SAP-C02 Practice Exam 67 — 20 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

Accepted Answer

Use a CloudFormation stack policy with a deny effect for resource creation without tags.. Option C is correct because CloudFormation stack policies can enforce tagging at the stack level by denying creation of resources without tags. Option A is wrong because AWS Config rules can detect but may not automatically remediate without additional setup. Option B is wrong because resource-level permissions would require modifying each service's policy. Option D is wrong because a Lambda function would be reactive and may have a delay.

Answer

Create a Lambda function that tags resources after creation.

Answer

Use IAM policies to require tagging on all resource creation.

Answer

Use an AWS Config rule with auto-remediation via SSM Automation.

Question 2

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

Accepted Answer

Modify the DBInstanceClass property in the CloudFormation template and use an UpdatePolicy of AutoScalingReplacingUpdate.. Option A is correct because modifying the DBInstanceClass property in CloudFormation with an UpdatePolicy of AutoScalingReplacingUpdate will cause a replacement with minimal downtime. Option B is wrong because changing the template and updating the stack directly may cause downtime. Option C is wrong because creating a new stack and deleting the old one is not minimal downtime. Option D is wrong because AWS OpsWorks is not relevant.

Answer

Create a new CloudFormation stack with the new DB instance class and delete the old stack.

Answer

Edit the CloudFormation template to change the DBInstanceClass and update the stack directly.

Answer

Use AWS OpsWorks to manage the DB instance and apply the change.

Question 3

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage and a deploy stage. The company wants to add a test stage that runs automated integration tests after the build stage and before the deploy stage. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Configure AWS CodeBuild to run the integration tests as part of the test stage.. Options B, C, and D are correct. Option B: Adding a test stage in CodePipeline. Option C: Using CodeBuild for test execution. Option D: Adding a manual approval step for safety. Option A is wrong because Lambda is not suitable for running tests directly. Option E is wrong because CloudFormation is for infrastructure, not testing.

Answer

Use AWS CloudFormation to create a test environment.

Answer

Use an AWS Lambda function to run the integration tests.

Question 4

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

Accepted Answer

The security group for the tasks does not allow inbound traffic from the ALB on the health check port.. Option C is correct because if the security group for the tasks does not allow inbound traffic from the ALB on the health check port, health checks fail. Options A, B, and D do not directly cause health check failures.

Answer

The ECS service is configured with a desired count of zero.

Answer

The task definition specifies an invalid container image.

Answer

The ECS cluster has insufficient capacity.

Question 5

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

Accepted Answer

Use AWS CloudFormation change sets before updating the stack.. Option C is correct because change sets allow you to preview the changes before execution, helping to identify conflicts. Option A is wrong because it does not directly address conflicts. Option B is wrong because resource deletion is not the primary goal. Option D is wrong because it targets templates, not update execution.

Answer

Enable termination protection on the stack.

Answer

Use AWS CloudFormation nested stacks.

Answer

Use stack policies to protect critical resources.

Question 6

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.. Option A is correct because CloudWatch Events can filter CloudTrail events and trigger a notification via SNS. Option B is wrong because it requires creating a custom metric. Option C is wrong because it is passive. Option D is wrong because it requires custom analytics.

Answer

Enable CloudTrail Insights to detect unusual key creation patterns.

Answer

Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.

Answer

Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.

Question 7

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Accepted Answer

Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.. Option A is correct because the IAM role used by CloudFormation needs permissions to create EC2 instances. Option C is correct because updating the stack with the corrected IAM role allows the resource creation to proceed. Option B is wrong because the template doesn't need to be changed. Option D is wrong because the service role is not the issue. Option E is wrong because user does not need more permissions.

Answer

Modify the CloudFormation template to use a different instance type.

Answer

Create a new IAM service role for CloudFormation and assign it to the stack.

Answer

Grant the user additional IAM permissions to create EC2 instances.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. A recent deployment failed with a stack update error. The error message indicates that a resource was being updated but was in a failed state. What should the engineer do to resolve this issue?

