SAP-C02 Practice Exam 51 — 20 Questions

Question 1

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (data processing units) allocated to the Glue job allows for greater parallelism, which directly reduces processing time for CPU-bound or memory-bound workloads. Option A is incorrect because increasing the timeout does not improve performance; it only prevents the job from failing due to time limits. Option B is incorrect because S3 Transfer Acceleration speeds up data transfer to S3, not the processing within Glue. Option D is incorrect because while converting to Parquet can improve read performance and reduce data volume, it does not address the core processing bottleneck if the job is compute-intensive; the most effective immediate step is to increase DPUs.

Answer

Increase the Glue job timeout setting to 24 hours.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Answer

Convert the input data from CSV to Parquet format.

Question 2

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Use AWS CloudFormation with a blue/green deployment strategy for the database.. CloudFormation can use a blue/green deployment strategy, which creates a new database environment (green) alongside the existing one (blue). Traffic is switched after the new environment is ready, minimizing downtime. Option E is correct because taking a database snapshot before updates provides a rollback mechanism in case the update fails. Option A is wrong: Multi-AZ provides high availability and automatic failover but does not eliminate downtime during updates—it simply recovers quickly after an outage. Option B is wrong: Directly updating the CloudFormation stack without creating a new database may cause downtime if the database must be replaced or modified in place. Option D is wrong: A read replica serves only read traffic; it cannot handle write traffic during database updates, so it does not prevent downtime for write operations.

Answer

Enable Multi-AZ on the RDS instance to allow failover during updates.

Answer

Update the CloudFormation stack directly without creating a new database.

Answer

Use a read replica to serve traffic during the update.

Question 3

A company is designing a new cloud-native application that uses Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. The application handles user authentication using Amazon Cognito User Pools. During a stress test, the team notices that some requests are failing with HTTP 503 (Service Unavailable) errors. The CloudWatch logs show that Lambda functions are being throttled, and the DynamoDB table is experiencing high write throttling. The team needs to resolve these issues while maintaining low latency. Which solution is the MOST effective?

Accepted Answer

Set Lambda reserved concurrency to a value that covers peak load and enable DynamoDB auto scaling with a target utilization of 70%.. Setting Lambda reserved concurrency ensures that the function always has capacity available to handle peak load without being throttled by the account-level concurrency limit, while DynamoDB auto scaling with a target utilization of 70% dynamically adjusts write capacity to match traffic patterns, preventing write throttling. This combination directly addresses both throttling issues without introducing additional latency from buffering or caching layers.

Answer

Use Amazon SQS to buffer requests to Lambda and configure a DynamoDB Accelerator (DAX) cluster for caching.

Answer

Increase the DynamoDB write capacity units to the maximum expected peak and configure Lambda provisioned concurrency.

Answer

Replace AWS Lambda with Amazon ECS on Fargate and use an Application Auto Scaling target tracking policy.

Question 4

A company is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. The company wants to implement service discovery and load balancing at the application layer. Which TWO services should the company use?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is correct because it provides service discovery for microservices by allowing services to register their DNS names and health checks, enabling dynamic routing between ECS Fargate tasks. Application Load Balancer (ALB) is correct because it operates at Layer 7 (application layer), supporting HTTP/HTTPS traffic, path-based routing, and integration with ECS for load balancing across Fargate tasks.

Answer

Amazon API Gateway

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 5

A company is migrating a monolithic application to a serverless architecture using AWS Lambda. The application reads and writes to an Amazon RDS for PostgreSQL database. The database connection pool is exhausted during peak traffic. Which design change should a solutions architect recommend to avoid connection exhaustion?

Accepted Answer

Use Amazon RDS Proxy to pool and share database connections.. Amazon RDS Proxy sits between the Lambda function and the RDS database, managing a pool of database connections and reusing them across multiple invocations. This prevents the Lambda function from exhausting the database connection pool during traffic spikes, as each Lambda instance does not need to open its own connection. RDS Proxy also handles connection multiplexing and reduces the overhead of establishing new connections.

Answer

Use Amazon SQS to buffer write requests to the database.

Answer

Use DynamoDB Accelerator (DAX) as a caching layer.

Answer

Increase the max_connections parameter in the RDS parameter group.

Question 6

A company is using AWS Organizations with multiple accounts. The central IT team wants to deploy a set of common VPCs in each account using AWS CloudFormation StackSets. The StackSets must be managed from the management account. Which THREE permissions are required for the StackSets to successfully deploy stacks into member accounts?

Accepted Answer

The management account must have an IAM role (StackSetsAdminRole) with permissions to create stack instances in member accounts.. StackSets require the management account to have an IAM role (commonly named 'AWSCloudFormationStackSetAdministrationRole') that grants permission to create and manage stack instances in member accounts. This role is assumed by CloudFormation to perform operations across accounts, and it must have a trust policy allowing the CloudFormation service to assume it.

Answer

The management account must have an AWS Organizations SCP that allows CloudFormation StackSets operations.

Answer

Each member account must have a self-managed IAM role named 'AWSCloudFormationStackSetExecutionRole' with a trust policy allowing the management account to assume it.

Question 7

A company has multiple AWS accounts that each have their own VPCs with overlapping CIDR ranges. They want to use AWS Transit Gateway to connect these VPCs to a central network account. However, overlapping CIDRs prevent attachment. What is the MOST scalable solution?

Accepted Answer

Set up a NAT gateway in each VPC and route traffic through the transit gateway using private IP addresses from a separate CIDR block.. It uses a NAT gateway in each VPC to translate overlapping private IPs to unique private IPs from a separate CIDR block before routing through the Transit Gateway. This allows the Transit Gateway to forward traffic without conflict, as the NAT gateway performs source network address translation (SNAT) to eliminate IP overlap. This approach is highly scalable because it avoids re-architecting existing VPCs and can be applied incrementally as new VPCs are added.

Answer

Use AWS PrivateLink to connect each VPC to the network account.

Answer

Create VPC peering connections between each VPC and the network account.

Answer

Assign new non-overlapping CIDR ranges to each VPC and update all resources.

Question 8

A company is migrating a legacy monolithic application to a microservices architecture on AWS. The application has strict latency requirements and must be deployed across multiple Availability Zones. Which design strategy BEST meets these requirements while minimizing operational overhead?

Accepted Answer

Use Amazon ECS with Fargate launch type, defining services across multiple AZs.. Amazon ECS with Fargate is the best choice because it provides serverless container orchestration, automatically managing infrastructure and scaling. By deploying services across multiple Availability Zones, it ensures high availability and low-latency communication without the operational overhead of managing EC2 instances or Kubernetes control planes. AWS Lambda introduces cold start latency and a 15-minute execution limit, making it unsuitable for strict latency requirements and long-running microservices. EC2 instances and EKS require more operational overhead for patching and scaling. Fargate minimizes that overhead while meeting latency and multi-AZ requirements.

Answer

Use AWS Lambda functions for each microservice, triggered by API Gateway.

Answer

Deploy each microservice on Amazon EC2 instances in an Auto Scaling group across AZs.

Answer

Use Amazon EKS with worker nodes on EC2, and deploy microservices as Kubernetes pods.

Question 9

Refer to the exhibit. A solutions architect runs this CLI command but receives an error: 'Unknown options: --query'. What is the most likely cause?

Accepted Answer

The AWS CLI version is outdated.. The 'Unknown options: --query' error occurs when the AWS CLI version is outdated and does not recognize the --query parameter. The --query parameter was introduced in AWS CLI version 1.6.0. If the CLI version is older, it will treat --query as an unknown option. While it is true that --query often requires --output for proper formatting, the error for missing --output would be different, not 'Unknown options'. Therefore, the most likely cause is an outdated AWS CLI version.

Answer

The --filters parameter is incorrectly formatted.

Answer

The --query parameter is used without specifying --output.

Answer

The tag value is missing.

Question 10

A company is designing a serverless application using AWS Lambda that processes images uploaded to an S3 bucket. The processing time varies but typically completes within 5 minutes. The Lambda function needs to access a VPC-hosted database. What is the BEST way to configure the Lambda function to access the database while minimizing cold start latency?

Accepted Answer

Use an Amazon VPC interface endpoint for Lambda and keep the function outside the VPC. Using an Amazon VPC interface endpoint for Lambda allows the function to remain outside the VPC while securely accessing resources inside the VPC via AWS PrivateLink. This avoids the cold start latency penalty (often 10+ seconds) incurred when attaching a Lambda function to a VPC, which requires Elastic Network Interface (ENI) creation. The function can directly invoke the database through the interface endpoint without traversing the public internet or needing a NAT gateway.

Answer

Place the Lambda function outside the VPC and use a NAT gateway to reach the database

Answer

Place the Lambda function inside the VPC with a security group allowing access to the database

Answer

Use Amazon RDS Proxy to manage connections and keep Lambda outside the VPC

Question 11

A company has multiple AWS accounts managed via AWS Organizations. The security team wants to restrict the use of specific instance types across all accounts. Which TWO methods can be used to enforce this restriction?

Accepted Answer

Create an SCP that denies the ec2:RunInstances action for specific instance types.. Service Control Policies (SCPs) in AWS Organizations allow you to centrally restrict permissions across all accounts in the organization. By creating an SCP that denies the ec2:RunInstances action with a condition key like ec2:InstanceType matching specific prohibited instance types, you can enforce this restriction at the organization, OU, or account level, preventing any user or role from launching those instance types regardless of their IAM permissions.

Answer

Use AWS CloudTrail to monitor launches of prohibited instance types and automatically terminate them.

Answer

Use Service Quotas to restrict the number of instances of specific types.

Answer

Create an IAM policy in each account that denies the specified instance types.

Question 12

Drag and drop the steps to deploy a serverless application using AWS SAM in the correct order.

Accepted Answer

Write the AWS SAM template, then build, then package, then deploy, then test.. The correct order for deploying a serverless application with AWS SAM is to first write the SAM template (defining resources and configuration), then build the application (compiling code and dependencies), then package the built artifacts (uploading to S3), then deploy the stack (using CloudFormation), and finally test the deployed application to ensure it works as expected. Common mistakes include swapping build and package, writing the template after building, or deploying before packaging, which lead to errors or incomplete deployments.

Answer

Write the AWS SAM template, then package, then build, then deploy, then test.

Answer

Build, then write the AWS SAM template, then package, then deploy, then test.

Answer

Write the AWS SAM template, then build, then deploy, then package, then test.

Question 13

A company is deploying a web application on AWS that must scale automatically based on CPU utilization. The application runs on Amazon EC2 instances in an Auto Scaling group. Which configuration is required for the Auto Scaling group to scale based on CPU?

Accepted Answer

Create a step scaling policy based on a CloudWatch alarm for CPU utilization.. A step scaling policy allows the Auto Scaling group to adjust capacity in increments based on the severity of a CloudWatch alarm, such as one monitoring CPU utilization. This provides more granular and responsive scaling than simple policies, as it can add or remove instances in steps (e.g., add 2 instances when CPU > 70%, add 1 when CPU > 50%) and supports cooldown and warm-up logic to avoid thrashing.

Answer

Create a scheduled scaling action to add instances at peak times.

Answer

Create a simple scaling policy that adds one instance when CPU exceeds 50%.

Answer

Configure the ALB health check to mark instances unhealthy if CPU is high.

Question 14

A company uses AWS Organizations with multiple OUs. The DevOps team needs to allow developers to launch EC2 instances only of type t3.micro in the dev OU. Which action should the team take?

Accepted Answer

Apply a Service Control Policy (SCP) to the dev OU that denies ec2:RunInstances with instance type not equal to t3.micro.. A Service Control Policy (SCP) applied to the dev OU can centrally restrict which EC2 instance types can be launched by all accounts within that OU. The SCP uses a Deny effect with a condition key ec2:InstanceType not equal to t3.micro, which prevents any IAM principal in the OU from launching non-compliant instances, regardless of their IAM permissions. This is the most effective way to enforce a hard boundary at the organization level.

Answer

Create an IAM role with a policy that allows only t3.micro, and attach it to users in the dev OU.

Answer

Use AWS CloudFormation templates that specify t3.micro.

