SAP-C02 Practice Exam 66 — 20 Questions

Question 1

A company uses AWS Organizations with multiple OUs. The finance team needs to have read-only access to billing data across all accounts. The security team wants to ensure that no IAM user can modify billing preferences. Which policy should be attached to the root OU to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An SCP that denies the effect of actions that modify billing preferences.. A Service Control Policy (SCP) attached to the root OU can deny the effect of actions that modify billing preferences across all accounts in the organization. SCPs are the only mechanism that can restrict permissions for all principals (including the root user) in member accounts, and by using a Deny effect on specific billing modification actions, the security team ensures no IAM user or role can alter billing settings. This approach does not require enumerating every allowed read-only action, which avoids the risk of missing future read-only actions.

Answer

An SCP that allows only read-only billing actions.

Answer

An SCP that denies all billing-related actions except read-only.

Answer

An IAM policy attached to the root OU that denies billing modifications.

Question 2

A company is designing a new application that will run on AWS. The application needs to store and retrieve user session data with low latency. The session data is small (less than 1 KB per user) and must be highly available. The company expects up to 10 million active users per day. Which AWS service should be used as the session store?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis is an in-memory data store designed for low-latency access, making it ideal for session storage for millions of users. Option A: DynamoDB has higher latency compared to in-memory stores. Option B: S3 is object storage and not suitable for low-latency session data. Option C: RDS for MySQL is relational and slower for session access.

Answer

Amazon DynamoDB

Answer

Amazon S3

Answer

Amazon RDS for MySQL

Question 3

A company is migrating a legacy on-premises application to AWS. The application uses a monolithic architecture and a MySQL database. The company wants to refactor the application into microservices and use a NoSQL database for better scalability. The new application will be deployed on Amazon EKS. The database must be highly available and support automatic scaling. Which database service should the company use?

Accepted Answer

Amazon DynamoDB. Amazon DynamoDB is a NoSQL database that supports high availability and automatic scaling. Option A: Amazon Aurora Serverless is a relational database, not NoSQL. Option C: Amazon DocumentDB (with MongoDB compatibility) is a NoSQL database but is MongoDB-compatible; DynamoDB is more fully managed and serverless and better suited for microservices on EKS. Option D: Amazon RDS for MySQL with Multi-AZ deployment is relational and not NoSQL.

Answer

Amazon Aurora Serverless

Answer

Amazon DocumentDB (with MongoDB compatibility)

Answer

Amazon RDS for MySQL with Multi-AZ deployment

Question 4

A company runs a static website on Amazon S3 with a custom domain using Amazon Route 53. The website content is updated frequently by multiple developers. The company wants to implement a workflow where updates are automatically tested and deployed. They have existing CI/CD tools that integrate with AWS CodeCommit. The Solutions Architect needs to design a deployment pipeline that rebuilds the website only when changes are pushed to the main branch, and then invalidates the Amazon CloudFront cache if a CloudFront distribution is used. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use AWS CodePipeline with a source stage tied to CodeCommit, a build stage using AWS CodeBuild, and a deploy stage that syncs the S3 bucket and invalidates CloudFront.. AWS CodePipeline with a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that syncs to S3 and invalidates CloudFront provides a fully managed CI/CD pipeline with minimal operational overhead. Option A is wrong because CloudFormation is for infrastructure provisioning, not for building a deployment pipeline triggered by code pushes. Option B is wrong because S3 event notifications trigger Lambda functions for simple tasks, not for full CI/CD build and deploy workflows. Option D is wrong because Lambda@Edge is for processing requests at edge locations, not for building and deploying static content.

Answer

Use AWS CloudFormation with a custom resource that triggers a build on CodeCommit push.

Answer

Configure an S3 event notification to invoke an AWS Lambda function that builds and deploys the website.

Answer

Use AWS Lambda@Edge to generate the website on the fly and cache at CloudFront.

Question 5

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

Accepted Answer

Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.. SSE-KMS allows the company to use AWS KMS for centralized key management and access control, ensuring that only authorized users can access the decryption keys. Option A is incorrect because an S3 bucket policy restricting put permissions does not control access to existing objects' encryption keys. Option B is incorrect because SSE-S3 keys are managed by AWS, not the customer, so the security team cannot enforce key access controls. Option C is incorrect because client-side encryption does not use S3 server-side encryption and would require managing keys outside of AWS.

Answer

Configure an S3 bucket policy to allow only specific IAM roles to put objects.

Answer

Continue using SSE-S3 and enable S3 Block Public Access.

Answer

Use client-side encryption with an AWS KMS key.

