SAP-C02 Mock Exam 88 — 25 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The company has configured a target tracking scaling policy based on average memory utilization. During a traffic spike, the ECS service scales out, but the new tasks are immediately deregistered and replaced. The CloudWatch logs show that the new tasks are failing the ALB health check. The health check is configured to ping the '/health' endpoint on the container. The solutions architect verifies that the application container correctly responds to the '/health' endpoint with a 200 status code. What is the MOST likely cause of the health check failures?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The security group attached to the ECS tasks does not allow inbound traffic from the ALB on the health check port.. Since the application container correctly responds to the '/health' endpoint with a 200 status code, the health check failures are likely due to network connectivity. For Fargate tasks, each task gets an ENI, and the security group attached to the tasks must allow inbound traffic from the ALB on the health check port. If this rule is missing, the ALB cannot reach the health check endpoint, causing tasks to be deregistered. Option A is incorrect because the ALB listener rule is for routing traffic, not health checks. Option C is incorrect because a high deregistration delay would cause slow draining, not immediate health check failures. Option D is incorrect because the health check path is confirmed correct by the architect.

Answer

The ALB is not configured with a proper listener rule to forward traffic to the target group.

Answer

The deregistration delay (connection draining) is set too high, causing the ALB to think the tasks are unhealthy.

Answer

The health check path is incorrect; it should be '/index.html' instead of '/health'.

Question 2

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

Accepted Answer

Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.. Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Answer

Migrate the application to use Amazon DynamoDB with global tables.

Answer

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Answer

Implement Amazon ElastiCache in front of the database to cache read queries.

Question 3

A company has multiple AWS accounts managed under AWS Organizations. The security team needs to enforce that all newly created S3 buckets in any account are automatically tagged with a 'CostCenter' tag. Which solution is the MOST operationally efficient?

Accepted Answer

Use a service control policy (SCP) to deny s3:CreateBucket unless the request includes a 'CostCenter' tag.. A service control policy (SCP) can deny the s3:CreateBucket action unless the request includes a 'CostCenter' tag, using the 'aws:RequestTag' condition key. This enforces tagging at the point of creation across all accounts in the organization, preventing untagged buckets from being created in the first place, which is the most operationally efficient approach as it avoids the need for remediation or post-creation tagging.

Answer

Use an AWS Lambda function triggered by AWS CloudTrail to tag buckets after creation.

Answer

Use an AWS Config rule to mark non-compliant buckets and automatically apply tags.

Answer

Use AWS CloudFormation StackSets to deploy a template that creates tagged buckets in each account.

Question 4

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

Accepted Answer

Set up an automatic remediation action using AWS Config to enable encryption on non-compliant buckets.. AWS Config can be configured with automatic remediation actions (e.g., using AWS Systems Manager Automation) to enable encryption on S3 buckets that are found non-compliant. Option C is correct because a Service Control Policy (SCP) can be applied to organizational units (OUs) in AWS Control Tower to deny the creation of S3 buckets without encryption, providing preventive governance. Option D is correct because an AWS Config rule can be defined to evaluate whether S3 buckets have encryption enabled, alerting on non-compliance. Option B is incorrect because IAM policies attached to the root user are not effective for enforcing baseline rules across multiple accounts; SCPs are designed for that purpose. Option E is incorrect because AWS CloudTrail only logs API calls for auditing and does not enforce or remediate compliance; it is not a control mechanism for ensuring encryption at rest.

Answer

Attach an IAM policy to each account's root user.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 5

A Solutions Architect is reviewing the CloudFormation template snippet shown in the exhibit. What will happen when this template is deployed?

Accepted Answer

The template will create an S3 bucket with versioning enabled.. The CloudFormation template snippet includes the `VersioningConfiguration` property set to `Enabled` within the `AWS::S3::Bucket` resource. This explicitly enables versioning when the stack is deployed. The template also specifies a `BucketName`, so CloudFormation uses that name rather than generating a random one. Option B is incorrect because the bucket name is explicitly provided, not randomly generated. Option C is incorrect because the template will only fail if the bucket name is already taken, but that is not guaranteed. Option D is incorrect because versioning is explicitly enabled.

Answer

The template will create an S3 bucket with a random name.

Answer

The template will fail because the bucket name is not globally unique.

Answer

The template will create an S3 bucket with versioning disabled.

