SAP-C02 Continuous Improvement for Existing Solutions Practice Test 13 — 15 Questions

Question 1

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.. The pattern of errors occurring exactly at 00:10, 00:30, and 00:50 (20-minute intervals) indicates that the Lambda function is timing out after processing for a long duration, and the SQS visibility timeout is set to 20 minutes. When the function times out, the message becomes visible again in the queue after the visibility timeout, leading to a retry. This results in errors at regular intervals. Option A is incorrect because memory exhaustion would cause out-of-memory errors, not timeouts. Option C is incorrect because hitting reserved concurrency would cause throttles (e.g., 429 errors), not function errors. Option D is incorrect because an incompatible runtime would cause all invocations to fail immediately, not in a pattern.

Answer

The Lambda function is running out of memory.

Answer

The Lambda function is hitting the reserved concurrency limit.

Answer

The Lambda function is using an incompatible runtime.

Question 2

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Accepted Answer

No security group or network ACL allows inbound traffic.. The instance can access the internet (outbound works), which means the subnet is public, has a route to an internet gateway, and the instance has a public IP or NAT. The failure is inbound-only, so the most likely cause is that no security group or network ACL permits inbound traffic on the required port. Security groups are stateful and must explicitly allow inbound; NACLs are stateless and must allow both directions.

Answer

The subnet does not have auto-assign public IP enabled.

Answer

The VPC does not have an internet gateway attached.

Answer

The route table does not have a route to the internet gateway.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Accepted Answer

Use AWS Config rules to automatically remediate non-compliant buckets.. Option A is correct because AWS Config rules can continuously evaluate S3 buckets against desired configurations (such as requiring SSE-KMS encryption and blocking public access) and, with remediation actions, automatically fix non-compliant buckets across the organization's accounts. Option C is correct because a Service Control Policy (SCP) applied at the organization or OU level can deny s3:PutObject requests that lack the x-amz-server-side-encryption header set to aws:kms, thereby enforcing KMS encryption on all uploads centrally. Option B is incorrect because CloudTrail only logs API activity and does not natively remediate non-compliant resources. Option D is incorrect because a bucket policy per account is not a centralized, organization-wide enforcement mechanism and cannot reliably enforce KMS encryption on all PutObject calls. Option E is incorrect because denying s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy does not enforce encryption; those actions control public access settings and bucket policies, not the encryption of uploaded objects.

Answer

Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

Answer

Create an S3 bucket policy in each account to enforce encryption and block public access.

Answer

Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.

Question 4

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster to cache frequently accessed data.. Option A is correct because an Amazon ElastiCache cluster (Redis or Memcached) offloads frequently accessed read queries from the RDS database by serving cached results in memory, reducing read pressure on PostgreSQL without requiring application logic changes beyond pointing reads at the cache. Option C is correct because RDS for PostgreSQL read replicas use PostgreSQL's asynchronous streaming replication to serve read-only traffic, and the reader endpoint load-balances connections across replicas, directly improving read scalability while the application continues using standard PostgreSQL connections. Option E is correct because RDS Proxy pools and multiplexes database connections, absorbing connection churn and reducing the overhead of establishing new PostgreSQL connections, which lowers load on the primary instance during high-traffic read scenarios. Option B is not correct because Multi-AZ is a high-availability/failover feature using a synchronous standby that does not serve read traffic, so it does not improve read scalability. Option D is not correct because sharding requires significant application and schema changes to route queries across multiple RDS instances, contradicting the requirement to avoid modifying the application.

Answer

Deploy a Multi-AZ RDS instance for automatic failover.

Answer

Implement database sharding by splitting the data across multiple RDS instances.

Question 5

A company uses AWS Systems Manager Patch Manager to patch Amazon EC2 instances. After a patching operation, some instances fail to report their compliance status. What is the MOST efficient way to identify the cause of the failure?

