or snapshot approval, regardless of the investigation plan.
Enable Amazon Inspector EC2 vulnerability scanning only and use package CVE findings as proof that the suspicious executable file itself was malware-scanned.
Evaluate GuardDuty Malware Protection for EC2 with approved scanning prerequisites and event response policies.
Enable GuardDuty Runtime Monitoring only and treat process-behavior events as a replacement for malware inspection of supported EBS storage.

Explanation

Correct Answer

GuardDuty Malware Protection can examine supported attached storage in response to appropriate findings, supplementing behavioral detection.

Incorrect Answers

Premature destruction may erase evidence and does not constitute a managed malware scanning strategy.

Inspector evaluates vulnerabilities and package exposure, not the same GuardDuty Malware Protection disk-scan evidence for suspect malicious files.

Runtime Monitoring is complementary process telemetry, whereas Malware Protection provides distinct malicious file detection on eligible volumes.

Question 444

A company discovers multiple long-lived IAM user access keys that have not been used for months. Security needs to identify actual use before disabling or deleting them, without breaking dormant business integrations. Which IAM inventory should it review?

Use IAM Access Analyzer unused-role findings only, without inspecting the last-use timestamps and status of the IAM user access keys.
Use IAM credential reports and access key last-used information, then rotate or remove validated dormant keys through a controlled rollout.
Delete every IAM user immediately without inventory, owner confirmation or recovery handling.
Tighten IAM console password rules but leave every unused programmatic access key active and unreviewed.

Explanation

Correct Answer

Credential and last-use evidence helps distinguish stale credentials from still-required service integration paths.

Incorrect Answers

Role unused-access analysis does not replace IAM user credential reports and key-specific last-used evidence for these long-lived user keys.

Unreviewed deletion can break production integrations and does not meet controlled credential hygiene.

Console password complexity is independent of access-key last-use and revocation risk.

Question 445

A SaaS production role currently permits broad EC2 read and write actions. IAM Access Analyzer already reports unused-role findings, but its owners now need a candidate IAM policy based on the actual API calls made by this specific role during the previous 45 days. The team will inspect gaps for scheduled maintenance and resource scoping before attaching a new policy. Which capability provides the starting policy document?

IAM Access Analyzer policy generation from a specified existing CloudTrail trail and a supported observation window, followed by human validation and tightening.
Create only an IAM Access Analyzer unused-access analyzer and download its external resource-access findings as the role policy.
Use the IAM credential report to generate per-action Allow statements from the role’s prior EC2 API calls.
Use CloudTrail Lake SQL query results alone as an automatically attachable IAM identity policy with no review.

Explanation

Correct Answer

IAM Access Analyzer can derive a policy template from the role's CloudTrail activity within an eligible lookback window; review is required because coverage is not exhaustive.

Incorrect Answers

Unused-access findings and external-access scans identify potential risk; they do not themselves create a role-specific IAM policy based on a chosen CloudTrail event history.

Credential reports inventory user credential properties, not a synthesized role policy from historical EC2 API use.

CloudTrail query results are event evidence, not an automatically valid IAM policy; they require separate generation, scoping and review.

Question 446

A storage bucket holds payroll exports. Security wants to prevent any public bucket policy or public ACL changes, including accidental changes by trusted administrators, while still allowing approved internal access. Which S3 account and bucket controls are appropriate?

Enable IAM Access Analyzer external-access findings only and assume its detective report prevents future public bucket policy changes from taking effect.
Enable applicable S3 Block Public Access settings at account and bucket scope, and maintain least-privilege private bucket policies.
Make the bucket public and hide object keys from a directory listing as the only confidentiality control.
Use SSE-KMS encryption at rest as the sole guardrail for public object policies, without applying Block Public Access.

Explanation

Correct Answer

Public-access block settings prevent supported public permission patterns from being effective despite mistaken policy or ACL changes.

Incorrect Answers

Access Analyzer identifies policy exposure but does not itself enforce the preventive Block Public Access guardrail.

An unlisted public object can still be retrieved by a client who knows or discovers its key.

KMS key policy can constrain decryption, but encryption alone does not prohibit unsafe public policies and ACLs on all objects.

Question 447

An application uses an EC2 instance role to call AWS APIs. Security finds an old process that requires IMDSv1 and could expose temporary role credentials through server-side request forgery. What EC2 metadata security improvement should be evaluated?

Keep IMDSv1 enabled and rely only on the application’s IAM instance profile permission limits to prevent credentials from being reached by SSRF.
Change the instance metadata hop limit while continuing to permit unauthenticated IMDSv1 requests from the instance.
Disable the metadata endpoint entirely without migrating the application to any replacement supported instance-role credential source.
Require IMDSv2 with hop/metadata settings and validate application compatibility before enforcing the configuration.

