SAP-C02 Continuous Improvement for Existing Solutions Practice Test 12 — 15 Questions

Question 1

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Edit the CloudFormation template to change the DBInstanceClass and update the stack directly.. Modifying the DBInstanceClass property in the CloudFormation template and updating the stack directly is the correct approach because CloudFormation will perform an in-place update of the RDS instance. For RDS, changing the instance class triggers a modification that can be applied with minimal downtime (typically a brief failover if Multi-AZ is enabled). This is the standard, supported method for updating RDS instance class via CloudFormation.

Answer

Modify the DBInstanceClass property in the CloudFormation template and use an UpdatePolicy of AutoScalingReplacingUpdate.

Answer

Create a new CloudFormation stack with the new DB instance class and delete the old stack.

Answer

Use AWS OpsWorks to manage the DB instance and apply the change.

Question 2

A company has a production AWS Lambda function that processes data from an Amazon SQS queue. The function often experiences throttling errors. The company wants to implement a solution to reduce throttling and improve processing performance. Which solution meets these requirements?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Increasing the reserved concurrency for the Lambda function guarantees that the function can process more invocations concurrently, reducing throttling errors. Option A is incorrect because SQS queues do not have a configurable concurrency limit; concurrency is managed at the Lambda function level. Option C is incorrect because distributing messages across multiple queues does not increase the function's concurrency; each queue invocation still counts toward the same reserved concurrency. Option D, increasing the batch size, can improve throughput per invocation but does not reduce throttling caused by insufficient concurrency.

Answer

Configure the SQS queue to use a higher concurrency limit.

Answer

Create additional SQS queues and distribute messages across them.

Answer

Increase the batch size of the Lambda event source mapping.

Question 3

A Solutions Architect is reviewing an Amazon S3 bucket policy that grants access to users from another AWS account. The policy uses the Principal element with "AWS": "arn:aws:iam::123456789012:root". The users in the other account are unable to access the bucket. What is the most likely cause?

Accepted Answer

The policy must specify the IAM user ARN, not the root user ARN.. The root user ARN does not grant access to individual IAM users; the policy must allow the entire account or specific user ARNs. Option B is wrong because the bucket policy can refer to another account. Option C is wrong because S3 does not require VPC endpoints for cross-account access. Option D is wrong because the bucket policy can use IAM user ARNs.

Answer

The bucket policy must also include a VPC endpoint condition.

Answer

Cross-account access is not supported with bucket policies.

Answer

The bucket policy must use the CanonicalUser ID instead of the account ID.

Question 4

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences high latency during peak hours. The company wants to improve performance by enabling HTTP/2. What is the simplest way to achieve this?

Accepted Answer

Enable HTTP/2 on the Application Load Balancer's HTTPS listener.. Application Load Balancers natively support HTTP/2 for client connections when using an HTTPS listener. Enabling HTTP/2 on the ALB's HTTPS listener is a simple configuration change that requires no modifications to the backend EC2 instances, as the ALB handles protocol translation. This directly addresses the requirement to improve performance via HTTP/2 with minimal effort.

Answer

Configure the EC2 instances to support HTTP/2.

Answer

Place an Amazon CloudFront distribution in front of the ALB and enable HTTP/2.

Answer

Upgrade the load balancer to a Network Load Balancer.

Question 5

A company is using an AWS Direct Connect connection to access its VPC. The company is experiencing intermittent connectivity issues. The Solutions Architect suspects a routing problem. Which AWS service can help diagnose the issue by providing real-time metrics and logs?

Accepted Answer

Amazon CloudWatch with Direct Connect metrics. Amazon CloudWatch provides real-time metrics for AWS Direct Connect connections, including ConnectionState, ConnectionBpsEgress/Ingress, ConnectionPpsEgress/Ingress, and ConnectionErrorCount. These metrics help diagnose intermittent connectivity issues by revealing patterns such as drops in throughput, error spikes, or state changes. CloudWatch also integrates with Direct Connect logs (e.g., virtual interface logs) to provide detailed diagnostic information. Thus, CloudWatch is the correct service for real-time monitoring and diagnosis of Direct Connect routing problems.

