SAP-C02 Practice Exam 56 — 20 Questions

Question 1

A solutions architect notices that an Auto Scaling group's instances are continuously being terminated and replaced. CloudWatch logs show that health checks are failing due to high memory usage. The instances run a memory-intensive application. What should the architect do to improve stability?

Accepted Answer

Create a CloudWatch alarm for memory utilization and attach it to a scaling policy.. Option A is correct because adding a memory alarm allows the Auto Scaling group to scale out before memory exhaustion causes failures. Option B is wrong because increasing instance count per AZ doesn't address the root cause of memory pressure. Option C is wrong because memory-optimized instances provide more memory per instance, reducing the likelihood of failure. Option D is wrong because a scheduled scaling policy is for predictable traffic, not for memory-driven scaling.

Answer

Change the instance type to a memory-optimized family like R5.

Answer

Use a scheduled scaling policy to add instances during peak hours.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Question 2

A solutions architect applies the IAM policy shown in the exhibit to an IAM user. The user attempts to upload an object to the S3 bucket 'my-bucket' without specifying the 'x-amz-server-side-encryption' header. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks any PutObject request that does not specify AES256 encryption.. Option B is correct. The Deny statement with StringNotEquals will match because the condition s3:x-amz-server-side-encryption is not set (or evaluates to a value not equal to AES256). Since the Deny statement applies, the request is denied. Option A is wrong because the Allow statement requires the condition to be true; if not specified, the condition is not met. Option C is wrong because the Deny statement explicitly denies if encryption is not AES256. Option D is wrong because the condition is evaluated.

Answer

The upload succeeds because the Allow statement grants the s3:PutObject permission.

Answer

The upload succeeds because the Deny statement only applies when the header is present but set to a value other than AES256.

Answer

The upload fails because the condition is malformed and causes an error.

Question 3

A company uses AWS Elastic Beanstalk to deploy a web application. They want to update the environment's configuration to use a larger instance type without any downtime. Which update policy supports this?

Accepted Answer

Rolling. Option C is correct because Rolling update with batch size updates instances in batches, keeping the environment running. Option A is wrong because All at once replaces all instances simultaneously, causing downtime. Option B is wrong because Immutable update launches new instances in a separate ASG and then swaps, which also causes brief downtime? Actually, immutable updates swap the entire environment, but can cause a brief interruption. However, Rolling update is designed for zero downtime. Option D is wrong because Blue/Green deployment is not built into Elastic Beanstalk natively as an update policy; it's a manual approach.

Answer

All at once

Answer

Blue/Green

Answer

Immutable

Question 4

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

Accepted Answer

Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.. Option A is correct because using S3 default encryption with an AWS KMS CMK and enabling automatic key rotation meets the requirement. Option B is wrong because SSE-S3 uses Amazon S3-managed keys, not KMS. Option C is wrong because SSE-C uses customer-provided keys, not KMS. Option D is wrong because client-side encryption does not use S3 server-side encryption.

Answer

Use SSE-S3 (Amazon S3-managed keys) and rely on S3's automatic key rotation.

Answer

Use SSE-C (customer-provided keys) and manage key rotation manually.

Answer

Use client-side encryption with a KMS CMK and upload the encrypted data.

Question 5

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

Accepted Answer

Mount an EFS volume to the instances for log storage. Option A ensures logs are sent to CloudWatch in near real-time. Option B ensures that if the instance fails, logs are not lost by writing to a persistent volume. Option C (S3) is not necessary if using CloudWatch Logs. Option D (SQS) adds complexity. Option E (CloudWatch agent with auto-scaling) is not a separate feature.

Answer

Use the CloudWatch agent with the auto-scaling group lifecycle hooks

Answer

Configure the Auto Scaling group to send logs to Amazon S3 on instance termination

Answer

Use Amazon SQS to buffer log events before sending to CloudWatch Logs

Question 6

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

Accepted Answer

The health check target path or port is misconfigured.. Option C is correct because if the health check target is misconfigured (e.g., wrong path or port), healthy instances may be marked as unhealthy, causing unnecessary replacements and errors. Option A is wrong because a longer health check interval would reduce unnecessary replacements. Option B is wrong because instance type does not directly affect health checks. Option D is wrong because a smaller Auto Scaling group might cause capacity issues but not necessarily errors due to unhealthy instances.

Answer

The EC2 instances are of a burstable performance type.

Answer

The Auto Scaling group's minimum size is too small.

Answer

The health check interval is too long.

