AWS Certified Professional Changed SAP-C02 Questions

AWS Certified Solutions Architect - Professional Questions and Answers

Question 49

An ecommerce company runs an application on AWS. The application has an Amazon API Gateway API that invokes an AWS Lambda function. The data is stored in an Amazon RDS for PostgreSQL DB instance.

During the company ' s most recent flash sale, a sudden increase in API calls negatively affected the application ' s performance. A solutions architect reviewed the Amazon CloudWatch metrics during that time and noticed a significant increase in Lambda invocations and database connections. The CPU utilization also was high on the DB instance.

What should the solutions architect recommend to optimize the application ' s performance?

Options:

Increase the memory of the Lambda function. Modify the Lambda function to close the database connections when the data is retrieved.

Add an Amazon ElastiCache for Redis cluster to store the frequently accessed data from the RDS database.

Create an RDS proxy by using the Lambda console. Modify the Lambda function to use the proxy endpoint.

Modify the Lambda function to connect to the database outside of the function ' s handler. Check for an existing database connection before creating a new connection.

Question 50

A research company conducts mathematical simulations in the AWS Cloud. The simulations run on several hundred Amazon EC2 Linux instances. If a simulation encounters an issue, an engineer establishes an SSH connection to the affected EC2 instance.

Company policy requires that each EC2 instance session is established with a unique SSH key and that all SSH connections are logged in AWS CloudTrail. CloudTrail is enabled for the company’s account and the AWS Regions that the company uses.

Which solution will meet these requirements?

Options:

Answer:

Launch new EC2 instances. Generate an individual SSH key for each new EC2 instance. Store the SSH key in AWS Secrets Manager. Create a new IAM policy. Attach the IAM policy to the engineers' IAM role with an Allow statement for the GetSecretValue action. Instruct the engineers to retrieve the SSH key from Secrets Manager when the engineers connect through any SSH client.

Answer:

Create an AWS Systems Manager document to run commands on EC2 instances to set a new unique SSH key. Create a new IAM policy. Attach the IAM policy to the engineers' IAM role with an Allow statement to run Systems Manager documents. Instruct the engineers to run the document to set an SSH key and to connect through any SSH client.

Answer:

Launch new EC2 instances without setting up any SSH key for the new EC2 instances. Set up EC2 Instance Connect on each new EC2 instance. Create a new IAM policy. Attach the IAM policy to the engineers' IAM role with an Allow statement for the SendSSHPublicKey action. Instruct the engineers to connect to the EC2 instances by using Instance Connect from the AWS CLI.

Answer:

Set up AWS Secrets Manager to store the EC2 SSH key. Create an AWS Lambda function to create a new SSH key and to call AWS Systems Manager Session Manager to set the SSH key on the EC2 instance. Configure Secrets Manager to use the Lambda function to automatically rotate the SSH key once daily. Instruct the engineers to retrieve the SSH key from Secrets Manager when the engineers connect through any SSH client.

Answer:

CC is correct because EC2 Instance Connect is designed to provide per-connection, short-lived SSH access without long-lived shared private keys, and it integrates with IAM so access is controlled and auditable. With EC2 Instance Connect, engineers push a public key for a short time window to the target instance using the SendSSHPublicKey API action. This meets the “unique SSH key per session” intent because the key can be generated per session and injected temporarily instead of being a persistent static key. Additionally, the key injection is performed through an AWS API call, which is recorded in AWS CloudTrail, satisfying the logging requirement for SSH access activity.Why the other options are incorrect:

Answer:

B: Running a Systems Manager document to set keys creates operational overhead and still does not inherently ensure CloudTrail logs of each SSH connection (the SSM Run Command API calls are logged, but the subsequent SSH login over the network is not an AWS API event). It also risks key persistence beyond a single session.

Answer:

D: Daily rotation is not “unique per session,” and it is complex/operationally heavy. Like A, the SSH login itself is not automatically a CloudTrail event; CloudTrail would capture Secrets Manager and SSM API calls, not the network SSH authentication event.

Explanation:

[References:, Amazon EC2 Instance Connect Documentation: SendSSHPublicKey workflow, temporary key injection, IAM-based access control, AWS CloudTrail Documentation: logging of AWS API calls (including EC2 Instance Connect API actions) across Regions, Amazon EC2 Documentation: Linux instance access patterns and key-based authentication options, AWS Certified Solutions Architect – Professional (SAP-C02) Exam Guide: centralized access control, auditability, and scalable operational patterns for large fleets, , , , ]

Question 51

A company ' s interactive web application uses an Amazon CloudFront distribution to serve images from an Amazon S3 bucket. Occasionally, third-party tools ingest corrupted images into the S3 bucket. This image corruption causes a poor user experience in the application later. The company has successfully implemented and tested Python logic to detect corrupt images.

A solutions architect must recommend a solution to integrate the detection logic with minimal latency between the ingestion and serving.

Which solution will meet these requirements?

Options:

Use a Lambda@Edge function that is invoked by a viewer-response event.

Use a Lambda@Edge function that is invoked by an origin-response event.

Use an S3 event notification that invokes an AWS Lambda function.

Use an S3 event notification that invokes an AWS Step Functions state machine.

Question 52

A company needs to apply consistent custom security audit rules across its organization in AWS Organizations. Accounts in the organization use a single AWS Region.

The company uses AWS Config in each account with four custom rules and five managed rules. The rules must be deployed to all accounts and must not be editable by member accounts. The company wants to easily update rules in the future. All required permissions are already in place.

Which combination of steps will meet these requirements with the LEAST operational effort? (Select TWO.)

Options:

Call the PutOrganizationConformancePack API operation from a delegated administrator account to deploy the conformance pack to the entire organization.

Create an AWS Config conformance pack that includes four custom policy rules.

Create an AWS Config conformance pack that includes four custom policy rules and five AWS managed rules.

Deploy five AWS organizational rules and the conformance pack from a delegated administrator account to the entire organization.

Use AWS CloudFormation StackSets to deploy the conformance pack with termination protection.

Spring Sale 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: save70

AWS Certified Professional Changed SAP-C02 Questions

AWS Certified Solutions Architect - Professional Questions and Answers

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

Options:

Answer:

Explanation:

CompTIA

Fortinet

Microsoft

Salesforce