SAP-C02 Exam Dumps - AWS Certified Solutions Architect - Professional

Create VPC Endpoint Service:

In the shared VPC, create a VPC endpoint service using the Network Load Balancer (NLB) that fronts the centralized application.

Enable the option to require endpoint acceptance to control which business unit VPCs can connect to the service.

Set Up VPC Endpoints in Business Unit VPCs:

In each business unit VPC, create a VPC endpoint that points to the VPC endpoint service created in the shared VPC.

Use the service name of the endpoint service created in the shared VPC for configuration.

Accept Endpoint Requests:

From the VPC endpoint service console in the shared VPC, review and accept endpoint connection requests from authorized business unit VPCs. This ensures that only authorized VPCs can access the centralized application.

Configure Routing:

Update the route tables in each business unit VPC to direct traffic destined for the centralized application through the VPC endpoint.

This solution ensures secure, private connectivity between the business unit VPCs and the shared VPC, even if there are overlapping CIDR blocks. It leverages AWS PrivateLink and VPC endpoints to provide scalable and controlled access​(AWS Documentation)​​(Amazon Web Services, Inc.)​.

The company wants logging that helps troubleshoot email delivery issues and also wants to search by recipient, subject, and time sent. Amazon SES provides event publishing for email sending and delivery events through configuration sets. With a configuration set, SES can publish sending events such as send, delivery, bounce, complaint, reject, and rendering failure to destinations such as Amazon CloudWatch, Amazon SNS, or Amazon Kinesis Data Firehose. For building a searchable log store, delivering these events into Amazon S3 through Kinesis Data Firehose is an effective approach because S3 provides durable storage and integrates well with query services.

Option A creates an SES configuration set with a Kinesis Data Firehose destination that delivers logs to an S3 bucket. This captures detailed SES event data that is directly useful for troubleshooting delivery issues and retaining historical records for analysis.

Once logs are stored in Amazon S3, Amazon Athena can query the data using SQL. Athena is designed to query data in S3 and is well suited for ad hoc searches. This meets the requirement to search based on recipient, subject, and time sent, assuming the event schema includes these fields (or they are included in the published event payload). Therefore, option C completes the solution by enabling searches over the stored log dataset.

Option B (CloudTrail) records API activity, such as calls made to SES APIs, but it is not designed to capture per-message delivery outcomes (deliveries, bounces, complaints) in a way that supports troubleshooting delivery behavior and detailed email event searching. CloudTrail is useful for auditing who called SES APIs, not for tracking message-level delivery events and outcomes.

Option D (CloudWatch log group) is another valid SES event publishing destination, but if the requirement is to perform flexible searches by multiple dimensions over a potentially large historical dataset, storing the logs in S3 and querying with Athena is a more direct and scalable pattern. Also, the provided option E is incorrect because Athena queries data in S3, not in CloudWatch Logs. CloudWatch Logs has its own query mechanism, but Athena is not used to query CloudWatch Logs directly in the way described.

Option E is incorrect because Amazon Athena does not query CloudWatch Logs as a log store. The typical searchable pattern for Athena is S3-backed datasets.

Therefore, the best combination to satisfy logging and searchable analysis requirements is to publish SES events to S3 via Kinesis Data Firehose (option A) and query those logs with Athena (option C).

The company does not have a data inventory and needs to identify which S3 buckets contain sensitive data. The appropriate AWS managed service for discovering and classifying sensitive data in S3 is Amazon Macie. Macie is designed to discover, classify, and report on sensitive data such as PII in S3 buckets. Amazon Inspector is primarily focused on vulnerability management for compute and container resources and does not provide S3 sensitive data classification in the way Macie does.

After identifying sensitive data locations, the company needs to ensure sensitive data is encrypted with a key that only administrators can access. SSE-S3 uses S3-managed keys and does not provide fine-grained administrative control of key usage in the same way as SSE-KMS with a customer managed key. Using AWS KMS customer managed keys allows the company to control access through key policies and IAM policies so that only designated administrator principals can use or manage the key.

The requirement also implies existing objects already encrypted with SSE-S3 need to be re-encrypted with SSE-KMS for sensitive objects. Changing default encryption only affects new objects. Existing objects must be rewritten (copied over themselves or copied to a new location) using SSE-KMS with the customer managed key. An orchestrated workflow is a common approach to iterate over identified objects and perform copy operations with the desired encryption settings.