Answer

VPC Flow Logs

Answer

AWS CloudTrail

Answer

AWS Trusted Advisor

Question 6

A company has an Amazon S3 bucket that stores sensitive data. The company wants to ensure that all data in the bucket is encrypted at rest. Which action should the Solutions Architect take?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3, SSE-KMS, or SSE-C.. Enabling default encryption on the S3 bucket ensures all objects are automatically encrypted at rest using SSE-S3, SSE-KMS, or SSE-C. Option B is wrong because AWS CloudHSM is a hardware-based key management service, but it is not required for encrypting data at rest in S3; default encryption or bucket policies can enforce encryption without CloudHSM. Option C is wrong because a bucket policy can deny uploads of unencrypted objects, but it does not encrypt existing data; it only enforces encryption for new uploads. Option D is wrong because pre-signed URLs grant temporary access to upload objects but do not enforce encryption; encryption must be enforced separately.

Answer

Use AWS CloudHSM to manage encryption keys.

Answer

Configure a bucket policy that denies unencrypted uploads.

Answer

Require the use of pre-signed URLs for uploads.

Question 7

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. To improve recovery time in the event of an AZ failure, which TWO actions should the company take? (Choose two.)

Accepted Answer

Create an Amazon Machine Image (AMI) from the instance.. Option A is correct because creating an AMI from the instance captures the OS, application, and configuration so the Auto Scaling group can quickly launch replacement instances in a healthy AZ after an AZ failure, improving recovery time. Option E is correct because configuring the Auto Scaling group to launch instances across multiple AZs ensures capacity remains available if one AZ fails, allowing the application to keep running and recover faster. Option B is not appropriate because EBS Multi-Attach only supports io1/io2 volumes within a single AZ and cannot attach a volume to instances in another AZ. Option C is not suitable because manually copying an EBS volume to another AZ is a manual, slow process and does not provide automated recovery. Option D is not the best fit because copying snapshots to another region addresses regional disaster recovery, not recovery from an AZ failure within the same region.

Answer

Use EBS multi-attach to attach the volume to instances in another AZ.

Answer

Copy the EBS volume to another AZ using the AWS Management Console.

Answer

Take regular EBS snapshots and copy them to another region.

Question 8

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage and a deploy stage. The company wants to add a test stage that runs automated integration tests after the build stage and before the deploy stage. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Configure AWS CodeBuild to run the integration tests as part of the test stage.. Option A is correct because AWS CodeBuild is the native build/test service that CodePipeline invokes as an action provider; you can add a CodeBuild action in the test stage with a buildspec that runs the automated integration tests. Option C is correct because CodePipeline stages execute sequentially, so inserting a new test stage between the existing build and deploy stages is exactly how you enforce tests running after build and before deploy. Option E is correct because a manual approval action placed after the test stage gates the pipeline so deployment proceeds only after the tests pass and a reviewer approves, which is a standard CodePipeline pattern for controlled releases. Option B is not required: CloudFormation can provision test infrastructure, but the question asks how to add the test stage and run tests, not how to create the environment. Option D is not appropriate here because Lambda is not the standard mechanism for running integration test suites; CodeBuild is designed for that purpose.

Answer

Use AWS CloudFormation to create a test environment.

Answer

Use an AWS Lambda function to run the integration tests.

Question 9

An IAM policy is attached to an IAM user. The user reports being unable to download objects from the bucket 'example-bucket' when connecting from their office IP address 203.0.113.5. What is the most likely reason?

Accepted Answer

The user's IP address is not in the allowed range.. The most likely reason is that the IAM policy includes a condition restricting access to a specific IP range that does not include 203.0.113.5. The aws:SourceIp condition key is used to allow or deny based on the requester's IP address.

Answer

The condition key 'aws:SourceIp' is invalid.

Answer

The resource ARN is incorrect.

Answer

The s3:GetObject action is misspelled.

Question 10

A CloudFormation stack update failed with the above error. What is the likely cause?

Accepted Answer

The runtime is no longer supported by AWS Lambda.. The CloudFormation stack update failed because the Lambda function's configured runtime is no longer supported by AWS. AWS deprecates Lambda runtimes on a published schedule (e.g., Node.js 12, Python 3.6), and after the deprecation date, CreateFunction and UpdateFunctionConfiguration calls using that runtime fail with an InvalidParameterValue or similar error. CloudFormation surfaces this as a stack update failure.

