SAP-C02 Practice Exam 66 — 20 Questions

Question 1

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

Accepted Answer

Reduce the cooldown period for the Auto Scaling group.. Option C is correct because reducing the cooldown period allows the Auto Scaling group to respond faster to changes. Option A is wrong because increasing min size does not speed up scaling. Option B is wrong because it changes the threshold. Option D is wrong because it's not about instance type.

Answer

Decrease the CPU utilization threshold for scale-out alarms.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Answer

Use a larger instance type to handle more traffic.

Question 2

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs all API calls to S3, including KMS decrypt calls. Option A is wrong because AWS Config records resource configuration, not access. Option B is wrong because VPC Flow Logs track network traffic, not API calls. Option D is wrong because CloudWatch Logs can store logs but not generate them from S3 access.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 3

A company is using AWS Lambda functions to process data from an S3 bucket. Recently, the function has been timing out. The function has a 5-minute timeout configured. What is the most likely cause of the timeout?

Accepted Answer

The Lambda function is processing larger files than before.. Option B is correct because if the Lambda function is processing larger files, it may exceed the 5-minute timeout. Option A is incorrect because increasing memory does not affect timeout. Option C is incorrect because reserved concurrency does not affect execution time. Option D is incorrect because a new VPC configuration would not cause a timeout by itself.

Answer

The Lambda function was moved to a different VPC.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The Lambda function's memory is too low.

Question 4

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO).. Options A, B, and D are correct. A: RTO and RPO define recovery objectives. B: Replication of data ensures consistency. D: DNS failover routes traffic to DR site. C is incorrect because using larger instances may not be needed. E is incorrect because multiple AZs solve high availability within a region, not DR across regions.

Answer

Deploying the application across multiple Availability Zones.

Answer

Using larger instance sizes for better performance.

Question 5

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

Accepted Answer

Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set.. Option C is correct because an S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones. Option D is wrong because CloudTrail does not enforce encryption.

Answer

Enable default encryption on the bucket.

Answer

Use S3 Batch Operations to encrypt existing objects.

Answer

Enable AWS CloudTrail to monitor uploads without encryption.

Question 6

A company has an Amazon S3 bucket that stores sensitive data. The company wants to ensure that all data in the bucket is encrypted at rest. Which action should the Solutions Architect take?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3, SSE-KMS, or SSE-C.. Option A is correct because enabling default encryption on the bucket ensures all objects are encrypted. Option B is wrong because bucket policies do not encrypt data. Option C is wrong because CloudHSM is not required. Option D is wrong because pre-signed URLs do not enforce encryption.

Answer

Use AWS CloudHSM to manage encryption keys.

Answer

Configure a bucket policy that denies unencrypted uploads.

Answer

Require the use of pre-signed URLs for uploads.

Question 7

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Accepted Answer

Create one or more Read Replicas in the same region.. Option B is correct because creating Read Replicas offloads read traffic from the primary instance. Option A increases cost unnecessarily, C requires application changes, and D does not directly improve read performance.

Answer

Enable Multi-AZ deployment for failover.

Answer

Use Amazon ElastiCache to cache frequent queries.

Answer

Upgrade to a larger instance type.

Question 8

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

Accepted Answer

The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.. Option A is correct because the pattern suggests the function times out after 30 seconds of processing, and the SQS messages become visible again after the visibility timeout. The errors at regular intervals (20 minutes) indicate that the function retries the same messages. Option B is wrong because insufficient concurrency would cause throttles, not errors. C is wrong because memory would cause out-of-memory errors, not timeouts. D is wrong because runtime updates would cause all invocations to fail.

Answer

The Lambda function is running out of memory.

Answer

The Lambda function is hitting the reserved concurrency limit.

Answer

The Lambda function is using an incompatible runtime.

Question 9

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

Accepted Answer

Create a new launch template with a patched AMI, then perform a rolling update that detaches and reattaches the existing EBS volumes.. Option D is correct because replacing instances with a new launch template and attaching the existing EBS volumes preserves data. Option A is wrong because it causes downtime. Option B is wrong because it does not preserve state. Option C is wrong because it does not preserve data.

Answer

Use a rolling update with a new Auto Scaling group and delete old instances.

Answer

Terminate all instances and launch new ones with a patched AMI.

Answer

Use Systems Manager Patch Manager to apply patches to running instances.

Question 10

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

Accepted Answer

Enable Amazon RDS Proxy.. Option A is correct because enabling Amazon RDS Proxy provides connection pooling and reduces failover time by keeping connections alive. Option B is wrong because read replicas are for read scaling, not for reducing failover time. Option C is wrong because increasing instance size doesn't directly affect failover time. Option D is wrong because disabling Multi-AZ increases downtime.

Answer

Disable Multi-AZ to avoid failover altogether.

Answer

Create a read replica and promote it during failover.

Answer

Increase the DB instance size to improve performance.

Question 11

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

Accepted Answer

Configure the JDBC connection string with a timeout and implement automatic retry logic.. Option C is correct because using a custom JDBC URL with a timeout and retry logic allows the application to reconnect after failover. Option A is wrong because RDS proxy does not eliminate the need for application retry logic. Option B is wrong because increasing the TTL does not affect the connection timeout. Option D is wrong because a Lambda function does not directly improve failover recovery.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Increase the TTL for the RDS DNS record to 60 seconds.

Question 12

A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?

Accepted Answer

The subnet's network ACL is blocking inbound SSH traffic.. Option A is correct because the network ACL must allow inbound SSH traffic on port 22. Option B is incorrect because security group already allows SSH. Option C is incorrect because the instance status check failing would show other symptoms. Option D is incorrect because the instance has a public IP.