Accepted Answer

Roll back the stack update to the previous working state.. Option B is correct because rolling back the stack update to the last known good state is the standard approach. Option A is incorrect because continuing update may propagate errors. Option C is incorrect because deleting the stack would remove all resources. Option D is incorrect because a new stack may have dependencies.

Answer

Delete the stack and recreate it with the same template.

Answer

Continue the update by skipping the failed resource.

Answer

Create a new stack and migrate resources.

Question 9

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

Accepted Answer

Two log files are larger than 1 KB.. Option B is correct because the query filters objects larger than 1000 bytes and returns only those keys. Option A is incorrect because the output shows two keys. Option C is incorrect because the command queries objects, not versions. Option D is incorrect because size > 1000 bytes, not 1000 KB.

Answer

The log files are larger than 1000 KB.

Answer

The bucket contains only two objects with the prefix 'logs/'.

Answer

The bucket has versioning enabled.

Question 10

A company is using Amazon API Gateway to expose a REST API. The API backend is a Lambda function that queries an Amazon DynamoDB table. During peak hours, the API returns HTTP 429 (Too Many Requests) errors. What is the MOST cost-effective way to reduce these errors?

Accepted Answer

Increase the throttling limits in API Gateway.. Option A is correct because increasing the API Gateway throttling limits allows more requests to pass through to the backend. Option B is wrong because increasing Lambda concurrency may help but is more expensive than adjusting throttling limits. Option C is wrong because DynamoDB auto-scaling addresses database capacity, not API throttling. Option D is wrong because API caching reduces backend calls for repeated requests but does not address throttling limits.

Answer

Enable API caching in API Gateway.

Answer

Enable DynamoDB auto-scaling.

Answer

Increase the reserved concurrency of the Lambda function.

Question 11

A company runs a web application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer. During traffic spikes, the application becomes slow. The team suspects that the ECS service is not scaling fast enough. Which THREE actions should the team take to improve the scalability? (Choose three.)

Accepted Answer

Decrease the scale-in and scale-out cooldown periods.. Options A, C, and E are correct. Option A: Increasing the number of tasks per service allows handling more concurrent requests. Option C: Decreasing the cooldown period allows faster scaling. Option E: Increasing the target value for the scaling metric makes scaling more aggressive. Option B is wrong because decreasing the number of subnets reduces capacity. Option D is wrong because decreasing the ALB idle timeout does not affect scaling.

Answer

Decrease the number of subnets in the VPC.

Answer

Decrease the ALB idle timeout.

Question 12

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Accepted Answer

The ec2:ResourceTag condition key is not supported for ec2:StopInstances.. Option B is correct because the Condition element with the ec2:ResourceTag condition key requires that the instance have the specified tag. However, the condition key ec2:ResourceTag is not supported for ec2:StopInstances (it is supported for DescribeInstances). For StopInstances and StartInstances, the condition key is ec2:ResourceTag, but it must be used with the correct key; actually, the issue is that the condition is applied to all actions, but the condition key might not be evaluated as expected. However, the most common reason is that the ec2:ResourceTag condition key is not supported for StopInstances and StartInstances actions. Option A is wrong because the resource is '*', which includes all instances. Option C is wrong because the action 'ec2:StopInstances' is allowed, but the condition may not match. Option D is wrong because the policy does not specify a resource ARN, so it applies to all resources.

Answer

The Resource element is set to '*', which does not include the specific instance.

Answer

The ec2:StopInstances action is not listed in the policy.

Answer

The policy requires a resource ARN for the condition to work.

Question 13

A company has a production AWS Lambda function that processes data from an Amazon SQS queue. The function often experiences throttling errors. The company wants to implement a solution to reduce throttling and improve processing performance. Which solution meets these requirements?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Option D is correct because increasing the Lambda function's reserved concurrency ensures the function can handle more concurrent executions, reducing throttling. Option A is wrong because Lambda does not support concurrency limits per queue. Option B is wrong because using a Lambda event source mapping for SQS already batches messages. Option C is wrong because adding more queues does not increase concurrency per function.

Answer

Configure the SQS queue to use a higher concurrency limit.

