SAP-C02 Continuous Improvement for Existing Solutions Practice Test 10 — 15 Questions

Question 1

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Organizations Service Control Policies (SCPs) can deny public access to S3 buckets at the organization or OU level, providing preventive control. AWS Config can be used to detect publicly accessible S3 buckets and trigger remediation (e.g., via auto-remediation or Lambda). Option A is incorrect because AWS Resource Access Manager is for sharing resources, not enforcing security policies. Option B is incorrect because AWS WAF is a web application firewall, not for S3 bucket access control. Option C is incorrect because AWS IAM Identity Center (SSO) manages user identities and access, not bucket policies.

Answer

AWS Resource Access Manager

Answer

AWS WAF

Answer

AWS IAM Identity Center (SSO)

Question 2

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

Accepted Answer

The 'ec2:StartInstances' action does not support resource-level conditions.. The policy includes a condition requiring the resource tag 'Environment: production', but the ec2:StartInstances action does not support resource-level condition keys (like ec2:ResourceTag). Therefore, the condition is never evaluated, and the action is denied by default. Option A is incorrect because attaching the policy to a group effectively applies it to all group members. Option B is incorrect because the policy does not require MFA. Option C is incorrect because the policy does allow ec2:StartInstances on specific resources, but the condition is the issue.

Answer

The policy is attached to a group, not directly to the user.

Answer

The user does not have MFA enabled.

Answer

The policy does not allow 'ec2:StartInstances' on all resources.

Question 3

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

Accepted Answer

The AWS CLI is configured to use a different region than where the stack was deployed.. The CLI command is querying the wrong region. The stack was created in us-east-1 but the CLI default region might be different. Option B is wrong because the stack was created successfully. Option C is wrong because outputs are returned correctly. Option D is wrong because the stack name is exactly as used.

Answer

The stack was deleted after creation.

Answer

The stack name is case-sensitive and should be 'MyApp'.

Answer

The '--query' parameter is incorrectly formatted.

Question 4

Refer to the exhibit. A company has an Amazon ECS task definition with two containers. The 'web' container is essential, and the 'sidecar' container is not. The 'sidecar' container exits unexpectedly. What will happen to the task?

Accepted Answer

The task continues running as normal.. Non-essential containers can fail without affecting the task. Option A is wrong because only essential container failure stops the task. Option B is wrong because ECS will not restart a non-essential container by default; it depends on the task definition restart policy. Option D is wrong because the sidecar's CPU=0 means it can use up to the available CPU, but it still runs.

Answer

The sidecar container will be marked as essential.

Answer

ECS will automatically restart the sidecar container.

Answer

The ECS task will be stopped.

Question 5

A company runs a production web application on EC2 instances in an Auto Scaling group behind an ALB. The application logs are stored on an EBS volume attached to each instance. The operations team notices that the logs are not being sent to a central location. What is the MOST efficient way to centralize log collection with minimal code changes?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to stream the log files to CloudWatch Logs.. Installing the CloudWatch Logs agent on each EC2 instance and configuring it to stream log files to CloudWatch Logs centralizes log collection without requiring any changes to the application code. Option A is incorrect because modifying the application to use the AWS SDK to send logs via PutLogEvents API would require code changes. Option B is incorrect because while Amazon Kinesis Agent could be used to send logs to Kinesis Data Firehose and then to S3, this approach is more complex and not the most efficient for simple log centralization from EC2 instances; the CloudWatch Logs agent is purpose-built for this task. Option C is incorrect because setting up an S3 bucket with a lifecycle policy to transition logs to Glacier does not collect logs; it only manages log storage after they are already in S3, and logs would need to be sent to S3 first.

Answer

Modify the application to use the AWS SDK to send logs to CloudWatch Logs via PutLogEvents API.

Answer

Use Amazon Kinesis Agent to send logs to Kinesis Data Firehose and then to S3.

Answer

Set up an S3 bucket with a lifecycle policy to transition logs to Glacier.

Question 6

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use AWS Config conformance packs deployed via AWS Organizations with automatic remediation using Systems Manager Automation.. AWS Config conformance packs can be deployed at the organization level using AWS Organizations, enabling centralized management of rules across hundreds of accounts. Automatic remediation is achieved by associating Systems Manager Automation documents with non-compliant resources. Option A is incorrect because CloudFormation StackSets require per-account deployment and management, which does not scale as efficiently as conformance packs. Option B is incorrect because Config rules in each account with Lambda functions lack centralized deployment and management. Option D is incorrect because an AWS Config aggregator only provides a cross-account compliance view, not enforcement or remediation.

