SAP-C02 Practice Exam 62 — 20 Questions

Question 1

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

Accepted Answer

Increase the SQS queue's visibility timeout to 6 minutes.. Options B and D are correct. Increasing the visibility timeout to 6 minutes prevents the message from becoming visible again before processing completes. Enabling FIFO queues with deduplication ensures exactly-once processing. Option A is wrong because Lambda does not support reserved concurrency for SQS triggers in a way that prevents duplicates. Option C is wrong because a dead-letter queue handles failures, not duplicates. Option E is wrong because reducing batch size does not prevent duplicates.

Answer

Set the Lambda function's reserved concurrency to 1.

Answer

Reduce the SQS batch size to 1.

Answer

Configure a dead-letter queue for the SQS queue.

Question 2

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

Accepted Answer

Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.. Option C is correct because SSE-KMS provides centralized key management and access control. Option A is wrong because SSE-S3 keys are managed by AWS, not the customer. Option B is wrong because client-side encryption does not use S3 server-side encryption. Option D is wrong because bucket policies control access to objects, not encryption keys.

Answer

Configure an S3 bucket policy to allow only specific IAM roles to put objects.

Answer

Continue using SSE-S3 and enable S3 Block Public Access.

Answer

Use client-side encryption with an AWS KMS key.

Question 3

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The Lambda function has been running successfully for months. Recently, the company updated the Lambda function code and started seeing occasional throttling errors (HTTP 429) from the Lambda service. The function's reserved concurrency is set to 100. The company is unsure why throttling is occurring only after the code update. What is the MOST likely cause?

Accepted Answer

The code update increased the execution time of the Lambda function, leading to a higher number of concurrent executions that exceed the account-level concurrency limit.. Option B is correct because if the function invocation rate exceeds the account-level concurrency limit (default 1000), throttling occurs. The code update may have increased execution time, causing more concurrent invocations to pile up. Option A is wrong because increasing S3 events would increase invocations, but the reserved concurrency of 100 might still be within account limits. Option C is wrong because Lambda execution role permissions don't cause throttling errors. Option D is wrong because CloudWatch Logs throttling would cause logs to be dropped, not Lambda throttling.

Answer

The Lambda function is writing logs to CloudWatch Logs at a rate that exceeds the CloudWatch throttling limit.

Answer

The S3 bucket is receiving more uploads than before, causing more Lambda invocations.

Answer

The updated Lambda function no longer has the required IAM permissions to access S3, causing retries that throttle.

Question 4

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 10 minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms can monitor metrics and trigger actions when a threshold is breached.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 5

A financial services company runs a critical application on EC2 instances in an Auto Scaling group across multiple Availability Zones. They need to ensure that in the event of a single AZ failure, the application remains available with no data loss. The application uses EBS volumes for persistent storage. What should a solutions architect recommend?

Accepted Answer

Use an EBS multi-attach volume with a cluster-aware file system.. Option D is correct because using an EBS multi-attach enabled volume with a cluster file system allows instances in different AZs to share the same storage, providing high availability and no data loss. Option A is wrong because EBS snapshots are not real-time. Option B is wrong because EBS volumes cannot be attached to instances in different AZs. Option C is wrong because EFS is a different service and not EBS.

Answer

Take periodic EBS snapshots and restore in another AZ.

Answer

Use Amazon EFS instead of EBS volumes.

Answer

Use an EBS volume in one AZ and attach it to instances in another AZ.

Question 6

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

Accepted Answer

Add an HTTPS listener to the ALB using an ACM certificate, and configure the HTTP listener to redirect to HTTPS.. Option C is correct because creating an HTTPS listener with an ACM certificate and redirecting HTTP to HTTPS ensures encryption. Option A is wrong because CloudFront adds complexity and cost. Option B is wrong because a TCP listener does not terminate TLS. Option D is wrong because ACM cannot be directly associated with a TCP listener.

Answer

Replace the ALB with a Network Load Balancer and associate an ACM certificate with it.

Answer

Change the ALB listener to TCP and use a self-signed certificate on the EC2 instances.

Answer

Place a CloudFront distribution in front of the ALB and configure HTTPS between viewers and CloudFront.

Question 7

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic to tasks. The company has configured an Auto Scaling target tracking policy based on average CPU utilization. During a marketing campaign, traffic spikes cause the ALB to return 503 errors. The ECS service dashboard shows that the number of tasks scaled out to the maximum allowed but the CPU utilization remained high. What is the MOST likely cause of the 503 errors?

Accepted Answer

The ECS service scaled out to the maximum number of tasks, but the new tasks are not yet registered as healthy with the ALB, or the existing tasks are overwhelmed.. Option B is correct because with target tracking based on CPU, the service scales out until max tasks is reached; if CPU is still high, the ALB may be overloaded or tasks are not accepting traffic fast enough. A surge queue or health check grace period issue could cause 503s. Option A is wrong because an ALB can handle many connections; the issue is task capacity. Option C is wrong because target tracking scaling can take minutes; the issue is max tasks reached. Option D is wrong because Fargate tasks have sufficient ENIs; the error is at the ALB level.

