SAP-C02 Mock Exam 77 — 25 Questions

Question 1

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable API Gateway caching with a TTL of 60 seconds.. Enabling API Gateway caching reduces load on Lambda and DynamoDB for repeated requests, improving latency and reducing errors. Option E: Enabling DynamoDB auto scaling adjusts capacity based on traffic patterns, reducing throttling-related 5xx errors. Option A (Lambda reserved concurrency) limits concurrency and could worsen throttling. Option B (provisioned concurrency) helps with cold starts but does not address DynamoDB throttling. Option D (increasing Lambda timeout) may mask underlying issues without resolving root causes.

Answer

Set Lambda reserved concurrency to 5 for each function.

Answer

Configure provisioned concurrency for all Lambda functions.

Answer

Increase the Lambda function timeout to 30 seconds.

Question 2

A company uses AWS Organizations with a centralized networking account that hosts a VPC with a transit gateway. Other accounts need to connect to this transit gateway. The company wants to ensure that only approved VPCs can attach to the transit gateway, and that the attachments are automatically approved when a VPC is created in a member account. Which solution meets these requirements?

Accepted Answer

Use AWS Transit Gateway Network Manager and create a policy to automatically accept attachments from VPCs with a specific tag.. AWS Transit Gateway Network Manager allows you to create a policy that automatically accepts attachment requests from VPCs that have a specific tag. This meets the requirement for automatic approval of approved VPCs without manual intervention, while ensuring only tagged VPCs are attached.

Answer

Create a Lambda function that monitors for new VPCs and creates the transit gateway attachment.

Answer

Use an SCP to require that all VPCs have a specific tag and then use AWS Config to automatically create the attachment.

Answer

Create a transit gateway in the networking account and share it with member accounts using AWS Resource Access Manager. Members create attachments and the networking team manually approves them.

Question 3

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

Accepted Answer

Use an AWS Config rule with auto-remediation via SSM Automation.. Using an AWS Config rule with auto-remediation via SSM Automation can detect untagged resources in near real-time and automatically apply the required CostCenter tag, ensuring compliance without manual intervention. Option A is incorrect because tagging after creation is reactive and does not prevent untagged resources from existing temporarily. Option B is incorrect because IAM policies cannot enforce tagging across all services consistently, and many services allow resource creation without tags even with IAM restrictions. Option C is incorrect because CloudFormation stack policies only control updates and deletions, not creation; they cannot prevent the creation of untagged resources.

Answer

Create a Lambda function that tags resources after creation.

Answer

Use IAM policies to require tagging on all resource creation.

Answer

Use a CloudFormation stack policy with a deny effect for resource creation without tags.

Question 4

A company wants to allow developers to launch EC2 instances, but only with specific instance types and only if the instance has a tag 'CostCenter'. Which IAM policy statement should be applied to the developers' IAM group? (Choose TWO.)

Accepted Answer

Allow ec2:RunInstances with a condition that the request includes a 'CostCenter' tag.. The IAM policy condition 'ec2:RequestTag/CostCenter' ensures that the developer's RunInstances request includes the required 'CostCenter' tag, enforcing tagging compliance at launch time. Option B is correct because a condition using 'ec2:InstanceType' with a 'ForAllValues:StringLike' or 'StringEquals' operator restricts allowed instance types to a specific list, preventing unauthorized instance families or sizes.

Answer

Allow ec2:RunInstances without conditions.

Answer

Deny ec2:RunInstances if the instance type is not in the allowed list.

Question 5

A company is hosting a static website on Amazon S3. The website uses JavaScript to make API calls to a backend API hosted on Amazon API Gateway. The company wants to reduce latency for users worldwide. Which combination of AWS services should the solutions architect use? (Choose two.)

Accepted Answer

Use CloudFront with API Gateway as an origin.. Amazon CloudFront can use API Gateway as a custom origin, allowing API requests to be served from edge locations closer to users, which reduces latency. This integration caches API responses at the edge when possible and terminates the user's TCP connection at the edge, improving performance for global users.

Answer

Use AWS Global Accelerator for the S3 website.

Answer

Use Lambda@Edge to process API calls at the edge.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 6

A company is designing a new microservices application on AWS. Each microservice will be deployed as a containerized application using Amazon ECS with Fargate launch type. The company expects variable traffic patterns and needs to ensure that the application can scale automatically based on demand. Which scaling solution should be used?

Accepted Answer

Configure Application Auto Scaling with a target tracking scaling policy based on average CPU utilization.. Amazon ECS with Fargate uses Application Auto Scaling to automatically adjust the desired count of tasks based on demand. A target tracking scaling policy based on average CPU utilization is the correct approach because it allows you to define a target value (e.g., 70% CPU) and Application Auto Scaling will add or remove tasks to maintain that target, matching the variable traffic patterns described.

Answer

Use Amazon EC2 Auto Scaling to add more Fargate tasks.

Answer

Use AWS Auto Scaling Plans with predictive scaling.

Answer

Manually adjust the desired count of tasks in the ECS service based on traffic analysis.

