SAP-C02 Practice Exam 60 — 20 Questions

Question 1

A media company runs a video transcoding pipeline on AWS using Amazon EC2 Spot Instances. The pipeline uses a custom AMI with pre-installed software. The operations team notices that the latest AMI is not always used when new instances launch, causing inconsistent transcoding results. What should the team do to ensure that all new Spot Instances use the latest AMI?

Accepted Answer

Use an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store.. Option A is correct because Amazon EC2 Auto Scaling with a launch template can reference the latest AMI ID using SSM Parameter Store. Option B is wrong because updating the AMI ID in the Auto Scaling group requires manual intervention. Option C is wrong because it does not automatically update the AMI. Option D is wrong because CloudFormation does not automatically update the AMI.

Answer

Create a new launch configuration each time a new AMI is released and associate it with the Auto Scaling group.

Answer

Use AWS CloudFormation to update the stack with the new AMI ID and then manually trigger a rolling update.

Answer

Manually update the AMI ID in the EC2 Auto Scaling group configuration every time a new AMI is released.

Question 2

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to implement a change management process that requires approval before stack updates can proceed. Which TWO approaches can achieve this?

Accepted Answer

Create a service role with specific IAM policies and require that updates be initiated with that role.. Options A and D are correct. Using a change set allows review before execution. Using a service role with IAM policies can enforce approval workflows. B is wrong because stack policies protect resources, not control updates. C is wrong because stack sets are for multi-account deployments. E is wrong because it is a manual process, not automated.

Answer

Use AWS CloudFormation StackSets to deploy updates across multiple accounts.

Answer

Manually review all template changes before uploading to S3.

Answer

Configure a stack policy to prevent updates to critical resources.

Question 3

Refer to the exhibit. A company has an Amazon ECS task definition with two containers. The 'web' container is essential, and the 'sidecar' container is not. The 'sidecar' container exits unexpectedly. What will happen to the task?

Accepted Answer

The task continues running as normal.. Option C is correct because non-essential containers can fail without affecting the task. Option A is wrong because only essential container failure stops the task. Option B is wrong because ECS will not restart a non-essential container by default; it depends on the task definition restart policy. Option D is wrong because the sidecar's CPU=0 means it can use up to the available CPU, but it still runs.

Answer

The sidecar container will be marked as essential.

Answer

ECS will automatically restart the sidecar container.

Answer

The ECS task will be stopped.

Question 4

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

Accepted Answer

Create a dynamic scaling policy based on the average CPU utilization metric.. Options A and C are correct. An Auto Scaling group is needed to manage the instances, and a scaling policy based on CPU utilization is needed. Option B is wrong because a scheduled scaling policy is based on time, not CPU. Option D is wrong because a Network Load Balancer is not required. Option E is wrong because CloudWatch alarm is part of the scaling policy but not the primary requirement; the policy itself is needed.

Answer

Configure a scheduled scaling policy to add instances during business hours.

Answer

Replace the ALB with a Network Load Balancer for better performance.

Answer

Create a CloudWatch alarm that sends an email when CPU exceeds 80%.

Question 5

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

Accepted Answer

Add a manual approval action in the pipeline stage with an SNS topic for notification.. Option C is correct because CodePipeline supports a manual approval action using SNS notification. Option A is wrong because approval is not a Lambda function. Option B is wrong because CloudWatch Events is not for approvals. Option D is wrong because approval is a built-in action.

Answer

Use Amazon CloudWatch Events to trigger an SNS topic for approval.

Answer

Create a custom action using AWS CodeDeploy.

Answer

Add a Lambda function that sends an email and pauses the pipeline until a token is provided.

Question 6

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in Europe report slow load times. The CloudFront distribution uses the default cache behavior. What is the MOST cost-effective improvement?

Accepted Answer

Configure CloudFront with multiple origins and use geographic restrictions to route users to the nearest origin.. Option B is correct because adding multiple origins in different regions and using geographic distribution or origin failover reduces latency for users in Europe. Option A is wrong because Lambda@Edge adds cost and complexity. Option C is wrong because cache behaviors do not affect latency. Option D is wrong because Transfer Acceleration is for uploads.

Answer

Enable CloudFront Lambda@Edge to optimize content delivery.

Answer

Use an S3 Transfer Acceleration to speed up content delivery.