Answer

Use AWS CloudFormation StackSets to deploy Config rules to all accounts.

Answer

Use AWS Config rules in each account with AWS Lambda functions for remediation.

Answer

Use an AWS Config aggregator in the management account to view compliance across accounts.

Question 7

A company is using Amazon ECS with Fargate launch type for a microservices application. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization but no obvious pattern. What should the company do to identify the cause?

Accepted Answer

Enable AWS X-Ray tracing on the ECS tasks to trace requests across microservices.. AWS X-Ray provides distributed tracing to pinpoint performance bottlenecks. Option A is wrong because increasing task size is a reactive fix that does not identify the cause. Option C is wrong because CloudWatch Synthetics monitors endpoint availability, not internal trace data. Option D is wrong because CloudWatch Logs Insights is for querying logs, not for tracing requests across microservices.

Answer

Increase the CPU and memory for all ECS tasks.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints.

Answer

Use CloudWatch Logs Insights to analyze application logs for errors.

Question 8

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CodePipeline to send notifications to an Amazon SNS topic when the pipeline fails.. AWS CodePipeline natively supports sending notifications to Amazon SNS topics when pipeline state changes occur, such as failure. This is the most direct and efficient method without requiring additional services. Option B is incorrect because while the build script could use the AWS CLI to send a notification, this would require modifying the build script and does not leverage CodePipeline's built-in notification capability. Option C is incorrect because although a CloudWatch Events (EventBridge) rule can trigger a Lambda function to send email via SES, this approach is more complex and less efficient than using SNS directly from CodePipeline. Option D is incorrect because CloudWatch alarms are designed for metric-based thresholds, not for pipeline state changes; CodePipeline events are better handled via SNS or EventBridge.

Answer

Have the build script send a notification on failure using the AWS CLI.

Answer

Set up a CloudWatch Events rule to trigger an AWS Lambda function that sends an email via Amazon SES.

Answer

Create a CloudWatch alarm on the CodePipeline failure metric.

Question 9

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

Accepted Answer

Create one or more RDS read replicas and direct read queries to the replica endpoint.. The most appropriate solution is to create one or more RDS read replicas and direct read queries to the replica endpoint. Read replicas offload read traffic from the primary Multi-AZ instance, improving read latency with minimal application changes (only the read endpoint needs to be updated). Option A (DynamoDB Global Tables) would require a complete database migration and application rewrite, which is not minimal. Option C (ElastiCache) would require application code changes to cache queries, and may not be as effective for complex joins. Option D (increasing instance size) is vertical scaling that may only provide limited improvement and does not directly address read-heavy workloads; it also incurs higher cost without truly scaling out read capacity.

Answer

Migrate the database to Amazon DynamoDB Global Tables.

Answer

Implement Amazon ElastiCache in front of the database to cache query results.

Answer

Increase the DB instance class to a larger size with more vCPUs.

Question 10

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

Accepted Answer

Use an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is not present.. The most secure way to enforce SSE-KMS across all S3 buckets is to use an S3 bucket policy that denies PutObject if the required encryption header is not present. This ensures that any upload attempts without SSE-KMS are rejected, providing a preventive control. Option A is incorrect because AWS Config rules can only detect and remediate after the fact, not prevent non-compliant uploads. Option B is incorrect because default encryption can be overridden by specifying a different encryption header in the request. Option C is incorrect because IAM policies control permissions for API calls but cannot enforce specific encryption parameters on object uploads.

Answer

Use AWS Config rules to detect unencrypted objects and remediate with Lambda.

Answer

Enable default encryption on each bucket with SSE-KMS.

Answer

Create an IAM policy that requires kms:Encrypt permission for all S3 operations.

Question 11

A company is running a batch processing job on an EC2 instance that processes data from an S3 bucket and writes results to another S3 bucket. The job runs once per hour and takes about 20 minutes. The company wants to optimize costs by only paying for compute time when the job is running. Which solution is MOST cost-effective?

