SAP-C02 Practice Exam 61 — 20 Questions

Question 1

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

Accepted Answer

A service control policy (SCP) or a resource-based policy is denying the action.. Option D is correct because the error occurs even though the user has the StopInstances permission; likely the instance is protected by a resource-based policy or a service control policy (SCP) at the account level. Option A is wrong because the policy uses Resource '*' which includes all instances. Option B is wrong because there is no condition requiring tags. Option C is wrong because the CLI syntax is correct.

Answer

The user is using an incorrect CLI command syntax.

Answer

The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.

Answer

The policy does not specify the instance ID in the Resource field.

Question 2

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. Option A is correct because Lambda functions in a VPC require a NAT gateway or VPC endpoints to access external services; without it, they cannot reach the internet, causing timeouts. Option C is wrong because Lambda automatically scales. Option D is wrong because the function already has a VPC configuration. Option B is wrong because concurrent executions do not cause timeouts.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 3

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which THREE components are required?

Accepted Answer

AWS Cloud Map. Options A, C, and E are correct. An Application Load Balancer provides DNS names for services. AWS Cloud Map enables service discovery with custom DNS names. Amazon Route 53 can be used to register custom domain names. Option B is wrong because Amazon ECS Service Connect is a feature for service discovery but is not required; it can be used instead of Cloud Map. Option D is wrong because Network Load Balancer is not required for DNS-based discovery.

Answer

Network Load Balancer (NLB)

Answer

Amazon ECS Service Connect

Question 4

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

Accepted Answer

Create a target tracking scaling policy using the custom metric as the target.. Option B is correct because a target tracking scaling policy automatically adjusts capacity based on the metric. Option A is wrong because step scaling is more complex and less efficient. Option C is wrong because scheduled scaling is for predictable patterns. Option D is wrong because Lambda is not needed for this.

Answer

Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

Answer

Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

Answer

Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

Question 5

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application uses a custom health check that reports instance health to Amazon CloudWatch. The Auto Scaling group is configured with an EC2 health check type. Recently, the company noticed that instances failing the custom health check are not being terminated and replaced. What should the solutions architect do to ensure that instances failing the custom health check are automatically replaced?

Accepted Answer

Change the Auto Scaling group health check type to ELB and ensure the custom health check is integrated with the ELB target group.. Option D is correct because Auto Scaling only uses the EC2 status checks (system/reachability) by default. To use a custom health check, you must configure the Auto Scaling group to use ELB health checks and have the custom health check reported via a target group. Alternatively, you can use Amazon EventBridge to listen for custom health check failures and terminate instances. Option A is wrong because changing the health check type to ELB still requires a target group, and the custom health check must be integrated. Option B is wrong because CloudWatch alarms don't directly trigger instance replacement; you would need a lifecycle hook or EventBridge. Option C is wrong because manual termination defeats automation.

Answer

Manually terminate the unhealthy instances from the EC2 console.

Answer

Configure the Auto Scaling group to use instance metadata to report health.

Answer

Create a CloudWatch alarm based on the custom health check metric and configure the alarm to terminate the instance.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

Accepted Answer

Implement scheduled scaling actions to add capacity before known peak times.. Option C is correct because scheduled scaling can pre-emptively add capacity based on known traffic patterns. Option A is wrong because increasing cooldown would delay scaling. Option B is wrong because step scaling is more aggressive but not proactive. Option D is wrong because lowering threshold would cause over-scaling and cost.

Answer

Decrease the CPU utilization threshold for scale-out.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Change the scaling policy to step scaling with a higher step adjustment.

Question 7

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

Accepted Answer

Create an origin access identity (OAI) and grant it read access to the S3 bucket.. Option C is correct because origin access identity (OAI) allows CloudFront to access S3 securely. Option A is wrong because signed URLs are for end-user access. Option B is wrong because bucket policy with OAI is the right approach, but this option describes OAI. Option D is wrong because CloudFront does not use IAM roles for S3 access.

Answer

Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.

Answer

Attach an IAM role to CloudFront distribution.

