SAP-C02 Practice Test 25 — 15 Questions

Question 1

A startup wants to deploy a web application on AWS with a serverless architecture. The application includes static content (HTML, CSS, JS) and a REST API backend using Lambda and DynamoDB. The company wants low latency and high availability globally. Which combination of services should they use?

Accepted Answer

Amazon CloudFront for static content, Amazon API Gateway for the REST API, and AWS Lambda for compute.. Option A is correct because CloudFront serves static content with low latency, API Gateway provides a REST API endpoint, and Lambda integrates with DynamoDB. Option B is wrong because S3 Transfer Acceleration is for uploads, not global content delivery. Option C is wrong because ALB is not serverless. Option D is wrong because Lambda Edge runs at edge locations but is not needed for API backend.

Answer

Amazon CloudFront for static content, Application Load Balancer for API, and Lambda for compute.

Answer

AWS Lambda@Edge for both static content and API.

Answer

Amazon S3 for static content with Transfer Acceleration, and AWS Lambda for API.

Question 2

A company is designing a data lake on AWS using Amazon S3. The data lake will store petabytes of data from various sources. The company needs to query the data using Amazon Athena and Amazon Redshift Spectrum. The data is highly compressed and stored in Parquet format. Which storage class should be used to minimize costs while maintaining immediate query performance?

Accepted Answer

S3 Intelligent-Tiering. Option B is correct. S3 Intelligent-Tiering automatically moves data between frequent and infrequent access tiers based on usage, optimizing cost without compromising performance. Option A is wrong because S3 Standard is more expensive for infrequently accessed data. Option C is wrong because S3 Glacier has retrieval delays. Option D is wrong because S3 One Zone-IA has lower durability and availability.

Answer

S3 Standard

Answer

S3 Glacier Deep Archive

Answer

S3 One Zone-IA

Question 3

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

Accepted Answer

Use an SQS FIFO queue and enable content-based deduplication.. Option B is correct because SQS FIFO queues guarantee exactly-once processing. Option A is wrong because standard SQS queues do not guarantee exactly-once. Option C is wrong because Lambda destination is for success/failure, not exactly-once. Option D is wrong because DynamoDB Streams are not for SQS.

Answer

Use a standard SQS queue and set the Lambda function reserved concurrency to 1.

Answer

Use a standard SQS queue and configure Lambda destinations for the queue.

Answer

Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.

Question 4

A company is designing a new serverless application using AWS Lambda. The application must be invoked by an Amazon S3 bucket event. The company wants to ensure that the Lambda function has the necessary permissions to be invoked. Which THREE steps are required?

Accepted Answer

Add a resource-based policy to the Lambda function that grants S3 permission to invoke it.. Options A, B, and D are correct. A resource-based policy on the Lambda function allows S3 to invoke it. An S3 bucket notification configuration triggers the Lambda. IAM permissions on the S3 bucket are not required for invocation; the resource-based policy is. Option E is wrong because the event source mapping is not needed for S3.

Answer

Attach an IAM role to the S3 bucket that allows it to invoke Lambda functions.

Answer

Create an event source mapping in Lambda for the S3 bucket.

Question 5

A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?

Accepted Answer

IAM roles for EC2 instances.. Options A and B are correct. AWS Systems Manager Parameter Store securely stores configuration data, and IAM roles for EC2 provide secure access without hardcoding credentials. Option C is wrong because Secrets Manager is also a valid service but the question asks for two services. Option D is wrong because EC2 user data is not secure for credentials. Option E is wrong because S3 requires managing access keys.

Answer

AWS Secrets Manager.

Answer

Amazon S3 with bucket policies.

Answer

EC2 user data scripts.

Question 6

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. The application must scale based on the number of requests per container. The company wants to use a service that can automatically adjust the number of tasks based on a custom metric. Which solution should the company use?

Accepted Answer

Configure an ECS Service Auto Scaling policy with a target tracking scaling policy based on a custom CloudWatch metric.. Option A is correct because ECS Service Auto Scaling can use target tracking with a custom CloudWatch metric. Option B is wrong because DynamoDB auto scaling is for tables. Option C is wrong because Application Auto Scaling is the underlying service, but the question asks for the specific solution; ECS Service Auto Scaling is the direct feature. Option D is wrong because AWS Auto Scaling is a broader console feature, but the scaling policy is applied via ECS Service Auto Scaling.

Answer

Configure Amazon DynamoDB auto scaling to adjust the read capacity based on the request count.

Answer

Use Application Auto Scaling to register the ECS service and create a step scaling policy.

Answer

Use the AWS Auto Scaling console to create a scaling plan that includes the ECS service.

Question 7

A company is designing a new database solution for a global e-commerce application. The database must support high read and write throughput with single-digit millisecond latency. The company expects traffic spikes during peak hours. Which TWO AWS services should the company consider?

Accepted Answer

Amazon ElastiCache. Options A and C are correct. DynamoDB provides low-latency, high-throughput NoSQL database. ElastiCache provides in-memory caching for low latency. Option B is wrong because Aurora is relational and may not match DynamoDB's throughput for simple key-value access. Option D is wrong because DocumentDB is for document workloads. Option E is wrong because RDS is relational and less scalable.

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon Aurora

Answer

Amazon RDS for MySQL

Question 8

Refer to the exhibit. An IAM policy is attached to a user who needs to upload objects to an S3 bucket owned by another AWS account. The uploads are failing with access denied. What is the most likely cause?

Accepted Answer

The upload request does not include the required ACL header.. Option C is correct. The policy requires the x-amz-acl header to be set to 'bucket-owner-full-control', but the user's upload request likely does not include that header. Options A and B are wrong because the policy explicitly allows PutObject. Option D is wrong because the bucket policy is not shown.