Accepted Answer

Use AWS Batch with spot instances to run the job only when needed.. AWS Batch automatically provisions and terminates EC2 instances based on job queue requirements, and it can use Spot Instances for significant cost savings. Option A (AWS Lambda) is wrong because the batch job takes 20 minutes, exceeding the 15-minute maximum execution time for Lambda functions. Option B (Reserved Instance) is wrong because it requires a 1-year commitment and still incurs costs for idle hours when the job is not running. Option C (t3.micro running 24/7) is wrong because while it is low-cost, it still charges for idle time, making it less cost-effective than only paying for compute during job execution.

Answer

Convert the batch job into an AWS Lambda function.

Answer

Purchase a Reserved Instance for the EC2 instance to reduce hourly cost.

Answer

Use a t3.micro instance and keep it running 24/7 since it's low cost.

Question 12

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

Accepted Answer

Use Amazon S3 for temporary data storage.. Using Amazon S3 for temporary data storage improves durability because S3 offers 99.999999999% durability, far exceeding the durability of a single EBS volume or instance store. It is cost-effective as you pay only for the storage used, with no upfront investment or additional volume costs. Although S3 is object storage, it is suitable for temporary data that does not require block-level access. Option A is incorrect because increasing IOPS does not improve durability. Option C is incorrect because adding EBS volumes and RAID 1 mirroring increases costs significantly due to additional volume charges. Option D is incorrect because moving to instance store reduces durability, as instance store is ephemeral and data is lost on instance stop/termination.

Answer

Increase the IOPS of the current EBS volume to improve performance.

Answer

Add additional EBS volumes and set up RAID 1 for mirroring.

Answer

Move the temporary data to an instance store volume if the instance type supports it.

Question 13

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.. Using CloudFront Origin Access Control (OAC) restricts access to the S3 bucket so that only the CloudFront distribution can access objects. The bucket policy must be updated to grant CloudFront access. Option B is incorrect because S3 Object Ownership does not restrict access. Option C is incorrect because allowing public read access would enable direct S3 access. Option D is incorrect because CloudFront key pairs and signed URLs control access through CloudFront but do not prevent direct S3 bucket access.

Answer

Set S3 Object Ownership to BucketOwnerPreferred.

Answer

Configure the S3 bucket policy to allow public read access.

Answer

Generate CloudFront key pairs and require signed URLs for all content.

Question 14

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

Accepted Answer

Create a dynamic scaling policy based on the average CPU utilization metric.. To automatically scale EC2 instances based on CPU utilization, you need an Auto Scaling group to manage the instances (Option D) and a dynamic scaling policy based on the average CPU utilization metric (Option C). Option A is a scheduled scaling policy based on time, not CPU utilization. Option B is incorrect because a Network Load Balancer is not required for scaling based on CPU. Option E is incorrect because while a CloudWatch alarm can be used to trigger scaling, it is not a required step on its own; the scaling policy is the primary requirement.

Answer

Configure a scheduled scaling policy to add instances during business hours.

Answer

Replace the ALB with a Network Load Balancer for better performance.

Answer

Create a CloudWatch alarm that sends an email when CPU exceeds 80%.

Question 15

A company runs a containerized microservices application on Amazon EKS. The operations team notices that some pods are frequently being evicted due to resource constraints. The team wants to improve resource utilization and reduce evictions. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure Horizontal Pod Autoscaler based on CPU and memory utilization.. Options A and C are correct. Horizontal Pod Autoscaler (HPA) dynamically scales the number of pod replicas based on CPU or memory utilization, helping to meet demand without over-provisioning. Resource quotas limit the total resources a namespace can consume, preventing any single team or application from starving others. Option B is incorrect because increasing resource requests for all pods can lead to over-provisioning and wasted resources, potentially worsening the eviction problem. Option D is incorrect because Cluster Autoscaler adds more worker nodes, which addresses cluster-level capacity but does not directly reduce pod evictions caused by node-level resource contention. Option E is incorrect because Vertical Pod Autoscaler (VPA) adjusts resource requests and limits automatically, but it often requires pod restarts and may not immediately prevent evictions if the underlying node is already overcommitted.

Answer

Increase the resource requests for all pods to ensure they have enough resources.

Answer

Enable Cluster Autoscaler to add more worker nodes.

Answer

Use Vertical Pod Autoscaler to automatically adjust pod resource requests.