SAP-C02 Continuous Improvement for Existing Solutions Practice Test 14 — 15 Questions

Question 1

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions query an Amazon RDS for PostgreSQL database. Recently, the company has noticed increased latency and occasional timeouts during peak hours. A solutions architect needs to improve the performance and scalability of the database layer. Which solution will meet these requirements with the LEAST operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Implement Amazon RDS Proxy to manage connection pooling between Lambda and the RDS instance.. Amazon RDS Proxy manages connection pooling between Lambda functions and RDS, reducing the overhead of opening and closing connections, which helps avoid latency and timeouts during peak load. Option A is incorrect because DAX is a caching layer for DynamoDB, not RDS. Option B is incorrect because while Read Replicas can offload read traffic, they do not address connection management, and Lambda still creates many connections. Option C is incorrect because increasing instance size is vertical scaling and does not solve the connection pooling issue; it may still lead to timeouts under high connection surges.

Answer

Enable Amazon DynamoDB Accelerator (DAX) on the RDS instance.

Answer

Add a Multi-AZ RDS Read Replica and modify Lambda to use the Read Replica for queries.

Answer

Increase the instance size of the RDS database to handle more concurrent connections.

Question 2

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic to tasks. The company has configured an Auto Scaling target tracking policy based on average CPU utilization. During a marketing campaign, traffic spikes cause the ALB to return 503 errors. The ECS service dashboard shows that the number of tasks scaled out to the maximum allowed but the CPU utilization remained high. What is the MOST likely cause of the 503 errors?

Accepted Answer

The ECS service scaled out to the maximum number of tasks, but the new tasks are not yet registered as healthy with the ALB, or the existing tasks are overwhelmed.. When ECS tasks scale out to the maximum allowed, the ALB may still return 503 errors if the new tasks are not yet registered as healthy (health check grace period or delayed registration) or if the existing tasks are already overwhelmed. The scaling policy reached its maximum, but the tasks cannot handle the traffic, leaving the ALB with no healthy targets to serve requests. Option B is incorrect because target tracking scaling policies typically respond within minutes, but the issue here is that the maximum number of tasks was reached and CPU remained high, not that scaling was too slow. Option C is incorrect because ENI limits for Fargate tasks are per-task and unlikely to cause ALB 503 errors. Option D is incorrect because ALB connection limits are very high and rarely the bottleneck; the error stems from lack of healthy targets.

Answer

The target tracking scaling policy takes too long to trigger, and the service cannot scale quickly enough.

Answer

The Fargate tasks have exhausted their elastic network interface (ENI) limits.

Answer

The ALB connection limit has been exceeded due to the traffic spike.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session data locally on the EC2 instances. The company wants to make the application stateless to improve availability and scalability. Which solution should the solutions architect recommend?

Accepted Answer

Use Amazon ElastiCache for Redis to store session data externally.. Amazon ElastiCache for Redis provides a fast, in-memory, highly available session store that decouples session state from EC2 instances, making the application stateless. This improves availability and scalability. Option B is incorrect because session stickiness (sticky sessions) on the ALB ties a user to a specific instance, preventing true statelessness and can cause uneven load distribution. Option C is incorrect because mounting Amazon EFS to store session files still relies on a filesystem, which is slower than in-memory storage and does not eliminate statefulness. Option D is incorrect because Amazon S3 is not designed for high-frequency read/write operations like session management; it introduces high latency and is less efficient than ElastiCache.

Answer

Configure session stickiness on the ALB to route requests from the same user to the same EC2 instance.

Answer

Mount an Amazon EFS file system on the EC2 instances and store session files there.

Answer

Store session data in Amazon S3 and update the application to read and write sessions to S3.

Question 4

A company has an AWS Lambda function that processes files uploaded to an S3 bucket. The Lambda function has been running successfully for months. Recently, the company updated the Lambda function code and started seeing occasional throttling errors (HTTP 429) from the Lambda service. The function's reserved concurrency is set to 100. The company is unsure why throttling is occurring only after the code update. What is the MOST likely cause?

