SAP-C02 Continuous Improvement for Existing Solutions — 10 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.. An S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Answer

Enable default encryption on each bucket using SSE-S3.

Answer

Require that all buckets use AWS KMS managed keys for encryption.

Answer

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because an AWS Config rule (e.g., the managed rule s3-bucket-server-side-encryption-enabled) continuously evaluates S3 buckets across all accounts in the organization for default encryption and can trigger automatic remediation via SSM Automation documents, providing detective and corrective enforcement. Option B is correct because an SCP applied at the organization or OU level sets the maximum permissions for member accounts, and denying s3:PutObject unless the x-amz-server-side-encryption header is present forces every upload to be encrypted in transit to S3, giving preventive enforcement across the organization. Option C is not correct because GuardDuty is a threat-detection service that identifies suspicious activity and anomalous S3 access patterns, but it cannot enforce encryption at rest. Option D is not correct because an IAM role merely grants permissions; it does not require or enforce that buckets be encrypted, and assigning it to all users does not guarantee encryption. Option E is not correct because CloudTrail only records S3 API activity for auditing, not enforcement of encryption settings.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 3

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. A scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 4

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

Accepted Answer

Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.. Adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Answer

Increase the ALB idle timeout to 120 seconds.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Reduce the target tracking scaling threshold to 50% average CPU.

Question 5

A company is running a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences increased latency during peak hours. Upon investigation, the CPU utilization of the tasks reaches 90%. The ECS service is configured with a target tracking scaling policy based on average CPU at 70%. However, scaling is not keeping up with demand. What should a solutions architect do to improve the responsiveness of the scaling?

Accepted Answer

Add a step scaling policy that adds 4 tasks when CPU exceeds 80% for 1 minute.. Adding a step scaling policy provides a more aggressive and immediate scaling response when CPU exceeds 80% for 1 minute, which complements the existing target tracking policy. Target tracking scaling policies are reactive and may not scale quickly enough during rapid demand spikes, whereas step scaling can add a fixed number of tasks instantly when a breach occurs, reducing latency during peak hours.

Answer

Increase the task-level CPU limit to 2048 units.

Answer

Decrease the target tracking value to 50% average CPU.

Answer

Decrease the scale-in cooldown period to 60 seconds.

Question 6

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

Accepted Answer

The user can describe instances but cannot terminate instances in any region.. The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer

The user cannot describe instances or terminate instances.

Answer

The user can terminate instances and describe instances.

Answer

The user can describe instances but cannot terminate any instances.

Question 7

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

Accepted Answer

The command displays the instance ID, instance type, and launch time of three running instances.. The command `aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,InstanceType,LaunchTime]' --output table` filters for running instances and projects only the InstanceId, InstanceType, and LaunchTime fields. The output shows three rows, each representing a running instance with those three attributes. Therefore, option B is correct because it accurately describes the displayed data.

Answer

There are two instances with the Environment=production tag.

Answer

One of the instances is stopped.

Answer

The command lists all instances in the account regardless of tags.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

Accepted Answer

Create RDS read replicas for the DB instance and route read queries from the application to the replicas.. Creating RDS read replicas offloads read queries from the primary DB instance, reducing CPU contention from read-heavy workloads. Since the application reads and writes to the same database, directing read traffic to replicas decreases the primary instance's CPU utilization, directly addressing the 100% CPU spike observed during the load test. This improves database scalability by distributing read operations horizontally without altering write capacity.

Answer

Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.

Answer

Increase the instance size of the RDS DB instance to a larger instance type.

Answer

Enable Multi-AZ for the RDS instance to distribute the load across two instances.

Question 9

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

Accepted Answer

{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}. The CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Answer

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Question 10

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

Accepted Answer

Enable cluster mode for the Redis cluster and add more shards.. Enabling cluster mode for the Redis cluster and adding more shards horizontally partitions the data across multiple nodes, distributing both CPU and memory load. This directly addresses the 100% CPU and high memory utilization during traffic spikes, allowing the cluster to handle more concurrent requests without performance degradation. Cluster mode also provides linear scalability, which is essential for a critical web application experiencing variable traffic.

Answer

Configure ElastiCache Auto Scaling to automatically add nodes when CPU utilization exceeds 75%.

Answer

Enable Multi-AZ replication for the Redis cluster.

Answer

Increase the instance size of the Redis cluster to a larger node type.