Question 7

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Option D is correct because increasing the number of DPUs (data processing units) allocated to the Glue job can parallelize processing and reduce runtime. Option A is wrong because converting to Parquet is a good practice but does not reduce processing time if the job is CPU-bound. Option B is wrong because increasing the timeout does not speed up processing. Option C is wrong because S3 Transfer Acceleration speeds up uploads, not Glue processing.

Answer

Increase the Glue job timeout setting to 24 hours.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Answer

Convert the input data from CSV to Parquet format.

Question 8

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically deleted after 30 days. The current lifecycle policy is configured to expire objects after 30 days, but objects are not being deleted. What is the most likely cause?

Accepted Answer

The bucket has S3 Object Lock enabled with a retention period exceeding 30 days.. Option C is correct because S3 Lifecycle policies require proper permissions to execute actions. Option A is wrong because S3 Object Lock can prevent deletion if retention period is set. Option B is wrong because versioning does not prevent lifecycle expiration; expired delete markers are removed. Option D is wrong because storage class transitions do not affect expiration.

Answer

The bucket has versioning enabled, and lifecycle rules apply only to current versions.

Answer

The objects are stored in the S3 Glacier Deep Archive storage class.

Answer

The IAM role used by S3 Lifecycle lacks the s3:DeleteObject permission.

Question 9

A solutions architect runs the AWS CLI command shown in the exhibit to troubleshoot a failed CloudFormation stack creation. What is the most likely cause of the failure?

Accepted Answer

The LaunchConfigurationName property in the Auto Scaling group resource was not provided or was an incorrect type.. Option B is correct. The error message indicates that the LaunchConfigurationName property must be a string, meaning it was probably not provided or was of the wrong type. Option A is wrong because the error does not mention IAM. Option C is wrong because the error is about LaunchConfigurationName, not VPC. Option D is wrong because the error is about the creation, not the resource type itself.

Answer

The VPC configuration is incorrect, causing the Auto Scaling group to fail.

Answer

The Auto Scaling group resource type is not supported in the region.

Answer

The IAM role for the stack does not have permission to create Auto Scaling groups.

Question 10

A company uses Amazon RDS for PostgreSQL and needs to apply a minor version upgrade. They want to minimize downtime. Which approach should they use?

Accepted Answer

Use a Multi-AZ deployment and apply the upgrade. Option B is correct because Multi-AZ deployments can be upgraded with minimal downtime as the standby is upgraded first, then failover occurs. Option A is wrong because upgrades always require some downtime unless Multi-AZ. Option C is wrong because creating a read replica and promoting it is a manual process that can cause data loss if not careful. Option D is wrong because modifying the DB parameter group does not upgrade the version.

Answer

Apply the upgrade during the maintenance window

Answer

Create a read replica, upgrade it, and promote it

Answer

Modify the DB parameter group to set the version

Question 11

A company has a serverless application using AWS Lambda and Amazon API Gateway. The application experiences cold starts that cause latency spikes. Which solution would reduce the impact of cold starts?

Accepted Answer

Configure Provisioned Concurrency for the Lambda function.. Option D is correct because Provisioned Concurrency keeps a number of execution environments warm. Option A is wrong because increasing memory reduces cold start duration but does not eliminate it. Option B is wrong because it increases cost and complexity. Option C is wrong because it reduces performance.

Answer

Increase the Lambda function memory allocation.

Answer

Decrease the Lambda function timeout.

Answer

Use a VPC and enable Lambda to access resources in the VPC.

Question 12

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application stores session data locally on the instances. The company wants to improve availability and scalability. What should a solutions architect recommend?

Accepted Answer

Move session state to Amazon ElastiCache and make the application stateless.. Option C is correct because moving session state to ElastiCache makes the application stateless, allowing instances to be added/removed without session loss. Option A is wrong because Auto Scaling without session management will cause session loss. Option B is wrong because sticky sessions alone don't prevent loss if an instance fails. Option D is wrong because increasing instance size doesn't improve scalability.

Answer

Use Auto Scaling to add more EC2 instances.

Answer

Enable sticky sessions on the ALB.

Answer

Use larger EC2 instances to handle more sessions.

Question 13

A company uses AWS CodeBuild to compile and test code. The build process takes a long time because dependencies are downloaded from the internet each time. The company wants to speed up the build process. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use a custom Docker image in CodeBuild that includes the dependencies. Option A avoids downloading dependencies on every build by using a custom Docker image with pre-installed dependencies. Option B caches dependency files in a persistent S3 bucket. Option C (increase compute) may help but does not address the root cause. Option D (parallel builds) may increase complexity. Option E (CodeArtifact) is for storing artifacts but does not speed up initial download as much as caching.

