SAP-C02 Practice Exam 64 — 20 Questions

Question 1

A company has a web application behind an Application Load Balancer that uses sticky sessions. The application is deployed on EC2 instances in an Auto Scaling group. During a deployment, the team notices that users are experiencing errors after new instances are launched. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group's scale-in policy is terminating instances with active sessions.. Option A is correct because stickiness binds users to specific instances; new instances don't have session data, causing errors. Option B is wrong because deregistration delay helps drain connections. Option C is wrong because health checks would detect unhealthy instances. Option D is wrong because scaling policies don't affect session stickiness.

Answer

The target group's deregistration delay is too short.

Answer

The stickiness duration is set too long, causing requests to be routed to terminated instances.

Answer

The ALB health check is not configured for the new instances.

Question 2

A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Enable caching of authorization responses in API Gateway.. Option A is correct because increasing the Lambda timeout gives more time for authorization. Option C is correct because enabling caching reduces invocations of the authorizer. Option B is wrong because request validation does not affect authorizer performance. Option D is wrong because it does not help the authorizer. Option E is wrong because concurrency is not the issue.

Answer

Use AWS WAF to block suspicious requests.

Answer

Increase the Lambda reserved concurrency.

Answer

Enable request validation in API Gateway.

Question 3

A company has an S3 bucket that stores critical data. They need to ensure that all objects are encrypted at rest. The bucket policy currently denies uploads if the x-amz-server-side-encryption header is not set to AES256. However, some objects are still stored with SSE-KMS. How can the company enforce SSE-S3 exclusively?

Accepted Answer

Update the bucket policy to deny uploads with SSE-KMS.. Option D is correct because using a bucket policy to deny uploads with SSE-KMS or without encryption ensures only SSE-S3 is allowed. Option A is incorrect because the bucket policy must be updated. Option B is incorrect because default encryption applies to new objects but does not prevent SSE-KMS. Option C is incorrect because lifecycle rules do not change encryption of existing objects.

Answer

Use S3 Lifecycle policies to transition objects to SSE-S3.

Answer

Enable default encryption on the bucket with SSE-S3.

Answer

Use S3 Object Lambda to change encryption.

Question 4

A company is using Amazon RDS for MySQL and notices that read replicas are falling behind the primary. The primary instance is experiencing high write traffic. What is the best solution to reduce replica lag?

Accepted Answer

Increase the instance class of the read replica.. Option C is correct because increasing the replica instance class size improves its ability to apply changes. Option A is incorrect because Multi-AZ does not affect read replica lag. Option B is incorrect because read replicas cannot be in the same region. Option D is incorrect because disabling binary logging would break replication.

Answer

Enable Multi-AZ on the primary instance.

Answer

Disable binary logging on the primary.

Answer

Move the read replica to the same AWS Region as the primary.

Question 5

An IAM policy condition allows launching EC2 instances only if the instance type is t2.micro or t2.small. A developer tries to launch a t2.medium instance. What happens?

Accepted Answer

The launch is denied because t2.medium is not in the allowed list.. Option C is correct because the condition restricts allowed instance types, so t2.medium is not allowed. Option A is incorrect because the condition is explicit. Option B is incorrect because the condition applies. Option D is incorrect because the policy is evaluated at launch time.

Answer

The launch is denied only if the user does not have a separate policy allowing t2.medium.

Answer

The launch succeeds because the condition only allows, not denies.

Answer

The launch succeeds if the user has an additional Allow for t2.medium.

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

Accepted Answer

Enable detailed monitoring on the EC2 instances.. Option D is correct because detailed CloudWatch metrics (at 1-minute granularity) can provide more granular data to pinpoint when CPU spikes occur. Option A is wrong because increasing instance size only masks the symptom. Option B is wrong because scaling policies respond to sustained high CPU, not intermittent spikes. Option C is wrong because CloudTrail records API calls, not instance-level metrics.

Answer

Increase the instance size to handle the load.

Answer

Add a scaling policy based on CPU utilization.

Answer

Enable AWS CloudTrail to log EC2 API calls.

