SAP-C02 Continuous Improvement for Existing Solutions Practice Test 12 — 15 Questions

Question 1

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

Accepted Answer

Add a manual approval action in the pipeline stage with an SNS topic for notification.. AWS CodePipeline provides a built-in manual approval action that can be added to a pipeline stage, which sends an SNS notification to approvers. Option B is incorrect because CloudWatch Events is used for event-driven automation, not for manual approvals. Option C is incorrect because AWS CodeDeploy is a deployment service, not for approval steps. Option D is incorrect because while a Lambda function could be used, CodePipeline has a native approval action that is simpler and more appropriate.

Answer

Use Amazon CloudWatch Events to trigger an SNS topic for approval.

Answer

Create a custom action using AWS CodeDeploy.

Answer

Add a Lambda function that sends an email and pauses the pipeline until a token is provided.

Question 2

A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the bucket ensures all new objects are encrypted. Option A is wrong because CloudTrail only logs and does not enforce encryption. Option C is wrong because versioning does not enforce encryption. Option D is wrong because a bucket policy that denies PutObject if not encrypted can be circumvented or does not cover existing objects, but default encryption is more straightforward.

Answer

Use AWS CloudTrail to monitor for unencrypted objects.

Answer

Enable S3 Versioning to protect objects.

Answer

Create a bucket policy that denies PutObject if the object is not encrypted.

Question 3

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. ECS tasks should be launched in the same private subnet as the RDS instance to allow direct network communication via VPC routing, without needing internet gateways or NAT. Option B is incorrect because placing ECS tasks in a public subnet with a NAT gateway would require traffic to go through the NAT, but NAT gateways are for outbound internet access, not for inbound traffic to private resources; also, public subnets have direct internet access which is unnecessary and could introduce security risks. Option C is incorrect because a VPN connection is typically used for on-premises to VPC connectivity, not for internal VPC communication; VPC routing and security groups are sufficient. Option D is incorrect because an Application Load Balancer is used for load balancing HTTP/HTTPS traffic to application targets, not for routing internal database traffic; it would add unnecessary complexity and latency.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 4

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Accepted Answer

Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.. AWS Config rules can trigger custom Lambda functions to evaluate the S3 bucket policy and publish a notification to SNS if the policy allows public access. Option B is incorrect because S3 event notifications are triggered by object-level events (e.g., PUT, POST), not by policy changes. Option C is incorrect because AWS Config rules cannot directly publish to SNS; they require a Lambda function or other action to send notifications. Option D is incorrect because CloudTrail logs API calls but does not provide real-time compliance evaluation or direct notification.

Answer

Configure S3 event notifications on the bucket to send events to SNS.

Answer

Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.

Answer

Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.

Question 5

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. The most likely cause of the timeout is that the Lambda function is attached to a VPC but does not have a NAT gateway or VPC endpoints to access external resources (Option D). When a Lambda function is configured to run in a VPC, it loses default internet access. To access external services (such as an external database or API), the function needs a NAT gateway in a public subnet or VPC endpoints for the specific services. Without this, the function will timeout when trying to reach external resources. Option A is incorrect because cold starts cause latency but not consistent timeouts. Option B is incorrect because hitting the concurrent execution limit would cause throttling (HTTP 429 or 500 errors), not timeouts. Option C is incorrect because attaching to a public subnet would not help; Lambda functions cannot have public IPs in a VPC by default, and a public subnet does not provide internet access without an internet gateway and route table updates.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 6

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

Accepted Answer

Create a read replica from the latest automated snapshot and enable Performance Insights on the replica.. Creating a read replica from the latest automated snapshot provides a near-current copy of the database without impacting the production instance. This allows the team to enable Performance Insights on the replica to analyze query performance and investigate the write IOPS spike safely. Option A is wrong because enhanced monitoring provides OS-level metrics but not query-level details needed for this investigation. Option B is wrong because CloudWatch metrics show overall performance but not individual queries. Option C is wrong because enabling Performance Insights on the production instance could add overhead and impact performance.

