SAP-C02 Continuous Improvement for Existing Solutions Practice Test 10 — 15 Questions

Question 1

A media company delivers video content to a global audience using Amazon CloudFront, AWS Lambda@Edge, and Amazon S3. The origin is an S3 bucket that stores video files. Recently, users in Asia-Pacific report slow load times. The operations team checks CloudFront metrics and sees a high cache miss rate for content popular in that region. The team wants to improve performance for all users without significantly increasing costs. The application uses a single CloudFront distribution with a default cache behavior. The S3 bucket is in us-east-1. Which solution should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use Lambda@Edge to redirect requests to the nearest S3 bucket based on the viewer's location.. Lambda@Edge runs at CloudFront edge locations and can inspect the viewer's country via the `CloudFront-Viewer-Country` header, then rewrite the origin request to the nearest regional S3 bucket. This directly addresses the high cache miss rate in Asia-Pacific by serving from a closer origin, and it works within the existing single distribution without multiplying distribution costs. It is the only option that improves origin fetch latency for all users without significant cost increase.

Answer

Enable S3 Transfer Acceleration on the S3 bucket and update CloudFront to use the accelerated endpoint.

Answer

Create separate CloudFront distributions for each geographic region and use Route 53 latency-based routing.

Answer

Set up multiple origin groups in the existing CloudFront distribution with one S3 bucket per region, and configure cache behaviors based on geographic headers.

Question 2

A healthcare company runs a HIPAA-compliant web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS for PostgreSQL database with Multi-AZ. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The current setup uses an SSL certificate on the ALB to terminate HTTPS, but traffic between the ALB and EC2 instances is over HTTP. The company wants to enforce end-to-end encryption without changing the application code. Which solution meets these requirements?

Accepted Answer

Configure the ALB to use a TLS listener and forward traffic to the target group using the TCP protocol on port 443.. By configuring the ALB with a TLS listener (HTTPS) and forwarding traffic to the target group using the HTTPS protocol on port 443, the traffic between ALB and EC2 instances is encrypted. This provides end-to-end encryption without changing application code, as the instances only need a valid certificate and web server configuration for HTTPS (which is a configuration change, not code).

Option A is incorrect because an NLB with a TLS listener terminates TLS at the NLB and forwards unencrypted traffic to targets via TCP, breaking end-to-end encryption. Health checks over HTTPS would require instances to handle HTTPS, which may need application changes.

Option C is incorrect because AWS Certificate Manager (ACM) does not accept self-signed certificates for trust; it requires certificates signed by a trusted certificate authority.

Option D is incorrect because traffic between CloudFront and ALB remains unencrypted (HTTP), and ALB to instances is also HTTP, so end-to-end encryption is not achieved.

Answer

Replace the ALB with a Network Load Balancer, configure a TLS listener, and use target group health checks over HTTPS.

Answer

Install a self-signed certificate on each EC2 instance, configure the ALB target group to use HTTPS, and upload the self-signed certificate to AWS Certificate Manager (ACM) for the ALB to trust.

Answer

Place AWS CloudFront in front of the ALB and configure CloudFront to use TLS 1.2, with the ALB still using HTTP.

Question 3

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

Accepted Answer

Enable RDS Proxy to manage database connections.. RDS Proxy is a fully managed, highly available database proxy that pools and shares database connections, reducing the overhead of opening and closing connections for every application request. This directly reduces CPU load on the RDS instance because connection management (authentication, TLS handshake, session setup) is offloaded to the proxy. Since the application code does not need to change—only the connection endpoint—this is the most effective solution to reduce database load without code modifications.

Answer

Add a second RDS read replica to distribute read traffic.

Answer

Upgrade the RDS instance to a larger instance type with more vCPUs.

Answer

Implement an ElastiCache for Redis cluster to cache frequently accessed data.

Question 4

A company runs a critical workload on EC2 instances in an Auto Scaling group across three Availability Zones. The application needs to maintain a consistent IP address for outbound traffic to external partners. The current design uses a NAT gateway in each AZ, but partners whitelist a single IP. How can the company provide a fixed outbound IP while maintaining high availability?

Accepted Answer

Deploy a Network Load Balancer with Elastic IPs in front of NAT instances in each AZ.. A Network Load Balancer (NLB) with Elastic IPs can distribute traffic to NAT instances across multiple Availability Zones, providing a fixed outbound IP and high availability. If one AZ fails, the NLB redirects traffic to healthy NAT instances in other AZs, ensuring the workload remains operational. Option A is incorrect because a proxy fleet behind an ALB would still result in multiple outbound IPs, as ALB instances have different IPs. Option B is incorrect because using a single NAT gateway across all AZs is not possible – NAT gateways are AZ-specific and cannot span zones; also, a single NAT gateway is a single point of failure. Option C is incorrect because a single NAT instance in one AZ lacks high availability – if that AZ fails, outbound connectivity is lost.

