SAP-C02 Practice Exam 68 — 20 Questions

Question 1

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Migrate the database to Amazon RDS with Multi-AZ deployment.. Option A is correct because Multi-AZ RDS provides database high availability. Option B is correct because Auto Scaling across multiple AZs provides compute high availability. Option C is correct because an ALB distributes traffic across healthy instances. Option D is wrong because a single EBS volume is not highly available. Option E is wrong because storing data only on the instance store is not durable.

Answer

Use an EBS volume with higher IOPS to improve performance.

Answer

Store data on the instance store instead of EBS to reduce latency.

Question 2

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

Accepted Answer

Configure an Application Load Balancer in front of the Auto Scaling group.. Option B is correct because adding an ALB distributes traffic across instances. Option D is correct because launching instances across multiple AZs improves availability and scalability. Option A is wrong because larger instances may not help if the issue is concurrency. Option C is wrong because increasing desired capacity without a load balancer may cause uneven distribution. Option E is wrong because changing the AMI does not directly improve performance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value.

Answer

Switch to a different Amazon Machine Image (AMI) with optimized performance.

Answer

Increase the instance size to a larger type.

Question 3

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

Accepted Answer

Create an S3 Lifecycle rule that transitions objects with prefix 'backups/' to GLACIER after 30 days.. Option D is correct because an S3 Lifecycle rule can be configured to transition objects with the specified prefix to GLACIER after 30 days. Option A is incorrect because S3 Batch Operations are for one-time bulk operations. Option B is incorrect because S3 Intelligent-Tiering may not move to GLACIER automatically. Option C is incorrect because Lambda would be less efficient.

Answer

Use an AWS Lambda function triggered by S3 events to change the storage class.

Answer

Use S3 Batch Operations to copy objects to a new bucket with GLACIER storage class.

Answer

Enable S3 Intelligent-Tiering on the bucket.

Question 4

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

Accepted Answer

CodeDeploy automatic rollback configuration with CloudWatch alarm.. CodeDeploy can be configured to automatically roll back a deployment when a CloudWatch alarm is triggered. This is a native feature. Option B is correct. Options A, C, and D are not directly applicable: Lambda can be used but is not the primary feature; R53 health checks are not integrated with CodeDeploy; CodeBuild is for building, not deploying.

Answer

AWS Lambda function invoked by CloudWatch Events.

Answer

Amazon Route 53 health checks with failover routing.

Answer

AWS CodeBuild with post-build actions.

Question 5

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. The company wants to improve performance by enabling HTTP/2. What is the simplest way to achieve this?

Accepted Answer

Enable HTTP/2 on the Application Load Balancer's HTTPS listener.. Option B is correct because ALB natively supports HTTP/2 and can be enabled in the listener settings. Option A is wrong because upgrading to a Network Load Balancer does not support HTTP/2. Option C is wrong because CloudFront with HTTP/2 is more complex than directly enabling it on ALB. Option D is wrong because configuring EC2 instances directly does not improve latency at the load balancer level.

Answer

Configure the EC2 instances to support HTTP/2.

Answer

Place an Amazon CloudFront distribution in front of the ALB and enable HTTP/2.

Answer

Upgrade the load balancer to a Network Load Balancer.

Question 6

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

Accepted Answer

Check the security group rules for the instance.. Option C is correct because security group rules control inbound traffic. Option A is wrong because the instance is running. Option B is wrong because the status checks show health, not network access. Option D is wrong because the instance ID is correct.

Answer

Check if the instance is terminated.

Answer

Check if the instance ID is correct.

Answer

Check the instance status checks.

Question 7

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

Accepted Answer

The application is updating the same item in multiple regions concurrently, and the last-writer-wins conflict resolution is causing data loss.. Option B is correct because DynamoDB global tables use last-writer-wins (LWW) conflict resolution, and if the same item is updated in multiple regions concurrently, conflicts occur. Using conditional writes and application-level conflict resolution can help. Option A is wrong because strong consistency is not supported for global tables. C is wrong because auto scaling does not affect conflicts. D is wrong because conflict resolution is automatic with LWW.

Answer

The application is using strongly consistent reads.

Answer

The DynamoDB write capacity is insufficient.

Answer

The DynamoDB global tables are not properly configured with conflict resolution.

