SAP-C02 Practice Exam 70 — 20 Questions

Question 1

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

Accepted Answer

Use AWS X-Ray to trace requests from the ALB to the application and downstream services.. Option B is correct because leveraging AWS X-Ray to trace requests end-to-end helps identify which component is causing latency. Option A is wrong because adding more EC2 instances may not address the root cause and could increase costs. Option C is wrong because switching to a Network Load Balancer (NLB) does not provide visibility into application-level latency. Option D is wrong because enabling detailed monitoring on the ALB only provides metrics, not traces. Option E is wrong because migrating to Lambda adds complexity and may not solve latency issues caused by other factors.

Answer

Enable detailed ALB metrics and create a CloudWatch dashboard.

Answer

Migrate the application to AWS Lambda to eliminate EC2 overhead.

Answer

Replace the ALB with a Network Load Balancer (NLB) for lower latency.

Answer

Add more EC2 instances behind the ALB to distribute the load.

Question 2

A company is running a production web application on AWS Auto Scaling EC2 instances behind an Application Load Balancer. Recent deployments have caused intermittent errors. The team wants to implement a deployment strategy that minimizes downtime and allows for quick rollback. Which strategy should they use?

Accepted Answer

Use blue/green deployment with a second Auto Scaling group and switch the ALB target group.. Option B is correct because blue/green deployment with a second Auto Scaling group and ALB switch allows instant rollback by switching back to the original environment. Option A is wrong because rolling updates with a single ASG can still cause partial downtime and slower rollback. Option C is wrong because it does not minimize downtime and requires manual intervention. Option D is wrong because immutable deployments replace instances, but rollback requires redeployment.

Answer

Deploy a new version to a single instance, test, then scale out.

Answer

Perform rolling updates with a single Auto Scaling group, updating a few instances at a time.

Answer

Use an immutable deployment by launching a new Auto Scaling group and terminating the old one.

Question 3

A company is migrating a legacy application to AWS. The application requires a relational database with high I/O and low latency. The database size is 2 TB and growing. The Solutions Architect must choose a storage solution that provides the best price-performance. Which TWO solutions meet these requirements?

Accepted Answer

Use Amazon Aurora with I/O-Optimized cluster configuration.. Options A and C are correct: RDS with Provisioned IOPS provides consistent low latency, and Aurora with I/O-Optimized provides high I/O at lower cost for high I/O workloads. Option B is wrong because gp3 is general purpose, not best for high I/O. Option D is wrong because DynamoDB is NoSQL. Option E is wrong because Redshift is for analytics.

Answer

Use Amazon DynamoDB with provisioned capacity.

Answer

Use Amazon Redshift with dense compute nodes.

Answer

Use Amazon RDS with gp3 storage.

Question 4

A company runs a containerized microservices application on Amazon ECS using Fargate. The application includes a service that processes messages from an Amazon SQS queue. The service is CPU-bound and takes longer to process messages as the queue depth increases. The team wants to automatically scale the number of tasks based on the queue depth. Which solution is MOST effective?

Accepted Answer

Configure ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue's ApproximateNumberOfMessagesVisible metric.. Option B is correct because ECS Service Auto Scaling can use a target tracking scaling policy with the SQS ApproximateNumberOfMessagesVisible metric to scale the number of tasks. Option A is wrong because CloudWatch alarms on CPU can cause slow reaction. Option C is wrong because Lambda is not suitable for long-running CPU-bound tasks. Option D is wrong because adjusting CPU allocation does not address scaling; it's a vertical scaling approach.

Answer

Use an AWS Lambda function to poll the SQS queue and invoke a new task for each message.

Answer

Increase the CPU allocation for the task definition to process messages faster.

Answer

Use a CloudWatch alarm based on CPU utilization to trigger an Auto Scaling action.

Question 5

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

Accepted Answer

Replace the EC2 instances with AWS Lambda functions that are triggered by SQS events.. Option B is correct because using a Lambda function with SQS triggers scales automatically and cost-effectively for variable workloads. Option A is wrong because Auto Scaling with a fixed schedule may not react quickly to a sudden spike. Option C is wrong because Auto Scaling based on queue length may be slower to scale. Option D is wrong because increasing instance size is less cost-effective than serverless.

Answer

Increase the EC2 instance size to handle more messages per instance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value during the expected spike.

Answer

Use Auto Scaling with a step scaling policy based on the SQS queue depth.

Question 6

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

Accepted Answer

Change the bucket's default encryption configuration to SSE-KMS.. Option C is correct because changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys. Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Answer

Add a lifecycle policy to transition objects to SSE-KMS.

Answer

Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.

Answer

Use a bucket policy to deny uploads without SSE-KMS.

