SAP-C02 Mock Exam 89 — 25 Questions

Question 1

A company is designing a high-performance computing (HPC) workload on AWS. The workload requires tightly coupled inter-node communication with low latency and high bandwidth. Which THREE services or features should the architect consider to meet these requirements? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

EC2 instances with enhanced networking and high-throughput (e.g., p4d, p3dn). EC2 instances like p4d and p3dn are designed for HPC workloads, offering enhanced networking (up to 100 Gbps) and high-throughput capabilities. These instances support Elastic Fabric Adapter (EFA) and are optimized for tightly coupled inter-node communication, providing the low latency and high bandwidth required for HPC.

Answer

VPC peering between multiple VPCs

Answer

AWS Global Accelerator

Question 2

A company wants to serve static content (images and videos) to users worldwide with low latency. The content is stored in an Amazon S3 bucket. What is the most cost-effective solution?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as the origin.. Amazon CloudFront is a global content delivery network (CDN) that caches static content at edge locations worldwide, reducing latency for users. Using an S3 bucket as the origin is cost-effective because CloudFront egress costs are often lower than direct S3 data transfer, and you only pay for data transfer out from CloudFront and occasional origin fetches. This solution minimizes origin load and provides low-latency delivery without the overhead of managing servers or additional acceleration services.

Answer

Use AWS Global Accelerator with endpoints pointing to the S3 bucket.

Answer

Deploy EC2 instances in multiple Regions and use a load balancer.

Answer

Host the content directly from the S3 bucket and use S3 Transfer Acceleration.

Question 3

A company is migrating a legacy .NET Framework 4.8 application to AWS. The application uses Windows authentication integrated with Active Directory and relies on a shared file system for configuration files. The company wants to minimize operational overhead and use managed services. Which combination of AWS services should the company use to modernize the application?

Accepted Answer

AWS Managed Microsoft AD, Amazon FSx for Windows File Server, and AWS Elastic Beanstalk for .NET on Windows. AWS Managed Microsoft AD provides Windows authentication integrated with Active Directory, FSx for Windows File Server provides a managed shared file system that supports Windows-native SMB protocol and NTFS permissions, and AWS Elastic Beanstalk for .NET on Windows minimizes operational overhead for hosting a .NET Framework 4.8 application. Option A (EFS) does not natively support Windows authentication or SMB protocol, making it unsuitable. Option B (RDS for SQL Server) is unnecessary as the application does not require a database. Option C (App Runner) does not support .NET Framework applications, and S3 cannot function as a Windows shared file system.

Answer

AWS Managed Microsoft AD, Amazon EFS, and AWS Elastic Beanstalk for .NET on Windows

Answer

Amazon Cognito, Amazon RDS for SQL Server, and AWS Lambda

Answer

AWS Directory Service for Microsoft AD, Amazon S3, and AWS App Runner

Question 4

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

Accepted Answer

Enable detailed monitoring on the EC2 instances.. Enabling detailed monitoring on EC2 instances provides CloudWatch metrics at a 1-minute granularity, which is crucial for identifying the exact timing and duration of CPU spikes. The intermittent nature of the latency spikes and the lack of correlation with request count suggest that the root cause may be a specific process or internal instance activity. Detailed monitoring allows for more precise analysis of CPU usage patterns, helping to isolate the cause. Option A is incorrect because increasing instance size only masks the symptom without addressing the underlying issue. Option C is incorrect because scaling policies respond to sustained high CPU utilization, not intermittent spikes, and would not help identify the root cause. Option D is incorrect because CloudTrail logs API calls and does not provide instance-level metric data needed to diagnose CPU spikes.

Answer

Increase the instance size to handle the load.

Answer

Add a scaling policy based on CPU utilization.

Answer

Enable AWS CloudTrail to log EC2 API calls.

Question 5

A company wants to allow developers to manage their own resources in individual AWS accounts while the central IT team manages networking and security. Which AWS service can help enforce that developers cannot modify networking resources?

Accepted Answer

Use AWS Organizations Service Control Policies (SCPs) to deny networking actions for developer accounts.. AWS Organizations Service Control Policies (SCPs) allow the central IT team to define a permission guardrail that explicitly denies actions on networking resources (e.g., ec2:CreateVpc, ec2:DeleteSubnet) for developer accounts. SCPs are applied at the account or organizational unit level and cannot be overridden by any IAM policy within the account, ensuring developers cannot modify networking resources even if they have full administrative access.

