SAP-C02 Continuous Improvement for Existing Solutions Practice Test 11 — 15 Questions

Question 1

A company has an S3 bucket that stores critical data. They need to ensure that all objects are encrypted at rest. The bucket policy currently denies uploads if the x-amz-server-side-encryption header is not set to AES256. However, some objects are still stored with SSE-KMS. How can the company enforce SSE-S3 exclusively?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Update the bucket policy to deny uploads with SSE-KMS.. Updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively.

Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption.

Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption.

Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.

Answer

Use S3 Lifecycle policies to transition objects to SSE-S3.

Answer

Enable default encryption on the bucket with SSE-S3.

Answer

Use S3 Object Lambda to change encryption.

Question 2

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Accepted Answer

Add a NAT Gateway in the public subnet and update the private subnet's route table.. A NAT Gateway deployed in the public subnet, combined with a route in the private subnet's route table pointing 0.0.0.0/0 to that NAT Gateway, allows private instances to initiate outbound internet traffic while remaining unreachable from the internet. This is the AWS-recommended, highly available, managed solution for egress from private subnets.

Answer

Create a VPC endpoint for the internet.

Answer

Launch a NAT instance in the private subnet.

Answer

Attach an Internet Gateway directly to the private subnet.

Question 3

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

Accepted Answer

The upload is denied because the Deny statement applies to all uploads.. In AWS IAM, an explicit Deny always overrides any Allow, regardless of the Principal element or the specific action granted. If the policy attached to the user contains a Deny statement that matches the s3:PutObject action (and the SSE-KMS condition), the upload is denied even though the user has an Allow for s3:PutObject. The Deny wins because IAM evaluates all applicable policies and any matching Deny is final.

Answer

The upload succeeds because the Deny statement has no Principal specified.

Answer

The upload is denied only if the object is larger than 5 GB.

Answer

The upload succeeds because the user has an Allow for s3:PutObject.

Question 4

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

Accepted Answer

Two log files are larger than 1 KB.. The AWS CLI command shown (likely aws s3api list-objects with a query filtering Size > 1024) returns objects whose size is greater than 1 KB, and the output indicates two such log files. The correct interpretation is that two log files are larger than 1 KB.

Answer

The log files are larger than 1000 KB.

Answer

The bucket contains only two objects with the prefix 'logs/'.

Answer

The bucket has versioning enabled.

Question 5

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

Accepted Answer

Enable detailed monitoring on the EC2 instances.. Enabling detailed monitoring on EC2 instances provides CloudWatch metrics at a 1-minute granularity, which is crucial for identifying the exact timing and duration of CPU spikes. The intermittent nature of the latency spikes and the lack of correlation with request count suggest that the root cause may be a specific process or internal instance activity. Detailed monitoring allows for more precise analysis of CPU usage patterns, helping to isolate the cause. Option A is incorrect because increasing instance size only masks the symptom without addressing the underlying issue. Option C is incorrect because scaling policies respond to sustained high CPU utilization, not intermittent spikes, and would not help identify the root cause. Option D is incorrect because CloudTrail logs API calls and does not provide instance-level metric data needed to diagnose CPU spikes.

Answer

Increase the instance size to handle the load.

Answer

Add a scaling policy based on CPU utilization.

Answer

Enable AWS CloudTrail to log EC2 API calls.

Question 6

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. The default Lambda timeout is 3 seconds, which is almost certainly too short for variable file processing. Increasing the timeout is the most cost-effective fix because Lambda billing is based on invocation count and GB-seconds of execution — a longer timeout does not increase cost unless the function actually runs longer, and it directly addresses the timeout error without adding infrastructure.

Answer

Increase the memory allocation for the Lambda function.

Answer

Use an SQS queue to buffer the S3 events.

Answer

Use AWS Step Functions to orchestrate the processing.

Question 7

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

Accepted Answer

Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.. A service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly. Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.

