Amazon Web Services certsexpert download Full Version Sap-c02 Exam by Inaaya q253 vce pdf

Page: 19 / 48

Exam Name:	AWS Certified Solutions Architect - Professional
Exam Code:	SAP-C02 Dumps
Vendor:	Amazon Web Services	Certification:	AWS Certified Professional
Questions:	645 Q&A's	Shared By:	inaaya

Question 76

A company uses AWS Organizations. The company creates a central VPC in an AWS account that is designated for networking in a single AWS Region. The central VPC has an AWS Site-to-Site VPN connection to the company ' s on-premises network. A solutions architect must create another AWS account that uses the same networking resources that the central VPC uses.

Which solution meets these requirements MOST cost-effectively?

Options:

Create a VPC in the new AWS account. Create a new Site-to-Site VPN connection for the on-premises connection.

Use AWS Resource Access Manager to share the VPN connection in the central VPC with the new AWS account.

Create a VPC in the new AWS account. Configure a virtual private gateway to connect to the central VPC.

Use AWS Resource Access Manager to share the subnets in the central VPC with the new AWS account.

Discussion

Question 77

Question:

A company mandates that all internal AWS communications useprivate IPs. A solutions architect createdinterface VPC endpointsfor public AWS services like S3. However, service names are still resolving topublic IP addresses, and the internal apps cannot connect.

What should the architect do to resolve this issue?

Options:

Update the subnet route table with a route to the interface endpoint.

Enable the private DNS option on the VPC attributes.

Configure the security group on the interface endpoint to allow access.

Configure a private hosted zone with conditional forwarding.

Discussion

Question 78

A company has a new requirement to store all database backups in an isolated AWS account. The company is using AWS Organizations and has created a central write-once, read-many (WORM) account for the backups.

The company has 40 Amazon RDS for MySQL databases in its production account. The databases are encrypted with the default RDS AWS KMS key. RDS automated backups of the databases occur daily and have a retention period of 30 days.

Which solution will successfully copy the database backups to the central account?

Options:

Enable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create IAM policies and backup policies. Enable cross-account management. Create a backup vault in the central account. Create a KMS key for the backup vault and share the key with the production account. In the production account, restore the databases from a snapshot and apply the shared KMS

Enable Organizations trusted access and backup policies for AWS Backup. Configure the central account as the delegated administrator for AWS Backup. Create IAM policies and backup policies. Enable cross-account management. In the production account, share the default RDS KMS key with the central account. Create a backup vault in the central account. Apply the shared default RDS KMS key to the backup vault. Create a backup plan in the centra

Create an Amazon EventBridge rule to invoke an AWS Lambda function every day. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account. After the copy job is complete, create a new KMS key. Use the new KMS key to encrypt the database snapshots in the central account.

Create an Amazon EventBridge rule to invoke an AWS Lambda function every day. In the production account, share the default RDS KMS key with the central account. Program the Lambda function to decrypt the snapshots and to initiate a copy request of all unencrypted snapshots to the central account. After the copy job is complete, encrypt the database snapshots with the shared default RDS KMS key in the central account.

Discussion

Answer:

Explanation:

The company wants backups to be stored in an isolated central account designed for WORM storage. With AWS Organizations, AWS Backup supports centralized, cross-account backup management through delegated administration, backup policies, and cross-account backup vault usage. This provides the least operational overhead and scales to dozens of databases.

A key constraint is encryption. The databases are encrypted with the default RDS AWS KMS key. AWS-managed KMS keys (including the default RDS KMS key) are not customer-managed and generally cannot be shared across accounts for cross-account snapshot copy and cross-account backup workflows that require key sharing and explicit grants. For cross-account backup copies, the source backups must be encrypted with a customer managed KMS key that can be shared (via key policy and grants) with the destination account. Therefore, the company must move away from using the default RDS AWS-managed key for encryption of snapshots that will be copied across accounts.

Option A uses the correct managed approach: enable trusted access and backup policies in Organizations, make the central account the delegated administrator, and use AWS Backup to manage cross-account backups into a central backup vault. It also correctly introduces a customer managed KMS key in the central account for the backup vault and shares that key with the production account. Because the existing databases are encrypted with the default RDS AWS-managed key, option A includes the necessary remediation step: restore (or otherwise recreate) the databases so they are encrypted with the shared customer managed KMS key, enabling future backups and copies to be encrypted with a shareable key and stored in the central vault.

