SAP-C02 Practice Exam 69 — 20 Questions

Question 1

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

Accepted Answer

Configure the ALB to forward the custom header to the target group and validate it on the application.. Options B and D are correct. WAF can inspect custom headers, and ALB can forward headers to the target. Option A is wrong because Security Groups do not inspect headers. Option C is wrong because Cognito is for user pools, not custom headers. Option E is wrong because CloudFront is a CDN, not a security service.

Answer

Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.

Answer

Use Amazon Cognito to authenticate users and pass the header.

Answer

Configure the ALB's security group to allow traffic only from known IP addresses.

Question 2

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

Accepted Answer

Configure the build project to use an S3 cache for dependencies.. Option B is correct because caching dependencies in S3 avoids re-downloading them each build. Option A is wrong because increasing compute resources may not help if the bottleneck is network bandwidth. Option C is wrong because parallel builds are for multiple builds, not a single build. Option D is wrong because CodeBuild doesn't have a build timeout setting that reduces build time; it's a limit.

Answer

Run the build in parallel across multiple build projects.

Answer

Increase the compute type of the build environment to use more vCPUs.

Answer

Reduce the build timeout setting to force faster execution.

Question 3

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

Accepted Answer

Use an SCP to deny creation of buckets without SSE-KMS and use an AWS Config rule with remediation to enable SSE-KMS on existing buckets.. Option D is correct because an SCP can deny creation of unencrypted buckets and AWS Config can remediate existing buckets. Option A is wrong because a Lambda function is reactive, not proactive. Option B is wrong because S3 default encryption is not applied retroactively. Option C is wrong because SSE-S3 does not meet the KMS requirement.

Answer

Use S3 default encryption to automatically encrypt new objects.

Answer

Use an AWS Config rule to check for encryption and automatically remediate by enabling SSE-S3.

Answer

Create an AWS Lambda function that scans all buckets and enables encryption.

Question 4

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

Accepted Answer

Use the strangler fig pattern: implement API Gateway to route traffic to new Lambda functions for specific endpoints while keeping the monolith for others.. Option B is correct because the strangler fig pattern allows incremental replacement of functionality by routing specific requests to new microservices via API Gateway while keeping the monolithic application for the rest. Option A is incorrect because full migration at once risks downtime. Option C is incorrect because pattern does not require database changes initially. Option D is incorrect because deployment pipeline is not a migration strategy.

Answer

Deploy all microservices in a new VPC and cut over DNS after testing.

Answer

Create a new version of the monolith that calls Lambda functions as backend.

Answer

Use AWS CodeDeploy to perform a blue/green deployment of the monolith to Lambda.

Question 5

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

Accepted Answer

Restrict the security group source to the API Gateway's VPC endpoint or the ALB security group.. Option B is correct because the Lambda function should only be invoked via the API Gateway, not directly from the internet. The security group should restrict inbound traffic from the API Gateway's source, not from all IPs. Option A is incorrect because outbound traffic is needed for the function to send responses. Option C is incorrect because VPC attachment is necessary for accessing internal resources. Option D is incorrect because the Lambda function is already in a VPC.

Answer

Modify the Lambda function to not use a VPC.

Answer

Add a deny rule for inbound 0.0.0.0/0 and allow only from the Lambda function's own IP.

Answer

Remove the VPC attachment from the Lambda function and use a VPC endpoint.

Question 6

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Right-size the cluster by analyzing resource utilization metrics.. Using Spot instances reduces cost significantly for fault-tolerant workloads. Right-sizing the cluster ensures efficient resource use. Option A is correct (Spot) and Option D is correct (right-sizing). Option B (On-Demand) increases cost. Option C (Reserved Instances) is for steady-state. Option E (dedicated) is more expensive.

Answer

Use On-Demand Instances for all nodes.

Answer

Purchase Reserved Instances for the cluster.

Answer

Use Dedicated Instances to improve performance.

Question 7

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

Accepted Answer

Enable job bookmarking and configure incremental processing to reduce data volume per run.. Option B is correct because using Glue job bookmarking with incremental processing reduces the data processed per run, avoiding memory issues. Option A is wrong because increasing DPUs increases cost linearly. Option C is wrong because using a larger instance type for Redshift does not affect Glue memory. Option D is wrong because switching to EMR adds complexity and may not be more cost-effective. Option E is wrong because partitioning data in Amazon S3 with more files does not directly solve memory issues.

