Amazon Web Services Updated SAP-C02 Exam Questions and Answers by lisa

A is correct because the agent performs autonomous workload actions without user interaction. In OAuth terms, this maps to the client credentials grant, where the workload authenticates as itself rather than on behalf of an interactive user. Amazon Bedrock AgentCore Identity is designed for identity and credential management for AI agents and automated workloads, including workload identities, credential providers, and auditability. AWS documentation describes AgentCore Identity as supporting agent identities through workload identities and states that client credentials are used when an agent authenticates directly with each system using its own identity and preconfigured permissions. IAM users with long-lived keys are a weaker security design. Authorization code is user-delegated and interactive, so it does not fit a no-user-interaction autonomous agent workflow.

Option B is correct because S3 conditional writes using If-Match and ETags provide optimistic concurrency control. The application reads the object, obtains the current ETag, and submits the update only if the object still has that ETag. If another user’s write completed first, the ETag changes and the later write fails instead of overwriting the first successful update. A Lambda function can detect failed S3 write responses and send retry or conflict-resolution messages to Amazon SQS. Option A enables versioning, which preserves object history but does not prevent conflicting writes from succeeding. Option C misuses Object Lock, which is designed for retention and write protection, not collaborative editing. Option D adds distributed locking and batch processing complexity and is not appropriate for real-time document edits.

The correct answer is B. The requirement is resource-side protection for all current and future private Amazon ECR repositories across the organization. AWS Organizations resource control policies are designed to centrally restrict permissions on resources in member accounts and are appropriate when external principals must be prevented from accessing organization-owned resources. AWS documentation lists Amazon Elastic Container Registry as a supported service for RCPs. A condition such as aws:PrincipalOrgID enforces that only principals from the same AWS Organization can access the resources. SCPs restrict principals in accounts, not resource exposure to external principals. Modifying IAM policies in hundreds of accounts is operationally poor and does not protect future repository policies consistently. AWS RAM is not the right control plane for private ECR repository access. (AWS Documentation)

===============

A is the correct answer because it uses AWS Directory Service for Microsoft Active Directory to join the Windows EC2 instances to an Active Directory domain on AWS and enable MFA. AWS Directory Service for Microsoft Active Directory, also known as AWS Managed Microsoft AD, is a fully managed service that is powered by Windows Server 2019. It allows you to run directory-aware workloads in the AWS Cloud, including Microsoft SharePoint and custom .NET and SQL Server-based applications. You can also configure a trust relationship between AWS Managed Microsoft AD in the AWS Cloud and your existing on-premises Microsoft Active Directory. AWS Managed Microsoft AD supports MFA by integrating with your existing RADIUS-based MFA infrastructure. To join the Windows EC2 instances to an Active Directory domain on AWS, you can use an Amazon Workspace, which is a fully managed, secure desktop computing service that runs on AWS. You can connect to and use the Workspace for domain security configuration tasks. References:

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/directory_microsoft_ad.html

https://docs.aws.amazon.com/directoryservice/latest/admin-guide/ms_ad_join_instance.html

https://docs.aws.amazon.com/workspaces/latest/adminguide/amazon-workspaces.html