Question 7

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

Accepted Answer

The deny statement does not apply to the users attempting to access the bucket.. Option A is correct because an explicit deny in another statement would override the allow, but the question says users can access from outside the range, meaning the deny is not effective. The most likely reason is that the deny statement does not apply to the users (e.g., it applies to a different principal). Option B is incorrect because the policy is a bucket policy, not an IAM policy. Option C is incorrect because the condition is correct syntax. Option D is incorrect because the bucket policy is applied to the bucket, not IAM users.

Answer

The condition key 'aws:SourceIp' is misspelled.

Answer

The policy is an IAM policy, not a bucket policy, and the condition key is invalid.

Answer

The policy is attached to the IAM user instead of the bucket.

Question 8

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

Accepted Answer

Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.. Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.

Answer

Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.

Answer

Create an AWS Config rule in each account to remediate non-compliant buckets.

Answer

Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Question 9

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

Accepted Answer

Replace the instance store volume with an Amazon EBS volume, create an AMI, and use Auto Scaling with an Application Load Balancer.. Option C is correct because using EBS snapshots provides backup and recovery for instance store data? Actually instance store is ephemeral; EBS snapshots cannot back up instance store. So Option A is correct: Create an AMI from the instance and use Auto Scaling with an Application Load Balancer. This provides high availability without changing the storage to EBS? Wait, instance store data is lost on stop/terminate. So the best solution is to migrate data to EBS and then use AMI/Auto Scaling. But the question says minimal architectural changes. Option D is correct: Replace instance store with EBS and use AMI/Auto Scaling. Option A uses instance store which is not persistent. Option B adds cost without solving availability. Option C is wrong because EBS snapshots cannot back up instance store. So the correct answer is D.

Answer

Attach an Amazon EBS volume and configure the application to write to it, then take periodic EBS snapshots.

Answer

Use AWS Backup to schedule backups of the instance and restore to a new instance if needed.

Answer

Create an AMI from the instance and launch a second instance in a different Availability Zone behind an Application Load Balancer.

Question 10

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.. Option B is correct because setting the bucket's DeletionPolicy to Retain allows the stack to update even if the bucket already exists, and manual deletion is avoided. Option A is wrong because it does not prevent the update failure if the bucket exists. Option C is wrong because importing requires manual steps and does not prevent update failures. Option D is wrong because it does not address the root cause.

Answer

Use AWS CloudFormation resource import to bring the existing bucket into the stack.

Answer

Use a custom resource to check if the bucket exists before creation.

Answer

Manually delete the S3 bucket before each stack update.

Question 11

A company is using AWS CodePipeline to automate deployments. The pipeline includes a build stage that compiles code and runs tests. The build stage fails intermittently due to network timeouts when downloading dependencies. Which THREE actions could improve the reliability of the build stage?

Accepted Answer

Use CodeBuild local cache to store dependencies across builds.. Options A, B, and D are correct: Caching dependencies, using a VPC with NAT gateway for consistent networking, and using CodeBuild local caching reduce failures. Option C is wrong because increasing timeout only delays failure. Option E is wrong because using a larger instance type may not fix network timeouts.

Answer

Increase the build timeout to allow more time for downloads.

Answer

Use a larger compute type for CodeBuild to improve network speed.

Question 12

A company runs a web application on EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon ElastiCache Redis cluster. During a traffic spike, the Redis cluster's CPU utilization reaches 90%, causing increased latency. The company wants to reduce the load on Redis without changing the application code. Which solution should the company implement?

Accepted Answer

Enable cluster mode on the ElastiCache Redis cluster to distribute data across multiple shards.. Option A is correct because enabling ElastiCache for Redis cluster mode allows data to be distributed across multiple shards, reducing CPU load per node. Option B is wrong because read replicas are for read-heavy workloads, not for reducing CPU load on the primary. Option C is wrong because a larger node type may help but is less cost-effective than sharding. Option D is wrong because ElastiCache does not support Lambda extensions.

Answer

Use Amazon ElastiCache Global Datastore to distribute traffic across regions.

Answer

Add read replicas to the Redis cluster to offload read traffic.

Answer

Upgrade to a larger Redis node type with more vCPUs.

Question 13

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

Accepted Answer

A pending modification to the DB instance was applied during failover.. Option A is correct because the new primary may have a pending modification (e.g., scaling) applied during failover, causing a brief performance impact. Option B is incorrect because failover is automatic. Option C is incorrect because parameter group changes require a reboot, not failover. Option D is incorrect because Multi-AZ does not provide read replicas.

Answer

The read replica in a different region is now serving traffic.

Answer

The Multi-AZ configuration was disabled during the failover.

