Free SAP-C02 Practice Questions

Question 1

An order service consumes an Amazon SQS FIFO queue. Each message carries a stable order ID, and each order must decrement inventory exactly once. A worker commits an inventory decrement in Aurora PostgreSQL, then crashes before deleting the message. After the visibility timeout, another worker processes the message and decrements inventory again. Both attempts occur within five minutes of the original send. What change prevents a second decrement without losing an order whose first attempt did not commit?

Accepted Answer

Record the order ID under a unique constraint and decrement inventory in one database transaction; delete the message after confirming that transaction committed.

Answer

Extend the visibility timeout beyond the longest transaction, and reuse the order ID as MessageDeduplicationId on producer retries.

Answer

Write the order ID to DynamoDB before the inventory transaction, and acknowledge redeliveries whose IDs already exist in that table.

Answer

Delete each message before updating inventory, then retry the database transaction locally and alert if the retries are exhausted.

Question 2

A software vendor must expose a proprietary TCP service to customers in separate AWS accounts in the same Region. The vendor and several customers use overlapping IPv4 CIDR ranges that cannot be changed. Customers initiate every connection, prohibit internet egress for this service, and must not gain network access to the vendor's other applications. The vendor must approve each customer's connection. Which connectivity model fits these constraints?

Accepted Answer

Publish an NLB-backed AWS PrivateLink endpoint service with connection acceptance enabled; authorize customer principals and have customers create interface endpoints.

Answer

Peer each customer's VPC with the vendor's VPC, adding service-subnet routes and restricting access with security groups.

Answer

Attach the VPCs to a transit gateway, separating customers with route tables and adding routes to the service subnet.

Answer

Place the service behind an internet-facing Network Load Balancer, require mutual TLS, and restrict its security group to each customer's approved public IP addresses.

Question 3

A checkout release is receiving 10% of production traffic through a canary deployment. Over the evaluation window, the established version has a p99 latency of 240 ms and the canary has a p99 of 940 ms. The combined mean latency is 70 ms, and both versions have error rates below 0.2%. Each version has sufficient traffic for its measurements. The release gate requires p99 latency below 500 ms for the new version. Database changes remain compatible with the established version. How should the release owner respond?

Accepted Answer

Return the canary's traffic to the established version and investigate the new version's tail latency before attempting another rollout.

Answer

Promote the canary because the combined mean latency passes and both versions have low error rates.

Answer

Keep both versions serving and increase the canary's traffic share until the combined p99 exceeds the threshold, then evaluate whether rollback is needed.

Answer

Take both versions out of service until the regression is understood, preventing further exposure to slow checkouts.

Question 4

An Oracle order database is moving to Aurora PostgreSQL. Schema conversion and application testing are complete. AWS DMS has finished the full load and is applying ongoing changes with approximately three seconds of target latency. Applications still write to Oracle. No acknowledged order may be lost, and writes may pause for at most three minutes. Rehearsals show that draining transactions, applying the remaining changes, and validating the target take less than one minute. Select the appropriate cutover sequence.

Accepted Answer

Quiesce and drain Oracle writes, confirm all committed changes are applied, validate Aurora, then redirect writers while keeping the source fenced against further writes.

Answer

Redirect writes after the full load completes, keep Oracle writable for clients with cached connections, then stop replication when those connections expire.

Answer

Stop DMS once target latency is below three seconds, redirect writes, and retain an Oracle snapshot for later reconciliation.

Answer

Keep writes enabled during DMS validation, redirect writers once validation succeeds, and rely on validation to repair changes made during the switch.

Question 5

An analytics role in one AWS account reads an S3 bucket owned by another account. Its identity policy and the bucket policy allow GetObject for the required prefix. Reads of SSE-S3 objects succeed, but reads of objects encrypted with a particular customer-managed KMS key fail. No applicable policy contains an explicit deny. The role has no KMS permissions, and the key policy authorizes only principals in the bucket owner's account. Which least-privilege change enables reads of the existing encrypted objects?

Accepted Answer

Allow kms:Decrypt for the analytics role in the key policy and allow the same action on that key in the role's identity policy.

Answer

Grant kms:Decrypt on the key ARN in the analytics role's identity policy, without changing the key policy.

Answer

Grant kms:Encrypt and kms:GenerateDataKey in both policies so the analytics role can use S3's envelope-encryption process for the existing objects.

Answer

Add the analytics role to the key policy for kms:Decrypt, leaving its identity policy unchanged.

Question 6

A CloudFormation change set will replace an RDS DB instance. The database resource already specifies DeletionPolicy: Retain. The approved replacement must proceed, but the original physical DB instance must remain available for seven days of reconciliation; a snapshot alone is insufficient. Data migration and application cutover are handled separately. What additional resource-lifecycle control is needed?

