SAP-C02 Practice Exam 63 — 20 Questions

Question 1

A media company runs a video processing pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The first Lambda function downloads a video file from an S3 bucket, the second transcodes it using AWS Elemental MediaConvert, and the third uploads the transcoded files to a different S3 bucket. Recently, the pipeline has been failing intermittently with 'State machine execution timed out' errors. The Step Functions execution history shows that the first Lambda function takes up to 25 minutes to complete for large video files. The Step Functions state machine has a default execution timeout of 5 minutes. The company wants to fix the timeout issue without redesigning the entire pipeline. Which solution should the solutions architect recommend?

Accepted Answer

Increase the 'timeoutSeconds' value in the Step Functions state machine definition to 1800 (30 minutes) or more.. Option A is correct because the issue is that the first Lambda function exceeds the state machine execution timeout. By increasing the timeout in the state machine definition, the execution can run longer. The Lambda function itself has a maximum timeout of 15 minutes, but the state machine timeout must be higher than the total expected duration. Option B is wrong because the Lambda function timeout is separate; even if increased, the state machine timeout would still cause failure. Option C is wrong because using SQS would require significant changes to the pipeline and does not directly address the long-running Lambda. Option D is wrong because increasing Lambda timeout alone does not fix the state machine timeout.

Answer

Increase the Lambda function timeout to 30 minutes in the Lambda configuration.

Answer

Increase the Lambda function timeout to 15 minutes and increase the state machine execution timeout to 30 minutes.

Answer

Replace the Lambda function with an Amazon SQS queue and have the Step Functions wait for a callback.

Question 2

A company is designing a disaster recovery strategy for a multi-tier application hosted on AWS. The application uses Amazon RDS for MySQL with Multi-AZ deployment. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Configure a Cross-Region Read Replica of the RDS instance and promote it during disaster.. Using Cross-Region Read Replicas for RDS MySQL allows automatic replication with an RPO of seconds and failover in minutes, meeting the requirements with minimal overhead.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a standby RDS instance in another region.

Answer

Take automated snapshots every hour and copy them to another region. Restore from snapshot during disaster.

Answer

Use RDS Multi-AZ in a different region.

Question 3

A company uses AWS Lambda to process events from an SQS queue. The Lambda function has a reserved concurrency of 5. During peak hours, messages are being backed up in the queue. The function's duration is well within the 15-minute limit. What is the fastest way to increase throughput?

Accepted Answer

Increase the reserved concurrency to 20.. Option A is correct because increasing reserved concurrency allows more simultaneous invocations, processing more messages in parallel. Option B is wrong because Lambda functions don't have a 'thread count' setting. Option C is wrong because batch size is already maxed at 10 for SQS. Option D is wrong because adding more queues would require code changes and doesn't directly help.

Answer

Increase the function's maximum thread count.

Answer

Create additional SQS queues and distribute messages.

Answer

Increase the SQS batch size to 100.

Question 4

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.. Option D is correct. The RDS Multi-AZ failover promotes the standby to primary, but the DNS record may take time to propagate. However, the more common issue is that the EC2 instances' security group or network ACL may be referencing the old primary's IP or the security group may not allow traffic to the new primary's IP. But given that security groups are correct, the likely issue is that the EC2 instances are using an endpoint that points to the old primary's DNS name or IP, which becomes invalid after failover. The RDS DNS name should be used (CNAME) that automatically points to the new primary. If the application uses a hardcoded IP or an endpoint that is not updated, connectivity fails. Option A is wrong because Multi-AZ failover typically completes within 1-2 minutes. Option B is wrong because the RDS endpoint DNS record updates quickly (within seconds). Option C is wrong because security groups are correctly configured.

Answer

The security group for the EC2 instances does not allow outbound traffic to the RDS instance.

Answer

The RDS Multi-AZ failover took longer than expected, exceeding the RTO.

Answer

The RDS endpoint DNS record did not update to point to the new primary.

Question 5

A company is using Amazon CloudFront to distribute content globally. They want to optimize cost and performance. Which TWO actions are recommended?

Accepted Answer

Enable Regional Edge Caches to reduce load on the origin.. Using Regional Edge Caches reduces origin load and latency. Price Class selection reduces cost by limiting edge locations.

Answer

Disable compression to reduce CPU usage on the origin.

Answer

Use a single origin server to simplify configuration.

Answer

Use multiple CloudFront distributions for the same content.

Question 6

A company is migrating a monolithic application to a microservices architecture on AWS. They want to improve deployment frequency and reduce risk. Which TWO strategies should they adopt?

Accepted Answer

Implement blue/green deployments.. Correct answers are A and E. Option A reduces risk by limiting blast radius. Option E speeds up releases by automating testing and deployment. Option B is wrong because long-lived branches increase merge complexity. Option C is wrong because manual gates slow down frequency. Option D is wrong because rebuilding from scratch is risky and slow.

Answer

Deploy all microservices from a single codebase.

Answer

Require manual approval for each production deployment.

Answer

Use feature branches with manual merge approvals.

Question 7

A company runs a production AWS environment with Amazon EC2 instances managed by Auto Scaling groups. The operations team notices that after a recent deployment, the application is returning higher error rates. Which TWO steps should the team take to enable a quick rollback and improve future deployments?

Accepted Answer

Implement canary deployments using AWS CodeDeploy to shift traffic gradually and monitor error rates.. Option A (use Elastic Beanstalk for blue/green deployment) allows rollback by swapping environments. Option D (implement canary deployments in CodeDeploy) reduces blast radius and allows monitoring before full rollout. Option B (CloudFormation change sets) is for previewing changes, not rollback. Option C (CloudTrail) is for auditing, not deployment control. Option E (Lifecycle hooks) are for custom actions during instance launch/termination, not rollback.

Answer

Configure Auto Scaling lifecycle hooks to automatically terminate new instances if health checks fail.

Answer

Use AWS CloudFormation change sets to automatically roll back failed deployments.

Answer

Enable AWS CloudTrail to track deployment API calls and automatically revert if errors exceed a threshold.

Question 8

A company runs a customer-facing web application on EC2 instances behind an Application Load Balancer. The application stores session data in an RDS MySQL database. Recently, they have been experiencing increased latency and occasional timeouts during peak hours. The operations team has observed that the RDS instance's CPU utilization is consistently above 80%, and the number of database connections is near the maximum allowed. The application code is not easily modifiable in the short term. The company needs a solution that reduces the load on the database with minimal changes to the application. What should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster and modify the application to cache frequent queries.. Option C is correct because implementing an in-memory cache like ElastiCache can offload frequent reads, reducing database load without code changes if the application uses caching libraries or can be configured to use a caching layer. Option A is wrong because read replicas would help with read scaling, but the issue is both CPU and connections; also, the application might not be read-heavy. Option B is wrong because switching to Aurora would require migration and may not address the connection limit. Option D is wrong because increasing instance size is a temporary fix and doesn't address the architectural issue.

Answer

Increase the RDS instance size to a larger instance type.

Answer

Create an RDS read replica and offload read traffic to it.

Answer

Migrate the database to Amazon Aurora with Multi-AZ.

Question 9

A healthcare company runs a HIPAA-compliant web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS for PostgreSQL database with Multi-AZ. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The current setup uses an SSL certificate on the ALB to terminate HTTPS, but traffic between the ALB and EC2 instances is over HTTP. The company wants to enforce end-to-end encryption without changing the application code. Which solution meets these requirements?

Accepted Answer

Replace the ALB with a Network Load Balancer, configure a TLS listener, and use target group health checks over HTTPS.. Option D (network load balancer with target group health checks over HTTPS) is not correct because it requires code change on instances. Actually, the correct solution is to terminate TLS at the ALB and re-encrypt using a self-signed certificate on the EC2 instances, but that requires application support. However, the best option is to use a Network Load Balancer with TLS termination and forward to instances with a self-signed certificate (which doesn't require code change if the app listens on HTTPS). However, among the options, Option D is most plausible but still flawed. Let me reconsider: The correct answer should be to use a Network Load Balancer with TLS passthrough to instances that have certificates installed. Since the application cannot be changed, use a self-signed certificate on the instances for the internal traffic. Option B (self-signed certificate on EC2 and ALB re-encrypt) often requires code changes to trust the self-signed cert. Option D is the closest: NLB with TLS listener and target group with HTTPS health check. But the correct answer is actually to use an NLB with TLS listener and target group health checks over HTTPS, but the application must support HTTPS. Since the problem says no code change, the application likely already listens on HTTPS? Actually, the problem says traffic between ALB and EC2 is HTTP, so the application listens on HTTP. So we need to enable HTTPS on the instances without code change. That's not possible. The only way is to use a reverse proxy on the instance or use a self-signed certificate that the ALB can trust. But ALB can terminate TLS and re-encrypt to target group with a self-signed certificate if the target group protocol is HTTPS and the ALB trusts the self-signed certificate (by uploading it to ACM as a private certificate?). ACM does not accept self-signed certificates. So the correct solution is to use a Network Load Balancer with TLS passthrough and install a certificate on the instances. The application must support HTTPS. Since the application currently uses HTTP, the only way is to modify the application to listen on HTTPS. However, the problem says 'without changing the application code'. So the only feasible solution is to use a reverse proxy like NGINX on the instance in front of the application. That is not listed. Among the options, Option B is the least bad because you can upload a private CA-signed certificate to ACM and use it on ALB to re-encrypt to instances. But the instances need to have the corresponding certificate. That might require manual installation but not code change. Option A (NLB with TLS listener and target group protocol TCP) does not encrypt traffic to instances. Option C (CloudFront in front of ALB) adds complexity. Option D is similar to B but uses NLB. So the best answer is B. Actually, the correct answer is D: use a Network Load Balancer with TLS listener and target group health checks over HTTPS. Wait, NLB does not terminate TLS; it passes through. So the instances must handle TLS. That requires code change. So B is better because ALB can re-encrypt. But ALB re-encryption requires the target group protocol to be HTTPS and the ALB to trust the target's certificate. If the target uses a self-signed certificate, ALB will reject it. So you need a certificate signed by a CA that ALB trusts. That can be a private CA from ACM Private CA. So you can install a certificate from ACM Private CA on the instances. That is a configuration change, not code change. So B is feasible.

