Free SAP-C02 practice test

IAM Identity Center provides centralized, federated single sign-on to multiple accounts with permission sets, integrating corporate identity providers via SAML. Per-account IAM users (B) don't scale and fragment identity, sharing root (C) is a severe risk, and Cognito (A) targets application end users, not workforce SSO to accounts.

Region-restricting SCPs on the OUs enforce that workloads can only deploy in approved (in-country) Regions, while Control Tower/Organizations provide central governance — a preventive, enforceable residency guardrail. Trust (B) isn't enforcement, a global VPC (C) doesn't constrain Regions, and disabling CloudTrail (D) harms auditability.

SCPs set the maximum permissions for accounts in an OU and cannot be overridden by account-level IAM — a Region-restricting SCP on the OU enforces the guardrail organization-wide. Per-account IAM (B) can be changed by account admins, a bucket policy (C) only affects S3, and permissions boundaries (D) apply per principal and are easy to miss across accounts.

An SCP that explicitly denies actions like disabling CloudTrail or GuardDuty sets an organization-wide guardrail that no account-level policy can override — a preventive control. Guidelines (B) aren't enforced, an alarm (C) is detective (after the fact), and permissions boundaries (D) must be applied per principal and can be missed.

Transit Gateway centralizes routing among many VPCs and on-premises connections (via Direct Connect gateway and/or VPN attachments), scaling cleanly as sites/VPCs are added. Full-mesh VPNs (B) don't scale, a NAT gateway (C) provides outbound internet not inter-network routing, and public IPs (D) are insecure and unmanaged.

A canary deployment shifts a small traffic percentage to the new version first, monitoring before full rollout with automatic rollback (CodeDeploy supports canary/linear traffic shifting for Lambda/ECS). All-at-once (B) maximizes blast radius, deleting first (C) risks an outage, and manual FTP (D) is not a controlled deployment.

Tier-to-tier security groups that reference each other (plus private subnets and NACLs) enforce least-privilege network paths between tiers. A single open security group (B), public subnets everywhere (C), and a public database (D) all violate segmentation and least privilege.

AWS KMS provides managed, auditable, rotatable encryption keys integrated with S3, EBS, RDS, and more, with customer-managed keys for control. Hard-coded keys (B) and keys in a public bucket (C) are severe security failures, and skipping encryption (D) fails the requirement.

Warm standby keeps a running, scaled-down environment in a second Region that scales up quickly on failover — achieving low RTO/RPO at moderate cost. Backup-and-restore (C) has RTO/RPO in hours, single-Region (D) provides no DR, and basic pilot light (A) typically has longer recovery than a minutes-level RTO.

AWS Lambda runs event-driven functions with no servers to manage, automatic scaling, and per-invocation billing — ideal for spiky, short tasks. Always-on EC2 (B) and fixed EKS (C) pay while idle, and continuous Batch (D) targets large parallel jobs, not event-triggered functions.

S3 Glacier Deep Archive is the lowest-cost class for rarely accessed, long-term archives where hours of retrieval time are acceptable. S3 Standard (B) is priced for frequent access, Standard-IA (D) suits infrequent-but-quick access, and EBS (A) is block storage attached to instances, not archival object storage.

CloudFront caches content at global edge locations, reducing latency for distant users and offloading the origin. A bigger origin (B) doesn't fix geographic latency, and options C and D don't address the problem.

An S3 Lifecycle policy automatically transitions aging objects to cheaper tiers (Standard-IA, then Glacier) and can expire them after retention — optimizing cost while meeting the one-year requirement. Leaving all in Standard (D) overpays, deleting early (B) violates retention, and EBS (A) is more expensive block storage.

Event-driven automation (CloudWatch/EventBridge triggering Systems Manager Automation documents or Lambda) remediates known issues automatically, improving operational excellence. Always paging humans (B) doesn't scale, disabling alarms (C) hides problems, and manual-only maintenance (D) is slow and reactive.

Horizontal scaling with an Auto Scaling group across AZs behind a load balancer removes the single point of failure and scales with demand. A bigger single instance (B) is still a single point of failure with a ceiling, a manual second instance without a balancer (C) doesn't distribute traffic, and snapshots (D) don't improve availability or scale.

Attaching an IAM role via an instance profile gives EC2 temporary, automatically rotated credentials with no long-lived keys to leak. Yearly rotation (B) still leaves standing keys, a public bucket (D) is a severe exposure, and AdministratorAccess (C) violates least privilege.

AWS DMS replicates data with minimal downtime, and SCT converts schema/code for heterogeneous engine changes (e.g., Oracle → PostgreSQL). A nightly dump (B) requires extended downtime, Snowball (C) is for bulk offline data transfer, and CloudFront (D) is a CDN.

Retire means decommissioning an application that's no longer needed, saving migration effort and cost. Rehost (D) moves it as-is, replatform (B) makes minor optimizations during the move, and repurchase (A) switches to a different product (e.g., SaaS).

Relocate moves infrastructure (such as VMware-based workloads to VMware Cloud on AWS) without purchasing new hardware or rewriting apps — fast, minimal change. Refactor (B) re-architects, repurchase (D) switches products, and retire (C) decommissions.

AWS Glue is a serverless data-integration service with a data catalog and managed ETL, replacing self-managed server-based ETL. Custom EC2 scripts (D) are server-based, Snowball (C) is bulk transfer, and Route 53 (B) is DNS.