SAP-C02 Continuous Improvement for Existing Solutions Practice Test 11 — 15 Questions

Question 1

A company runs a production database on Amazon RDS for PostgreSQL. They need to perform a major version upgrade with minimal downtime. Which strategy should they use?

Accepted Answer

Create a read replica of the current database using the new version, promote it, and update the connection string.. Option D is correct because creating a read replica with the new version, promoting it, and switching DNS minimizes downtime. Option A is wrong because in-place upgrade causes downtime. Option B is wrong because snapshots take time. Option C is wrong because DMS has overhead and potential lag.

Answer

Use AWS Database Migration Service (DMS) to replicate data to a new instance.

Answer

Create a new RDS instance with the new version and migrate data using pg_dump.

Answer

Take a snapshot of the database, perform an in-place upgrade, and restore if needed.

Question 2

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

Accepted Answer

Yes, because t3.large supports both architectures.. Option A is correct because the exhibit shows SupportedArchitectures includes both x86_64 and arm64, so t3.large supports both. Option B is wrong because it does support arm64. Option C is wrong because the architecture is chosen at launch, not automatically. Option D is wrong because t3.large is current generation.

Answer

No, because t3.large instances only support x86_64 architecture.

Answer

No, because t3.large is not a current generation instance type.

Answer

Yes, but only if they use a custom AMI that supports both architectures.

Question 3

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

Accepted Answer

Add a manual approval action in the pipeline stage with an SNS topic for notification.. Option C is correct because CodePipeline supports a manual approval action using SNS notification. Option A is wrong because approval is not a Lambda function. Option B is wrong because CloudWatch Events is not for approvals. Option D is wrong because approval is a built-in action.

Answer

Use Amazon CloudWatch Events to trigger an SNS topic for approval.

Answer

Create a custom action using AWS CodeDeploy.

Answer

Add a Lambda function that sends an email and pauses the pipeline until a token is provided.

Question 4

A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Option B is correct because enabling default encryption on the bucket ensures all new objects are encrypted. Option A is wrong because bucket policy can be circumvented. Option C is wrong because CloudTrail only logs. Option D is wrong because versioning does not enforce encryption.

Answer

Use AWS CloudTrail to monitor for unencrypted objects.

Answer

Enable S3 Versioning to protect objects.

Answer

Create a bucket policy that denies PutObject if the object is not encrypted.

Question 5

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. Option D is correct because ECS tasks should be launched in the same VPC and security group as the database, or use VPC peering/transit gateway. Option A is wrong because NAT gateway is for outbound. Option B is wrong because public subnet tasks cannot directly access private RDS without proper routing. Option C is wrong because VPN is overkill.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 6

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Accepted Answer

Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.. Option C is correct because AWS Config rules can trigger custom Lambda functions to evaluate resources and send notifications. Option A is wrong because CloudTrail logs API calls but does not directly evaluate resource compliance. Option B is wrong because S3 events do not trigger on policy changes by default. Option D is wrong because Config rules do not directly publish to SNS.

Answer

Configure S3 event notifications on the bucket to send events to SNS.

Answer

Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.

Answer

Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.

Question 7

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. Option A is correct because Lambda functions in a VPC require a NAT gateway or VPC endpoints to access external services; without it, they cannot reach the internet, causing timeouts. Option C is wrong because Lambda automatically scales. Option D is wrong because the function already has a VPC configuration. Option B is wrong because concurrent executions do not cause timeouts.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 8

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

Accepted Answer

Create a read replica from the latest automated snapshot and enable Performance Insights on the replica.. Option B is correct because creating a read replica from the latest snapshot provides a near-current copy without impacting production. Option A is wrong because enabling Performance Insights on the current instance adds overhead. Option C is wrong because querying the production database directly affects performance. Option D is wrong because CloudWatch metrics alone do not show query-level details.

Answer

Use the enhanced monitoring feature to collect OS-level metrics on the production instance.

Answer

Review Amazon CloudWatch metrics for the production DB instance to identify the cause.

Answer

Enable Performance Insights on the production instance to analyze queries.

