SAP-C02 Exam Dumps - AWS Certified Solutions Architect - Professional

B is correct because Amazon FSx for Lustre provides a high-performance, POSIX-compliant file system that can be directly linked with Amazon S3 using data repository integration. This allows the EC2-based processing engine (which requires POSIX file operations) to read/write files through a mounted Lustre file system while automatically importing objects from S3 and exporting results back to S3 using Lustre’s S3 integration policies. This satisfies all requirements: POSIX file access, no need to change the application to use the S3 API, and automated synchronization for both inputs and outputs.

Why the other options are incorrect:

A: DataSync is designed for scheduled or task-based data transfers. It does not provide a mounted POSIX file system interface for the application to read/write “in place,” and the “without an agent” requirement is not a fit for an EC2-hosted POSIX workflow that needs continuous file semantics.

C: Amazon EFS is POSIX and mountable, but “data repository associations to S3” is not an EFS capability in the way described. EFS does not provide native bidirectional automatic sync with S3 using import/export policies like FSx for Lustre’s S3 integration.

D: S3 File Gateway provides a file interface backed by S3, but keeping cache coherent with explicit RefreshCache calls is operationally complex and not truly “automatic synchronization” in the sense required. It also introduces caching behaviors that can complicate immediate availability expectations.

By integrating a Lambda pre-provisioning hook into the AWS IoT Core provisioning template, the serial number can be validated against the CA before the device is allowed to send data.

Using allow-auto-registration ensures that only installed devices can register and send data, meeting the security requirement that sensors cannot send data until physically installed.

This approach follows AWS IoT’s secure onboarding pattern for managing device identity and authorization.

Comprehensive and Detailed in Depth Explanation:

C is correct because AWS Transit Gateway is the most scalable and efficient way to interconnect hundreds of VPCs. By deploying one transit gateway per OU and sharing it with AWS RAM, each OU can isolate its network traffic and maintain internal communication without affecting or exposing other OUs.

The correct answer is A, D, and F. Existing AWS accounts can be invited into an AWS Organizations organization, and SCPs are the correct organization-level mechanism to enforce preventive controls such as required tagging. Because OUs contain accounts, not individual EC2 instances, development workloads must be recreated or migrated into an account that is placed under the development OU. Amazon Inspector is the correct service for automated EC2 vulnerability scanning, and Security Hub can aggregate and centralize findings across an organization. For patching, AWS Systems Manager Patch Manager can be managed across an organization through delegated administration and organization-wide patch policies, which reduces operational overhead compared with configuring each account separately. Trusted Advisor is not the right vulnerability scanning service, and configuring Patch Manager separately in every account creates unnecessary administration.

The best solution for this problem is to update the visibility timeout for the SQS queue to 3 hours. This is because when the visibility timeout is set to 1 hour, it means that if the EC2 instance doesn ' t process the message within an hour, it will be moved to the dead-letter queue. By increasing the visibility timeout to 3 hours, this should give the EC2 instance enough time to process the message before it gets moved to the dead-letter queue. Additionally, configuring scale-in protection for the EC2 instances during processing will help to ensure that the instances are not terminated while the messages are being processed.

Ais the correct best-practice approach:

Activate cost allocation tags inmanagement/payer account.

Enable AWS Cost and Usage Report (CUR) to dump usage to S3.

Query CUR withAmazon Athena, and visualize withAmazon QuickSight.

Other options either duplicate CURs (C, D) or misuse tools (B: CloudWatch is not a cost analysis tool).

The company should attach a policy to the S3-access group to deny all S3 actions unless MFA is present. The company should request temporary credentials from AWS Security Token Service (AWS STS). The company should attach the temporary credentials in a profile that Amazon S3 will reference when the user performs actions in Amazon S3. This solution will meet the requirements because AWS STS is a service that enables you to request temporary, limited-privilege credentials for IAM users or for users that you authenticate (federated users). You can use MFA with AWS STS to provide an extra layer of security when requesting temporary credentials1. You can use the sts get-session-token AWS CLI command to request temporary credentials that include an MFA token2. You can then use these credentials with the AWS CLI to access Amazon S3 resources. To do this, you need to attach a policy to the IAM group that denies all S3 actions unless MFA is present3.You also need to create a profile in the AWS CLI configuration file that references the temporary credentials.

The other options are not correct because:

Attaching a policy to the S3 bucket to prompt the IAM user for an MFA code when the IAM user performs actions on the S3 bucket would not work because policies attached to S3 buckets cannot enforce MFA authentication. Policies attached to S3 buckets are resource-based policies that define what actions can be performed on the bucket and by whom. They do not have any logic to prompt for an MFA code or verify it.

Updating the trust policy for the S3-access group to require principals to use MFA when principals assume the group would not work because trust policies are used for roles, not groups. Trust policies are policies that define which principals can assume a role. They do not apply to groups, which are collections of IAM users that share permissions.

Creating an Amazon Route 53 Resolver DNS Firewall domain list that contains the allowed domains and configuring a DNS Firewall rule group with rules to allow or block requests based on the domain list would not help with enforcing MFA authentication for Amazon S3 actions. Amazon Route 53 Resolver DNS Firewall is a feature that enables you to filter and regulate outbound DNS traffic for your VPC. You can create reusable collections of filtering rules in DNS Firewall rule groups and associate them with your VPCs. You can specify lists of domain names to allow or block, and you can customize the responses for the DNS queries that you block. This feature is useful for controlling access to sites and blocking DNS-level threats, but not for requiring MFA authentication.