SAP-C02 Practice Test 5 — 10 Questions

Question 1

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. A Lambda function attached to a VPC with only a private subnet has no route to the internet unless a NAT gateway (for outbound internet) or VPC endpoints (for AWS services) are configured. If the function calls external resources or AWS APIs without these, the calls hang until the 30-second timeout. This is the most likely cause of intermittent timeouts in this scenario.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 2

A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for secure secret storage with built-in automatic rotation for RDS, Redshift, and DocumentDB credentials, plus custom Lambda-based rotation for other secrets. It centralizes secret management and integrates natively with EC2 via the AWS SDK or Secrets Manager Agent. KMS is for encryption keys, not secret lifecycle management, and Parameter Store lacks native rotation.

Answer

AWS Key Management Service (KMS)

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 3

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Answer

AWS Data Pipeline

Answer

AWS Lambda functions

Answer

AWS Glue ETL jobs

Question 4

A company is designing a multi-tier web application on AWS. The web tier must automatically scale based on CPU utilization, and the application tier must process messages from an SQS queue. The application tier instances are frequently terminated and replaced due to scaling events. Where should the application logs be stored to ensure they are retained regardless of instance lifecycle?

Accepted Answer

Configure the CloudWatch Logs agent on each instance to stream logs to CloudWatch Logs.. The CloudWatch Logs agent streams log data to Amazon CloudWatch Logs in real-time, decoupling log retention from the EC2 instance lifecycle. When instances are terminated, the logs are already persisted in CloudWatch Logs, ensuring they are retained regardless of scaling events.

Answer

Store logs on an EBS volume and take regular snapshots.

Answer

Write logs to the instance store volume of each EC2 instance.

Answer

Write logs to an Amazon S3 bucket mounted on each instance using NFS.

Question 5

A company is designing a new real-time bidding platform that must handle sudden bursts of traffic up to 100,000 requests per second. The application runs on Amazon EC2 instances behind an Application Load Balancer and stores bid data in Amazon DynamoDB. The company wants to minimize latency and cost while ensuring the database can scale automatically. Which solution meets these requirements?

Accepted Answer

Use DynamoDB with on-demand capacity mode and enable DynamoDB Accelerator (DAX) for read-heavy workloads.. The correct solution uses DynamoDB on-demand mode to handle unpredictable bursts without capacity planning, and DAX to provide microsecond read latency for read-heavy operations. This combination ensures automatic scaling, low latency, and cost efficiency for a real-time bidding platform. Other options either require manual scaling, introduce bottlenecks, or are not optimized for the required throughput and latency.

Answer

Use Amazon RDS for MySQL with Multi-AZ and read replicas, and implement a caching layer using Amazon ElastiCache.

Answer

Use DynamoDB with provisioned capacity mode and set up Auto Scaling with a target utilization of 70%.

Answer

Use Amazon Aurora Serverless v2 with auto-scaling and enable Aurora Global Database for low-latency reads.

Question 6

A company is migrating 200 on-premises virtual machines running a mix of Windows and Linux workloads to AWS. The migration must complete within a tight cutover window, and the company wants to minimize manual configuration and scripting. A solutions architect needs to choose a migration approach that supports automated conversion of the source servers into Amazon EC2 instances with minimal changes. Which AWS service should the solutions architect use?

Accepted Answer

AWS Application Migration Service (AWS MGN). AWS Application Migration Service is purpose-built for rehosting physical, virtual, or cloud servers to AWS. It continuously replicates source servers at the block level, then automatically launches them as EC2 instances for test or cutover. This removes the need to rebuild operating systems or applications manually, supports both Windows and Linux, and enables short cutover windows because the replication is ongoing. The other services address data transfer or database migration, not whole-server conversion.

Answer

AWS DataSync

Answer

AWS Database Migration Service (AWS DMS)

Answer

AWS Server Migration Service (AWS SMS)

Question 7

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

Accepted Answer

Implement retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code.. For synchronous REST-based microservices on ECS Fargate with variable traffic and a requirement to prevent cascading failures, implementing retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code is the correct approach. These patterns handle transient failures gracefully, prevent a failing service from overwhelming upstream callers, and ensure that a slow or unavailable dependency does not cause thread exhaustion or cascading timeouts.

Answer

Use Amazon API Gateway in front of each service to throttle requests and protect against traffic spikes.

Answer

Convert all inter-service communication to asynchronous messaging using Amazon SQS or SNS.

Answer

Deploy multiple instances of each service across multiple Availability Zones and use an Application Load Balancer.

Question 8

A company wants to migrate an on-premises Oracle database to Amazon Aurora PostgreSQL. The migration must have minimal downtime. Which AWS service should be used for the migration?

Accepted Answer

AWS Database Migration Service (DMS). AWS DMS supports ongoing replication to minimize downtime during migration.

Answer

AWS Server Migration Service (SMS)

Answer

AWS DataSync

Answer

AWS Snowball

Question 9

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

Accepted Answer

Implement a Read Replica and direct read traffic to it.. Implementing a Read Replica allows offloading read traffic from the primary DB instance. This reduces the load on the primary, potentially enabling the use of a smaller instance size or lowering provisioned IOPS, thereby reducing costs without affecting performance for the read-intensive application. Option A is incorrect because Multi-AZ deployment adds a standby instance and synchronous replication, increasing costs without direct performance benefit. Option B is incorrect; upgrading to the latest generation instance type may improve performance but generally does not reduce costs. Option D is incorrect; purchasing Reserved Instances provides a discount on hourly rates but does not address the utilization or instance size, so it does not directly reduce costs based on workload.

Answer

Change the DB instance to a Multi-AZ deployment.

Answer

Upgrade to the latest generation instance type.

Answer

Purchase Reserved Instances for the database.

Question 10

A company is implementing a multi-account strategy using AWS Organizations. They want to centralize CloudTrail logs from all accounts into a single S3 bucket in the management account. Which TWO steps are required to achieve this? (Choose two.)

Accepted Answer

Create a CloudTrail trail in the management account with the 'Enable for all accounts in my organization' option.. Option D is correct because creating an organization trail from the management account with 'Enable for all accounts in my organization' is the mechanism that makes CloudTrail log events from every member account into the specified S3 bucket, satisfying the centralized logging requirement. Option E is correct because the central S3 bucket must have a bucket policy granting the CloudTrail service principal (cloudtrail.amazonaws.com) permission to write objects, and it must account for the source accounts (via aws:SourceArn or organization conditions) so logs from all accounts can be delivered. Option A is not required because S3 replication copies objects between buckets and is unrelated to CloudTrail's native organization trail delivery. Option B is not required because CloudTrail uses the service principal and bucket policy, not an IAM role in each member account, to deliver logs. Option C is not required because AWS Config records resource configuration changes and does not forward CloudTrail logs to S3.

Answer

Use S3 replication to copy logs from member account buckets to the central bucket.

Answer

Create an IAM role in each member account that allows CloudTrail to write to the central bucket.

Answer

Enable AWS Config in each member account to forward logs to the central bucket.