SAP-C02 Practice Test 3 — 25 Questions

Question 1

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with a DB cluster.. Option A is correct because a Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Answer

Use automated backups with 5-minute retention.

Answer

Take manual snapshots every 5 minutes and copy to another region.

Answer

Create a cross-region read replica in us-west-2.

Question 2

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

Accepted Answer

Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.. Option B is correct because Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Answer

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Answer

Use Amazon CloudFront with origins in each region.

Answer

Use AWS Global Accelerator with Network Load Balancers in each region.

Question 3

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 4

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Answer

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Answer

Amazon DynamoDB Global Tables

Question 5

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. Option A is correct because a scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 6

A company is migrating a monolithic legacy application to a microservices architecture on AWS. The application currently uses a relational database with complex joins. The migration must minimize application changes. Which database strategy should be used for the new architecture?

Accepted Answer

Use a single Amazon RDS instance shared by all microservices.. Option B is correct because the requirement to minimize application changes means the microservices must continue to use the same relational database with complex joins. A single shared Amazon RDS instance preserves the existing SQL queries and join logic without requiring data decomposition or API-based data access patterns, which would necessitate significant application rewrites.

Answer

Use a separate Amazon RDS instance for each microservice.

Answer

Use Amazon Aurora with RDS Proxy in front of it.

Answer

Use Amazon DynamoDB as a shared database for all microservices.

Question 7

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

Accepted Answer

Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function. Option A is correct because using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Answer

Enable DynamoDB Accelerator (DAX) for the Lambda function

Answer

Provisioned Concurrency on the Lambda function

Answer

Increase the SQS queue visibility timeout and retention period

Question 8

A solutions architect is designing a new serverless application using AWS Lambda to process orders from an API Gateway endpoint and store them in DynamoDB. The architect creates the IAM role shown in the exhibit. When testing, the Lambda function fails to write to DynamoDB with an AccessDeniedException. What is the MOST likely cause?

Accepted Answer

The IAM role lacks a trust policy that allows Lambda to assume it.. The IAM role shown in the exhibit likely includes a permissions policy that grants DynamoDB write access, but it is missing a trust policy that allows the Lambda service (lambda.amazonaws.com) to assume the role. Without this trust relationship, Lambda cannot obtain temporary credentials to execute the function, resulting in an AccessDeniedException when attempting to write to DynamoDB.

Answer

The Lambda function does not have permission to create log groups.

Answer

The Lambda function is not in the same VPC as DynamoDB.

Answer

The DynamoDB table 'Orders' does not exist.

Question 9

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

Accepted Answer

Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.. Option B is correct because an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Answer

Enable default encryption on each bucket using SSE-S3.

Answer

Require that all buckets use AWS KMS managed keys for encryption.

Answer

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Question 10

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

Accepted Answer

Define an IAM task role with S3 access policies and reference it in the ECS task definition.. Option A is correct because an IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Answer

Attach an IAM role to the underlying EC2 instance.

Answer

Assign an IAM role to the ECS service using the ECS service-linked role.

Answer

Store AWS credentials in the container environment variables.

Question 11

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked with a batch size of 10. Some messages are failing repeatedly, causing the function to retry them up to the maximum retry count and then they are sent to a dead-letter queue (DLQ). The company wants to improve the resilience of the application by handling partial batch failures more efficiently. What should a solutions architect do?

Accepted Answer

Implement reportBatchItemFailures in the Lambda function and enable partial batch response for the SQS event source mapping.. Option B is correct because implementing reportBatchItemFailures in the Lambda function and enabling partial batch response for the SQS event source mapping allows the function to signal which specific messages within a batch failed. This prevents the entire batch from being retried or sent to the DLQ, and only the failed messages are retried individually, improving resilience and efficiency.

Answer

Move the messages to a DLQ immediately after the first failure.

Answer

Decrease the batch size to 1 so that each invocation processes a single message.

Answer

Increase the batch size to 100 to process more messages per invocation.

Question 12

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to automatically roll back a stack update if it fails, and receive a notification. What should be configured to meet these requirements?

Accepted Answer

Enable rollback on failure in the CloudFormation stack and configure an SNS notification topic.. Option C is correct because CloudFormation natively supports automatic rollback on stack update failure via the 'Rollback on failure' setting. By configuring an SNS notification topic on the stack, the operations team receives alerts when a rollback occurs, meeting both requirements without additional custom logic.

Answer

Use AWS CloudTrail to monitor the UpdateStack API call and trigger a rollback via a Lambda function.

Answer

Use AWS Config rules to detect stack failure and revert changes.

Answer

Create a custom resource in the CloudFormation template that performs rollback.

Question 13

A company is running a web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes that cause increased latency. The company wants to implement a solution to automatically adjust capacity in anticipation of traffic changes. What should a solutions architect do?

