SAP-C02 Continuous Improvement for Existing Solutions Practice Test 11 — 15 Questions

Question 1

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An approval action in the CodePipeline stage.. To add a manual approval step before deployment to production, you need: an approval action in the CodePipeline stage (A), an Amazon SNS topic to send approval notifications (E), and an IAM role for CodePipeline to publish to the SNS topic (C). The approval action pauses the pipeline and sends a notification via SNS. A CloudWatch Events rule (B) is not required because the approval action itself triggers the notification, not an event. An AWS Lambda function (D) is not needed because the approval process is handled natively by CodePipeline with SNS.

Answer

A CloudWatch Events rule to trigger the approval action.

Answer

An AWS Lambda function to process approval requests.

Question 2

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

Accepted Answer

The second interface is associated with a different security group.. The command filters by security group ID, so only interfaces in that group are shown. The second interface may belong to a different security group. Option A is wrong because the filter is by group-id, not instance-id. Option B is wrong because the command does not filter by device index. Option C is wrong because the command can list all interfaces in the group regardless of attachment.

Answer

The second interface is not attached to the instance.

Answer

The second interface has a device index of 0.

Answer

The command only returns interfaces that are attached.

Question 3

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

Accepted Answer

The previous version is permanently deleted, but the delete marker remains.. The lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted, but the delete marker remains. Option A is wrong because the delete marker is not permanently deleted. Option B is wrong because the delete marker is not removed and the object does not become current again. Option C is wrong because only the noncurrent version is permanently deleted, not the delete marker.

Answer

All versions of the object are permanently deleted.

Answer

The delete marker is removed, and the object becomes current again.

Answer

The object is permanently deleted along with the delete marker.

Question 4

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

Accepted Answer

The DynamoDB table name is misspelled in the Lambda code.. The 'ResourceNotFoundException' error indicates that the DynamoDB table does not exist in the account and region where the Lambda function is running. The most common cause is a misspelled table name in the Lambda code (Option D). Cross-account permission issues (Option C) typically result in an 'AccessDeniedException' rather than 'ResourceNotFoundException', because the resource does exist but access is denied. Option A is incorrect because Lambda uses temporary credentials from its execution role, and credential issues would cause authentication errors. Option B is incorrect because DynamoDB is accessible over the public internet or via a VPC endpoint; lack of a VPC endpoint would cause a timeout, not a resource-not-found error.

Answer

The Lambda function is using the wrong AWS credentials.

Answer

The Lambda function is in a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table is in a different AWS account and the Lambda role does not have cross-account access.

Question 5

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

Accepted Answer

Implement scheduled scaling actions to add capacity before known peak times.. Scheduled scaling can proactively add capacity before known peak times, preventing slow response times during traffic spikes. Option A is incorrect because decreasing the CPU utilization threshold would cause the Auto Scaling group to scale out sooner, which could help with responsiveness but may lead to over-provisioning and increased costs; however, it does not address the slow response times during a spike that has already started. Option B is incorrect because increasing the cooldown period delays subsequent scaling actions, making the system less responsive during a spike. Option D is incorrect because step scaling with a higher step adjustment is still a reactive measure; it does not add capacity before the spike and may cause abrupt scaling that could overshoot.

Answer

Decrease the CPU utilization threshold for scale-out.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Change the scaling policy to step scaling with a higher step adjustment.

Question 6

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Accepted Answer

Network Load Balancer (NLB) with target group stickiness.. Network Load Balancer (NLB) supports TLS termination at the listener level and provides sticky sessions through target group stickiness (source IP affinity). This meets the requirements for containerized microservices on Amazon ECS with Fargate. Application Load Balancer (ALB) also supports sticky sessions and SSL termination, but NLB is more cost-effective for high-throughput scenarios and works well with Fargate. Options C and D are incorrect because Classic Load Balancer is legacy and lacks advanced features, while AWS Lambda with API Gateway is not a load balancer and cannot directly provide sticky sessions.

Answer

Application Load Balancer (ALB) with stickiness and SSL termination.

Answer

Classic Load Balancer (CLB) with SSL termination at the instance.

Answer

AWS Lambda with API Gateway.

Question 7

A company has a stateful web application running on Amazon EC2 instances. They want to implement blue/green deployments to reduce downtime. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Migrate session state to Amazon ElastiCache or DynamoDB.. For blue/green deployments with stateful applications, migrating session state to a durable store like ElastiCache or DynamoDB (Option A) ensures continuity across environments. Using Route 53 weighted routing (Option C) allows gradual traffic shifting to the green environment, minimizing downtime. Option B is incorrect because ELB itself does not manage blue/green deployments natively; it is used within the architecture but not the primary action. Option D is incorrect because a high TTL on DNS records would delay traffic switching. Option E is incorrect because deregistering instances immediately would cause disruption; proper testing should occur first.

Answer

Use an Elastic Load Balancer (ELB) to manage the blue and green environments.

Answer

Set a high TTL on the DNS record to prevent caching issues.

Answer

Immediately deregister the blue instances from the load balancer after deployment.

Question 8

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database with a primary in one Region and a secondary in another Region.. Amazon RDS Multi-AZ does not support cross-Region standby; it only provides high availability within a single region. Option C is correct: Amazon Aurora Global Database offers synchronous cross-Region replication with automatic failover, typically achieving an RPO of less than 1 second and RTO of 1 minute, although it requires migrating from RDS MySQL to Aurora. Option D is incorrect: AWS DMS with continuous change data capture (CDC) uses asynchronous replication, which cannot guarantee a 1-second RPO. Option B is incorrect because manual snapshots every hour cannot achieve an RPO of 1 second. Option E is incorrect because cross-Region read replicas use asynchronous replication, so RPO is not guaranteed to be 1 second, and manual promotion takes longer than 1 minute.