Answer

Use IAM roles to grant developers access only to their own resources.

Answer

Use AWS Config rules to detect changes to networking resources.

Answer

Use resource tags to identify networking resources and apply IAM conditions.

Question 6

A media company runs a video processing pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The first Lambda function downloads a video file from an S3 bucket, the second transcodes it using AWS Elemental MediaConvert, and the third uploads the transcoded files to a different S3 bucket. Recently, the pipeline has been failing intermittently with 'State machine execution timed out' errors. The Step Functions execution history shows that the first Lambda function takes up to 25 minutes to complete for large video files. The Step Functions state machine has a default execution timeout of 5 minutes. The company wants to fix the timeout issue without redesigning the entire pipeline. Which solution should the solutions architect recommend?

Accepted Answer

Replace the Lambda function with an Amazon SQS queue and have the Step Functions wait for a callback.. The Lambda function has a maximum timeout of 15 minutes, so increasing the state machine timeout alone (Option A) does not solve the Lambda function's inability to run for 25 minutes. Replacing the Lambda with an SQS queue allows the long-running task to be processed asynchronously, with Step Functions waiting for a callback, avoiding the Lambda timeout limit and the state machine timeout error. Options B and C are invalid because Lambda cannot be configured beyond 15 minutes: setting it to 30 or 15 minutes still fails for a 25-minute task. Option D changes only the problematic component, meeting the requirement to fix the issue without redesigning the entire pipeline.

Answer

Increase the 'timeoutSeconds' value in the Step Functions state machine definition to 1800 (30 minutes) or more.

Answer

Increase the Lambda function timeout to 30 minutes in the Lambda configuration.

Answer

Increase the Lambda function timeout to 15 minutes and increase the state machine execution timeout to 30 minutes.

Question 7

Refer to the exhibit. A solutions architect is reviewing this SCP. What is the effect of this SCP when attached to an organizational unit (OU)?

Accepted Answer

It denies all actions if the request is not made over HTTPS.. This SCP denies all actions if the request is not made over HTTPS, effectively enforcing encrypted transport. Option A is correct because it accurately describes this effect. Option B is incorrect because the SCP does not require MFA; it requires HTTPS. Option C is incorrect because the SCP does not restrict IP addresses; it restricts unencrypted requests. Option D is incorrect because the SCP denies non-HTTPS requests, not allows all HTTPS requests.

Answer

It denies all actions if the request does not include multi-factor authentication.

Answer

It denies all actions from IP addresses outside the corporate network.

Answer

It allows all actions as long as the request is made over HTTPS.

Question 8

A company is designing a new application that will process streaming data from IoT devices. The data must be processed in real time and then stored in Amazon S3 for long-term analytics. Which combination of AWS services should be used?

Accepted Answer

Amazon Kinesis Data Streams, AWS Lambda, Amazon S3. Amazon Kinesis Data Streams ingests and buffers streaming IoT data in real time, AWS Lambda processes each record as it arrives, and the processed data is written directly to Amazon S3 for durable long-term analytics. This combination provides the low-latency, serverless pipeline required for real-time processing and S3-based storage.

Answer

Amazon Kinesis Data Firehose, Amazon Redshift

Answer

Amazon SQS, AWS Lambda, Amazon RDS

Answer

AWS IoT Core, Amazon DynamoDB

Question 9

A company uses AWS Organizations with a multi-account setup. The central IT team manages a shared services VPC in the network account, which hosts a NAT gateway, a VPN connection to the on-premises network, and a transit gateway. Several application accounts have VPCs attached to the transit gateway. Recently, the application teams report that they cannot reach the on-premises network through the VPN. The network team confirms that the VPN is up and routes are propagated in the transit gateway route tables. However, the application VPCs are not receiving the routes. What is the MOST likely cause?

Accepted Answer

The transit gateway route tables are not associated with the application VPC attachments.. The most likely cause is that the transit gateway route tables are not associated with the application VPC attachments. Even if the VPN routes are propagated into the transit gateway route tables, the application VPCs will not receive those routes unless their VPC attachments are explicitly associated with the correct transit gateway route table. Without this association, the transit gateway does not propagate routes to the attached VPCs, leaving them unable to reach the on-premises network.

Answer

The application VPCs have route tables that override the transit gateway routes with local routes.

Answer

The VPN connection is not configured to advertise the on-premises CIDR to the transit gateway.