Answer

Use a larger node type for the Amazon Redshift cluster to offload processing.

Answer

Replace AWS Glue with Amazon EMR and use spot instances for cost savings.

Answer

Partition the input data in Amazon S3 into more files with smaller sizes.

Answer

Increase the number of DPUs (Data Processing Units) for the Glue job.

Question 8

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

Accepted Answer

Modify the RDS instance to use a larger instance type with higher IOPS.. Option C is correct because provisioning GP3 volumes with higher IOPS can improve write performance without code changes. Option A is wrong because Multi-AZ improves availability, not write latency. Option B is wrong because read replicas improve read performance, not write. Option D is wrong because modifying parameter groups does not directly increase IOPS.

Answer

Create a read replica and offload read traffic.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the DB parameter group to optimize for write operations.

Question 9

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

Accepted Answer

Enable source IP stickiness on the NLB target group.. Option B is correct because NLB supports target group stickiness based on the source IP address, which is the appropriate method for stateful applications. Option A is wrong because ALB is not used with NLB. Option C is wrong because the NLB itself does not support cookie-based stickiness; that is an ALB feature. Option D is wrong because disabling cross-zone load balancing does not ensure stickiness.

Answer

Disable cross-zone load balancing on the NLB.

Answer

Enable cookie-based stickiness on the NLB listener.

Answer

Switch to an Application Load Balancer and enable cookie-based stickiness.

Question 10

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Use AWS CloudFormation with a blue/green deployment strategy for the database.. Option A is correct because a blue/green deployment minimizes downtime by creating a new database environment. Option C is correct because taking a snapshot before updates provides a rollback option. Option B is wrong because Multi-AZ is for high availability, not for zero-downtime updates. Option D is wrong because a read replica is for read scaling, not for updates. Option E is wrong because modifying the stack directly may cause downtime.

Answer

Enable Multi-AZ on the RDS instance to allow failover during updates.

Answer

Update the CloudFormation stack directly without creating a new database.

Answer

Use a read replica to serve traffic during the update.

Question 11

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket.. Option A is correct because enabling log file validation creates a digest file that can be used to verify integrity. Option D is correct because S3 Object Lock prevents objects from being deleted or overwritten. Option B is incorrect because SSE-KMS does not prevent tampering. Option C is incorrect because S3 Lifecycle does not prevent deletion. Option E is incorrect because S3 Transfer Acceleration does not provide security.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS).

Answer

Enable S3 Transfer Acceleration on the CloudTrail S3 bucket.

Answer

Set an S3 Lifecycle policy to transition logs to Amazon S3 Glacier.

Question 12

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Accepted Answer

That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.. When a Lambda function is VPC-enabled, it requires a VPC endpoint for services like S3, DynamoDB, or a NAT gateway for internet access. If the function needs to access the database via a public endpoint, a NAT gateway is needed. Option D is correct. Option A is about Lambda's environment variables. Option B is about database credentials. Option C is about Lambda's concurrency, not connectivity.

Answer

That the database password has not been rotated.

Answer

That the Lambda function's reserved concurrency is not set to zero.

Answer

That the Lambda function's environment variables are correctly set.

Question 13

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

Accepted Answer

Use the put-retention-policy command to set retentionInDays to 7.. The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct. Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Answer

Export the logs to S3 and delete the log group.

Answer

Configure an S3 Lifecycle policy on the log group's underlying storage.

Answer

Create a CloudTrail trail to capture log events and expire them after 7 days.

Question 14

A company is running a critical microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the team noticed that the ALB's 5xx error rate has increased. The error is HTTP 503. The team suspects the target group is unhealthy. Which THREE steps should the team take to diagnose and resolve the issue?

Accepted Answer

Verify the ECS service's desired count and compare with the number of healthy tasks in the target group.. Option A, Option C, and Option E are correct. Option A checks health check settings and logs. Option C checks if the service is running and tasks are healthy. Option E checks if the service's desired count matches running tasks. Option B (Check target group stickiness) is not directly related to 503 errors. Option D (Switch to Network Load Balancer) is a major change and not diagnostic.