Answer

The DB parameter group was changed to a less efficient configuration.

Question 14

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

Accepted Answer

The health check path is misconfigured and returns HTTP 404.. The ALB sends requests to targets based on health checks. If the health check path returns a non-200 status, the target is marked unhealthy. A misconfigured health check path (e.g., pointing to a non-existent endpoint) can cause all instances to be marked unhealthy, leading to 503 errors. Option B is correct because it directly affects health check status. Options A, C, and D would not cause the healthy host count to drop to zero.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Answer

The EC2 instances are in an Auto Scaling group with insufficient capacity.

Question 15

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

Accepted Answer

A build stage that packages the application using AWS CodeBuild.. A typical deployment pipeline includes: build the application, run automated tests in a staging environment, and then deploy to production after approval. Option A (build) is needed. Option C (test in staging) is needed. Option D (deploy to production after staging tests pass) is needed. Option B (manual approval to production) is common but not required for automated testing. Option E (deploy to staging) is redundant if already included in test stage.

Answer

A manual approval step before deploying to production.

Answer

A deploy stage that deploys to a canary environment.

Question 16

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

Accepted Answer

Increase the memory (and CPU) allocation for the Lambda function.. Option C is correct because increasing the Lambda function's memory also increases CPU allocation, which can speed up processing. Option A is wrong because concurrency limit reduces parallelism, making timeouts worse. Option B is wrong because increasing the batch size may cause the function to process more messages per invocation, increasing the chance of timeout. Option D is wrong because reserving concurrency does not affect per-invocation performance. Option E is wrong because using a larger instance type is not applicable to Lambda.

Answer

Increase the reserved concurrency of the Lambda function.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Use a Lambda function URL instead of SQS invocation.

Answer

Migrate the Lambda function to run on Amazon ECS with Fargate using a larger task size.

Question 17

A company has a legacy application that runs on an EC2 instance with a large attached EBS volume. The application writes log files to the volume, and the volume is frequently full, causing application errors. The Solutions Architect needs to implement a solution to automatically manage disk space without application changes. Which solution meets these requirements?

Accepted Answer

Use a script with Amazon Data Lifecycle Manager to snapshot the volume and delete old snapshots.. Option D is correct because using a lifecycle policy to move old logs to S3 Glacier and delete from volume automates space management. Option A is wrong because S3 Lifecycle policies apply to S3 objects, not EBS volumes. Option B is wrong because CloudWatch Logs agent requires application changes to send logs. Option C is wrong because increasing volume size does not automatically manage space.

Answer

Configure an S3 Lifecycle policy to transition log files to Amazon S3 Glacier after 30 days.

Answer

Increase the EBS volume size and enable auto-scaling.

Answer

Install the CloudWatch Logs agent and stream logs to CloudWatch Logs, then delete local logs.

Question 18

A company is deploying a web application that uses an Application Load Balancer and an Auto Scaling group of EC2 instances. The application must be able to handle sudden spikes in traffic. Which TWO actions should the Solutions Architect take to improve scalability and reduce latency? (Choose two.)

Accepted Answer

Enable HTTP/2 on the Application Load Balancer.. Options B and C are correct. Option B: Using a predictive scaling policy helps prepare for traffic spikes. Option C: Enabling HTTP/2 on the ALB reduces latency through multiplexing. Option A is wrong because increasing cooldown delays scaling. Option D is wrong because larger instances are a vertical scaling approach, not horizontal. Option E is wrong because increasing health check interval delays detection of unhealthy instances.

Answer

Increase the default cooldown period for the Auto Scaling group.

Answer

Use larger EC2 instance types for the Auto Scaling group.

Answer

Increase the health check interval on the Application Load Balancer.

Question 19

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

Accepted Answer

The deployment removed the health check path from the application.. Option A is correct because an increase in request count without a corresponding increase in target capacity can cause the ALB to return 503 errors when all targets are unhealthy or overloaded. Option B is incorrect because security groups were not changed. Option C is incorrect because if the health check path was removed, health checks would fail consistently, not intermittently. Option D is incorrect because a missing security group rule would block traffic entirely, not cause intermittent errors.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the ALB does not allow inbound traffic on the listener port.

Answer

The ALB's target group health check settings are misconfigured.

Question 20

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

Accepted Answer

Configure cross-region replication for the RDS instance using a read replica.. Option A is correct because automated backups of RDS allow point-in-time recovery with RPO of 5 minutes. Option C is correct because EBS snapshots can be created frequently and replicated. Option E is correct because cross-region replication provides a secondary site. Option B is incorrect because AMIs do not include data. Option D is incorrect because application-level replication is less reliable.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Answer

Create AMIs of the EC2 instances every hour.