SAP-C02 Continuous Improvement for Existing Solutions — 20 Questions

Question 1

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.. An S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Answer

Enable default encryption on each bucket using SSE-S3.

Answer

Require that all buckets use AWS KMS managed keys for encryption.

Answer

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Question 2

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because an AWS Config rule (e.g., the managed rule s3-bucket-server-side-encryption-enabled) continuously evaluates S3 buckets across all accounts in the organization for default encryption and can trigger automatic remediation via SSM Automation documents, providing detective and corrective enforcement. Option B is correct because an SCP applied at the organization or OU level sets the maximum permissions for member accounts, and denying s3:PutObject unless the x-amz-server-side-encryption header is present forces every upload to be encrypted in transit to S3, giving preventive enforcement across the organization. Option C is not correct because GuardDuty is a threat-detection service that identifies suspicious activity and anomalous S3 access patterns, but it cannot enforce encryption at rest. Option D is not correct because an IAM role merely grants permissions; it does not require or enforce that buckets be encrypted, and assigning it to all users does not guarantee encryption. Option E is not correct because CloudTrail only records S3 API activity for auditing, not enforcement of encryption settings.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 3

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. A scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 4

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

Accepted Answer

Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.. Adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Answer

Increase the ALB idle timeout to 120 seconds.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Reduce the target tracking scaling threshold to 50% average CPU.

Question 5

A company is running a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences increased latency during peak hours. Upon investigation, the CPU utilization of the tasks reaches 90%. The ECS service is configured with a target tracking scaling policy based on average CPU at 70%. However, scaling is not keeping up with demand. What should a solutions architect do to improve the responsiveness of the scaling?

Accepted Answer

Add a step scaling policy that adds 4 tasks when CPU exceeds 80% for 1 minute.. Adding a step scaling policy provides a more aggressive and immediate scaling response when CPU exceeds 80% for 1 minute, which complements the existing target tracking policy. Target tracking scaling policies are reactive and may not scale quickly enough during rapid demand spikes, whereas step scaling can add a fixed number of tasks instantly when a breach occurs, reducing latency during peak hours.

Answer

Increase the task-level CPU limit to 2048 units.

Answer

Decrease the target tracking value to 50% average CPU.

Answer

Decrease the scale-in cooldown period to 60 seconds.

Question 6

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

Accepted Answer

The user can describe instances but cannot terminate instances in any region.. The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer

The user cannot describe instances or terminate instances.

Answer

The user can terminate instances and describe instances.

Answer

The user can describe instances but cannot terminate any instances.

Question 7

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

Accepted Answer

The command displays the instance ID, instance type, and launch time of three running instances.. The command `aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,InstanceType,LaunchTime]' --output table` filters for running instances and projects only the InstanceId, InstanceType, and LaunchTime fields. The output shows three rows, each representing a running instance with those three attributes. Therefore, option B is correct because it accurately describes the displayed data.

Answer

There are two instances with the Environment=production tag.

Answer

One of the instances is stopped.

Answer

The command lists all instances in the account regardless of tags.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

Accepted Answer

Create RDS read replicas for the DB instance and route read queries from the application to the replicas.. Creating RDS read replicas offloads read queries from the primary DB instance, reducing CPU contention from read-heavy workloads. Since the application reads and writes to the same database, directing read traffic to replicas decreases the primary instance's CPU utilization, directly addressing the 100% CPU spike observed during the load test. This improves database scalability by distributing read operations horizontally without altering write capacity.

Answer

Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.

Answer

Increase the instance size of the RDS DB instance to a larger instance type.

Answer

Enable Multi-AZ for the RDS instance to distribute the load across two instances.

Question 9

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

Accepted Answer

{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}. The CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Answer

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Question 10

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

Accepted Answer

Enable cluster mode for the Redis cluster and add more shards.. Enabling cluster mode for the Redis cluster and adding more shards horizontally partitions the data across multiple nodes, distributing both CPU and memory load. This directly addresses the 100% CPU and high memory utilization during traffic spikes, allowing the cluster to handle more concurrent requests without performance degradation. Cluster mode also provides linear scalability, which is essential for a critical web application experiencing variable traffic.

Answer

Configure ElastiCache Auto Scaling to automatically add nodes when CPU utilization exceeds 75%.

Answer

Enable Multi-AZ replication for the Redis cluster.

Answer

Increase the instance size of the Redis cluster to a larger node type.

