Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 6

Question 50

A platform team wants to discover resource-based policies on S3 and KMS that grant unintended access outside its AWS Organization. Findings must identify potential external trust relationships before a partner can exploit them. Which service is most directly designed for this analysis?

Run IAM Access Analyzer policy validation to check whether identity policies follow best practices, but do not configure an external-access analyzer for the organizations trusted zone.
Inspect the CloudTrail record of principals that already used each S3 bucket and KMS key, and declare every unobserved external policy principal harmless.
Use IAM Access Analyzer external access findings and review its resource-policy analysis with the organization as the trusted zone.
Enable only IAM Access Analyzer unused-access findings for roles and infer that they identify every potential outside-account grant on S3 buckets and KMS keys.

Explanation

Correct Answer

IAM Access Analyzer evaluates supported resource policies and flags access granted to principals outside the configured zone of trust.

Incorrect Answers

Policy validation checks policy grammar and selected security best practices; the external-access analyzer specifically detects outside-principal grants from supported resource policies.

CloudTrail records observed actions, not potential external trust relationships. A policy grant is risky even if an external caller has not used it yet.

Unused-access analysis looks at principal permissions; the stated external trust-zone resource-policy findings require an external-access analyzer.

Question 51

A forensics team has a working organization trail that records management events, but auditors cannot find object-level GetObject activity for a sensitive S3 bucket after suspected unauthorized reads. What CloudTrail configuration fills this visibility gap?

Enable CloudTrail Insights events on management API anomalies while leaving S3 object-level data events off for this bucket.
Select only read-only management events for the organization trail and assume all object reads are now included.
Configure CloudTrail S3 object-level data event selectors for the relevant bucket and validate delivery to the central audit trail destination.
Enable CloudTrail Lake only for management events and expect the event store automatically to contain object-level GetObject calls from the sensitive bucket.

Explanation

Correct Answer

S3 object operations are CloudTrail data events; ordinary management-event recording does not automatically capture all requested GetObject calls.

Incorrect Answers

Insights detects selected anomalous API activity; it does not substitute for event selectors that log individual S3 GetObject data-plane operations.

S3 GetObject is a data event, not a management event. Data-event advanced selectors must cover the relevant object resource and read operation.

CloudTrail Lake can query captured data events, but selecting only management events does not record GetObject; enable explicit S3 object data selectors.

Question 52

A customer encrypts production EBS snapshots with a customer-managed KMS key. A separate disaster-recovery account must copy those snapshots and encrypt the copies under a key owned by that account. Which permission and workflow design is required?

Share the encrypted EBS snapshot with the recovery account but grant only EC2 snapshot-copy permissions, leaving the source KMS key policy unchanged.
Copy the snapshot to the recovery account but retain an encryption dependency on the production-only source KMS key after the source Region becomes unavailable.
Allow the destination role in an EC2 snapshot resource permission but leave the source account customer-managed KMS key without a cross-account decrypt authorization.
Authorize the destination account to use the source KMS key for snapshot copy, then copy using a destination-account KMS key with appropriate policies.

Explanation

Correct Answer

Cross-account encrypted snapshot copies require access to the source encryption key plus a usable destination key; key policy and identity permissions must align.

Incorrect Answers

The target account also needs cryptographic authorization on the source KMS key to copy encrypted snapshots, in addition to snapshot permissions.

A recovery copy must be usable with a destination-controlled KMS key and tested permissions independent of the isolated production Region.

Snapshot access and source key cryptographic permissions are independent; the copy cannot re-encrypt data without permitted source key usage.

Question 53

A security architect attaches a restrictive service control policy to every workload OU and expects it to restrict the AWS Organizations management account as well. An audit observes that a management-account administrator can still perform an operation the SCP denies in members. Why?

Attach the same SCP to the root of the organization, expecting that placement to limit actions taken by the management-account principal itself.
Create an SCP with an explicit Deny and a matching IAM deny in every member account, expecting the member-account IAM policies to flow up to management.
Restrict the management account through an SCP attached to a delegated administrator member account that operates AWS Organizations.
Recognize that SCPs do not restrict principals in the management account and apply separate strong management-account access controls.

Explanation

Correct Answer

SCPs are maximum-permission boundaries for member accounts but do not apply to the AWS Organizations management account itself.

Incorrect Answers

SCPs govern principals in member accounts under root/OU attachments; management-account identities are not subject to SCPs even when root has the policy.