Explanation

Correct Answer

IMDSv2 session-token requests reduce credential exposure patterns associated with unrestricted metadata service access.

Incorrect Answers

Least-privilege IAM scopes impact but do not remove the metadata request-authentication weakness targeted by requiring IMDSv2 tokens.

Hop limits are useful in some contexts, but without requiring IMDSv2 tokens the unsupported legacy metadata request pattern remains allowed.

Removing IMDS outright can break the stated application role-credential path; staged IMDSv2 adoption is the compatible control.

Question 448

A financial organization already uses Systems Manager Session Manager for private Linux EC2 administrative access, with approved IAM principals and no inbound SSH. Its auditors now object that interactive sessions all start as the default privileged ssm-user rather than the distinct, pre-created non-root operating-system accounts assigned to authorized administrators. Which Session Manager capability makes that OS-user selection enforceable?

Enable unrestricted SSH access temporarily to bootstrap a distinct root-equivalent Unix login for every IAM principal.
Enable Session Manager Run As support, associate controlled SSMSessionRunAs principal tags or a specified existing default OS user, and verify user existence and IAM tag permissions.
Disable the Session Manager agent on every host and rely on an EC2 security group description to map IAM users to Unix usernames.
Create a separate CloudWatch Logs group for every operator and assume the log-group name changes the Linux login identity for Session Manager sessions.

Explanation

Correct Answer

Session Manager Run As can select an existing non-root OS user based on the trusted SSMSessionRunAs role/user tag or configured preference; access must be controlled so users cannot assign unauthorized tags.

Incorrect Answers

Opening SSH is neither required nor suitable for the already working private Session Manager path, and shared root-equivalent logins undermine segregation.

Instance security-group metadata does not map an IAM identity to an operating-system user, and disabling the agent stops managed sessions.

Log group selection is an audit/logging setting and has no effect on the OS account Session Manager uses to authenticate a shell.

Question 449

A company has repeated incidents caused by developers attaching policies with wildcards to production IAM roles. It wants these policy documents checked before deployment for known security issues and unintended external access. Which first-party analysis step helps?

Use IAM policy simulator for a few chosen API examples, but never run policy validation against the policy document’s known security warnings.
Rely only on CloudTrail API activity after deployment, without checking wildcard permissions or unintended access before release.
Run IAM Access Analyzer policy validation and relevant access previews during the IaC pipeline review, and gate deployment on material findings.
Allow every policy to deploy without review and use CloudTrail only to discover unauthorized behavior afterward.

Explanation

Correct Answer

Policy validation and access previews identify risky IAM policy patterns before they reach production roles or resources.

Incorrect Answers

Simulation can test selected requests but is not a substitute for systematic predeployment policy validation and findings triage.

Historical activity is useful for rightsizing but cannot preemptively identify unsafe policy statements before they grant access.

Retrospective logs cannot prevent the initial overbroad permission grant.

Question 450

A company uses AWS KMS customer-managed keys for regulatory data, but decrypt events must be attributable to the calling principal and service context during investigations. Which audit source provides key-use activity?

Use only Amazon CloudWatch KMS service metrics to count decryption operations and infer which principal caused each call.
Disable CloudTrail for KMS to avoid revealing legitimate decrypt activity to auditors.
Use AWS Config to record key rotation settings and infer the exact caller of each historical kms:Decrypt operation.
Collect and protect CloudTrail KMS key management and cryptographic API events with suitable event selectors and key policy controls.

Explanation

Correct Answer

CloudTrail records supported KMS API activity, enabling review of decryption context and principal identities.

Incorrect Answers

Aggregated service metrics do not provide the request identity and parameters recorded in supported CloudTrail KMS API events.

Suppressing key-use audit events violates the traceability requirement.

Resource configuration history documents key settings, not the principal identity of individual cryptographic API requests.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 440

Explanation

Correct Answer

Incorrect Answers

Question 441

Explanation

Correct Answer

Incorrect Answers

Question 442

Explanation

Correct Answer

Incorrect Answers

Question 443

Explanation

Correct Answer

Incorrect Answers

Question 444

Explanation

Correct Answer

Incorrect Answers

Question 445

Explanation

Correct Answer

Incorrect Answers

Question 446

Explanation

Correct Answer

Incorrect Answers

Question 447

Explanation

Correct Answer

Incorrect Answers

Question 448

Explanation

Correct Answer

Incorrect Answers

Question 449

Explanation

Correct Answer

Incorrect Answers

Question 450

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests