Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 46

Question 450

A company uses AWS KMS customer-managed keys for regulatory data, but decrypt events must be attributable to the calling principal and service context during investigations. Which audit source provides key-use activity?

Use only Amazon CloudWatch KMS service metrics to count decryption operations and infer which principal caused each call.
Disable CloudTrail for KMS to avoid revealing legitimate decrypt activity to auditors.
Use AWS Config to record key rotation settings and infer the exact caller of each historical kms:Decrypt operation.
Collect and protect CloudTrail KMS key management and cryptographic API events with suitable event selectors and key policy controls.

Explanation

Correct Answer

CloudTrail records supported KMS API activity, enabling review of decryption context and principal identities.

Incorrect Answers

Aggregated service metrics do not provide the request identity and parameters recorded in supported CloudTrail KMS API events.

Suppressing key-use audit events violates the traceability requirement.

Resource configuration history documents key settings, not the principal identity of individual cryptographic API requests.

Question 451

A production EC2 service already uses a dedicated customer-managed KMS key for EBS encryption, with separate roles and key policies from development. Auditors discover that a production role can also call kms:Decrypt directly on unrelated ciphertext using the same key, even though its legitimate cryptographic requests should be made only by the supported EC2/EBS service integration in us-east-1. Which key-policy restriction best narrows this remaining risk without disabling encrypted EBS volumes?

Use a verified kms:ViaService condition on the authorized key operations with the supported EC2 service value for us-east-1, while preserving required caller and grant permissions for the EBS workflow.
Delete the existing key immediately so its prior encrypted EBS volumes automatically decrypt with a newly created unrelated key.
Replace the KMS key-policy condition with an EC2 volume Name tag, expecting the tag alone to block direct KMS decrypt requests.
Give all development and production roles unrestricted kms:Decrypt access, assuming EBS encryption at rest restricts who may invoke KMS.

Explanation

Correct Answer

kms:ViaService constrains allowed key operations to supported forward-access sessions through the specified AWS service; correctly scoped key, caller and grant permissions can preserve the EBS service path while ruling out direct key use.

Incorrect Answers

Deleting the key can render encrypted volumes and snapshots unrecoverable and does not provide a safe service-only authorization boundary.

A resource tag on the volume is not equivalent to a KMS key policy condition evaluated for the decrypt request.

Overbroad direct KMS permissions are the risk the question asks to remove; encryption at rest alone does not impose a service-only key-use condition.

Question 452

An AWS WAF managed rule group protects a production API. Forensics confirm one specific managed subrule falsely blocks a documented mobile request, while the other subrules correctly block attacks and must remain enforced. Which targeted configuration allows a temporary exception without disabling the whole group?

Set the entire web ACL default action to Allow and disable all other managed protections until the mobile client is changed.
Configure a rule action override to Count only for the identified managed subrule, monitor matches, and retain Block actions for the other evaluated subrules.
Remove WAF from the supported API endpoint so no rule can inspect malicious traffic.
Allowlist the affected mobile client’s broad source-network range ahead of all managed rules, bypassing otherwise necessary managed protections for unrelated requests.

Explanation

Correct Answer

AWS WAF supports a per-rule action override, allowing the one false-positive subrule to Count while retaining enforcement of other managed rules.

Incorrect Answers

Changing the entire ACL opens unrelated attack paths and contradicts the requirement to keep other rules enforcing.

Removing WAF eliminates protection for the application instead of narrowly addressing the identified false positive.

A broad top-level Allow rule may bypass other legitimate detections; a narrow subrule Count override retains the remaining managed rules.

Question 453

A security engineer uses AWS WAF to inspect requests to an ALB and must preserve evidence but avoid writing authentication tokens and password query parameters into centralized logs. Which logging safeguard should be applied?

Encrypt AWS WAF logs in an approved destination but leave all sensitive Authorization headers and password query values unredacted to every log reader.
Configure AWS WAF logging with supported field redaction or data protection settings for sensitive headers and query fields.
Enable AWS WAF full logging with KMS encryption and treat that as permission to retain every authentication token and password value indefinitely.
Turn off AWS WAF logging entirely to avoid sensitive-field collection, sacrificing the security evidence auditors still require.

Explanation

Correct Answer

WAF logging supports selective suppression of sensitive request data while retaining useful security decision metadata.

Incorrect Answers

Encryption protects storage and transport; it does not suppress secrets in plaintext log views for authorized log readers.