Question 7

A company uses an Amazon RDS for MySQL DB instance. The database is experiencing high read latency. The team wants to improve read performance with minimal application changes. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Create one or more read replicas and direct read queries to them.. Options A and C are correct. Option A: Read replicas offload read traffic from the primary instance, reducing latency. Option C: Increasing instance size (e.g., moving to a larger instance class) can improve I/O performance. Option B is wrong because Multi-AZ is for high availability, not read performance. Option D is wrong because increasing max_connections does not improve read latency. Option E is wrong because switching to Aurora is a major change and may not be minimal.

Answer

Enable Multi-AZ deployment for failover support.

Answer

Migrate the database to Amazon Aurora.

Answer

Increase the max_connections parameter.

Question 8

A company has a fleet of EC2 instances that process data from an SQS queue. The instances are part of an Auto Scaling group. The team notices that the queue depth is growing, but the Auto Scaling group is not scaling out quickly enough. Which THREE actions should the team take to improve the scaling responsiveness? (Choose three.)

Accepted Answer

Use a custom CloudWatch metric for the SQS queue depth to drive scaling.. Options B, D, and E are correct. Option B: Using a custom metric based on queue depth allows scaling on actual workload. Option D: Reducing the cooldown period allows faster scaling actions. Option E: Using a step scaling policy provides more aggressive scaling when queue depth is high. Option A is wrong because increasing instance size does not improve scaling speed. Option C is wrong because decreasing the warm-up time for the metric is not a standard Auto Scaling feature.

Answer

Decrease the AWS CloudWatch metric warm-up time.

Answer

Increase the instance size in the launch template.

Question 9

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

Accepted Answer

Set up an automatic remediation action using AWS Config to enable encryption on non-compliant buckets.. Option A is correct because SCPs can enforce encryption. Option C is correct because Config rules detect non-compliance. Option E is correct because remediation actions can auto-fix violations. Option B is wrong because IAM policies are not preventive at the OU level. Option D is wrong because CloudTrail trails are for logging, not enforcement.

Answer

Attach an IAM policy to each account's root user.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 10

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Accepted Answer

Add a NAT Gateway in the public subnet and update the private subnet's route table.. Option A is correct because a NAT Gateway in a public subnet allows outbound internet traffic while preventing inbound connections. Option B is incorrect because a NAT instance is less managed and secure. Option C is incorrect because a VPC endpoint is for AWS services only. Option D is incorrect because an Internet Gateway attached to the private subnet would allow inbound traffic.

Answer

Create a VPC endpoint for the internet.

Answer

Launch a NAT instance in the private subnet.

Answer

Attach an Internet Gateway directly to the private subnet.

Question 11

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. Option C is correct because increasing the timeout allows longer-running functions to complete without failing. Option A is wrong because increasing memory also increases cost and may not be needed. Option B is wrong because SQS is for decoupling, not for fixing timeouts. Option D is wrong because Step Functions add complexity and cost; simpler is to adjust the timeout.

Answer

Increase the memory allocation for the Lambda function.

Answer

Use an SQS queue to buffer the S3 events.

Answer

Use AWS Step Functions to orchestrate the processing.

Question 12

A company uses AWS CloudFormation to manage infrastructure. A recent update to a stack failed, and the stack is now in a ROLLBACK_COMPLETE state. The team needs to investigate the cause and then redeploy the update. Which TWO actions should the team take? (Choose two.)

Accepted Answer

View the stack events in the CloudFormation console.. Options A and E are correct. Option A: Viewing stack events shows detailed error messages for each resource. Option E: Using ChangeSets allows previewing changes before applying. Option B is wrong because the stack is in ROLLBACK_COMPLETE, not UPDATE_ROLLBACK_FAILED. Option C is wrong because StackSets manage multiple accounts, not single stack debugging. Option D is wrong because the template is already in use; reviewing the previous version is not directly helpful.

Answer

Review the previous stack template version.

Answer

Use AWS CloudFormation StackSets to redeploy across accounts.

Answer

Execute a rollback to continue the rollback process.