Option C uses Macie for discovery, creates a KMS customer managed key restricted to administrators, sets bucket default encryption to SSE-KMS for future objects, and uses a Step Functions workflow to re-encrypt existing sensitive objects. This meets both the discovery requirement and the encryption/control requirement.

Option A is incorrect because Inspector is not the right service to inventory sensitive data in S3. Although the use of a customer managed KMS key and bucket policy enforcement is directionally correct for controlling encryption on writes, the first step (sensitive data discovery) is wrong.

Option B is incorrect because AWS managed keys cannot have their key policies modified by customers in the way customer managed keys can. Also, Inspector is not the right tool for sensitive data discovery in S3.

Option D is incorrect for the same reasons: it relies on Macie correctly for discovery but then attempts to modify an AWS managed key policy, which is not the correct method for restricting access. To restrict access, the company should use a KMS customer managed key with an appropriate key policy.

Therefore, using Amazon Macie plus an AWS KMS customer managed key and a workflow to re-encrypt existing sensitive objects is the correct solution.

Option A is correct because SageMaker AI Notebook Instances support Git repositories as SageMaker resources, and private repository credentials can be stored in AWS Secrets Manager. This satisfies the requirement with the least operational overhead because the notebook instances can remain isolated from direct internet access while SageMaker manages repository association and authentication. Placing credentials inside a URL is insecure and does not properly solve credential management. NAT gateway options introduce internet egress into the VPC, which conflicts with the isolation requirement and adds operational and security complexity. Network ACLs are not suitable for controlling access to a specific Git URL because they operate at the subnet and IP/port level, not at an application URL level. (AWS Documentation)

===============

The key requirement is to provide access to a private Git repository while keeping the SageMaker notebook instances isolated from the internet. The environment is intentionally configured without internet access, and connectivity to AWS services is provided through VPC endpoints. Introducing a NAT gateway and routing to the internet would violate the requirement to keep the notebook instances isolated from the internet, and network ACLs cannot reliably restrict outbound access by URL or domain name because NACLs operate at the IP and port level and do not provide DNS-aware URL filtering.

SageMaker supports integrating Git repositories so that notebooks can pull code directly as part of the workflow. When using a private repository, credentials must be handled securely. Using AWS Secrets Manager to store and reference Git credentials allows authentication without embedding usernames and passwords in code or URLs and without granting broad network access. This approach meets the requirement with low operational overhead because it relies on managed SageMaker Git integration and managed secret storage rather than custom networking controls.

Option A uses SageMaker’s Git repository integration with the remote URL and stores credentials in AWS Secrets Manager. This allows notebooks to access the private repository in a controlled, auditable way while preserving the “no internet access” posture of the VPC design (because it does not require adding a NAT gateway or public routes).

Option B is not appropriate because embedding credentials (even just usernames) in URLs is not a secure or robust credential management practice. It also does not solve private authentication in a secure manner and can lead to credential leakage through logs or configuration.

Options C and D are not correct because they require adding a NAT gateway and routing to the internet. That directly conflicts with the requirement that SageMaker notebook instances remain isolated from the internet. Additionally, the proposed restriction mechanism is invalid: network ACLs cannot restrict traffic to a specific URL. They only allow/deny traffic based on IP addresses, ports, and protocols. A Git repository can resolve to multiple IPs, can change IPs, and can use CDNs, making NACL-based IP allowlisting brittle and operationally heavy.

Therefore, integrating the Git repository with SageMaker and using Secrets Manager for credentials is the best solution with the least operational overhead while maintaining internet isolation.

Automating the process of increasing service quotas for Amazon EC2 instances in new AWS accounts with minimal operational overhead can be effectively achieved by using Amazon EventBridge, Amazon SNS, and AWS Lambda. An EventBridge rule can detect the creation of a new account and trigger an SNS topic, which in turn invokes a Lambda function. This function can then programmatically request a service quota increase for EC2 instances using the AWS Service Quotas API. This approach streamlines the process, reduces manual intervention, and ensures that new accounts are automatically configured with the desired service quotas.

Amazon EventBridge Documentation: Provides guidance on setting up event rules for detecting AWS account creation.

AWS Lambda Documentation: Details how to create and configure Lambda functions to perform automated tasks, such as requesting service quota increases.

AWS Service Quotas Documentation: Offers information on managing and requesting increases for AWS service quotas programmatically.