SAP-C02 Practice Test 5 — 10 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They want to implement a blue/green deployment strategy with minimal impact on users. Which approach should they use?

Accepted Answer

Create a new target group with the green instances. Modify the ALB listener rule to forward traffic to the new target group.. Option A is correct because blue/green deployment with an ALB is achieved by creating a new target group for the green instances and modifying the ALB listener rule to forward traffic to the new target group. This allows instant traffic shifting with zero downtime, as the ALB can route traffic between target groups without changing the DNS or creating a new ALB. The blue (old) target group remains available for instant rollback if needed.

Answer

Stop all instances, launch new instances with the new version, and update the target group.

Answer

Update the existing target group's instances to the new version, one at a time.

Answer

Create a new ALB and update DNS to point to the new ALB.

Question 2

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The recovery time objective (RTO) is 1 hour and the recovery point objective (RPO) is 15 minutes. Which combination of steps should the company take to meet these requirements? (Choose THREE.)

Accepted Answer

Use Amazon Route 53 health checks to monitor the primary application and configure DNS failover to the secondary Region.. Option A is correct because Route 53 health checks can monitor the primary application's endpoint, and DNS failover to a secondary Region enables automatic traffic redirection within minutes, aligning with the 1-hour RTO. This approach provides a simple, stateless failover mechanism without requiring complex routing changes.

Answer

Configure a Multi-AZ deployment for the RDS database in the primary Region.

Answer

Deploy the application on Amazon Aurora Global Database.

Question 3

A company is designing a serverless application using AWS Lambda for business logic and Amazon API Gateway for REST APIs. The application needs to store and retrieve user session data. Which service should they use for session state?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is the correct choice for storing user session state in a serverless application because it provides an in-memory data store with sub-millisecond latency, which is ideal for session management where fast reads and writes are critical. Redis supports key-value structures with TTL (time-to-live) expiration, allowing automatic cleanup of stale sessions, and integrates seamlessly with Lambda and API Gateway via the ElastiCache client SDK.

Answer

Amazon RDS for MySQL

Answer

Amazon DynamoDB

Answer

Amazon S3

Question 4

A company is designing a serverless data processing pipeline using AWS Step Functions, AWS Lambda, and Amazon DynamoDB. The pipeline must process incoming JSON records from an Amazon Kinesis Data Stream. Each record must be processed exactly once and in order. The company expects a throughput of up to 1,000 records per second. Which combination of services and configurations should the company use to meet these requirements? (Choose TWO.)

Accepted Answer

Configure the Kinesis Data Stream with 10 shards.. Option C is correct because with a throughput of 1,000 records per second, a Kinesis Data Stream with 10 shards provides the necessary capacity (each shard supports up to 1,000 records/second for ingestion and 2 MB/s for reads). This shard count ensures the stream can handle the peak load without throttling, while maintaining the ordering guarantee within each shard.

Answer

Use DynamoDB Streams to trigger the Lambda function for each record.

Answer

Use an Amazon SQS FIFO queue as the event source for the Lambda function to maintain order.

Answer

Use AWS Step Functions to coordinate processing of records and ensure exactly-once delivery.

Question 5

A company is designing a new containerized application on Amazon EKS. The application must be able to access secrets (e.g., database credentials) securely. The company requires that secrets be automatically rotated and audited. Which THREE actions should the company take to meet these requirements?

Accepted Answer

Use IAM roles for service accounts (IRSA) to grant pods access to Secrets Manager. Option B is correct because IAM Roles for Service Accounts (IRSA) allows pods in Amazon EKS to assume an IAM role with fine-grained permissions, enabling secure access to AWS Secrets Manager without embedding long-term credentials. This approach integrates with AWS IAM to provide temporary credentials via OIDC federation, ensuring that only authorized pods can retrieve secrets.

Answer

Mount the Secrets Store CSI Driver volume directly to the pod without using ASCP

Answer

Store secrets in Kubernetes Secrets and use a ConfigMap to reference them

Question 6

A company needs to design a disaster recovery (DR) solution for a critical database running on Amazon RDS for MySQL. The RTO is 15 minutes and RPO is 5 minutes. The primary region is us-east-1. Which solution meets these requirements?

Accepted Answer

Enable Multi-AZ deployment with a DB cluster.. Option A is correct because a Multi-AZ DB cluster deployment for Amazon RDS for MySQL provides automatic failover to a standby instance in a different Availability Zone within the same region, achieving an RTO of typically 1–2 minutes and an RPO of effectively zero (synchronous replication). This meets the 15-minute RTO and 5-minute RPO requirements without any manual intervention or cross-region latency.

Answer

Use automated backups with 5-minute retention.

Answer

Take manual snapshots every 5 minutes and copy to another region.

Answer

Create a cross-region read replica in us-west-2.

Question 7

A company wants to design a highly available, stateless web application using Amazon ECS with Fargate. They need to distribute traffic across multiple AWS Regions for low latency. Which approach should they use?

Accepted Answer

Use Amazon Route 53 latency-based routing to direct traffic to an Application Load Balancer in each region.. Option B is correct because Amazon Route 53 latency-based routing directs users to the region with the lowest latency, and using an Application Load Balancer (ALB) in each region provides regional traffic distribution and health checks for the stateless ECS Fargate tasks. This combination ensures high availability and low latency across multiple AWS Regions, as the ALB handles HTTP/HTTPS traffic and integrates with ECS service discovery.

Answer

Use a single Network Load Balancer in the primary region with cross-zone load balancing.

Answer

Use Amazon CloudFront with origins in each region.

Answer

Use AWS Global Accelerator with Network Load Balancers in each region.

Question 8

A company is deploying a microservices architecture on Amazon ECS with Fargate. They need to enable service-to-service communication with mutual TLS (mTLS) and service discovery. Which combination of services should they use? (Select THREE.)

Accepted Answer

AWS Certificate Manager (ACM). AWS App Mesh provides a service mesh that supports mTLS for encrypting and authenticating service-to-service communication within an ECS Fargate environment. AWS Cloud Map enables service discovery by allowing microservices to register and discover each other via DNS or API calls. AWS Certificate Manager (ACM) is used to provision and manage the X.509 certificates required for mTLS, which are integrated with App Mesh to enforce mutual authentication.

Answer

Amazon Route 53

Answer

AWS Direct Connect

Question 9

A company is designing a data lake on Amazon S3 for analytics. The data is ingested from multiple sources and must be encrypted at rest. The company requires the ability to audit access to the data lake and enforce fine-grained access control based on tags. Which solution should the company choose?

Accepted Answer

Use S3 Object Lambda with AWS CloudTrail. Option D is correct because S3 Object Lambda allows you to add custom code to S3 GET requests, enabling fine-grained access control based on tags by dynamically modifying the data returned. AWS CloudTrail provides the required audit trail by logging all API calls, including those to S3 Object Lambda, ensuring full auditability of access to the data lake.

Answer

Use S3 bucket policies with condition keys for tags

Answer

Use S3 server-side encryption with customer-provided keys (SSE-C) and bucket policies

Answer

Use AWS Lake Formation with column-level permissions

Question 10

A company is designing a new application on AWS that requires a relational database with read replicas across multiple AWS Regions. The database must have automated failover and a recovery point objective (RPO) of less than 5 seconds. Which database solution should the company choose?

Accepted Answer

Amazon Aurora Global Database. Amazon Aurora Global Database is the correct choice because it is designed for cross-Region replication with a typical RPO of less than 1 second and automated failover from the primary Region to a secondary Region in under 1 minute. This meets the requirement for a relational database with read replicas across multiple Regions and an RPO of less than 5 seconds, as Aurora Global Database uses a dedicated, fast replication channel that minimizes lag.

Answer

Amazon RDS for MySQL with Multi-AZ and cross-Region read replicas

Answer

Amazon RDS for PostgreSQL with cross-Region read replicas and Multi-AZ

Answer

Amazon DynamoDB Global Tables