SAP-C02 Practice Exam 54 — 20 Questions

Question 1

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create one or more read replicas in the same Region.. Options A and D are correct. A: Creating a read replica offloads read queries from the primary database. D: Using an RDS Proxy allows connection pooling, reducing overhead. Option B is wrong because Multi-AZ is for high availability, not read scaling. Option C is wrong because increasing instance size can help but is often more expensive than read replicas. Option E is wrong because ElastiCache is for caching data, not for offloading database queries directly.

Answer

Enable Multi-AZ deployment for the database.

Answer

Increase the instance size of the primary database.

Answer

Use Amazon ElastiCache to cache query results.

Question 2

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

Accepted Answer

Create an Aurora read replica and direct read queries to it.. Option A is correct because implementing an ElastiCache caching layer can reduce repeat database queries. Option D is correct because creating an Aurora read replica and directing read traffic to it offloads the primary instance. Option B is wrong because increasing the DB instance class may help but is not a best practice for immediate load reduction. Option C is wrong because increasing Auto Scaling group size does not affect database load. Option E is wrong because enabling Performance Insights is for monitoring, not load reduction.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Amazon RDS Performance Insights to identify slow queries.

Answer

Increase the Auto Scaling group maximum size to handle more traffic.

Question 3

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

Accepted Answer

ECS tasks are being replaced by the service scheduler during deployments or health checks.. Option B is correct because Fargate tasks are ephemeral; they can be replaced due to deployments or health checks, causing loss of local session data. Option A is wrong because ALB sticky sessions are irrelevant if the container itself is replaced. Option C is wrong because scaling out does not cause individual container replacement. Option D is wrong because the issue is about session persistence, not security groups.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS service is configured to scale out, causing new tasks to be created without existing session data.

Answer

The Application Load Balancer is not configured with sticky sessions.

Question 4

A company is using AWS CloudFormation to manage infrastructure. The operations team wants to be notified when a stack operation fails. Which approach is the MOST efficient?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack. Option B is correct because CloudFormation can directly publish to SNS topics on stack events, including failures. Option A is inefficient because it requires polling. Option C is not native. Option D is expensive and complex.

Answer

Create a scheduled CloudWatch Events rule that calls the DescribeStacks API and sends an alert if status is FAILED

Answer

Use a Lambda function that is invoked by CloudFormation via custom resource

Answer

Use Amazon EventBridge to monitor CloudFormation API calls and trigger a Lambda function

Question 5

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS for MySQL database. The stack creation fails with the error 'The following resource(s) failed to create: [DBInstance]'. The solutions architect needs to troubleshoot the issue. Which approach should be taken first?

Accepted Answer

Review the CloudFormation stack events in the AWS Management Console.. Option B is correct because CloudFormation logs events that include detailed status reasons for resource failures. Option A is wrong because RDS events might not capture the specific CloudFormation-related failure. Option C is wrong because deleting the stack is premature without understanding the cause. Option D is wrong because CloudTrail logs API calls, but the failure reason is in CloudFormation events.

Answer

Check the RDS console for any database events.

Answer

Delete the stack and deploy again with the same parameters.

Answer

Use AWS CloudTrail to view the CreateStack API call.

Question 6

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

Accepted Answer

Use a step scaling policy with a lower scale-out threshold and a larger adjustment. Option B is correct because step scaling policies respond more aggressively to larger deviations, helping to add capacity faster. Option A (increase memory) does not directly affect scaling. Option C (increase health check interval) would slow detection of unhealthy tasks. Option D (use target tracking) is reactive and may not handle spikes well.

Answer

Increase the task memory allocation to improve performance

Answer

Increase the health check interval to reduce the number of tasks marked unhealthy

Answer

Use a target tracking scaling policy with a higher target value

Question 7

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The deployment pipeline includes a source stage, a build stage using CodeBuild, and a deploy stage. Recently, deployments have been failing in the deploy stage with the error: 'The environment is in an invalid state for this operation.' The developer confirms the build artifacts are correct. What is the MOST likely cause?

Accepted Answer

Another deployment or configuration update is already in progress on the environment. Option C is correct because if there is an ongoing update or configuration change, Elastic Beanstalk prevents concurrent operations. Option A is wrong because CodePipeline does not require a specific instance type. Option B is wrong because insufficient capacity would cause a different error. Option D is wrong because the environment URL being unavailable is a symptom, not cause.

