SAP-C02 Practice Test 4 — 25 Questions

Question 1

A company is migrating a large-scale, stateful application to AWS. The application maintains session state in memory on the current on-premises servers. The company needs a solution that preserves session state during migration and minimizes latency for users worldwide. Which strategy should the company use?

Accepted Answer

Use AWS Global Accelerator to gradually shift traffic, and use Amazon ElastiCache for Redis to centralize session state. Option A is correct because AWS Global Accelerator allows you to gradually shift traffic from on-premises to AWS using endpoint weights, minimizing disruption during migration. Amazon ElastiCache for Redis provides a centralized, in-memory session store that preserves session state across the migration, ensuring low-latency access for users worldwide by leveraging Global Accelerator's anycast IP and AWS edge locations.

Answer

Use Amazon Route 53 weighted routing to shift traffic to new EC2 instances, and store session state in Amazon S3

Answer

Use AWS CloudFront to cache static content, and use Amazon DynamoDB for session state

Answer

Use AWS Global Accelerator to shift traffic, and deploy AWS WAF to protect the application

Question 2

A company is migrating a 10 TB Oracle database to Amazon Aurora PostgreSQL. The database is business-critical and must have minimal downtime. The company has set up AWS DMS with ongoing replication from the source. During the migration, the company notices that DMS is failing with an error indicating insufficient memory. What should the company do to resolve this issue and complete the migration?

Accepted Answer

Increase the instance class of the DMS replication instance. AWS DMS replication instances have finite memory allocated to cache changes during ongoing replication (CDC). When the volume of cached changes exceeds the instance's memory, DMS fails with an insufficient memory error. Increasing the instance class of the DMS replication instance (Option B) provides more memory to handle the cache, resolving the error without disrupting the migration.

Answer

Increase the memory on the source Oracle database

Answer

Change the DMS task to use change data capture (CDC) only and skip the full load

Answer

Split the migration into multiple smaller tasks

Question 3

A company wants to migrate a legacy monolithic application to AWS with minimal changes. The application currently runs on a single on-premises server with a Microsoft SQL Server database. The company wants to use AWS managed services to reduce operational overhead. Which combination of services should the company use to meet these requirements?

Accepted Answer

AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server. Option B is correct because AWS Application Migration Service (MGN) enables lift-and-shift migration of the on-premises server to Amazon EC2 with minimal changes, while AWS DMS can migrate the Microsoft SQL Server database to Amazon RDS for SQL Server, a fully managed service that reduces operational overhead. This combination meets the requirement of minimal application changes and leverages AWS managed services for the database.

Answer

AWS Application Migration Service (MGN) to Amazon EC2, and AWS DMS to Amazon DynamoDB

Answer

AWS Server Migration Service (SMS) to Amazon EC2, and AWS DMS to Amazon RDS for SQL Server

Answer

AWS CloudFormation to provision EC2 instances, and AWS DMS to Amazon RDS for SQL Server

Question 4

A company is migrating a legacy application that uses SOAP web services to AWS. The application currently runs on a single on-premises server. The company wants to minimize changes and reduce operational overhead. Which approach should the company take?

Accepted Answer

Rehost the application on Amazon EC2 using AWS Application Migration Service (MGN).. Option C is correct because rehosting the application on Amazon EC2 using AWS Application Migration Service (MGN) minimizes changes by lifting and shifting the entire on-premises server, including the SOAP web services, to AWS with minimal modification. This approach reduces operational overhead by automating server replication and cutover, avoiding the need to refactor or containerize the application, which aligns with the requirement to minimize changes.

Answer

Refactor the SOAP web services to RESTful APIs and deploy on Amazon API Gateway and AWS Lambda.

Answer

Containerize the application and deploy it on Amazon ECS using Fargate.

Answer

Use AWS Database Migration Service (DMS) to migrate the database and redeploy the application manually.

