SAP-C02 Practice Test 18 — 15 Questions

Question 1

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The application needs to store session state. Which AWS service provides a fully managed, highly scalable solution for session state management?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice because it provides a fully managed, in-memory data store that is ideal for session state management. Redis offers sub-millisecond latency, built-in replication, and automatic failover, making it highly scalable and durable for session data. The Application Load Balancer can be configured with stickiness (session affinity) to route requests to the same EC2 instance, but using ElastiCache for Redis decouples session state from the compute layer, enabling stateless application tiers and seamless scaling.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 2

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

Answer

Amazon MQ, AWS Lambda, Amazon RDS

Question 3

A company is designing a new solution that uses Amazon S3 to store large amounts of archival data. The data must be retained for 7 years and then automatically deleted. Which S3 feature should they use?

Accepted Answer

S3 Lifecycle policies. S3 Lifecycle policies allow you to define rules that automatically expire objects after a specified period, such as 7 years. This directly meets the requirement to retain archival data for a fixed duration and then delete it without manual intervention.

Answer

S3 Replication

Answer

S3 Versioning

Answer

S3 Object Lock

Question 4

A company is migrating a legacy on-premises application to AWS. The application requires a fixed IP address for whitelisting by external partners. The solution must be highly available across multiple Availability Zones. Which design should they use?

Accepted Answer

Use a Network Load Balancer (NLB) with an Elastic IP address.. Option C is correct because a Network Load Balancer (NLB) supports static IP addresses via Elastic IPs per Availability Zone, providing a fixed IP for partner whitelisting while maintaining high availability across multiple AZs. Unlike ALBs, NLBs operate at Layer 4 and can preserve the client IP, which is critical for IP-based whitelisting scenarios.

Answer

Use an Application Load Balancer (ALB) with an Elastic IP address.

Answer

Use Amazon Route 53 with a weighted routing policy.

Answer

Use a Classic Load Balancer (CLB) with an Elastic IP address.

Question 5

A company is migrating a legacy monolithic application to AWS. The application currently uses a shared filesystem for storing user-uploaded documents. The company wants to decouple storage and compute, ensure high durability, and minimize operational overhead. Which AWS service should the company use to replace the shared filesystem?

Accepted Answer

Amazon S3. Amazon S3 is the correct choice because it provides a highly durable (99.999999999% durability), scalable, and fully managed object storage service that decouples storage from compute. Unlike a shared filesystem, S3 allows multiple compute instances (e.g., EC2, Lambda) to access the same documents via HTTP/HTTPS APIs without needing a mounted filesystem, minimizing operational overhead. It also supports features like versioning, lifecycle policies, and cross-region replication, making it ideal for user-uploaded documents in a migration scenario.

Answer

Amazon EBS

Answer

Amazon EFS

Answer

Amazon FSx for Windows File Server

Question 6

A company is designing a multi-tier web application on AWS. They want to ensure that the web tier can scale automatically based on CPU utilization. Which AWS service should they use?

Accepted Answer

Auto Scaling groups. Option A is correct because Auto Scaling groups can automatically adjust capacity based on CloudWatch alarms. Option B is wrong because Elastic Load Balancing distributes traffic but does not scale. Option C is wrong because CloudFront is a CDN. Option D is wrong because Route 53 is DNS.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

Elastic Load Balancing

Question 7

An IAM policy attached to an S3 bucket is shown. What is the net effect on requests to read objects from the bucket?

Accepted Answer

Only requests using HTTPS from the IP range 192.0.2.0/24 are allowed.. Option D is correct because the Deny for non-SecureTransport overrides the Allow, so only HTTPS requests from the specified IP range are allowed. Option A is wrong because non-HTTPS requests are denied. Option B is wrong because requests from outside the IP range are denied. Option C is wrong because the Deny is explicit.

Answer

All HTTPS requests from any IP are allowed.

Answer

Only requests using HTTPS from any IP are allowed because the Deny is overridden.

Answer

All requests from the IP range 192.0.2.0/24 are allowed, regardless of protocol.

Question 8

A company wants to share a large dataset stored in Amazon S3 with a partner who has their own AWS account. The partner needs to access the data using their own account credentials. Which approach should the company use?