Encrypted logs still expose sensitive fields to readers with access, so WAF field redaction/data protection is needed independently.

Disabling logging prevents credential leakage to log stores but also removes the required event record; redaction offers a targeted solution.

Question 454

An organization uses CloudTrail to track AWS API activity but a recent incident involved a possible malicious process on an EC2 instance with access to local files. Security needs to preserve host forensic evidence before cleanup. Which response is most defensible?

Immediately patch the suspected executable and reboot the instance before securing any disk snapshot or process evidence.
Rely only on CloudTrail management events for host process forensics and skip any approved disk or memory evidence collection.
Isolate the affected instance as needed, preserve approved snapshots and relevant logs, and follow an incident runbook before destructive remediation.
Immediately terminate the host and delete all EBS volumes before identifying what executed.

Explanation

Correct Answer

Forensic preservation reduces loss of evidence and supports determining compromise scope before removing the malicious process.

Incorrect Answers

An in-place response can alter volatile and persistent indicators before the incident scope and forensic record are preserved.

CloudTrail can show AWS API calls but does not preserve artifacts produced by local malicious processes within the EC2 host.

Premature destruction can eliminate evidence and make investigation or recovery impossible.

Question 455

A public S3 bucket accidentally exposed sensitive customer records. Security has removed the public policy, but executives ask whether external access may have occurred before containment. Which evidence sources should be reviewed?

Examine CloudTrail management events alone and claim a bucket policy change event lists each previously completed external S3 GetObject request.
Investigate relevant CloudTrail S3 data events and S3 access logs if enabled, IAM policy history, and Macie findings as appropriate to the incident timeline.
Use only current bucket policy state and conclude that no past external reads were ever possible.
Review Amazon Macie sensitive-data classifications only and treat every finding as proof that an external actor downloaded the corresponding object.

Explanation

Correct Answer

Data-plane access and policy-change evidence can help establish the exposure window; removing a policy alone cannot prove no reads occurred.

Incorrect Answers

Policy-change events show exposure configuration history but do not automatically include individual object-read requests; S3 data event collection is separately needed.

Present authorization settings do not record historical access during an earlier exposure window.

Macie finds possible sensitive data; actual access timing requires available request-level activity evidence.

Question 456

A company scans S3 buckets with Amazon Macie and receives sensitive-data findings for regulated records in an unexpectedly broad analytics bucket. Management asks for a controlled response without immediately deleting unknown business data. Which workflow is appropriate?

Use IAM Access Analyzer external access findings only and classify every Macie-sensitive object as publicly exposed without verifying actual bucket and object permissions.
Classify the findings, verify object owners and required retention, restrict inappropriate access, and move or remediate data through approved governance.
Delete every object in the bucket without checking whether records are subject to legal retention.
Assume every Macie sensitive-data finding implies confirmed external exfiltration, and delete affected data without owner review.

Explanation

Correct Answer

Macie findings identify possible sensitive content; remediation must preserve business and legal obligations while reducing exposure.

Incorrect Answers

IAM Access Analyzer examines policy relationships and Macie examines content; neither should be conflated with unverified exposure or full remediation.

Blind deletion can breach regulatory retention and destroy needed business records.

Sensitive-data classification and documented access/exfiltration evidence are different; uncontrolled deletion may breach retention.

Question 457

A service already uses RDS IAM database authentication successfully. Engineers generate one signed authentication token at process startup and cache it for eight hours; existing pooled sessions keep working, but any new DB connection after fifteen minutes is rejected with an expired-token error. What client correction is needed?

Grant rds-db:connect broadly to every AWS identity because the token expiry means the role policy is missing.
Generate a fresh valid IAM DB authentication token for each new connection attempt or before its 15-minute validity expires, while correctly managing pooled sessions and TLS.
Add RDS Proxy for pooling but continue submitting the same eight-hour-old IAM token to every new database connection.
Increase RDS connection idle timeout and keep authenticating new sessions with the expired process-start token.

Explanation

Correct Answer

RDS IAM auth tokens are valid for 15 minutes when starting connections; refreshing tokens for new connections fixes expiration while existing sessions may remain established.

Incorrect Answers

The original role can already authenticate; an expired token is a time-validity failure rather than missing IAM identity authorization.

Pooling can reduce backend connection churn, but does not extend the fifteen-minute validity of tokens used during a new IAM database authentication handshake.

