SAP-C02 Continuous Improvement for Existing Solutions Practice Test 12 — 15 Questions

Question 1

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

Accepted Answer

Increase the SQS queue's visibility timeout to 6 minutes.. Options B and D are correct. Increasing the visibility timeout to 6 minutes prevents the message from becoming visible again before processing completes. Enabling FIFO queues with deduplication ensures exactly-once processing. Option A is wrong because Lambda does not support reserved concurrency for SQS triggers in a way that prevents duplicates. Option C is wrong because a dead-letter queue handles failures, not duplicates. Option E is wrong because reducing batch size does not prevent duplicates.

Answer

Set the Lambda function's reserved concurrency to 1.

Answer

Reduce the SQS batch size to 1.

Answer

Configure a dead-letter queue for the SQS queue.

Question 2

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which THREE components are required?

Accepted Answer

AWS Cloud Map. Options A, C, and E are correct. An Application Load Balancer provides DNS names for services. AWS Cloud Map enables service discovery with custom DNS names. Amazon Route 53 can be used to register custom domain names. Option B is wrong because Amazon ECS Service Connect is a feature for service discovery but is not required; it can be used instead of Cloud Map. Option D is wrong because Network Load Balancer is not required for DNS-based discovery.

Answer

Network Load Balancer (NLB)

Answer

Amazon ECS Service Connect

Question 3

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

Accepted Answer

Yes, because the request matches the Allow condition and the Deny condition does not apply.. Option A is correct. The first statement allows GET from the specified IP range. The second statement denies all actions if not using HTTPS. Since the request uses HTTPS (SecureTransport true), the Deny condition does not apply, so the Allow takes effect.

Answer

No, because the Deny statement explicitly denies all actions.

Answer

Yes, because the IP address is within the allowed range.

Answer

No, because the Deny statement overrides the Allow statement.

Question 4

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Accepted Answer

The NAT gateway is not in a public subnet with an internet gateway.. Option C is correct. The route table has a route to a NAT gateway in the same subnet, but the NAT gateway must be in a public subnet with an internet gateway. If the NAT gateway is in a private subnet, it cannot route to the internet. Option A is wrong because there is a default route. Option B is wrong because the local route is present. Option D is wrong because the route table is associated with the subnet.

Answer

The route table does not have a default route (0.0.0.0/0).

Answer

The VPC does not have a local route.

Answer

The route table is not associated with the subnet.

Question 5

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. Option B is correct. ResourceNotFoundException indicates the DynamoDB table does not exist or has been deleted. Option A is wrong because insufficient permissions cause AccessDeniedException. Option C is wrong because throttling causes ProvisionedThroughputExceededException. Option D is wrong because a different error would occur if the function timed out.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 6

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

Accepted Answer

Configure an SQS queue as the Lambda event source with a dead-letter queue for failed messages.. Option D is correct because SQS with a dead-letter queue provides reliable capture and retry of failed Lambda invocations. Option A is wrong because CloudWatch Logs only capture logs, not failed invocations. Option B is wrong because SNS does not store messages for retries. Option C is wrong because EventBridge does not automatically retry failed Lambda invocations.

Answer

Enable CloudWatch Logs for Lambda and create a metric filter to trigger an alarm.

Answer

Use Amazon EventBridge to capture Lambda errors and route them to a recovery function.

Answer

Publish failed invocation details to an SNS topic and subscribe a Lambda function to process them.

Question 7

A media company runs a video transcoding pipeline on AWS using Amazon EC2 Spot Instances. The pipeline uses a custom AMI with pre-installed software. The operations team notices that the latest AMI is not always used when new instances launch, causing inconsistent transcoding results. What should the team do to ensure that all new Spot Instances use the latest AMI?

Accepted Answer

Use an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store.. Option A is correct because Amazon EC2 Auto Scaling with a launch template can reference the latest AMI ID using SSM Parameter Store. Option B is wrong because updating the AMI ID in the Auto Scaling group requires manual intervention. Option C is wrong because it does not automatically update the AMI. Option D is wrong because CloudFormation does not automatically update the AMI.

Answer

Create a new launch configuration each time a new AMI is released and associate it with the Auto Scaling group.

Answer

Use AWS CloudFormation to update the stack with the new AMI ID and then manually trigger a rolling update.

Answer

Manually update the AMI ID in the EC2 Auto Scaling group configuration every time a new AMI is released.