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and EC2 instance status checks. The team needs to identify the root cause of the latency. Which TWO actions should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Set up an Amazon CloudWatch Synthetics canary that follows a step-by-step guide through the application and monitor the step durations.. CloudWatch Synthetics canaries simulate user workflows step by step, and monitoring step durations helps pinpoint which specific part of the application is causing latency spikes. This provides granular, end-to-end visibility into the user experience beyond what aggregate metrics offer. Option D is correct because ALB access logs contain detailed information about each request, including timestamps, processing times, and response times. Analyzing these logs can help identify specific requests that contribute to high latency, such as those with long target response times or backend errors.

Answer

Enable detailed monitoring (1-minute metrics) on the ALB and create a CloudWatch dashboard to view the RequestCount and TargetResponseTime metrics.

Answer

Integrate the application with AWS X-Ray and enable tracing on the EC2 instances to capture trace data for all requests.

Answer

Enable VPC Flow Logs on the subnets where the EC2 instances reside and analyze the logs for packet loss.

Question 12

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application consists of a frontend service and a backend service. The backend service is CPU-intensive and experiences high load during business hours. The operations team observes that the frontend service sometimes returns 503 errors during peak load. The team has already configured an ECS service auto scaling policy for the backend service based on average CPU utilization with a target value of 70%. The backend service is currently running 4 tasks, and the frontend is running 2 tasks. The errors seem to correlate with the backend scaling up. Which solution should the team implement to improve the application's performance and reduce errors?

Accepted Answer

Update the backend service auto scaling policy to use a combination of CPU and memory utilization metrics with a step scaling policy, and increase the cooldown period to allow tasks to stabilize before additional scaling actions.. The 503 errors during backend scale-up are likely caused by the backend tasks not being fully ready to handle traffic immediately after launch. By using a combination of CPU and memory utilization metrics with a step scaling policy, the team can make scaling decisions more responsive to actual load patterns. Increasing the cooldown period prevents additional scaling actions from being triggered prematurely, giving new tasks time to stabilize and reducing the window where the backend is overwhelmed, which in turn reduces frontend timeouts.

Answer

Reduce the target CPU utilization for the backend auto scaling policy from 70% to 50% to trigger scaling earlier and keep CPU lower.

Answer

Change the backend service from Fargate to EC2 launch type and use larger instance types to provide more CPU capacity.

Answer

Increase the desired count of the frontend service to 4 tasks to handle more requests and reduce the load on the backend service.

Question 13

Match each AWS monitoring and logging service to its capability.

Accepted Answer

CloudWatch: Monitor and manage metrics, logs, and alarms. CloudWatch provides observability via metrics and logs (correct). GuardDuty detects threats with ML (correct). CloudTrail records API activity for auditing, not resource configuration changes, so B is incorrect. AWS Config tracks resource configuration changes, not API activity, so C is incorrect.

Answer

CloudTrail: Evaluate and track resource configuration changes

Answer

AWS Config: Record API activity for auditing and compliance

Question 14

A company uses AWS Lambda to process incoming messages from an SQS queue. The Lambda function is triggered by SQS and processes messages in batches of 10. Recently, the number of messages has increased significantly, and some messages are being processed multiple times. What should a solutions architect do to ensure exactly-once processing?

Accepted Answer

Change the SQS queue to a FIFO queue and enable content-based deduplication.. Exactly-once processing is achieved by using an SQS FIFO queue with content-based deduplication. FIFO queues guarantee that a message is delivered exactly once and consumers receive messages in order. Lambda supports SQS FIFO as an event source, though it has lower throughput limits. Option A (DynamoDB-based idempotency) also works but adds complexity and cost. Option B (increasing reserved concurrency) only helps with scaling but does not prevent duplicates if a message is processed but the function fails after processing. Option C (increasing visibility timeout) delays reprocessing but does not guarantee exactly-once if the function is throttled or fails.

Answer

Use a DynamoDB table to store unique message IDs and check for duplicates before processing.

Answer

Set the Lambda function's reserved concurrency to a higher value to prevent throttling.

Answer

Increase the visibility timeout of the SQS queue to 30 minutes.

Question 15

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

Accepted Answer

ECS tasks are being replaced by the service scheduler during deployments or health checks.. ECS Fargate tasks are ephemeral — when the service scheduler replaces a task during a rolling deployment, health check failure, or task restart, the container's local filesystem is destroyed along with the session file. Because session state is stored locally rather than in a shared external store, every task replacement wipes active user sessions, producing the frequent logouts.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS service is configured to scale out, causing new tasks to be created without existing session data.

