Amazon Web Services SAP-C02 Exam With Confidence Using Practice Dumps

The IAM policy simulator will generate a policy that contains only the necessary permissions for the application to access Secrets Manager, providing the least privilege necessary to get the job done. This is the most efficient solution as it will not require additional steps such as analyzing CloudTrail events or manually creating and testing an IAM policy.

You can use the IAM policy simulator to generate an IAM policy for an IAM role by specifying the role and the API actions and resources that the application or service requires. The simulator will then generate an IAM policy that grants the least privilege access to those actions and resources.

Once you have generated an IAM policy using the simulator, you can replace the existing SecretsManagerReadWnte policy that is attached to the IAM role with the newly generated policy. This will ensure that the application or service has the least privilege access to the Secrets Manager actions that it requires.

You can access the IAM policy simulator through the IAM console, AWS CLI, and AWS SDKs. Here is the link for more

The best solution is to create an RSA key pair that is dedicated to the data-handling microservice and upload the public key to the CloudFront distribution. Then, create a field-level encryption profile and a configuration, and add the configuration to the CloudFront cache behavior. This solution will ensure that the sensitive data is encrypted at the edge locations of CloudFront, close to the end users, and remains encrypted throughout the application stack. Only the data-handling microservice, which has access to the private key of the RSA key pair, can decrypt the data. This solution does not require any additional resources or code changes, and leverages the built-in feature of CloudFront field-level encryption. For more information about CloudFront field-level encryption, see Using field-levelencryption to help protect sensitive data.

Option C is correct because Amazon WorkSpaces provides persistent cloud desktops, which best replicates the existing desktop experience for users who currently use full Windows and Linux workstations with multiple applications. AD Connector allows WorkSpaces authentication to proxy to the company’s existing on-premises Active Directory, so users can continue using their existing identity credentials. MFA for WorkSpaces with AD Connector is implemented through RADIUS, not merely by turning on a console setting. AWS documentation specifically states that AD Connector can integrate with existing RADIUS-based MFA infrastructure and that WorkSpaces MFA can use a RADIUS server that is hosted on premises or in AWS. AppStream 2.0 is better for application streaming, not full desktop continuity. Option A is technically incomplete because it omits the RADIUS MFA requirement.