SAP-C02 Free Practice Test

- (Exam Topic 1)
A company with global offices has a single 1 Gbps AWS Direct Connect connection to a single AWS Region. The company's on-premises network uses the connection to communicate with the company's resources in the AWS Cloud. The connection has a single private virtual interface that connects to a single VPC.
A solutions architect must implement a solution that adds a redundant Direct Connect connection in the same Region. The solution also must provide connectivity to other Regions through the same pair of Direct Connect connections as the company expands into other Regions.
Which solution meets these requirements?

1. A. Provision a Direct Connect gatewa
2. B. Delete the existing private virtual interface from the existing connectio
3. C. Create the second Direct Connect connectio
4. D. Create a new private virtual interlace on each connection, and connect both private victual interfaces to the Direct Connect gatewa
5. E. Connect the Direct Connect gateway to the single VPC.
6. F. Keep the existing private virtual interfac
7. G. Create the second Direct Connect connectio
8. H. Create a new private virtual interface on the new connection, and connect the new private virtual interface to the single VPC.
9. I. Keep the existing private virtual interfac
10. J. Create the second Direct Connect connectio
11. K. Create a new public virtual interface on the new connection, and connect the new public virtual interface to the single VPC.
12. L. Provision a transit gatewa
13. M. Delete the existing private virtual interface from the existing connection.Create the second Direct Connect connectio
14. N. Create a new private virtual interface on each connection, and connect both private virtual interfaces to the transit gatewa
15. O. Associate the transit gateway with the single VPC.

Correct Answer: A
A Direct Connect gateway is a globally available resource. You can create the Direct Connect gateway in any Region and access it from all other Regions. The following describe scenarios where you can use a Direct Connect gateway.
https://docs.aws.amazon.com/directconnect/latest/UserGuide/direct-connect-gateways-intro.html

- (Exam Topic 1)
A company has 50 AWS accounts that are members of an organization in AWS Organizations Each account contains multiple VPCs The company wants to use AWS Transit Gateway to establish connectivity between the VPCs in each member account Each time a new member account is created, the company wants to automate the process of creating a new VPC and a transit gateway attachment.
Which combination of steps will meet these requirements? (Select TWO)

1. A. From the management account, share the transit gateway with member accounts by using AWS Resource Access Manager
2. B. Prom the management account, share the transit gateway with member accounts by using an AWS Organizations SCP
3. C. Launch an AWS CloudFormation stack set from the management account that automatical^/ creates a new VPC and a VPC transit gateway attachment in a member accoun
4. D. Associate the attachment with the transit gateway in the management account by using the transit gateway ID.
5. E. Launch an AWS CloudFormation stack set from the management account that automatical^ creates a new VPC and a peering transit gateway attachment in a member accoun
6. F. Share the attachment with the transit gateway in the management account by using a transit gateway service-linked role.
7. G. From the management account, share the transit gateway with member accounts by using AWS Service Catalog

Correct Answer: AC
https://aws.amazon.com/blogs/mt/self-service-vpcs-in-aws-control-tower-using-aws-service-catalog/ https://docs.aws.amazon.com/vpc/latest/tgw/tgw-transit-gateways.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-ec2-transitgatewayattachme

- (Exam Topic 3)
A company has a project that is launching Amazon EC2 instances that are larger than required. The project's account cannot be part of the company's organization in AWS Organizations due to policy restrictions to keep this activity outside of corporate IT. The company wants to allow only the launch of t3.small EC2 instances by developers in the project's account. These EC2 instances must be restricted to the us-east-2 Region.
What should a solutions architect do to meet these requirements?

1. A. Create a new developer accoun
2. B. Move all EC2 instances, users, and assets into us-east-2. Add the account to the company's organization in AWS Organization
3. C. Enforce a tagging policy that denotes Region affinity.
4. D. Create an SCP that denies the launch of all EC2 instances except t3.small EC2 instances in us-east-2.Attach the SCP to the project's account.
5. E. Create and purchase a t3.small EC2 Reserved Instance for each developer in us-east-2. Assign each developer a specific EC2 instance with their name as the tag.
6. F. Create an IAM policy than allows the launch of only t3.small EC2 instances in us-east-2. Attach the policy to the roles and groups that the developers use in the project's account.

Correct Answer: D

- (Exam Topic 3)
A company plans to deploy a new private intranet service on Amazon EC2 instances inside a VPC. An AWS Site-to-Site VPN connects the VPC to the company's on-premises network. The new service must communicate with existing on-premises services The on-premises services are accessible through the use of hostnames that reside in the company example DNS zone This DNS zone is wholly hosted on premises and is available only on the company's private network.
A solutions architect must ensure that the new service can resolve hostnames on the company example domain to integrate with existing services.
Which solution meets these requirements?

1. A. Create an empty private zone in Amazon Route 53 for company example Add an additional NS record to the company's on-premises company example zone that points to the authoritative name servers for the new private zone in Route 53
2. B. Turn on DNS hostnames for the VPC Configure a new outbound endpoint with Amazon Route 53 Resolve
3. C. Create a Resolver rule to forward requests for company example to the on-premises name servers
4. D. Turn on DNS hostnames for the VPC Configure a new inbound resolver endpoint with Amazon Route 53 Resolve
5. E. Configure the on-premises DNS server to forward requests for company example to the new resolver.
6. F. Use AWS Systems Manager to configure a run document that will install a hosts file that contains any required hostname
7. G. Use an Amazon EventBndge rule to run the document when an instance is entering the running state.

Correct Answer: B
https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver.html

- (Exam Topic 1)
A company recently completed the migration from an on-premises data center to the AWS Cloud by using a replatforming strategy. One of the migrated servers is running a legacy Simple Mail Transfer Protocol (SMTP) service that a critical application relies upon. The application sends outbound email messages to the company’s customers. The legacy SMTP server does not support TLS encryption and uses TCP port 25. The application can use SMTP only.
The company decides to use Amazon Simple Email Service (Amazon SES) and to decommission the legacy SMTP server. The company has created and validated the SES domain. The company has lifted the SES limits.
What should the company do to modify the application to send email messages from Amazon SES?

1. A. Configure the application to connect to Amazon SES by using TLS Wrappe
2. B. Create an IAM role that has ses:SendEmail and ses:SendRawEmail permission
3. C. Attach the IAM role to an Amazon EC2 instance.
4. D. Configure the application to connect to Amazon SES by using STARTTL
5. E. Obtain Amazon SES SMTP credential
6. F. Use the credentials to authenticate with Amazon SES.
7. G. Configure the application to use the SES API to send email message
8. H. Create an IAM role that has ses:SendEmail and ses:SendRawEmail permission
9. I. Use the IAM role as a service role for Amazon SES.
10. J. Configure the application to use AWS SDKs to send email message
11. K. Create an IAM user for Amazon SE
12. L. Generate API access key
13. M. Use the access keys to authenticate with Amazon SES.

Correct Answer: B
To set up a STARTTLS connection, the SMTP client connects to the Amazon SES SMTP endpoint on port 25, 587, or 2587, issues an EHLO command, and waits for the server to announce that it supports the STARTTLS SMTP extension. The client then issues the STARTTLS command, initiating TLS negotiation. When negotiation is complete, the client issues an EHLO command over the new encrypted connection, and the SMTP session proceeds normally To set up a TLS Wrapper connection, the SMTP client connects to the Amazon SES SMTP endpoint on port 465 or 2465. The server presents its certificate, the client issues an EHLO command, and the SMTP session proceeds normally.
https://docs.aws.amazon.com/ses/latest/dg/smtp-connect.html