Amazon Web Services Updated SAP-C02 Exam Questions and Answers by deborah

CloudFormation cannot delete non-empty S3 buckets. OptionAallows you to create acustom Lambda resourcethat deletes all objects in the S3 bucket before the stack deletes it. The DependsOn ensures the bucket deletion occurs only after the Lambda has completed.

B: Adding DeletionPolicy: Delete does not resolve the issue if the bucket still contains objects.

C: Snapshot doesn ' t apply to S3 and won ' t help here.

D: Changing to Amazon EFS would require architectural changes, which are not allowed per requirements.

A and C are correct. Aurora PostgreSQL can store patient data in an encrypted database and can enforce TLS for encrypted connections in transit. For tamper-resistant auditing, Aurora Database Activity Streams are the stronger choice because they monitor database activity and send the stream to Amazon Kinesis for external consumption. AWS documentation states that activity streams monitor and report activities and that the activity stream is collected and transmitted to Kinesis. Sending those audit records to Amazon S3 and enabling S3 Object Lock in compliance mode provides immutable retention. Compliance mode prevents protected object versions from being overwritten or deleted by any user, including the root user, during the retention period. pgAudit logs in CloudWatch are useful, but they do not provide the same database activity stream control and immutability pattern.

Option B is correct because the Step Functions callback pattern with a task token is designed for long-running external approval or control-plane workflows. Step Functions can pause the state machine without consuming Lambda or container compute, preserve execution state, and resume only when the generated task token is returned through SendTaskSuccess or SendTaskFailure. The token acts as a unique correlation and authorization mechanism for the pending task, which is better than polling, holding a worker open, or periodically reinvoking the workflow. AWS documentation states that callback tasks pause execution until the task token is returned and explicitly identifies human approval and third-party integrations as valid use cases. This meets the requirements for asynchronous external approval, no long-lived credentials, and no unnecessary compute consumption.

The correct answer is B. This option uses IAM Identity Center to create permission sets that map to the existing IAM roles in each account. This way, the company can leverage the existing policies and roles that are already configured for the expected activities of each group of users in each account. The company also needs to create a customer managed policy that allows the group to assume the roles and attach it to thepermission set. This policy grants the necessary permissions for IAM Identity Center to assume the roles on behalf of the users. Finally, the company can assign user access to the AWS accounts in IAM Identity Center, which will automatically create IAM users and groups in each account based on the permission sets.

Option A is incorrect because it requires creating new policies in each account and giving them the same name. This is not necessary and adds complexity and overhead. The company can use the existing IAM roles and policies that are already configured for each account.

Option C is incorrect because it requires creating new policies in each account and giving them unique names. This is also not necessary and adds complexity and overhead. The company can use the existing IAM roles and policies that are already configured for each account.

Option D is incorrect because it requires adding the OU to the accounts configuration in IAM Identity Center. This is not supported by IAM Identity Center, which only allows adding individual accounts or all accounts in an organization.