SAP-C02 Practice Test 3 — 10 Questions

Question 1

A company is migrating a stateful application to AWS. The application uses sticky sessions (session affinity) on the current on-premises load balancer. The company wants to use an Application Load Balancer (ALB) in AWS. Which feature should be enabled?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Sticky sessions (session affinity) using a cookie generated by the load balancer.. ALB supports sticky sessions (session affinity) using a cookie generated by the load balancer, which meets the requirement to maintain session state from the on-premises environment. Option A (connection draining) is used to allow in-flight requests to complete during instance deregistration, not for session affinity. Option C (health checks) ensures traffic is only sent to healthy instances, but does not maintain session stickiness. Option D (cross-zone load balancing) distributes traffic evenly across all availability zones, but does not affect session affinity.

Answer

Connection draining (deregistration delay).

Answer

Health checks to ensure only healthy instances receive traffic.

Answer

Cross-zone load balancing.

Question 2

A company is designing a new multi-region disaster recovery solution for a critical application running on AWS. The primary region is us-east-1. The application uses Amazon RDS for MySQL with Multi-AZ, and runs on EC2 instances behind an ALB. The RPO must be less than 5 minutes, and RTO less than 30 minutes. The company wants to minimize costs when the DR solution is not in use. Which solution should a Solutions Architect recommend?

Accepted Answer

Set up an RDS MySQL cross-Region read replica in us-west-2. Keep a standby EC2 environment with Auto Scaling configured to scale from 0 to minimum instances using a CloudWatch alarm on health checks. Use Route 53 failover routing to switch DNS to us-west-2.. Option D meets the RPO of less than 5 minutes because RDS cross-Region read replicas use asynchronous replication with a typical lag of seconds. It meets the RTO of less than 30 minutes because the read replica can be promoted to a standalone primary in minutes. The standby EC2 environment with Auto Scaling set to 0 (scaling up based on health check alarms) minimizes cost when not in use. Route 53 failover routing redirects traffic to us-west-2 after promotion. Option A is incorrect because a single hot standby EC2 instance incurs ongoing cost, and it does not meet the cost minimization requirement. Option B is incorrect because automated snapshots have an RPO of up to 24 hours (not <5 minutes), and restoring to S3-mounted volumes is not a functional database serving solution. Option C is incorrect because Multi-AZ in both regions is costly (always running instances) and cross-Region load balancing with ALB is not a native feature for failover; plus Multi-AZ does not provide a separate read replica in another region for DR without additional replication.

Answer

Use RDS MySQL with cross-Region read replicas in us-west-2. Use a hot standby EC2 environment with a single instance. Use Route 53 failover routing.

Answer

Back up RDS MySQL to S3 using automated snapshots and copy them to us-west-2. Use EC2 instances with S3-mounted volumes to serve traffic from the backup.

Answer

Use RDS MySQL with Multi-AZ in us-east-1 and a second Multi-AZ deployment in us-west-2. Keep EC2 instances running in us-west-2 behind an ALB with cross-Region load balancing.

Question 3

A company wants to implement a centralized logging solution for all VPCs in their AWS Organization. They need to capture VPC Flow Logs, AWS CloudTrail logs, and DNS logs, and store them in a central Amazon S3 bucket. The logs must be encrypted with a customer-managed KMS key. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use the AWS Centralized Logging with OpenSearch Service solution, which sets up the necessary infrastructure to collect and store logs from multiple accounts in a central S3 bucket with KMS encryption.. The AWS Centralized Logging with OpenSearch Service solution is a purpose-built, AWS-managed solution that automates the deployment of the necessary infrastructure to collect, centralize, and store VPC Flow Logs, CloudTrail logs, and DNS logs from multiple accounts into a central S3 bucket with customer-managed KMS encryption. This approach minimizes operational overhead by handling cross-account log collection, S3 bucket configuration, and KMS key integration out of the box, eliminating the need for manual setup and maintenance.

Answer

Create an S3 bucket in the central account with KMS encryption. Configure each account to send logs to that bucket using cross-account permissions.

Answer

Create separate S3 buckets for each log type in the central account and configure KMS encryption. Use AWS Glue to crawl and catalog the logs.

Answer

Use Amazon S3 with default encryption and enable S3 Cross-Region Replication to a central bucket.

Question 4

A company manages multiple AWS accounts using AWS Organizations. The security team needs to enforce that all newly created accounts automatically have a specific set of security controls, including AWS Config rules and an AWS CloudTrail trail. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use AWS Organizations with AWS CloudFormation StackSets to automatically deploy the security stack to new accounts.. AWS Organizations integrates directly with AWS CloudFormation StackSets to automatically deploy stacks across accounts in an organization. By configuring StackSets with automatic deployment enabled, any new account added to the organization will automatically receive the specified security stack (including AWS Config rules and CloudTrail trail) without any manual intervention or additional orchestration. This approach minimizes operational overhead by leveraging native AWS automation.

