SAP-C02 Practice Test 4 — 25 Questions

Question 1

A company is designing a multi-region active-active application that uses Amazon DynamoDB global tables. The application must be able to handle write conflicts that may occur when the same item is updated in two different regions at the same time. The company needs to ensure that the application uses the most recently written data. What should the architect recommend?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the default last writer wins conflict resolution. Amazon DynamoDB global tables use a last writer wins (LWW) conflict resolution mechanism based on the timestamp of the update. When concurrent updates to the same item occur in different regions, DynamoDB automatically compares the update timestamps and retains the most recently written data. This satisfies the requirement to use the most recently written data without requiring custom reconciliation logic.

Answer

Use optimistic locking with a version number

Answer

Use DynamoDB Streams to capture changes and reconcile conflicts

Answer

Use conditional writes to prevent overwrites

Question 2

A company is running a stateful web application on EC2 instances in an Auto Scaling group. Users report that their sessions are lost when instances are terminated during scale-in. What should a solutions architect do to preserve session state?

Accepted Answer

Store session state in Amazon ElastiCache.. ElastiCache provides a centralized, fast session store that persists across instance terminations, ensuring session state is retained even when instances are scaled in. Option A is wrong because using lifecycle hooks to save session data to Amazon S3 is unreliable due to the high latency and the risk that the termination process may not complete the save in time. Option B is wrong because sticky sessions (session affinity) on the Application Load Balancer can cause uneven load distribution and still result in session loss if all instances in a target group are replaced or if the specific instance with the session is terminated. Option D is wrong because increasing the Auto Scaling group's cooldown period only delays the next scaling activity but does not preserve session state when instances are eventually terminated.

Answer

Use lifecycle hooks to save session data to Amazon S3 before instance termination.

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer.

Answer

Increase the Auto Scaling group's cooldown period to prevent rapid scaling.

Question 3

A company is migrating a monolithic application to AWS. The application consists of a web server, an application server, and a MySQL database. The web server and application server run on the same EC2 instance. The company wants to minimize changes during migration. Which migration strategy should the architect recommend?

Accepted Answer

Rehost using AWS Application Migration Service (AWS MGN). Rehosting using AWS Application Migration Service (AWS MGN) is the correct strategy because it minimizes changes by lifting and shifting the existing servers to EC2. The application remains monolithic, and the database can stay on the same instance or be moved as-is. This aligns with the requirement to minimize changes during migration.

Answer

Refactor the application into microservices on Amazon ECS

Answer

Replatform by migrating the database to Amazon RDS

Answer

Retire the application and replace it with a SaaS solution

Question 4

A solutions architect is reviewing the above IAM policy attached to an S3 bucket. A user from IP address 10.0.1.5 makes a request over HTTP (not HTTPS). Will the user be able to download an object?

Accepted Answer

No, because the request is not using HTTPS.. The IAM policy includes a condition that requires requests to use HTTPS (aws:SecureTransport = true). Since the user's request is over HTTP, the condition fails, and the Allow statement does not apply. Therefore, the request is denied by default, and the user cannot download the object.

Answer

No, because the IP address is not in the allowed range.

Answer

Yes, because the IP address is allowed.

Answer

Yes, because the Allow statement is evaluated first.

Question 5

A company is migrating a critical application to AWS. The application requires a relational database with high availability and automated failover. The company wants to use a fully managed database service. Which AWS service should the architect choose?

Accepted Answer

Amazon RDS Multi-AZ. Amazon RDS Multi-AZ provides a fully managed relational database with synchronous replication to a standby instance in a different Availability Zone and automatic failover, meeting the high availability and automated failover requirements. It is the correct choice for a relational workload needing managed HA.

Answer

Amazon ElastiCache

Answer

Amazon DynamoDB

Answer

Amazon RDS Single-AZ

Question 6

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

Accepted Answer

Elastic Fabric Adapter (EFA). Elastic Fabric Adapter (EFA) is a network interface that enables HPC and machine learning applications to achieve low-latency inter-node communication by bypassing the operating system kernel and providing OS-bypass capabilities via the Libfabric library. This is essential for tightly coupled HPC workloads like genomics research, where MPI (Message Passing Interface) jobs require microsecond-level latency and high throughput between compute nodes.

