SAP-C02 Practice Exam 4 — 20 Questions

Question 1

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Accepted Answer

Amazon CloudFront and AWS Shield. Amazon CloudFront provides a global content delivery network (CDN) with low latency by caching content at edge locations worldwide. AWS Shield, specifically Shield Advanced, offers managed DDoS protection against large-scale attacks, including layer 3/4 and layer 7 threats. Together, they meet the requirement for both low-latency content delivery and DDoS mitigation.

Answer

AWS Global Accelerator and Amazon CloudFront

Answer

Amazon Route 53 and AWS Shield

Answer

AWS WAF and Amazon CloudFront

Question 2

A company has a centralized logging solution using Amazon S3 and AWS CloudTrail. They want to ensure that logs are immutable and cannot be deleted or modified by any user, including the root user. Which S3 feature should be enabled?

Accepted Answer

S3 Object Lock in compliance mode.. S3 Object Lock in compliance mode ensures that objects are write-once-read-many (WORM) and cannot be deleted or overwritten by any user, including the root user. Compliance mode locks the retention period and prevents any user, even the AWS account root user, from shortening or removing the retention settings, making logs truly immutable.

Answer

S3 Versioning with a lifecycle policy.

Answer

S3 bucket policy denying s3:DeleteObject.

Answer

S3 MFA Delete.

Question 3

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Option A is correct because running the validation script manually on a healthy instance isolates whether the script itself is broken or whether the failure is environmental (permissions, dependencies, or runtime context), which is the fastest way to reproduce and diagnose the error. Option C is correct because the CodeDeploy agent logs on a failing instance (typically /var/log/aws/codedeploy-agent/codedeploy-agent.log) contain the exact stderr/stdout and exit code from the failing lifecycle hook, pinpointing the specific validation error. Option D is correct because CodeDeploy only executes scripts mapped to lifecycle event hooks defined in the AppSpec file's hooks section (for EC2/on-premises, e.g., BeforeInstall, AfterInstall, ApplicationStart, ValidateService); if ValidateService is missing or misspelled, the validation script never runs as intended and the deployment fails validation. Option B is not appropriate because increasing the deployment timeout only masks a script that is failing outright rather than slow, and the logs already show the validation scripts are failing, not timing out. Option E is not appropriate because Auto Scaling lifecycle hooks govern instance launch/termination and do not address CodeDeploy application validation script failures during the deploy stage.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 4

A company is designing a new application that requires a global content delivery network with low latency and DDoS protection. Which combination of AWS services should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Fargate. AWS Fargate is the correct compute option because it is a serverless compute engine for containers that eliminates the need to provision, configure, or manage the underlying EC2 instances. By using Fargate with Amazon EKS, the development team can deploy containers without worrying about node scaling, patching, or cluster capacity, thereby minimizing operational overhead.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 5

A company uses AWS Organizations with consolidated billing. The finance team needs to track costs by department, which are tagged with 'department' tags. However, some resources are not tagged. The team wants to ensure that all new resources are tagged, and existing untagged resources are identified. What should they do?

Accepted Answer

Use a service control policy (SCP) to deny resource creation without the 'department' tag, and use AWS Config rules to detect untagged resources.. It combines two complementary AWS services to solve both requirements. A service control policy (SCP) can deny the creation of any resource that does not include the required 'department' tag, enforcing tagging at the organization level across all accounts. AWS Config rules can then be used to detect existing untagged resources by evaluating resources against a desired tagging configuration, providing visibility into non-compliant resources without automatically modifying them.

Answer

Use AWS Config rules to enforce tagging on existing resources and automatically tag them.

Answer

Use AWS Cost Explorer to report on untagged resources.

Answer

Create an IAM policy that requires tagging for all actions and attach it to all users.

Question 6

A multinational corporation uses AWS Organizations to manage multiple accounts across different geographic regions. The company needs to ensure that all data residing in AWS accounts for a specific country remains within that country's boundaries. Which combination of AWS services and features should the company use to enforce this data residency requirement?

Accepted Answer

Use service control policies (SCPs) to deny actions in non-approved regions and AWS Config rules to audit compliance.. Service control policies (SCPs) in AWS Organizations allow you to centrally control the maximum available permissions for all accounts in the organization. By creating an SCP that explicitly denies all actions in non-approved regions, you can enforce that no resources can be created or modified outside the allowed region. AWS Config rules then provide ongoing compliance auditing by detecting and reporting any resources that violate the data residency policy, ensuring continuous enforcement and visibility.

Answer

Use AWS PrivateLink and VPC endpoints to keep traffic within the country's region.

Answer

Use resource-based policies on all AWS resources to deny access from other regions.

Answer

Use AWS WAF and AWS Shield to protect data and enforce geographic restrictions.