Answer

The S3 bucket does not contain the zip file.

Answer

The IAM role ARN is incorrect.

Answer

The timeout value is too high.

Question 11

A company is using AWS Lambda functions to process files uploaded to an S3 bucket. Recently, the processing time has increased significantly. A solutions architect notices that the Lambda functions are using the default VPC configuration. What is the MOST likely cause of the performance degradation?

Accepted Answer

Lambda function is attached to a VPC, causing network latency for S3 API calls.. When a Lambda function is attached to a VPC, all outbound traffic to AWS services like S3 goes through the VPC's networking layer (ENIs, subnets, route tables, NAT gateways) rather than the direct AWS backbone. This adds latency and potential bandwidth bottlenecks, especially if the VPC lacks proper S3 Gateway Endpoints. The default VPC configuration often lacks these optimizations, causing the observed performance degradation.

Answer

Lambda function is using too much memory.

Answer

S3 bucket has versioning enabled, causing extra overhead.

Answer

S3 bucket is in a different region.

Question 12

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless encryption is specified.. SCPs are the only AWS Organizations mechanism that can proactively block an API action before it succeeds. An SCP denying s3:CreateBucket unless the request includes server-side encryption with AES-256 (e.g., via the s3:x-amz-server-side-encryption condition key) prevents any non-compliant bucket from ever being created in member accounts. This is preventive, organization-wide, and cannot be bypassed by account-level IAM permissions.

Answer

Use CloudTrail to monitor bucket creation and alert security team.

Answer

Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.

Answer

Use AWS Config rules to detect non-compliant buckets and auto-remediate.

Question 13

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

Accepted Answer

Use a rolling update with a lifecycle hook to gracefully handle connections and unmount the file system before instance termination.. A rolling update with a lifecycle hook allows the Auto Scaling group to gracefully handle connections and unmount the shared file system before terminating instances. This minimizes downtime by ensuring that instances are drained of connections and that the file system is cleanly unmounted, preventing data corruption and service interruption. The lifecycle hook pauses the termination process, giving time for graceful shutdown.

Answer

Use an in-place update without any hooks.

Answer

Perform a blue/green deployment.

Answer

Terminate all instances and launch new ones.

Question 14

A company is running a production web application on Amazon EKS. The application experiences intermittent latency spikes. The operations team suspects that the issue is related to pod networking. Which THREE tools should they use to diagnose the issue? (Choose 3)

Accepted Answer

VPC Flow Logs. VPC Flow Logs (B) are correct because they capture IP traffic metadata (source/destination IP, ports, protocol, ACCEPT/REJECT) for ENIs used by EKS pods, letting the team spot dropped packets, security group or NACL blocks, and cross-AZ traffic patterns that cause latency spikes. Amazon CloudWatch Logs (C) is correct because EKS control plane logs (api, audit, authenticator, controllerManager, scheduler) and application/container logs can be shipped there to correlate networking errors such as DNS resolution failures, CNI plugin errors, or connection timeouts with the latency events. Amazon CloudWatch Container Insights (D) is correct because it collects pod- and node-level metrics (CPU, memory, network RX/TX, packet drops) via the CloudWatch agent and Fluent Bit, enabling the team to pinpoint which pods or nodes exhibit network throughput anomalies during the spikes. tcpdump on worker nodes (A) is not among the marked answers because it requires privileged host access and manual packet capture, which is impractical and not a managed diagnostic tool for this scenario. AWS CodePipeline (E) is unrelated to network diagnostics, as it is a CI/CD orchestration service.

Answer

tcpdump on worker nodes

Answer

AWS CodePipeline

Question 15

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

Accepted Answer

No, because the policy denies the request.. The IAM policy likely includes a Deny statement for s3:PutObject when the request lacks encryption headers (e.g., x-amz-server-side-encryption). Since an explicit Deny always overrides any Allow, the upload will fail. The user cannot override this with other permissions.

Answer

Yes, because the user can override the policy with s3:PutObjectAcl.

Answer

Yes, because the bucket has default encryption enabled.

Answer

No, because the user needs additional permissions.