SAP-C02 VCE Exam Download

Resource-based policies are policies that you attach to a resource, such as an IAM role, to specify who can access the resource and what actions they can perform on it1. Identity-based policies are policies that you attach to an IAM user, group, or role to specify what actions they can perform on which resources2. Trust policies are special types of resource-based policies that define which principals (such as IAM users or roles) can assume a role3.

To allow an IAM user in Account A to assume a role in Account B, the solutions architect needs to do the following:

Configure the resource-based policy on the target role in Account B to allow the action sts:AssumeRole for the IAM user in Account A. This policy grants permission to the IAM user to assume the role4.

Configure the identity-based policy on the user in Account A to allow the action sts:AssumeRole for the target role in Account B. This policy grants permission to the user to perform the action of assuming the role5.

Configure the trust policy on the target role in Account B to allow the principal of the IAM user in Account A. This policy defines who can assume the role.

Resource-based policies

Identity-based policies

Trust policies

Granting a user permissions to switch roles

Switching roles

[Modifying a role trust policy]

The company needs to upgrade DocumentDB to the latest version with no data loss while allowing continuous reads and writes. The company also must be able to test and verify the upgrade before switching production traffic. This is a classic requirement for performing an upgrade using a blue/green approach: build a new target environment on the new version, keep it in sync with the source, validate it, and then cut over by changing the endpoint (here, Route 53 DNS).

Option A implements this pattern using a new DocumentDB cluster running the latest version and AWS DMS to continuously migrate and replicate changes from the old cluster to the new cluster. Because the workload is continuously changing, a one-time export/import is insufficient; continuous replication is needed to keep the target cluster current during the test period. AWS DMS supports a “migrate and replicate” style of task that performs a full load and then applies ongoing changes (CDC) so the target stays synchronized. The question also states that change streams are enabled with a 24-hour retention period, which supports capturing and applying changes during migration/validation and helps ensure the replication stream can be maintained while testing.

Option A also addresses indexes by using the DocumentDB Index Tool to export and import indexes, which is important because indexes can affect query performance and behavior. After the company validates the new cluster, the cutover is done by updating the Route 53 record to point to the new cluster endpoint, switching all backend services without changing application configuration beyond DNS resolution.

Option B uses MongoDB CLI tools to export/import. This is not suitable for continuous write workloads because export/import is a point-in-time operation and would require downtime or risk data divergence during the test period. It also adds more operational overhead and does not provide continuous replication for the duration of validation.

Option C performs an in-place major version upgrade. That does not satisfy the requirement to test and verify the upgrade before backend services use the upgraded version because the upgrade happens directly on the production cluster. Even though a snapshot exists for rollback, production is still exposed to the upgrade immediately, which violates the requirement for pre-cutover verification.

Option D is incorrect because AWS DataSync transfers files between storage systems such as NFS/SMB and AWS storage services. It is not a database migration or replication service and cannot copy a DocumentDB database in a way that preserves database semantics and supports continuous replication.

Therefore, creating a new DocumentDB cluster, keeping it synchronized using AWS DMS (supported by change stream retention), validating it, and then cutting over via Route 53 DNS update (option A) meets all requirements.

Comprehensive and Detailed Explanation:

Why C is the best answer

This question requires all of the following:

Bidirectional access between two separate AWS Organizations

Access to S3 buckets across accounts and organizational boundaries

Encryption at rest

Logging of all S3 bucket access

Buckets exist in different Regions

Option C is the best match because S3 Access Points are purpose-built to simplify and scale access management for shared S3 datasets. For cross-account or multi-team sharing scenarios, S3 Access Points let you define dedicated access paths and policies instead of overloading a single bucket policy. For encryption at rest, customer managed AWS KMS keys are the strongest fit when cross-account access must be explicitly controlled. For logging bucket-level object access, AWS CloudTrail is the correct service because S3 data events record object-level API activity such as GetObject and PutObject.

Why the other options are not correct

A. S3 Access Grants is not the best fit here

S3 Access Grants is designed primarily to grant S3 access to identities mapped from identity sources and simplify data access at scale. It is not the standard primary design choice for bidirectional bucket sharing between two separate organizations. The exam-focused architectural pattern for controlled cross-account S3 sharing is S3 Access Points plus policies, combined with KMS permissions and CloudTrail data events. Even though SSE-KMS and CloudTrail data events are good parts of the design, the access mechanism in A is not the best answer.

B. VPC networking services do not solve the main requirement

VPC peering, PrivateLink, and endpoint access controls are network connectivity controls. Amazon S3 is not shared between organizations by building VPC peering between their VPCs. Also, VPC Flow Logs record network flow metadata, not S3 object access. That means B fails the logging requirement and uses the wrong control plane for the access-sharing requirement.

D. Replication and SCPs do not provide bidirectional shared access

S3 Cross-Region Replication copies objects; it does not establish bidirectional shared access for both organizations to each other’s buckets. Service Control Policies also do not work the way this option describes. SCPs are guardrails within an AWS Organization; they are not shared between separate organizations to grant object access. In addition, S3 server access logging is not the best answer when the requirement is to collect logs of all S3 bucket access in an auditable way for object-level API actions. CloudTrail data events are the stronger and more exam-aligned choice for logging object access activity.

Key technical reasoning

Cross-account / cross-organization S3 access:

S3 Access Points are commonly used to provide distinct permissions and simplified policy management for different consumers of the same bucket. This is especially useful in multi-account environments.

Encryption at rest:

When access spans accounts or organizations, customer managed KMS keys are preferred because key policies and grants can explicitly authorize external principals. This gives finer control than SSE-S3 when cross-account governance matters.

Logging:

For S3 object-level operations, CloudTrail data events are the standard answer in AWS architecture questions. They record API activity such as GetObject, PutObject, and DeleteObject. This is more appropriate than VPC Flow Logs or relying only on S3 server access logging.

Regional aspect:

The fact that buckets are in us-east-1 and us-west-1 does not prevent cross-account access. S3 access control, KMS permissions, and CloudTrail can be configured in the relevant Regions.