Question 8

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

Accepted Answer

Enable slow query logging and stream logs to Amazon CloudWatch Logs with a retention policy of 30 days.. Option B is correct because CloudWatch Logs can stream RDS slow query logs and retain them for 30 days at low cost. Option A is wrong because storing in S3 directly is not a built-in RDS feature. Option C is wrong because RDS doesn't write logs to EBS volumes by default. Option D is wrong because it requires additional infrastructure and cost.

Answer

Enable slow query logging and use an RDS event subscription to send logs to an SQS queue for processing.

Answer

Enable slow query logging and store logs in an S3 bucket with lifecycle policy to delete after 30 days.

Answer

Enable slow query logging and store logs on the RDS instance's EBS volume, then take daily snapshots.

Question 9

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

Accepted Answer

Add an HTTPS listener to the ALB using an ACM certificate, and configure the HTTP listener to redirect to HTTPS.. Option C is correct because creating an HTTPS listener with an ACM certificate and redirecting HTTP to HTTPS ensures encryption. Option A is wrong because CloudFront adds complexity and cost. Option B is wrong because a TCP listener does not terminate TLS. Option D is wrong because ACM cannot be directly associated with a TCP listener.

Answer

Replace the ALB with a Network Load Balancer and associate an ACM certificate with it.

Answer

Change the ALB listener to TCP and use a self-signed certificate on the EC2 instances.

Answer

Place a CloudFront distribution in front of the ALB and configure HTTPS between viewers and CloudFront.

Question 10

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

Accepted Answer

Change the task placement strategy to spread across Availability Zones.. Option D is correct because the spread strategy distributes tasks across availability zones, reducing contention. Option A is wrong because increasing memory doesn't address placement. Option B is wrong because more tasks could worsen contention. Option C is wrong because GPU instances are not relevant.

Answer

Increase the memory and CPU for each task definition to reduce contention.

Answer

Increase the number of tasks to distribute the load evenly.

Answer

Use a launch type of EC2 with GPU instances to handle the load.

Question 11

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

Accepted Answer

Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.. Option C is correct because SSE-KMS provides centralized key management and access control. Option A is wrong because SSE-S3 keys are managed by AWS, not the customer. Option B is wrong because client-side encryption does not use S3 server-side encryption. Option D is wrong because bucket policies control access to objects, not encryption keys.

Answer

Configure an S3 bucket policy to allow only specific IAM roles to put objects.

Answer

Continue using SSE-S3 and enable S3 Block Public Access.

Answer

Use client-side encryption with an AWS KMS key.

Question 12

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

Accepted Answer

Create a target tracking scaling policy using the custom metric as the target.. Option B is correct because a target tracking scaling policy automatically adjusts capacity based on the metric. Option A is wrong because step scaling is more complex and less efficient. Option C is wrong because scheduled scaling is for predictable patterns. Option D is wrong because Lambda is not needed for this.

Answer

Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

Answer

Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

Answer

Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

Question 13

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

Accepted Answer

Create an Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and use a load balancer.. Option D is correct because AMI-backed instances launch from a stored AMI, and data on instance store is ephemeral; the application should store data on EBS. Option A is wrong because high availability requires multiple instances. Option B is wrong because Multi-Attach is for specific use cases. Option C is wrong because EBS snapshots are for backups, not quick recovery.

Answer

Take frequent EBS snapshots and automate the creation of a new instance from the latest snapshot.

Answer

Configure the EBS volume as a Multi-Attach volume and attach it to a standby instance.

Answer

Convert the instance to an AMI and launch a new instance from that AMI in a different Availability Zone.

Question 14

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.. Option B is correct because a metric filter can create a metric from log events, and an alarm can trigger when the metric breaches a threshold. Option A is wrong because CloudWatch Logs Insights is for querying, not real-time alerting. Option C is wrong because an S3 event notification is for S3 events, not log content. Option D is wrong because Lambda subscriptions are for real-time processing, but simpler is metric filter + alarm.

Answer

Configure S3 event notifications on the log file destination to send an alert.

Answer

Subscribe a Lambda function to the log group and have it check for the error message.

Answer

Use CloudWatch Logs Insights to run a query periodically and send results via email.

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

Accepted Answer

Switch from a step scaling policy to a target tracking scaling policy based on CPU utilization.. Options A and C are correct. A buffer-based scaling policy (target tracking) is more responsive than step scaling. Decreasing the cooldown period allows faster scaling out. B is wrong because increasing instance size does not improve scaling responsiveness. D is wrong because decreasing minimum size could worsen performance. E is wrong because increasing cooldown slows down scaling.

Answer

Increase the instance size to handle more traffic per instance.

Answer

Increase the health check grace period for the Auto Scaling group.

Answer

Decrease the minimum number of instances in the Auto Scaling group.