Answer

Configure the ALB to use a TLS listener and forward traffic to the target group using the TCP protocol on port 443.

Answer

Install a self-signed certificate on each EC2 instance, configure the ALB target group to use HTTPS, and upload the self-signed certificate to AWS Certificate Manager (ACM) for the ALB to trust.

Answer

Place AWS CloudFront in front of the ALB and configure CloudFront to use TLS 1.2, with the ALB still using HTTP.

Question 10

A company runs a batch processing application on a scheduled EC2 instance that starts every night. The instance processes a large number of files from an S3 bucket and writes results to another S3 bucket. The job takes approximately 6 hours to complete. Recently, the job has been failing after 4 hours with an error indicating that the instance's EBS root volume is full. The instance type is t3.medium with a 20 GB gp2 root volume. The application writes temporary files to the root volume. The company wants to fix this with minimal changes to the application and infrastructure. What should a solutions architect recommend?

Accepted Answer

Increase the size of the EBS root volume to 100 GB.. Option B is correct because increasing the root volume size provides more space for temporary files without application changes. Option A is wrong because instance store is ephemeral and may not be available on t3 instances. Option C is wrong because mounting an EBS volume would require application changes to write to a different path. Option D is wrong because reducing file size may not be feasible and requires code changes.

Answer

Create an additional EBS volume and mount it to the instance.

Answer

Change the instance type to one with instance store volumes.

Answer

Modify the application to compress temporary files.

Question 11

A startup runs its application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to distribute traffic. During a recent marketing campaign, the application experienced high latency and some requests returned 503 errors. The team suspects that the tasks are hitting resource limits. The team wants to automatically scale the tasks based on CPU utilization. Which solution should the team implement?

Accepted Answer

Configure Application Auto Scaling for the ECS service with a target tracking scaling policy based on average CPU utilization.. Option A (Application Auto Scaling with target tracking) is the correct approach for ECS services. Option B (Auto Scaling group) is for EC2. Option C (CloudWatch alarm to stop tasks) is not scaling. Option D (Lambda to add tasks) is less efficient.

Answer

Create a CloudWatch alarm that triggers a Lambda function to stop idle tasks.

Answer

Create an Auto Scaling group for the ECS cluster and configure it to scale based on CPU utilization.

Answer

Use AWS Lambda to periodically check CPU utilization and update the desired count of the ECS service.

Question 12

A media company delivers video content to a global audience using Amazon CloudFront, AWS Lambda@Edge, and Amazon S3. The origin is an S3 bucket that stores video files. Recently, users in Asia-Pacific report slow load times. The operations team checks CloudFront metrics and sees a high cache miss rate for content popular in that region. The team wants to improve performance for all users without significantly increasing costs. The application uses a single CloudFront distribution with a default cache behavior. The S3 bucket is in us-east-1. Which solution should the team implement?

Accepted Answer

Set up multiple origin groups in the existing CloudFront distribution with one S3 bucket per region, and configure cache behaviors based on geographic headers.. Option B (multiple origin groups with region-specific behaviors) is ideal for global distribution because CloudFront can route based on geographic headers. Option A (multiple distributions) increases complexity. Option C (Lambda@Edge for origin selection) can work but requires code changes. Option D (S3 Transfer Acceleration) speeds up uploads, not downloads.

Answer

Enable S3 Transfer Acceleration on the S3 bucket and update CloudFront to use the accelerated endpoint.

Answer

Create separate CloudFront distributions for each geographic region and use Route 53 latency-based routing.

Answer

Use Lambda@Edge to redirect requests to the nearest S3 bucket based on the viewer's location.

Question 13

A company is migrating an on-premises application to AWS. The application requires persistent shared storage that can be accessed by multiple EC2 instances simultaneously with strong consistency. Which AWS storage solution should the company use?

