SAP-C02 Mock Exam 83 — 25 Questions

Question 1

A company uses AWS Organizations with consolidated billing. The finance team wants to track costs by project, where each project may use resources across multiple accounts. What is the MOST scalable way to allocate costs?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Cost Categories in AWS Cost Explorer to group costs by shared tags that are activated centrally.. AWS Cost Categories allow you to group costs based on shared tags, accounts, or other dimensions across multiple accounts in an AWS Organization. This is the most scalable approach for tracking costs by project when resources span multiple accounts, as it centralizes cost allocation without requiring manual tag activation per account.

Answer

Create separate AWS accounts for each project and use consolidated billing to view costs.

Answer

Use AWS Budgets with cost allocation tags to track project costs.

Answer

Apply cost allocation tags to resources in each account and use AWS Cost Explorer to filter by tag.

Question 2

A Solutions Architect is reviewing an Amazon S3 bucket policy that grants access to users from another AWS account. The policy uses the Principal element with "AWS": "arn:aws:iam::123456789012:root". The users in the other account are unable to access the bucket. What is the most likely cause?

Accepted Answer

The policy must specify the IAM user ARN, not the root user ARN.. The root user ARN does not grant access to individual IAM users; the policy must allow the entire account or specific user ARNs. Option B is wrong because the bucket policy can refer to another account. Option C is wrong because S3 does not require VPC endpoints for cross-account access. Option D is wrong because the bucket policy can use IAM user ARNs.

Answer

The bucket policy must also include a VPC endpoint condition.

Answer

Cross-account access is not supported with bucket policies.

Answer

The bucket policy must use the CanonicalUser ID instead of the account ID.

Question 3

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

Accepted Answer

Increase the Lambda function reserved concurrency.. Increasing the number of Lambda function instances will increase concurrency and process more messages in parallel. Option A is wrong because increasing batch size may cause timeouts. Option C is wrong because increasing function memory/timeout does not directly improve throughput. Option D is wrong because SQS visibility timeout does not affect Lambda concurrency.

Answer

Increase the SQS visibility timeout to allow more time per message.

Answer

Increase the Lambda function memory and timeout settings.

Answer

Increase the SQS batch size to the maximum of 100.

Question 4

A company is using AWS Lambda functions to process files uploaded to an S3 bucket. Recently, the processing time has increased significantly. A solutions architect notices that the Lambda functions are using the default VPC configuration. What is the MOST likely cause of the performance degradation?

Accepted Answer

Lambda function is attached to a VPC, causing network latency for S3 API calls.. Lambda functions in a VPC use an Elastic Network Interface (ENI) in a private subnet, which can add latency for internet-bound requests. Options A, C, and D do not directly cause increased processing time.

Answer

Lambda function is using too much memory.

Answer

S3 bucket has versioning enabled, causing extra overhead.

Answer

S3 bucket is in a different region.

Question 5

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

Accepted Answer

Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.. A blue/green deployment with ECS minimizes downtime by switching traffic gradually. Option A is wrong because migrating all at once risks downtime. Option B is wrong because launching a separate ECS cluster adds complexity. Option C is wrong because CodeStar is not a deployment strategy.

Answer

Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.

Answer

Deploy the monolith as a single task in ECS and update the task definition with new container versions.

Answer

Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.

Question 6

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer. Recently, error rates increased due to a misconfiguration. The operations team wants to automatically roll back to the previous working configuration if errors exceed a threshold. Which solution provides the fastest rollback?

Accepted Answer

Implement AWS CodeDeploy with automatic rollback triggered by CloudWatch alarms.. AWS CodeDeploy supports automatic rollback based on CloudWatch alarm thresholds, providing the fastest rollback by reverting to the previous working deployment revision automatically. Option A is incorrect because manually restoring AMI snapshots is slow and error-prone. Option B is incorrect because AWS Elastic Beanstalk with rolling updates and health checks can perform rollbacks, but it is slower and less granular than CodeDeploy’s immediate alarm-based rollback. Option C is incorrect because AWS CloudFormation stack policies prevent updates and do not facilitate automatic rollback of the application deployment.

Answer

Manually restore AMI snapshots of the previous deployment.

Answer

Use AWS Elastic Beanstalk with rolling updates and health checks.

Answer

Use AWS CloudFormation with a stack policy to prevent updates.