Idle connection lifetime changes do not refresh SigV4 token signing time or make an expired token valid for a new login.

Question 458

A security-sensitive workload runs supported cryptographic operations and wants an isolated runtime environment to handle highly confidential plaintext separate from the parent EC2 instance’s general-purpose processes. What AWS hardware-backed isolation feature might help?

Encrypt EBS volumes with KMS and assume at-rest encryption isolates sensitive plaintext while the parent EC2 process is executing.
Evaluate AWS Nitro Enclaves with a defined attestation/key release model and restricted enclave-to-parent communication.
Allocate a Dedicated Host and run the sensitive module in an ordinary unrestricted EC2 process without enclave attestation.
Use instance role and security group restrictions alone to isolate plaintext from every other process on the same EC2 operating system.

Explanation

Correct Answer

Nitro Enclaves provide an isolated execution environment for sensitive processing with attestation-related integration options.

Incorrect Answers

KMS-backed volume encryption protects stored data; it does not create Nitro Enclave-like isolated memory and execution boundaries.

Dedicated placement changes physical tenancy, not the hardened in-instance isolation and cryptographic attestation of Nitro Enclaves.

IAM and networking restrict cloud API and packet access but do not supply an isolated enclave runtime for sensitive plaintext.

Question 459

An Aurora PostgreSQL cluster has predictable read-heavy analytics every morning. CloudWatch metrics and query profiling show that these SELECT workloads saturate the writer instance while writes are steady. The application can route read-only, noncritical queries separately. What improvement is most appropriate?

Add Aurora reader instances but continue routing analytical SELECT queries to the writer endpoint.
Enable RDS Proxy to pool SQL connections to the writer without moving the CPU-heavy analytical SELECT workload.
Increase the writer size while preserving all analytical SELECT workload on it and ignoring the option to isolate eventually consistent reads.
Add Aurora Replicas and route eligible read-only traffic to the reader endpoint, validating replica lag and acceptable read consistency.

Explanation

Correct Answer

Aurora Replicas provide read-serving capacity; routing eligible reads away from the writer relieves the measured bottleneck, subject to replica lag and consistency requirements.

Incorrect Answers

Capacity added through reader replicas helps only when eligible read traffic is moved to those replicas; unchanged writer routing leaves the bottleneck.

Connection pooling addresses connection fan-in, not the measured CPU work performed by repeated analytics on the writer.

Resizing may help temporarily but does not separate read-heavy workload from writes; a reader endpoint offers the direct scalable read offload.

Question 460

A production RDS PostgreSQL database has high CPU during business hours and engineers debate whether slow queries or disk throughput are responsible. They need query-level evidence before resizing the DB instance. Which diagnostic tool should be used?

Enable Enhanced Monitoring to inspect host processes only, without collecting top SQL, database waits or active-session load.
Use Amazon CloudWatch Database Insights to examine RDS database load, top SQL statements, and wait events before deciding whether to tune queries or resize.
Resize the RDS instance based solely on CPU percentage without checking SQL load, top queries or wait classes.
Review PostgreSQL connection count and CloudWatch CPU only and infer the exact slow query from their correlation.

Explanation

Correct Answer

Database Insights exposes RDS DB load and permits filtering by SQL statements and waits, distinguishing query/lock or storage pressure before a size change. The legacy RDS Performance Insights console was discontinued in November 2025; use the supported CloudWatch Database Insights experience.

Incorrect Answers

Operating-system telemetry helps spot non-SQL processes but cannot by itself identify the expensive query statements and wait events required here.

A size increase before diagnosis can be costly and misses the query-level causes; Database Insights supplies the needed DB load dimensions.

Aggregate metrics cannot identify which SQL statements or wait events dominate database load; a per-query insights tool is needed.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 450

Explanation

Correct Answer

Incorrect Answers

Question 451

Explanation

Correct Answer

Incorrect Answers

Question 452

Explanation

Correct Answer

Incorrect Answers

Question 453

Explanation

Correct Answer

Incorrect Answers

Question 454

Explanation

Correct Answer

Incorrect Answers

Question 455

Explanation

Correct Answer

Incorrect Answers

Question 456

Explanation

Correct Answer

Incorrect Answers

Question 457

Explanation

Correct Answer

Incorrect Answers

Question 458

Explanation

Correct Answer

Incorrect Answers

Question 459

Explanation

Correct Answer

Incorrect Answers

Question 460

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests