SAP-C02 Practice Exam 54 — 20 Questions

Question 1

A company uses AWS Organizations and has a central IT team that manages VPCs. The team wants to ensure that only authorized accounts can create VPCs, and that all VPCs must have a specific tag. Which solution enforces this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Apply an SCP that denies ec2:CreateVpc if the request does not include the required tag.. AWS Organizations Service Control Policies (SCPs) can centrally restrict actions across all member accounts. By applying an SCP that denies ec2:CreateVpc unless the request includes a specific tag (using the ec2:ResourceTag condition key), the central IT team ensures that only authorized accounts (which cannot bypass the SCP) can create VPCs, and all VPCs must have the required tag at creation time.

Answer

Use AWS Config to detect and delete untagged VPCs.

Answer

Use IAM policies in each account to require tags.

Answer

Use AWS CloudFormation StackSets to deploy VPC templates with tags.

Question 2

A company is migrating a large-scale batch processing workload from on-premises to AWS. The workload runs on a schedule and processes data files from an FTP server. The company wants to use AWS services that are serverless and event-driven to reduce operational overhead. The data files will be uploaded to an Amazon S3 bucket. Which solution meets these requirements?

Accepted Answer

Use Amazon S3 Event Notifications to invoke an AWS Lambda function that processes the file. Amazon S3 Event Notifications can directly invoke an AWS Lambda function to process the file upon upload. This is serverless and event-driven, meeting the requirements to reduce operational overhead. Option A (AWS Batch) is not serverless because it requires provisioning compute resources and does not directly trigger from S3 events in a serverless manner. Option C (AWS Glue) is designed for ETL and crawling, not for general batch processing of files. Option D (Step Functions) is used for orchestrating workflows, but the actual processing would still need a compute resource like EC2 or Lambda; using it with EC2 adds overhead and is not fully serverless.

Answer

Use Amazon S3 Event Notifications to invoke an AWS Batch job that processes the file

Answer

Use AWS Glue to crawl the S3 bucket and run an ETL job on a schedule

Answer

Use Amazon S3 Event Notifications to start an AWS Step Functions workflow that runs processing on Amazon EC2

Question 3

A company is designing a disaster recovery solution for a critical application that runs on EC2 instances in a single AWS Region. The application uses a custom AMI that is updated weekly. The recovery point objective (RPO) is 15 minutes, and the recovery time objective (RTO) is 4 hours. The solution must minimize cost while meeting these objectives. Which approach should be used?

Accepted Answer

Use EC2 Image Builder to create an updated AMI weekly and replicate it to another Region, then launch instances from the replicated AMI in the DR Region.. EC2 Image Builder automates weekly AMI creation and replication to another Region, ensuring a recent AMI is available for quick instance launch (meeting the 4-hour RTO). For the 15-minute RPO, the DR strategy relies on complementary data replication mechanisms (e.g., database or storage replication) which are more cost-effective than full server replication. Option A is the most efficient approach for the AMI component, while Options C and B are either unnecessarily costly or misaligned, and Option D is manual and error-prone.

Answer

Use Amazon S3 cross-region replication to copy the application data to a bucket in another Region.

Answer

Use AWS CloudEndure Disaster Recovery for continuous replication of the entire server.

Answer

Manually create an AMI of the instance every week and copy it to another region using the AWS Management Console.

Question 4

A company is migrating a multi-tier web application to AWS. The application uses a commercial database that requires a license. The company wants to reduce licensing costs. Which migration strategy should be considered?

Accepted Answer

Replatform the database to Amazon RDS for an open-source engine like PostgreSQL. (Replatform the database to Amazon RDS for an open-source engine like PostgreSQL) is correct because migrating to an open-source database on Amazon RDS eliminates the need for commercial licenses, thereby reducing licensing costs. Option A (Rehost) is incorrect because it retains the same commercial database software, so licensing costs remain. Option C (Repurchase to SaaS) may not be applicable or cost-effective for the database. Option D (Refactor to DynamoDB) typically requires significant application changes and may not align with a license cost reduction goal.

Answer

Rehost the database to EC2 with the same database software

Answer

Repurchase a Software as a Service (SaaS) alternative

Answer

Refactor the application to use Amazon DynamoDB

Question 5

A company is migrating its on-premises data center to AWS. The company has over 200 applications, each with varying dependencies. The migration team wants to use AWS Migration Hub to track the migration progress. Which approach should the team take to ensure successful tracking and minimize manual effort?

Accepted Answer

Use AWS Application Discovery Service to discover dependencies and then use AWS Migration Hub to track the migration of each application.. AWS Application Discovery Service helps discover dependencies and collect data about on-premises servers, which is used to create a migration plan. AWS Migration Hub then tracks the migration progress of each application across multiple tools, automating tracking and minimizing manual effort. Option A is incorrect because Amazon CloudWatch dashboards monitor resource health but do not track migration progress or dependencies. Option B is incorrect because AWS Systems Manager is for operational management, not specifically for migration tracking. Option D is incorrect because manual spreadsheets are error-prone and require significant effort, defeating the purpose of using AWS tools for automation.

Answer

Use Amazon CloudWatch dashboards to monitor the health of on-premises servers.

Answer

Use AWS Systems Manager to automate the migration of each application.

Answer

Manually create a spreadsheet of all applications and their dependencies, and update it weekly.

Question 6

A company is migrating a large Hadoop cluster to Amazon EMR. The cluster uses HDFS for storage. The company wants to decouple compute and storage to reduce costs. Which approach should the company take?

Accepted Answer

Use Amazon S3 as the data store and EMRFS. The correct approach is Option A: Use Amazon S3 as the data store with EMRFS (EMR File System). This decouples compute and storage because Amazon EMR clusters can read/write data directly to S3, allowing the cluster to be terminated when not needed while data persists in S3. Option B (FSx for Lustre) is a high-performance file system but still ties compute to storage. Option C (EFS) is not optimized for Hadoop workloads. Option D (EBS volumes) are attached to the EC2 instances, coupling compute and storage.

Answer

Use Amazon FSx for Lustre

Answer

Use Amazon EFS for HDFS

Answer

Use EBS volumes for HDFS

Question 7

A company is migrating a multi-tier web application to AWS. The application uses sticky sessions (session affinity). The company wants to use an Application Load Balancer (ALB). How should the architect configure the ALB to support sticky sessions?

Accepted Answer

Enable stickiness on the target group and set a cookie expiration duration.. ALB supports sticky sessions by enabling stickiness on the target group and setting a cookie expiration duration. Option A is wrong because ALB uses cookies for session affinity, not a custom header. Option C is wrong because the question specifies using an ALB, not an NLB, and proxy protocol is for preserving client IP, not sticky sessions. Option D is wrong because placing ElastiCache in front of the ALB is not a load balancer configuration; it is an external solution for storing session data.

Answer

Configure the ALB listener to use a custom header for session affinity.

Answer

Use a Network Load Balancer (NLB) and enable proxy protocol.

Answer

Place an Amazon ElastiCache cluster in front of the ALB to store session data.

Question 8

A company is designing a hybrid cloud architecture that requires low-latency connectivity between on-premises and AWS. The company has multiple branch offices connecting to a central data center. The data center must be connected to AWS with 10 Gbps throughput and high availability. Which solution should the company choose?

Accepted Answer

Order two AWS Direct Connect connections from different providers and configure them in a LAG.. The requirement for 10 Gbps throughput and high availability mandates using two AWS Direct Connect connections from different providers, configured as a Link Aggregation Group (LAG). LAG aggregates multiple connections into a single logical interface, providing both increased bandwidth and redundancy. A single Direct Connect connection with a backup VPN (Option B) would not meet the 10 Gbps throughput requirement, as VPNs are typically limited to lower bandwidth and introduce latency. Option A and C rely on VPNs, which cannot guarantee 10 Gbps throughput and may suffer from internet-based variability.

Answer

Use AWS Transit Gateway to connect multiple VPCs to on-premises via a single VPN.

Answer

Use a single AWS Direct Connect connection with a backup VPN over the internet.

Answer

Set up multiple AWS Site-to-Site VPN connections from the data center to the VPC.

Question 9

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

Accepted Answer

Edit the CloudFormation template to change the DBInstanceClass and update the stack directly.. Updating the CloudFormation stack directly with a new DBInstanceClass property will cause a reboot of the RDS DB instance, which typically has minimal downtime compared to creating a new instance. This is the standard approach for modifying RDS instance classes. Option A is incorrect because AutoScalingReplacingUpdate is an update policy for Auto Scaling groups, not applicable to RDS DB instances. Option B is incorrect because creating a new stack and deleting the old one would cause significant downtime and is not efficient. Option D is incorrect because AWS OpsWorks is not used for managing RDS instances.

Answer

Modify the DBInstanceClass property in the CloudFormation template and use an UpdatePolicy of AutoScalingReplacingUpdate.

Answer

Create a new CloudFormation stack with the new DB instance class and delete the old stack.

Answer

Use AWS OpsWorks to manage the DB instance and apply the change.

Question 10

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

Accepted Answer

Increase both memory and vCPU to 4 GB and 2 vCPUs.. Increasing both vCPU and memory improves performance for CPU-bound tasks and prevents memory contention. Option A is wrong because increasing the number of tasks (horizontal scaling) does not reduce latency for a single request if the task itself is underpowered; it distributes load but does not address high CPU on each task. Option B is wrong because increasing only vCPU might alleviate CPU pressure but could still be limited by memory if the application is also memory-intensive; however, increasing both ensures no bottleneck. Option D is wrong because increasing memory alone does not address the high CPU utilization.

Answer

Increase the number of tasks (desired count) to distribute the load.

Answer

Increase the vCPU to 2 while keeping 2 GB memory.

Answer

Increase the memory to 4 GB while keeping 1 vCPU.

Question 11

A company's AWS environment includes multiple VPCs across several accounts that are connected via a transit gateway. The network team wants to monitor all network traffic between VPCs for security analysis. Which solution is the most scalable and cost-effective?

Accepted Answer

Enable VPC Flow Logs and publish them to a central S3 bucket, then use Amazon Athena to query the logs.. VPC Flow Logs capture IP traffic metadata (not full packets) and can be centrally published to an S3 bucket across accounts using a central logging account. Querying with Athena is serverless, scales automatically, and incurs cost only for data scanned, making it the most scalable and cost-effective solution for security analysis of inter-VPC traffic.

Answer

Use AWS Traffic Mirroring to mirror all traffic to a central inspection appliance.

Answer

Enable VPC Flow Logs for each VPC and stream them to Amazon CloudWatch Logs in each account.

Answer

Place a network load balancer in each VPC and capture traffic using a packet sniffer.

Question 12

A company is building a serverless application using AWS Lambda. The Lambda function needs to process files uploaded to an S3 bucket. The function should be triggered as soon as a new object is created. How should the architect configure this?

Accepted Answer

Configure S3 to send event notifications to the Lambda function directly. Amazon S3 can directly invoke an AWS Lambda function via event notifications when a new object is created. This is the simplest and most direct integration, requiring no intermediate services. S3 publishes an event to Lambda, which then executes the function synchronously, ensuring near-real-time processing of uploaded files.

Answer

Configure S3 to send event notifications to an SNS topic, which triggers the Lambda function

Answer

Configure S3 to send event notifications to an SQS queue, and have the Lambda function poll the queue

Answer

Configure S3 to send event notifications to Amazon CloudWatch Events, which triggers the Lambda function

Question 13

A company is troubleshooting a Lambda function that is timing out when trying to connect to an RDS database in a VPC. The Lambda function configuration is shown in the exhibit. The function has a timeout of 30 seconds and a memory size of 128 MB. The VPC has subnets in multiple Availability Zones, but the function only has one subnet configured. What change will MOST LIKELY resolve the timeout?

Accepted Answer

Add subnets from other Availability Zones to the VPC configuration.. The Lambda function is timing out because it is configured with only one subnet, but the RDS database is in a VPC with subnets across multiple Availability Zones (AZs). Lambda requires at least one subnet per AZ used by the target resource to ensure network path availability; if the single subnet's AZ becomes unavailable or the RDS instance is in a different AZ, the connection fails. Adding subnets from other AZs provides redundant network paths, resolving the timeout.

Answer

Remove the VPC configuration to allow the function to access the internet.

Answer

Increase the function's memory size to 1024 MB.

Answer

Update the security group to allow all outbound traffic.

Question 14

A company is migrating a large-scale e-commerce platform to AWS. The platform uses a MySQL database with a 2 TB dataset. They want to modernize to Amazon Aurora MySQL with minimal downtime. Which THREE steps should they take? (Select THREE.)

Accepted Answer

Use AWS Schema Conversion Tool (SCT) to convert the existing schema to Aurora MySQL. To migrate a large MySQL database to Amazon Aurora MySQL with minimal downtime, the recommended steps are to use AWS Schema Conversion Tool (SCT) to convert the schema to Aurora-compatible format and AWS DMS with ongoing replication using Change Data Capture (CDC) to synchronize data with near-zero downtime. Setting up an Aurora Replica from the source MySQL instance (Option B) is not possible because Aurora Replicas are only within Aurora, not from an external MySQL source. Options C and D are incorrect as they do not target Aurora.