Answer

Enhanced Networking (ENA)

Answer

VPC Peering

Answer

AWS Direct Connect

Question 7

A company is migrating a legacy monolithic application to AWS. The application uses a proprietary binary protocol over TCP. The company wants to modernize the architecture using microservices while minimizing changes to the client. Which approach should the company use?

Accepted Answer

Use a Network Load Balancer with TCP listener and route traffic based on destination port to different target groups.. A Network Load Balancer (NLB) with a TCP listener can forward traffic based on destination port to different target groups, allowing the legacy client using a proprietary binary protocol over TCP to reach distinct microservices without any client-side changes. This preserves the existing TCP connection semantics and binary protocol, which an Application Load Balancer (HTTP/HTTPS only) or API Gateway (HTTP/REST) cannot handle.

Answer

Use AWS Global Accelerator with a TCP listener and endpoint groups for microservices.

Answer

Use an Application Load Balancer with path-based routing to direct traffic to separate microservices.

Answer

Use Amazon API Gateway with a custom authorizer to route requests to AWS Lambda functions.

Question 8

A company has an AWS Organization with multiple accounts. The central IT team wants to deploy a common set of AWS Config rules across all accounts in the production OU. Which approach is the MOST scalable and maintainable?

Accepted Answer

Use AWS Config conformance packs and deploy them using AWS CloudFormation StackSets.. AWS Config conformance packs provide a collection of AWS Config rules and remediation actions that can be deployed consistently across accounts and Regions. Using AWS CloudFormation StackSets to deploy conformance packs is the most scalable and maintainable approach because StackSets automates the deployment to multiple accounts in an AWS Organization, and conformance packs allow centralized management of rule sets, including parameterization and remediation, without requiring per-account manual effort.

Answer

Use an AWS Config aggregator to deploy rules across accounts.

Answer

Use AWS CloudFormation StackSets to deploy an AWS Config rule template to each account.

Answer

Use AWS Config to create a custom rule in each account manually.

Question 9

A company is designing a new application that will run on Amazon EC2 instances in an Auto Scaling group. The application must be able to distribute incoming traffic across multiple instances. Which TWO AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

Network Load Balancer. Option C (Network Load Balancer) is correct because it is an Elastic Load Balancing service that operates at Layer 4 (TCP/UDP/TLS) and distributes incoming traffic across targets such as EC2 instances in an Auto Scaling group, using listeners and target groups. Option D (Application Load Balancer) is correct because it is an Elastic Load Balancing service that operates at Layer 7 (HTTP/HTTPS) and also distributes incoming traffic across EC2 instances registered in target groups within an Auto Scaling group. Both load balancers integrate with Auto Scaling groups so that instances added or removed by scaling are automatically registered or deregistered as targets. Option A (Amazon CloudFront) is a content delivery network that caches and serves content from edge locations, not a load balancer for distributing traffic across EC2 instances. Option B (AWS Global Accelerator) improves global reachability and performance by routing traffic over the AWS global network to endpoints, but it is not the primary service for distributing traffic across multiple EC2 instances in an Auto Scaling group. Option E (Amazon Route 53) is a DNS service that can perform DNS-based routing, but it does not distribute incoming traffic across EC2 instances at the connection level like a load balancer.

Answer

Amazon CloudFront

Answer

AWS Global Accelerator

Answer

Amazon Route 53

Question 10

A company is designing a multi-account strategy for its development teams. Each team needs to have its own isolated environment with VPCs, subnets, and security groups. The company wants to centralize network administration and ensure that all VPCs use a common set of security rules. Which THREE steps should the company take? (Choose THREE.)

Accepted Answer

Deploy a centralized inspection VPC with AWS Network Firewall and use Transit Gateway to route traffic.. Option B is correct because a centralized inspection VPC with AWS Network Firewall, combined with AWS Transit Gateway for routing, provides centralized traffic inspection and a hub-and-spoke topology that enforces common security policy across all team VPCs. Option C is correct because a dedicated network account using AWS Resource Access Manager (RAM) to share subnets lets teams consume centrally managed VPC networking while keeping network administration centralized. Option E is correct because AWS Firewall Manager applies common security group rules (and other policies) across all accounts in AWS Organizations, ensuring uniform security rules. Option A is not correct because VPC Peering is a point-to-point connection that does not scale for centralized administration or common security enforcement across many accounts. Option D is not correct because CloudFormation StackSets deploys identical VPCs per account, which duplicates network administration rather than centralizing it and does not enforce common security rules.