Answer

Use AWS CodeArtifact to store and retrieve dependencies

Answer

Use local build agents to run builds in parallel

Answer

Increase the compute type of the build environment

Question 14

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

Accepted Answer

Add a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Option D is correct because an S3 bucket policy with a condition that denies PutObject if encryption headers are not present enforces encryption for all new objects. Option A is wrong because default encryption only encrypts objects that don't specify encryption, but doesn't enforce it. Option B is wrong because pre-signed URLs do not enforce encryption. Option C is wrong because CloudFront does not enforce encryption at the S3 level.

Answer

Use Amazon CloudFront to enforce HTTPS.

Answer

Enable S3 default encryption on the bucket.

Answer

Require pre-signed URLs for all uploads.

Question 15

A company uses Amazon RDS for MySQL for its database. The operations team notices that read queries are slow during peak hours. The application is read-heavy and can tolerate eventual consistency. Which solution would improve read performance with minimal application changes?

Accepted Answer

Create an RDS read replica and direct read traffic to it.. Option B is correct because creating a read replica offloads read traffic from the primary instance, improving read performance. Option A is wrong because increasing the DB instance size may help but is more expensive and not as targeted. Option C is wrong because RDS Proxy is for connection pooling, not read scaling. Option D is wrong because Multi-AZ provides high availability, not read scaling.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Multi-AZ deployment for failover support.

Answer

Enable RDS Proxy to pool database connections.

Question 16

A company runs a production database on Amazon RDS for PostgreSQL. The database experiences high write latency during peak hours. The company wants to improve write performance with minimal cost. Which action should a solutions architect take?

Accepted Answer

Use RDS for PostgreSQL with multiple write replicas and configure application-level sharding.. Option D is correct because using multiple write replicas with sharding distributes the write load. Option A is wrong because adding more read replicas does not help write performance. Option B is wrong because Multi-AZ does not improve write performance; it provides failover. Option C is wrong while increasing IOPS helps, it may not be cost-effective compared to sharding.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Add multiple read replicas in different Availability Zones.

Answer

Increase the allocated storage and provisioned IOPS.

Question 17

A solutions architect deployed an AWS Lambda function using a deployment package. The function logs the error shown in the exhibit. What is the most likely cause?

Accepted Answer

The deployment package does not include the 'express' npm dependency.. Option A is correct. The error indicates that the 'express' module is not found, which means it was not included in the deployment package. Option B is wrong because the function ran, so the handler is correct. Option C is wrong because the Lambda execution role does not affect module availability. Option D is wrong because the error is a missing module, not a memory issue.

Answer

The Lambda function has exceeded the maximum memory limit.

Answer

The Lambda function handler is incorrectly configured.

Answer

The Lambda execution role does not have permissions to access the module.

Question 18

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. Which TWO actions are required?

Accepted Answer

Add a manual approval action to the pipeline. Options A and D are correct. A: You need an IAM role for the approval action to allow the approver to review. D: The pipeline must be configured with a manual approval action. Option B is wrong because SNS is optional for notification, not required. Option C is wrong because a Lambda function is not required for manual approval. Option E is wrong because CloudWatch Events can be used but not required.

Answer

Create a Lambda function to trigger the approval

Answer

Set up a CloudWatch Events rule to invoke the approval

Answer

Configure an SNS topic to notify the approver

Question 19

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

Accepted Answer

Configure a Direct Connect gateway and attach a VPN to it, then advertise the same prefixes via BGP with lower priority on the VPN.. Option B is correct because AWS VPN CloudHub provides a hub-and-spoke model for multiple VPN connections, but for failover, using BGP with Direct Connect and VPN as backup is standard. However, the best answer is to use a Direct Connect gateway with a VPN attachment for failover. Option A is wrong because it adds latency. Option C is wrong because it bypasses Direct Connect. Option D is wrong because it does not provide automatic failover.

Answer

Use a NAT gateway to route traffic through the internet as a backup.

Answer

Create a Site-to-Site VPN connection and update route tables to point all traffic to the VPN.

Answer

Set up a second Direct Connect connection from a different provider.

Question 20

A company is modernizing a legacy application by breaking it into microservices. The application has a complex set of dependencies and requires gradual migration. Which design pattern should the company use?

Accepted Answer

Strangler Fig pattern. B is correct because Strangler Fig pattern allows incremental replacement of functionality. A is wrong because Blue/Green is a deployment strategy. C is wrong because Circuit Breaker is for fault tolerance. D is wrong because Saga is for distributed transactions.

Answer

Blue/Green deployment pattern

Answer

Saga pattern

Answer

Circuit Breaker pattern