Answer

Use AWS Config conformance packs to deploy rules across accounts.

Answer

Use AWS Lambda functions triggered by AWS CloudTrail events to create a new stack in each new account.

Answer

Use AWS Service Catalog to create a portfolio that includes the security stack and grant access to new accounts.

Question 5

A company wants to automate the deployment of a three-tier web application on AWS. The deployment should include the network, security groups, EC2 instances, and an Application Load Balancer. Which AWS service should they use?

Accepted Answer

AWS CloudFormation. AWS CloudFormation. AWS CloudFormation allows infrastructure as code to provision all required resources, including the network, security groups, EC2 instances, and an Application Load Balancer. Option A (AWS Elastic Beanstalk) abstracts the underlying infrastructure and does not provide granular control. Option C (AWS CodeDeploy) is used for deploying application code, not infrastructure. Option D (AWS OpsWorks) is a configuration management service, not an infrastructure provisioning tool.

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Answer

AWS OpsWorks

Question 6

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 7

Refer to the exhibit. A company deploys this CloudFormation template. After deployment, they enable S3 Transfer Acceleration on the bucket. Later, they update the stack. What happens to the Transfer Acceleration setting?

Accepted Answer

The Transfer Acceleration setting remains unchanged after the update.. CloudFormation drift detection does not automatically revert manual changes. The Transfer Acceleration setting is a property of the bucket; if not defined in the template, CloudFormation may not manage it, but typically manual changes are not overwritten unless the template explicitly defines them. However, best practice is to define all settings in the template to avoid drift. Option A is wrong because CloudFormation does not automatically disable it. Option B is wrong because CloudFormation does not automatically enable it. Option C is wrong because updates do not reset to default.

Answer

CloudFormation enables Transfer Acceleration because it is a best practice.

Answer

The update fails because of a conflict between the template and the manual change.

Answer

CloudFormation removes the Transfer Acceleration setting because it is not defined in the template.

Question 8

A company is migrating a legacy application to AWS. The application currently runs on a single on-premises server with a local MySQL database. The company wants to minimize changes and reduce operational overhead. Which TWO strategies should the solutions architect recommend? (Select TWO.)

Accepted Answer

Replatform the database to Amazon RDS for MySQL. Rehost (lift-and-shift) minimizes changes by moving the application as-is. Replatforming the database to RDS reduces operational overhead by offloading database management. Retire is not applicable. Refactor would require changes. Repurchase involves buying new software.

Answer

Refactor the application to use microservices

Answer

Retire the application

Answer

Repurchase a SaaS alternative

Question 9

A multinational corporation is implementing a multi-account AWS strategy using AWS Organizations. The security team requires that all newly created accounts in the organization automatically have an Amazon GuardDuty detector enabled in all enabled Regions. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use AWS CloudFormation StackSets with a stack that includes an AWS::GuardDuty::Detector resource, and apply it to the organization root OU.. AWS CloudFormation StackSets can be applied to the organization root OU, automatically deploying an AWS::GuardDuty::Detector resource to every account in the organization as new accounts are created. This approach requires no manual intervention per account, and StackSets handle the lifecycle of the detector across all enabled Regions with minimal operational overhead.

Answer

Use AWS Service Catalog to publish a GuardDuty product and require account owners to launch it.

Answer

Use an SCP that denies guardduty:DeleteDetector and guardduty:UpdateDetector actions, then have each account administrator manually enable GuardDuty.

Answer

Use AWS Config rules to detect accounts without GuardDuty enabled and trigger a Lambda function to enable it.

Question 10

A company is designing a microservices architecture using Amazon ECS with Fargate. Each microservice needs to communicate with others via REST APIs. The company wants to ensure that communication is encrypted in transit and that services can discover each other using DNS names. Which set of actions should the company take?

Accepted Answer

Enable ECS Service Connect on each service, and use the service discovery names provided by Service Connect.. ECS Service Connect provides built-in DNS-based service discovery and automatic encryption via TLS for inter-service communication. Option B uses AWS Cloud Map for service discovery but does not enforce encryption in transit. Option C uses a Network Load Balancer (NLB) in front of each service, which adds unnecessary complexity and cost without addressing service discovery. Option D uses an Application Load Balancer (ALB) in front of each service, which is also overly complex and costly for simple inter-service communication.

Answer

Create a namespace in AWS Cloud Map, register each service, and configure service-to-service communication using the namespace.

Answer

Place a Network Load Balancer in front of each service and use the NLB DNS name for communication.

Answer

Place an Application Load Balancer in front of each service and use the ALB DNS name for communication.