Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 5

Question 40

An engineer uses VPC Reachability Analyzer to model a private path from one ENI to another. The tool reports a missing route in the source subnet route table. Which corrective action addresses this specific configuration issue before packet testing?

Change only the destination subnet return route and leave the Reachability Analyzer-reported source subnet route missing.
Add the intended destination CIDR route with the correct next hop in the source subnet table and verify the reverse path separately.
Increase MTU on the source instance without supplying a route for the destination CIDR.
Disable the destination subnet network ACL and assume this supplies a next hop for the missing source subnet route.

Explanation

Correct Answer

Reachability analysis identifies configuration-level routing blockers; fixing the missing prefix entry restores a potential forwarding path.

Incorrect Answers

The reported blocker is a missing forward route in the source subnet; the reverse route cannot repair that source lookup.

A larger MTU cannot make a packet forward when no route to the destination network exists.

ACLs can filter packets after routing but do not create the absent CIDR route flagged by Reachability Analyzer.

Question 41

A company has a third-party SD-WAN virtual appliance running in its networking VPC. Its appliance must dynamically advertise branch routes to AWS Transit Gateway and learn relevant VPC routes over GRE tunnels, without maintaining static routes for every changed branch prefix. Which Transit Gateway attachment type supports this integration?

Use an ordinary Transit Gateway peering attachment and assume it supports GRE tunnels terminating directly on third-party SD-WAN appliances.
Use AWS PrivateLink interface endpoints because their service DNS names originate arbitrary BGP routes to the appliance.
Create a Transit Gateway Connect attachment over a supported underlying transport attachment, establish GRE Connect peers, and use BGP route exchange with the appliance.
Create a transit gateway VPC attachment for the appliance and configure only VPC route-table propagation with no GRE Connect peers or BGP sessions.

Explanation

Correct Answer

Transit Gateway Connect supports GRE transport and dynamic BGP exchange with third-party appliances such as SD-WAN endpoints.

Incorrect Answers

TGW peering connects transit gateways; it is not the GRE/BGP virtual-appliance integration product specified.

PrivateLink allows access to published services and cannot establish general branch-route BGP peering to a transit gateway.

The ordinary VPC attachment carries routed traffic but does not provide the required GRE/BGP dynamic appliance route exchange.

Question 42

A partner exposes a managed service using PrivateLink. The consumer endpoint connection remains in PendingAcceptance despite correct security groups and DNS. The endpoint service does not allow automatic acceptance. What step is needed?

Update only the consumer interface endpoint security group and wait for it to exit PendingAcceptance without the provider approving it.
Add the consumer to the endpoint-service allowed-principals list but leave an existing connection in PendingAcceptance with acceptance required.
Remove all endpoint service allowed-principal settings and make the service public to resolve a private request.
Have the endpoint service owner accept the connection request after validating the consumer principal and service policy.

Explanation

Correct Answer

PrivateLink endpoint services with acceptance required remain pending until the producer authorizes the consumer endpoint.

Incorrect Answers

Consumer network security groups affect traffic after acceptance, not the provider-owned administrative acceptance requirement.

Allowed principals determine who may request an endpoint; the separate acceptance-required setting still needs provider approval.

Broadening service access violates private authorization and is not required to accept an approved pending connection.

Question 43

A new AWS account has a shared VPC in which one application subnet must resolve names in two competing internal DNS suffixes. The network team wants conditional forwarding on a per-domain basis without exposing public records. What should it configure?

Create one default forwarding rule for all DNS names to just one of the two private on-premises DNS servers.
Use a Route 53 Resolver outbound endpoint and distinct forwarding rules associated with the VPC for each private suffix, pointing to the correct on-premises DNS server IP addresses.
Set the VPC DHCP options to a single arbitrary public DNS server and expect it to discover both private authoritative systems.
Create public A records for each internal suffix and rely on DNS TTL alone to restrict internal queries.

Explanation

Correct Answer

Resolver forwarding rules match the queried domain and select on-premises DNS targets through an outbound endpoint; associations enable this behavior for the application VPC.

Incorrect Answers

A single catch-all forwarder does not preserve the required suffix-specific resolution toward the two distinct private authoritative systems.

A generic public resolver has no automatic knowledge of isolated on-premises private DNS zones.

Public record publication contradicts private name-resolution requirements and does not implement conditional forwarding.