Answer

Allow each team to create their own VPCs and use VPC Peering to connect them.

Answer

Use AWS CloudFormation StackSets to deploy identical VPCs to each account.

Question 11

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked with a batch size of 10. Some messages are failing repeatedly, causing the function to retry them up to the maximum retry count and then they are sent to a dead-letter queue (DLQ). The company wants to improve the resilience of the application by handling partial batch failures more efficiently. What should a solutions architect do?

Accepted Answer

Implement reportBatchItemFailures in the Lambda function and enable partial batch response for the SQS event source mapping.. Implementing reportBatchItemFailures in the Lambda function and enabling partial batch response for the SQS event source mapping allows the function to signal which specific messages within a batch failed. This prevents the entire batch from being retried or sent to the DLQ, and only the failed messages are retried individually, improving resilience and efficiency.

Answer

Move the messages to a DLQ immediately after the first failure.

Answer

Decrease the batch size to 1 so that each invocation processes a single message.

Answer

Increase the batch size to 100 to process more messages per invocation.

Question 12

A company is deploying a web application on AWS that requires a relational database. The application is read-heavy and expects sudden spikes in traffic. The database must be highly available and perform well under load. Which database configuration meets these requirements?

Accepted Answer

Deploy Amazon RDS in a Multi-AZ configuration and use read replicas to offload read traffic.. It combines Multi-AZ deployment for high availability with read replicas to offload read traffic, addressing both the read-heavy workload and sudden traffic spikes. Multi-AZ ensures automatic failover to a standby instance in a different Availability Zone if the primary fails, while read replicas distribute read queries across multiple copies, reducing load on the primary database and improving performance under spike conditions.

Answer

Use Amazon ElastiCache for Memcached as the primary database.

Answer

Deploy Amazon RDS in a Multi-AZ configuration without read replicas.

Answer

Deploy Amazon RDS in a single Availability Zone with a large instance size.

Question 13

A company wants to migrate a legacy Oracle database to AWS with minimal downtime. The database is 2 TB in size and runs on a single on-premises server. The company requires the ability to cut over quickly and roll back if needed. Which AWS service should be used?

Accepted Answer

AWS Database Migration Service (DMS) with ongoing replication from the source to an Amazon RDS for Oracle target.. AWS Database Migration Service (DMS) with ongoing replication enables continuous data replication from the on-premises Oracle database to Amazon RDS for Oracle, allowing minimal downtime during cutover. It also supports rollback by stopping replication and reverting to the source. Option A is incorrect because S3 Transfer Acceleration is for fast uploads to S3, not for database migration with replication. Option C is incorrect because AWS Schema Conversion Tool (SCT) handles schema conversion, not ongoing data replication. Option D is incorrect because AWS Snowball Edge is an offline data transfer device, which does not meet the minimal downtime requirement.

Answer

Use S3 Transfer Acceleration to upload the database dump directly to an EC2 instance.

Answer

AWS Schema Conversion Tool (SCT) to convert the schema and then export the data to flat files for import.

Answer

AWS Snowball Edge to copy the database files and then restore on Amazon RDS.

Question 14

A company is migrating a multi-tier web application to AWS. The application uses a commercial database that requires a license. The company wants to reduce licensing costs. Which migration strategy should be considered?

Accepted Answer

Replatform the database to Amazon RDS for an open-source engine like PostgreSQL. Replatforming to Amazon RDS for an open-source engine like PostgreSQL eliminates the commercial database license cost because PostgreSQL is open-source and RDS is a managed service. This aligns with the goal of reducing licensing costs while minimizing application changes. The company can still use a relational database with similar capabilities, avoiding the need for a full refactor or repurchase.