Answer

Create additional SQS queues and distribute messages across them.

Answer

Increase the batch size of the Lambda event source mapping.

Question 14

A company is migrating a legacy application to AWS. The application requires a relational database with high availability and automated backups. Which TWO AWS services should the company consider? (Choose two.)

Accepted Answer

Amazon RDS with Multi-AZ deployment. Options A and C are correct. Option A: Amazon RDS Multi-AZ provides high availability and automated backups. Option C: Amazon Aurora is a MySQL/PostgreSQL-compatible relational database with high availability and automated backups. Option B is wrong because DynamoDB is NoSQL. Option D is wrong because ElastiCache is an in-memory cache. Option E is wrong because Redshift is a data warehouse.

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Answer

Amazon DynamoDB

Question 15

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

Accepted Answer

Use Change Sets and require manual approval to execute them.. Option B is correct because Change Sets allow you to review changes before executing them. Option A is automatic, C is for changesets but does not require approval, D is not related.

Answer

Enable termination protection on the stack.

Answer

Use AWS CodePipeline to automatically deploy changes.

Answer

Use stack policies to prevent updates.

Question 16

A Solutions Architect is reviewing an Amazon S3 bucket policy that grants access to users from another AWS account. The policy uses the Principal element with "AWS": "arn:aws:iam::123456789012:root". The users in the other account are unable to access the bucket. What is the most likely cause?

Accepted Answer

The policy must specify the IAM user ARN, not the root user ARN.. Option A is correct because the root user ARN does not grant access to individual IAM users; the policy must allow the entire account or specific user ARNs. Option B is wrong because the bucket policy can refer to another account. Option C is wrong because S3 does not require VPC endpoints for cross-account access. Option D is wrong because the bucket policy can use IAM user ARNs.

Answer

The bucket policy must also include a VPC endpoint condition.

Answer

Cross-account access is not supported with bucket policies.

Answer

The bucket policy must use the CanonicalUser ID instead of the account ID.

Question 17

An IAM policy is attached to an IAM user. The user reports being unable to download objects from the bucket 'example-bucket' when connecting from their office IP address 203.0.113.5. What is the most likely reason?

Accepted Answer

The user's IP address is not in the allowed range.. Option B is correct because the policy only allows access from the IP range 192.0.2.0/24, and the user's IP 203.0.113.5 is not in that range. Option A is wrong because the resource is correct. Option C is wrong because the action is correct. Option D is wrong because the condition is valid.

Answer

The condition key 'aws:SourceIp' is invalid.

Answer

The resource ARN is incorrect.

Answer

The s3:GetObject action is misspelled.

Question 18

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

Accepted Answer

Use a rolling update with a lifecycle hook to gracefully handle connections and unmount the file system before instance termination.. Option D is correct because a rolling update with a lifecycle hook allows draining connections and unmounting the file system gracefully. Option A is for immutable deployments but stateful apps may not support it. B and C do not minimize downtime.

Answer

Use an in-place update without any hooks.

Answer

Perform a blue/green deployment.

Answer

Terminate all instances and launch new ones.

Question 19

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

Accepted Answer

Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.. Option D is correct because CodeDeploy with ECS blue/green deployment provides built-in traffic shifting and automated rollback. Option A is wrong because it lacks traffic shifting. Option B is wrong because it does not support blue/green. Option C is wrong because it lacks automated rollback.

Answer

Use CodePipeline with a Lambda function to swap target groups and monitor health.

Answer

Use CodeDeploy with an in-place deployment configuration and a manual approval step.

Answer

Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

Question 20

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

Accepted Answer

Create a change set that replaces the resource causing the limit error with a smaller instance type.. Option D is correct because updating the stack with a change set that replaces the resource causing the limit error is the safest way to handle it. Option A is wrong because deleting and recreating causes downtime. Option B is wrong because manual modifications lead to drift. Option C is wrong because rolling back doesn't fix the underlying issue.

Answer

Manually modify the resource to reduce its capacity and then continue the update.

Answer

Roll back the stack update and ignore the error.

Answer

Delete the stack and recreate it with the corrected template.