Question 7

A media company is designing a new video transcoding pipeline. Source files are uploaded to an Amazon S3 bucket, and the company wants each upload to trigger processing without managing servers. Jobs can take up to 20 minutes, and the company must be able to retry a failed job without reprocessing successful ones. The operations team wants visibility into which specific uploads failed and the ability to replay only those. The company also wants to decouple the upload event from the worker so that bursts of thousands of simultaneous uploads do not overwhelm the processing tier. Which design should the solutions architect recommend?

Accepted Answer

Configure S3 Event Notifications to send each upload to an Amazon SQS queue, and run workers on Amazon ECS that poll the queue and delete messages only after successful transcoding. The design must buffer unpredictable bursts, support jobs longer than a Lambda invocation, and allow selective replay of only failed uploads. An SQS queue between S3 event notifications and a long-running ECS worker tier satisfies all three: the queue absorbs spikes, workers process at their own pace, and messages are deleted only on success so failures remain individually replayable. This also keeps the pipeline serverless at the ingestion edge without imposing a compute timeout.

Answer

Configure S3 Event Notifications to publish to an Amazon SNS topic that fans out to an AWS Step Functions state machine per upload

Answer

Enable S3 Transfer Acceleration and use S3 Batch Operations to transcode all objects nightly regardless of which uploads succeeded

Answer

Configure S3 Event Notifications to invoke an AWS Lambda function directly for each upload, with a 15-minute timeout and built-in retries

Question 8

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. Option A is correct because EC2 Spot Instances can cut compute costs by up to 90% versus On-Demand, and since the workload is a fault-tolerant batch job that can be retried, Spot interruptions are acceptable, directly supporting the goal of minimizing cost. Option C is correct because AWS Batch is purpose-built for batch computing: it manages a job queue and a compute environment (which can be backed by Spot Instances), dynamically provisioning resources so there is no idle compute capacity. Option D is correct because Amazon S3 Event Notifications can publish an event (e.g., to Amazon EventBridge, SQS, or Lambda) when a new file lands in the bucket, automatically submitting the batch job and eliminating polling or manual triggering. Option B is not appropriate because Lambda has a maximum execution timeout of 15 minutes, far short of the 2-hour CPU-intensive processing time per file. Option E is not appropriate because an Auto Scaling group with scheduled scaling provisions capacity on a time schedule rather than reacting to file arrivals, which risks idle compute and does not provide the job queue and job management that AWS Batch offers.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 9

A company is migrating a legacy on-premises application to AWS. The application requires a shared file system that can be mounted by multiple EC2 instances concurrently, with strong consistency and low-latency access. Which AWS storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple EC2 instances across multiple Availability Zones. It offers strong read-after-write consistency and low-latency access, making it ideal for shared file workloads requiring POSIX permissions and concurrent access.

Answer

AWS Storage Gateway File Gateway

Answer

Amazon EBS with multi-attach enabled

Answer

Amazon S3

Question 10

Drag and drop the steps to configure an Application Load Balancer with HTTPS listeners in the correct order.

Accepted Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create a target group, 3. Create an ALB with an HTTPS listener, 4. Register targets with the target group, 5. Update DNS to point to the ALB.. First get the certificate, then create the target group, then the ALB with HTTPS, register targets, and update DNS.

Answer

1. Create an ALB with an HTTPS listener, 2. Create a target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Register targets with the target group, 5. Update DNS to point to the ALB.

Answer

1. Obtain an SSL/TLS certificate from ACM, 2. Create an ALB with an HTTPS listener, 3. Create a target group, 4. Update DNS to point to the ALB, 5. Register targets with the target group.

Answer

1. Create a target group, 2. Register targets with the target group, 3. Obtain an SSL/TLS certificate from ACM, 4. Create an ALB with an HTTPS listener, 5. Update DNS to point to the ALB.

Question 11

A company is designing a new data lake on AWS. The data lake will store petabytes of data from various sources, including IoT devices, application logs, and streaming data. The data must be stored cost-effectively, and access patterns vary from frequently accessed recent data to rarely accessed historical data. The company also needs to run SQL queries on the data. Which solution should the architect recommend?

Accepted Answer

Store data in S3 with lifecycle policies to transition between storage classes, and use Amazon Athena for queries. Amazon S3 lifecycle policies allow automatic transition of objects between storage classes (e.g., S3 Standard to S3 Standard-IA to S3 Glacier Deep Archive) based on age, optimizing cost for varying access patterns. Amazon Athena enables serverless SQL querying directly on data stored in S3, making it ideal for a petabyte-scale data lake without managing infrastructure.

Answer

Store data in S3 with lifecycle policies to transition to Glacier, and use S3 Select for queries

Answer

Store data in Amazon EMR on EC2 and query with Hive

Answer

Store data in Amazon Redshift and query with Redshift Spectrum

Question 12

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

Accepted Answer

Use a cell-based architecture where each microservice runs in isolated cells with independent data stores.. A cell-based architecture isolates each microservice (or group) into independent cells with their own data stores, so a failure in one cell cannot cascade to others — this directly reduces blast radius. Independent data stores prevent a shared database from becoming a single point of failure and coupling failure domains. This pattern is the AWS-recommended approach for fault isolation in microservices.

