SAP-C02 Mock Exam 91 — 25 Questions

Question 1

A company is designing a data lake solution on Amazon S3. Data is ingested from multiple sources and stored in a raw bucket. The data must be processed and transformed before being moved to a curated bucket. The processing logic is complex and includes conditional transformations. Which service should be used to orchestrate the transformation pipeline?

Accepted Answer

AWS Step Functions. AWS Step Functions is the correct choice because it is designed to orchestrate complex, multi-step workflows with conditional branching, retries, and error handling. It can coordinate AWS Lambda functions, AWS Glue jobs, and other services to process and transform data from a raw S3 bucket to a curated bucket, making it ideal for a transformation pipeline with complex logic.

Answer

AWS Data Pipeline

Answer

AWS Lambda functions

Answer

AWS Glue ETL jobs

Question 2

A company is designing a new data lake on Amazon S3. They need to query the data using standard SQL and expect to run complex queries that scan large datasets. The query performance should be optimized to minimize data scanned. Which service should they use?

Accepted Answer

Amazon Athena. Amazon Athena is a serverless interactive query service that uses standard SQL to analyze data directly in Amazon S3. It is optimized for querying large datasets with a pay-per-query model, and it automatically minimizes data scanned by leveraging features like columnar data formats (Parquet, ORC), partitioning, and compression to reduce the amount of data read per query.

Answer

Amazon Redshift Spectrum

Answer

Amazon EMR

Answer

Amazon QuickSight

Question 3

A company is deploying a web application on AWS Elastic Beanstalk. The application must be accessible over HTTPS only and must automatically redirect HTTP requests to HTTPS. The SSL/TLS certificate is provided by AWS Certificate Manager (ACM). How should this be configured?

Accepted Answer

Configure the environment’s load balancer to listen on port 443 with the ACM certificate and port 80 with a redirect rule.. Option C is correct because Elastic Beanstalk environments using a load balancer (ALB or CLB) can be configured to listen on port 443 with the ACM certificate for HTTPS termination, and simultaneously define a listener on port 80 with a redirect action that sends HTTP traffic to HTTPS. This is the simplest and most scalable approach, as it offloads SSL termination and redirection to the load balancer, eliminating the need to manage certificates or redirection logic on individual instances.

Answer

Use a NAT instance to perform SSL termination and redirect.

Answer

Install the certificate on each EC2 instance and configure the web server to redirect HTTP to HTTPS.

Answer

Deploy a CloudFront distribution with the ACM certificate and redirect HTTP to HTTPS at the distribution level.

Question 4

A company is designing a CI/CD pipeline for a containerized application using AWS CodePipeline. The application is deployed to Amazon ECS with Fargate. The pipeline must automatically build and test code changes before deploying to production. Which service should be used to build and test the Docker images?

Accepted Answer

AWS CodeBuild. AWS CodeBuild is the correct service because it is a fully managed continuous integration service that compiles source code, runs tests, and produces software packages that are ready to deploy. In this scenario, CodeBuild can build the Docker image from a Dockerfile, run unit or integration tests inside the build environment, and then push the image to Amazon ECR, all within the CI/CD pipeline defined in AWS CodePipeline.

Answer

AWS CodeDeploy

Answer

Amazon ECR

Answer

AWS CodeCommit

Question 5

A company is designing a disaster recovery solution for a critical application running on EC2 with data in an Amazon RDS MySQL Multi-AZ DB instance. The recovery time objective (RTO) is 15 minutes and recovery point objective (RPO) is 1 hour. Which strategy meets these requirements?

Accepted Answer

Create a cross-Region read replica of the RDS DB instance.. Option B is correct because a cross-Region read replica of an Amazon RDS MySQL DB instance provides asynchronous replication with a typical replication lag of seconds to minutes, meeting the RPO of 1 hour and RTO of 15 minutes by promoting the replica to a standalone instance in the event of a disaster. This approach minimizes data loss and allows rapid failover without relying on snapshot restoration or backup copying.

Answer

Enable Multi-AZ in a different Region.

Answer

Take daily snapshots of the RDS DB instance and copy them to another Region.

Answer

Use Amazon S3 cross-Region replication for database backups.

Question 6

A company is building a high-performance computing (HPC) cluster on AWS for genomics research. The compute nodes require low-latency inter-node communication. Which networking solution should be used?

Accepted Answer

Elastic Fabric Adapter (EFA). Elastic Fabric Adapter (EFA) is a network interface that enables HPC and machine learning applications to achieve low-latency inter-node communication by bypassing the operating system kernel and providing OS-bypass capabilities via the Libfabric library. This is essential for tightly coupled HPC workloads like genomics research, where MPI (Message Passing Interface) jobs require microsecond-level latency and high throughput between compute nodes.