Question 7

A company is using AWS DMS to migrate a SQL Server database to Amazon Redshift. The initial full load completed, but the ongoing replication task failed with the error shown. What is the MOST likely cause?

Accepted Answer

The source SQL Server transaction log has not been backed up or truncated, causing it to become full.. The error indicates that AWS DMS cannot read the source SQL Server transaction log to capture ongoing changes. This typically occurs when the transaction log is full because it has not been backed up or truncated, preventing DMS from reading new log records for continuous replication. DMS relies on the source database's transaction log for CDC (Change Data Capture), and a full log blocks this process.

Answer

The DMS task is not configured to use a task log for troubleshooting.

Answer

The target Redshift table does not have a primary key defined for the DMS task to apply changes.

Answer

The DMS task is using a full LOB mode, which is not supported for Redshift targets.

Question 8

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

Accepted Answer

Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.. Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.

Answer

Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.

Answer

Create an AWS Config rule in each account to remediate non-compliant buckets.

Answer

Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Question 9

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

Accepted Answer

Change the bucket's default encryption configuration to SSE-KMS.. Changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys. Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Answer

Add a lifecycle policy to transition objects to SSE-KMS.

Answer

Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.

Answer

Use a bucket policy to deny uploads without SSE-KMS.

Question 10

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

Accepted Answer

The ALB is buffering requests because the backend instances are overwhelmed; increase the number of instances or improve instance performance.. A high SurgeQueueLength means the ALB is receiving more requests than the healthy instances can handle, causing queuing. Option B is wrong because surge queue is for HTTP requests, not connections. Option C is wrong because it is not a client-side issue. Option D is wrong because the queue is at the ALB level, not instance level.

Answer

The backend instances are failing health checks; review the health check configuration.

Answer

Clients are sending too many requests; implement API rate limiting.

Answer

The ALB is experiencing a high number of new connections; increase the idle timeout setting.

Question 11

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

Accepted Answer

Use the put-retention-policy command to set retentionInDays to 7.. The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct. Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Answer

Export the logs to S3 and delete the log group.

Answer

Configure an S3 Lifecycle policy on the log group's underlying storage.

Answer

Create a CloudTrail trail to capture log events and expire them after 7 days.

Question 12

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. The team wants to capture network traffic between containers for troubleshooting. Which solution should they implement?

Accepted Answer

Enable VPC Flow Logs on the ENIs attached to the ECS tasks.. Using Amazon ECS task networking with VPC and enabling VPC Flow Logs captures network traffic metadata. Option A is wrong because AWS X-Ray captures application-level traces, not network packets. Option B is wrong because CloudWatch Logs agent captures logs, not network traffic. Option C is wrong because ECS Exec allows shell access but not traffic capture.

Answer

Enable AWS X-Ray tracing on the ECS tasks.

Answer

Configure the awslogs driver to send container logs to CloudWatch Logs.

Answer

Use Amazon ECS Exec to access containers and run tcpdump.

Question 13

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Accepted Answer

Create one or more Read Replicas in the same region.. Creating Read Replicas offloads read traffic from the primary instance. Option A increases cost unnecessarily, C requires application changes, and D does not directly improve read performance.

Answer

Enable Multi-AZ deployment for failover.

Answer

Use Amazon ElastiCache to cache frequent queries.

Answer

Upgrade to a larger instance type.

Question 14

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

Accepted Answer

The health check path is misconfigured and returns HTTP 404.. The ALB performs health checks on targets by sending requests to the configured health check path. If the health check path returns an HTTP 404 (or any non-200 status), the ALB marks the target as unhealthy. When all instances have a misconfigured health check path that returns 404, the healthy host count drops to zero, resulting in 503 errors. Option D is correct because a misconfigured health check path directly causes all instances to be marked unhealthy. Option A (idle timeout) would cause connection timeouts but not affect healthy host count. Option B (security group) would prevent traffic from ALB, but the health check would still succeed if the security group allows ALB traffic, and it would not cause healthy host count to drop to zero periodically if misconfigured. Option C (insufficient capacity) would cause scaling issues but not zero healthy hosts if the health check is correct. Therefore, D is the most likely cause.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Answer

The EC2 instances are in an Auto Scaling group with insufficient capacity.

Question 15

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

Accepted Answer

Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.. CodeDeploy with ECS blue/green deployment provides built-in traffic shifting and automated rollback. Option A is wrong because it lacks traffic shifting. Option B is wrong because it does not support blue/green. Option C is wrong because it lacks automated rollback.