Accepted Answer

Amazon EFS. Option D is correct because Amazon EFS provides a fully managed NFS file system that can be mounted by multiple EC2 instances with strong consistency. Option A is wrong because EBS volumes can only be attached to one instance at a time (multi-attach is limited). Option B is wrong because S3 is object storage, not a file system. Option C is wrong because S3 Glacier is for archival.

Answer

Amazon S3 with S3 File Gateway.

Answer

Amazon S3 Glacier Deep Archive.

Answer

Amazon EBS with Multi-Attach enabled.

Question 14

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

Accepted Answer

Implement an ElastiCache for Redis cluster to cache frequently accessed data.. Option A is correct because ElastiCache for Redis provides an in-memory cache that reduces database read load without code changes. Option B is wrong because it would not reduce database load. Option C is wrong because RDS Proxy is for connection pooling, not caching. Option D is wrong because increasing instance size is a vertical scaling approach that may not be as cost-effective as caching.

Answer

Add a second RDS read replica to distribute read traffic.

Answer

Upgrade the RDS instance to a larger instance type with more vCPUs.

Answer

Enable RDS Proxy to manage database connections.

Question 15

A company runs a critical workload on EC2 instances in an Auto Scaling group across three Availability Zones. The application needs to maintain a consistent IP address for outbound traffic to external partners. The current design uses a NAT gateway in each AZ, but partners whitelist a single IP. How can the company provide a fixed outbound IP while maintaining high availability?

Accepted Answer

Deploy a Network Load Balancer with Elastic IPs in front of NAT instances in each AZ.. Option C is correct because a NAT gateway with an Elastic IP can be placed in a single AZ, but if that AZ fails, the workload fails. A Network Load Balancer with EIPs and NAT instances provides a fixed IP and HA. Option A is wrong because multiple NAT gateways have different IPs. Option B is wrong because it's not HA. Option D is wrong because a proxy fleet still uses multiple IPs.

Answer

Use a proxy fleet of EC2 instances behind an Application Load Balancer.

Answer

Use a single NAT gateway across all three AZs and assign an Elastic IP.

Answer

Use a NAT instance with an Elastic IP in one AZ.

Question 16

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

Accepted Answer

The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.. Option A is correct because the pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission. Option D is wrong because versioning is not required for writes.

Answer

The S3 bucket policy denies access from the pipeline's AWS account.

Answer

The CodeBuild project does not have the necessary environment variables.

Answer

The S3 bucket does not have versioning enabled.

Question 17

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

Accepted Answer

Increase the Lambda function's reserved concurrency and timeout.. Option B is correct because increasing the reserved concurrency ensures Lambda can scale to handle the burst. Option A is wrong because it does not address the timeout. Option C is wrong because DLQ is for failed messages after retries, not for avoiding reprocessing. Option D is wrong because batch size reduction may increase timeouts.

Answer

Reduce the batch size in the Lambda event source mapping.

Answer

Increase the SQS visibility timeout to 6 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 18

A company is using Amazon CloudFront to serve content from an S3 origin. The content is updated infrequently. Users in some regions report seeing stale content. The company wants to ensure that users always see the latest version without waiting for TTL expiration. What is the MOST cost-effective solution?

Accepted Answer

Use file versioning in the URL (e.g., appending a query string or using a unique object key).. Option D is correct because file versioning (changing the URL) guarantees fresh content without cache invalidation costs. Option A is wrong because it is costly and not automatic. Option B is wrong because reducing TTL increases origin load. Option C is wrong because it does not invalidate existing cache.

Answer

Set a very short TTL (e.g., 0 seconds) for the CloudFront distribution.

Answer

Use an origin shield to reduce the number of requests to S3.

Answer

Create a CloudFront invalidation request for the changed files after each update.

Question 19

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

Accepted Answer

Increase the number of EC2 instances running the consumer application.. Option B is correct because KCL distributes shard processing across workers; adding more workers allows parallel processing. Option A is wrong because it does not reduce per-shard load. Option C is wrong because it does not help shard distribution. Option D is wrong because it may increase shard count but still requires more workers.

Answer

Decrease the batch size in the KCL configuration.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the Kinesis stream's retention period to 7 days.

Question 20

A company is using AWS CloudFormation to manage infrastructure. The stack creation fails with the error 'Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/Admin/MySession is not authorized to perform: ec2:RunInstances'. What is the MOST likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have ec2:RunInstances permission.. Option C is correct because the IAM role assumed by CloudFormation lacks the necessary permissions. Option A is wrong because the error is about the user/role, not AWS. Option B is wrong because the error does not mention S3. Option D is wrong because the region is specified in the template.

Answer

The region specified in the template is disabled.

Answer

The CloudFormation template has a syntax error.

Answer

The AWS account is not subscribed to EC2 service.