Amazon AWS Certified Solutions Architect - Professional SAP-C02 Practice Test 7

Question 60

An organization wants to monitor whether personally identifiable information has been stored in unapproved S3 buckets. Its security team wants managed sensitive-data discovery rather than manually writing a classifier for every object format. Which AWS service is designed for this?

Enable GuardDuty S3 Protection and treat suspicious data-access signals as comprehensive PII classification of object contents.
Use Amazon Macie to discover and classify supported sensitive data in the S3 buckets and investigate findings under approved access controls.
Use S3 Storage Lens to report bucket size and activity and infer whether each object contains government identifiers.
Run IAM Access Analyzer to identify cross-account policy grants and assume it also reads S3 object bytes for personal identifiers.

Explanation

Correct Answer

Macie applies managed sensitive-data discovery to S3 datasets and can identify potential PII exposures for risk assessment and remediation.

Incorrect Answers

GuardDuty detects certain malicious behaviors; Macie performs managed sensitive-data identification within S3 object content.

Storage metrics do not inspect object contents and cannot identify the sensitive-data types Macie can classify.

External access analysis evaluates policy permissions, not sensitive content classification of stored objects.

Question 61

A company needs to prevent production CloudTrail organization logging from being casually disabled by member-account administrators. It also needs the security account to investigate attempted changes. Which control set is most appropriate?

Create the organization trail under controlled administration, deny risky member actions with scoped SCPs, and monitor CloudTrail configuration changes centrally.
Configure one organization trail but allow members to change the management-account trail owner and log-archive bucket permissions.
Record CloudTrail management events locally in each workload account with no protected cross-account archive or centralized alerting.
Apply an SCP that blocks CloudTrail disable actions in members but omit central detection and monitoring of attempted control changes.

Explanation

Correct Answer

Member SCP restrictions can prevent disabling protected organization logging in supported account contexts, while central event detection identifies attempted or permitted changes.

Incorrect Answers

Central administration is effective only with scoped permissions; members should not have access to disable the organization trail or alter protected archives.

Local-only logs can be altered or lost if workload administrators are compromised and do not meet centralized investigation needs.

Preventive denial helps reduce modification risk but does not by itself provide the requested central investigation and alerting of attempted changes.

Question 62

A SaaS platform has 900 IAM roles accumulated across its AWS Organization. External resource-policy findings are already handled, but many long-lived roles appear unused and several active roles carry services and actions no longer called. Security wants evidence-guided permission pruning over a 90-day observation window. Which analysis should it enable?

Run IAM Access Analyzer external-access findings for resource policies and treat an absence of external grants as proof every identity role is actively used.
Review IAM credential reports for human passwords/access-key ages and assume those reports show unused service actions for all roles.
Create an IAM Access Analyzer unused-access analyzer with an appropriate tracking period and organization scope, then evaluate unused roles and service/action findings before removing permissions.
Generate an IAM policy from one observed CloudTrail sample and automatically delete every unobserved action for all production roles.

Explanation

Correct Answer

Unused access findings are designed to identify inactive roles and unused service/action permission use within the configured tracking period, supporting targeted least-privilege changes.

Incorrect Answers

External access findings address trust to resources, not whether IAM roles/actions have gone unused over the requested observation period.

Credential reports are not the organization-wide role/action last-accessed analysis requested; unused-access analyzer findings assess stale grants.

A single sample is not a sufficiently governed observation period and can remove rarely used business-critical permissions; investigate unused-access findings before pruning.

Question 63

An organization wants VPC Lattice service-to-service connections but the client receives a 403 error after successful TLS connection. Network routes and DNS resolve correctly. The service network auth policy requires SigV4-signed requests from approved workload identities. What should be fixed?

Add an interface VPC endpoint and new routes even though the client already reaches the Lattice service and receives HTTP 403.
Disable the service-network auth policy but continue to claim IAM-based authorization of each VPC Lattice request.
Attach a valid IAM identity policy to the workload role but send unsigned HTTP requests under a service policy that demands SigV4.
Sign the application requests with valid SigV4 credentials from an authorized role and verify policy actions and service association.

Explanation

Correct Answer

When IAM authentication is enabled, network reachability does not replace SigV4 authorization and matching service-network policy.

Incorrect Answers

Successful TLS with 403 points to authorization after network reachability. Additional networking cannot satisfy the SigV4 policy conditions.

Removing the SigV4 policy bypasses the required workload identity verification rather than making the caller satisfy it.

An IAM policy alone does not cryptographically authenticate the HTTP request to Lattice. The client must also sign with its valid role credentials.