Answer

Configure CloudFront signed URLs.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

Accepted Answer

Rerun the stack update with the --disable-rollback flag and then describe the stack events.. Option C is correct because disabling rollback on failure allows the stack to remain in a failed state for investigation. Option A is wrong because you cannot describe stack events of a deleted stack. Option D is wrong because creating a change set does not help with the current failure. Option B is wrong because you can check the specific resource status reason.

Answer

Delete the stack and review the CloudFormation logs.

Answer

Create a change set to preview the updates.

Answer

Use the AWS CLI describe-stack-resources command to see the status of each resource.

Question 9

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. Option B is correct. ResourceNotFoundException indicates the DynamoDB table does not exist or has been deleted. Option A is wrong because insufficient permissions cause AccessDeniedException. Option C is wrong because throttling causes ProvisionedThroughputExceededException. Option D is wrong because a different error would occur if the function timed out.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 10

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

Accepted Answer

Switch from a step scaling policy to a target tracking scaling policy based on CPU utilization.. Options A and C are correct. A buffer-based scaling policy (target tracking) is more responsive than step scaling. Decreasing the cooldown period allows faster scaling out. B is wrong because increasing instance size does not improve scaling responsiveness. D is wrong because decreasing minimum size could worsen performance. E is wrong because increasing cooldown slows down scaling.

Answer

Increase the instance size to handle more traffic per instance.

Answer

Increase the health check grace period for the Auto Scaling group.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 11

A company has a monolithic application running on a single Amazon EC2 instance. The application consists of a web server and a backend worker process. The company wants to migrate to a microservices architecture using containers on Amazon ECS with Fargate. The solutions architect needs to design a solution that minimizes downtime during the migration. Which approach should the solutions architect recommend?

Accepted Answer

Use a strangler fig pattern: gradually replace parts of the monolith with microservices, routing traffic via an Application Load Balancer.. Option D is correct because a strangler fig pattern allows incremental migration of functionality from the monolith to microservices, with the ALB routing traffic to either the monolith or new services. This minimizes downtime because the old application remains operational while pieces are moved. Option A is wrong because a lift-and-shift of the entire application into a single container does not decompose it into microservices. Option B is wrong because refactoring the entire application at once introduces significant risk and downtime. Option C is wrong because running both the monolith and new services on the same instance but on different ports does not inherently minimize downtime and complicates routing.

Answer

Create a Docker image of the entire monolithic application and run it on ECS with Fargate.

Answer

Run the monolithic application on the same EC2 instance as the new microservices, using different ports.

Answer

Refactor the entire application into microservices, then deploy all microservices at once on ECS.

Question 12

A company is using Amazon RDS for MySQL and wants to minimize downtime during a major version upgrade. Which approach is the MOST effective?

Accepted Answer

Create a read replica with the new version, promote it to primary, and update the application endpoint.. Creating a read replica, upgrading it, and then promoting it to primary minimizes downtime because the promotion is a quick operation.

Answer

Take a snapshot, restore as a new instance with the new version, and update the application endpoint.

Answer

Launch a new RDS instance with the new version, use DMS to migrate data, and switch the application endpoint.

Answer

Use the AWS RDS modify-db-instance command with the --allow-major-version-upgrade option. This typically causes a few minutes of downtime but is the simplest.

Question 13

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

Accepted Answer

The bucket contains delete markers that are not being expired.. Option C is correct because NoncurrentVersionExpirationInDays applies to noncurrent versions, but if the object has no current version (e.g., all versions are delete markers), the rule doesn't clean up delete markers. Option A is wrong because the rule is enabled. Option B is wrong because versioning is enabled. Option D is wrong because bucket policy doesn't affect lifecycle.

Answer

The bucket has a bucket policy that prevents deletion.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule is disabled.

Question 14

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

Accepted Answer

View the stopped task logs in Amazon CloudWatch Logs.. Option D is correct because checking the stopped task logs in CloudWatch Logs reveals application errors. Option A is wrong because the task definition is likely correct if the old tasks work. Option B is wrong because the service event stream shows deployment events, not task logs. Option C is wrong because ECS Exec requires the task to be running.

