SAP-C02 Practice Exam 59 — 20 Questions

Question 1

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket with versioning enabled and a DeletionPolicy of Retain. The stack is deleted. What happens to the bucket and its objects?

Accepted Answer

The bucket and its objects are retained. Option D is correct. With DeletionPolicy set to Retain, the bucket is preserved along with all its objects when the stack is deleted. Option A is wrong because the bucket is not deleted. Option B is wrong because versioning status remains as set. Option C is wrong because buckets with versioning enabled can be deleted via console with force delete option, but CloudFormation respects DeletionPolicy.

Answer

The bucket and all its objects are deleted

Answer

The bucket is deleted only if it is empty

Answer

The bucket is deleted, but versioning information is retained

Question 2

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

Accepted Answer

Assign Elastic IP addresses to the Network Load Balancer.. Options B and D are correct because assigning an Elastic IP to the NLB provides static IPs, and using a Global Accelerator provides two static IPs. Option A is wrong because it doesn't provide static IPs. Option C is wrong because it's for ALB, not NLB. Option E is wrong because EIPs cannot be attached to instances behind NLB directly.

Answer

Attach an Elastic IP to each EC2 instance.

Answer

Configure an Application Load Balancer instead of NLB.

Answer

Use AWS WAF to allow traffic from the partners' IP ranges.

Question 3

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

Accepted Answer

Create one or more RDS read replicas and direct read queries to the replica endpoint.. Option C is correct because setting up RDS read replicas offloads read traffic from the primary instance, and can be done with zero application changes if the application uses a separate endpoint. Option A is wrong because increasing instance size is a vertical scaling approach but may not help with complex joins. Option B is wrong because ElastiCache requires application code changes. Option D is wrong because DynamoDB is a different database and would require significant application rework.

Answer

Migrate the database to Amazon DynamoDB Global Tables.

Answer

Implement Amazon ElastiCache in front of the database to cache query results.

Answer

Increase the DB instance class to a larger size with more vCPUs.

Question 4

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

Accepted Answer

The previous version is permanently deleted, but the delete marker remains.. Option B is correct because the lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted. Option A is wrong because the delete marker remains. Option C is wrong because only noncurrent versions expire. Option D is wrong because the delete marker is not expired.

Answer

All versions of the object are permanently deleted.

Answer

The delete marker is removed, and the object becomes current again.

Answer

The object is permanently deleted along with the delete marker.

Question 5

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to write to CloudWatch Logs.. Option B is correct because if the Lambda execution role lacks logs:CreateLogGroup and logs:PutLogEvents permissions, Lambda cannot write logs. Option A is wrong because the log group exists but has 0 stored bytes. Option C is wrong because retention policy doesn't prevent new logs. Option D is wrong because the log group exists.

Answer

The Lambda function is exceeding the CloudWatch Logs API rate limits.

Answer

The log group retention policy is set to 7 days, which expired old logs.

Answer

The log group was deleted and not recreated.

Question 6

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

Accepted Answer

Create a read replica from the latest automated snapshot and enable Performance Insights on the replica.. Option B is correct because creating a read replica from the latest snapshot provides a near-current copy without impacting production. Option A is wrong because enabling Performance Insights on the current instance adds overhead. Option C is wrong because querying the production database directly affects performance. Option D is wrong because CloudWatch metrics alone do not show query-level details.

Answer

Use the enhanced monitoring feature to collect OS-level metrics on the production instance.

Answer

Review Amazon CloudWatch metrics for the production DB instance to identify the cause.

Answer

Enable Performance Insights on the production instance to analyze queries.

Question 7

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

Accepted Answer

Yes, because the request matches the Allow condition and the Deny condition does not apply.. Option A is correct. The first statement allows GET from the specified IP range. The second statement denies all actions if not using HTTPS. Since the request uses HTTPS (SecureTransport true), the Deny condition does not apply, so the Allow takes effect.

Answer

No, because the Deny statement explicitly denies all actions.

Answer

Yes, because the IP address is within the allowed range.

Answer

No, because the Deny statement overrides the Allow statement.

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

Accepted Answer

The 'ec2:StartInstances' action does not support resource-level conditions.. Option B is correct because the Condition block requires the resource tag to be 'Environment: production', but the action 'StartInstances' does not support resource-level authorization; it requires 'ec2:StartInstances' to be allowed without conditions, or the condition must be on the request. AWS evaluates conditions on the resource only for actions that support it. Option A is wrong because the policy allows all actions. Option C is wrong because the policy does not enforce MFA. Option D is wrong because the policy is attached to a group, not a user, but that should still work.

Answer

The policy is attached to a group, not directly to the user.

Answer

The user does not have MFA enabled.

Answer

The policy does not allow 'ec2:StartInstances' on all resources.

Question 9

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

Accepted Answer

Move the temporary data to an instance store volume if the instance type supports it.. Option B is correct because instance store volumes are ephemeral but provide low-cost storage; however, they are not durable. For temporary data, using an EBS volume with snapshots is not cost-effective. Option A is wrong because RAID with additional EBS volumes increases cost. Option C is wrong because increasing IOPS adds cost. Option D is wrong because S3 is not block-level storage.

Answer

Increase the IOPS of the current EBS volume to improve performance.

Answer

Use Amazon S3 for temporary data storage.

Answer

Add additional EBS volumes and set up RAID 1 for mirroring.

Question 10

A company runs a production database on Amazon RDS for PostgreSQL. They need to perform a major version upgrade with minimal downtime. Which strategy should they use?

Accepted Answer

Create a read replica of the current database using the new version, promote it, and update the connection string.. Option D is correct because creating a read replica with the new version, promoting it, and switching DNS minimizes downtime. Option A is wrong because in-place upgrade causes downtime. Option B is wrong because snapshots take time. Option C is wrong because DMS has overhead and potential lag.