Question 9

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

Accepted Answer

View the stopped task logs in Amazon CloudWatch Logs.. Option D is correct because checking the stopped task logs in CloudWatch Logs reveals application errors. Option A is wrong because the task definition is likely correct if the old tasks work. Option B is wrong because the service event stream shows deployment events, not task logs. Option C is wrong because ECS Exec requires the task to be running.

Answer

Review the task definition for misconfigured environment variables.

Answer

Check the ECS service event stream for error messages.

Answer

Use ECS Exec to connect to the failing tasks and debug.

Question 10

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

Accepted Answer

Rerun the stack update with the --disable-rollback flag and then describe the stack events.. Option C is correct because disabling rollback on failure allows the stack to remain in a failed state for investigation. Option A is wrong because you cannot describe stack events of a deleted stack. Option D is wrong because creating a change set does not help with the current failure. Option B is wrong because you can check the specific resource status reason.

Answer

Delete the stack and review the CloudFormation logs.

Answer

Create a change set to preview the updates.

Answer

Use the AWS CLI describe-stack-resources command to see the status of each resource.

Question 11

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

Accepted Answer

The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.. Option B is correct because API Gateway caches authorizer responses; if the cache is enabled and the token is cached with a deny, subsequent requests with the same token will fail. Option A is wrong because the authorizer is being invoked. Option C is wrong because token expiration would cause a different error. Option D is wrong because the Lambda function returns a policy.

Answer

The Lambda function is returning a malformed IAM policy.

Answer

The token has expired.

Answer

The Lambda authorizer is not being invoked due to throttling.

Question 12

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Accepted Answer

Enable default encryption on each S3 bucket.. Option B is correct because S3 default encryption can be set at the bucket level for all objects. Option A is wrong because bucket policies can enforce encryption but require a policy per bucket. Option C is wrong because AWS Config can detect noncompliant buckets but not enforce encryption. Option D is wrong because IAM policies cannot enforce encryption on S3 buckets.

Answer

Create an IAM policy that denies s3:PutObject unless encryption headers are present.

Answer

Use an S3 bucket policy to deny PutObject without encryption.

Answer

Use AWS Config to automatically remediate noncompliant buckets.

Question 13

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in Europe report slow load times. The CloudFront distribution uses the default cache behavior. What is the MOST cost-effective improvement?

Accepted Answer

Configure CloudFront with multiple origins and use geographic restrictions to route users to the nearest origin.. Option B is correct because adding multiple origins in different regions and using geographic distribution or origin failover reduces latency for users in Europe. Option A is wrong because Lambda@Edge adds cost and complexity. Option C is wrong because cache behaviors do not affect latency. Option D is wrong because Transfer Acceleration is for uploads.

Answer

Enable CloudFront Lambda@Edge to optimize content delivery.

Answer

Use an S3 Transfer Acceleration to speed up content delivery.

Answer

Add additional cache behaviors to serve different content from different origins.

Question 14

A company runs a stateful web application on EC2 instances behind an Application Load Balancer (ALB). The application uses WebSockets for real-time communication. During scale-in events, users experience disconnections. How can the company maintain WebSocket connections during scaling?

Accepted Answer

Enable connection draining on the ALB target group.. Option D is correct because enabling connection draining on the ALB target group allows in-flight requests and WebSocket connections to complete before the instance is deregistered. Option A is wrong because sticky sessions do not prevent disconnections during scale-in. Option B is wrong because ASG lifecycle hooks do not affect ALB connections. Option C is wrong because a Network Load Balancer is for TCP/UDP, not HTTP/WebSocket at the application layer.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Answer

Use sticky sessions (session affinity) on the ALB.

Answer

Use an Auto Scaling lifecycle hook to delay instance termination.

Question 15

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

Accepted Answer

Increase the read capacity units for the table.. Options B and C are correct. Adding a Global Secondary Index with a different partition key can distribute reads across partitions. Adjusting read capacity units increases throughput. Option A is wrong because changing the sort key would require a new table. Option D is wrong because DynamoDB Accelerator (DAX) improves read performance but is not a capacity change. Option E is wrong because table replication is for disaster recovery.

Answer

Use DynamoDB global tables to replicate data to another region.

Answer

Enable DynamoDB Accelerator (DAX) for the table.

Answer

Change the table's sort key to a more evenly distributed attribute.