Answer

Add additional cache behaviors to serve different content from different origins.

Question 7

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

Accepted Answer

Enable slow query logging and stream logs to Amazon CloudWatch Logs with a retention policy of 30 days.. Option B is correct because CloudWatch Logs can stream RDS slow query logs and retain them for 30 days at low cost. Option A is wrong because storing in S3 directly is not a built-in RDS feature. Option C is wrong because RDS doesn't write logs to EBS volumes by default. Option D is wrong because it requires additional infrastructure and cost.

Answer

Enable slow query logging and use an RDS event subscription to send logs to an SQS queue for processing.

Answer

Enable slow query logging and store logs in an S3 bucket with lifecycle policy to delete after 30 days.

Answer

Enable slow query logging and store logs on the RDS instance's EBS volume, then take daily snapshots.

Question 8

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions query an Amazon RDS for PostgreSQL database. Recently, the company has noticed increased latency and occasional timeouts during peak hours. A solutions architect needs to improve the performance and scalability of the database layer. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Implement Amazon RDS Proxy to manage connection pooling between Lambda and the RDS instance.. Option A is correct because Amazon RDS Proxy handles connection pooling, reducing database load and improving scalability, which directly addresses latency and timeouts. Option B is wrong because Read Replicas help with read-heavy workloads but do not reduce connection overhead. Option C is wrong because DynamoDB Accelerator (DAX) is used for DynamoDB, not RDS. Option D is wrong because increasing instance size is a vertical scaling approach that does not address the connection pooling issue and may still lead to timeouts under high connection counts.

Answer

Enable Amazon DynamoDB Accelerator (DAX) on the RDS instance.

Answer

Add a Multi-AZ RDS Read Replica and modify Lambda to use the Read Replica for queries.

Answer

Increase the instance size of the RDS database to handle more concurrent connections.

Question 9

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Options A, C, and D are correct. Checking AppSpec hooks ensures the validation scripts are correctly defined. Reviewing CodeDeploy agent logs helps identify script failures. Testing the validation script manually on a healthy instance verifies its functionality. Option B is wrong because increasing the deployment timeout does not fix the script failure. Option E is wrong because CodeDeploy does not use Auto Scaling lifecycle hooks for instance health; it uses its own deployment lifecycle.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 10

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application needs to maintain a fixed number of instances and should automatically replace any unhealthy instance. Which scaling policy should be used?

Accepted Answer

Manual scaling with health check replacement. A manual scaling policy set to maintain a fixed number of instances combined with health checks ensures that unhealthy instances are replaced.

Answer

Scheduled scaling policy

Answer

Simple scaling policy

Answer

Target tracking scaling policy

Question 11

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use AWS Config conformance packs deployed via AWS Organizations with automatic remediation using Systems Manager Automation.. Option D is correct because AWS Config conformance packs can be deployed at the organization level using AWS Organizations, allowing centralized management of rules and automatic remediation with SSM Automation. Option A is wrong because manual deployment doesn't scale. Option B is wrong because CloudFormation StackSets require per-account management. Option C is wrong because AWS Config aggregator only aggregates data, doesn't enforce rules.

Answer

Use AWS CloudFormation StackSets to deploy Config rules to all accounts.

Answer

Use AWS Config rules in each account with AWS Lambda functions for remediation.

Answer

Use an AWS Config aggregator in the management account to view compliance across accounts.

Question 12

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

Accepted Answer

An approval action in the CodePipeline stage.. Options A, B, and C are correct. The approval action is added to the pipeline, requires an SNS topic for notifications, and an IAM role for the pipeline to publish to SNS. Option D is wrong because a Lambda function is not required for approval. Option E is wrong because a CloudWatch Events rule is not needed.

Answer

A CloudWatch Events rule to trigger the approval action.

Answer

An AWS Lambda function to process approval requests.

Question 13

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon RDS Multi-AZ deployment in the primary Region with a standby in another Region.. Option A is correct because a Global Database with standby in another Region provides near-zero RPO and automatic failover. Option D is correct because Multi-Region Aurora Global Database also meets RPO and RTO. Option B is wrong because cross-Region read replicas have RTO > 1 minute (manual promotion). Option C is wrong because RTO is too long. Option E is wrong because RPO is too high.

Answer

Take manual snapshots of the RDS instance every hour and copy them to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region.

