SAP-C02 Continuous Improvement for Existing Solutions Practice Test 10 — 15 Questions

Question 1

A company runs a containerized microservices application on Amazon EKS. The operations team notices that some pods are frequently being evicted due to resource constraints. The team wants to improve resource utilization and reduce evictions. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure Horizontal Pod Autoscaler based on CPU and memory utilization.. Options A and C are correct. Resource quotas prevent a single namespace from consuming all resources. Horizontal Pod Autoscaler automatically scales pods based on resource usage. Option B is wrong because Vertical Pod Autoscaler adjusts resource requests, but can cause pod restarts. Option D is wrong because cluster autoscaler adds nodes, not reduces evictions due to pod-level constraints. Option E is wrong because increasing requests may lead to over-provisioning.

Answer

Increase the resource requests for all pods to ensure they have enough resources.

Answer

Enable Cluster Autoscaler to add more worker nodes.

Answer

Use Vertical Pod Autoscaler to automatically adjust pod resource requests.

Question 2

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

Accepted Answer

An approval action in the CodePipeline stage.. Options A, B, and C are correct. The approval action is added to the pipeline, requires an SNS topic for notifications, and an IAM role for the pipeline to publish to SNS. Option D is wrong because a Lambda function is not required for approval. Option E is wrong because a CloudWatch Events rule is not needed.

Answer

A CloudWatch Events rule to trigger the approval action.

Answer

An AWS Lambda function to process approval requests.

Question 3

A company applies the above IAM policy to an IAM user. The user attempts to upload an object to my-bucket using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/. What is the outcome?

Accepted Answer

The upload fails with an access denied error because the Deny statement with StringNotEquals blocks the request.. Option C is correct because the Deny statement with StringNotEquals will block any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not specify encryption, the Deny applies. Option A is wrong because the Allow statement requires encryption. Option B is wrong because the object is not encrypted. Option D is wrong because it would be denied.

Answer

The upload fails with an access denied error because the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement matches.

Answer

The upload succeeds because the Deny statement does not apply when no encryption header is present.

Question 4

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

Accepted Answer

The second interface is associated with a different security group.. Option D is correct because the command filters by security group ID, so only interfaces in that group are shown. The second interface may belong to a different security group. Option A is wrong because the filter is by group-id, not instance-id. Option B is wrong because the command does not filter by device index. Option C is wrong because the command can list all interfaces in the group regardless of attachment.

Answer

The second interface is not attached to the instance.

Answer

The second interface has a device index of 0.

Answer

The command only returns interfaces that are attached.

Question 5

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

Accepted Answer

The previous version is permanently deleted, but the delete marker remains.. Option B is correct because the lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted. Option A is wrong because the delete marker remains. Option C is wrong because only noncurrent versions expire. Option D is wrong because the delete marker is not expired.

Answer

All versions of the object are permanently deleted.

Answer

The delete marker is removed, and the object becomes current again.

Answer

The object is permanently deleted along with the delete marker.

Question 6

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

Accepted Answer

The DynamoDB table is in a different AWS account and the Lambda role does not have cross-account access.. Option A is correct because if the DynamoDB table is in a different AWS account, the Lambda execution role must have cross-account trust permissions. Option B is wrong because DynamoDB does not require VPC endpoints for access. Option C is wrong because Lambda's temporary credentials are sufficient. Option D is wrong because DynamoDB table names are case-sensitive but the error is ResourceNotFoundException, not AccessDeniedException.

Answer

The Lambda function is using the wrong AWS credentials.

Answer

The Lambda function is in a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table name is misspelled in the Lambda code.

Question 7

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

Accepted Answer

Implement scheduled scaling actions to add capacity before known peak times.. Option C is correct because scheduled scaling can pre-emptively add capacity based on known traffic patterns. Option A is wrong because increasing cooldown would delay scaling. Option B is wrong because step scaling is more aggressive but not proactive. Option D is wrong because lowering threshold would cause over-scaling and cost.

Answer

Decrease the CPU utilization threshold for scale-out.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Change the scaling policy to step scaling with a higher step adjustment.

Question 8

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Accepted Answer

Application Load Balancer (ALB) with stickiness and SSL termination.. Option C is correct because ALB supports sticky sessions (session affinity) and SSL termination. Option A is wrong because NLB does not support sticky sessions natively. Option B is wrong because CLB is legacy and less recommended. Option D is wrong because Lambda is not a load balancer.