Accepted Answer

The code update increased the execution time of the Lambda function, leading to a higher number of concurrent executions that exceed the account-level concurrency limit.. When a Lambda function's execution time increases due to a code update, each invocation holds a concurrency slot for longer. With reserved concurrency set to 100, if the function's invocations per second remain the same but each takes longer, the number of concurrent executions can exceed the account-level concurrency limit (default 1000), causing throttling (HTTP 429). Option A is wrong because CloudWatch Logs throttling would result in dropped log events, not Lambda throttling errors. Option B is wrong because if the S3 bucket received the same rate of uploads, the invocation rate wouldn't change; the question states throttling occurred only after the code update, not due to increased uploads. Option C is wrong because missing IAM permissions would cause access denied errors (HTTP 403), not throttling errors.

Answer

The Lambda function is writing logs to CloudWatch Logs at a rate that exceeds the CloudWatch throttling limit.

Answer

The S3 bucket is receiving more uploads than before, causing more Lambda invocations.

Answer

The updated Lambda function no longer has the required IAM permissions to access S3, causing retries that throttle.

Question 5

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group. The application uses a custom health check that reports instance health to Amazon CloudWatch. The Auto Scaling group is configured with an EC2 health check type. Recently, the company noticed that instances failing the custom health check are not being terminated and replaced. What should the solutions architect do to ensure that instances failing the custom health check are automatically replaced?

Accepted Answer

Change the Auto Scaling group health check type to ELB and ensure the custom health check is integrated with the ELB target group.. Auto Scaling only uses EC2 status checks (system/reachability) by default. To use a custom health check, you must configure the Auto Scaling group to use ELB health checks and integrate the custom health check with the ELB target group, so that instances failing the custom check are marked unhealthy by the ELB and automatically replaced. Option A is wrong because manually terminating instances is not automated and defeats the purpose of Auto Scaling. Option B is wrong because instance metadata cannot be used to report custom health to Auto Scaling; it only provides instance metadata, not health information. Option C is wrong because a CloudWatch alarm alone cannot terminate instances; you would need a lifecycle hook or EventBridge to act on the alarm.

Answer

Manually terminate the unhealthy instances from the EC2 console.

Answer

Configure the Auto Scaling group to use instance metadata to report health.

Answer

Create a CloudWatch alarm based on the custom health check metric and configure the alarm to terminate the instance.

Question 6

A company uses AWS CloudFormation to deploy infrastructure. The company wants to ensure that if a stack update fails, the stack automatically rolls back to the last known good state. Which CloudFormation stack option should the company configure?

Accepted Answer

Set the 'Rollback on failure' option to 'Yes' when performing the stack update.. When performing a stack update, you can set the 'Rollback on failure' option to 'Yes'. This ensures that if the update fails, CloudFormation automatically rolls back to the last known good state. Option A is incorrect because termination protection prevents accidental deletion, not rollback. Option B is incorrect because a stack policy controls which resources can be updated, not rollback behavior. Option D is incorrect because change sets allow you to review changes but do not provide automatic rollback.

Answer

Enable termination protection on the stack.

Answer

Configure a stack policy to prevent updates to critical resources.

Answer

Use a change set to review changes before updating the stack.

Question 7

A company is running a stateful web application on Amazon EC2 instances in an Auto Scaling group. The instances store session data in an Amazon ElastiCache for Redis cluster. The company wants to improve the application's fault tolerance and ensure that session data is not lost if an Availability Zone fails. What should the solutions architect do?

Accepted Answer

Enable Cluster Mode on the ElastiCache for Redis cluster and configure Multi-AZ.. Enabling Cluster Mode on the ElastiCache for Redis cluster and configuring Multi-AZ provides automatic sharding and replication across Availability Zones. This ensures that session data is not lost if an AZ fails, as replicas in other AZs can take over. Option B is incorrect because read replicas alone do not provide automatic failover or data durability across AZ failures unless Multi-AZ is enabled. Option C is incorrect because increasing instance size does not protect against AZ failure. Option D is incorrect because ElastiCache for Memcached does not support persistence or replication, so data would be lost on node failure.