Option B is not workable because it requires “sharing the default RDS KMS key” with another account and using it for the central vault. AWS-managed keys are not shared and are not controlled by customers in a way that supports this cross-account backup model. Therefore, this option fails the encryption requirement.

Option C and option D rely on decrypting snapshots, copying them as unencrypted, and then re-encrypting. This is not a valid or safe operational pattern for RDS automated backups at scale, and it conflicts with typical constraints around snapshot encryption transitions. It also introduces substantial custom automation and operational overhead, and it undermines the objective of a controlled WORM backup account by manipulating encryption state through custom code. Additionally, “decrypting snapshots” is not how encrypted RDS snapshots are typically handled; encrypted snapshots remain encrypted and are copied re-encrypted with a different KMS key that the destination can use, which requires a customer managed key and proper permissions.

Therefore, the successful and scalable solution is to centralize backups with AWS Backup and ensure the databases are encrypted with a customer managed KMS key that can be shared cross-account, as described in option A.

[References:, AWS documentation on AWS Backup centralized management with AWS Organizations, including delegated administrator and backup policies for cross-account governance., AWS documentation on cross-account backup and snapshot copy requirements for encryption, including the need to use AWS KMS customer managed keys for cross-account sharing and re-encryption., AWS guidance that AWS-managed KMS keys (service-managed default keys) are not shareable across accounts for these cross-account encryption and copy workflows., , , , ]

Question 79

A company is using AWS Organizations lo manage multiple AWS accounts For security purposes, the company requires the creation of an Amazon Simple Notification Service (Amazon SNS) topic that enables integration with a third-party alerting system in all the Organizations member accounts

A solutions architect used an AWS CloudFormation template to create the SNS topic and stack sets to automate the deployment of CloudFormation stacks Trusted access has been enabled in Organizations

What should the solutions architect do to deploy the CloudFormation StackSets in all AWS accounts?

Options:

Create a stack set in the Organizations member accounts. Use service-managed permissions. Set deployment options to deploy to an organization. Use CloudFormation StackSets drift detection.

Create stacks in the Organizations member accounts. Use self-service permissions. Set deployment options to deploy to an organization. Enable the CloudFormation StackSets automatic deployment.

Create a stack set in the Organizations management account Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets automatic deployment.

Create stacks in the Organizations management account. Use service-managed permissions. Set deployment options to deploy to the organization. Enable CloudFormation StackSets drift detection.

Discussion

Ernest

That's amazing. I think I'm going to give Cramkey Dumps a try for my next exam. Thanks for telling me about them! CramKey admin please share more questions……You guys are amazing.

Nate Apr 3, 2026

I failed last week, I never know this site , but amazed to see all these questions were in my exam week before. I feel bad now, why I didn’t bother this site. Thanks Cramkey, Excellent Job.

Miley

Hey, I tried Cramkey Dumps for my IT certification exam. They are really awesome and helped me pass my exam with wonderful score.

Megan Apr 3, 2026

That’s great!!! I’ll definitely give it a try. Thanks!!!

Sam

Can I get help from these dumps and their support team for preparing my exam?

Audrey Apr 6, 2026

Definitely, you won't regret it. They've helped so many people pass their exams and I'm sure they'll help you too. Good luck with your studies!

Georgina

I used Cramkey Dumps to prepare for my recent exam and I have to say, they were a huge help.

Corey Apr 15, 2026

Really? How did they help you? I know these are the same questions appears in exam. I will give my try. But tell me if they also help in some training?

Page: 19 / 48

Title

Questions

Posted

amazon web services.examstopics.aws certified professional sap-c02 reddit questions.by omari.q421.vce.pdf

421

2026-03-03

amazon web services.crack4sure.sap-c02 actual questions.by keegan.q42.vce.pdf

2026-04-15

amazon web services.pass4success.newly released sap-c02 exam pdf.by bernard.q295.vce.pdf

295

2026-03-17