Question 6

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics such as CPU and memory usage.. Options A, C, and D are correct. Enabling Enhanced Monitoring provides OS-level metrics like CPU and memory usage, helping to identify resource bottlenecks. Performance Insights helps identify the specific queries consuming the most CPU, enabling targeted optimization. Reviewing RDS events can reveal recent maintenance activities or failovers that might impact performance. Option B is incorrect because increasing instance size or IOPS is a remedial action, not a diagnostic step. Option E is incorrect because Multi-AZ is for high availability, not performance diagnosis.

Answer

Increase the instance size to provisioned IOPS to handle the load.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 7

Refer to the exhibit. This bucket policy is applied to a central logging bucket in account 111111111111. Account 222222222222 wants to deliver CloudTrail logs to this bucket. However, log delivery fails. What is the MOST likely cause?

Accepted Answer

The principal should be the CloudTrail service principal, not the root account of 111111111111.. The bucket policy in the exhibit likely specifies the root user of account 111111111111 as the principal, but CloudTrail in account 222222222222 must be allowed to write logs. For cross-account CloudTrail log delivery, the principal must be the CloudTrail service principal (e.g., `cloudtrail.amazonaws.com`) rather than a specific AWS account root user, because CloudTrail assumes a service-linked role to deliver logs to the destination bucket. Without the correct service principal, the policy denies the write operation, causing log delivery to fail.

Answer

The resource ARN is incorrect.

Answer

The bucket policy requires the x-amz-acl header, which CloudTrail does not set.

Answer

The bucket policy does not allow s3:PutObject for the account 222222222222.

Question 8

A company is designing a new serverless data processing pipeline that uses Amazon Kinesis Data Streams to ingest real-time clickstream data. The data must be processed using AWS Lambda and then stored in Amazon S3. The company needs to ensure that records are processed in order within each shard and that each record is processed exactly once. Which configuration should they use? (Choose TWO.)

Accepted Answer

Use the Kinesis Client Library (KCL) and implement deduplication logic in the Lambda function.. The correct options are D and E. Using the Kinesis Client Library (KCL) with deduplication logic ensures exactly-once processing and maintains per-shard ordering. Configuring the Lambda function with a reserved concurrency of 1 limits the function to a single concurrent execution, which can enforce sequential processing across shards and help preserve order, though it is not a scalable per-shard solution. Option A is incorrect because SQS FIFO adds unnecessary complexity and does not preserve Kinesis shard ordering natively. Option B is incorrect because the batch window only affects invocation latency, not ordering or exactly-once semantics. Option C is incorrect because enabling parallelization factor allows concurrent batches per shard, breaking strict ordering.

Answer

Use an Amazon SQS FIFO queue between Kinesis and Lambda to ensure ordering.

Answer

Increase the batch window to reduce the number of Lambda invocations.

Answer

Enable parallelization factor on the Lambda event source mapping.

Question 9

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application consists of a frontend service and a backend service. The backend service is CPU-intensive and experiences high load during business hours. The operations team observes that the frontend service sometimes returns 503 errors during peak load. The team has already configured an ECS service auto scaling policy for the backend service based on average CPU utilization with a target value of 70%. The backend service is currently running 4 tasks, and the frontend is running 2 tasks. The errors seem to correlate with the backend scaling up. Which solution should the team implement to improve the application's performance and reduce errors?

Accepted Answer

Update the backend service auto scaling policy to use a combination of CPU and memory utilization metrics with a step scaling policy, and increase the cooldown period to allow tasks to stabilize before additional scaling actions.. The 503 errors during backend scale-up are likely caused by the backend tasks not being fully ready to handle traffic immediately after launch. By using a combination of CPU and memory utilization metrics with a step scaling policy, the team can make scaling decisions more responsive to actual load patterns. Increasing the cooldown period prevents additional scaling actions from being triggered prematurely, giving new tasks time to stabilize and reducing the window where the backend is overwhelmed, which in turn reduces frontend timeouts.

Answer

Reduce the target CPU utilization for the backend auto scaling policy from 70% to 50% to trigger scaling earlier and keep CPU lower.

Answer

Change the backend service from Fargate to EC2 launch type and use larger instance types to provide more CPU capacity.

Answer

Increase the desired count of the frontend service to 4 tasks to handle more requests and reduce the load on the backend service.

Question 10

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application occasionally receives traffic spikes that cause the Auto Scaling group to launch new instances. However, the new instances take several minutes to become healthy, causing a temporary performance degradation. Which TWO actions would improve the scaling responsiveness? (Select TWO.)

Accepted Answer

Use a launch template with a pre-provisioned AMI that includes the application and dependencies.. Using a launch template with a pre-provisioned AMI reduces instance startup time, allowing new instances to become healthy faster during traffic spikes. Option E is correct because a scheduled scaling policy can add instances before expected traffic spikes, proactively handling the load. Option A is incorrect because increasing the cooldown period would delay additional scaling actions, worsening responsiveness. Option B is incorrect because reducing the health check interval does not speed up instance initialization; it only checks health more frequently. Option C is incorrect because decreasing the health check grace period may cause instances to be terminated prematurely before they have a chance to become healthy.