Answer

Enhanced Networking (ENA)

Answer

VPC Peering

Answer

AWS Direct Connect

Question 7

A company wants to implement a serverless data processing pipeline on AWS. The pipeline reads CSV files from Amazon S3, transforms the data, and loads it into Amazon Redshift. Which THREE AWS services should be used to build this pipeline?

Accepted Answer

AWS Lambda. AWS Lambda is correct because it can be triggered by S3 events when a CSV file is uploaded, and it can execute lightweight data transformation logic (e.g., parsing CSV rows, filtering, or converting formats) before loading the data into Amazon Redshift. Lambda is serverless, scales automatically, and integrates natively with S3 and Redshift via the AWS SDK, making it ideal for event-driven, short-running transformations in a serverless pipeline.

Answer

AWS Database Migration Service (DMS)

Answer

Amazon EC2

Question 8

A company is migrating a legacy application to AWS. The application consists of several components that communicate via TCP. The solutions architect must design a solution that minimizes operational overhead and provides high availability. Which TWO strategies should be used?

Accepted Answer

Use managed services like Amazon RDS and Amazon ElastiCache to reduce operational overhead.. Option B is correct because using managed services like Amazon RDS and Amazon ElastiCache offloads administrative tasks such as patching, backups, and replication setup, significantly reducing operational overhead. Option E is correct because an Application Load Balancer (ALB) distributes incoming TCP traffic across multiple EC2 instances in different Availability Zones, providing high availability and fault tolerance for the application components.

Answer

Use instance store volumes for data persistence.

Answer

Use Spot Instances for all compute resources.

Answer

Use VPC Peering to connect components.

Question 9

A company is designing a new disaster recovery solution for a critical application running on Amazon EC2. They need to replicate data across AWS Regions with a Recovery Point Objective (RPO) of 15 minutes and a Recovery Time Objective (RTO) of 1 hour. Which THREE actions should they take to meet these objectives?

Accepted Answer

Create a CloudFormation template to provision the infrastructure in the secondary region. Option B is correct because AWS CloudFormation templates enable infrastructure-as-code, allowing rapid and consistent provisioning of the secondary region environment. This automation is essential to meet the 1-hour RTO, as it eliminates manual setup and reduces recovery time to minutes by deploying pre-defined stacks.

Answer

Manually create and copy AMIs to the secondary region weekly

Answer

Configure the EC2 instances in a Multi-AZ Auto Scaling group

Question 10

A company is deploying a containerized application on Amazon EKS. The application requires persistent storage that can be shared across multiple pods in different Availability Zones. Which TWO storage solutions meet this requirement? (Choose TWO.)

Accepted Answer

Amazon FSx for Lustre. Amazon EFS provides a fully managed, scalable, and elastic NFS file system that can be mounted concurrently by multiple Amazon EKS pods across different Availability Zones, making it suitable for shared persistent storage. Amazon FSx for Lustre is a high-performance file system optimized for workloads like machine learning and HPC, and it supports concurrent access from multiple clients across AZs, meeting the requirement for shared storage.

Answer

Amazon EBS with io2 volumes

Answer

Amazon S3

Answer

Amazon EC2 Instance Store

Question 11

A company is deploying a containerized application on Amazon ECS with Fargate. The application needs to be accessible from the internet and must be secured with an AWS WAF. Which TWO steps should be taken to achieve this?

Accepted Answer

Associate the ALB with an AWS WAF web ACL.. Option A is correct because AWS WAF can be associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS traffic at the application layer. This allows you to protect the containerized application from common web exploits like SQL injection or cross-site scripting. Option B is correct because an ALB is required to route internet traffic to the ECS Fargate service and to terminate TLS, which is necessary for WAF to inspect the request payload.

Answer

Use a Network Load Balancer in front of the ECS service.

Answer

Assign public IP addresses to the Fargate tasks.

Answer

Use Amazon CloudFront as a CDN.

Question 12

A company wants to implement a serverless architecture where an AWS Lambda function is triggered whenever a new object is uploaded to an S3 bucket. Which S3 feature should they use?

Accepted Answer

S3 Event Notifications. S3 Event Notifications allow you to configure S3 to publish events (e.g., s3:ObjectCreated:Put) to AWS Lambda, SQS, or SNS whenever an object is uploaded. This is the native serverless integration that triggers a Lambda function directly from S3 without polling or custom code.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Question 13

A company is designing a multi-tier web application that must be fault-tolerant and scalable. The application uses an Application Load Balancer (ALB) to distribute traffic to EC2 instances in an Auto Scaling group. The instances run a web server and a backend application. Which TWO steps should be taken to ensure the application can scale without data loss?

Accepted Answer

Store session state in an external data store such as ElastiCache.. Option B is correct because storing session state in an external data store like ElastiCache decouples session data from individual EC2 instances. This ensures that if an instance is terminated or replaced during scaling events, the session data persists and can be served by any other instance in the Auto Scaling group, preventing data loss and maintaining user experience.

Answer

Use instance store volumes for temporary data.

Answer

Use a custom CloudWatch metric to scale based on CPU utilization.