Question 64

An organization already requires an approved permissions boundary on developer-created IAM roles. A production review now asks whether a proposed role identity policy would allow ec2:TerminateInstances on a test instance after the existing boundary limits are considered. Reviewers need a non-destructive predeployment evaluation, not another role-creation guardrail. Which action best answers the question?

Run IAM Access Analyzer external-access validation against only the role trust policy and use that as the result for ec2:TerminateInstances.
Simulate only the new identity policy and disregard the existing permissions boundary when computing the role effective decision.
Review IAM Access Analyzer unused-access reports and treat an unobserved ec2:TerminateInstances invocation as equivalent to policy denial.
Run a suitably scoped IAM policy simulation for the proposed role action and resource, including its identity policies and existing permissions boundary, then verify any unsupported conditions in a controlled test.

Explanation

Correct Answer

The IAM policy simulator can evaluate prospective action and resource permissions with a role boundary in scope, but the reviewer must respect simulator limitations and validate unsupported contextual conditions.

Incorrect Answers

External trust analysis is not a simulation of the identity action under a permissions boundary on the specified EC2 resource.

An identity allow can still be blocked by a permissions boundary; policy simulation must account for the intersection to answer the question.

Last-accessed findings show historical usage patterns, not whether a proposed policy would permit this action at deployment time.

Question 65

An AWS Lambda function in an AWS Organization uses a customer-managed KMS key only to decrypt secrets returned through Secrets Manager. Security wants to prevent direct unrestricted KMS decrypt calls on arbitrary ciphertext. Which key authorization condition is relevant?

Limit only the KMS key alias to an approved prefix while leaving the function with direct unrestricted kms:Decrypt on ciphertext.
Use kms:EncryptionContext constraints without kms:ViaService but allow direct calls with user-supplied encryption contexts.
Grant a broad kms:Decrypt policy and log every request in CloudTrail instead of restricting which integrated service may call KMS.
Scope decrypt permissions with kms:ViaService for the expected regional Secrets Manager service and restrict relevant encryption context when supported.

Explanation

Correct Answer

ViaService and encryption-context conditions can limit key use to a specific service-mediated operation and data context.

Incorrect Answers

Aliases help identify keys but are not the service-bound cryptographic authorization condition needed to prevent arbitrary direct decrypt use.

Encryption-context constraints can be valuable, but the requirement specifically forbids unrestricted direct use and benefits from binding calls to Secrets Manager.

Detective logging is not preventive authorization. ViaService conditions restrict key use through the intended integrated AWS service.

Question 66

An incident responder needs to prove that management API logs delivered to an S3 archive have not been modified after delivery. The organization already uses a CloudTrail trail and centralized S3 retention policies. Which CloudTrail feature provides tamper-detection evidence?

Enable CloudTrail event delivery to a versioned S3 bucket only and treat object versioning as a cryptographic verification of every delivered log.
Enable SSE-KMS on the CloudTrail destination bucket and treat encryption at rest as proof no authorized actor modified delivered log objects.
Create S3 Cross-Region Replication for audit logs without enabling CloudTrail digest delivery or verifying digests.
Enable CloudTrail log file integrity validation and verify digest files against the log objects.

Explanation

Correct Answer

CloudTrail digest files provide cryptographic integrity validation so alterations and missing delivered log files can be detected.

Incorrect Answers

Version history is useful but not the hash-and-digest chain that CloudTrail log file integrity validation provides for tamper detection.

Encryption protects confidentiality/integrity of stored bytes but does not independently prove historic log files were not replaced after delivery.

Replication can copy already tampered data; cryptographic log digest verification is the direct mechanism for detecting log-file modification.

Question 67

A cloud security platform uses organization-wide CloudTrail management events but must audit reads of sensitive S3 objects and selected Lambda function invocations. The audit must avoid collecting every event for every bucket and function. How should event selection be configured?

Enable only CloudTrail management events with multi-Region delivery and assume they record selected S3 GetObject and Lambda Invoke data events.
Enable all S3 and Lambda data events organization-wide with no resource filtering despite the requirement to audit only selected protected resources.
Enable relevant CloudTrail data event selectors and narrow them to the protected S3 and Lambda resources.
Use S3 server access logging for the buckets and CloudWatch Lambda metrics as a complete caller-specific CloudTrail data event substitute.

Explanation

Correct Answer

CloudTrail advanced or basic event selectors can capture data-plane activity for selected resources without logging unrelated high-volume objects.

Incorrect Answers

Management events do not include the selected high-volume object/Invoke activity absent explicit data event selectors.