Answer

Replace the ALB with a Network Load Balancer (NLB) to bypass health checks.

Answer

Verify that sticky sessions (session affinity) are enabled on the target group.

Question 15

A company's security team wants to ensure that all S3 buckets are encrypted at rest. They have thousands of existing buckets. Which approach should a Solutions Architect use to identify noncompliant buckets?

Accepted Answer

Create an AWS Config rule to evaluate S3 bucket encryption settings.. Option B is correct because AWS Config has managed rules to check S3 bucket encryption. Option A is wrong because Trusted Advisor checks only a subset of buckets. Option C is wrong because S3 Inventory provides object metadata, not encryption status. Option D is wrong because CloudTrail logs API calls, not current state.

Answer

Use AWS Trusted Advisor to check bucket encryption.

Answer

Analyze AWS CloudTrail logs for PutBucketEncryption API calls.

Answer

Enable S3 Inventory to list all objects and their encryption status.

Question 16

A company is running a stateless web application on Amazon EC2 instances in an Auto Scaling group. The application stores session data in an Amazon ElastiCache Redis cluster. After a recent deployment, users are being logged out frequently. What is the most likely cause?

Accepted Answer

The application is not using the ElastiCache cluster for session storage.. Option B is correct because if the application is not properly configured to use the ElastiCache cluster, session data may be lost on instance replacement or scaling events. Option A is wrong because the Auto Scaling group is configured, but the issue is session persistence. Option C is wrong because health checks do not affect session data. Option D is wrong because the ALB is not causing logout; the issue is session storage.

Answer

The Auto Scaling group's min size is too small.

Answer

The Elastic Load Balancer's health check is too aggressive.

Answer

The ElastiCache cluster's security group is blocking traffic from the ALB.

Question 17

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

Accepted Answer

Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.. Option D is correct because a blue/green deployment with ECS minimizes downtime by switching traffic gradually. Option A is wrong because migrating all at once risks downtime. Option B is wrong because launching a separate ECS cluster adds complexity. Option C is wrong because CodeStar is not a deployment strategy.

Answer

Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.

Answer

Deploy the monolith as a single task in ECS and update the task definition with new container versions.

Answer

Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.

Question 18

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

Accepted Answer

Modify the target group health check to use path '/' instead of '/health'.. Option B is correct because the CodePipeline deploy action uses CodeDeploy for blue/green deployments. The error indicates that the original target group (blue) is not healthy, possibly because the health check path is not valid for the original application version. Adjusting the health check to a common path like '/' allows both versions to pass. Option A is incorrect because Fargate does not allow SSH. Option C is incorrect because redeploying the same version won't fix the underlying health check issue. Option D is incorrect because a new target group does not address the root cause.

Answer

Redeploy the previous version of the application that passed health checks.

Answer

Create a new target group with the correct health check path and update the ECS service.

Answer

SSH into the Fargate container and restart the application.

Question 19

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which TWO actions can the company take?

Accepted Answer

Use CloudFront geo-restriction to allow or block countries.. Option A is correct because CloudFront geo-restriction allows whitelisting or blacklisting countries. Option D is correct because the geographic restriction feature is built-in. Option B is incorrect because S3 bucket policies do not support geographic restrictions. Option C is incorrect because Lambda@Edge can be used but is more complex. Option E is incorrect because WAF can block based on country using geo match conditions.

Answer

Configure an S3 bucket policy to deny access from specific IP ranges.

Answer

Use Lambda@Edge to check the request's country and return a 403.

Question 20

A company uses Amazon DynamoDB for a gaming application. During a new game launch, they experience higher than expected latency on write operations. The table has on-demand capacity. What is the best way to improve write performance?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching.. For write-heavy workloads, using DynamoDB Accelerator (DAX) can reduce latency by caching writes. Option B is correct. Option A (increase WCU) is unnecessary with on-demand. Option C (GSI) adds overhead. Option D (Auto Scaling) is for provisioned capacity.

Answer

Use auto scaling with provisioned capacity.

Answer

Increase the write capacity units (WCU).

Answer

Add a global secondary index (GSI) to the table.