Answer

Use AWS Config rules to terminate non-compliant instances.

Question 15

A company is migrating a large-scale Apache Kafka cluster to Amazon MSK. The cluster has 100 topics with high throughput. The team wants to minimize operational overhead and ensure high availability. Which configuration should be used?

Accepted Answer

Provision an Amazon MSK cluster with 3 brokers per AZ across 3 AZs.. Amazon MSK is a fully managed service for Apache Kafka that reduces operational overhead. Deploying an MSK cluster with 3 brokers per AZ across 3 AZs provides high availability and fault tolerance, as data is replicated across AZs. Option A is wrong because Kinesis Data Streams is a different streaming service with different semantics and not a drop-in replacement for Kafka. Option B is wrong because SQS FIFO queues are not designed for high-throughput pub/sub streaming like Kafka. Option C is wrong because self-managing Kafka on EC2 increases operational overhead, which the team wants to minimize.

Answer

Use Amazon Kinesis Data Streams with enhanced fan-out.

Answer

Use Amazon SQS FIFO queues with message deduplication.

Answer

Deploy Apache Kafka on Amazon EC2 with Spot Instances and EBS volumes.

Question 16

Refer to the exhibit. An IAM policy is attached to a user. When the user tries to upload an object to the S3 bucket 'my-bucket' using the AWS CLI without specifying server-side encryption, the upload fails. What is the MOST likely reason?

Accepted Answer

The policy requires server-side encryption with AES256, but the request did not include the encryption header.. The IAM policy explicitly requires the `s3:x-amz-server-side-encryption` condition with a value of `AES256`. When the user uploads an object via the AWS CLI without specifying the `--server-side-encryption AES256` flag, the request lacks the required encryption header, causing the condition in the policy to fail and the upload to be denied. The policy does not deny all uploads without encryption—it only denies those that fail to meet the specific encryption requirement.

Answer

The bucket policy denies all uploads without encryption.

Answer

The user is not the bucket owner.

Answer

The user does not have permission to call s3:PutObject.

Question 17

A company wants to implement a centralized logging solution for multiple AWS accounts. Which TWO services should be used together?

Accepted Answer

Amazon S3. Amazon S3 serves as a central log repository, and Amazon Athena allows querying logs directly in S3.

Answer

AWS CloudTrail

Answer

Amazon RDS

Answer

AWS Config

Question 18

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

Accepted Answer

AWS Config. AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies. Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.

Answer

AWS Resource Access Manager

Answer

AWS WAF

Answer

AWS IAM Identity Center (SSO)

Question 19

A company is designing a multi-account AWS environment for different business units. They need to share a central Amazon RDS database with read replicas in each account for disaster recovery. What architecture minimizes cross-region data transfer costs while maintaining high availability?

Accepted Answer

Create a cross-region read replica in the central account and grant access to other accounts.. Creating a cross-region read replica in the central account and granting access to other accounts allows each account to have a local read replica that stays in sync with the source, providing high availability and disaster recovery while minimizing cross-region data transfer costs (since replicas are in the same region as the source? Actually, the replica is cross-region, so costs are incurred, but among the given options, this is the only one that uses actual read replicas for continuous replication. Option C is wrong because restoring a snapshot creates an independent instance that does not automatically sync with the source, so it does not meet the requirement for continuous replication and disaster recovery.

Answer

Use a VPC endpoint to share the database across accounts without data transfer costs.

Answer

Share a snapshot of the RDS instance with each account and restore it as a read replica in the same region.

Answer

Create an IAM role in each account to access the central RDS instance directly.

Question 20

Refer to the exhibit. A company has this IAM policy attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 with the tag 'Environment: staging'. What happens?

Accepted Answer

The termination is denied because the condition requires the 'Environment' tag to be 'production'.. The TerminateInstances action has a condition that requires the tag 'Environment: production'. Since the instance has 'staging', the condition is not met, so the action is denied. Options A, B, and D are incorrect because the condition explicitly requires 'production'.

Answer

The instance is terminated because the policy allows TerminateInstances.

Answer

The termination is denied because the Resource is not the instance's ARN.

Answer

The instance is terminated because the condition is not evaluated.