Answer

Increase the Auto Scaling group cooldown period.

Answer

Reduce the target group health check interval to 5 seconds.

Answer

Decrease the health check grace period to 30 seconds.

Question 11

A company is building a new microservices-based application on AWS using Amazon ECS with Fargate. The application has a frontend service, an order service, and a payment service. Services communicate synchronously via REST APIs. The company expects variable traffic and wants to ensure that failures in one service do not cascade to others. Which solution should a Solutions Architect recommend?

Accepted Answer

Implement retry logic with exponential backoff, circuit breakers, and timeouts in each service's client code.. Implementing retry logic with exponential backoff, circuit breakers, and timeouts is the standard pattern to handle transient faults and prevent cascading failures in synchronous microservices communication. Circuit breakers stop calls to a failing service, allowing it to recover, while retries with backoff avoid overwhelming the service. Option A is wrong because API Gateway throttling only protects API Gateway itself, not cascading failures between internal services. Option C is wrong because converting to asynchronous messaging is an architectural change that may not be suitable for synchronous REST APIs and does not directly address failure cascading without additional patterns. Option D is wrong because deploying multiple instances across AZs improves availability but does not protect against failures within a single service instance; it does not prevent cascading failures.

Answer

Use Amazon API Gateway in front of each service to throttle requests and protect against traffic spikes.

Answer

Convert all inter-service communication to asynchronous messaging using Amazon SQS or SNS.

Answer

Deploy multiple instances of each service across multiple Availability Zones and use an Application Load Balancer.

Question 12

A company is designing a new application on AWS that processes real-time IoT sensor data from thousands of devices. The data must be ingested, processed, and stored for analysis. The company wants to use a serverless architecture to reduce operational overhead. The processing includes filtering, aggregation, and transformation. Which solution should a Solutions Architect recommend?

Accepted Answer

Use AWS IoT Core to ingest data, use IoT rules to route data to Kinesis Data Analytics for real-time processing, and store results in S3.. AWS IoT Core is purpose-built for ingesting data from IoT devices, its rules engine can route data to Kinesis Data Analytics for real-time processing using SQL, and results can be stored in S3 for analysis. Option A is incorrect because Kinesis Data Firehose delivers data in batches, not real-time processing as required. Option B is incorrect because while Lambda can process, it may have concurrency limits and is less optimal for high-throughput streaming compared to Kinesis Data Analytics. Option C is incorrect because SQS is not designed for real-time streaming ingestion from IoT devices; it's a message queue, not a streaming service.

Answer

Use Amazon Kinesis Data Streams to ingest data, use Kinesis Data Firehose to deliver data to S3, and use Athena for queries.

Answer

Use Amazon Kinesis Data Streams to ingest data, trigger a Lambda function for processing, and store results in DynamoDB.

Answer

Use Amazon SQS to ingest sensor data, trigger a Lambda function for processing, and store results in DynamoDB.

Question 13

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

Accepted Answer

Increase the number of EC2 instances running the consumer application.. The Kinesis Client Library (KCL) distributes shard processing across workers. Increasing the number of EC2 instances running the consumer application adds more workers, allowing parallel processing of shards and thus improving throughput for the lagging consumer. Option A is incorrect because decreasing the batch size reduces the number of records processed per call, which typically lowers throughput. Option B is incorrect because increasing the number of shards increases the stream's total capacity but does not directly help a consumer that is already falling behind; it may actually require more workers to handle the additional shards. Option C is incorrect because extending the retention period affects how long data is stored, not how quickly it is processed.

Answer

Decrease the batch size in the KCL configuration.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the Kinesis stream's retention period to 7 days.

Question 14

A company is designing a new application that will process sensitive financial transactions. The application must be deployed in a VPC with no public internet access. The application needs to send logs to Amazon CloudWatch Logs and store files in Amazon S3. Which set of actions should be taken to meet these requirements without allowing internet access?

Accepted Answer

Create a Gateway VPC endpoint for S3 and an Interface VPC endpoint for CloudWatch Logs. A Gateway VPC endpoint for S3 allows private connectivity to S3 without traversing the internet, using route table entries. An Interface VPC endpoint for CloudWatch Logs, powered by AWS PrivateLink, enables private HTTPS connections to the CloudWatch Logs API without requiring a NAT gateway or internet gateway. Together, these endpoints satisfy the requirement for a VPC with no public internet access.