Answer

The application VPCs have security groups that block traffic to the on-premises network.

Question 10

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster to cache frequently accessed data.. Options A, C, and E are correct. Amazon ElastiCache reduces database load by caching frequently accessed data. Read replicas offload read traffic from the primary database. RDS Proxy helps manage database connections and reduce load on the database. Option B (Multi-AZ) provides high availability and automatic failover but does not improve read scalability. Option D (database sharding) requires application modifications and is not the recommended approach for read scalability without modifying the application.

Answer

Deploy a Multi-AZ RDS instance for automatic failover.

Answer

Implement database sharding by splitting the data across multiple RDS instances.

Question 11

A company is migrating a legacy batch processing system to AWS. The batch jobs run on a schedule and process files from an FTP server. The company wants a serverless solution. Which THREE AWS services should be combined to implement the solution?

Accepted Answer

Amazon EventBridge (CloudWatch Events). Options A, C, and D are correct. Amazon EventBridge (formerly CloudWatch Events) can schedule events to trigger AWS Lambda functions. Lambda can process the batch files. Amazon S3 can store the files. Option B (EC2 with Auto Scaling) is not serverless. Option E (Simple Workflow Service) is an older workflow service not optimized for this serverless batch processing scenario.

Answer

Amazon EC2 with Auto Scaling

Answer

Amazon Simple Workflow Service (SWF)

Question 12

A company uses AWS Organizations and wants to delegate administrative tasks for specific AWS services to a member account. Which AWS feature should be used?

Accepted Answer

Delegated administrator for AWS services. Delegated administrator for AWS services allows you to designate a member account in AWS Organizations to perform administrative tasks for specific AWS services, such as AWS IAM Access Analyzer or AWS Security Hub, without granting full organization management access. This feature centralizes control while distributing operational responsibilities, making it the correct choice for delegating administrative tasks for specific services.

Answer

AWS Control Tower

Answer

Cross-account IAM roles

Answer

AWS CloudTrail organization trail

Question 13

A company wants to migrate 500 TB of data from an on-premises data center to Amazon S3. The company has a 1 Gbps dedicated network connection to AWS. What is the most cost-effective and time-efficient migration method?

Accepted Answer

Use AWS Snowball Edge to physically ship the data to AWS.. AWS Snowball Edge is the most cost-effective and time-efficient method for migrating 500 TB of data over a 1 Gbps dedicated connection. At 1 Gbps, the theoretical maximum transfer time for 500 TB is over 46 days, not accounting for overhead and network issues. Snowball Edge physically ships the data, avoiding network transfer delays. Option B is wrong because S3 Transfer Acceleration still uses the network and does not reduce the transfer time sufficiently for 500 TB. Option C is wrong because AWS DataSync is optimized for smaller, ongoing transfers and would still be limited by the 1 Gbps link. Option D is wrong because Direct Connect provides a dedicated network connection but still requires transferring data over the network, which would take many days.

Answer

Use S3 Transfer Acceleration to upload data over the existing internet connection.

Answer

Use AWS DataSync to transfer data over the dedicated network.

Answer

Establish an AWS Direct Connect connection and use S3 multipart upload.

Question 14

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

Accepted Answer

The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.. The pattern of errors occurring exactly at 00:10, 00:30, and 00:50 (20-minute intervals) indicates that the Lambda function is timing out after processing for a long duration, and the SQS visibility timeout is set to 20 minutes. When the function times out, the message becomes visible again in the queue after the visibility timeout, leading to a retry. This results in errors at regular intervals. Option A is incorrect because memory exhaustion would cause out-of-memory errors, not timeouts. Option C is incorrect because hitting reserved concurrency would cause throttles (e.g., 429 errors), not function errors. Option D is incorrect because an incompatible runtime would cause all invocations to fail immediately, not in a pattern.

Answer

The Lambda function is running out of memory.

Answer

The Lambda function is hitting the reserved concurrency limit.

Answer

The Lambda function is using an incompatible runtime.

Question 15

A company wants to deploy a containerized application on AWS. The application requires persistent storage that can be shared across multiple containers running on different EC2 instances. Which AWS service should be used?

Accepted Answer

Amazon EFS. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently on multiple EC2 instances. This makes it the ideal choice for persistent storage that must be shared across containers running on different EC2 instances, as it supports the NFSv4.1 and NFSv4.0 protocols and automatically scales storage capacity as files are added or removed.