Answer

Implement Auto Scaling groups for each microservice without separating data stores.

Answer

Route all traffic through a single Application Load Balancer to simplify management.

Answer

Deploy all microservices in a single Availability Zone with a shared database.

Question 13

A company wants to migrate a legacy monolithic application to AWS with minimal changes. The application currently runs on a single on-premises server with a Microsoft SQL Server database. The company wants to use AWS managed services to reduce operational overhead. Which combination of services should the company use to meet these requirements?

Accepted Answer

AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server. AWS Application Migration Service (MGN) enables lift-and-shift migration of the on-premises server to Amazon EC2 with minimal changes, while AWS DMS can migrate the Microsoft SQL Server database to Amazon RDS for SQL Server, a fully managed service that reduces operational overhead. This combination meets the requirement of minimal application changes and leverages AWS managed services for the database.

Answer

AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon DynamoDB

Answer

AWS Server Migration Service (SMS) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server

Answer

AWS CloudFormation to provision EC2 instances, and AWS DMS to Amazon RDS for SQL Server

Question 14

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Question 15

Which THREE design patterns can help a microservices application achieve loose coupling and independent deployability? (Choose three.)

Accepted Answer

Circuit breaker pattern to handle service failures. The circuit breaker pattern (B) prevents cascading failures by monitoring for failures and opening the circuit to stop calls to an unhealthy service, allowing it time to recover. This supports loose coupling because the caller does not need to know the internal state of the downstream service, and it enables independent deployability by isolating failures during deployment or scaling events.

Answer

Shared database schema across services

Answer

Synchronous RESTful HTTP calls between services

Question 16

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Accepted Answer

Use the default last writer wins conflict resolution. Amazon DynamoDB global tables use a last writer wins (LWW) conflict resolution mechanism based on the timestamp of the update. When concurrent updates to the same item occur in different regions, DynamoDB automatically compares the update timestamps and retains the most recently written data. This satisfies the requirement to use the most recently written data without requiring custom reconciliation logic.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 17

A company is running a stateful web application on EC2 instances in an Auto Scaling group. Users report that their sessions are lost when instances are terminated during scale-in. What should a solutions architect do to preserve session state?

Accepted Answer

Store session state in Amazon ElastiCache.. ElastiCache provides a centralized, fast session store that persists across instance terminations, ensuring session state is retained even when instances are scaled in. Option A is wrong because using lifecycle hooks to save session data to Amazon S3 is unreliable due to the high latency and the risk that the termination process may not complete the save in time. Option B is wrong because sticky sessions (session affinity) on the Application Load Balancer can cause uneven load distribution and still result in session loss if all instances in a target group are replaced or if the specific instance with the session is terminated. Option D is wrong because increasing the Auto Scaling group's cooldown period only delays the next scaling activity but does not preserve session state when instances are eventually terminated.

Answer

Use lifecycle hooks to save session data to Amazon S3 before instance termination.

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer.

Answer

Increase the Auto Scaling group's cooldown period to prevent rapid scaling.

Question 18

A company is migrating a monolithic application to AWS. The application consists of a web server, an application server, and a MySQL database. The web server and application server run on the same EC2 instance. The company wants to minimize changes during migration. Which migration strategy should the architect recommend?

Accepted Answer

Rehost using AWS Application Migration Service (AWS MGN). Rehosting using AWS Application Migration Service (AWS MGN) is the correct strategy because it minimizes changes by lifting and shifting the existing servers to EC2. The application remains monolithic, and the database can stay on the same instance or be moved as-is. This aligns with the requirement to minimize changes during migration.

Answer

Refactor the application into microservices on Amazon ECS

Answer

Replatform by migrating the database to Amazon RDS

Answer

Retire the application and replace it with a SaaS solution

Question 19

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The IAM policy includes a condition that requires requests to use HTTPS (aws:SecureTransport = true). Since the user's request is over HTTP, the condition fails, and the Allow statement does not apply. Therefore, the request is denied by default, and the user cannot download the object.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 20

A company is migrating a critical application to AWS. The application requires a relational database with high availability and automated failover. The company wants to use a fully managed database service. Which AWS service should the architect choose?

Accepted Answer

Amazon RDS Multi-AZ. Amazon RDS Multi-AZ provides a fully managed relational database with synchronous replication to a standby instance in a different Availability Zone and automatic failover, meeting the high availability and automated failover requirements. It is the correct choice for a relational workload needing managed HA.

Answer

Amazon ElastiCache

Answer

Amazon DynamoDB

Answer

Amazon RDS Single-AZ