SAP-C02 Practice Test 14 — 15 Questions

Question 1

A company wants to implement a least-privilege security model across multiple AWS accounts. Which TWO services can help enforce this?

Accepted Answer

AWS Organizations Service Control Policies (SCPs). AWS Organizations Service Control Policies (SCPs) are correct because they allow you to centrally control the maximum available permissions for all accounts in your organization, enabling a least-privilege model by restricting actions at the account level. SCPs act as a guardrail that applies to all IAM users, roles, and root users within an account, ensuring that even if a principal has broad IAM policies, the SCP can deny specific high-risk actions across the entire organization.

Answer

AWS Key Management Service (KMS)

Answer

AWS Config

Answer

AWS CloudTrail

Question 2

A solutions architect is troubleshooting an EC2 instance that is not sending metrics to CloudWatch. The instance is running and has internet connectivity. Based on the exhibit, what is the MOST likely reason?

Accepted Answer

The CloudWatch agent is not installed or running on the instance.. The exhibit shows an EC2 instance that is running and has internet connectivity, but metrics are not being sent to CloudWatch. For custom metrics (such as memory or disk utilization) to be published, the CloudWatch agent must be installed and running on the instance. Without the agent, the instance cannot collect and send operating-system-level metrics, even if network connectivity and IAM permissions are correctly configured.

Answer

The instance does not have an IAM role that allows sending metrics to CloudWatch.

Answer

The instance's security group is blocking outbound traffic to CloudWatch endpoints.

Answer

The instance is in the wrong AWS region for CloudWatch.

Question 3

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

Accepted Answer

Right-size the task definitions by adjusting CPU and memory reservations.. Right-sizing the task definitions by adjusting CPU and memory reservations ensures each service receives the appropriate resources, reducing wasted capacity and optimizing cluster utilization. This directly addresses the high cluster CPU utilization while individual services are underutilized. Option A (increasing tasks) would exacerbate the issue. Option B (Fargate Spot) does not solve the resource allocation problem. Option C (EC2 launch type) is not relevant to the utilization pattern described.

Answer

Increase the number of tasks for each service.

Answer

Use AWS Fargate Spot for interruptible workloads.

Answer

Switch from Fargate to EC2 launch type.

Question 4

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences occasional read replica lag of up to 5 seconds. The application requires read-after-write consistency. Which action should the company take to improve the solution?

Accepted Answer

Modify the application to always read from the primary instance.. Reading from the primary instance ensures read-after-write consistency. Since the application requires strong consistency, all reads must be directed to the primary, as read replicas may have lag. Option B is incorrect because increasing the number of read replicas does not reduce replication lag. Option C is incorrect because Amazon ElastiCache is a caching layer, not a solution for consistency. Option D is incorrect because Amazon RDS Proxy helps manage connections but does not eliminate read replica lag.

Answer

Increase the number of read replicas to distribute the load.

Answer

Implement Amazon ElastiCache to cache read results.

Answer

Use Amazon RDS Proxy to route read queries to the read replica.

Question 5

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

Accepted Answer

Modify the function to stream the file from S3 instead of downloading it entirely.. The correct answers are C and D. Option C (streaming the file from S3) reduces download time and eliminates the need to store the entire file in /tmp, directly improving performance by lowering I/O latency. Option D (increasing the Lambda timeout) provides more time for the function to complete processing, preventing timeouts. Option B (increasing memory) does not directly address the root cause of the timeout (slow file download), and its CPU benefit is secondary. Option A (reserved concurrency) affects scaling, not individual execution time. Option E (/tmp storage) is ephemeral and does not impact performance.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Increase the /tmp storage limit for the Lambda function.

Question 6

Which THREE components are required to set up a centralized logging solution for multiple AWS accounts using Amazon S3? (Choose THREE.)

Accepted Answer

A central S3 bucket in the logging account.. A central S3 bucket in a dedicated logging account is the foundational component for aggregating logs from multiple AWS accounts. This bucket serves as the single destination for all log data, enabling centralized storage, analysis, and retention without exposing logs to individual source accounts.

Answer

Amazon CloudWatch Logs subscription filter in each account.

Answer

AWS CloudTrail in the central account only.

Question 7

A company is migrating a batch processing workload to AWS. The workload runs on a schedule and processes large files stored on a network file system. The company wants to use a serverless architecture to reduce costs. Which combination of AWS services should the company use?

Accepted Answer

AWS Step Functions, AWS Lambda, and Amazon S3.. AWS Step Functions can orchestrate the workflow, AWS Lambda can process files in a serverless manner, and Amazon S3 can store the large files. Option A is wrong because Amazon EMR is not a serverless service and EFS is a network file system, not ideal for serverless batch processing. Option B is wrong because Amazon Kinesis Data Firehose is designed for streaming data, not batch processing of large files. Option D is wrong because Amazon EC2 and EBS are not serverless.

Answer

AWS Step Functions, Amazon EMR, and Amazon EFS.

