SAP-C02 Continuous Improvement for Existing Solutions — 40 Questions

Question 1

A company is running a web application on AWS using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application experiences periodic traffic spikes that cause increased latency. The company wants to implement a solution to automatically adjust capacity in anticipation of traffic changes. What should a solutions architect do?

Accepted Answer

Configure a predictive scaling policy using historical traffic patterns.. Predictive scaling uses historical traffic patterns to forecast future demand and proactively adjust capacity before traffic spikes occur, which directly addresses the requirement to anticipate changes. This approach reduces latency by ensuring sufficient resources are available ahead of time, unlike reactive policies that only respond after utilization increases.

Answer

Configure a simple scaling policy based on CPU utilization.

Answer

Configure a scheduled scaling policy to add instances during known peak hours.

Answer

Configure a target tracking scaling policy based on average CPU utilization.

Question 2

A company has a monolithic application running on a single Amazon RDS for MySQL DB instance. The application is experiencing performance issues due to heavy read traffic. The company wants to implement a solution that offloads read traffic with minimal application changes. What should a solutions architect do?

Accepted Answer

Create a read replica of the RDS instance and modify the application connection string to use the reader endpoint.. Creating a read replica of the RDS for MySQL DB instance and modifying the application connection string to use the reader endpoint offloads read traffic from the primary instance with minimal application changes. The reader endpoint automatically distributes connections across all read replicas, reducing the load on the primary instance without requiring code changes beyond updating the connection string.

Answer

Migrate the application to use Amazon DynamoDB with global tables.

Answer

Use Amazon RDS Multi-AZ with a standby instance for read traffic.

Answer

Implement Amazon ElastiCache in front of the database to cache read queries.

Question 3

A company is using AWS CloudFormation to deploy infrastructure. The security team requires that all Amazon S3 buckets created by CloudFormation must be encrypted at rest. What should a solutions architect do to enforce this requirement?

Accepted Answer

Add an S3 bucket policy that denies s3:PutObject without the x-amz-server-side-encryption header.. Option B is correct because an S3 bucket policy that denies s3:PutObject unless the request includes the x-amz-server-side-encryption header enforces encryption at rest for all objects uploaded to the bucket. This policy condition works regardless of how the bucket is created, including via CloudFormation, and ensures that any PutObject operation without the required encryption header is rejected, meeting the security team's requirement.

Answer

Enable default encryption on each bucket using SSE-S3.

Answer

Require that all buckets use AWS KMS managed keys for encryption.

Answer

Use a CloudFormation stack policy to prevent modification of bucket encryption settings.

Question 4

A company runs a containerized application on Amazon ECS with Fargate. The application needs to securely access an Amazon S3 bucket. The company wants to follow the principle of least privilege. What should a solutions architect recommend?

Accepted Answer

Define an IAM task role with S3 access policies and reference it in the ECS task definition.. Option A is correct because an IAM task role is the recommended mechanism for granting least-privilege permissions to ECS tasks using the Fargate launch type. The task role is defined in the ECS task definition and assumed by the container runtime, allowing the application to securely access the S3 bucket without embedding credentials. This approach follows AWS best practices by scoping permissions to the specific task rather than the underlying infrastructure.

Answer

Attach an IAM role to the underlying EC2 instance.

Answer

Assign an IAM role to the ECS service using the ECS service-linked role.

Answer

Store AWS credentials in the container environment variables.

Question 5

A company has an AWS Lambda function that processes messages from an Amazon SQS queue. The function is invoked with a batch size of 10. Some messages are failing repeatedly, causing the function to retry them up to the maximum retry count and then they are sent to a dead-letter queue (DLQ). The company wants to improve the resilience of the application by handling partial batch failures more efficiently. What should a solutions architect do?

Accepted Answer

Implement reportBatchItemFailures in the Lambda function and enable partial batch response for the SQS event source mapping.. Option B is correct because implementing reportBatchItemFailures in the Lambda function and enabling partial batch response for the SQS event source mapping allows the function to signal which specific messages within a batch failed. This prevents the entire batch from being retried or sent to the DLQ, and only the failed messages are retried individually, improving resilience and efficiency.

Answer

Move the messages to a DLQ immediately after the first failure.

Answer

Decrease the batch size to 1 so that each invocation processes a single message.

Answer

Increase the batch size to 100 to process more messages per invocation.

Question 6

A company is using AWS Organizations with multiple accounts. The security team wants to ensure that all Amazon S3 buckets across the organization are encrypted at rest. Which TWO steps should the security team take to enforce this requirement?