Question 8

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Accepted Answer

Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.. Options B and D are correct. Service control policies (SCPs) can deny actions that do not meet encryption and public access conditions. Option A is wrong because resource-level policies are per bucket. Option C is wrong because CloudTrail cannot enforce. Option E is wrong because Config rules only detect, not enforce.

Answer

Use AWS Config rules to automatically remediate non-compliant buckets.

Answer

Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

Answer

Create an S3 bucket policy in each account to enforce encryption and block public access.

Question 9

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

Accepted Answer

Increase both memory and vCPU to 4 GB and 2 vCPUs.. Option C is correct because increasing memory and vCPU together can improve performance for CPU-bound tasks. Option A is wrong because increasing only memory doesn't address CPU. Option B is wrong because increasing only vCPU might not be enough if memory is also a bottleneck. Option D is wrong because scaling horizontally may not reduce latency for a single request if the task itself is underpowered.

Answer

Increase the number of tasks (desired count) to distribute the load.

Answer

Increase the vCPU to 2 while keeping 2 GB memory.

Answer

Increase the memory to 4 GB while keeping 1 vCPU.

Question 10

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). During a recent deployment, users experienced errors. The team wants to automatically roll back the deployment if the error rate exceeds 5% within 10 minutes after deployment. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use CodeDeploy with a CloudWatch alarm on the ALB error rate that triggers a deployment rollback.. Option D is correct because AWS CodeDeploy supports automatic rollback based on CloudWatch alarm metrics, such as error rate, with minimal overhead. Option A is wrong because manual approval does not trigger automatic rollback. Option B is wrong because Lambda functions add complexity and are not the best practice for automatic rollback. Option C is wrong because modifying ASG health checks does not directly monitor error rate for rollback.

Answer

Configure the Auto Scaling group to use ELB health checks and replace instances if the error rate increases.

Answer

Use CodeDeploy with manual approval gates and a script that checks error rates.

Answer

Use a custom Lambda function that monitors ALB error rates and triggers a rollback via CodeDeploy API.

Question 11

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of user_id and a sort key of timestamp. During a new game launch, the table experiences throttling on a few partitions. The company wants to improve the partition distribution. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Add a random suffix to the partition key to distribute writes more evenly.. Option A is correct because adding a suffix to partition key can spread writes across partitions. Option C is correct because using DynamoDB Accelerator (DAX) reduces read load, indirectly helping write capacity. Option D is correct because using write sharding distributes writes across multiple partitions. Option B is wrong because increasing read capacity does not help write throttling. Option E is wrong because changing to on-demand may help but does not improve partition distribution.

Answer

Increase the read capacity units for the table.

Answer

Switch the table to on-demand capacity mode.

Question 12

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

Accepted Answer

Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.. Option A is correct because placing ECS tasks and RDS in the same VPC allows private communication via security groups. Option B is incorrect because NAT gateway is for outbound internet access. Option C is incorrect because a public endpoint would violate the security requirement. Option D is incorrect because an internet gateway is not needed for private communication.

Answer

Use a NAT gateway to route traffic from ECS tasks to RDS.

Answer

Attach an internet gateway to the VPC and route through it.

Answer

Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.

Question 13

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application experiences intermittent high latency due to CPU spikes on some instances. The company wants to automatically replace unhealthy instances and optimize costs. What should a solutions architect do?

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. Option B is correct because a dynamic scaling policy adjusts the number of instances based on CPU utilization. Option A is wrong because it does not replace unhealthy instances. Option C is wrong because it replaces all instances at fixed times. Option D is wrong because it only replaces instances on a schedule.

Answer

Use a lifecycle hook to perform a health check and terminate unhealthy instances.

Answer

Use an AWS Lambda function to terminate instances with high CPU.

Answer

Implement a scheduled scaling policy to increase instances during peak hours.

Question 14

A company is using AWS CodePipeline with an S3 source action. After a successful deployment, the latest commit ID is stored as an environment variable in the CodeBuild project. The team notices that subsequent pipeline executions are not triggering when new commits are pushed to the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to trigger the pipeline.. Option B is correct because S3 event notifications for PUT and POST operations require the bucket to be configured to send events to CodePipeline. Option A is wrong because the bucket policy is not relevant for event notifications. Option C is wrong because CodePipeline can use S3 as a source without a webhook. Option D is wrong because the pipeline execution role is not the cause.

Answer

The CodePipeline service role lacks permissions to poll the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to read objects.

Answer

The CodePipeline webhook is misconfigured.

