SAP-C02 Continuous Improvement for Existing Solutions — 10 Questions

Question 1

Match each AWS monitoring and logging service to its capability.

Accepted Answer

CloudWatch: Monitor and manage metrics, logs, and alarms. CloudWatch provides observability via metrics and logs (correct). GuardDuty detects threats with ML (correct). CloudTrail records API activity for auditing, not resource configuration changes, so B is incorrect. AWS Config tracks resource configuration changes, not API activity, so C is incorrect.

Answer

CloudTrail: Evaluate and track resource configuration changes

Answer

AWS Config: Record API activity for auditing and compliance

Question 2

A company uses Amazon ElastiCache for Redis to cache frequently accessed data. The cache cluster is a single node (cache.r5.large). Over time, the cache hit ratio has decreased, and the CPU utilization is consistently above 80%. What should a solutions architect do to improve performance?

Accepted Answer

Enable cluster mode and distribute the cache across multiple shards.. Enabling cluster mode distributes data across multiple shards, reducing CPU load on individual nodes and improving the cache hit ratio by allowing more efficient use of memory and processing. Option A is incorrect because reducing TTL would cause more cache misses, further degrading the hit ratio. Option B is incorrect because read replicas offload read traffic but do not reduce CPU utilization caused by high write activity or data management. Option C is incorrect because scaling up to a larger node type provides more resources but does not address the architectural limitation of a single node; the increased CPU utilization is due to the single node being overwhelmed, not just resource capacity.

Answer

Reduce the Time-to-Live (TTL) of cached objects.

Answer

Add a read replica to offload read traffic.

Answer

Scale up to a larger node type, such as cache.r5.xlarge.

Question 3

A company uses Amazon S3 to store critical data. They need to ensure that data is automatically replicated to another AWS Region for disaster recovery. Which configuration meets this requirement with minimal operational overhead?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) on the source bucket.. S3 Cross-Region Replication (CRR) automatically replicates objects to a destination bucket in a different AWS Region, providing disaster recovery with minimal operational overhead. Option A is wrong because S3 Versioning alone does not replicate data. Option B is wrong because S3 Transfer Acceleration speeds up uploads but does not replicate data. Option C is wrong because S3 Lifecycle policies manage storage tiers, not replication.

Answer

Enable S3 Versioning on the source bucket.

Answer

Use S3 Transfer Acceleration to upload objects to both Regions.

Answer

Configure an S3 Lifecycle policy to transition objects to S3 Glacier.

Question 4

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an S3 bucket. The ECS task role has the necessary S3 permissions. However, the application is unable to upload files to S3. What is the MOST likely cause?

Accepted Answer

The task definition does not specify the correct task role ARN. For an ECS Fargate task to access S3, the task role with the necessary permissions must be specified in the task definition. If the task role ARN is incorrect or missing, the container will not be able to assume the role, causing S3 access failures. Option A is wrong because the task execution role is used only by the ECS agent to pull container images and send logs, not for application-level S3 access. Option B is wrong because the question states that the task role already has the required S3 permissions, so the bucket policy is likely not the issue. Option C is wrong because an S3 VPC endpoint is not required if the task can reach S3 through the internet or a NAT gateway; its absence would not prevent uploads if proper routing exists.

Answer

The Task execution role is missing S3 permissions

Answer

The S3 bucket policy denies access to the task role

Answer

The VPC does not have an S3 VPC endpoint

Question 5

A company applies the above IAM policy to an IAM user. The user attempts to upload an object to my-bucket using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/. What is the outcome?

Accepted Answer

The upload fails with an access denied error because the Deny statement with StringNotEquals blocks the request.. The Deny statement with StringNotEquals on s3:x-amz-server-side-encryption denies any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not include any encryption header, the Deny condition matches and the request is denied. Option A is incorrect because evaluation order does not matter; an explicit Deny always overrides an Allow. Option C is incorrect because the Allow statement requires encryption, which is not provided. Option D is incorrect because the Deny statement applies precisely when no encryption header is present.

Answer

The upload fails with an access denied error because the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement matches.

Answer

The upload succeeds because the Deny statement does not apply when no encryption header is present.

Question 6

A company is designing a disaster recovery strategy for a multi-tier application hosted on AWS. The application uses Amazon RDS for MySQL with Multi-AZ deployment. The Recovery Time Objective (RTO) is 15 minutes and Recovery Point Objective (RPO) is 1 hour. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Configure a Cross-Region Read Replica of the RDS instance and promote it during disaster.. Configuring a Cross-Region Read Replica for RDS MySQL provides continuous replication with an RPO of seconds and failover can be accomplished in minutes by promoting the replica, meeting the 15-minute RTO and 1-hour RPO with minimal operational overhead. Option B is incorrect because AWS DMS adds complexity and overhead, and while it can replicate data, it is not as tightly integrated or automated as RDS Read Replicas. Option C is incorrect because restoring from hourly snapshots cannot achieve an RPO of 1 hour (it matches at best) and restore times typically exceed 15 minutes due to volume size, resulting in higher RTO. Option D is incorrect because Multi-AZ is designed for high availability within a single region, not for disaster recovery across regions; it does not provide cross-region failover capability.