Accepted Answer

Configure a predictive scaling policy using historical traffic patterns.. Predictive scaling uses historical traffic patterns to forecast future demand and proactively adjust capacity before traffic spikes occur, which directly addresses the requirement to anticipate changes. This approach reduces latency by ensuring sufficient resources are available ahead of time, unlike reactive policies that only respond after utilization increases.

Answer

Configure a simple scaling policy based on CPU utilization.

Answer

Configure a scheduled scaling policy to add instances during known peak hours.

Answer

Configure a target tracking scaling policy based on average CPU utilization.

Question 14

A company is running a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences increased latency during peak hours. Upon investigation, the CPU utilization of the tasks reaches 90%. The ECS service is configured with a target tracking scaling policy based on average CPU at 70%. However, scaling is not keeping up with demand. What should a solutions architect do to improve the responsiveness of the scaling?

Accepted Answer

Add a step scaling policy that adds 4 tasks when CPU exceeds 80% for 1 minute.. Option C is correct because adding a step scaling policy provides a more aggressive and immediate scaling response when CPU exceeds 80% for 1 minute, which complements the existing target tracking policy. Target tracking scaling policies are reactive and may not scale quickly enough during rapid demand spikes, whereas step scaling can add a fixed number of tasks instantly when a breach occurs, reducing latency during peak hours.

Answer

Increase the task-level CPU limit to 2048 units.

Answer

Decrease the target tracking value to 50% average CPU.

Answer

Decrease the scale-in cooldown period to 60 seconds.

Question 15

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

Accepted Answer

Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.. Option B is correct because adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Answer

Increase the ALB idle timeout to 120 seconds.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Reduce the target tracking scaling threshold to 50% average CPU.

Question 16

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

Accepted Answer

Add an Amazon RDS Read Replica in the same AWS Region.. Option D is correct because adding an Amazon RDS Read Replica offloads read traffic from the primary MySQL database, allowing read queries to be served by the replica and reducing load on the source instance. This directly addresses the high number of read queries causing the bottleneck, as read replicas are designed for read-heavy workloads and can be promoted to a standalone instance if needed.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Implement DynamoDB Accelerator (DAX) in front of the database.

Answer

Scale up the RDS instance to a larger instance type.

Question 17

A company is running a stateful web application on EC2 instances in an Auto Scaling group behind an ALB. The application stores session data locally on the instance. The company notices that users are frequently logged out and lose session data during scaling events. What is the MOST operationally efficient way to preserve session state?

Accepted Answer

Migrate session data to ElastiCache for Redis and modify the application to use it.. Option A is correct because migrating session state to ElastiCache for Redis provides a centralized, external, and highly available session store that persists independently of EC2 instance lifecycles. This ensures that when instances are terminated or added during Auto Scaling events, session data remains intact and accessible from any instance, eliminating user logouts and data loss. It is operationally efficient as it requires minimal application code changes and leverages a fully managed, in-memory data store optimized for low-latency access.

Answer

Create a custom AMI that pre-populates session data from Amazon S3.

Answer

Increase the Auto Scaling group's cooldown period to 600 seconds.

Answer

Enable sticky sessions (session affinity) on the ALB.

Question 18

A company has a legacy application that runs on a single EC2 instance. The application writes logs to a local file. The company wants to centralize log management without modifying the application code. Which solution is MOST operationally efficient?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the EC2 instance.. The Amazon CloudWatch agent can be installed on the EC2 instance without modifying application code. It reads the local log file and sends the logs to Amazon CloudWatch Logs for centralized management, making it the most operationally efficient solution.

Answer

Use AWS CloudTrail to capture log file changes.

Answer

Modify the application to write logs to stdout and use the awslogs driver.

Answer

Set up an Amazon S3 bucket and use an AWS Lambda function to periodically copy log files.

Question 19

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

Accepted Answer

{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}. Option A is correct because the CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Answer

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Question 20

An e-commerce company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL DB cluster with one writer and two reader instances. During a sales event, the database CPU utilization is high, and read replicas show high replica lag. The company needs to improve the read scalability and reduce replica lag. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Add more reader instances to the cluster to distribute the read traffic.. Adding more reader instances (Option A) distributes the read workload across additional nodes, reducing the load on each reader and helping to lower replica lag. Aurora Auto Scaling (Option E) automatically adjusts the number of reader instances based on metrics like CPU utilization or replica lag, providing dynamic scaling during traffic spikes. Increasing the instance size of reader instances (Option D) provides more CPU and memory resources to each reader, enabling them to process more read queries and apply changes from the writer faster, which directly reduces replica lag.

Answer

Enable Multi-AZ for the cluster to improve read availability.

Answer

Increase the instance size of the writer instance to improve write throughput.