Answer

Use a proxy fleet of EC2 instances behind an Application Load Balancer.

Answer

Use a single NAT gateway across all three AZs and assign an Elastic IP.

Answer

Use a NAT instance with an Elastic IP in one AZ.

Question 5

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

Accepted Answer

The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.. The pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission. Option D is wrong because versioning is not required for writes.

Answer

The S3 bucket policy denies access from the pipeline's AWS account.

Answer

The CodeBuild project does not have the necessary environment variables.

Answer

The S3 bucket does not have versioning enabled.

Question 6

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

Accepted Answer

Increase the Lambda function's reserved concurrency and timeout.. Increasing the reserved concurrency ensures Lambda can scale to handle the burst, and increasing the timeout allows the function to complete processing without timing out. Option A is wrong because reducing the batch size may reduce the number of messages processed per invocation but does not address the timeout issue. Option C is wrong because increasing the SQS visibility timeout would cause messages to be delayed before becoming visible again after a timeout, but it does not solve the root cause of the Lambda function timing out; it just delays reprocessing. Option D is wrong because a dead-letter queue is used to capture messages that repeatedly fail processing after maximum retries, not to prevent reprocessing of timeout failures.

Answer

Reduce the batch size in the Lambda event source mapping.

Answer

Increase the SQS visibility timeout to 6 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 7

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

Accepted Answer

Increase the number of EC2 instances running the consumer application.. Kinesis Client Library (KCL) consumers scale by adding more worker instances (e.g., EC2 instances) that each take ownership of shards up to the shard count. With 10 shards and one lagging consumer, adding EC2 instances allows KCL to distribute shard processing across more workers, increasing aggregate throughput. This is the standard horizontal scaling approach for KCL-based consumers.

Answer

Decrease the batch size in the KCL configuration.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the Kinesis stream's retention period to 7 days.

Question 8

A company has a web application behind an Application Load Balancer that uses sticky sessions. The application is deployed on EC2 instances in an Auto Scaling group. During a deployment, the team notices that users are experiencing errors after new instances are launched. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group's scale-in policy is terminating instances with active sessions.. The most likely cause is that the Auto Scaling group's scale-in policy is terminating instances that still have active sessions. When an instance is terminated, the sticky sessions are lost, and users are routed to new instances where their session state may not exist, causing errors. The deregistration delay should allow in-flight requests to complete, but if the instance is terminated abruptly, sessions are disrupted.

Answer

The target group's deregistration delay is too short.

Answer

The stickiness duration is set too long, causing requests to be routed to terminated instances.

Answer

The ALB health check is not configured for the new instances.

Question 9

A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Enable caching of authorization responses in API Gateway.. Option A is correct because API Gateway Lambda authorizers support caching of the returned authorization policy keyed by a configurable identity source (for example, the Authorization header), so enabling the authorizer cache (TTL up to 3600 seconds) lets API Gateway reuse the policy and skip invoking the Lambda function for repeated callers, directly reducing invocations and eliminating the timeouts caused by repeated authorizer calls at peak traffic. Option C is correct because the timeouts occur inside the authorizer function itself, and raising the Lambda function timeout (up to 15 minutes) gives the existing authentication logic enough time to complete under peak load without altering that logic. Option B is not appropriate because AWS WAF filters malicious traffic at the edge and does not address authorizer execution time or caching. Option D is not appropriate because reserved concurrency only guarantees/limits how many concurrent invocations the function can serve; it does not shorten execution time and can even throttle requests when the limit is reached. Option E is not appropriate because request validation checks request parameters/body against a model before integration and has no effect on Lambda authorizer latency.

Answer

Use AWS WAF to block suspicious requests.

Answer

Increase the Lambda reserved concurrency.

Answer

Enable request validation in API Gateway.

Question 10

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

Accepted Answer

Set up an automatic remediation action using AWS Config to enable encryption on non-compliant buckets.. Option D is correct because an AWS Config managed rule such as s3-bucket-server-side-encryption-enabled evaluates S3 bucket configuration and flags buckets that lack default encryption, which is the detection mechanism needed to enforce the baseline. Option A is correct because AWS Config automatic remediation (via an SSM Automation document) can act on the non-compliant resources identified by that rule, enabling encryption at rest automatically so accounts converge on the baseline without manual intervention. Option C is correct because an SCP in AWS Organizations (which underpins Control Tower) can deny s3:CreateBucket or s3:PutBucketEncryption requests that do not include encryption, providing preventive guardrails across all accounts in the OU. Option B does not belong because attaching an IAM policy to each account's root user is an anti-pattern and does not enforce S3 encryption at rest across accounts. Option E does not belong because CloudTrail only records API activity for auditing; it neither detects non-compliant bucket configurations nor enforces encryption.