Question 7

A company has a decentralized IT structure where each business unit manages its own AWS accounts. The central IT team wants to enforce security policies across all accounts but allow business units to retain administrative control. Which solution should the central IT team implement?

Accepted Answer

Use AWS Organizations with service control policies (SCPs) to enforce baseline permissions, and delegate administration to organizational units (OUs) for each business unit.. AWS Organizations with SCPs allows the central IT team to enforce baseline security policies across all accounts without removing administrative control from business units. By delegating administration to OUs for each business unit, the central team sets guardrails while business units retain full IAM management within their accounts, satisfying the decentralized structure requirement.

Answer

Deploy AWS CloudFormation StackSets to each account with security templates.

Answer

Create a shared services account and use IAM cross-account roles for each business unit.

Answer

Migrate all workloads to a single AWS account and use IAM roles for each business unit.

Question 8

A company is designing a new web application that will be deployed on Amazon ECS with Fargate. They need to store session state for the application. Which TWO services can they use for this purpose?

Accepted Answer

Amazon ElastiCache for Redis. Amazon ElastiCache for Redis (option D) is commonly used for session state due to its low latency and in-memory data store capabilities. Amazon DynamoDB (option E) is also suitable for session state as it provides low-latency, scalable, and fully managed NoSQL database. Option A (Amazon EFS) is a file storage service, not ideal for session state. Option B (Amazon RDS) is a relational database, which can be used but is not optimal for high-performance session state. Option C (Amazon S3) is an object store with higher latency, making it unsuitable for real-time session management.

Answer

Amazon EFS

Answer

Amazon RDS

Answer

Amazon S3

Question 9

Match each AWS networking concept to its definition.

Accepted Answer

VPC: A virtual network dedicated to your AWS account.. A VPC is a logically isolated virtual network. Subnets are subdivisions of the VPC. An Internet Gateway provides internet access to public subnets, while a NAT Gateway provides outbound internet access to private subnets. Security Groups control instance-level traffic.

Answer

VPC: A service that provides a dedicated physical network for your account.

Answer

Internet Gateway: Allows instances in a private subnet to access the internet.

Question 10

Refer to the exhibit. An IAM policy is attached to a user. The user is trying to download an object from the 'confidential' folder in 'my-bucket' using HTTP (not HTTPS). What will happen?

Accepted Answer

The request is denied because the second statement explicitly denies access when using HTTP.. The Deny statement explicitly denies s3:* actions on the confidential folder when SecureTransport is false (HTTP). Since the first statement allows GetObject for the whole bucket, but the Deny overrides (explicit deny), the request will be denied. Option A (allowed) ignores the Deny. Option B (denied due to first statement) is wrong because first statement allows. Option D (denied due to IP condition) is wrong because the IP condition is only on the Allow statement.

Answer

The request is denied because the second statement denies access from the IP range.

Answer

The request is denied because the first statement only allows from a specific IP range.

Answer

The request is allowed because the first statement allows s3:GetObject.

Question 11

A company wants to use AWS Single Sign-On (SSO) to manage access to multiple AWS accounts. The company has an existing identity source in an on-premises Active Directory. Which integration method should the company use?

Accepted Answer

Use SAML 2.0 federation between AWS SSO and the on-premises AD.. AWS IAM Identity Center (formerly AWS SSO) can integrate with an on-premises Active Directory using SAML 2.0 federation. This involves configuring a SAML 2.0 identity provider (such as Active Directory Federation Services) to federate with IAM Identity Center. Option C is incorrect because it describes combining AWS Managed Microsoft AD and AD Connector, which is not a valid integration method. The correct approaches are either using AD Connector alone or AWS Managed Microsoft AD with a trust, not both together. Other options are not viable direct integration methods.

Answer

Use AWS IAM Identity Center with an external identity provider that supports SCIM.

Answer

Set up an AWS Managed Microsoft AD directory and sync with the on-premises AD using AD Connector.

Answer

Configure AWS SSO to directly connect to the on-premises Active Directory using LDAP.

Question 12

Match each AWS disaster recovery strategy to its description.

Accepted Answer

Backup and Restore: Data is backed up to S3 and restored when needed.. AWS DR strategies range from low-cost/high-RTO (Backup and Restore) to high-cost/low-RTO (Multi-Site). Pilot Light has minimal core services running, Warm Standby has a scaled-down environment, and Multi-Site has fully active regions. Common confusions include swapping definitions between similar strategies.

Answer

Backup and Restore: A scaled-down version of the environment runs and can be scaled up quickly.

Answer

Pilot Light: Data is backed up to S3 and restored when needed.

Question 13

Match each AWS cost management tool to its use.

Accepted Answer

AWS Cost Explorer: A visual tool that enables you to view and analyze your AWS costs and usage.. Correct matches: Cost Explorer visualizes costs, Budgets set alerts, Trusted Advisor recommends optimizations, and CUR provides detailed data. Common confusions involve mixing tool capabilities.

Answer

AWS Cost Explorer: A service that automatically reduces costs by applying savings plans.

Answer

AWS Budgets: A report that includes all cost and usage data in CSV format.