Comprehensive recording can be expensive and high-volume; narrow advanced event selectors to required bucket, prefixes and functions where supported.

These sources differ in event identity/scope and do not replace targeted CloudTrail data selectors for the requested API audit.

Question 68

An application account cannot list S3 objects in a central audit bucket, despite an identity policy allowing s3:ListBucket. The resource policy in the audit account denies access unless aws:PrincipalOrgID matches the current organization. The application role belongs to a different organization. Which conclusion is correct?

Add an explicit Allow for s3:ListBucket to the application identity and assume it overrides the destination bucket policy Deny.
Add the audit account ID to a resource ACL but leave the aws:PrincipalOrgID explicit Deny unchanged.
Change the object-level s3:GetObject permissions while leaving the bucket-level s3:ListBucket Deny condition intact.
The cross-organization caller is intentionally denied by the resource policy and must be explicitly granted through an approved trust design or a revised policy.

Explanation

Correct Answer

An organization-ID condition on a resource policy can reject principals outside the trusted organization even when their identity policies permit an action.

Incorrect Answers

An explicit resource-policy Deny remains effective even when identity policies contain matching Allow statements.

An ACL allow cannot override the explicit organization-based Deny on a cross-organization caller.

The failure concerns bucket listing, and the organization-based bucket policy deny still blocks that action regardless of object grants.

Question 69

A test archive uses S3 Object Lock to retain its object versions for 60 days, but an authorized compliance officer must sometimes shorten that test-only retention under a documented exception procedure. Ordinary workload administrators must not be able to bypass the rule. Which retention mode and authorization design supports this controlled override?

Enable compliance mode but grant the officer s3:BypassGovernanceRetention, assuming it can bypass compliance retention.
Use only S3 Versioning and an IAM permissions boundary on uploaders, with no Object Lock retention configuration.
Grant all workload administrators s3:BypassGovernanceRetention and automatically omit the bypass request flag.
Apply S3 Object Lock governance mode with a defined retention period; reserve s3:BypassGovernanceRetention and explicit bypass operations for the tightly controlled compliance role.

Explanation

Correct Answer

Governance mode provides retention protection for typical principals but supports an intentional exception by a narrowly trusted role with the bypass permission and explicit request header.

Incorrect Answers

Compliance mode cannot be shortened or bypassed, even by the account root; governance-bypass permission is not effective on compliance retention.

Ordinary versioning does not protect object versions against deletion by authorized administrators or implement a controlled retention override.

A broad bypass permission defeats the requirement to deny ordinary administrators; the operation also needs an explicit bypass request indication.

Question 70

A forensics team wants an existing S3 Object Lock bucket to preserve evidence during an investigation even though the evidence objects have no future retention date assigned. It needs an open-ended lock until the legal team lifts it. Which feature should be applied?

Set Object Lock governance retention for a fixed 30 days and rely on it remaining in force indefinitely if the investigation lasts longer.
Set a compliance-mode retention-until date estimated for the investigation and assume it can be removed on demand once legal approves.
Set S3 Object Lock legal holds on the relevant object versions and restrict the permission to remove those holds.
Enable S3 bucket versioning alone and restrict most ordinary users from deleting object versions, leaving administrators able to delete evidence.

Explanation

Correct Answer

A legal hold prevents removal regardless of a fixed retention deadline until an authorized user explicitly removes the hold.

Incorrect Answers

Finite governance retention can expire or be bypassed. A legal hold remains effective until explicitly removed.

Compliance-mode retention cannot be shortened or bypassed until its date; it is unsuitable for a fully flexible open-ended release.

Versioning without an Object Lock legal hold does not guarantee preservation of investigation evidence against authorized version deletion.

Pass Your Amazon AWS Certified Solutions Architect - Professional SAP-C02 Exam Easy!

Question 60

Explanation

Correct Answer

Incorrect Answers

Question 61

Explanation

Correct Answer

Incorrect Answers

Question 62

Explanation

Correct Answer

Incorrect Answers

Question 63

Explanation

Correct Answer

Incorrect Answers

Question 64

Explanation

Correct Answer

Incorrect Answers

Question 65

Explanation

Correct Answer

Incorrect Answers

Question 66

Explanation

Correct Answer

Incorrect Answers

Question 67

Explanation

Correct Answer

Incorrect Answers

Question 68

Explanation

Correct Answer

Incorrect Answers

Question 69

Explanation

Correct Answer

Incorrect Answers

Question 70

Explanation

Correct Answer

Incorrect Answers

AWS Certified Solutions Architect - Professional SAP-C02 Practice Tests