Question 6

A global company uses AWS Organizations with hundreds of accounts. The security team requires that all S3 buckets across the organization block public access. They want to enforce this policy without modifying existing bucket policies. Which solution should they use?

Accepted Answer

Create an SCP that denies s3:PutAccountPublicAccessBlock and s3:DeleteAccountPublicAccessBlock, and enable S3 Block Public Access at the account level via a custom resource in each account.. S3 Block Public Access settings at the account level override bucket-level policies and can be enforced organization-wide via a service control policy (SCP) that denies the ability to disable or delete those settings. By using a custom resource (e.g., AWS CloudFormation) to enable S3 Block Public Access at the account level in each account, and an SCP to prevent any account from modifying those settings, the security team ensures all buckets in the organization block public access without needing to modify existing bucket policies.

Answer

Use AWS CloudTrail to monitor for public bucket creation and alert the security team.

Answer

Create a service control policy (SCP) that denies s3:PutBucketPolicy for any bucket that allows public access.

Answer

Use AWS Config rules to detect public buckets and auto-remediate with a Lambda function.

Question 7

A company uses AWS Systems Manager Patch Manager to patch Amazon EC2 instances. After a patching operation, some instances fail to report their compliance status. What is the MOST efficient way to identify the cause of the failure?

Accepted Answer

Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances.. Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances. This is the most efficient approach because Systems Manager Inventory provides a centralized view of patch compliance across all managed instances, allowing you to quickly identify which instances are non-compliant and investigate the reasons for patch failures. Option A is inefficient because it requires running scripts manually on each instance. Option C is incorrect because the Patch Manager dashboard (if available) may not provide detailed failure reasons. Option D is inefficient and does not directly address compliance failure causes.

Answer

Run a script on each instance to list missing patches.

Answer

Use the Patch Manager dashboard in the AWS Management Console.

Answer

Check the EC2 console for each instance's patch status.

Question 8

A company is designing a multi-account strategy for its AWS environment. Which TWO considerations are important when using AWS Organizations?

Accepted Answer

AWS CloudTrail can be enabled for all accounts from the management account using an organization trail.. AWS Organizations allows you to create an organization trail in CloudTrail that logs events for all accounts within the organization from the management account. This simplifies audit and compliance by centralizing log collection without needing to configure trails individually in each member account.

Answer

Service control policies (SCPs) apply to all accounts in the organization, including the management account.

Answer

Each account in an organization must have its own payment method.

Answer

AWS Config rules cannot be applied across accounts via AWS Organizations.

Question 9

A company uses AWS Lambda functions within a VPC to process data from an Amazon SQS queue. The Lambda functions frequently timeout with the error 'Task timed out after 3.00 seconds'. The functions perform database operations on an RDS instance in the same VPC. The average database query takes 2 seconds. What is the MOST likely cause of the timeouts?

Accepted Answer

The VPC does not have a NAT gateway, so the Lambda function cannot poll the SQS queue.. Lambda functions in a VPC require a NAT gateway or VPC endpoints to access the SQS API, which is outside the VPC. Without a NAT gateway, the function cannot poll the SQS queue, causing timeouts. Option A is wrong because Lambda can access RDS within the same VPC without special permissions. Option C is wrong because the timeout is due to SQS polling failure, not the database query time. Option D is wrong because the RDS instance is under-provisioned would cause slow queries, but the error is a timeout after exactly 3 seconds, indicating the function is waiting on something else (SQS polling).

Answer

The Lambda function does not have the required VPC permissions to access the RDS instance.

Answer

The Lambda function timeout should be increased to accommodate database query time.

Answer

The RDS instance is under-provisioned and causing slow queries.

Question 10

A company is migrating a legacy application to AWS. The application requires a shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones. The file system must provide high throughput and low latency. Which storage solution meets these requirements?

Accepted Answer

Use Amazon EFS with provisioned throughput.. Amazon EFS with provisioned throughput is the correct choice because it provides a fully managed, scalable, shared file system that can be mounted by hundreds of EC2 instances across multiple Availability Zones simultaneously. It uses the NFSv4.1 protocol, delivers high throughput and low latency, and allows you to provision throughput independently of storage size to meet performance requirements.

Answer

Use Amazon EBS with a multi-attach enabled volume.

Answer

Use Amazon S3 with S3 File Gateway to present as a file system.