Answer

The Application Load Balancer is not configured with sticky sessions.

Question 16

A company uses Amazon ElastiCache for Redis to cache frequently accessed data. The cache cluster is a single node (cache.r5.large). Over time, the cache hit ratio has decreased, and the CPU utilization is consistently above 80%. What should a solutions architect do to improve performance?

Accepted Answer

Enable cluster mode and distribute the cache across multiple shards.. Enabling cluster mode distributes data across multiple shards, reducing CPU load on individual nodes and improving the cache hit ratio by allowing more efficient use of memory and processing. Option A is incorrect because reducing TTL would cause more cache misses, further degrading the hit ratio. Option B is incorrect because read replicas offload read traffic but do not reduce CPU utilization caused by high write activity or data management. Option C is incorrect because scaling up to a larger node type provides more resources but does not address the architectural limitation of a single node; the increased CPU utilization is due to the single node being overwhelmed, not just resource capacity.

Answer

Reduce the Time-to-Live (TTL) of cached objects.

Answer

Add a read replica to offload read traffic.

Answer

Scale up to a larger node type, such as cache.r5.xlarge.

Question 17

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. DynamoDB Auto Scaling adjusts write capacity based on actual usage, reducing throttling without manual intervention. Option A is wrong because increasing read capacity does not help with write throttling. Option B is wrong because DAX is a cache for read operations, not writes. Option C is wrong because while switching to On-Demand mode can eliminate throttling, it may be more expensive than Auto Scaling if the workload is predictable; Auto Scaling is the more cost-effective solution for this scenario.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 18

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store processed file IDs and check for duplicates before processing.. Option A is correct because storing processed file IDs in a DynamoDB table and checking for duplicates before processing creates an idempotency guard: the Lambda function can conditionally write the file ID (e.g., with a conditional PutItem on a unique key) and skip processing if it already exists, preventing the same file from being handled more than once. Option D is correct because configuring S3 event notifications with prefix and suffix filters ensures the Lambda function is only triggered for the intended object keys (e.g., only .csv files in a specific prefix), avoiding spurious or duplicate invocations caused by unrelated or unintended object events. Option B is not correct because switching to an SQS queue with Lambda polling improves decoupling and retry handling but does not by itself guarantee idempotent processing, since SQS can deliver messages at least once. Option C is not correct because increasing the Lambda timeout only allows longer execution and does not prevent duplicate processing. Option E is not correct because S3 Transfer Acceleration only speeds up uploads over long distances and has no effect on idempotency.

Answer

Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 19

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Accepted Answer

Create a read replica from the source DB instance.. Option B is correct because implementing an RDS read replica fundamentally requires creating the replica from the source DB instance, either via the console, CLI (create-db-instance-read-replica), or API, which establishes asynchronous replication from the primary. Option C is correct because the read replica only reduces load on the primary if the application is actually reconfigured to direct read-only queries to the replica's endpoint, leaving writes and read-write traffic on the primary endpoint. Option E is correct because placing the read replica in a different Availability Zone is a recommended practice that provides AZ-level fault tolerance for read traffic and avoids the replica competing for the same AZ resources as the primary. Option A is incorrect because co-locating the replica in the same AZ as the primary defeats the high-availability benefit and is not a requirement for read replicas. Option D is incorrect because Multi-AZ is a separate feature for the primary/standby failover model and is not enabled on read replicas; read replicas themselves are not Multi-AZ instances.

Answer

Ensure the read replica is in the same Availability Zone as the primary.

Answer

Enable Multi-AZ on the read replica.

Question 20

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

Accepted Answer

The upload request does not include the 'x-amz-acl' header with value 'bucket-owner-full-control'.. When an IAM user from Account A uploads an object to a bucket in Account B, the bucket owner does not automatically own the object unless the uploader grants ownership via the 'x-amz-acl' header with value 'bucket-owner-full-control'. Without this, the object is owned by Account A, and Account B may not have access, leading to failure if the bucket policy requires bucket owner ownership. Thus, the most likely reason is the missing ACL header.

Answer

The resource ARN in the policy is incorrect; it should include the bucket name only.

Answer

The bucket policy in Account B denies the upload.

Answer

The IAM user does not have permission to call s3:PutObject.