Answer

Network Load Balancer (NLB) with target group stickiness.

Answer

Classic Load Balancer (CLB) with SSL termination at the instance.

Answer

AWS Lambda with API Gateway.

Question 9

A company has a stateful web application running on Amazon EC2 instances. They want to implement blue/green deployments to reduce downtime. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Migrate session state to Amazon ElastiCache or DynamoDB.. Option B is correct because a swap at the DNS level (e.g., Route 53 weighted records or blue/green with ALB) is key. Option D is correct because for stateful apps, migrating session state to ElastiCache or DynamoDB ensures continuity. Option A is wrong because ELB does not manage blue/green natively. Option C is wrong because setting TTL high delays traffic switching. Option E is wrong because deregistering instances from the old group is done after testing, not immediately.

Answer

Use an Elastic Load Balancer (ELB) to manage the blue and green environments.

Answer

Set a high TTL on the DNS record to prevent caching issues.

Answer

Immediately deregister the blue instances from the load balancer after deployment.

Question 10

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon RDS Multi-AZ deployment in the primary Region with a standby in another Region.. Option A is correct because a Global Database with standby in another Region provides near-zero RPO and automatic failover. Option D is correct because Multi-Region Aurora Global Database also meets RPO and RTO. Option B is wrong because cross-Region read replicas have RTO > 1 minute (manual promotion). Option C is wrong because RTO is too long. Option E is wrong because RPO is too high.

Answer

Take manual snapshots of the RDS instance every hour and copy them to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region.

Answer

Configure cross-Region read replicas for RDS MySQL.

Question 11

A company is using AWS CloudFormation to deploy infrastructure. They want to ensure that updates to a stack do not cause downtime for a critical web application. Which THREE strategies should they consider? (Choose THREE.)

Accepted Answer

Apply a stack policy to protect critical resources.. Option A is correct because change sets allow you to review changes before applying. Option B is correct because stack policies prevent updates to critical resources. Option D is correct because rolling updates with batch size reduce impact. Option C is wrong because deletion policy only protects against stack deletion, not updates. Option E is wrong because nested stacks don't inherently prevent downtime.

Answer

Use the DeletionPolicy attribute to retain resources.

Answer

Use nested stacks to isolate components.

Question 12

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

Accepted Answer

A service control policy (SCP) or a resource-based policy is denying the action.. Option D is correct because the error occurs even though the user has the StopInstances permission; likely the instance is protected by a resource-based policy or a service control policy (SCP) at the account level. Option A is wrong because the policy uses Resource '*' which includes all instances. Option B is wrong because there is no condition requiring tags. Option C is wrong because the CLI syntax is correct.

Answer

The user is using an incorrect CLI command syntax.

Answer

The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.

Answer

The policy does not specify the instance ID in the Resource field.

Question 13

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to write to CloudWatch Logs.. Option B is correct because if the Lambda execution role lacks logs:CreateLogGroup and logs:PutLogEvents permissions, Lambda cannot write logs. Option A is wrong because the log group exists but has 0 stored bytes. Option C is wrong because retention policy doesn't prevent new logs. Option D is wrong because the log group exists.

Answer

The Lambda function is exceeding the CloudWatch Logs API rate limits.

Answer

The log group retention policy is set to 7 days, which expired old logs.

Answer

The log group was deleted and not recreated.

Question 14

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

Accepted Answer

The bucket contains delete markers that are not being expired.. Option C is correct because NoncurrentVersionExpirationInDays applies to noncurrent versions, but if the object has no current version (e.g., all versions are delete markers), the rule doesn't clean up delete markers. Option A is wrong because the rule is enabled. Option B is wrong because versioning is enabled. Option D is wrong because bucket policy doesn't affect lifecycle.

Answer

The bucket has a bucket policy that prevents deletion.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule is disabled.

Question 15

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

Accepted Answer

Create an origin access identity (OAI) and grant it read access to the S3 bucket.. Option C is correct because origin access identity (OAI) allows CloudFront to access S3 securely. Option A is wrong because signed URLs are for end-user access. Option B is wrong because bucket policy with OAI is the right approach, but this option describes OAI. Option D is wrong because CloudFront does not use IAM roles for S3 access.

Answer

Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.

Answer

Attach an IAM role to CloudFront distribution.

Answer

Configure CloudFront signed URLs.