Question 5

A company plans to modernize an existing .NET Framework 4.7 application running on Windows Server 2012 R2. The company wants to move to a containerized architecture on AWS with minimal code changes. Which service should the company use to meet these requirements?

Accepted Answer

AWS App2Container (A2C). AWS App2Container (A2C) is specifically designed to containerize existing .NET Framework applications running on Windows Server with minimal code changes. It analyzes the application, generates Docker images, and produces CloudFormation templates for deployment on Amazon ECS or EKS, directly meeting the requirement to modernize a .NET Framework 4.7 application to a containerized architecture without significant refactoring.

Answer

AWS Serverless Application Model (SAM)

Answer

AWS Copilot

Answer

AWS Migration Hub

Question 6

A company is planning to migrate a legacy application to AWS. The application runs on a single server with a monolithic architecture and uses an Oracle database. The migration team wants to reduce licensing costs and improve scalability. Which TWO strategies should the team consider?

Accepted Answer

Replatform the application to use AWS Elastic Beanstalk and Amazon RDS for PostgreSQL.. Option A is correct because replatforming the application to AWS Elastic Beanstalk reduces operational overhead by automating capacity provisioning, load balancing, and scaling, while migrating from Oracle to Amazon RDS for PostgreSQL eliminates Oracle licensing costs and provides a managed database service with built-in high availability and scalability. This approach directly addresses the company's goals of reducing licensing costs and improving scalability without requiring a full application rewrite.

Answer

Refactor the application into microservices and use Amazon DynamoDB for data storage.

Answer

Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with license-included.

Answer

Rehost the application on Amazon EC2 and use Amazon RDS for Oracle with BYOL.

Question 7

A company has an Amazon S3 bucket that stores sensitive data. The company wants to ensure that all data in the bucket is encrypted at rest. Which action should the Solutions Architect take?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3, SSE-KMS, or SSE-C.. Option A is correct because enabling default encryption on the S3 bucket ensures all objects are automatically encrypted at rest using SSE-S3, SSE-KMS, or SSE-C. Option B is wrong because AWS CloudHSM is a hardware-based key management service, but it is not required for encrypting data at rest in S3; default encryption or bucket policies can enforce encryption without CloudHSM. Option C is wrong because a bucket policy can deny uploads of unencrypted objects, but it does not encrypt existing data; it only enforces encryption for new uploads. Option D is wrong because pre-signed URLs grant temporary access to upload objects but do not enforce encryption; encryption must be enforced separately.

Answer

Use AWS CloudHSM to manage encryption keys.

Answer

Configure a bucket policy that denies unencrypted uploads.

Answer

Require the use of pre-signed URLs for uploads.

Question 8

A company is using AWS Migration Hub to track a large-scale migration to AWS. The company wants to automate the replatforming of multiple Windows web servers to Amazon EC2 instances running Amazon Linux 2. The migration must be repeatable and minimize manual intervention. Which AWS service should the company use to achieve this?

Accepted Answer

AWS Application Migration Service (MGN). AWS Application Migration Service (MGN) is the correct choice because it automates the replatforming of Windows web servers to Amazon Linux 2 by continuously replicating source servers, performing automated conversion of the OS and applications, and enabling cutover to target EC2 instances with minimal manual intervention. It supports heterogeneous OS migrations (e.g., Windows to Linux) and provides a repeatable, automated workflow that aligns with the company's requirement for a large-scale, repeatable migration.

Answer

AWS OpsWorks for Chef Automate

Answer

AWS Server Migration Service (SMS)

Answer

AWS CloudFormation templates to provision new EC2 instances and migrate data manually

Question 9

A company is migrating a legacy .NET Framework 4.7 web application to AWS. The application currently runs on Windows Server 2012 R2 with IIS and uses SQL Server Express for local storage. The company wants to minimize re-architecture and reduce operational overhead. Which migration strategy should the company use?