Answer

Use Amazon FSx for Windows File Server with a single file system.

Question 11

A company uses AWS Organizations with a multi-account setup. The security team needs to ensure that all users in all accounts use multi-factor authentication (MFA) to access the AWS Management Console. Which THREE steps should be taken to enforce this?

Accepted Answer

Use AWS IAM Identity Center (SSO) with MFA enforcement for all accounts.. AWS IAM Identity Center (SSO) allows you to centrally manage user access and enforce MFA at the identity provider level. By configuring MFA enforcement in IAM Identity Center, all users federating into any account in the organization are required to present a valid MFA token before accessing the AWS Management Console, ensuring consistent enforcement across the multi-account setup.

Answer

Enable CloudTrail to log all console logins and alert if MFA is not used.

Answer

Use a service control policy (SCP) to require MFA on all IAM users.

Question 12

A company wants to migrate an on-premises relational database to Amazon RDS for MySQL with minimal downtime. The database is 500 GB in size. Which AWS service should be used for the initial data load and ongoing replication?

Accepted Answer

Use AWS Database Migration Service (DMS) with ongoing replication.. AWS Database Migration Service (DMS) with ongoing replication is the correct choice because it supports both a full load of the 500 GB database and continuous change data capture (CDC) using the MySQL binary log (binlog) to replicate ongoing changes with minimal downtime. DMS can perform the initial load while the source remains operational, then switch to CDC to keep the target in sync until cutover.

Answer

Use AWS Snowball to transfer the database files to RDS.

Answer

Use an RDS read replica from the on-premises database.

Answer

Export the database to Amazon S3 and import into RDS.

Question 13

A large financial services company uses AWS Organizations with over 200 accounts. The security team has implemented a Service Control Policy (SCP) that denies access to all services except a whitelist that includes Amazon S3, Amazon DynamoDB, AWS Lambda, and Amazon CloudWatch. Recently, the DevOps team reported that they cannot create new EC2 instances in their development account, even though the administrator explicitly attached an IAM policy allowing ec2:RunInstances. The SCP does not explicitly deny EC2. What is the most likely cause of this issue?

Accepted Answer

The SCP denies all services not explicitly allowed, and EC2 is not on the whitelist. The SCP uses a deny-all approach with a whitelist of allowed services. Since EC2 is not on that whitelist, the SCP implicitly denies all EC2 actions, overriding any IAM policy that explicitly allows ec2:RunInstances. SCPs act as a guardrail that cannot be bypassed by account-level IAM policies.

Answer

The IAM role used by the DevOps team has a trust policy that does not allow EC2 actions

Answer

The EC2 service has been disabled via AWS Config in that account

Answer

The development account is in an organizational unit (OU) with a different SCP that denies EC2

Question 14

Refer to the exhibit. A security engineer is reviewing this S3 bucket policy. The bucket is used to store sensitive logs from multiple accounts in an AWS Organization. What is the primary purpose of the condition element in this policy?

Accepted Answer

To ensure that only requests originating from accounts within the specified organization are allowed.. The condition element in this S3 bucket policy uses the `aws:PrincipalOrgID` condition key to restrict access to principals (users or roles) that belong to accounts within the specified AWS Organization. This ensures that only requests from accounts that are members of the organization are allowed, even if the IAM principal has explicit permissions. This is the primary purpose of the condition, as it enforces organizational boundaries for cross-account access to sensitive logs.

Answer

To restrict access to only the root user of the management account.

Answer

To enforce that all requests are made using HTTPS.

Answer

To allow access only from specific IP addresses within the organization.

Question 15

A company is designing a new application that will be deployed on AWS. The application requires a relational database with automatic failover and high availability within a single AWS region. Which database deployment option meets these requirements?

Accepted Answer

Amazon RDS Multi-AZ deployment. RDS Multi-AZ provides automatic failover and high availability within a region. Option A is wrong because Single-AZ does not provide failover. Option B is wrong because Read Replicas are for read scaling, not failover. Option D is wrong because cross-region replication is for disaster recovery, not primary failover.

Answer

Amazon RDS Single-AZ deployment

Answer

Amazon RDS with Read Replicas

Answer

Amazon RDS cross-region replication

Question 16

A company is designing a serverless data processing pipeline using AWS Lambda. The pipeline processes data from an Amazon Kinesis Data Stream. The Lambda function has a memory limit of 512 MB and a timeout of 5 minutes. The data volume is expected to increase significantly. Which TWO strategies should the company implement to improve throughput and reduce processing latency? (Choose TWO.)