Accepted Answer

Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances.. Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances. This is the most efficient approach because Systems Manager Inventory provides a centralized view of patch compliance across all managed instances, allowing you to quickly identify which instances are non-compliant and investigate the reasons for patch failures. Option A is inefficient because it requires running scripts manually on each instance. Option C is incorrect because the Patch Manager dashboard (if available) may not provide detailed failure reasons. Option D is inefficient and does not directly address compliance failure causes.

Answer

Run a script on each instance to list missing patches.

Answer

Use the Patch Manager dashboard in the AWS Management Console.

Answer

Check the EC2 console for each instance's patch status.

Question 6

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

Accepted Answer

Reduce the cooldown period for the Auto Scaling group.. Reducing the cooldown period allows the Auto Scaling group to react faster to increased traffic, enabling quicker scale-out. Option A is incorrect because decreasing the CPU utilization threshold for scale-out alarms would cause the group to scale out at lower CPU levels, potentially scaling out sooner but not necessarily improving the speed of response. Option B is incorrect because increasing the minimum number of instances does not speed up scaling; it only ensures a higher baseline capacity. Option D is incorrect because using larger instance types handles more traffic per instance but does not improve the scaling response time.

Answer

Decrease the CPU utilization threshold for scale-out alarms.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Answer

Use a larger instance type to handle more traffic.

Question 7

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

Accepted Answer

Create a new launch template with a patched AMI, then perform a rolling update that detaches and reattaches the existing EBS volumes.. It minimizes downtime by using a rolling update and preserves data by detaching and reattaching existing EBS volumes. Option A is wrong because it does not preserve existing EBS volumes, leading to data loss. Option C is wrong because terminating all instances causes downtime and does not preserve data. Option D is wrong because patching running instances may cause application instability and does not ensure data preservation in case of rollback.

Answer

Use a rolling update with a new Auto Scaling group and delete old instances.

Answer

Terminate all instances and launch new ones with a patched AMI.

Answer

Use Systems Manager Patch Manager to apply patches to running instances.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

Accepted Answer

Configure the ALB to forward the custom header to the target group and validate it on the application.. Option B is correct because an Application Load Balancer can be configured with listener rules to forward specific HTTP headers, including a custom authentication header, to the target group, allowing the application on the EC2 instances to validate the header and reject unauthenticated requests. Option C is correct because AWS WAF can be associated with an ALB and a custom rule can inspect the request headers, matching on the presence or value of the custom authentication header and blocking any request that lacks it before it reaches the targets. Option A is not correct because CloudFront signed URLs protect content distribution at the CDN layer and do not validate a custom authentication header at the ALB, so they do not satisfy the requirement as stated. Option D is not correct because Amazon Cognito authenticates users and issues tokens, but it does not by itself pass a custom header to the ALB or enforce header validation at the load balancer. Option E is not correct because restricting the ALB security group to known IP addresses provides network-level filtering, not authentication based on the custom header, and would not ensure requests come only from authenticated users.

Answer

Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.

Answer

Use Amazon Cognito to authenticate users and pass the header.

Answer

Configure the ALB's security group to allow traffic only from known IP addresses.

Question 9

A company is using AWS CodePipeline with an S3 source action. After a successful deployment, the latest commit ID is stored as an environment variable in the CodeBuild project. The team notices that subsequent pipeline executions are not triggering when new commits are pushed to the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to trigger the pipeline.. For an S3 source action in CodePipeline, the pipeline does not automatically poll the S3 bucket for changes. Instead, you must configure an Amazon CloudWatch Events (EventBridge) rule to trigger the pipeline when an object is created in the bucket. Without this event notification, the pipeline will not start on new commits.

Answer

The CodePipeline service role lacks permissions to poll the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to read objects.

Answer

The CodePipeline webhook is misconfigured.

Question 10

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

Accepted Answer

Create a change set that replaces the resource causing the limit error with a smaller instance type.. Creating a change set that replaces the resource causing the limit error with a smaller instance type allows the update to proceed without manual intervention, minimizing downtime. Option A is wrong because manually modifying the resource can cause stack drift and may not be safe. Option C is wrong because rolling back does not resolve the underlying resource limit issue. Option D is wrong because deleting and recreating the stack would cause significant downtime.

Answer

Manually modify the resource to reduce its capacity and then continue the update.

Answer

Roll back the stack update and ignore the error.

Answer

Delete the stack and recreate it with the corrected template.

Question 11

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

Accepted Answer

Increase both memory and vCPU to 4 GB and 2 vCPUs.. Increasing both memory and vCPU to 4 GB and 2 vCPUs (C) is the most effective because the application is experiencing high CPU utilization, and adding vCPU directly addresses the compute bottleneck. However, increasing memory alongside vCPU ensures that the additional vCPU has sufficient memory to operate efficiently, as Fargate task definitions require a valid CPU/memory combination. This balanced scaling reduces latency without over-provisioning.

Answer

Increase the number of tasks (desired count) to distribute the load.

Answer

Increase the vCPU to 2 while keeping 2 GB memory.

Answer

Increase the memory to 4 GB while keeping 1 vCPU.

Question 12

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Increasing the reserved concurrency for the Lambda function raises the maximum number of concurrent executions the function can have, which directly reduces throttling when SQS is delivering a high volume of messages. Reserved concurrency of 5 caps the function at 5 simultaneous invocations, so raising it allows more messages to be processed in parallel.

Answer

Create multiple Lambda functions each processing a subset of the queue.

Answer

Decrease the reserved concurrency to force the function to process messages more efficiently.

Answer

Increase the batch size of the SQS event source mapping.

Question 13

A company runs a stateful application on EC2 instances in an Auto Scaling group behind an ALB. They want to perform a rolling update without losing session state. Which solution is most appropriate?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB and perform a rolling update.. Enabling sticky sessions (session affinity) on the ALB ensures that requests from a user are consistently routed to the same instance during the rolling update, preserving session state. Option B (blue/green deployment) would require external session state management or state replication. Option C (scale out then scale in) may route new requests to instances lacking state, and Option D (terminate instances one by one) loses the state when the instance is terminated.

Answer

Use a blue/green deployment with a new Auto Scaling group.

Answer

Scale out the Auto Scaling group, then scale in the old instances.

Answer

Terminate instances one by one and let Auto Scaling replace them.

Question 14

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

Accepted Answer

Enable Amazon RDS Proxy.. Amazon RDS Proxy is a fully managed, highly available database proxy that sits between the application and the RDS database. During a Multi-AZ failover, the proxy automatically routes connections to the new primary instance, reducing the failover time perceived by the application from minutes to seconds. It does this by pooling and reusing connections, and by transparently handling the DNS change and connection re-establishment, so the application doesn't need to implement retry logic or wait for DNS TTL expiration.

Answer

Disable Multi-AZ to avoid failover altogether.

Answer

Create a read replica and promote it during failover.

Answer

Increase the DB instance size to improve performance.

Question 15

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Accepted Answer

Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.. The failure is caused by insufficient IAM permissions when CloudFormation tries to create MyEC2Instance, so the fix must address the permissions used by the stack and then re-apply the corrected configuration. Option C is correct because the CloudFormation service role (or the role under which the stack operates) must include the ec2:RunInstances permission so CloudFormation can launch the EC2 instance on the stack's behalf. Option E is correct because after correcting the IAM role, the company must run a stack update (for example, aws cloudformation update-stack) so CloudFormation retries the failed resource creation with the updated permissions. Option A is incorrect because changing the instance type does not resolve an IAM authorization failure. Option B is incorrect because simply creating a new IAM service role without attaching the required ec2:RunInstances permission and associating it with the stack does not fix the missing authorization. Option D is incorrect because granting the user additional permissions does not help if CloudFormation is operating under a service role that lacks the required EC2 permissions.

Answer

Modify the CloudFormation template to use a different instance type.

Answer

Create a new IAM service role for CloudFormation and assign it to the stack.

Answer

Grant the user additional IAM permissions to create EC2 instances.