Question 14

Match each AWS database service to its characteristic.

Accepted Answer

Amazon RDS: Fully managed relational database service supporting multiple database engines. Each AWS database service targets specific use cases: RDS for relational workloads, DynamoDB for NoSQL, Redshift for analytics, and ElastiCache for caching. Common confusions include mixing up NoSQL with relational and caching with warehousing.

Answer

Amazon RDS: Fully managed NoSQL key-value database

Answer

Amazon Redshift: In-memory caching service

Question 15

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

Accepted Answer

Use Amazon S3 for temporary data storage.. Using Amazon S3 for temporary data storage improves durability because S3 offers 99.999999999% durability, far exceeding the durability of a single EBS volume or instance store. It is cost-effective as you pay only for the storage used, with no upfront investment or additional volume costs. Although S3 is object storage, it is suitable for temporary data that does not require block-level access. Option A is incorrect because increasing IOPS does not improve durability. Option C is incorrect because adding EBS volumes and RAID 1 mirroring increases costs significantly due to additional volume charges. Option D is incorrect because moving to instance store reduces durability, as instance store is ephemeral and data is lost on instance stop/termination.

Answer

Increase the IOPS of the current EBS volume to improve performance.

Answer

Add additional EBS volumes and set up RAID 1 for mirroring.

Answer

Move the temporary data to an instance store volume if the instance type supports it.

Question 16

A company is using AWS Organizations and wants to restrict the use of specific instance types across all accounts. The company wants to allow only t3.micro, t3.small, m5.large, and m5.xlarge instances. Which SCP should be applied?

Accepted Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"arn:aws:ec2:*:*:instance/*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.micro","t3.small","m5.large","m5.xlarge"]}}}. The correct SCP because it targets the instance resource with a resource ARN and uses a Deny effect with StringNotEquals to block any instance types not in the allowed list. By listing the specific instance types explicitly, the policy avoids the unsupported use of wildcards in StringNotEquals conditions for ec2:InstanceType. This ensures that only the specified instance types can be launched.

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringNotEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Allow","Action":"ec2:RunInstances","Resource":"*","Condition":{"StringEquals":{"ec2:InstanceType":["t3.*","m5.*"]}}}

Answer

{"Effect":"Deny","Action":"ec2:RunInstances","Resource":"*"}

Question 17

A company is designing a new microservices-based application on AWS. They want to ensure that services can discover each other dynamically and that traffic can be load balanced across multiple Availability Zones. Which AWS service should they use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map is a cloud resource discovery service that allows microservices to dynamically register their endpoints (IP addresses, ports) and discover each other via DNS or API calls. It integrates with Amazon Route 53 auto-naming and health checks, enabling load-balanced traffic across multiple Availability Zones by returning healthy, available endpoints. This makes it the correct choice for dynamic service discovery in a microservices architecture.

Answer

AWS Service Catalog

Answer

Amazon Route 53 private hosted zones

Answer

AWS Systems Manager Parameter Store

Question 18

A company is designing a new application that will run on Amazon ECS with Fargate. The application must be able to read and write files to a shared file system that is accessible from multiple tasks simultaneously. The file system must be durable and support NFS protocol. Which storage solution should be used?

Accepted Answer

Amazon EFS. Amazon EFS is the correct choice because it provides a fully managed, durable, NFS-based (Network File System) shared file system that can be mounted concurrently by multiple Amazon ECS tasks running on Fargate. EFS supports the NFSv4.1 and NFSv4.0 protocols, ensuring simultaneous read/write access across tasks, and its data is replicated across multiple Availability Zones for durability.

Answer

Amazon EBS with Multi-Attach

Answer

Amazon S3

Answer

Amazon FSx for Lustre

Question 19

A company is designing a new serverless application using AWS Lambda. The function needs to access an Amazon RDS database. Which THREE practices should be followed to avoid connection exhaustion?

Accepted Answer

Use Amazon RDS Proxy to pool connections. Amazon RDS Proxy sits between Lambda and the database, managing a pool of established connections. It reduces the overhead of opening and closing connections per invocation and prevents Lambda from exhausting database connections during concurrent executions. This is the recommended pattern for serverless applications with relational databases.

Answer

Store the database connection in a global variable to reuse across invocations

Answer

Assign a static IP address to the Lambda function

Question 20

A company uses AWS Organizations with a management account and several member accounts. The security team wants to ensure that all member accounts have AWS CloudTrail enabled and that logs are delivered to a centralized S3 bucket in the management account. What should they do?

Accepted Answer

Create a CloudTrail trail in the management account that applies to all accounts in the organization.. AWS CloudTrail supports organization trails, which can be created in the management account and automatically apply to all member accounts within the AWS Organization. This ensures that all accounts have CloudTrail enabled and logs are delivered to a centralized S3 bucket in the management account without requiring per-account configuration.

Answer

Use AWS CloudFormation StackSets to deploy a CloudTrail configuration to all accounts.

Answer

Enable CloudTrail in each member account and configure it to deliver logs to the management account's S3 bucket.

Answer

Apply an SCP to require CloudTrail to be enabled in all accounts.