Answer

Use AWS Config rules with auto-remediation using SSM Automation.

Answer

Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.

Answer

Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.

Question 8

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. Recently, a deployment failed because the new task definition referenced an ECR image that did not exist. The team wants to prevent this type of failure in the future. Which action should be taken?

Accepted Answer

Add a validation step in CodePipeline to run a task definition dry-run.. The failure occurred because the ECS task definition referenced an ECR image tag that did not exist. A CodePipeline validation step that performs a task definition dry-run (e.g., using the ECS `RegisterTaskDefinition` API with `dryRun` or a custom Lambda that checks the image tag's existence in ECR) catches this exact misconfiguration before deployment. This pre-deployment validation ensures that the task definition's image reference is resolvable, preventing the pipeline from proceeding to a doomed ECS deployment.

Answer

Configure ECR scan on push to verify image integrity.

Answer

Add an ECR lifecycle policy to expire old images.

Answer

Enable AWS CloudTrail to log ECR API calls.

Question 9

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

Accepted Answer

Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set.. An S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones. Option D is wrong because CloudTrail does not enforce encryption.

Answer

Enable default encryption on the bucket.

Answer

Use S3 Batch Operations to encrypt existing objects.

Answer

Enable AWS CloudTrail to monitor uploads without encryption.

Question 10

A company is using Amazon API Gateway to expose a REST API. The API backend is a Lambda function that queries an Amazon DynamoDB table. During peak hours, the API returns HTTP 429 (Too Many Requests) errors. What is the MOST cost-effective way to reduce these errors?

Accepted Answer

Increase the throttling limits in API Gateway.. HTTP 429 errors from API Gateway indicate the client is exceeding the configured throttle limits (default 10,000 RPS steady-state and 5,000 burst per account/region, with per-method limits). Since the backend Lambda and DynamoDB are not the bottleneck here, the most direct and cost-effective fix is to raise the API Gateway throttling limits (or request a quota increase) so legitimate peak traffic is not rejected. This avoids adding caching infrastructure or over-provisioning backend capacity.

Answer

Enable API caching in API Gateway.

Answer

Enable DynamoDB auto-scaling.

Answer

Increase the reserved concurrency of the Lambda function.

Question 11

A company has a fleet of EC2 instances that process data from an SQS queue. The instances are part of an Auto Scaling group. The team notices that the queue depth is growing, but the Auto Scaling group is not scaling out quickly enough. Which THREE actions should the team take to improve the scaling responsiveness? (Choose three.)

Accepted Answer

Use a custom CloudWatch metric for the SQS queue depth to drive scaling.. Option A is correct because SQS queue depth (ApproximateNumberOfMessagesVisible) is not a native EC2 Auto Scaling metric, so the team must publish it as a custom CloudWatch metric (or use the SQS metric with target tracking) to drive a scaling policy that reacts to backlog growth. Option C is correct because a long cooldown period blocks the Auto Scaling group from launching additional instances after a scaling activity, so reducing it lets the group scale out again sooner as the queue continues to grow. Option D is correct because step scaling policies allow multiple, tiered adjustments based on the magnitude of the alarm breach, scaling out more aggressively and faster than a simple scaling policy, which performs a single adjustment and then waits. Option B is not correct because there is no AWS CloudWatch 'metric warm-up time' setting to decrease; CloudWatch metrics have periods and evaluation periods, not a warm-up parameter. Option E is not correct because increasing instance size changes per-instance capacity but does not improve how quickly the Auto Scaling group detects and responds to the growing queue depth.

Answer

Decrease the AWS CloudWatch metric warm-up time.

Answer

Increase the instance size in the launch template.

Question 12

A company uses AWS CloudFormation to manage infrastructure. A recent update to a stack failed, and the stack is now in a ROLLBACK_COMPLETE state. The team needs to investigate the cause and then redeploy the update. Which TWO actions should the team take? (Choose two.)