Answer

Amazon CloudWatch Events, AWS Lambda, and Amazon Kinesis Data Firehose.

Answer

Amazon CloudWatch Events, Amazon EC2, and Amazon EBS.

Question 8

A migration engineer is setting up an AWS DMS task to migrate data from an on-premises Oracle database to Amazon RDS for PostgreSQL. The engineer attaches this IAM policy to the DMS service role. The DMS task fails with an error indicating insufficient privileges. What is the most likely cause?

Accepted Answer

The policy does not allow the dms:CreateEndpoint action. DMS needs permission to describe endpoints and test connections, which are not in the policy. The policy allows creating and starting tasks but not the prerequisite actions like creating endpoints. S3 access is correct if using S3 as a source/target, but the core issue is missing endpoint permissions.

Answer

The policy does not allow the s3:ListBucket action for the S3 bucket

Answer

The policy does not allow the dms:TestConnection action

Answer

The policy does not allow the rds:ModifyDBInstance action

Question 9

A company is migrating a monolithic application to AWS and wants to modernize it into microservices. The application currently uses a single relational database. Which migration strategy is most appropriate to minimize risk while starting the modernization process?

Accepted Answer

Incremental migration using the Strangler Fig pattern. The Strangler Fig pattern (Option A) is the most appropriate strategy because it allows incremental replacement of monolithic components with microservices, reducing the risk associated with a full rewrite or big bang migration. Option B (big bang migration to containers) is risky as it requires simultaneous migration of all components. Option C (replatform to Amazon RDS) only changes the database platform without addressing application architecture. Option D (rehost using VM Import/Export) simply lifts and shifts the monolith without modernization.

Answer

Big bang migration of the entire application to containers

Answer

Replatform to Amazon RDS for MySQL

Answer

Rehost the application using AWS VM Import/Export

Question 10

A company is moving its application from on-premises to AWS. They want to use the same third-party software licenses on AWS. Which AWS purchasing option allows them to bring their own licenses?

Accepted Answer

Dedicated Hosts. (Dedicated Hosts) is correct because it provides visibility and control over physical servers, allowing you to use your own licenses per socket/core. Option A (Savings Plans) is just a billing discount. Option C (Spot Instances) are interruptible. Option D (Reserved Instances) is also a billing discount and does not provide the license flexibility of Dedicated Hosts.

Answer

Savings Plans

Answer

Spot Instances

Answer

Reserved Instances

Question 11

An organization is planning to migrate a large number of on-premises virtual machines to AWS. The migration must be automated and support replication of live workloads with minimal downtime. Which AWS service is best suited for this task?

Accepted Answer

AWS Application Migration Service (MGN). (AWS Application Migration Service) is correct as it automates lift-and-shift migration with continuous replication and cutover. Option A (AWS DataSync) is for data transfer, not live VM replication. Option C (AWS Server Migration Service) is legacy and less capable. Option D (AWS Database Migration Service) is for databases, not general VM migration.

Answer

AWS DataSync

Answer

AWS Server Migration Service (SMS)

Answer

AWS Database Migration Service (DMS)

Question 12

A company is migrating an on-premises Oracle database to Amazon Aurora PostgreSQL. They need to minimize downtime and ensure data integrity. Which AWS service should they use for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS Database Migration Service (DMS) supports homogeneous and heterogeneous migrations with minimal downtime. Option A is wrong because SCT only helps with schema conversion, not the actual data migration. Option C is wrong because DataSync is for file storage, not databases. Option D is wrong because Snowball Edge is for large-scale offline data transfer, not online database migration.

Answer

AWS Schema Conversion Tool (SCT)

Answer

AWS DataSync

Answer

AWS Snowball Edge

Question 13

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

Accepted Answer

S3 Event Notifications. S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Question 14

A company is designing a new web application on AWS. The application must be highly available and scale automatically based on traffic. The architecture includes an Application Load Balancer (ALB) and an Auto Scaling group of EC2 instances. The application stores session state. What is the BEST way to handle session state to ensure high availability?

Accepted Answer

Store session state in Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the best choice for handling session state in a highly available, auto-scaling web application because it provides a centralized, in-memory data store that is external to the EC2 instances. This ensures that session data persists independently of instance lifecycle events (e.g., scaling in/out or failures), and Redis offers sub-millisecond latency, replication, and automatic failover, which are critical for maintaining session continuity across the fleet.

Answer

Store session state in Amazon DynamoDB

Answer

Store session state on the local instance store of each EC2 instance

Answer

Store session state in Amazon S3

Question 15

A company is planning to migrate a Microsoft SQL Server database to Amazon RDS for SQL Server. They want to automate the migration process and minimize manual effort. Which AWS service should they use?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS can migrate SQL Server to RDS with minimal downtime. Option A is wrong because CloudEndure Migration is for server migration. Option B is wrong because DataSync is for file data. Option D is wrong because Schema Conversion Tool is for schema conversion.

Answer

AWS CloudEndure Migration

Answer

AWS DataSync

Answer

AWS Schema Conversion Tool (SCT)