Question 15

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

Accepted Answer

Configure the cache behavior to forward all query strings but cache based on a whitelist.. Option B is correct because increasing the TTL allows objects to stay in cache longer. Option C is correct because normalizing query strings ensures that different query string orders don't create multiple cache entries. Option A is wrong because shorter TTL reduces cache hits. Option D is wrong because custom error responses don't affect cache hit ratio. Option E is wrong because enabling compression improves speed, not cache hit ratio.

Answer

Configure custom error responses to serve cached content on errors.

Answer

Decrease the default TTL for objects.

Answer

Enable automatic compression for compressible objects.

Question 16

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

Accepted Answer

Add a test stage in CodePipeline after the deployment stage and configure CodeDeploy to automatically roll back on pipeline failure.. Option C is correct because CodePipeline can have a test stage after deployment, and CodeDeploy can trigger a rollback if the test stage fails. Option A is wrong because manual testing is not automatic. Option B is wrong because CloudWatch alarms are not for test results. Option D is wrong because a separate pipeline adds complexity.

Answer

Create a separate CodePipeline for testing and use a cross-pipeline trigger to initiate rollback.

Answer

Add a manual approval step after deployment to run tests manually.

Answer

Use a CloudWatch alarm to monitor test results and trigger a rollback.

Question 17

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

Accepted Answer

Update the Lambda function configuration to remove the VPC settings, then delete the subnet.. Option C is correct because the Lambda function's ENI must be deleted first by deleting the Lambda function or updating its configuration to not use the subnet. Option A is incorrect because the ENI is managed by Lambda and cannot be manually deleted. Option B is incorrect because the subnet is in use, so the stack cannot continue. Option D is incorrect because force delete is not a valid operation for subnets.

Answer

Modify the CloudFormation template to ignore the deletion failure using a DeletionPolicy attribute.

Answer

Use the AWS CLI to force delete the subnet.

Answer

Manually delete the Elastic Network Interface (ENI) from the AWS Management Console.

Question 18

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

Accepted Answer

The CloudFront behavior for older videos does not include the Lambda function association.. Lambda@Edge functions can be associated with CloudFront behaviors. If the function is only triggered for specific behaviors (e.g., only for certain file extensions or cache behaviors), older videos served under other behaviors may not get the headers. Option C is correct. Options A and B are less likely because the function is invoked on every request, and S3 permissions do not affect Lambda@Edge execution. Option D is incorrect because the issue is about missing headers, not caching of old content.

Answer

The Lambda@Edge function is not triggered for viewer request events.

Answer

The S3 bucket policy denies access to the Lambda function.

Answer

The videos are cached in CloudFront and the function runs only on cache misses.

Question 19

A company runs a web application on EC2 instances behind an ALB. They want to improve the security posture by implementing defense in depth. Which TWO measures should they implement? (Choose TWO.)

Accepted Answer

Configure security groups to restrict traffic to only necessary ports.. Defense in depth includes multiple layers. AWS WAF protects against web exploits. Security groups act as a virtual firewall. Option A (WAF) and Option D (security groups) are correct. Option B (public subnets) is less secure. Option C (direct internet access) bypasses security. Option E (public S3) is not relevant.

Answer

Store static assets in a public S3 bucket.

Answer

Place EC2 instances in public subnets for easier management.

Answer

Allow direct internet access to the EC2 instances.

Question 20

A company uses Amazon DynamoDB as its primary database. The operations team is seeing increased read latency during peak hours. The table has a provisioned read capacity of 1000 RCU, but CloudWatch metrics show that consumed read capacity frequently reaches 1000 RCU. The application uses eventually consistent reads. What is the MOST cost-effective way to reduce read latency?

Accepted Answer

Enable DynamoDB Accelerator (DAX) to cache frequently read items.. Option C is correct because enabling DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency without increasing provisioned RCU. Option A is wrong because increasing RCU increases cost. Option B is wrong because switching to strongly consistent reads would double RCU consumption. Option D is wrong because adding a global secondary index does not reduce read latency for the base table. Option E is wrong because using ElastiCache adds complexity and cost.

Answer

Switch to strongly consistent reads to improve consistency.

Answer

Create a global secondary index (GSI) on the table to offload reads.

Answer

Increase the provisioned read capacity to 2000 RCU.

Answer

Use Amazon ElastiCache for Memcached as a read cache.