Accepted Answer

Create an AWS Config rule that checks for S3 bucket default encryption and auto-remediates using SSM Automation.. Option A is correct because AWS Config can be configured with a managed rule (e.g., s3-bucket-server-side-encryption-enabled) to detect buckets without default encryption, and an automatic remediation action using AWS Systems Manager (SSM) Automation can enforce encryption by applying the bucket's default encryption settings. Option B is correct because a service control policy (SCP) that denies s3:PutObject unless the x-amz-server-side-encryption header is present ensures that any object uploaded to S3 must include encryption headers, effectively enforcing encryption at the API level across all accounts in the organization.

Answer

Use Amazon GuardDuty to monitor S3 data access patterns.

Answer

Create an IAM role with permissions to encrypt S3 buckets and assign it to all users.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 7

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer. The application needs to process a large batch job that runs once per month and takes 2 hours. The company wants to optimize costs while ensuring the batch job has sufficient capacity. Which THREE steps should a solutions architect recommend?

Accepted Answer

Create a scheduled scaling policy that increases the desired capacity before the batch job starts.. Option A is correct because a scheduled scaling policy allows you to increase the desired capacity of the Auto Scaling group before the batch job starts, ensuring sufficient resources are available exactly when needed. This proactive approach avoids the latency of dynamic scaling and optimizes cost by not maintaining extra capacity outside the batch window.

Answer

Use On-Demand Instances only for the batch job to ensure availability.

Answer

Purchase Reserved Instances for the batch job capacity.

Question 8

A company runs a critical application on EC2 instances behind an Application Load Balancer (ALB) in a production AWS account. Recently, the application has experienced intermittent timeouts. The operations team notices that the CPU utilization of the instances spikes to 100% for a few minutes during the timeouts. The Auto Scaling group is configured with a target tracking scaling policy based on average CPU utilization at 70%. What should a solutions architect do to improve the application's availability and reduce timeouts?

Accepted Answer

Add a step scaling policy to scale out by 2 instances when CPU exceeds 80% for 1 minute.. Option B is correct because adding a step scaling policy that triggers at 80% CPU for 1 minute provides a faster, more aggressive scale-out response than the existing target tracking policy alone. This helps preempt the CPU spikes that reach 100% and cause timeouts, improving application availability by adding capacity before performance degrades.

Answer

Increase the ALB idle timeout to 120 seconds.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Reduce the target tracking scaling threshold to 50% average CPU.

Question 9

A company is running a stateful web application on EC2 instances in an Auto Scaling group behind an ALB. The application stores session data locally on the instance. The company notices that users are frequently logged out and lose session data during scaling events. What is the MOST operationally efficient way to preserve session state?

Accepted Answer

Migrate session data to ElastiCache for Redis and modify the application to use it.. Option A is correct because migrating session state to ElastiCache for Redis provides a centralized, external, and highly available session store that persists independently of EC2 instance lifecycles. This ensures that when instances are terminated or added during Auto Scaling events, session data remains intact and accessible from any instance, eliminating user logouts and data loss. It is operationally efficient as it requires minimal application code changes and leverages a fully managed, in-memory data store optimized for low-latency access.

Answer

Create a custom AMI that pre-populates session data from Amazon S3.

Answer

Increase the Auto Scaling group's cooldown period to 600 seconds.

Answer

Enable sticky sessions (session affinity) on the ALB.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to automatically roll back a stack update if it fails, and receive a notification. What should be configured to meet these requirements?

Accepted Answer

Enable rollback on failure in the CloudFormation stack and configure an SNS notification topic.. Option C is correct because CloudFormation natively supports automatic rollback on stack update failure via the 'Rollback on failure' setting. By configuring an SNS notification topic on the stack, the operations team receives alerts when a rollback occurs, meeting both requirements without additional custom logic.

Answer

Use AWS CloudTrail to monitor the UpdateStack API call and trigger a rollback via a Lambda function.

Answer

Use AWS Config rules to detect stack failure and revert changes.

Answer

Create a custom resource in the CloudFormation template that performs rollback.

Question 11

A company is running a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences increased latency during peak hours. Upon investigation, the CPU utilization of the tasks reaches 90%. The ECS service is configured with a target tracking scaling policy based on average CPU at 70%. However, scaling is not keeping up with demand. What should a solutions architect do to improve the responsiveness of the scaling?