Question 13

A company uses an AWS CodePipeline to deploy a serverless application. The pipeline includes a build stage that runs on AWS CodeBuild and a deploy stage that updates an AWS Lambda function. The company wants to add a manual approval step before the deploy stage. What is the most efficient way to implement this?

Accepted Answer

Add a manual approval action in the CodePipeline stage before deploy.. Option C is correct because CodePipeline has a built-in approval action that can be added to the pipeline. Option A is wrong because using a Lambda function for approval is unnecessary. Option B is wrong because SNS alone does not provide approval. Option D is wrong because CloudFormation is not needed for a simple approval step.

Answer

Add an AWS Lambda function that sends an email for approval.

Answer

Use an AWS CloudFormation stack with a wait condition.

Answer

Configure an Amazon SNS topic to notify approvers.

Question 14

A CloudFormation stack update failed with the above error. What is the likely cause?

Accepted Answer

The runtime is no longer supported by AWS Lambda.. Option D is correct because the error message explicitly states that the runtime 'nodejs14.x' is not supported. Option A is wrong because the S3 bucket is not the issue. Option B is wrong because the role ARN is correct. Option C is wrong because the timeout is within limits.

Answer

The S3 bucket does not contain the zip file.

Answer

The IAM role ARN is incorrect.

Answer

The timeout value is too high.

Question 15

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Options B and D are correct. B enforces encryption at upload time, and D provides server-side encryption. A does not enforce encryption, C is about access logging, and E is about replication.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning on the buckets.

Answer

Enable S3 Server Access Logs.

Question 16

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster to cache frequently accessed data.. Options A, C, and E are correct. Read replicas offload read traffic, ElastiCache reduces database load, and Multi-AZ provides high availability but not read scaling. Option B is wrong because it does not support sharding. Option D is wrong because it only provides failover, not read scaling.

Answer

Deploy a Multi-AZ RDS instance for automatic failover.

Answer

Implement database sharding by splitting the data across multiple RDS instances.

Question 17

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Option A is correct because increasing reserved concurrency allows more concurrent invocations. Option B is wrong because adding more Lambda functions is not how concurrency works. Option C is wrong because increasing batch size may cause timeouts. Option D is wrong because decreasing concurrency worsens the problem.

Answer

Create multiple Lambda functions each processing a subset of the queue.

Answer

Decrease the reserved concurrency to force the function to process messages more efficiently.

Answer

Increase the batch size of the SQS event source mapping.

Question 18

A company is designing a disaster recovery strategy for a critical application running on Amazon RDS for PostgreSQL. The primary database is in us-east-1. The company needs a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Configure a Multi-AZ deployment with a standby in a different AWS Region.. Option A is correct because Multi-AZ with a standby in another region (cross-region) provides synchronous replication with low RPO/RTO. Option D is correct because a read replica in another region can be promoted quickly. Option B is wrong because cross-region snapshot copy has higher RPO. Option C is wrong because automated backups have higher RPO. Option E is wrong because DMS has higher latency.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Answer

Take daily snapshots and copy them to another Region.

Answer

Enable automated backups with a retention period of 35 days.

Question 19

A developer is deploying a serverless application using AWS SAM. The deployment fails with a 'ResourceNotReady' error. What is the most likely cause?

Accepted Answer

A resource that the application depends on is not yet created.. Option B is correct because 'ResourceNotReady' indicates a dependency is not ready. Option A is incorrect because template syntax errors would show before deployment. Option C is incorrect because code errors would show during invocation. Option D is incorrect because tags do not cause this error.

Answer

The SAM template has invalid YAML syntax.

Answer

The application has too many tags.

Answer

The Lambda function code has a runtime error.

Question 20

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

Accepted Answer

Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.. Option D is correct because a service control policy (SCP) can deny the creation of S3 buckets without encryption, enforcing compliance across all accounts. Option A is wrong because it relies on Lambda execution after bucket creation, which may have a delay. Option B is wrong because AWS Config rules can detect but not automatically remediate without additional automation. Option C is wrong because CloudTrail logs events but does not prevent non-compliant actions.

Answer

Use AWS Config rules with auto-remediation using SSM Automation.

Answer

Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.

Answer

Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.