Answer

Place the application behind a public Application Load Balancer

Answer

Set up a NAT gateway in a public subnet and route traffic through it

Answer

Use AWS PrivateLink to connect to CloudWatch Logs and S3

Question 15

A company is designing a cross-account backup strategy using AWS Backup. They have a central backup account that needs to manage backups for multiple member accounts. What is the minimal set of permissions required?

Accepted Answer

Create an IAM role in each member account that trusts the backup account and allows backup and restore actions.. AWS Backup requires cross-account IAM roles to delegate backup and restore permissions. The central backup account assumes an IAM role in each member account that has a trust policy allowing the backup account's IAM entity to perform backup and restore actions. This is the minimal set of permissions needed to manage backups across accounts without granting broader access.

Answer

Create a customer managed key in the backup account and share it with member accounts.

Answer

Grant the backup account full S3 access to member account buckets.

Answer

Enable AWS Config in member accounts to track backup compliance.

Question 16

A company is migrating an application that uses a commercial database to Amazon RDS. The database size is 500 GB. Which migration approach minimizes downtime?

Accepted Answer

Use AWS Database Migration Service (AWS DMS) with ongoing replication (change data capture).. AWS Database Migration Service (AWS DMS) with ongoing replication (change data capture) allows the source database to remain fully operational during migration, with only a brief downtime during the final cutover. This minimizes overall downtime. Option A is incorrect because using native database tools for export and import requires taking the source database offline for the duration of the export and import. Option B is incorrect because AWS Snowball Edge is an offline data transfer device; it requires copying database files to the device and shipping it, which does not support ongoing replication and results in significant downtime. Option D is incorrect because copying database files to Amazon S3 and restoring to RDS involves creating a backup of the database, which can cause downtime, and the restore process also takes time.

Answer

Use native database tools to export and import data.

Answer

Use AWS Snowball Edge to transfer the database files.

Answer

Copy database files to Amazon S3 and restore to RDS.

Question 17

A company is migrating a critical workload to AWS and needs to ensure business continuity. The workload runs on a single EC2 instance with a 500 GB EBS volume. The company requires a Recovery Time Objective (RTO) of 2 hours and a Recovery Point Objective (RPO) of 15 minutes. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Use Amazon EBS snapshots with a 15-minute frequency and automate recovery with AWS Backup.. EBS snapshots can be taken every 15 minutes to meet the RPO, and restoring from a snapshot can meet the 2-hour RTO. AWS Backup automates the snapshot schedule and recovery, minimizing operational overhead. Option A is incorrect because creating AMIs every 15 minutes is impractical and would not meet the RTO efficiently. Option B is incorrect because RDS Multi-AZ is designed for database workloads, not general EC2 instances. Option D is incorrect because AWS Elastic Disaster Recovery introduces higher complexity and cost compared to the simpler snapshot-based approach for a single-instance workload.

Answer

Create an AMI of the instance every 15 minutes and launch a new instance from the latest AMI in case of failure.

Answer

Deploy the workload on Amazon RDS Multi-AZ and enable automatic failover.

Answer

Use AWS Elastic Disaster Recovery to continuously replicate the EC2 instance to another Region.

Question 18

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

Accepted Answer

Configure the JDBC connection string with a timeout and implement automatic retry logic.. Implementing a timeout and automatic retry logic in the JDBC connection pool ensures that after a failover, the application can quickly detect the failed connection and reconnect to the new primary. Option A is incorrect because restarting the application via CloudWatch Events and Lambda does not directly address connection failures and may cause additional downtime. Option B is incorrect: while Amazon RDS Proxy can help manage connections and reduce latency, it does not eliminate the need for application-level retry logic; during failover, connections are dropped and need to be re-established. Option D is incorrect because increasing the TTL of the RDS DNS record would actually cause the application to cache the old DNS record longer, delaying failover detection.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Increase the TTL for the RDS DNS record to 60 seconds.

Question 19

A startup is building a serverless application using AWS Lambda. They need to securely store and retrieve database credentials without hardcoding them in the function code. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS SDK, allowing retrieval of credentials at runtime without hardcoding, and supports automatic rotation of secrets for supported databases like Amazon RDS.

Answer

Amazon DynamoDB

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 20

A company has a production AWS account and a development AWS account. The development team needs to assume an IAM role in the production account to deploy resources. What is the correct way to set up this cross-account access?

Accepted Answer

Create an IAM role in the production account with a trust policy that specifies the development account as a trusted entity. Cross-account IAM role access requires creating an IAM role in the production (trusting) account with a trust policy that explicitly lists the development (trusted) account as a principal. The development team then assumes that role using the AWS STS AssumeRole API, which returns temporary security credentials. This follows the AWS recommended pattern for delegating access without sharing long-term credentials.

Answer

Apply a service control policy to allow cross-account access

Answer

Create an IAM user in the production account and share the credentials with the development team

Answer

Configure security group rules to allow access from the development account