Determine a strategy to improve overall operational excellence.
22 practice questions under this official exam objective (SAP-C02), each with the answer key, an option-by-option explanation and instant feedback.
Questions under this objective
22 total · page 1 of 2How Do You Detect Unsolicited Inbound Traffic in NAT Gateway Flow Logs?
VPC Flow Logs for a NAT gateway are analyzed in Amazon CloudWatch Logs, not CloudTrail, to determine whether inbound traffic from 198.51.100.2 was sol
Serverless sensor ingestion with Firehose, Lambda, S3, and Athena
A flood-monitoring agency with 10,000 sensors wants higher availability and no maintenance downtime. After collecting data with AWS IoT Core, streamin
Empty an S3 bucket with a Lambda-backed CloudFormation custom resource before stack deleti
Application versions are deployed by creating a CloudFormation stack and removing the old stack after validation. A stack deletion recently failed bec
Use Lambda over a CloudWatch Logs stream to count unique users per client
The company needs unique user counts per client for daily, weekly, and monthly periods, and all log files already go to CloudWatch with logins recorde
Trigger instance cleanup from the Trusted Advisor cost optimization check via EventBridge
A company on AWS Business Support wants to stop underutilized development EC2 instances, defined as ten percent or less average daily CPU and five MB
Centralize cost allocation and CUR analysis in the management account with Athena and Quic
A company runs applications for separate business units across multiple accounts in an organization, and every cloud resource already carries a Busine
Publish SES event logs to S3 through Data Firehose and query them with Athena
A travel company sends notifications through Amazon SES and needs logging to troubleshoot delivery, plus the ability to search the logs by recipient,
Enable AWS Security Hub across the organization with a delegated administrator
A company has created an AWS Control Tower landing zone and its security team will deploy preventive and detective controls across all accounts in the
Use AWS Config remediation with EBS encryption by default to fix and prevent unencrypted v
A security audit found unencrypted EBS volumes attached to thousands of EC2 instances, and policy requires all of them to be encrypted. The company ne
Decrypt PGP uploads in a Transfer Family workflow with the private key from Secrets Manage
A company receives third-party data through an AWS Transfer Family SFTP-enabled server writing to an S3 bucket, and the data is PGP encrypted so it mu
Build a CodePipeline CI/CD flow with CodeBuild, SNS alerts, CDK feature flags, and manual
A company uses CloudFormation for all deployments and stages binaries in versioned S3 buckets, with developers working from an EC2-hosted IDE. The dev
Batch smart meter readings through Kinesis Data Streams and raise DynamoDB write capacity
A utility collects usage data every five minutes from smart meters through API Gateway and Lambda into a DynamoDB table. In the pilot the functions to
Deny IAM actions for non-administrators with a service control policy at the root
A company manages many accounts with AWS Organizations and must ensure that only administrator roles are allowed to perform IAM actions. The architect
Use VPC endpoints for S3 and Systems Manager plus VPC peering to the patch source
A company patches EC2 instances today through a NAT gateway to the internet and wants to switch to Systems Manager Patch Manager using a patch source
Register an imported EC2 instance with Systems Manager using the agent and an IAM role
A VM imported from on-premises with EC2 VM Import runs from a new AMI in a public subnet with a public IP address, but it does not appear as a managed
Use an organization CloudTrail trail in the management account instead of per-account trai
A company is planning a migration to AWS Cloud and will use multiple accounts managed in an AWS Organization, creating a few accounts at first and add
Scan Lambda packages with Inspector and exclude untagged functions from code scanning
A company has Python Lambda functions deployed as .zip packages with a shared Lambda layer also in .zip, both stored in S3. It must automatically scan
Alarm on the AWS/Usage service quota metric for Fargate task count
A company runs about 100 services in an ECS cluster, recently moved from EC2 instances to Fargate, and previously came close to the account's maximum
Aggregate organisation audit activity in CloudTrail Lake and query it with SQL
A company has multiple AWS accounts inside an AWS Organization and needs to store account activity in a central location and query that data using SQL
Scope S3 access per user with a session-tag condition and audit access with CloudTrail dat
A company wants a single S3 bucket for work documents, authenticates all users through AWS IAM Identity Center, and has a data scientist group. Each d