Answer

Use the enhanced monitoring feature to collect OS-level metrics on the production instance.

Answer

Review Amazon CloudWatch metrics for the production DB instance to identify the cause.

Answer

Enable Performance Insights on the production instance to analyze queries.

Question 7

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

Accepted Answer

View the stopped task logs in Amazon CloudWatch Logs.. When tasks fail health checks and are stopped, their logs are sent to CloudWatch Logs (if configured). Viewing the stopped task logs reveals application errors that caused the health check failure. Option B is incorrect because misconfigured environment variables would likely affect the old running tasks as well; the issue is specific to new tasks, so the task definition is probably fine. Option C is incorrect because the ECS service event stream shows deployment events (like rollback triggers) but not the detailed error logs of the failing tasks. Option D is incorrect because ECS Exec requires the task to be running; since the tasks are failing health checks and stopping, ECS Exec cannot connect to them.

Answer

Review the task definition for misconfigured environment variables.

Answer

Check the ECS service event stream for error messages.

Answer

Use ECS Exec to connect to the failing tasks and debug.

Question 8

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

Accepted Answer

Rerun the stack update with the --disable-rollback flag and then describe the stack events.. Using the --disable-rollback flag when rerunning the update prevents the stack from rolling back on failure, allowing the team to describe stack events and investigate the specific error without losing the failed state. Option B is incorrect because deleting the stack would remove the failure logs and prevent investigation. Option C is incorrect because a change set is used to preview updates before execution, not to troubleshoot a failure that has already occurred. Option D is incorrect because describe-stack-resources only shows resource status (e.g., CREATE_FAILED) but does not provide the detailed error reason; you need stack events to see the specific error message.

Answer

Delete the stack and review the CloudFormation logs.

Answer

Create a change set to preview the updates.

Answer

Use the AWS CLI describe-stack-resources command to see the status of each resource.

Question 9

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

Accepted Answer

The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.. API Gateway caches the authorizer result based on the token. If a previous request with the same token was denied (e.g., due to an invalid token at that time), the cached deny policy will be used for subsequent requests even if the token is now valid, causing a 401 error. Option A is incorrect because the Lambda authorizer is being invoked successfully and returning a policy; the issue is with caching. Option B is incorrect because the problem states tokens are valid, not expired. Option C is incorrect because throttling would result in the authorizer not being invoked, but the logs show it is invoked.

Answer

The Lambda function is returning a malformed IAM policy.

Answer

The token has expired.

Answer

The Lambda authorizer is not being invoked due to throttling.

Question 10

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Accepted Answer

Enable default encryption on each S3 bucket.. Enabling default encryption on each S3 bucket ensures that all objects uploaded to that bucket are automatically encrypted, enforcing the policy across existing and future buckets. Option B is wrong because an IAM policy that denies s3:PutObject without encryption headers only applies when the request includes encryption headers; it does not enforce encryption for all objects, and it depends on the caller including the headers. Option C is wrong because while an S3 bucket policy can deny PutObject without encryption, it requires a policy per bucket and does not automatically remediate existing buckets. Option D is wrong because AWS Config can detect noncompliant buckets but requires a custom remediation action to enable encryption; it does not automatically enforce encryption without additional setup.

Answer

Create an IAM policy that denies s3:PutObject unless encryption headers are present.

Answer

Use an S3 bucket policy to deny PutObject without encryption.

Answer

Use AWS Config to automatically remediate noncompliant buckets.

Question 11

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in Europe report slow load times. The CloudFront distribution uses the default cache behavior. What is the MOST cost-effective improvement?

Accepted Answer

Enable CloudFront Lambda@Edge to optimize content delivery.. Using Lambda@Edge to route users based on their geographic location can direct European users to a closer CloudFront distribution or origin, reducing latency. This approach is cost-effective as it avoids the need for additional infrastructure. Option B is incorrect because S3 Transfer Acceleration is designed for uploads, not for accelerating content delivery to end users. Option C is incorrect because geographic restrictions are for access control, not routing; they cannot route users to the nearest origin. Option D is incorrect because additional cache behaviors control caching policies, not which origin serves content; they do not inherently reduce latency.