Member-account IAM policies cannot impose permissions on unrelated identities in the management account; separate management access controls are needed.

Delegated administration does not move management-account principals under member SCP enforcement or replace direct management-account IAM restrictions.

Question 54

A customer-managed KMS key encrypts finance files, and the team wants to reduce risks from accidental deletion. It proposes an automated schedule that routinely deletes and recreates the key because rotation is required. Which design is safe?

Use supported KMS key rotation for the existing key and tightly restrict scheduling deletion, preserving decrypt access to older ciphertext.
Disable automatic KMS rotation and create a fresh unrelated key every year, deleting the original immediately after updating the alias.
Schedule deletion of the original key after a short waiting period without first inventorying and re-encrypting dependent data.
Grant all application developers kms:ScheduleKeyDeletion for the shared production key to make regular rotation easier.

Explanation

Correct Answer

Key rotation can change backing key material without invalidating ciphertext encrypted under prior key-material versions; deletion is a separate destructive control.

Incorrect Answers

Changing an alias does not re-encrypt old ciphertext. Deleting the original key can make historically encrypted finance files permanently unrecoverable.

Key deletion destroys access to ciphertext requiring that key; planned retirement requires dependency discovery and verified re-encryption, not automatic deletion.

Deletion permission is distinct from rotation and creates catastrophic availability risk. Separate restricted key administration from authorized automatic rotation.

Question 55

A financial organization stores audit records in an S3 log archive account. A compromised workload administrator must not be able to overwrite or erase already delivered compliance objects during the seven-year retention window. Which protection is suitable?

Enable S3 Versioning and default encryption in the archive but leave version deletion unrestricted for privileged workload administrators.
Use Object Lock governance mode while allowing compromised workload administrators to bypass retention through s3:BypassGovernanceRetention.
Replicate log objects to another account without applying immutable retention controls to the destination versions.
Use S3 Object Lock in compliance mode with an appropriate retention period on a versioned destination bucket and carefully managed delivery permissions.

Explanation

Correct Answer

Compliance-mode Object Lock protects retained object versions against modification or deletion before expiration, including privileged ordinary principals.

Incorrect Answers

Versioning and encryption help retention and confidentiality but do not prevent authorized deletion of protected versions during the regulatory period.

Governance mode may allow authorized bypass; compliance mode is needed when even administrators must not shorten or bypass mandated retention.

Replication improves geographic/account isolation but an actor with destination delete permissions can still remove copies absent retention guarantees.

Question 56

A central operations team wants to let application developers create IAM roles only within an approved narrow set of permissions. Developers need to update their own role policies, but a normal role policy alone can be modified to grant broader privileges. Which IAM construct bounds the resulting role privileges?

Attach an IAM identity policy with a fixed permission set to each developer-created role but let developers replace that policy at will.
Require an IAM permissions boundary on created roles and restrict developers from removing or replacing the boundary.
Attach an SCP only to the development OU and assume it prevents developers from creating any overly broad role inside their account regardless of the SCP rules.
Require developers to name roles with a standard prefix, without enforcing iam:PermissionsBoundary on CreateRole and policy edits.

Explanation

Correct Answer

Permission boundaries cap effective IAM permissions even if the attached identity policy attempts to grant broader actions, assuming boundary mutation is constrained.

Incorrect Answers

An editable identity policy is not a maximum permission boundary; developers could add broader permissions without an enforced permissions boundary.

SCPs can bound account-level permissions but do not by themselves ensure each created role carries the approved least-privilege maximum.

Naming has no inherent permissions enforcement; the approved boundary must be attached and protected against deletion or replacement.

Question 57

A multi-account company has a central detective security function. Its incident team must detect possible credential use from impossible travel, unusual API calls, and compromised EC2 behavior across members without deploying host agents everywhere. Which managed service best supplies this threat detection?

Enable AWS Security Hub CSPM in every Region but omit member GuardDuty detection and assume compliance findings include all GuardDuty-style threat detections.
Use IAM Access Analyzer external-access findings only and assume they identify compromised EC2 runtime behavior and unusual credential use.
Enable Amazon GuardDuty across relevant accounts and Regions using delegated administration and review its managed threat findings.
Enable Amazon Inspector vulnerability scanning and interpret missing CVE findings as evidence no anomalous API usage or instance compromise occurred.

Explanation

Correct Answer

GuardDuty analyzes supported event and telemetry sources to identify suspicious account, network, and workload activity across member accounts.