Accepted Answer

Set UpdateReplacePolicy: Retain on the database resource and manage the retained instance separately during reconciliation.

Answer

Set a stack policy that denies Update:Replace for the database logical ID, while continuing to permit updates to every other resource in the stack.

Answer

Enable stack termination protection before executing the change set, so the database remains protected throughout the replacement and the seven-day reconciliation period.

Answer

Set UpdateReplacePolicy: Snapshot on the database resource, keeping DeletionPolicy: Retain to preserve the original running instance after its replacement is created.

Question 7

CloudTrail data events show ongoing unauthorized S3 deletions signed with a long-lived IAM access key that was exposed in a public repository. The key belongs to a legacy importer whose IAM user cannot assume roles or modify IAM. Checkout and fulfillment use separate roles. S3 Versioning and centralized audit logging are already enabled. The importer can be interrupted, but checkout must remain available. Which immediate action most directly contains this access while preserving recovery evidence?

Accepted Answer

Deactivate the exposed key and attach a temporary deny-all policy to the importer user; preserve object versions and audit logs.

Answer

Disable the KMS key used by the orders bucket and suspend checkout, preventing further use of encrypted order data until the investigation is complete.

Answer

Replace the importer instance and remove the key from bootstrap configuration, then monitor for further unauthorized requests.

Answer

Block the importer's internet egress and capture its instance image before rotating the access key.

Question 8

A Windows document-management application is being rehosted on EC2. Its vendor requires SMB shares, Microsoft Active Directory authentication, NTFS access controls, and Windows file-locking semantics. The shared files must remain accessible after an Availability Zone failure. Application changes are not permitted, and the operations team wants to avoid administering file-server operating systems or gateway appliances. Choose the storage replacement that preserves these requirements with the least operational work.

Accepted Answer

Use Amazon FSx for Windows File Server in a Multi-AZ deployment, integrated with the application's Active Directory.

Answer

Deploy Windows file servers and replicated EBS storage across AZs, administering the SMB failover cluster.

Answer

Use Regional Amazon EFS with mount targets in both AZs, translating NTFS access controls to POSIX permissions.

Answer

Deploy an Active Directory-integrated S3 File Gateway on EC2, keeping a standby gateway appliance ready in a second AZ.

Question 9

An inventory API will perform 1,200 GetItem reads per second against a DynamoDB table. Each complete item is 6 KiB, requests are evenly distributed across partition keys, and every read must reflect all previously completed writes. These are nontransactional reads. The architect must provision 25% more read capacity than the calculated sustained demand; burst capacity is not part of the plan. Which configuration meets the requirements with the smallest provisioned read capacity?

Accepted Answer

Provision 3,000 RCUs and issue strongly consistent GetItem requests directly to the table.

Answer

Provision 1,500 RCUs and send strongly consistent GetItem requests through DAX, relying on its cache to halve table read consumption.

Answer

Provision 2,400 RCUs and issue strongly consistent GetItem requests, relying on even key distribution to supply the required headroom.

Answer

Provision 6,000 RCUs and replace GetItem with transactional reads, budgeting for the stronger transaction semantics and the required headroom.

Question 10

An AWS Organizations SCP attached to the Production OU explicitly denies ec2:RunInstances outside eu-west-1. A subsidiary account must remain in that OU. Its MigrationProvisioner role has now been approved to launch instances in eu-central-1; all other roles must retain the original Region restriction. The role already has the necessary EC2 permissions, and there are no other blocking policies. An allow-only SCP attached to the subsidiary account did not enable the launch. How should the exception be implemented?

Accepted Answer

Revise the inherited deny so it excludes only the approved role's launches in eu-central-1, preserving the restriction for other principals and Regions.

Answer

Add an explicit allow for the role and eu-central-1 to the OU's existing SCP, leaving the Region-based deny unchanged.

Answer

Attach a permissions boundary that allows the required launches in eu-central-1 to MigrationProvisioner, leaving the inherited SCP and the role's identity policy unchanged.

Answer

Replace MigrationProvisioner's identity policy with AdministratorAccess for the migration window, then restore its narrower EC2 permissions after provisioning has completed.

Free SAP-C02 Practice Questions

Domain 1: Design Solutions for Organizational Complexity 26% of exam

Question 1

Question 2

Question 3

Domain 2: Design for New Solutions 29% of exam

Question 4

Question 5

Question 6

Domain 3: Continuous Improvement for Existing Solutions 25% of exam

Question 7

Question 8

Domain 4: Accelerate Workload Migration and Modernization 20% of exam

Question 9

Question 10

That's 10 of 1,030