Answer

The resource ARN is incorrect.

Answer

The bucket policy denies the request.

Answer

The user does not have s3:PutObject permission.

Question 9

A company is designing a new solution to ingest real-time clickstream data from a website. The data volume varies from 100 to 100,000 events per second. The solution must buffer the data for up to 5 minutes and then deliver it to Amazon S3 for analysis. The company wants to minimize operational overhead and cost. Which service should be used to buffer the data?

Accepted Answer

Amazon Kinesis Data Firehose. Option D is correct. Amazon Kinesis Data Firehose can buffer incoming data for up to 15 minutes and then deliver it to S3, with no server management. Option A is wrong because Kinesis Data Streams requires managing shards and consumers. Option B is wrong because SQS is not designed for large-scale streaming. Option C is wrong because Lambda has concurrency limits and is not a buffer.

Answer

Amazon Kinesis Data Streams

Answer

AWS Lambda

Answer

Amazon SQS

Question 10

A company is designing a new serverless data processing pipeline. The pipeline uses AWS Lambda to process records from an Amazon Kinesis Data Stream. The company wants to ensure that failed records are automatically retried and sent to a dead-letter queue after three failed attempts. Which configuration should the company use?

Accepted Answer

Configure an on-failure destination on the Kinesis event source mapping to send records to an SQS queue.. Option B is correct because Kinesis Data Streams as a Lambda event source supports on-failure destinations for DLQ. Option A is wrong because Lambda destinations are for async invocations, not streams. Option C is wrong because DLQ is not a property of Lambda function configuration. Option D is wrong because SQS standard queue does not support retry settings like Lambda.

Answer

Configure the Kinesis stream to send failed records to an SQS standard queue.

Answer

Configure the Lambda function's dead-letter queue property with an SQS queue.

Answer

Configure a Lambda destination on the function to send events to an SQS queue.

Question 11

A financial services company is designing a solution to process real-time stock trade data. The data is ingested via Amazon Kinesis Data Streams with a shard count of 10. Each shard receives 500 records per second, each record is 1 KB. The company needs to archive all raw data to Amazon S3 within 5 minutes of receipt and also run a Lambda function to enrich each record. What is the most cost-effective and scalable approach?

Accepted Answer

Configure Kinesis Data Firehose to read from the stream and deliver to S3, and use a Lambda function for enrichment.. Option B is correct because Kinesis Data Firehose can read from the stream and buffer to S3 within minutes, while Lambda can process records in parallel. Option A is wrong because Lambda cannot directly write to S3 efficiently at this scale. Option C is wrong because KCL adds complexity and cost. Option D is wrong because Kinesis Analytics is for analytics, not archiving.

Answer

Use Kinesis Data Analytics to archive data to S3.

Answer

Use the Kinesis Client Library (KCL) to process records and write to S3.

Answer

Use a Lambda function to read from the stream and write to S3.

Question 12

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

Accepted Answer

AWS CodeBuild. Option B is correct because AWS CodeBuild is a fully managed build service. Option A is wrong because CodeCommit is a source control service. Option C is wrong because CodeDeploy is a deployment service. Option D is wrong because CodePipeline is a continuous delivery service.

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 13

A company is designing a disaster recovery architecture for a critical application. The primary region runs on Amazon EC2 with an RDS database. The recovery time objective (RTO) is 15 minutes, and recovery point objective (RPO) is 1 minute. Which TWO steps should be taken to meet these objectives?

Accepted Answer

Configure RDS Multi-AZ in the primary region.. Options A and C are correct. A Multi-AZ RDS instance with synchronous replication provides an RPO of seconds and can failover quickly. An Aurora Global Database with a secondary region also provides low RPO and RTO. Option B is wrong because cross-region snapshot restore takes longer than 15 minutes. Option D is wrong because RTO would be too high. Option E is wrong because RTO includes database failover.

Answer

Pre-warm a standby EC2 instance in the DR region.

Answer

Take hourly snapshots of RDS and copy them to the DR region.

Answer

Use Amazon S3 Cross-Region Replication for application data.

Question 14

A company is designing a new application that will run on Amazon EC2 instances behind an Application Load Balancer. The company wants to ensure that traffic to the application is encrypted in transit. Which TWO actions should the company take?

Accepted Answer

Install an SSL/TLS certificate on the Application Load Balancer.. Options A and D are correct. The ALB handles SSL termination, and HTTPS listener ensures encryption. Option B is wrong because HTTP allows unencrypted traffic. Option C is wrong because CloudFront does not ensure encryption between ALB and EC2. Option E is wrong because an NLB does not support SSL termination natively.

Answer

Configure the Application Load Balancer with an HTTP listener that redirects to HTTPS.

Answer

Use a Network Load Balancer with TCP listener.

Answer

Place an Amazon CloudFront distribution in front of the ALB.

Question 15

A company is migrating a monolithic application to microservices on AWS. The current application uses a single Amazon RDS for PostgreSQL database. To avoid tight coupling, each microservice should have its own database. The company needs to minimize downtime during migration. Which THREE strategies should be used?

Accepted Answer

Design each microservice with its own database.. Options B, C, and D are correct. The Strangler Fig pattern gradually replaces functionality. Database per service ensures isolation. AWS DMS can migrate data with minimal downtime. Option A is wrong because a shared database defeats the purpose. Option E is wrong because a single large RDS instance is not a microservices pattern.

Answer

Use a single shared database with separate schemas for each service.

Answer

Deploy all microservices on a single large EC2 instance.