Answer

Use a fixed number of EC2 instances instead of Auto Scaling.

Question 14

A Solutions Architect is reviewing the IAM policy shown in the exhibit. The policy is attached to an IAM user. Which of the following is true about this policy?

Accepted Answer

The policy allows s3:GetObject on example-bucket only from the specified IP range.. Option A is correct because the IAM policy uses a `Condition` block with `IpAddress` to restrict the `s3:GetObject` action on `example-bucket` to requests originating from the specified IP range. The `Effect` is `Allow`, so the policy grants the `s3:GetObject` permission only when the source IP matches the condition, effectively limiting access to that range.

Answer

The policy denies access if the source IP is not in the specified range.

Answer

The policy is invalid because the Resource is not specific enough.

Answer

The policy allows all S3 actions on all buckets.

Question 15

A company is designing a new VPC for a web application that must be accessible from the internet. The application will run on EC2 instances in private subnets. Which TWO components are required to allow the EC2 instances to access the internet for updates?

Accepted Answer

A route table in the private subnet with a default route pointing to the NAT Gateway. Option A is correct because a route table in the private subnet with a default route (0.0.0.0/0) pointing to a NAT Gateway is required to direct outbound internet traffic from the EC2 instances to the NAT Gateway. The NAT Gateway then forwards this traffic to the Internet Gateway, enabling the instances to download updates while remaining inaccessible from the internet.

Answer

An Internet Gateway attached to the VPC

Answer

VPC Flow Logs

Answer

A virtual private gateway

Question 16

A company is designing a new application that will run on Amazon ECS with Fargate. The application needs to output logs to CloudWatch Logs. Which configuration should be used to send logs from the container to CloudWatch?

Accepted Answer

Use the awslogs log driver in the task definition and specify the log group.. The awslogs log driver is the native, built-in mechanism for Amazon ECS tasks using the Fargate launch type to send container logs directly to CloudWatch Logs. By specifying the 'awslogs' log driver in the task definition and providing the log group name, ECS automatically streams stdout and stderr from the container to the specified CloudWatch log group without requiring any additional agents or infrastructure.

Answer

Install and configure the CloudWatch agent in the container image.

Answer

Output logs to stdout/stderr and use a Lambda function to push them.

Answer

Configure a sidecar container running the CloudWatch agent.

Question 17

A company is designing a new hybrid cloud architecture that extends on-premises storage to AWS. The solution must provide low-latency access to frequently accessed data and use AWS storage for backup. Which TWO services should be used together?

Accepted Answer

AWS Storage Gateway (File Gateway). AWS Storage Gateway (File Gateway) provides a low-latency, on-premises cache for frequently accessed data while asynchronously uploading the underlying data to Amazon S3 for durable backup. This hybrid architecture allows applications to access data with local file-system performance while leveraging S3 as the backup target, meeting both the low-latency and backup requirements.

Answer

Amazon EFS

Answer

AWS Snowball Edge

Answer

AWS Direct Connect

Question 18

A company is designing a new CI/CD pipeline for a containerized application. They want to automatically build, test, and deploy the application to Amazon EKS. Which THREE AWS services should they use to implement this pipeline?

Accepted Answer

AWS CodePipeline. AWS CodePipeline is correct because it orchestrates the CI/CD workflow by integrating with other AWS services to automate the build, test, and deployment stages. For a containerized application on Amazon EKS, CodePipeline can pull source code from CodeCommit, trigger CodeBuild to build and test the Docker image, and then deploy the image to an EKS cluster using a deployment action or a custom action. This provides a fully managed, continuous delivery pipeline that automates the entire release process.

Answer

AWS CloudFormation

Answer

AWS CodeDeploy

Question 19

A company is building a serverless application using AWS Lambda and Amazon API Gateway. They need to authenticate users. Which TWO services can be used for authentication?

Accepted Answer

AWS IAM. AWS IAM is correct because it can be used to authenticate users by attaching IAM authorization to API Gateway, allowing the API to verify the caller's identity via AWS Signature Version 4 signing. This is commonly used for machine-to-machine or internal service calls where the caller has AWS credentials.

Answer

AWS Security Token Service

Answer

Amazon SQS

Answer

Amazon CloudFront

Question 20

A company is designing a new microservices architecture on AWS. They need to ensure that services can communicate asynchronously without tight coupling. Which AWS service should they use to decouple the services while providing durable message storage?

Accepted Answer

Amazon SQS. Amazon SQS (Simple Queue Service) is the correct choice because it provides a fully managed message queue that enables asynchronous communication between microservices, decoupling them so that producers and consumers operate independently. SQS offers durable message storage by persisting messages across multiple Availability Zones, ensuring messages are not lost even if a consumer fails. This aligns with the requirement for loose coupling and reliable message delivery.

Answer

Amazon SNS

Answer

Amazon EventBridge

Answer

Amazon Kinesis Data Streams