Amazon Web Services SAP-C02 Exam With Confidence Using Practice Dumps

The company is building an active-active, multi-Region architecture for an ECS-based web application behind ALBs, with shared container images in ECR and a relational database in Aurora MySQL. The goal is to duplicate the setup in a second Region with minimal operational overhead while allowing minor replication latency.

A is required because ACM certificates are Regional for use with Regional resources like an Application Load Balancer. An ALB in the secondary Region needs an ACM certificate that exists in that same Region to terminate HTTPS. Requesting (or importing) a certificate in the secondary Region and attaching it to the ALB HTTPS listener is the standard managed approach with low operational overhead.

B is not correct because ACM certificates are not shared “across Regions” for direct use by a Regional ALB in another Region. Sharing via AWS RAM is used for sharing resources across accounts within a Region (and for supported resource types), but it does not provide a mechanism to use an ACM certificate issued in one Region directly on an ALB in a different Region.

D is required because the application runs in both Regions and must be able to pull container images locally with minimal operational work. Amazon ECR supports cross-Region replication so images pushed in the primary Region can be replicated automatically to the secondary Region’s ECR repositories. This avoids building custom copy pipelines and reduces the chance of drift. Once replication is enabled, updating images in the primary Region can automatically populate the secondary Region repository.

C is not the best fit. A VPC endpoint for ECR is about private connectivity to ECR within a Region. It does not solve the multi-Region image availability problem by itself, and it introduces the idea of pulling images from the primary Region, which is unnecessary and less optimal when cross-Region replication can keep images local to each Region.

E is required because the database must support multi-Region application operation with tolerable replication latency. Aurora Global Database is the managed feature designed to replicate an Aurora cluster to a secondary Region with low-latency replication and minimal operational overhead compared to custom replication. Enabling write forwarding allows applications in the secondary Region to send write requests to the secondary cluster endpoint, with Aurora forwarding those writes to the primary writer. This reduces application changes compared to forcing all writes to go directly to the primary Region endpoints, and it supports an active-active application deployment pattern where both Regions can accept traffic.

F is not correct because “cross-Region writes between DB clusters” and “multiple writer instances in the primary Region” do not provide a managed, multi-Region, multi-writer Aurora design as described. Aurora’s managed multi-Region pattern is Aurora Global Database with a single primary writer in one Region (with the option to promote a secondary Region during failover) and optional write forwarding from a secondary Region to the primary. The option’s described cross-Region multi-writer behavior is not a standard supported Aurora configuration and would not be the least operational overhead approach.

Therefore, the least operational overhead combination that correctly addresses HTTPS termination in the secondary Region, image availability in both Regions, and managed multi-Region database replication is A, D, and E.

The correct solution is to use the authenticate-oidc action for the ALB listener rule and configure it with the details of the AWS Directory Service for Microsoft Active Directory directory. This way, the ALB can use OpenID Connect (OIDC) to authenticate users against the directory and grant them access to the intranet web application. The app client in the directory is used to register the ALB as an OIDC client and provide the necessary credentials and endpoints. The callback URL is the URL that the ALB redirects the user to after a successful authentication. This solution does not require any additional services or roles, and it leverages the existing directory accounts for all users.

The other solutions are incorrect because they either use the wrong action for the ALB listener rule, or they involve unnecessary or incompatible services or roles. For example:

Solution B is incorrect because it uses Amazon Cognito user pool, which is a separate user directory service that does not integrate with AWS Directory Service for Microsoft Active Directory. To use this solution, the company would have to migrate or synchronize their users from the directory to the user pool, which is not required by the question. Moreover, the authenticate-cognito action for the ALB listener rule only works with Amazon Cognito user pools, not with federated identity providers (IdPs) that have metadata from the directory.

Solution C is incorrect because it uses IAM as an identity provider (IdP), which is not compatible with AWS Directory Service for Microsoft Active Directory. IAM can only be used as an IdP for web identity federation, which allows users to sign in with social media or other third-party IdPs, not with Active Directory. Moreover, the authenticate-oidc action for the ALB listener rule requires an OIDC IdP, not a SAML 2.0 federation IdP, which is what IAM provides.

Solution D is incorrect because it uses AWS IAM Identity Center (AWS Single Sign-On), which is a service that simplifies the management of SSO access to multiple AWS accounts and business applications. This service is not needed for the scenario in the question, which only involves a single intranet web application. Moreover, the authenticate-cognito action for the ALB listener rule does not work with external IdPs that use SAML, such as AWS IAM Identity Center.

Authenticate users using an Application Load Balancer

What is AWS Directory Service for Microsoft Active Directory?

Using OpenID Connect for user authentication