Question 44

A hybrid application operates over Direct Connect and VPN. The security team must ensure BGP sessions to a customer edge router do not accept unexpected routes advertised by a misconfigured peer. Which defense should be built into route policy?

Implement explicit accepted-prefix filters and maximum-prefix controls on the customer edge, testing expected route advertisements.
Configure a prefix list for only outgoing prefixes advertised by the customer router, but accept every prefix learned from the DX or VPN neighbor.
Set BGP local preference to favor the primary connection but leave incoming route advertisements from both neighbors unfiltered.
Enable BGP graceful restart and remove inbound prefix limits, assuming session resilience protects against route leaks.

Explanation

Correct Answer

Prefix filtering limits the networks learned from a neighbor and reduces accidental or malicious route leakage into the hybrid network.

Incorrect Answers

Outbound advertising policy does not limit unintended routes imported from the peer; inbound accepted-prefix filtering is still needed.

Preference selects among known routes but does not reject unauthorized destination prefixes learned from a peer.

Graceful restart addresses transient peer failure; it cannot replace inbound route-prefix validation and maximum-prefix controls.

Question 45

A company already has independent Direct Connect circuits with virtual interfaces at two separate locations. Network diagrams show redundancy, but operations needs a controlled AWS-supported test that intentionally brings down the primary virtual interface BGP peering and confirms traffic moves to the standby path. Which validation approach directly exercises that failure without physically disconnecting the cable?

Use the AWS Direct Connect Resiliency Toolkit failover test on the selected primary virtual-interface BGP peering, then verify standby routing and application flows during the test.
Create another BGP peering session on the already redundant primary link and treat its Established state as a successful failure simulation.
Review only the AWS Direct Connect CloudWatch ConnectionState and BGP status metrics during normal operation, with no forced withdrawal.
Apply equal high-preference Direct Connect BGP communities on both virtual interfaces and assume this is sufficient proof of failover.

Explanation

Correct Answer

The Direct Connect failover test intentionally places the selected BGP peering in a down state so routing over redundant virtual interfaces can be measured without removing the cable.

Incorrect Answers

A healthy extra peering session does not take the primary path out of service or demonstrate that the standby carries traffic.

Historical healthy physical-link and session-state metrics do not demonstrate application routing after an intentional primary BGP failure.

Equal communities influence preference but do not perform the required controlled failover test or validate live standby traffic.

Question 46

A company offers a collection of private application APIs across several VPCs and accounts, with centrally defined service access and IAM-based authorization. It wants clients to reach services by service identity rather than managing many peer networks. Which modern application networking service should be evaluated?

Create an unrestricted TGW route between every subnet and assume it automatically provides per-service IAM authorizer semantics.
Publish every service behind separate PrivateLink endpoint services and require each client to manage independent interface endpoints without any shared service network.
Expose all applications through internal ALBs connected by broad Transit Gateway CIDR routes, without service-network-level IAM auth policies.
Evaluate Amazon VPC Lattice with service networks, supported service associations and IAM-auth policy for private service-to-service traffic.

Explanation

Correct Answer

VPC Lattice provides service-oriented private connectivity and supported authentication policies without requiring broad VPC CIDR peering.

Incorrect Answers

Network-level transitive routes alone do not create the requested service discovery and service-identity authorization layer.

PrivateLink can publish individual private services but does not provide the centrally defined multi-service network and service-level IAM authorization described here.

ALB and TGW may provide network reachability but do not supply the requested centrally governed service-identity authorization layer.

Question 47

A SaaS security-auditing vendor needs temporary read-only access to metadata in selected AWS accounts belonging to a customer. The vendor operates from its own AWS account and has multiple customers. Which cross-account design most directly protects against a confused-deputy problem while avoiding long-lived customer access keys?

Allow the vendor AWS account to assume a scoped customer role with short-lived STS credentials, but omit customer-specific external IDs from the trust policy.
Allow the vendor's AWS account to assume tightly scoped roles in customer accounts, and require a unique external ID in each role's trust policy.
Put the customer-specific external ID in an IAM policy attached to the vendor principal, but allow the customer trust policy to match the vendor principal without the ID.
Use a vendor-wide shared external ID for all customers instead of per-customer values, while the vendor still assumes roles on behalf of many tenants.

Explanation

Correct Answer

The cross-account role trust policy identifies the vendor principal and checks a customer-specific external ID; short-lived role credentials and scoped permissions reduce credential exposure.