Accepted Answer

Rehost the application on Amazon EC2 Windows instances using an AWS Migration Acceleration Program (MAP) partner tool.. Option D is correct because rehosting (lift-and-shift) the .NET Framework 4.7 application to Amazon EC2 Windows instances minimizes re-architecture and reduces operational overhead. The application is tightly coupled to Windows Server and IIS, and SQL Server Express is a local database; rehosting preserves the existing architecture without code changes. Using an AWS MAP partner tool streamlines the migration process, aligning with the goal of minimizing changes.

Answer

Retire the application and replace it with a SaaS-based solution.

Answer

Refactor the application to use .NET Core and deploy on Linux containers with Amazon ECS.

Answer

Replatform the application to use AWS Elastic Beanstalk with a SQL Server Express Multi-AZ RDS instance.

Question 10

A company has attached the above bucket policy to an S3 bucket. The bucket is accessed by an application running on an EC2 instance in the same AWS account. The EC2 instance is in a private subnet and uses an S3 Gateway Endpoint (vpce-12345678) to access the bucket. The application is failing to get objects from the bucket. What is the most likely cause?

Accepted Answer

The application is using HTTP instead of HTTPS. Option C is correct because the bucket policy likely includes a condition that denies requests not using HTTPS (i.e., `aws:SecureTransport`: false). The application is failing because it is using HTTP instead of HTTPS to access the S3 bucket, which violates the encryption-in-transit requirement enforced by the policy. Without HTTPS, the request is denied by the S3 service.

Answer

The application is not using the VPC endpoint

Answer

The bucket policy does not allow encryption in transit

Answer

The application is missing the required x-amz-server-side-encryption header

Question 11

A company is migrating a 5 TB Microsoft SQL Server database to Amazon RDS for SQL Server. The migration must have minimal downtime. The team uses AWS DMS with ongoing replication. During the full load, the task fails with an error indicating that the source server's transaction log is full. What should the team do to resolve this issue?

Accepted Answer

Increase the source server's transaction log size and set the log retention to a higher value.. Option B is correct because the error indicates the source transaction log is full during the full load phase of AWS DMS. Increasing the transaction log size and setting a higher log retention value prevents the log from filling up while DMS reads it for ongoing replication. This allows the full load to complete without interruption, addressing the root cause directly.

Answer

Stop the DMS task, take a native backup of the source, restore it to RDS, and then start DMS with ongoing replication.

Answer

Pause the DMS task, create a larger source instance, and restart the task.

Answer

Switch the DMS task to use batch-optimized apply mode.

Question 12

A company is migrating a monolithic Java application to AWS. The current architecture uses a single Oracle database. The migration plan is to refactor the application into microservices and use separate Amazon RDS for PostgreSQL databases per service. The company also wants to implement a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. Which tool should the company use to automate the database schema changes for each microservice?

Accepted Answer

Flyway, integrated into the CI/CD pipeline to run database migrations as part of the application deployment.. Flyway is a database migration tool that integrates directly into CI/CD pipelines, allowing schema changes to be version-controlled and applied automatically during application deployment. For a microservices architecture with separate PostgreSQL databases, Flyway can manage each service's schema independently, ensuring consistency and rollback capability. This aligns with the requirement to automate schema changes per microservice as part of the migration and modernization effort.

Answer

AWS Database Migration Service (DMS) to continuously replicate schema changes from the source Oracle database.

Answer

AWS CloudFormation with custom resource Lambda functions to run SQL scripts.

Answer

AWS CLI scripts executed in CodeBuild to run SQL commands against the target databases.

Question 13

A company is migrating a large e-commerce platform to AWS using a lift-and-shift approach. The application consists of a web tier, application tier, and a MySQL database. After migration, users report intermittent slow page loads. The operations team notices high CPU utilization on the application tier instances. Which THREE steps should the team take to address the performance issues?

Accepted Answer

Implement Amazon CloudFront to cache static content and reduce load on the web tier.. Option A is correct because implementing Amazon CloudFront to cache static content offloads requests from the web tier, reducing the number of dynamic requests that reach the application tier. This directly lowers CPU utilization on the application instances by minimizing the processing overhead for repeated static asset deliveries.

Answer

Replace the current application tier instances with larger instance types.

Answer

Move the MySQL database to Amazon RDS for MySQL and enable Multi-AZ deployment.

Question 14

A global e-commerce company is migrating its on-premises application to AWS. The application uses Active Directory for authentication and requires integration with AWS Managed Microsoft AD. The company has a multi-account strategy using AWS Organizations. Which TWO steps should the solutions architect take to ensure seamless authentication across the organization?

Accepted Answer

Establish a two-way forest trust between the on-premises Active Directory and AWS Managed Microsoft AD.. Option B is correct because establishing a two-way forest trust between on-premises Active Directory and AWS Managed Microsoft AD allows users authenticated by the on-premises AD to access resources in the AWS cloud without needing separate credentials. This trust enables Kerberos and NTLM authentication to flow seamlessly between the two forests, supporting the company's requirement for integration with AWS Managed Microsoft AD.

Answer

Configure an IAM identity provider to use the on-premises Active Directory.

Answer

Store AD credentials in AWS Systems Manager Parameter Store and retrieve them at runtime.

Answer

Deploy AWS Managed Microsoft AD in each account and configure replication.

Question 15

A company is designing a new web application that will be deployed on AWS. The application consists of an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances running a web server. The application must be highly available across multiple Availability Zones. The company expects variable traffic patterns, including sudden spikes. The operations team wants to minimize manual intervention. The application stores session state in a shared data store. The security team requires that all traffic between the ALB and the EC2 instances be encrypted. The company is using AWS Certificate Manager (ACM) to manage SSL/TLS certificates. The ALB must terminate SSL/TLS connections. Which combination of actions should the company take to meet these requirements?

Accepted Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using the same ACM certificate. Configure health checks on the target group to use HTTP on port 80 with path /health.. Option A is correct because it meets all requirements: the ALB terminates SSL/TLS using an ACM certificate on an HTTPS listener, encrypts traffic between ALB and EC2 instances by using HTTPS on the target group with the same ACM certificate (mutual TLS is not required; the ALB re-encrypts using the same certificate), and uses HTTP health checks on port 80 to avoid certificate validation issues during health checks. This ensures end-to-end encryption, high availability across multiple AZs, and minimizes manual intervention by automating certificate management with ACM.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTP health checks on port 80.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS on port 443 using a self-signed certificate. Configure health checks to use HTTPS on port 443.

Answer

Configure the ALB with an HTTPS listener using an ACM certificate. Configure the target group with HTTPS health checks on port 443 using a separate ACM certificate.

Question 16

A company is designing a data lake on Amazon S3. The data is ingested from multiple sources and must be encrypted at rest using customer-managed keys. The company also needs to audit all access to the data lake. Which combination of services should be used?

Accepted Answer

Configure S3 bucket encryption with SSE-KMS using a customer-managed CMK. Enable AWS CloudTrail with data events for S3 and KMS.. Option B is correct because it uses SSE-KMS with a customer-managed CMK to meet the encryption-at-rest requirement with customer-controlled keys, and enables AWS CloudTrail with data events for both S3 and KMS to audit all access to the data lake. This combination provides granular auditing of every S3 object-level operation (e.g., GetObject, PutObject) and every KMS key usage (e.g., Decrypt, GenerateDataKey), which is essential for compliance and security monitoring.

Answer

Enable S3 bucket encryption with SSE-S3. Enable S3 server access logs.

Answer

Enable S3 default encryption with SSE-S3. Enable Amazon CloudWatch Logs for S3 access logging.

Answer

Use client-side encryption with a customer-managed key. Enable Amazon CloudWatch Logs for S3 access logs.

Question 17

A company uses AWS Organizations with multiple accounts. The finance team needs to track costs by department, where each department uses resources across several accounts. What is the BEST way to allocate costs accurately?

Accepted Answer

Define cost allocation tags for each department and enable them in the Billing and Cost Management console.. Cost allocation tags allow you to tag AWS resources with department-specific metadata (e.g., 'Department: Finance') and then activate those tags in the Billing and Cost Management console. Once enabled, AWS Cost Explorer and cost reports can filter and group costs by these tags, providing accurate per-department cost tracking across multiple accounts in AWS Organizations. This is the most precise method because it directly associates resource usage with the department responsible, regardless of which account hosts the resource.

Answer

Use AWS Cost Explorer to view costs by linked account.

Answer

Set up AWS Budgets for each department with alerts.

Answer

Create AWS Resource Groups for each department and use AWS Config to track costs.

Question 18

A company is designing a serverless data processing pipeline. An AWS Lambda function processes records from an Amazon Kinesis Data Stream. The function runs for an average of 30 seconds per record, and the stream has 10 shards. The company expects a sustained load of 5,000 records per second. What is the primary consideration to ensure the Lambda function can scale to handle the load?

Accepted Answer

Ensure that the Lambda function processes each batch within the Kinesis stream's iterator age.. The primary consideration is to ensure that the Lambda function processes each batch within the Kinesis stream's iterator age (default 7 days). With 5,000 records/sec across 10 shards, each shard receives 500 records/sec. If each record takes 30 seconds to process, the Lambda function must process records faster than they arrive to avoid falling behind and exceeding the iterator age, which would cause data loss. The iterator age metric tracks how far behind the consumer is, and if it grows unbounded, records will expire before being processed.

Answer

Request a service quota increase for Lambda concurrent executions.

Answer

Set a reserved concurrency of 500 for the Lambda function.

Answer

Increase the Lambda function timeout to more than 30 seconds.

Question 19

A company with multiple AWS accounts wants to centralize CloudTrail logging. They create a CloudTrail trail in the management account that logs all events across all accounts and regions. However, the security team notices that some management events from member accounts are not being logged. What is the most likely cause?

Accepted Answer

The trail was not created as an organization trail.. Option D is correct because when a CloudTrail trail is created in the management account without enabling the 'organization trail' option, it only logs events for the management account itself and not for member accounts. To centralize logging across all accounts in AWS Organizations, the trail must be explicitly created as an organization trail, which automatically applies to all current and future member accounts. Without this setting, member account events are not forwarded to the management account's trail.

Answer

The SCPs applied to member accounts are blocking CloudTrail from sending logs.

Answer

CloudTrail is a regional service and the trail is only in one region.

Answer

Member accounts have IAM policies that deny CloudTrail logging.

Question 20

A company is migrating a distributed application that uses a custom TCP protocol between components. The application is deployed on-premises across multiple servers. The company wants to use AWS without modifying the application code. Which approach should the company take to migrate the application while maintaining low latency between components?

Accepted Answer

Use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency.. Option A is correct because using a Placement Group ensures that EC2 instances are placed close together within the same Availability Zone, minimizing network latency and maximizing throughput for the custom TCP protocol. This allows the application to run unchanged on AWS. Option B is incorrect because Direct Connect connects on-premises to AWS, but the application components would still be separated by network distance, increasing latency. Option C is incorrect because VPC Peering connects different VPCs, which does not guarantee low latency within a single VPC. Option D is incorrect because a VPN is used for secure connectivity over the internet, which introduces higher latency and is not necessary for components within the same VPC.

Answer

Use AWS Direct Connect to connect the on-premises servers to AWS and keep the application on-premises.

Answer

Use VPC Peering to connect the application components across different VPCs.

Answer

Use a VPN connection between the on-premises environment and AWS VPC.