Answer

Attach an IAM policy to each account's root user.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 11

A company is designing a disaster recovery strategy for a critical application running on Amazon RDS for PostgreSQL. The primary database is in us-east-1. The company needs a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS Database Migration Service (DMS) for continuous replication.. Option A is correct because AWS DMS with change data capture (CDC) continuously replicates ongoing changes from the RDS for PostgreSQL source to a target in another Region, giving near-real-time replication that can satisfy an RPO under 5 seconds and, with a pre-provisioned target, an RTO under 1 minute. Option C is correct because an Amazon RDS cross-Region read replica uses asynchronous replication to another Region and can be promoted to a standalone primary during a disaster, providing low-second RPO and fast failover well within the 1-minute RTO. Option B is incorrect because Multi-AZ deployments are confined to a single Region (a standby in another Region is not a supported RDS Multi-AZ configuration), so it does not provide cross-Region disaster recovery. Option D is incorrect because daily snapshots copied cross-Region yield an RPO measured in hours, far exceeding the 5-second requirement. Option E is incorrect because automated backups with a 35-day retention remain in the source Region and only support point-in-time recovery locally, not cross-Region failover with the required RPO/RTO.

Answer

Configure a Multi-AZ deployment with a standby in a different AWS Region.

Answer

Take daily snapshots and copy them to another Region.

Answer

Enable automated backups with a retention period of 35 days.

Question 12

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/Admin"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:CallerAccount": "123456789012"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/Admin"
      },
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*"
    }
  ]
}

A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?

Accepted Answer

There is an explicit deny statement elsewhere in the policy.. The key policy shown does not contain any explicit deny statements, so the inability to decrypt must be due to an explicit deny elsewhere in the key policy (possibly not shown) or in an IAM policy attached to the role. Option B is incorrect because the kms:CallerAccount condition checks the AWS account ID of the principal making the request; when a role from account 123456789012 is assumed, the caller account is 123456789012, regardless of the user's origin. Therefore, the condition would pass, and the first statement would apply. Since both statements allow decryption, the only remaining explanation is an explicit deny somewhere.

Answer

The second statement does not include kms:GenerateDataKey, which is required for decryption.

Answer

The condition in the first statement restricts decryption to requests coming from account 123456789012, but the role might be used by a user from a different account.

Answer

The condition key kms:CallerAccount is not a valid condition key for KMS key policies.

Question 13

A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?

Accepted Answer

The subnet's network ACL is blocking inbound SSH traffic.. The most likely cause is that the subnet's network ACL is blocking inbound SSH traffic. While the security group allows SSH from anywhere (0.0.0.0/0), network ACLs operate at the subnet level and can override security group rules. If the network ACL denies inbound traffic on port 22, SSH connections will be blocked. Option A is less likely because even without a public IP, the instance could be reached via private IP from within the VPC; the scenario implies external SSH access. Option B is incorrect because system status checks indicate underlying hardware issues, not connectivity problems. Option C is incorrect because the security group is attached by default when launching an instance, and the question confirms it allows SSH.

Answer

The instance does not have a public IP address.

Answer

The instance is failing system status checks.

Answer

The security group is not attached to the instance.

Question 14

A company is running a stateful web application on EC2 instances behind an ALB. Users report that when they refresh a page, they are logged out. What is the best solution to fix this issue?

Accepted Answer

Enable sticky sessions on the ALB.. An ALB distributes each new TCP connection to a potentially different backend EC2 instance. Since the application is stateful and stores session data locally on each instance, a page refresh that opens a new connection can land on a different instance that has no record of the user's session, causing the logout. Enabling sticky sessions (session affinity) on the ALB ensures that all requests from a given client during the session lifetime are routed to the same target, preserving the in-memory session state.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Replace the ALB with a Classic Load Balancer.

Answer

Use ElastiCache to store session data.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. A recent deployment failed with a stack update error. The error message indicates that a resource was being updated but was in a failed state. What should the engineer do to resolve this issue?

Accepted Answer

Roll back the stack update to the previous working state.. Rolling back the stack update to the previous working state is the correct action because CloudFormation automatically attempts rollback on failure by default, and if it is stuck, the engineer should trigger or complete a rollback to restore the last known good state. This resolves the failed resource state and returns the stack to a stable condition from which a corrected update can be attempted. Continuing or skipping the failed resource is not supported in a way that leaves the stack consistent.

Answer

Delete the stack and recreate it with the same template.

Answer

Continue the update by skipping the failed resource.

Answer

Create a new stack and migrate resources.