Accepted Answer

View the stack events in the CloudFormation console.. Option A is correct because when a CloudFormation stack update fails and enters ROLLBACK_COMPLETE, the stack events timeline in the CloudFormation console (or via aws cloudformation describe-stack-events) shows the exact resource that failed and the status reason, which is the primary way to diagnose the root cause. Option C is correct because creating a ChangeSet lets the team preview the proposed template and parameter changes and see which resources will be added, modified, or replaced before executing the update, reducing the chance of another failed deployment. Option B is not appropriate because reviewing a previous template version does not by itself explain the failure of the recent update or validate the fix. Option D is wrong because StackSets are for deploying stacks across multiple accounts and Regions, which is unrelated to diagnosing and redeploying a single failed stack. Option E is wrong because a stack in ROLLBACK_COMPLETE has already finished rolling back; there is no ongoing rollback to continue, and the stack cannot be updated in that state until it is deleted and recreated or otherwise remediated.

Answer

Review the previous stack template version.

Answer

Use AWS CloudFormation StackSets to redeploy across accounts.

Answer

Execute a rollback to continue the rollback process.

Question 13

A company runs a web application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer. During traffic spikes, the application becomes slow. The team suspects that the ECS service is not scaling fast enough. Which TWO actions should the team take to improve the scalability? (Choose two.)

Accepted Answer

Decrease the scale-in and scale-out cooldown periods.. Option B is correct because reducing the scale-out cooldown period allows the ECS Service Auto Scaling to launch additional Fargate tasks sooner after a scaling activity, and reducing the scale-in cooldown prevents premature removal of capacity, so the service can respond more quickly and aggressively to traffic spikes. Option D is correct because raising the maximum number of tasks in the ECS service removes the upper bound that could otherwise cap scaling; if the current maximum is reached during a spike, no further tasks can be launched regardless of the scaling policy, so increasing it enables the service to scale out further. Option A is incorrect because reducing the number of subnets in the VPC does not improve ECS scaling and could reduce availability across Availability Zones. Option C is incorrect because the ALB idle timeout governs how long idle connections are kept open and does not affect ECS task scaling speed. Option E is incorrect because increasing the target value for the scaling metric (e.g., CPU utilization) makes the scaling policy less sensitive, causing it to add tasks later rather than faster, which would worsen the slow response during spikes.

Answer

Decrease the number of subnets in the VPC.

Answer

Decrease the ALB idle timeout.

Answer

Increase the target value for the scaling metric (e.g., CPU utilization).

Question 14

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Accepted Answer

The ec2:ResourceTag condition key is not supported for ec2:StopInstances.. The ec2:ResourceTag condition key is not supported for the ec2:StopInstances action; it is only supported for read actions such as ec2:DescribeInstances. Therefore, even though the instance has the tag 'Environment=production', the condition is not evaluated and the action fails. Option B is incorrect because the Resource element '*' includes all instances. Option C is incorrect because the policy does include ec2:StopInstances. Option D is incorrect because a resource ARN is not required for the condition to work; the issue is the unsupported condition key.

Answer

The Resource element is set to '*', which does not include the specific instance.

Answer

The ec2:StopInstances action is not listed in the policy.

Answer

The policy requires a resource ARN for the condition to work.

Question 15

Refer to the exhibit. A company configured an Amazon Route 53 alias record for a domain name pointing to an Application Load Balancer (ALB). Users report that occasionally they are directed to an unhealthy ALB node. Which change should the company make to improve availability?

Accepted Answer

Configure the ALB health check to mark unhealthy nodes.. The issue is that Route 53 is routing traffic to an unhealthy ALB node because the ALB's health check is not correctly marking that node unhealthy. Configuring or fixing the ALB health check ensures that only healthy targets receive traffic, improving availability. Alias records already correctly point to the ALB, so changing the record type or routing policy does not address the root cause.

Answer

Change the record type to CNAME.

Answer

Use weighted routing policy.

Answer

Use multi-value answer routing.