Answer

Use AWS Database Migration Service (DMS) to replicate data to a new instance.

Answer

Create a new RDS instance with the new version and migrate data using pg_dump.

Answer

Take a snapshot of the database, perform an in-place upgrade, and restore if needed.

Question 11

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

Accepted Answer

The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.. Option B is correct because API Gateway caches authorizer responses; if the cache is enabled and the token is cached with a deny, subsequent requests with the same token will fail. Option A is wrong because the authorizer is being invoked. Option C is wrong because token expiration would cause a different error. Option D is wrong because the Lambda function returns a policy.

Answer

The Lambda function is returning a malformed IAM policy.

Answer

The token has expired.

Answer

The Lambda authorizer is not being invoked due to throttling.

Question 12

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

Accepted Answer

Configure an SQS queue as the Lambda event source with a dead-letter queue for failed messages.. Option D is correct because SQS with a dead-letter queue provides reliable capture and retry of failed Lambda invocations. Option A is wrong because CloudWatch Logs only capture logs, not failed invocations. Option B is wrong because SNS does not store messages for retries. Option C is wrong because EventBridge does not automatically retry failed Lambda invocations.

Answer

Enable CloudWatch Logs for Lambda and create a metric filter to trigger an alarm.

Answer

Use Amazon EventBridge to capture Lambda errors and route them to a recovery function.

Answer

Publish failed invocation details to an SNS topic and subscribe a Lambda function to process them.

Question 13

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics such as CPU and memory usage.. Options A, B, and D are correct. Enabling Performance Insights helps identify queries causing load. Enabling enhanced monitoring provides OS-level metrics. Using RDS events can indicate maintenance or issues. C is wrong because increasing instance size is a remedy, not a diagnostic step. E is wrong because Multi-AZ is for high availability, not performance diagnosis.

Answer

Increase the instance size to provisioned IOPS to handle the load.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 14

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Option D is correct because S3 default encryption ensures that all objects are encrypted at rest using SSE-S3 or SSE-KMS, regardless of whether the upload request specifies encryption. Option A is wrong because bucket policies cannot enforce encryption; they can deny uploads without encryption headers but are not the simplest method. Option B is wrong because S3 Access Points are used for managing access, not encryption. Option C is wrong while valid, it's more complex than simply enabling default encryption.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The operations team notices that stack updates frequently fail because of updates to resources that are not supported for updates. What is the BEST way to handle this?

Accepted Answer

Use a change set to review the proposed changes before executing the update.. The best practice is to use a change set to preview changes and identify unsupported updates before executing the update.

Answer

Use AWS Config rules to prevent updates.

Answer

Delete the stack and create a new one for each update.

Answer

Use AWS Service Catalog to enforce version control.

Question 16

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

Accepted Answer

The AWS CLI is configured to use a different region than where the stack was deployed.. Option A is correct because the CLI command is querying the wrong region. The stack was created in us-east-1 but the CLI default region might be different. Option B is wrong because the stack was created successfully. Option C is wrong because outputs are returned correctly. Option D is wrong because the stack name is exactly as used.

Answer

The stack was deleted after creation.

Answer

The stack name is case-sensitive and should be 'MyApp'.

Answer

The '--query' parameter is incorrectly formatted.

Question 17

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.. Option C is correct by using Origin Access Control (OAC) to restrict S3 bucket access to only CloudFront. Option A is wrong because it does not restrict direct access. Option B is wrong because Object Ownership is not a security feature. Option D is wrong because CloudFront key pairs are for signed URLs, not bucket access.

Answer

Set S3 Object Ownership to BucketOwnerPreferred.

Answer

Configure the S3 bucket policy to allow public read access.

Answer

Generate CloudFront key pairs and require signed URLs for all content.

Question 18

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Accepted Answer

Application Load Balancer (ALB) with stickiness and SSL termination.. Option C is correct because ALB supports sticky sessions (session affinity) and SSL termination. Option A is wrong because NLB does not support sticky sessions natively. Option B is wrong because CLB is legacy and less recommended. Option D is wrong because Lambda is not a load balancer.

Answer

Network Load Balancer (NLB) with target group stickiness.

Answer

Classic Load Balancer (CLB) with SSL termination at the instance.

Answer

AWS Lambda with API Gateway.

Question 19

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

Accepted Answer

Yes, because t3.large supports both architectures.. Option A is correct because the exhibit shows SupportedArchitectures includes both x86_64 and arm64, so t3.large supports both. Option B is wrong because it does support arm64. Option C is wrong because the architecture is chosen at launch, not automatically. Option D is wrong because t3.large is current generation.

Answer

No, because t3.large instances only support x86_64 architecture.

Answer

No, because t3.large is not a current generation instance type.

Answer

Yes, but only if they use a custom AMI that supports both architectures.

Question 20

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Accepted Answer

Enable default encryption on each S3 bucket.. Option B is correct because S3 default encryption can be set at the bucket level for all objects. Option A is wrong because bucket policies can enforce encryption but require a policy per bucket. Option C is wrong because AWS Config can detect noncompliant buckets but not enforce encryption. Option D is wrong because IAM policies cannot enforce encryption on S3 buckets.

Answer

Create an IAM policy that denies s3:PutObject unless encryption headers are present.

Answer

Use an S3 bucket policy to deny PutObject without encryption.

Answer

Use AWS Config to automatically remediate noncompliant buckets.

SAP-C02 Practice Exam 59 — 20 Questions

Exhibit

SAP-C02 Practice Exam 59 — 20 Questions

Exhibit