Answer

Review the task definition for misconfigured environment variables.

Answer

Check the ECS service event stream for error messages.

Answer

Use ECS Exec to connect to the failing tasks and debug.

Question 15

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Accepted Answer

The NAT gateway is not in a public subnet with an internet gateway.. Option C is correct. The route table has a route to a NAT gateway in the same subnet, but the NAT gateway must be in a public subnet with an internet gateway. If the NAT gateway is in a private subnet, it cannot route to the internet. Option A is wrong because there is a default route. Option B is wrong because the local route is present. Option D is wrong because the route table is associated with the subnet.

Answer

The route table does not have a default route (0.0.0.0/0).

Answer

The VPC does not have a local route.

Answer

The route table is not associated with the subnet.

Question 16

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.. Option B is correct because a metric filter can create a metric from log events, and an alarm can trigger when the metric breaches a threshold. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time alerting. Option C is wrong because an S3 event notification is for S3 events, not log content. Option D is wrong because Lambda subscriptions are for real-time processing, but simpler is metric filter + alarm.

Answer

Configure S3 event notifications on the log file destination to send an alert.

Answer

Subscribe a Lambda function to the log group and have it check for the error message.

Answer

Use CloudWatch Logs Insights to run a query periodically and send results via email.

Question 17

A company is running a stateful web application on Amazon EC2 instances in an Auto Scaling group. The instances store session data in an Amazon ElastiCache for Redis cluster. The company wants to improve the application's fault tolerance and ensure that session data is not lost if an Availability Zone fails. What should the solutions architect do?

Accepted Answer

Enable Cluster Mode on the ElastiCache for Redis cluster and configure Multi-AZ.. Option B is correct because ElastiCache for Redis with Cluster Mode enabled automatically shards data across multiple nodes and provides Multi-AZ with automatic failover, ensuring high availability and data durability. Option A is wrong because increasing instance size does not protect against AZ failure. Option C is wrong because a single-node cluster has no replication; if the node fails, data is lost. Option D is wrong because ElastiCache for Memcached does not support persistence or replication; data loss occurs on node failure.

Answer

Configure the ElastiCache for Redis cluster to have multiple read replicas in the same region.

Answer

Increase the instance size of the EC2 instances to handle more load.

Answer

Migrate from ElastiCache for Redis to ElastiCache for Memcached.

Question 18

A company is migrating a monolithic application to microservices on Amazon ECS. The application uses a legacy database that does not support distributed transactions. The team wants to ensure data consistency across services. Which solution is BEST for achieving eventual consistency with minimal code changes?

Accepted Answer

Implement the Saga pattern using AWS Step Functions.. Implementing the Saga pattern with AWS Step Functions allows orchestrating distributed transactions across services, managing rollbacks and compensating actions. This is the best approach for eventual consistency with minimal code changes.

Answer

Use Amazon DynamoDB transactions across all services.

Answer

Modify the legacy database to support two-phase commit.

Answer

Use Amazon SQS to queue all database writes and process them sequentially.

Question 19

A company wants to implement a centralized logging solution for multiple AWS accounts. Which TWO services should be used together?

Accepted Answer

Amazon S3. Amazon S3 serves as a central log repository, and Amazon Athena allows querying logs directly in S3.

Answer

AWS CloudTrail

Answer

Amazon RDS

Answer

AWS Config

Question 20

A company uses AWS CloudFormation to deploy infrastructure. They need to ensure that updates to a stack do not cause downtime for a critical database. Which TWO strategies should they use?

Accepted Answer

Use an UpdatePolicy attribute for rolling updates.. Correct answers are B and C. Option B prevents deletion of the database. Option C uses update policies to control how changes are applied. Option A is wrong because a new stack would require data migration. Option D is wrong because disabling rollback is risky. Option E is wrong because service roles don't prevent downtime.

Answer

Create a new stack and migrate data.

Answer

Disable rollback on stack update failures.

Answer

Use a service role for CloudFormation.

SAP-C02 Practice Exam 61 — 20 Questions

Exhibit

SAP-C02 Practice Exam 61 — 20 Questions

Exhibit