Answer

The target tracking scaling policy takes too long to trigger, and the service cannot scale quickly enough.

Answer

The Fargate tasks have exhausted their elastic network interface (ENI) limits.

Answer

The ALB connection limit has been exceeded due to the traffic spike.

Question 8

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high CPU utilization during peak hours. The company wants to reduce the load on the primary database instance without making changes to the application code. Which TWO solutions should the solutions architect recommend?

Accepted Answer

Create one or more Read Replicas in the same region and direct read traffic to them.. Options B and D are correct. Read Replicas can offload read traffic from the primary, reducing CPU utilization. Amazon ElastiCache caches frequent query results, reducing database queries. Option A is wrong because increasing instance size of the primary helps but is not the only solution and may require downtime. Option C is wrong because converting to Multi-AZ does not reduce read load; Multi-AZ is for failover. Option E is wrong because RDS Proxy helps with connection pooling but not CPU reduction from queries.

Answer

Increase the instance size of the primary RDS instance.

Answer

Enable Amazon RDS Proxy to manage database connections.

Answer

Convert the RDS instance to a Multi-AZ deployment if not already.

Question 9

A company uses Amazon DynamoDB as a data store for a mobile application. The application experiences throttling errors during peak hours. The table has a provisioned read capacity of 5000 RCUs and write capacity of 2000 WCUs. The throttling is on writes. What is the MOST cost-effective solution?

Accepted Answer

Enable auto scaling for DynamoDB write capacity.. DynamoDB Accelerator (DAX) is a read cache, not for writes. The most cost-effective solution is to use DynamoDB auto scaling for writes to handle peak loads without over-provisioning.

Answer

Enable DynamoDB Accelerator (DAX) to offload writes.

Answer

Switch to on-demand capacity mode.

Answer

Increase write capacity to 4000 WCUs.

Question 10

A media company uses AWS CloudFront to distribute video content. They notice that some users in Europe experience high latency. CloudFront metrics show low cache hit ratios for European edge locations. The origin is an S3 bucket in us-east-1. What is the MOST effective optimization?

Accepted Answer

Add a second origin in eu-west-1 and configure origin groups with failover.. Option C is correct because creating an additional CloudFront distribution with an origin in Europe or using a multi-region origin setup reduces latency for European users. Option A is wrong because S3 Transfer Acceleration improves uploads, not downloads. Option B is wrong because increasing TTL would reduce origin load but not latency for uncached objects. Option D is wrong because adding more cache behaviors doesn't help with geographic latency.

Answer

Increase the default TTL for objects in CloudFront.

Answer

Add additional cache behaviors for different file types.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 11

A company runs a high-traffic web application on EC2 instances in an Auto Scaling group. The application uses a Redis cluster for caching. Recently, they have noticed that the cache hit ratio has dropped significantly, causing increased load on the database. The operations team observed that the Redis cluster's CPU utilization is high and memory usage is near capacity. They need to improve the cache performance with minimal changes to the application code. What should a solutions architect recommend?

Accepted Answer

Upgrade the Redis cluster to a larger node type with more CPU and memory.. Option D is correct because using a larger node type provides more CPU and memory, improving performance without code changes. Option A is wrong because increasing TTL may reduce churn but does not address capacity. Option B is wrong because ElastiCache is already in use. Option C is wrong because enabling encryption adds overhead and does not solve the capacity issue.

Answer

Migrate from ElastiCache to Amazon MemoryDB for Redis.

Answer

Increase the TTL values for cached objects in the application.

Answer

Enable encryption in transit for the Redis cluster.

Question 12

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

Accepted Answer

Create an Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and use a load balancer.. Option D is correct because AMI-backed instances launch from a stored AMI, and data on instance store is ephemeral; the application should store data on EBS. Option A is wrong because high availability requires multiple instances. Option B is wrong because Multi-Attach is for specific use cases. Option C is wrong because EBS snapshots are for backups, not quick recovery.

Answer

Take frequent EBS snapshots and automate the creation of a new instance from the latest snapshot.

Answer

Configure the EBS volume as a Multi-Attach volume and attach it to a standby instance.

Answer

Convert the instance to an AMI and launch a new instance from that AMI in a different Availability Zone.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The company wants to ensure that if a stack update fails, the stack automatically rolls back to the last known good state. Which CloudFormation stack option should the company configure?

Accepted Answer

Set the 'Rollback on failure' option to 'Yes' when performing the stack update.. Option A is correct because CloudFormation stack updates have a 'Rollback on failure' option that defaults to 'Yes'. If an update fails, CloudFormation automatically rolls back to the previous state. Option B is wrong because a stack policy prevents updates to specific resources, not rollback behavior. Option C is wrong because change sets allow you to preview changes but do not automate rollback. Option D is wrong because termination protection prevents stack deletion, not rollback on failed updates.

Answer

Enable termination protection on the stack.

Answer

Configure a stack policy to prevent updates to critical resources.

Answer

Use a change set to review changes before updating the stack.