Answer

The environment's load balancer is not available

Answer

The environment's Auto Scaling group has insufficient capacity

Answer

The Elastic Beanstalk environment uses a t2.micro instance type which is not supported by CodePipeline

Question 8

A solutions architect runs the above commands for an EC2 instance. The instance state is 'running' but the system status is 'impaired'. What should the solutions architect do to restore the instance?

Accepted Answer

Stop and start the instance.. Option C is correct. AWS recommends stopping and starting the instance to move it to new underlying hardware when system status checks fail. Option A is wrong because the instance is already running. Option B is wrong because reboot may not resolve hardware issues. Option D is wrong because changing instance type does not fix underlying hardware impairment.

Answer

Start the instance.

Answer

Modify the instance type.

Answer

Reboot the instance.

Question 9

A company uses AWS Lambda to process incoming messages from an SQS queue. The Lambda function is triggered by SQS and processes messages in batches of 10. Recently, the number of messages has increased significantly, and some messages are being processed multiple times. What should a solutions architect do to ensure exactly-once processing?

Accepted Answer

Set the Lambda function's reserved concurrency to a higher value to prevent throttling.. Option C is correct because enabling the Lambda function's reserved concurrency ensures that the function can scale to handle the increased load without throttling, reducing the chance of reprocessing due to visibility timeouts. Option A is wrong because increasing the SQS visibility timeout solely may not prevent reprocessing if the function is throttled. Option B is wrong because enabling SQS FIFO queues provides exactly-once processing, but Lambda does not support FIFO triggers. Option D is wrong because using a DynamoDB table for idempotency keys is a valid approach for exactly-once processing, but it adds complexity and latency; the simpler solution is to manage concurrency.

Answer

Use a DynamoDB table to store unique message IDs and check for duplicates before processing.

Answer

Increase the visibility timeout of the SQS queue to 30 minutes.

Answer

Change the SQS queue to a FIFO queue and enable content-based deduplication.

Question 10

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

Accepted Answer

Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation. Option D is correct because AWS Config rules with automatic remediation via Systems Manager Automation documents can enforce encryption and public access settings across accounts using an organization-wide conformance pack. Option A is too manual. Option B (Service Control Policies) can prevent public access but not enforce encryption on existing buckets. Option C (CloudWatch Events) requires per-account setup and custom Lambda functions.

Answer

Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption

Answer

Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption

Answer

Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts

Question 11

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally capture all VPC flow logs for analysis in Amazon Athena. What is the MOST cost-effective way to store the flow logs?

Accepted Answer

Publish VPC Flow Logs to an Amazon S3 bucket with S3 Intelligent-Tiering enabled.. Option A is correct because VPC Flow Logs can be published directly to S3, and using S3 Intelligent-Tiering optimizes costs for logs that may be accessed infrequently. Option B is wrong because CloudWatch Logs is more expensive for long-term storage. Option C is wrong because Kinesis Data Firehose adds cost and complexity. Option D is wrong because it duplicates storage.

Answer

Publish VPC Flow Logs to both CloudWatch Logs and S3 for redundancy.

Answer

Use Amazon Kinesis Data Firehose to stream flow logs to an S3 bucket.

Answer

Publish VPC Flow Logs to Amazon CloudWatch Logs and export them to S3 after 30 days.

Question 12

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared EFS file system for persistent data. The operations team notices that during scale-in events, some requests fail because the instance is terminated while still processing. What is the BEST way to prevent request failures during scale-in?

Accepted Answer

Use lifecycle hooks to put the instance in a 'terminating:wait' state and complete request processing. Option C is correct because lifecycle hooks allow the Auto Scaling group to wait for a custom action (e.g., drain connections) before terminating an instance. Option A (increase cooldown) delays scaling but does not prevent interruption. Option B (decrease scale-in threshold) reduces the chance but not the issue. Option D (use a Network Load Balancer) does not help with instance termination.

Answer

Use a Network Load Balancer with connection draining enabled

Answer

Increase the cooldown period for the Auto Scaling group

Answer

Decrease the scale-in threshold to reduce the frequency of termination

Question 13

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

Accepted Answer

Use the RDS Multi-AZ DNS name (CNAME) that automatically updates after failover.. Option B is correct because using the RDS cluster endpoint (for Aurora) or the Multi-AZ DNS name (which automatically points to the current primary) ensures the application reconnects with minimal disruption. Option A is wrong because read replicas are for read scaling, not automatic failover. Option C is wrong because using an Elastic IP with RDS is not supported. Option D is wrong because a Network Load Balancer adds complexity and latency.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Create a read replica in another Region and promote it during failover manually.