Answer

EC2 Instance Store

Answer

Amazon S3

Answer

Amazon EBS

Question 16

A company is using AWS Organizations with consolidated billing. The finance team wants to track costs by project, but projects span multiple accounts. Which approach should be used to tag resources consistently across accounts?

Accepted Answer

Use tag policies in AWS Organizations to enforce required tags on resources.. Tag policies in AWS Organizations allow you to centrally define and enforce required tags across all accounts in the organization. When a tag policy is attached to an OU or account, it ensures that resources are created with the specified tags, and noncompliant resources can be identified. This is the most scalable and consistent approach for tagging resources that span multiple accounts, as it works at the organization level without requiring per-account configuration.

Answer

Define cost allocation tags in the management account and activate them for all accounts.

Answer

Use AWS Config rules to automatically tag resources after creation.

Answer

Use an SCP that denies resource creation if the required tags are not present.

Question 17

A startup is designing a new web application that will be hosted on AWS. The application consists of a static frontend and a backend API. The frontend is built with React and the backend is a RESTful API built with Node.js. The startup expects low traffic initially but wants to be able to scale to millions of users. The team wants to minimize operational overhead and cost. Which architecture should they use?

Accepted Answer

Host the frontend on Amazon S3 with static website hosting and the backend as AWS Lambda functions behind Amazon API Gateway.. S3 for static hosting and API Gateway with Lambda provides a serverless, scalable solution with low overhead. Option A is wrong because EC2 requires management. Option C is wrong because Lightsail has limited scalability. Option D is wrong because Elastic Beanstalk has more overhead than serverless.

Answer

Host the frontend and backend on a single EC2 instance using Amazon Lightsail.

Answer

Host the frontend on EC2 instances behind an ALB and the backend on EC2 instances behind another ALB.

Answer

Host the frontend on S3 and the backend on Amazon Elastic Beanstalk with a load balancer.

Question 18

A company is building a serverless data processing pipeline. Data is uploaded to an S3 bucket, which triggers a Lambda function to transform the data and store the result in another S3 bucket. The Lambda function needs to access a VPC-hosted database for enrichment. What is the MOST secure way to allow the Lambda function to access the VPC resources?

Accepted Answer

Configure the Lambda function to access the VPC and use a VPC endpoint for S3.. It allows the Lambda function to be attached to a VPC, enabling it to access the VPC-hosted database securely over private IP addresses. Additionally, using a VPC endpoint for S3 ensures that data transfer between Lambda and the S3 buckets remains within the AWS network, avoiding public internet exposure and reducing data transfer costs.

Answer

Assign a public IP to the Lambda function and route through an Internet Gateway.

Answer

Use Lambda@Edge to process data at the edge location.

Answer

Place the Lambda function in a public subnet and use a NAT Gateway.

Question 19

A company is planning to migrate its on-premises infrastructure to AWS. The company wants to assess the current environment and create a migration plan. Which TWO AWS services should be used for discovery and assessment?

Accepted Answer

AWS Migration Hub. For discovery and assessment of on-premises infrastructure, AWS Application Discovery Service (Option D) automatically discovers servers and application dependencies, while AWS Migration Hub (Option B) provides a centralized view to track migrations and integrates with discovery data. AWS Server Migration Service (Option A) is a replication tool for migrating servers, not a discovery service, and it has been deprecated. Amazon CloudWatch (Option C) is a monitoring service, and AWS Trusted Advisor (Option E) provides best practice recommendations; neither performs discovery.

Answer

AWS Server Migration Service (SMS)

Answer

Amazon CloudWatch

Answer

AWS Trusted Advisor

Question 20

A company has a multi-account environment with AWS Organizations. The security team wants to enforce that all EC2 instances launched in any account must have a specific tag key 'CostCenter'. Which approach should be used?

Accepted Answer

Use a Service Control Policy (SCP) that denies ec2:RunInstances unless the request includes the required tag.. A Service Control Policy (SCP) applied at the AWS Organizations root or OU level can centrally deny the ec2:RunInstances action unless the request includes the required 'CostCenter' tag. This enforces the tagging requirement across all accounts in the organization without needing per-account IAM policies, and it cannot be overridden by account administrators.

Answer

Create an IAM policy in each account that requires the tag for ec2:RunInstances.

Answer

Use AWS Config rules to detect untagged instances and trigger an AWS Lambda function to tag them.

Answer

Configure the EC2 service to automatically add the tag to all instances.