Accepted Answer

Grant the partner's AWS account access via a bucket policy.. Bucket policies can grant cross-account access to a partner's AWS account. The partner can then access the bucket using their own credentials.

Answer

Use S3 cross-region replication.

Answer

Create a pre-signed URL for the partner.

Answer

Provide the partner with an IAM user in the company's account.

Question 9

A company is migrating a legacy monolithic application to AWS. They want to refactor the application into microservices and use container orchestration. Which AWS service should they use to manage the containers?

Accepted Answer

Amazon EKS. Option B is correct because Amazon EKS is a managed Kubernetes service for container orchestration. Option A is wrong because ECS is also a container orchestration service but uses AWS proprietary, not Kubernetes. Option D is wrong because Fargate is a compute engine for containers, not an orchestration service. Option C is wrong because Lambda is serverless, not for containers.

Answer

AWS Lambda

Answer

Amazon ECS

Answer

AWS Fargate

Question 10

An administrator runs the above commands and observes the outputs. The instance is in a public subnet with an internet gateway. What is the most likely issue preventing users from accessing the web server?

Accepted Answer

The security group does not allow outbound traffic, so responses cannot be sent.. Option B is correct because the security group allows inbound HTTP (80) from 0.0.0.0/0, but the egress rules are empty, which means all outbound traffic is denied. The web server cannot send responses back. Option A is wrong because HTTP port 80 is open. Option C is wrong because SSH is not required for web access. Option D is wrong because the security group allows HTTP.

Answer

The security group allows SSH from a restricted IP, but not from the users.

Answer

The security group allows HTTP only from the IP range 203.0.113.0/24.

Answer

The security group does not allow inbound HTTP traffic.

Question 11

Which TWO strategies can be used to reduce the cost of Amazon DynamoDB tables for a new application with unpredictable traffic patterns? (Choose two.)

Accepted Answer

Use DynamoDB auto scaling with provisioned capacity.. DynamoDB on-demand mode is ideal for unpredictable traffic, and auto scaling adjusts capacity based on load. Both help reduce costs compared to provisioned capacity with manual over-provisioning.

Answer

Use DynamoDB Streams to reduce write capacity.

Answer

Use DynamoDB global tables for multi-region replication.

Answer

Use DynamoDB Accelerator (DAX) to reduce read capacity.

Question 12

A company runs a web application on EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application experiences sudden traffic spikes. What is the most effective way to ensure the application can handle the spikes without manual intervention?

Accepted Answer

Use a target tracking scaling policy based on average CPU utilization.. Option D is correct because a target tracking scaling policy based on CPU utilization automatically adjusts capacity in response to demand. Option A is wrong because scheduled scaling works for predictable patterns, not sudden spikes. Option B is wrong because a larger instance size may not handle spikes if only a few instances. Option C is wrong because manual scaling is not automated.

Answer

Increase the instance size to handle more load per instance.

Answer

Manually increase the desired capacity when traffic spikes.

Answer

Use scheduled scaling to add instances at expected peak times.

Question 13

A company needs to provide a global content delivery solution with low latency. Which AWS service should they use?

Accepted Answer

Amazon CloudFront. Option C is correct because Amazon CloudFront is a global CDN that delivers content with low latency. Option A is wrong because S3 is storage. Option B is wrong because EC2 is compute. Option D is wrong because Route 53 is DNS.

Answer

Amazon S3

Answer

Amazon EC2

Answer

Amazon Route 53

Question 14

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows services to register their endpoint locations and discover the endpoints of other services. It integrates with Route 53 for health checking and load balancing.

Answer

AWS Service Catalog

Answer

Amazon Route 53 private hosted zones

Answer

AWS Systems Manager Parameter Store

Question 15

Which THREE factors should be considered when designing a VPC for a new application that must be compliant with the Payment Card Industry Data Security Standard (PCI DSS)? (Choose three.)

Accepted Answer

Encrypt traffic between VPCs using VPN or AWS PrivateLink.. PCI DSS requires network segmentation, encryption in transit, and logging of network traffic. VPC endpoints allow private connectivity, but are not a PCI requirement per se.

Answer

Use VPC endpoints to keep traffic within the AWS network.

Answer

Use a single Availability Zone to reduce complexity.