Answer

Set up an Aurora Replica from the source MySQL instance

Answer

Use Amazon RDS for MySQL instead of Aurora

Answer

Migrate the database to Amazon DynamoDB

Question 15

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. DynamoDB Auto Scaling adjusts write capacity based on actual usage, reducing throttling without manual intervention. Option A is wrong because increasing read capacity does not help with write throttling. Option B is wrong because DAX is a cache for read operations, not writes. Option C is wrong because while switching to On-Demand mode can eliminate throttling, it may be more expensive than Auto Scaling if the workload is predictable; Auto Scaling is the more cost-effective solution for this scenario.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 16

A company is migrating a large number of files from on-premises to Amazon S3. The files are accessed frequently and require low latency. Which TWO AWS services can help accelerate the migration? (Choose TWO.)

Accepted Answer

AWS DataSync. Correct answers: C (AWS DataSync) and E (AWS Snowball Edge). AWS DataSync automates and accelerates transferring large amounts of data over the network, making it ideal for frequent, low-latency access. AWS Snowball Edge is a petabyte-scale data transport solution that uses secure physical devices to transfer large datasets offline, bypassing network constraints. Option A (AWS Storage Gateway) is a hybrid storage service, not a migration accelerator. Option B (AWS CloudFormation) is for infrastructure as code, not data transfer. Option D (Amazon S3 Transfer Acceleration) speeds up uploads but is a feature of S3, not a standalone migration service.

Answer

AWS Storage Gateway

Answer

AWS CloudFormation

Answer

Amazon S3 Transfer Acceleration

Question 17

A company is migrating a critical application to AWS. The migration plan includes a pilot light strategy. The company has set up a small replica of the environment in AWS. During a disaster, the company wants to quickly provision the full production environment. Which AWS service is best suited for this purpose?

Accepted Answer

AWS CloudFormation. AWS CloudFormation is the best service for this scenario because it allows you to define the entire infrastructure as code in templates, which can be stored and then quickly executed to provision the full production environment during a disaster. This aligns with the pilot light strategy, where a small replica is already running and CloudFormation can rapidly scale it up. Option A (OpsWorks) is wrong because it is configuration management service for Chef/Puppet, not for quickly provisioning full environments. Option B (Elastic Beanstalk) is wrong because it is designed for deploying web applications, not for provisioning custom infrastructure. Option D (CodeDeploy) is wrong because it handles application deployments, not infrastructure provisioning.

Answer

AWS OpsWorks

Answer

AWS Elastic Beanstalk

Answer

AWS CodeDeploy

Question 18

A company is migrating a web application to AWS. The application runs on EC2 instances behind an Application Load Balancer. The exhibit shows the current running instances. The company wants to ensure high availability across multiple Availability Zones. Which action should the company take?

Accepted Answer

Change the m5.xlarge instance in us-east-1c to an m5.large in us-east-1c or move it to another AZ.. The current instance distribution shows an m5.large in us-east-1b (or similar) and an m5.xlarge in us-east-1c, which is inconsistent. To ensure high availability across multiple Availability Zones, the company should either change the m5.xlarge to an m5.large to match instance types, or move it to a different AZ to better distribute instances. This avoids a single point of failure and ensures balanced capacity. Option A is incorrect because adding more instances to us-east-1a does not improve AZ diversity. Option C is incorrect because terminating the m5.xlarge and launching an m5.large in the same AZ does not change the AZ distribution. Option D is incorrect because placing all instances in a single AZ eliminates high availability.

Answer

Launch additional m5.large instances in us-east-1a.

Answer

Terminate the m5.xlarge instance in us-east-1c and launch an m5.large in the same AZ.

Answer

Place all instances in a single AZ and use an Auto Scaling group.

Question 19

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

Accepted Answer

Create an Aurora read replica and direct read queries to it.. Creating an Aurora read replica offloads read queries from the primary DB instance, reducing CPU load on it. Option C is correct because implementing an ElastiCache for Redis caching layer reduces the number of repeated read queries hitting the database, further lowering CPU utilization. Option B is wrong: while increasing the DB instance class could provide more CPU resources, it does not reduce load—it only scales up, which is not a best practice for immediate load reduction without code changes. Option D is wrong because Performance Insights is a monitoring tool for identifying performance bottlenecks, not a direct mechanism to reduce database load. Option E is wrong because increasing the Auto Scaling group size only scales the application tier, which would increase traffic to the database, worsening the CPU issue.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Amazon RDS Performance Insights to identify slow queries.

Answer

Increase the Auto Scaling group maximum size to handle more traffic.

Question 20

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

Accepted Answer

The user can describe instances but cannot terminate instances in any region.. The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer

The user cannot describe instances or terminate instances.

Answer

The user can terminate instances and describe instances.

Answer

The user can describe instances but cannot terminate any instances.