Incorrect Answers

Security Hub aggregates and evaluates security posture, but GuardDuty detectors are the managed source of the threat behavior and credential findings described.

Access Analyzer studies authorization relationships, not the runtime and behavioral signals GuardDuty produces for suspected compromise.

Inspector assesses vulnerabilities; it does not replace GuardDuty managed threat detection for identity, API and workload behavior.

Question 58

A company uses IAM role session tags to assign a department when contractors authenticate through federation. Contractors must not be able to choose a privileged department tag value freely. Which security boundary matters most?

Constrain sts:TagSession and accepted session-tag values in the trust/federation path, and reference validated tags in authorization policies.
Use ABAC conditions that compare session department tags against resource tags while allowing federated contractors to set any department in sts:TagSession.
Accept every identity-provider department claim without validating how external users can modify directory attributes.
Restrict S3 bucket tags but omit any IAM condition validating which principal session tags may be passed through federation.

Explanation

Correct Answer

Untrusted session tags can elevate ABAC privileges unless the identity provider, role trust conditions and tag-transmission authorization are controlled.

Incorrect Answers

ABAC is insecure if contractors control the trusted authorization tag; session tag values and issuer attributes must be restricted.

An identity provider is a trusted source only when attributes are governed. Unrestricted user self-service edits can bypass department separation.

Resource tags alone do not prevent a caller from forging the principal-side department label that the authorization expression compares.

Question 59

A payment workload uses an IAM role to retrieve a secret from AWS Secrets Manager. Security needs to ensure the secret is not readable from compromised development roles, while allowing only a designated production service role. Which authorization combination is appropriate?

Grant GetSecretValue through a shared wildcard IAM role and rely solely on secrecy of the production secret ARN.
Grant only secretsmanager:GetSecretValue in the production role but configure a resource policy broadly allowing development principals and leave KMS decrypt unrestricted.
Use a narrowly scoped Secrets Manager resource policy but let every development role assume the privileged production service role.
Scope the production role policy and Secrets Manager resource policy where used, with correct KMS permissions and explicit denial of unwanted principals.

Explanation

Correct Answer

Effective secret retrieval requires permission to access the secret and, for customer-managed encryption keys, decrypt authorization; narrow identities and resource scope reduce blast radius.

Incorrect Answers

A secret ARN is not an authorization control; overly broad identity permissions allow compromised dev roles to retrieve sensitive production values.

The complete effective access path includes resource policies and encryption; conflicting broad grants and KMS controls undermine principal isolation.

Restricting direct secret access is insufficient if the trust policy lets an attacker assume the authorized role. Role trust and KMS grants must align.

Question 60

An organization wants to monitor whether personally identifiable information has been stored in unapproved S3 buckets. Its security team wants managed sensitive-data discovery rather than manually writing a classifier for every object format. Which AWS service is designed for this?

Enable GuardDuty S3 Protection and treat suspicious data-access signals as comprehensive PII classification of object contents.
Use Amazon Macie to discover and classify supported sensitive data in the S3 buckets and investigate findings under approved access controls.
Use S3 Storage Lens to report bucket size and activity and infer whether each object contains government identifiers.
Run IAM Access Analyzer to identify cross-account policy grants and assume it also reads S3 object bytes for personal identifiers.

Explanation

Correct Answer

Macie applies managed sensitive-data discovery to S3 datasets and can identify potential PII exposures for risk assessment and remediation.

Incorrect Answers

GuardDuty detects certain malicious behaviors; Macie performs managed sensitive-data identification within S3 object content.

Storage metrics do not inspect object contents and cannot identify the sensitive-data types Macie can classify.

External access analysis evaluates policy permissions, not sensitive content classification of stored objects.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 50

Explanation

Correct Answer

Incorrect Answers

Question 51

Explanation

Correct Answer

Incorrect Answers

Question 52

Explanation

Correct Answer

Incorrect Answers

Question 53

Explanation

Correct Answer

Incorrect Answers

Question 54

Explanation

Correct Answer

Incorrect Answers

Question 55

Explanation

Correct Answer

Incorrect Answers

Question 56

Explanation

Correct Answer

Incorrect Answers

Question 57

Explanation

Correct Answer

Incorrect Answers

Question 58

Explanation

Correct Answer

Incorrect Answers

Question 59

Explanation

Correct Answer

Incorrect Answers

Question 60

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests