SAP-C02 Continuous Improvement for Existing Solutions Practice Test 13 — 15 Questions

Question 1

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

Accepted Answer

Yes, because the request matches the Allow condition and the Deny condition does not apply.. The first statement allows GET from the specified IP range. The second statement denies all actions if not using HTTPS. Since the request uses HTTPS (SecureTransport true), the Deny condition does not apply, so the Allow takes effect.

Answer

No, because the Deny statement explicitly denies all actions.

Answer

Yes, because the IP address is within the allowed range.

Answer

No, because the Deny statement overrides the Allow statement.

Question 2

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Accepted Answer

The NAT gateway is not in a public subnet with an internet gateway.. For an EC2 instance in a private subnet to access the internet via a NAT gateway, the NAT gateway must be deployed in a public subnet (with a route to an internet gateway). Option D correctly identifies that the NAT gateway is not in a public subnet with an internet gateway. Option A is incorrect because the route table does have a default route (0.0.0.0/0) pointing to the NAT gateway. Option B is incorrect because the VPC has a local route for internal traffic. Option C is incorrect because the route table is associated with the subnet (the exhibit shows the subnet ID). Therefore, the most likely cause is that the NAT gateway itself is in a private subnet, preventing it from reaching the internet.

Answer

The route table does not have a default route (0.0.0.0/0).

Answer

The VPC does not have a local route.

Answer

The route table is not associated with the subnet.

Question 3

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. A ResourceNotFoundException indicates that the specified DynamoDB table does not exist or has been deleted. Option A is incorrect because a Lambda timeout would result in a timeout error, not a ResourceNotFoundException. Option C is incorrect because insufficient permissions to access DynamoDB would produce an AccessDeniedException. Option D is incorrect because throttling by DynamoDB would cause a ProvisionedThroughputExceededException.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 4

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

Accepted Answer

Configure an SQS queue as the Lambda event source with a dead-letter queue for failed messages.. An SQS queue configured as a Lambda event source provides reliable invocation with retry logic, and a dead-letter queue (DLQ) captures messages that fail after all retries, preventing loss. Option A is wrong because CloudWatch Logs capture logs but do not capture or retry failed invocations. Option B is wrong because EventBridge can capture errors but does not provide built-in retry or a DLQ for Lambda throttling. Option D is wrong because SNS publishes messages but does not store them for retry; if the subscriber fails, the message is lost unless additional mechanisms are implemented.

Answer

Enable CloudWatch Logs for Lambda and create a metric filter to trigger an alarm.

Answer

Use Amazon EventBridge to capture Lambda errors and route them to a recovery function.

Answer

Publish failed invocation details to an SNS topic and subscribe a Lambda function to process them.

Question 5

A media company runs a video transcoding pipeline on AWS using Amazon EC2 Spot Instances. The pipeline uses a custom AMI with pre-installed software. The operations team notices that the latest AMI is not always used when new instances launch, causing inconsistent transcoding results. What should the team do to ensure that all new Spot Instances use the latest AMI?

Accepted Answer

Use an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store.. Using an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store ensures that new instances automatically use the most recent AMI without manual intervention. Option A is incorrect because launch configurations are immutable and cannot reference dynamic parameters like SSM Parameter Store; they require creating a new launch configuration each time the AMI changes. Option B is incorrect because CloudFormation updates require manual initiation and do not automatically track the latest AMI. Option C is incorrect because manually updating the AMI ID in the Auto Scaling group configuration is error-prone and not automated.

Answer

Create a new launch configuration each time a new AMI is released and associate it with the Auto Scaling group.

Answer

Use AWS CloudFormation to update the stack with the new AMI ID and then manually trigger a rolling update.

Answer

Manually update the AMI ID in the EC2 Auto Scaling group configuration every time a new AMI is released.

Question 6

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

Accepted Answer

Enable slow query logging and stream logs to Amazon CloudWatch Logs with a retention policy of 30 days.. The most cost-effective because Amazon RDS for MySQL can natively publish slow query logs to Amazon CloudWatch Logs with minimal setup. By setting a retention policy of 30 days in CloudWatch Logs, you avoid additional storage costs and complex configurations. Option B is not directly supported; exporting logs to S3 requires extra steps (e.g., via CloudWatch Logs export) and incurs added cost. Option A adds unnecessary complexity and cost with SQS. Option C is not feasible as RDS does not write slow query logs to EBS by default and snapshotting is not a log management solution.

Answer

Enable slow query logging and use an RDS event subscription to send logs to an SQS queue for processing.

Answer

Enable slow query logging and store logs in an S3 bucket with lifecycle policy to delete after 30 days.

Answer

Enable slow query logging and store logs on the RDS instance's EBS volume, then take daily snapshots.

Question 7

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

Accepted Answer

Add an HTTPS listener to the ALB using an ACM certificate, and configure the HTTP listener to redirect to HTTPS.. Adding an HTTPS listener to the ALB with an ACM certificate and configuring the HTTP listener to redirect to HTTPS ensures all traffic is encrypted in transit. This meets the security requirement directly without additional components. Option A is incorrect because Network Load Balancers do not support ACM certificates for TLS termination; they require TLS termination on the backend instances. Option B is incorrect because TCP listeners cannot terminate TLS, and self-signed certificates on EC2 instances would not provide trusted encryption for clients. Option C is incorrect because while CloudFront can provide HTTPS, it adds unnecessary complexity and cost; the requirement can be met natively with the ALB.

Answer

Replace the ALB with a Network Load Balancer and associate an ACM certificate with it.

Answer

Change the ALB listener to TCP and use a self-signed certificate on the EC2 instances.

Answer

Place a CloudFront distribution in front of the ALB and configure HTTPS between viewers and CloudFront.

Question 8

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

Accepted Answer

Change the task placement strategy to spread across Availability Zones.. Changing the task placement strategy to spread distributes tasks across Availability Zones, reducing resource contention and improving latency. Option A is wrong because increasing memory and CPU does not address placement-related contention. Option B is wrong because increasing the number of tasks with the default binpack strategy may worsen contention by packing tasks more densely. Option D is wrong because using EC2 with GPU instances does not solve placement issues and introduces unnecessary complexity.

Answer

Increase the memory and CPU for each task definition to reduce contention.

Answer

Increase the number of tasks to distribute the load evenly.

Answer

Use a launch type of EC2 with GPU instances to handle the load.

Question 9

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

Accepted Answer

Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.. SSE-KMS allows the company to use AWS KMS for centralized key management and access control, ensuring that only authorized users can access the decryption keys. Option A is incorrect because an S3 bucket policy restricting put permissions does not control access to existing objects' encryption keys. Option B is incorrect because SSE-S3 keys are managed by AWS, not the customer, so the security team cannot enforce key access controls. Option C is incorrect because client-side encryption does not use S3 server-side encryption and would require managing keys outside of AWS.

Answer

Configure an S3 bucket policy to allow only specific IAM roles to put objects.

Answer

Continue using SSE-S3 and enable S3 Block Public Access.

Answer

Use client-side encryption with an AWS KMS key.

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

Accepted Answer

Create a target tracking scaling policy using the custom metric as the target.. A target tracking scaling policy automatically adjusts the number of instances to maintain a target value for the custom metric, which is efficient for variable workloads. Option A is incorrect because scheduled scaling assumes predictable patterns. Option B is incorrect because using Lambda adds complexity and overhead. Option C is incorrect because step scaling requires manual configuration of steps and is less efficient than target tracking.

Answer

Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

Answer

Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

Answer

Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

Question 11

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

Accepted Answer

Create an Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and use a load balancer.. An Auto Scaling group with a minimum of two instances across multiple Availability Zones combined with a load balancer provides high availability and automatic failover, reducing RTO significantly. Option B is wrong: while EBS snapshots are useful for backups, restoring from a snapshot to create a new instance involves manual steps and can take minutes, not improving RTO adequately. Option C is wrong: Multi-Attach EBS volumes are for specific clustered applications (e.g., Windows Server Failover Clustering) and not all applications support it; also, it does not provide automatic failover. Option D is wrong: converting to an AMI and launching in another AZ requires manual intervention and does not ensure rapid recovery; it's a migration step, not an availability solution.

Answer

Take frequent EBS snapshots and automate the creation of a new instance from the latest snapshot.

Answer

Configure the EBS volume as a Multi-Attach volume and attach it to a standby instance.

Answer

Convert the instance to an AMI and launch a new instance from that AMI in a different Availability Zone.

Question 12

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.. The simplest way to notify when a specific error message appears in CloudWatch Logs is to create a metric filter on the log group for the error message, then set up a CloudWatch alarm on that metric. This is native, requires no custom code, and provides real-time alerting. Option A is incorrect because S3 event notifications apply to S3 objects, not CloudWatch Logs content. Option B is incorrect because subscribing a Lambda function is more complex than using a metric filter and alarm. Option D is incorrect because CloudWatch Logs Insights queries are not real-time and require manual or scheduled execution.

Answer

Configure S3 event notifications on the log file destination to send an alert.

Answer

Subscribe a Lambda function to the log group and have it check for the error message.

Answer

Use CloudWatch Logs Insights to run a query periodically and send results via email.

Question 13

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

Accepted Answer

Switch from a step scaling policy to a target tracking scaling policy based on CPU utilization.. To improve scaling responsiveness, the team should use a target tracking scaling policy based on CPU utilization (Option B) because target tracking continuously adjusts the desired capacity to meet the target value, providing faster and more precise scaling than step scaling. Decreasing the cooldown period (Option D) allows new instances to start contributing to metrics sooner, enabling the Auto Scaling group to scale out more quickly during spikes. Option A (increasing instance size) does not improve the speed of scaling out; it only increases capacity per instance but not responsiveness. Option C (increasing health check grace period) delays the detection of unhealthy instances, slowing down scaling. Option E (decreasing minimum number) reduces baseline capacity and does not help with scaling out speed.

Answer

Increase the instance size to handle more traffic per instance.

Answer

Increase the health check grace period for the Auto Scaling group.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 14

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics such as CPU and memory usage.. Options A, C, and D are correct. Enabling Enhanced Monitoring provides OS-level metrics like CPU and memory usage, helping to identify resource bottlenecks. Performance Insights helps identify the specific queries consuming the most CPU, enabling targeted optimization. Reviewing RDS events can reveal recent maintenance activities or failovers that might impact performance. Option B is incorrect because increasing instance size or IOPS is a remedial action, not a diagnostic step. Option E is incorrect because Multi-AZ is for high availability, not performance diagnosis.

Answer

Increase the instance size to provisioned IOPS to handle the load.

Answer

Enable Multi-AZ deployment for automatic failover.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The operations team wants to implement a change management process that requires approval before stack updates can proceed. Which TWO approaches can achieve this?

Accepted Answer

Create a service role with specific IAM policies and require that updates be initiated with that role.. Options B and E are correct. Using a service role with specific IAM policies (B) ensures that only authorized roles can initiate stack updates, enforcing an approval workflow. CloudFormation change sets (E) allow the operations team to review proposed changes before executing them, providing a mechanism for approval. Option A is incorrect because StackSets are used for deploying across multiple accounts and regions, not for approval workflows. Option C is incorrect because manually reviewing template changes before uploading to S3 is not a built-in CloudFormation mechanism for change management. Option D is incorrect because stack policies protect specific resources from being updated or deleted, but they do not enforce an approval process for updates.

Answer

Use AWS CloudFormation StackSets to deploy updates across multiple accounts.

Answer

Manually review all template changes before uploading to S3.

Answer

Configure a stack policy to prevent updates to critical resources.