Accepted Answer

Increase the number of shards in the Kinesis data stream. Increasing the number of shards in the Kinesis data stream (Option A) increases parallelism because each shard can be processed by one concurrent Lambda instance, allowing the pipeline to handle higher data volumes. Increasing the batch size in the event source mapping (Option B) allows each Lambda invocation to process more records at once, reducing the number of invocations and lowering per-record overhead. Together, these two strategies directly improve throughput and reduce latency. Option D (increasing memory) can improve performance for compute-bound functions but does not directly address parallelism or batching, and is not one of the two best choices for this scenario.

Answer

Change the data source from Kinesis to an Amazon SQS queue

Answer

Increase the Lambda function memory to 1024 MB

Answer

Increase the Lambda function's reserved concurrency to a higher value

Question 17

A company is migrating a distributed application that uses a custom TCP protocol between components. The application is deployed on-premises across multiple servers. The company wants to use AWS without modifying the application code. Which approach should the company take to migrate the application while maintaining low latency between components?

Accepted Answer

Use Amazon EC2 instances in a Placement Group within a single VPC to ensure low latency.. Using a Placement Group ensures that EC2 instances are placed close together within the same Availability Zone, minimizing network latency and maximizing throughput for the custom TCP protocol. This allows the application to run unchanged on AWS. Option B is incorrect because Direct Connect connects on-premises to AWS, but the application components would still be separated by network distance, increasing latency. Option C is incorrect because VPC Peering connects different VPCs, which does not guarantee low latency within a single VPC. Option D is incorrect because a VPN is used for secure connectivity over the internet, which introduces higher latency and is not necessary for components within the same VPC.

Answer

Use AWS Direct Connect to connect the on-premises servers to AWS and keep the application on-premises.

Answer

Use VPC Peering to connect the application components across different VPCs.

Answer

Use a VPN connection between the on-premises environment and AWS VPC.

Question 18

A company is migrating a legacy e-commerce platform to AWS. The platform includes a MySQL database that experiences heavy read traffic. The company wants to improve performance and reduce latency for read operations. Which TWO actions should the solutions architect take?

Accepted Answer

Add read replicas to the RDS MySQL database.. Adding read replicas offloads read traffic from the primary database, improving performance. Implementing Amazon ElastiCache for caching reduces database load for frequently accessed data. Multi-AZ is for high availability, not read performance. Provisioned IOPS improves write performance. Sharding adds complexity and may not be necessary.

Answer

Enable Multi-AZ on the RDS instance.

Answer

Shard the database across multiple RDS instances.

Answer

Upgrade to Provisioned IOPS for the database.

Question 19

A company is migrating a monolithic application to a microservices architecture on AWS. The application uses a relational database with complex queries. The company wants to reduce operational overhead and achieve high availability. Which database strategy should the company adopt for the microservices?

Accepted Answer

Use a separate Amazon RDS instance for each microservice. A microservices architecture requires database isolation to ensure loose coupling, independent scaling, and fault isolation. Using a separate Amazon RDS instance for each microservice allows each team to manage its own schema, optimize queries independently, and avoid a single point of failure, which aligns with the goal of reducing operational overhead and achieving high availability.

Answer

Use Amazon RDS Proxy with a single database

Answer

Use Amazon DynamoDB for all microservices

Answer

Use a single Amazon RDS instance shared across all microservices

Question 20

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have permission to create EC2 instances.. A stack status of ROLLBACK_COMPLETE indicates that CloudFormation successfully initiated resource creation but one or more resources failed, triggering a rollback. The most common cause is that the IAM role associated with the stack lacks permissions to create the required resources (e.g., EC2 instances). A template syntax error would cause a validation error before any resource creation begins, resulting in a status like CREATE_FAILED without a rollback. Wrong region selection would not cause a rollback after resources start being created; the stack would either succeed or fail due to availability issues. Option C is correct because insufficient IAM permissions are a frequent cause of resource creation failures leading to rollback.

Answer

The stack was created in the wrong AWS region.

Answer

The EC2 instance type is not available in the region.

Answer

The CloudFormation template has a syntax error.