Answer

Use CodePipeline with a Lambda function to swap target groups and monitor health.

Answer

Use CodeDeploy with an in-place deployment configuration and a manual approval step.

Answer

Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

Question 16

A company is migrating a legacy application that uses TCP on port 8080 to AWS. The application must be accessible from the internet. The company wants to use an Application Load Balancer. What must the company do to ensure the load balancer can accept traffic on port 8080?

Accepted Answer

Create a listener for port 8080 on the ALB.. ALB supports custom ports; you create a listener for port 8080. Option A is wrong because ALB does not require a specific security group port; you can configure any port. Option B is wrong because you cannot change the ALB's default ports; you add a listener. Option C is wrong because ALB itself does not need a public IP; it uses a DNS name.

Answer

Configure the security group to allow inbound traffic on port 80 and 443 only.

Answer

Change the ALB's default port to 8080.

Answer

Assign an Elastic IP address to the ALB.

Question 17

A company is migrating a multi-tier web application to AWS. The application consists of a stateless web tier and a stateful application tier that uses sticky sessions. The company wants to reduce operational overhead and improve elasticity. Which architecture should the solutions architect recommend?

Accepted Answer

Use an Application Load Balancer with sticky sessions for the web tier. Store session data in Amazon ElastiCache.. Using an Application Load Balancer (ALB) with sticky sessions (session affinity) enables the web tier to be stateless and scale horizontally. The application tier can use ElastiCache for session state storage, making it stateless as well. This reduces overhead and improves elasticity. NLB with EFS is not suitable for session state; ALB with DynamoDB is overkill; CloudFront does not support sticky sessions.

Answer

Use Amazon CloudFront with an origin load balancer and store session data in the web tier's local storage.

Answer

Use an Application Load Balancer with cross-zone load balancing and store session data in Amazon DynamoDB.

Answer

Use a Network Load Balancer with instance targets and Amazon EFS to share session data.

Question 18

A company is migrating a batch processing workload to AWS. The workload runs daily on a single on-premises server and takes 6 hours to complete. The company wants to reduce processing time and cost. Which approach should the solutions architect recommend?

Accepted Answer

Use AWS Batch to run the workload in parallel on multiple compute resources. AWS Batch can orchestrate parallel processing across multiple EC2 or Fargate resources, reducing time. A single larger instance may not reduce time as much as parallel processing. Lambda has a 15-minute execution limit. Step Functions alone does not provide compute.

Answer

Use AWS Lambda with a 6-hour timeout

Answer

Use AWS Step Functions to orchestrate the workload sequentially

Answer

Use a single larger EC2 instance with more vCPUs

Question 19

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

Accepted Answer

Decrease the cooldown period and set a lower CPU utilization threshold for scale-out. By decreasing the cooldown period and lowering the CPU utilization threshold for scale-out, the Auto Scaling group reacts faster to rising CPU usage. The lower threshold triggers a scale-out action before CPU reaches 90%, and the reduced cooldown allows new instances to start sooner after the previous scaling activity. This addresses the 5-minute startup lag by ensuring new instances are launched earlier in the spike, reducing the window of timeouts. Option A (scheduled scaling) only helps for predictable spikes, not intermittent ones. Option B (pre-warming the load balancer) is not a standard AWS feature and does not reduce instance startup time. Option D (predictive scaling) still has the same startup delay and requires historical data.

Answer

Use a scheduled scaling policy to add instances before expected peak times

Answer

Pre-warm the load balancer to reduce latency

Answer

Switch to predictive scaling

Question 20

A company is migrating a legacy .NET application to AWS. The application uses Windows authentication and connects to an on-premises SQL Server database. The company wants to minimize code changes. Which migration strategy is most appropriate?

Accepted Answer

Rehost the application on EC2 Windows instances and use Amazon RDS for SQL Server.. Rehosting on EC2 Windows with RDS SQL Server minimizes changes and supports Windows authentication. Option A is wrong because re-platforming to Linux may break .NET dependencies. Option B is wrong because refactoring to serverless requires significant code changes. Option D is wrong because moving to Aurora PostgreSQL requires code changes.

Answer

Replatform the application to use Amazon Aurora PostgreSQL with AWS DMS.

Answer

Refactor the application into microservices using AWS Lambda and Amazon DynamoDB.

Answer

Re-platform the application to run on Amazon Linux and use Amazon RDS for MySQL.