Accepted Answer

Add a step scaling policy that adds 4 tasks when CPU exceeds 80% for 1 minute.. Option C is correct because adding a step scaling policy provides a more aggressive and immediate scaling response when CPU exceeds 80% for 1 minute, which complements the existing target tracking policy. Target tracking scaling policies are reactive and may not scale quickly enough during rapid demand spikes, whereas step scaling can add a fixed number of tasks instantly when a breach occurs, reducing latency during peak hours.

Answer

Increase the task-level CPU limit to 2048 units.

Answer

Decrease the target tracking value to 50% average CPU.

Answer

Decrease the scale-in cooldown period to 60 seconds.

Question 12

A company has a legacy application that runs on a single EC2 instance. The application writes logs to a local file. The company wants to centralize log management without modifying the application code. Which solution is MOST operationally efficient?

Accepted Answer

Install and configure the Amazon CloudWatch agent on the EC2 instance.. The Amazon CloudWatch agent can be installed on the EC2 instance without modifying application code. It reads the local log file and sends the logs to Amazon CloudWatch Logs for centralized management, making it the most operationally efficient solution.

Answer

Use AWS CloudTrail to capture log file changes.

Answer

Modify the application to write logs to stdout and use the awslogs driver.

Answer

Set up an Amazon S3 bucket and use an AWS Lambda function to periodically copy log files.

Question 13

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

Accepted Answer

Add an Amazon RDS Read Replica in the same AWS Region.. Option D is correct because adding an Amazon RDS Read Replica offloads read traffic from the primary MySQL database, allowing read queries to be served by the replica and reducing load on the source instance. This directly addresses the high number of read queries causing the bottleneck, as read replicas are designed for read-heavy workloads and can be promoted to a standalone instance if needed.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Implement DynamoDB Accelerator (DAX) in front of the database.

Answer

Scale up the RDS instance to a larger instance type.

Question 14

A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which THREE statements should be included in the IAM policy? (Choose three.)

Accepted Answer

{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}. Option A is correct because the EC2 instance only needs to read objects from the S3 bucket, so the least-privilege action is s3:GetObject. The resource ARN 'arn:aws:s3:::my-bucket/*' correctly targets all objects within the bucket, which is required for reading objects. This adheres to the principle of granting only the necessary permissions.

Answer

{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}

Answer

{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}

Question 15

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

Accepted Answer

The user can describe instances but cannot terminate instances in any region.. The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer

The user cannot describe instances or terminate instances.

Answer

The user can terminate instances and describe instances.

Answer

The user can describe instances but cannot terminate any instances.

Question 16

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

Accepted Answer

The command displays the instance ID, instance type, and launch time of three running instances.. The command `aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,InstanceType,LaunchTime]' --output table` filters for running instances and projects only the InstanceId, InstanceType, and LaunchTime fields. The output shows three rows, each representing a running instance with those three attributes. Therefore, option B is correct because it accurately describes the displayed data.

Answer

There are two instances with the Environment=production tag.

Answer

One of the instances is stopped.

Answer

The command lists all instances in the account regardless of tags.

Question 17

A company uses AWS CloudFormation to manage its infrastructure. The operations team reports that stack updates often fail because of resource conflicts. The team wants to improve the reliability of updates without manual intervention. Which solution provides the MOST automated recovery from update failures?

Accepted Answer

Use the default CloudFormation rollback behavior that automatically reverts changes on failure.. Option D is correct because CloudFormation's built-in rollback behavior automatically reverts all changes made during a failed stack update, restoring the stack to its last known stable state without requiring any custom code or manual intervention. This provides the most automated recovery mechanism as it is natively integrated into the CloudFormation service and requires no additional infrastructure or scripting.

Answer

Use CloudFormation change sets to review and approve all changes before update.

Answer

Write a custom AWS Lambda function that reverts changes when a stack update fails.

Answer

Apply a stack policy to prevent updates to critical resources.

Question 18

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

Accepted Answer

Create RDS read replicas for the DB instance and route read queries from the application to the replicas.. The correct answer is A because creating RDS read replicas offloads read queries from the primary DB instance, reducing CPU contention from read-heavy workloads. Since the application reads and writes to the same database, directing read traffic to replicas decreases the primary instance's CPU utilization, directly addressing the 100% CPU spike observed during the load test. This improves database scalability by distributing read operations horizontally without altering write capacity.

Answer

Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.

Answer

Increase the instance size of the RDS DB instance to a larger instance type.

Answer

Enable Multi-AZ for the RDS instance to distribute the load across two instances.

Question 19

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

Accepted Answer

{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}. Option A is correct because the CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Answer

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Question 20

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Option D is correct because switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.