Answer

The instance does not have a public IP address.

Answer

The instance is failing system status checks.

Answer

The security group is not attached to the instance.

Question 13

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

Accepted Answer

VPC Reachability Analyzer.. Options A and D are correct. A: VPC Flow Logs capture IP traffic information. D: Reachability Analyzer checks network paths. B is incorrect because CloudTrail records API calls, not network traffic. C is incorrect because Config records resource configuration, not real-time connectivity. E is incorrect because Inspector is for security assessments.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Answer

AWS Config.

Question 14

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The team notices that during a recent traffic spike, some instances were terminated and replaced, causing a temporary drop in performance. How can the team improve the resilience of the application?

Accepted Answer

Configure a warm pool for the Auto Scaling group.. Option B is correct because using a warm pool allows instances to be pre-initialized and ready to serve traffic quickly when scaling out. Option A is wrong because increasing instance size does not address the replacement delay. Option C is wrong because purchasing Reserved Instances does not affect scaling speed. Option D is wrong because lifecycle hooks can delay termination but do not speed up new instance readiness.

Answer

Purchase Reserved Instances to ensure capacity.

Answer

Use lifecycle hooks to wait for instance termination.

Answer

Increase the instance size to handle more traffic.

Question 15

Refer to the exhibit. A company configured an Amazon Route 53 alias record for a domain name pointing to an Application Load Balancer (ALB). Users report that occasionally they are directed to an unhealthy ALB node. Which change should the company make to improve availability?

Accepted Answer

Configure the ALB health check to mark unhealthy nodes.. Option D is correct because setting EvaluateTargetHealth to true ensures that Route 53 only returns IP addresses of healthy ALB nodes. The exhibit shows EvaluateTargetHealth: true, so it is already set. But the question says users are directed to unhealthy nodes, so perhaps the ALB health check is misconfigured. However, the correct answer is to ensure health checks are properly configured. Option A is wrong because changing to a simple record does not provide health checking. Option B is wrong because weighted routing is for distributing traffic, not for health. Option C is wrong because multi-value answer routing can return multiple values, but it does not inherently improve health checking beyond what alias records provide. Actually, the issue is that the ALB health check might be misconfigured; the best solution is to configure the ALB health check correctly. Among the options, D is the most relevant.

Answer

Change the record type to CNAME.

Answer

Use weighted routing policy.

Answer

Use multi-value answer routing.

Question 16

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. To improve recovery time in the event of an AZ failure, which TWO actions should the company take? (Choose two.)

Accepted Answer

Create an Amazon Machine Image (AMI) from the instance.. Options A and C are correct. Option A: Using an AMI from the instance ensures a quick launch in another AZ. Option C: EBS snapshots can be used to create volumes in another AZ. Option B is wrong because EBS volumes are AZ-specific. Option D is wrong because EC2 instances are AZ-specific. Option E is wrong because EBS multi-attach is for specific use cases, not AZ recovery.

Answer

Use EBS multi-attach to attach the volume to instances in another AZ.

Answer

Copy the EBS volume to another AZ using the AWS Management Console.

Answer

Configure the Auto Scaling group to launch instances in multiple AZs.

Question 17

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

Accepted Answer

Enable auto scaling for DynamoDB and implement retry logic with exponential backoff in the Lambda function.. Option A is correct because enabling DynamoDB auto scaling adjusts capacity dynamically, and adding retry logic with exponential backoff in Lambda handles transient errors. Option B is wrong because SQS with Lambda can buffer requests. C is wrong because increasing capacity might be costly and does not handle spikes. D is wrong because Lambda retries on its own but without backoff.

Answer

Increase the provisioned read/write capacity of the DynamoDB table to a high fixed value.

Answer

Use an SQS queue between API Gateway and Lambda to buffer requests.

Answer

Configure API Gateway to automatically retry failed requests.

Question 18

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Accepted Answer

No security group or network ACL allows inbound traffic.. Option B is correct because the template does not configure a security group or network ACL to allow inbound traffic. The route table and internet gateway are correctly set up for outbound traffic. Option A is wrong because the subnet has MapPublicIpOnLaunch: true. C is wrong because the route exists. D is wrong because the VPC is not missing an internet gateway.

Answer

The subnet does not have auto-assign public IP enabled.

Answer

The VPC does not have an internet gateway attached.

Answer

The route table does not have a route to the internet gateway.

Question 19

A company is running a stateful web application on EC2 instances behind an ALB. Users report that when they refresh a page, they are logged out. What is the best solution to fix this issue?

Accepted Answer

Enable sticky sessions on the ALB.. Option C is correct because enabling stickiness (session affinity) ensures requests from the same user go to the same instance. Option A is incorrect because a Classic Load Balancer doesn't solve statefulness. Option B is incorrect because ElastiCache doesn't solve routing. Option D is incorrect because cross-zone load balancing doesn't affect session persistence.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Replace the ALB with a Classic Load Balancer.

Answer

Use ElastiCache to store session data.

Question 20

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

Accepted Answer

The upload is denied because the Deny statement applies to all uploads.. Option B is correct because the Deny statement without a condition applies to all uploads, overriding the Allow. Option A is incorrect because the Allow only applies to SSE-S3. Option C is incorrect because the Deny statement applies to all principals. Option D is incorrect because the Deny statement is explicit.

Answer

The upload succeeds because the Deny statement has no Principal specified.

Answer

The upload is denied only if the object is larger than 5 GB.

Answer

The upload succeeds because the user has an Allow for s3:PutObject.