Answer

Use an S3 Transfer Acceleration to speed up content delivery.

Answer

Configure CloudFront with multiple origins and use geographic restrictions to route users to the nearest origin.

Answer

Add additional cache behaviors to serve different content from different origins.

Question 12

A company runs a stateful web application on EC2 instances behind an Application Load Balancer (ALB). The application uses WebSockets for real-time communication. During scale-in events, users experience disconnections. How can the company maintain WebSocket connections during scaling?

Accepted Answer

Enable connection draining on the ALB target group.. Connection draining on the ALB target group allows existing WebSocket connections to complete before the instance is terminated, preventing disconnections during scale-in. Option A is wrong because an NLB is not required for WebSockets; ALB supports WebSocket connections. Option B is wrong because sticky sessions alone do not prevent disconnections during scale-in. Option D is wrong because lifecycle hooks can delay termination but do not handle existing connections; connection draining is specifically designed for this purpose.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Answer

Use sticky sessions (session affinity) on the ALB.

Answer

Use an Auto Scaling lifecycle hook to delay instance termination.

Question 13

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

Accepted Answer

Increase the read capacity units for the table.. Increasing read capacity units (RCUs) directly increases the number of read operations per second, reducing latency during peak hours. Option C is correct because DynamoDB Accelerator (DAX) is an in-memory cache that significantly reduces read latency by caching frequently accessed items. Option E, adding a Global Secondary Index (GSI), can improve query performance but not necessarily overall read latency for existing access patterns; it is a design change that may not address peak-hour latency directly. Option A is incorrect because global tables are for multi-region replication, not single-region performance. Option D is incorrect because changing the sort key does not improve read performance; sort key affects ordering within a partition, not throughput.

Answer

Use DynamoDB global tables to replicate data to another region.

Answer

Change the table's sort key to a more evenly distributed attribute.

Answer

Add a Global Secondary Index with a different partition key.

Question 14

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

Accepted Answer

Increase the SQS queue's visibility timeout to 6 minutes.. To prevent duplicate processing, the team should increase the SQS queue's visibility timeout to 6 minutes (option A). Since each message takes about 30 seconds to process, the default 60-second visibility timeout is too short; if processing exceeds 60 seconds, the message becomes visible again and is reprocessed. Increasing the timeout to 6 minutes (well above the 30-second processing time) ensures the message remains invisible until processing is complete. Additionally, switching to a FIFO SQS queue with content-based deduplication (option C) provides exactly-once processing semantics, eliminating duplicates regardless of visibility timeout. Option B is incorrect because reserved concurrency limits the number of concurrent Lambda executions but does not prevent duplicates from visibility timeout issues. Option D is incorrect because reducing batch size limits how many messages are polled at once but does not address the root cause of duplicate processing. Option E is incorrect because a dead-letter queue handles messages that fail repeatedly, not duplicates.

Answer

Set the Lambda function's reserved concurrency to 1.

Answer

Reduce the SQS batch size to 1.

Answer

Configure a dead-letter queue for the SQS queue.

Question 15

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which TWO components are required?

Accepted Answer

AWS Cloud Map. Only AWS Cloud Map (A) and Amazon Route 53 (D) are required for DNS-based service discovery. AWS Cloud Map allows services to register with DNS names and health checks, while Route 53 can be configured with private hosted zones to resolve those DNS names within the VPC. An Application Load Balancer (E) is not required because service discovery can be achieved solely through Cloud Map and Route 53 without any load balancer. ECS Service Connect (C) and Network Load Balancer (B) are also not required for basic DNS-based service discovery.

Answer

Network Load Balancer (NLB)

Answer

Amazon ECS Service Connect

Answer

Application Load Balancer (ALB)