Answer

Configure cross-Region read replicas for RDS MySQL.

Question 14

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. Option D is correct because ECS tasks should be launched in the same VPC and security group as the database, or use VPC peering/transit gateway. Option A is wrong because NAT gateway is for outbound. Option B is wrong because public subnet tasks cannot directly access private RDS without proper routing. Option C is wrong because VPN is overkill.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 15

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

Accepted Answer

Increase the read capacity units for the table.. Options B and C are correct. Adding a Global Secondary Index with a different partition key can distribute reads across partitions. Adjusting read capacity units increases throughput. Option A is wrong because changing the sort key would require a new table. Option D is wrong because DynamoDB Accelerator (DAX) improves read performance but is not a capacity change. Option E is wrong because table replication is for disaster recovery.

Answer

Use DynamoDB global tables to replicate data to another region.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Answer

Change the table's sort key to a more evenly distributed attribute.

Question 16

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

Accepted Answer

Change the task placement strategy to spread across Availability Zones.. Option D is correct because the spread strategy distributes tasks across availability zones, reducing contention. Option A is wrong because increasing memory doesn't address placement. Option B is wrong because more tasks could worsen contention. Option C is wrong because GPU instances are not relevant.

Answer

Increase the memory and CPU for each task definition to reduce contention.

Answer

Increase the number of tasks to distribute the load evenly.

Answer

Use a launch type of EC2 with GPU instances to handle the load.

Question 17

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the EC2 instances. The company wants to make the application stateless to improve availability and scalability. Which solution should the solutions architect recommend?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Option C is correct because ElastiCache with Redis provides a centralized, fast, and durable session store, making the application stateless. Option A is wrong because storing sessions in S3 would introduce high latency and is not designed for high-frequency read/write. Option B is wrong because session stickiness (sticky sessions) on the ALB prevents true statelessness and can cause uneven load. Option D is wrong because mounting an EFS volume for session files still ties sessions to a filesystem but adds complexity and latency compared to ElastiCache.

Answer

Configure session stickiness on the ALB to route requests from the same user to the same EC2 instance.

Answer

Mount an Amazon EFS file system on the EC2 instances and store session files there.

Answer

Store session data in Amazon S3 and update the application to read and write sessions to S3.

Question 18

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. CloudWatch logs show the ALB's healthy host count occasionally drops to zero during traffic spikes. Which design change should a solutions architect implement to improve availability?

Accepted Answer

Increase the size of the Auto Scaling group and adjust scaling policies.. The correct answer is D because increasing the number of instances and adding an Auto Scaling group ensures capacity can handle spikes, preventing all hosts from becoming unhealthy. Option A is wrong because Reserved Instances don't help with scaling. Option B is wrong because instance refresh is for updates, not capacity. Option C is wrong because a larger ALB does not fix the root cause of insufficient capacity.

Answer

Enable EC2 instance refresh for the Auto Scaling group.

Answer

Purchase Reserved Instances for the existing EC2 fleet.

Answer

Replace the ALB with a larger Network Load Balancer.

Question 19

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CodePipeline to send notifications to an Amazon SNS topic when the pipeline fails.. Option B is correct because CodePipeline can publish events to Amazon SNS when the pipeline state changes, enabling notifications. Option A is wrong because CloudWatch alarms are for metrics, not pipeline state. Option C is wrong because CloudWatch Events (now Amazon EventBridge) can trigger notifications, but using SNS directly from CodePipeline is simpler. Option D is wrong because SES is for email sending, but SNS is more appropriate.

Answer

Have the build script send a notification on failure using the AWS CLI.

Answer

Set up a CloudWatch Events rule to trigger an AWS Lambda function that sends an email via Amazon SES.

Answer

Create a CloudWatch alarm on the CodePipeline failure metric.

Question 20

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

Accepted Answer

The second interface is associated with a different security group.. Option D is correct because the command filters by security group ID, so only interfaces in that group are shown. The second interface may belong to a different security group. Option A is wrong because the filter is by group-id, not instance-id. Option B is wrong because the command does not filter by device index. Option C is wrong because the command can list all interfaces in the group regardless of attachment.

Answer

The second interface is not attached to the instance.

Answer

The second interface has a device index of 0.

Answer

The command only returns interfaces that are attached.