Answer

Configure the ElastiCache for Redis cluster to have multiple read replicas in the same region.

Answer

Increase the instance size of the EC2 instances to handle more load.

Answer

Migrate from ElastiCache for Redis to ElastiCache for Memcached.

Question 8

A company has a monolithic application running on a single Amazon EC2 instance. The application consists of a web server and a backend worker process. The company wants to migrate to a microservices architecture using containers on Amazon ECS with Fargate. The solutions architect needs to design a solution that minimizes downtime during the migration. Which approach should the solutions architect recommend?

Accepted Answer

Use a strangler fig pattern: gradually replace parts of the monolith with microservices, routing traffic via an Application Load Balancer.. A strangler fig pattern allows incremental migration of functionality from the monolith to microservices, with the ALB routing traffic to either the monolith or new services. This minimizes downtime because the old application remains operational while pieces are moved. Option A is wrong because a lift-and-shift of the entire application into a single container does not decompose it into microservices. Option C is wrong because running both the monolith and new services on the same instance but on different ports does not inherently minimize downtime and complicates routing. Option D is wrong because refactoring the entire application at once introduces significant risk and downtime.

Answer

Create a Docker image of the entire monolithic application and run it on ECS with Fargate.

Answer

Run the monolithic application on the same EC2 instance as the new microservices, using different ports.

Answer

Refactor the entire application into microservices, then deploy all microservices at once on ECS.

Question 9

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 10

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences high request latency during peak traffic. A solutions architect discovers that the ALB is not distributing traffic evenly across the instances. The instances have different sizes (t3.large and t3.xlarge). Which TWO actions should the solutions architect take to improve load distribution?

Accepted Answer

Replace all instances with the same instance type.. The correct answers are B and C. Option B: Using the same instance type ensures uniform capacity, so round-robin routing distributes traffic evenly. Option C: Changing the routing algorithm to least outstanding requests (LOR) distributes traffic based on pending requests, naturally giving more traffic to larger instances (t3.xlarge) and balancing load despite size differences. Option A (connection draining) helps with graceful deregistration but does not improve distribution. Option D (sticky sessions) worsens distribution by pinning users. Option E (increasing deregistration delay) does not affect distribution.

Answer

Enable connection draining on the target group.

Answer

Enable sticky sessions (session affinity) on the target group.

Answer

Increase the deregistration delay (connection draining) on the target group to 300 seconds.

Question 11

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Options A, C, and D are correct. Checking AppSpec hooks ensures the validation scripts are correctly defined. Reviewing CodeDeploy agent logs helps identify script failures. Testing the validation script manually on a healthy instance verifies its functionality. Option B is wrong because increasing the deployment timeout does not fix the script failure. Option E is wrong because CodeDeploy does not use Auto Scaling lifecycle hooks for instance health; it uses its own deployment lifecycle.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences high CPU utilization during peak hours. The company wants to reduce the load on the primary database instance without making changes to the application code. Which TWO solutions should the solutions architect recommend?

Accepted Answer

Create one or more Read Replicas in the same region and direct read traffic to them.. Options B and E are correct. Read Replicas offload read traffic from the primary database instance, reducing CPU utilization. ElastiCache caches the results of frequently accessed queries, decreasing the number of database queries and CPU load. Option A is incorrect because increasing the instance size does not address the root cause and may require downtime. Option C is incorrect because RDS Proxy manages connection pooling, not reducing CPU load from queries. Option D is incorrect because the instance is already Multi-AZ, which provides failover but does not reduce read load.

Answer

Increase the instance size of the primary RDS instance.

Answer

Enable Amazon RDS Proxy to manage database connections.