Question 14

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent 503 errors. The Auto Scaling group has a minimum of 2 and maximum of 10 instances. CloudWatch metrics show that CPU utilization rarely exceeds 30%. What is the MOST likely cause of the 503 errors?

Accepted Answer

The ALB connection draining is enabled with a very short timeout, causing in-flight connections to be dropped.. The 503 errors are likely due to the ALB connection draining setting. If connection draining is enabled and the drain timeout is too short, in-flight requests may be terminated, causing 503 errors. Low CPU utilization suggests the instances are not overloaded.

Answer

The EC2 instances are running out of memory.

Answer

The Auto Scaling group launch configuration uses an AMI that is not compatible with the instance type.

Answer

The ALB health check is misconfigured, causing healthy instances to be marked unhealthy.

Question 15

A company is designing a serverless event-driven application using AWS Lambda. The application processes messages from an Amazon SQS queue. The team needs to ensure that messages are processed in order and exactly once. Which THREE steps should be taken?

Accepted Answer

Configure the Lambda event source mapping to use the FIFO queue.. To achieve ordering and exactly-once processing, use a FIFO queue with a deduplication ID and configure a reserved concurrency of 1 to prevent parallel processing.

Answer

Enable Lambda function's batch window to 0.

Answer

Use a standard SQS queue.

Question 16

A company runs a stateful web application on EC2 instances with EBS volumes. They want to improve resilience by distributing the workload across multiple Availability Zones. Which THREE steps should they take?

Accepted Answer

Use Amazon EFS for shared storage across AZs.. Correct answers are A, C, and D. Option A ensures data is available in multiple AZs. Option C distributes instances for high availability. Option D handles traffic distribution and health checks. Option B is wrong because EBS volumes cannot be attached cross-AZ. Option E is wrong because Read Replicas are for RDS, not EBS.

Answer

Attach the same EBS volume to instances in different AZs.

Answer

Configure EBS Read Replicas in another AZ.

Question 17

A company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional timeouts during peak hours. After reviewing AWS X-Ray traces, the team finds that DynamoDB queries are slow. Which THREE actions should the team take to improve performance and continuously optimize the solution?

Accepted Answer

Optimize DynamoDB queries by using global secondary indexes and reducing the number of separate queries.. Option A (DAX) reduces read latency. Option B (read capacity auto scaling) adapts to demand. Option E (connection pooling) reduces cold start overhead. Option C (ElastiCache) is for external caching, not DynamoDB. Option D (warm containers) is for Lambda optimization but not directly addressing DynamoDB performance.

Answer

Use Amazon ElastiCache for Redis to cache DynamoDB query results.

Answer

Implement Lambda function warmers to keep containers initialized and reduce cold starts.

Question 18

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences high request latency during peak traffic. A solutions architect discovers that the ALB is not distributing traffic evenly across the instances. The instances have different sizes (t3.large and t3.xlarge). Which TWO actions should the solutions architect take to improve load distribution?

Accepted Answer

Enable connection draining on the target group.. Option A and Option D are correct. Changing the routing algorithm to least outstanding requests ensures that instances with fewer pending requests receive new traffic, balancing load based on current capacity. Enabling connection draining ensures that in-flight requests complete before an instance is deregistered, preventing abrupt termination. Option B is wrong because sticky sessions would cause uneven load. Option C is wrong because increasing the deregistration delay helps but doesn't improve distribution. Option E is wrong because using the same instance type does not address the imbalance caused by different sizes; LOR algorithm handles that.

Answer

Replace all instances with the same instance type.

Answer

Enable sticky sessions (session affinity) on the target group.

Answer

Increase the deregistration delay (connection draining) on the target group to 300 seconds.

Question 19

A company is using Amazon S3 to store sensitive documents. The security team requires that all objects be encrypted at rest using a customer-managed key (CMK) stored in AWS KMS. Additionally, the CMK must be rotated automatically every year. How should the company configure this?

Accepted Answer

Use S3 default encryption with SSE-KMS and enable automatic key rotation on the CMK.. Enable S3 default encryption with SSE-KMS and configure automatic key rotation on the CMK. This meets both requirements.

Answer

Use S3 default encryption with SSE-KMS and create a new CMK every year.

Answer

Use S3 bucket policies to enforce encryption and use KMS manual key rotation.

Answer

Use S3 default encryption with SSE-S3 and enable KMS automatic key rotation.

Question 20

A company runs a batch processing job on Amazon EC2 instances that are part of an Auto Scaling group. The job runs every night and takes approximately 2 hours. The instances are launched using a launch template with a Spot Instance request. Recently, the job has been failing because Spot Instances are being reclaimed before the job completes. The company wants a cost-effective solution that ensures the job completes reliably. The job can handle interruptions by checkpointing. Which solution should the company implement?

Accepted Answer

Use a mixed instances policy with a percentage of On-Demand Instances as a fallback.. Using Spot Instances with a termination notice and checkpointing allows the job to save progress and resume if interrupted. Mixed Instances policy can use On-Demand as a fallback.

Answer

Increase the instance size to complete the job faster.

Answer

Switch to On-Demand Instances only.

Answer

Use Reserved Instances for the batch job.