Answer

Configure a Network Load Balancer in front of the RDS instance.

Question 14

A company has a microservices architecture running on Amazon ECS with Fargate. Each service writes logs to CloudWatch Logs. The operations team needs to search across all logs for a specific error pattern. Currently, they manually query each log group, which is time-consuming. What is the MOST efficient way to enable centralized log search?

Accepted Answer

Use CloudWatch Logs Insights to query all log groups from a single query.. Option A is correct because CloudWatch Logs Insights allows querying multiple log groups in a single query, enabling centralized search. Option B is wrong because subscription filters send logs to a destination, but Kinesis Data Firehose is not designed for ad-hoc search. Option C is wrong because S3 is for long-term storage, not real-time search. Option D is wrong because CloudWatch Contributor Insights analyzes top contributors, not arbitrary patterns.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use CloudWatch Contributor Insights to identify the top error sources.

Answer

Create a subscription filter for each log group that sends logs to a Kinesis Data Firehose delivery stream.

Question 15

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. Option D is correct because DynamoDB Auto Scaling adjusts capacity based on actual usage, reducing throttling. Option A is wrong because changing to on-demand is a valid solution but may be more expensive; Auto Scaling is more cost-effective if usage is predictable. Option B is wrong because DAX is a cache for reads, not writes. Option C is wrong because increasing read capacity doesn't help write throttling.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 16

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team observes that some services are experiencing high latency during peak hours. The team wants to identify the root cause. Which THREE approaches should the team use? (Choose THREE.)

Accepted Answer

Use AWS X-Ray to trace requests through the microservices. Option A provides detailed metrics for each service. Option C helps trace requests across services. Option E shows latency distribution. Option B (CloudTrail) is for API calls. Option D (VPC Flow Logs) is for network traffic analysis, not application latency.

Answer

Enable AWS CloudTrail to log API calls

Answer

Enable VPC Flow Logs to analyze network traffic

Question 17

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to ensure that during a patching cycle, the application remains available and no requests are dropped. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Perform a rolling update using a batch size of 50% with a pause time.. Options B and D are correct. B: Using a lifecycle hook with a custom action can pause the instance before termination, allowing graceful draining. D: Using a rolling update with a batch size ensures that only a portion of instances are patched at a time. Option A is wrong because stopping instances all at once causes downtime. Option C is wrong because increasing desired capacity without draining connections may cause issues. Option E is wrong because Amazon Inspector identifies vulnerabilities but does not implement patching.

Answer

Increase the desired capacity of the Auto Scaling group before patching.

Answer

Stop all instances at the same time to apply patches consistently.

Answer

Use Amazon Inspector to automatically patch instances.

Question 18

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the VPC.. Option C is correct because using a VPC endpoint for S3 (Gateway or Interface) ensures traffic stays within the AWS network. Option A is wrong because internet traffic goes over the public internet. Option B is wrong because a NAT gateway is for outbound internet, not private access to S3. Option D is wrong because S3 Transfer Acceleration uses the internet.

Answer

Use an internet gateway and route traffic through a NAT gateway.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use a NAT gateway and update the route table to direct S3 traffic to the NAT.

Question 19

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

Accepted Answer

Implement a Read Replica and direct read traffic to it.. Option A is correct because using Read Replicas offloads read traffic from the primary instance, allowing the primary to be smaller. Option B is wrong because Reserved Instances reduce cost but do not change the instance size. Option C is wrong because it reduces availability. Option D is wrong because it increases cost.

Answer

Change the DB instance to a Multi-AZ deployment.

Answer

Upgrade to the latest generation instance type.

Answer

Purchase Reserved Instances for the database.

Question 20

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store processed file IDs and check for duplicates before processing.. Options B and D are correct. Using a DynamoDB table to track processed file IDs (B) allows the function to skip duplicates. Enabling S3 event notifications with a prefix and suffix filter (D) reduces the chance of multiple events for the same object. Option A is wrong because increasing Lambda timeout doesn't prevent multiple invocations. Option C is wrong because SQS can help but needs deduplication logic as well. Option E is wrong because S3 Transfer Acceleration is for faster uploads, not idempotency.

Answer

Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Enable S3 Transfer Acceleration on the bucket.