Incorrect Answers

Role-based STS credentials avoid stored access keys, yet the vendor acts for many customers and can be confused into assuming the wrong role unless external-ID trust conditions are enforced.

The customer role trust policy must enforce sts:ExternalId on the AssumeRole request. A condition in the vendors own policy alone does not secure customer delegation.

A shared external ID is easier to confuse or reuse across tenants and does not implement customer-specific confused-deputy protections.

Question 48

An AWS Organization prohibits use of a particular Region for most workload actions in member accounts, even for local administrators. Security wants a preventive permission boundary rather than alerts after the fact. Which control meets this requirement?

Deploy an IAM explicit deny on one administrator role in the management account and assume it automatically affects every member-account role.
Create an AWS Config rule to identify workloads in disallowed Regions and automatically notify the security account after each new deployment.
Attach a tested regional-deny SCP to the appropriate workload OU, accounting for required global-service exceptions.
Attach a Region-deny SCP only to the Organizations management account and assume it will flow automatically to every member account.

Explanation

Correct Answer

An SCP limits the maximum IAM permissions available to principals in member accounts; a targeted deny constrains local administrators subject to documented exemptions.

Incorrect Answers

IAM policies are account/principal scoped; an Organizations SCP on the member OU is needed for an enforced centralized permission ceiling.

Config evaluations and notifications are detective and may follow deployment; they cannot replace request-time preventive Region restrictions in a tested SCP.

SCPs do not constrain the management account and must be placed at the appropriate member OU or organization root scope subject to tested exceptions.

Question 49

A company already authenticates staff against an external SAML identity provider and wants short-lived AWS account access with centralized group-to-permission assignments across 40 accounts. It wants to eliminate per-account IAM users. Which architecture is best?

Federate the external SAML identity provider independently with forty account-specific IAM role assignments managed as separate local mappings.
Federate the workforce identity provider with IAM Identity Center and assign permission sets to groups and target accounts.
Configure IAM Identity Center user authentication but create no permission sets or account assignments, expecting federation alone to grant AWS roles.
Connect the external SAML identity provider to IAM Identity Center but omit AWS account permission-set assignments for employee groups.

Explanation

Correct Answer

IAM Identity Center integrates workforce authentication and uses account assignments and permission sets for centralized short-lived federated access.

Incorrect Answers

This can supply federated access but lacks the requested centralized AWS account/group permission-set administration that IAM Identity Center provides.

Identity Center federation authenticates users; access to member accounts requires explicit account assignment and permission sets.

Authentication alone does not grant scoped member-account access; group-to-account permission-set assignments are the authorization mechanism.

Question 50

A platform team wants to discover resource-based policies on S3 and KMS that grant unintended access outside its AWS Organization. Findings must identify potential external trust relationships before a partner can exploit them. Which service is most directly designed for this analysis?

Run IAM Access Analyzer policy validation to check whether identity policies follow best practices, but do not configure an external-access analyzer for the organizations trusted zone.
Inspect the CloudTrail record of principals that already used each S3 bucket and KMS key, and declare every unobserved external policy principal harmless.
Use IAM Access Analyzer external access findings and review its resource-policy analysis with the organization as the trusted zone.
Enable only IAM Access Analyzer unused-access findings for roles and infer that they identify every potential outside-account grant on S3 buckets and KMS keys.

Explanation

Correct Answer

IAM Access Analyzer evaluates supported resource policies and flags access granted to principals outside the configured zone of trust.

Incorrect Answers

Policy validation checks policy grammar and selected security best practices; the external-access analyzer specifically detects outside-principal grants from supported resource policies.

CloudTrail records observed actions, not potential external trust relationships. A policy grant is risky even if an external caller has not used it yet.

Unused-access analysis looks at principal permissions; the stated external trust-zone resource-policy findings require an external-access analyzer.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 40

Explanation

Correct Answer

Incorrect Answers

Question 41

Explanation

Correct Answer

Incorrect Answers

Question 42

Explanation

Correct Answer

Incorrect Answers

Question 43

Explanation

Correct Answer

Incorrect Answers

Question 44

Explanation

Correct Answer

Incorrect Answers

Question 45

Explanation

Correct Answer

Incorrect Answers

Question 46

Explanation

Correct Answer

Incorrect Answers

Question 47

Explanation

Correct Answer

Incorrect Answers

Question 48

Explanation

Correct Answer

Incorrect Answers

Question 49

Explanation

Correct Answer

Incorrect Answers

Question 50

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests