SAP-C02 Practice Test 26 — 15 Questions

Question 1

A company is designing a new serverless application on AWS. The application consists of multiple AWS Lambda functions that process incoming events from an Amazon SQS queue. The company wants to ensure that each message is processed exactly once. Which configuration should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SQS FIFO queue and enable content-based deduplication.. An SQS FIFO queue guarantees first-in, first-out delivery and exactly-once processing, eliminating duplicates within a message group. Enabling content-based deduplication allows the queue to automatically detect and discard duplicate messages based on the message body, ensuring each Lambda invocation processes a unique message without additional application logic.

Answer

Use a standard SQS queue and set the Lambda function reserved concurrency to 1.

Answer

Use a standard SQS queue and configure Lambda destinations for the queue.

Answer

Use an SQS FIFO queue and configure DynamoDB Streams as the event source for Lambda.

Question 2

A company is running a stateful web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the instance. The company wants to make the application highly available and fault-tolerant without rewriting the application code. What should the solutions architect do?

Accepted Answer

Configure the ALB with sticky sessions (session affinity) and use a custom cookie.. Configuring the ALB with sticky sessions (session affinity) using a custom cookie allows the ALB to consistently route requests from a user's session to the same EC2 instance, preserving the locally stored session state without requiring any application code changes. This approach leverages the ALB's built-in session affinity feature, which is transparent to the application and ensures high availability by distributing traffic across healthy instances while maintaining session continuity.

Answer

Replace the ALB with a Network Load Balancer (NLB) and enable cross-zone load balancing.

Answer

Move session state to Amazon ElastiCache and configure the ALB to use sticky sessions.

Answer

Use an Auto Scaling group to add more instances and distribute load.

Question 3

A company is designing a new application that will process real-time streaming data from thousands of IoT devices. The data must be ingested, processed with low latency, and stored in Amazon S3 for analytics. Which combination of AWS services should the company use to meet these requirements?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests real-time streaming data from thousands of IoT devices with low latency, and AWS Lambda can process each record as it arrives via event source mapping. The processed data is then stored in Amazon S3 for analytics, meeting all requirements for ingestion, low-latency processing, and durable storage.

Answer

Amazon SQS, AWS Lambda, Amazon S3

Answer

Amazon Kinesis Data Firehose, Amazon Redshift, Amazon S3

Answer

Amazon MQ, AWS Lambda, Amazon RDS

Question 4

A company is designing a serverless event-driven architecture using AWS Lambda, Amazon SQS, and Amazon DynamoDB. The Lambda function processes messages from an SQS queue and writes to DynamoDB. The company expects unpredictable traffic spikes and must ensure that messages are not lost. Which configuration should the company use to meet these requirements?

Accepted Answer

Use an SQS queue as a Lambda event source with reserved concurrency on the Lambda function. Using an SQS queue as a Lambda event source with reserved concurrency ensures that messages are not lost during traffic spikes. SQS acts as a durable buffer, and reserved concurrency prevents the Lambda function from being throttled, which would otherwise cause messages to remain in the queue or be sent to a dead-letter queue. This combination guarantees that every message is processed without loss, even under unpredictable load.

Answer

Enable DynamoDB Accelerator (DAX) for the Lambda function

Answer

Provisioned Concurrency on the Lambda function

Answer

Increase the SQS queue visibility timeout and retention period

Question 5

A company is designing a new microservices architecture on AWS. Each microservice must be independently deployable and scalable. The company expects unpredictable traffic patterns with sudden spikes. Which combination of AWS services should be used to build a decoupled, resilient system?

Accepted Answer

Use Amazon API Gateway, AWS Lambda, Amazon SQS, Amazon DynamoDB, and Amazon CloudWatch.. It combines API Gateway as a managed entry point, Lambda for stateless compute, SQS for decoupling and buffering sudden traffic spikes, DynamoDB for serverless NoSQL storage, and CloudWatch for observability. This serverless stack ensures each microservice is independently deployable and scales automatically without provisioning, handling unpredictable spikes via SQS queue depth and Lambda concurrency limits.

Answer

Use Application Load Balancer, Amazon EC2 Auto Scaling, Amazon SQS, and Amazon RDS.

Answer

Use Amazon API Gateway, AWS Lambda, Amazon Kinesis Data Streams, and Amazon DynamoDB.

Answer

Use Application Load Balancer, Amazon ECS with Fargate, Amazon SQS, and Amazon RDS with read replicas.

Question 6

A company is designing a new cloud-native application on AWS. The application will use a microservices architecture and requires a way to manage configuration data and secrets. Which THREE AWS services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager stores secrets with automatic rotation. AWS Systems Manager Parameter Store stores configuration data and secrets. AWS AppConfig manages application configuration. Option D (DynamoDB) is a database, not a configuration store. Option E (S3) can store config files but is not as integrated for secrets.

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 7

A media company is building a video transcoding pipeline using AWS Elemental MediaConvert. The source videos are uploaded to an S3 bucket, and the transcoded outputs are stored in another S3 bucket. The company wants to trigger the transcoding job as soon as a new video is uploaded. The pipeline must handle high volumes of uploads and ensure that no upload is missed. Which solution is MOST reliable and scalable?

Accepted Answer

Configure an S3 event notification to directly invoke an AWS Lambda function that starts the MediaConvert job.. S3 event notifications can directly invoke a Lambda function with minimal latency and no intermediate components, making it the simplest and most reliable way to trigger MediaConvert jobs for each upload. S3 event notifications are designed to deliver events with at-least-once delivery semantics, ensuring no upload is missed even under high volumes. This direct integration avoids additional failure points like SNS or SQS, which could introduce delays or require extra configuration for scaling.

Answer

Configure an S3 event notification to publish to an Amazon SNS topic, which triggers an AWS Lambda function that starts the MediaConvert job.

Answer

Use Amazon EventBridge to detect S3 PUT events and route them to a Lambda function.

Answer

Configure an S3 event notification to send events to an Amazon SQS queue, and have a Lambda function poll the queue and start MediaConvert jobs.

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless encryption is specified.. A service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.

Answer

Use CloudTrail to monitor bucket creation and alert security team.

Answer

Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.

Answer

Use AWS Config rules to detect non-compliant buckets and auto-remediate.

Question 9

A company is designing a data lake on Amazon S3. Data is ingested from multiple sources and stored as Parquet files partitioned by date. The company needs to ensure that only authorized users can access the data, and that the data is encrypted at rest. Which TWO actions should the company take to meet these requirements? (Choose TWO.)

Accepted Answer

Enable default encryption with SSE-KMS on the S3 bucket.. Options A and E are correct. A: Enabling default encryption with SSE-KMS ensures data is encrypted at rest using AWS Key Management Service, providing control over encryption keys. E: A bucket policy that allows access only from specific IAM roles ensures only authorized users can access the data, following the principle of least privilege. Option B (client-side encryption) is not required as server-side encryption meets the requirement. Option C (server access logging) does not control access or encryption. Option D (bucket ACL) is less secure and not recommended for controlling access compared to IAM policies.

Answer

Use client-side encryption before uploading to S3.

Answer

Enable S3 server access logging.

Answer

Use a bucket ACL to grant access to the data lake.

Question 10

A company is running a web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes that cause increased latency. The company wants to implement a solution to automatically adjust capacity in anticipation of traffic changes. What should a solutions architect do?

Accepted Answer

Configure a predictive scaling policy using historical traffic patterns.. Predictive scaling uses historical traffic patterns to forecast future demand and proactively adjust capacity before traffic spikes occur, which directly addresses the requirement to anticipate changes. This approach reduces latency by ensuring sufficient resources are available ahead of time, unlike reactive policies that only respond after utilization increases.

Answer

Configure a simple scaling policy based on CPU utilization.

Answer

Configure a scheduled scaling policy to add instances during known peak hours.

Answer

Configure a target tracking scaling policy based on average CPU utilization.

Question 11

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket, which triggers an AWS Lambda function that transcodes the video into multiple formats using FFmpeg. The transcoding job runs on the Lambda function with a 15-minute timeout. Recently, the company started receiving 4K videos that take more than 15 minutes to transcode. The Lambda function times out, and the video is not processed. The company wants to process these large videos without increasing the Lambda timeout and without rewriting the entire pipeline. What should the solutions architect do?

Accepted Answer

Replace the Lambda function with AWS Elemental MediaConvert job triggered by S3 events.. AWS Elemental MediaConvert is a managed service designed for video transcoding. It can handle large files and long-running jobs. The pipeline can be modified to trigger a MediaConvert job instead of a Lambda function. Option B is incorrect because Lambda functions have a maximum execution time of 15 minutes; increasing memory does not extend timeout. Option C is incorrect because using a larger Lambda function still has the 15-minute limit. Option D is incorrect because Step Functions orchestrate Lambda functions but do not extend the individual Lambda timeout.

Answer

Increase the Lambda function memory to the maximum to improve performance and reduce processing time.

Answer

Use AWS Step Functions to call multiple Lambda functions in parallel to process chunks of the video.

Answer

Use a Lambda function with a larger ephemeral storage to handle the video file.

Question 12

A company has multiple AWS accounts managed via AWS Control Tower. The DevOps team wants to deploy a shared CI/CD pipeline that can deploy applications across all accounts. The pipeline must use the same source repository and artifact store. What is the MOST secure and scalable approach?

Accepted Answer

Deploy the pipeline in a central DevOps account. Use cross-account IAM roles to deploy to target accounts.. The most secure and scalable approach is to deploy the CI/CD pipeline in a central DevOps account and use cross-account IAM roles to deploy to target accounts. This centralizes management, simplifies governance, follows least privilege, and scales easily as new accounts are added. Option C, while technically possible, does not necessarily centralize the pipeline in a dedicated account, which can lead to governance challenges and increased complexity. Therefore, only Option A fully meets the requirements.

Answer

Create a separate pipeline in each account using the same source repository.

Answer

Use AWS CodePipeline with cross-account actions by assuming IAM roles in each target account.

Question 13

A company is migrating a large-scale application to AWS. The application uses a message queue for decoupling components. The current on-premises solution uses RabbitMQ. The company wants a managed service that supports message durability and at-least-once delivery. Which THREE AWS services meet these requirements? (Choose THREE.)

Accepted Answer

Amazon MQ (managed RabbitMQ broker).. Options B, C, and E are correct. Amazon MQ is a managed message broker service that supports RabbitMQ, providing message durability and at-least-once delivery. Amazon SQS FIFO queues guarantee exactly-once processing while also offering at-least-once delivery and durability. Amazon SQS standard queues provide at-least-once delivery and durability. Option A is incorrect because Amazon SNS is a pub/sub messaging service, not a queue, and does not support the same durability and delivery semantics as a message queue. Option D is incorrect because Amazon Kinesis Data Streams is designed for real-time streaming data ingestion, not as a traditional message queue, and does not guarantee at-least-once delivery in the same way.

Answer

Amazon Simple Notification Service (SNS) topic.

Answer

Amazon Kinesis Data Streams.

Question 14

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

Accepted Answer

Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.. Adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Answer

Increase the ALB idle timeout to 120 seconds.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Reduce the target tracking scaling threshold to 50% average CPU.

Question 15

A company uses AWS Organizations and wants to allow certain accounts to use AWS Service Catalog for self-service provisioning. The IT team needs to control which products are available. Where should the product portfolio be shared?

Accepted Answer

Share the portfolio with the target accounts from the Service Catalog console. AWS Service Catalog allows you to share a product portfolio directly with individual AWS accounts or organizational units (OUs) within AWS Organizations. By sharing the portfolio from the Service Catalog console, the IT team can control which products are available to specific accounts, enabling self-service provisioning while maintaining governance. This approach leverages Service Catalog's native portfolio sharing mechanism, which does not require additional infrastructure or cross-account IAM roles.

Answer

Use AWS CloudFormation StackSets to deploy products to each account

Answer

Use SCPs to allow specific accounts to use Service Catalog

Answer

Create IAM roles in the central account that developers can assume