Answer

Use Amazon RDS Multi-AZ deployment in the primary Region with a standby in another Region.

Answer

Take manual snapshots of the RDS instance every hour and copy them to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region.

Answer

Configure cross-Region read replicas for RDS MySQL.

Question 9

A company is using AWS CloudFormation to deploy infrastructure. They want to ensure that updates to a stack do not cause downtime for a critical web application. Which THREE strategies should they consider? (Choose THREE.)

Accepted Answer

Apply a stack policy to protect critical resources.. The correct answers are B, C, D. Option B: Apply a stack policy to protect critical resources. A stack policy is an IAM resource-based policy that controls which stack resources can be updated or deleted. By setting a stack policy with a Deny for updates on critical resources, you prevent accidental modification during stack updates, thus reducing downtime risk. Option C: Use a rolling update strategy with an appropriate batch size. When updating an Auto Scaling group or other resources that support rolling updates, you can configure the update policy to update instances in batches. This minimizes downtime by ensuring that only a portion of the instances are replaced at a time, keeping the application available. Option D: Use Change Sets to preview stack updates. Change sets allow you to review the changes that will be made to your stack before executing them. This helps identify potential issues or unintended modifications that could cause downtime, giving you a chance to reject the changes. Option A is incorrect because the DeletionPolicy attribute is used to preserve or back up resources when a stack is deleted, not during updates. It does not prevent downtime during updates. Option E is incorrect because nested stacks help organize resources into reusable components but do not inherently prevent downtime during updates; they are a management and modularity tool, not a downtime prevention strategy.

Answer

Use the DeletionPolicy attribute to retain resources.

Answer

Use nested stacks to isolate components.

Question 10

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

Accepted Answer

A service control policy (SCP) or a resource-based policy is denying the action.. The 'AccessDenied' error despite having the StopInstances permission indicates that something else is denying the action. The most likely cause is a service control policy (SCP) attached at the account or organizational level, or a resource-based policy on the EC2 instance itself that explicitly denies the action. Option A is wrong because incorrect CLI syntax would cause a different error. Option B is wrong because the policy may not have a tag-based condition; the issue is not about missing tag permissions. Option C is wrong because the policy can use a wildcard for the Resource field, so not specifying an instance ID does not cause AccessDenied. Option D correctly identifies that an SCP or resource-based policy is denying the action.

Answer

The user is using an incorrect CLI command syntax.

Answer

The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.

Answer

The policy does not specify the instance ID in the Resource field.

Question 11

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to write to CloudWatch Logs.. If the Lambda execution role lacks logs:CreateLogGroup and logs:PutLogEvents permissions, Lambda cannot write logs. Option A is wrong because the log group exists but has 0 stored bytes. Option C is wrong because retention policy doesn't prevent new logs. Option D is wrong because the log group exists.

Answer

The Lambda function is exceeding the CloudWatch Logs API rate limits.

Answer

The log group retention policy is set to 7 days, which expired old logs.

Answer

The log group was deleted and not recreated.

Question 12

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

Accepted Answer

The bucket contains delete markers that are not being expired.. Lifecycle rules for noncurrent versions do not automatically expire delete markers. Delete markers are not considered noncurrent versions and require a separate ExpiredObjectDeleteMarker action in the lifecycle policy. Option B is incorrect because bucket policies do not affect lifecycle expiration. Option C is incorrect because versioning must be enabled for noncurrent version expiration to work; if versioning were disabled, the lifecycle rule would not apply. Option D is incorrect because the lifecycle rule is enabled as per the template; the issue is the absence of a rule for delete markers.

Answer

The bucket has a bucket policy that prevents deletion.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule is disabled.

Question 13

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

Accepted Answer

Create an origin access identity (OAI) and grant it read access to the S3 bucket.. Create an origin access identity (OAI) and grant it read access to the S3 bucket. An OAI is a special CloudFront user that allows CloudFront to access private S3 bucket content securely. Option A is incorrect because CloudFront does not have static public IP ranges; it uses a large dynamic range. Option C is incorrect because IAM roles are not used directly for CloudFront to S3 access; OAI is the standard method. Option D is incorrect because signed URLs control end-user access, not origin access.

Answer

Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.

Answer

Attach an IAM role to CloudFront distribution.

Answer

Configure CloudFront signed URLs.

Question 14

A company runs a production database on Amazon RDS for PostgreSQL. They need to perform a major version upgrade with minimal downtime. Which strategy should they use?

Accepted Answer

Create a read replica of the current database using the new version, promote it, and update the connection string.. Creating a read replica with the new PostgreSQL version, promoting it, and updating the connection string minimizes downtime by allowing the replica to catch up before promotion. Option A (DMS) adds complexity and potential lag. Option C (pg_dump) involves export/import time and potential data loss. Option D (in-place upgrade) causes downtime during the upgrade and risk of failure.

Answer

Use AWS Database Migration Service (DMS) to replicate data to a new instance.

Answer

Create a new RDS instance with the new version and migrate data using pg_dump.

Answer

Take a snapshot of the database, perform an in-place upgrade, and restore if needed.

Question 15

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

Accepted Answer

No, because t3.large instances only support x86_64 architecture.. T3.large instances only support the x86_64 architecture. They do not support arm64. Therefore, the company cannot meet the requirement of supporting both x86_64 and arm64 architectures with t3.large instances. Options B and D are incorrect because t3.large does not support arm64, and a custom AMI cannot add architecture support beyond what the instance type offers. Option C is incorrect because t3.large is a current generation instance type, but that is not relevant to the architecture support limitation.

Answer

Yes, because t3.large supports both architectures.

Answer

No, because t3.large is not a current generation instance type.

Answer

Yes, but only if they use a custom AMI that supports both architectures.