Answer

Convert the RDS instance to a Multi-AZ deployment if not already.

Question 13

A media company runs a video processing pipeline on AWS. The pipeline uses AWS Step Functions to orchestrate multiple AWS Lambda functions. The first Lambda function downloads a video file from an S3 bucket, the second transcodes it using AWS Elemental MediaConvert, and the third uploads the transcoded files to a different S3 bucket. Recently, the pipeline has been failing intermittently with 'State machine execution timed out' errors. The Step Functions execution history shows that the first Lambda function takes up to 25 minutes to complete for large video files. The Step Functions state machine has a default execution timeout of 5 minutes. The company wants to fix the timeout issue without redesigning the entire pipeline. Which solution should the solutions architect recommend?

Accepted Answer

Replace the Lambda function with an Amazon SQS queue and have the Step Functions wait for a callback.. The Lambda function has a maximum timeout of 15 minutes, so increasing the state machine timeout alone (Option A) does not solve the Lambda function's inability to run for 25 minutes. Replacing the Lambda with an SQS queue allows the long-running task to be processed asynchronously, with Step Functions waiting for a callback, avoiding the Lambda timeout limit and the state machine timeout error. Options B and C are invalid because Lambda cannot be configured beyond 15 minutes: setting it to 30 or 15 minutes still fails for a 25-minute task. Option D changes only the problematic component, meeting the requirement to fix the issue without redesigning the entire pipeline.

Answer

Increase the 'timeoutSeconds' value in the Step Functions state machine definition to 1800 (30 minutes) or more.

Answer

Increase the Lambda function timeout to 30 minutes in the Lambda configuration.

Answer

Increase the Lambda function timeout to 15 minutes and increase the state machine execution timeout to 30 minutes.

Question 14

A company runs a containerized application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The company has configured a target tracking scaling policy based on average memory utilization. During a traffic spike, the ECS service scales out, but the new tasks are immediately deregistered and replaced. The CloudWatch logs show that the new tasks are failing the ALB health check. The health check is configured to ping the '/health' endpoint on the container. The solutions architect verifies that the application container correctly responds to the '/health' endpoint with a 200 status code. What is the MOST likely cause of the health check failures?

Accepted Answer

The security group attached to the ECS tasks does not allow inbound traffic from the ALB on the health check port.. Since the application container correctly responds to the '/health' endpoint with a 200 status code, the health check failures are likely due to network connectivity. For Fargate tasks, each task gets an ENI, and the security group attached to the tasks must allow inbound traffic from the ALB on the health check port. If this rule is missing, the ALB cannot reach the health check endpoint, causing tasks to be deregistered. Option A is incorrect because the ALB listener rule is for routing traffic, not health checks. Option C is incorrect because a high deregistration delay would cause slow draining, not immediate health check failures. Option D is incorrect because the health check path is confirmed correct by the architect.

Answer

The ALB is not configured with a proper listener rule to forward traffic to the target group.

Answer

The deregistration delay (connection draining) is set too high, causing the ALB to think the tasks are unhealthy.

Answer

The health check path is incorrect; it should be '/index.html' instead of '/health'.

Question 15

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.. The RDS Multi-AZ failover promotes the standby to primary, changing the underlying IP address. If the application uses a hardcoded IP address or an endpoint that points to the old primary, it will fail to connect after failover. The correct approach is to use the RDS DNS name (CNAME) which automatically resolves to the current primary. Option A is incorrect because the stem states the security groups are correctly configured. Option B is incorrect because the failover completed in about 2 minutes, which is within normal Multi-AZ failover time (1-2 minutes). Option C is incorrect because the RDS endpoint DNS record updates quickly (within seconds) after a failover.

Answer

The security group for the EC2 instances does not allow outbound traffic to the RDS instance.

Answer

The RDS Multi-AZ failover took longer than expected, exceeding the RTO.

Answer

The RDS endpoint DNS record did not update to point to the new primary.