Answer

Use AWS Database Migration Service (DMS) to continuously replicate data to a standby RDS instance in another region.

Answer

Take automated snapshots every hour and copy them to another region. Restore from snapshot during disaster.

Answer

Use RDS Multi-AZ in a different region.

Question 7

A company runs a batch processing job on Amazon EC2 instances that are part of an Auto Scaling group. The job runs every night and takes approximately 2 hours. The instances are launched using a launch template with a Spot Instance request. Recently, the job has been failing because Spot Instances are being reclaimed before the job completes. The company wants a cost-effective solution that ensures the job completes reliably. The job can handle interruptions by checkpointing. Which solution should the company implement?

Accepted Answer

Use a mixed instances policy with a percentage of On-Demand Instances as a fallback.. The job uses checkpointing, so Spot Instances are suitable but risk premature termination. A mixed instances policy with a percentage of On-Demand Instances ensures reliability by providing a fallback when Spot capacity is reclaimed, without incurring the full cost of On-Demand-only or Reserved Instances.

Answer

Increase the instance size to complete the job faster.

Answer

Switch to On-Demand Instances only.

Answer

Use Reserved Instances for the batch job.

Question 8

A media company uses AWS CloudFront to distribute video content. They notice that some users in Europe experience high latency. CloudFront metrics show low cache hit ratios for European edge locations. The origin is an S3 bucket in us-east-1. What is the MOST effective optimization?

Accepted Answer

Add a second origin in eu-west-1 and configure origin groups with failover.. Configuring origin groups with a primary origin in us-east-1 and a secondary origin in eu-west-1 allows CloudFront to serve content from the closer origin for European users, reducing latency and improving cache hit ratios. Option A (Increase default TTL) would keep objects in cache longer but does not address the root cause of low cache hit ratios in European edge locations due to the distant origin. Option B (Add additional cache behaviors) allows different caching rules but does not reduce geographic latency. Option D (Enable S3 Transfer Acceleration) speeds up uploads to S3, not downloads or CloudFront delivery.

Answer

Increase the default TTL for objects in CloudFront.

Answer

Add additional cache behaviors for different file types.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 9

A healthcare company runs a HIPAA-compliant web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS for PostgreSQL database with Multi-AZ. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The current setup uses an SSL certificate on the ALB to terminate HTTPS, but traffic between the ALB and EC2 instances is over HTTP. The company wants to enforce end-to-end encryption without changing the application code. Which solution meets these requirements?

Accepted Answer

Configure the ALB to use a TLS listener and forward traffic to the target group using the TCP protocol on port 443.. By configuring the ALB with a TLS listener (HTTPS) and forwarding traffic to the target group using the HTTPS protocol on port 443, the traffic between ALB and EC2 instances is encrypted. This provides end-to-end encryption without changing application code, as the instances only need a valid certificate and web server configuration for HTTPS (which is a configuration change, not code).

Option A is incorrect because an NLB with a TLS listener terminates TLS at the NLB and forwards unencrypted traffic to targets via TCP, breaking end-to-end encryption. Health checks over HTTPS would require instances to handle HTTPS, which may need application changes.

Option C is incorrect because AWS Certificate Manager (ACM) does not accept self-signed certificates for trust; it requires certificates signed by a trusted certificate authority.

Option D is incorrect because traffic between CloudFront and ALB remains unencrypted (HTTP), and ALB to instances is also HTTP, so end-to-end encryption is not achieved.

Answer

Replace the ALB with a Network Load Balancer, configure a TLS listener, and use target group health checks over HTTPS.

Answer

Install a self-signed certificate on each EC2 instance, configure the ALB target group to use HTTPS, and upload the self-signed certificate to AWS Certificate Manager (ACM) for the ALB to trust.

Answer

Place AWS CloudFront in front of the ALB and configure CloudFront to use TLS 1.2, with the ALB still using HTTP.

Question 10

Refer to the exhibit.

$ aws ec2 describe-instances --region us-east-1 --filters Name=tag:Name,Values=WebServer --query 'Reservations[].Instances[].{ID:InstanceId,State:State.Name,Type:InstanceType,LaunchTime:LaunchTime}' --output table

A DevOps engineer runs the above command. The Auto Scaling group for WebServer instances has a desired count of 3, but the engineer notices that there are 5 instances with the same tag. What is the MOST likely cause?

Accepted Answer

The command is filtering by the wrong tag key.. The command filters by tag:Name=WebServer, but if the engineer notices 5 instances with the same tag, it indicates that the tag key used in the filter might be incorrect. For example, if some instances have the tag 'Name' incorrectly capitalized or a different tag key, they would not be matched by the filter. However, the engineer sees 5 instances, meaning the filter returns those 5, but the ASG desired count is 3. The most likely explanation is that the filter is matching instances that are not part of the ASG because they have a different tag key that coincidentally matches the filter. Option C is incorrect because instances in 'terminating' state are still returned by the describe-instances command, so they would appear in the output. Options A and D are less likely: cooldown does not prevent termination, and instances launched with a different launch template could still have the same tag.

Answer

The Auto Scaling group has a cooldown period that prevents immediate termination.

Answer

The other two instances are in a 'terminating' state and are not returned by the command.

Answer

The instances were launched with a different launch template that does not have the tag.