Answer

Rehost the database to EC2 with the same database software

Answer

Repurchase a Software as a Service (SaaS) alternative

Answer

Refactor the application to use Amazon DynamoDB

Question 15

A company is designing a new CI/CD pipeline for a web application that will be deployed on Amazon ECS. Which AWS service should the company use to build and test the application code?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. For a CI/CD pipeline that requires building and testing application code before deployment to Amazon ECS, CodeBuild is the correct service to perform these build and test actions.

Answer

AWS CodePipeline

Answer

AWS CodeDeploy

Answer

AWS CodeCommit

Question 16

A company runs a production database on Amazon RDS for PostgreSQL. The database experiences high write latency during peak hours. The company wants to improve write performance with minimal cost. Which action should a solutions architect take?

Accepted Answer

Increase the allocated storage and provisioned IOPS.. High write latency on RDS for PostgreSQL is typically caused by insufficient storage IOPS or throughput. Increasing allocated storage and provisioned IOPS (on gp3/io1/io2) directly addresses the storage bottleneck that limits write performance, and it is the lowest-cost targeted fix compared to architectural changes. Read replicas and Multi-AZ do not improve write throughput on the primary.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Add multiple read replicas in different Availability Zones.

Answer

Use RDS for PostgreSQL with multiple write replicas and configure application-level sharding.

Question 17

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. The error shown in the exhibit is a ResourceNotFoundException from DynamoDB, which indicates that the table specified in the function's request does not exist. This is the most likely cause when the SDK call fails with that specific exception, as opposed to permission or throttling errors.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 18

A company is migrating a legacy .NET Framework 4.8 application to AWS. The application uses Windows authentication integrated with Active Directory and relies on a shared file system for configuration files. The company wants to minimize operational overhead and use managed services. Which combination of AWS services should the company use to modernize the application?

Accepted Answer

AWS Managed Microsoft AD, Amazon FSx for Windows File Server, and AWS Elastic Beanstalk for .NET on Windows. AWS Managed Microsoft AD provides Windows authentication integrated with Active Directory, FSx for Windows File Server provides a managed shared file system that supports Windows-native SMB protocol and NTFS permissions, and AWS Elastic Beanstalk for .NET on Windows minimizes operational overhead for hosting a .NET Framework 4.8 application. Option A (EFS) does not natively support Windows authentication or SMB protocol, making it unsuitable. Option B (RDS for SQL Server) is unnecessary as the application does not require a database. Option C (App Runner) does not support .NET Framework applications, and S3 cannot function as a Windows shared file system.

Answer

AWS Managed Microsoft AD, Amazon EFS, and AWS Elastic Beanstalk for .NET on Windows

Answer

Amazon Cognito, Amazon RDS for SQL Server, and AWS Lambda

Answer

AWS Directory Service for Microsoft AD, Amazon S3, and AWS App Runner

Question 19

A company has a bucket policy on an S3 bucket as shown in the exhibit. A cross-account role (CrossAccountRole) is used to access the bucket. The role has an IAM policy that allows s3:GetObject and s3:PutObject on the bucket. When users assume the role and try to upload objects without specifying encryption, the upload fails. What must the users do to successfully upload objects?

Accepted Answer

Include the x-amz-server-side-encryption header with value aws:kms in the upload request.. The bucket policy includes a condition that requires the `x-amz-server-side-encryption` header to be set to `aws:kms` for `s3:PutObject` operations. When users assume the cross-account role and upload objects without specifying encryption, the request fails because it does not satisfy this condition. Including the `x-amz-server-side-encryption: aws:kms` header in the upload request explicitly meets the condition, allowing the upload to succeed.

Answer

Remove the condition from the bucket policy.

Answer

Add an IAM policy that allows s3:PutObject to the role.

Answer

Grant the role permission to use the KMS key.

Question 20

A company is designing a new microservices architecture on AWS. Each microservice must store its own data and communicate with other services via RESTful APIs. The company wants to minimize operational overhead. Which data store should the company use for each microservice?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a fully managed NoSQL key-value and document database that provides single-digit millisecond latency at any scale, making it ideal for microservices that need to store their own data and communicate via RESTful APIs. It requires no operational overhead for scaling, patching, or replication, and its pay-per-request billing aligns with the unpredictable traffic patterns common in microservices architectures.

Answer

Amazon ElastiCache for Redis

Answer

Amazon Redshift

Answer

Amazon RDS for PostgreSQL