SAP-C02 Continuous Improvement for Existing Solutions Practice Test 14 — 15 Questions

Question 1

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

Accepted Answer

Configure the cache behavior to forward all query strings but cache based on a whitelist.. Option A is correct because configuring the cache behavior to forward all query strings while caching based on a whitelist means CloudFront includes only the whitelisted query strings in the cache key, so requests that differ only by non-whitelisted query strings share the same cached object, directly raising the cache hit ratio. Option B is correct because increasing the minimum TTL keeps objects in CloudFront edge caches longer before they expire, so more requests are served from cache instead of being forwarded to the origin, which improves the hit ratio. Option C is not correct because custom error responses only control what CloudFront returns when the origin fails; they do not increase the proportion of requests served from cache. Option D is not correct because decreasing the default TTL causes objects to expire sooner and be fetched from the origin more often, lowering the cache hit ratio. Option E is not correct because automatic compression reduces object size for compressible content but does not change cache key matching or object lifetime, so it does not materially improve the cache hit ratio.

Answer

Configure custom error responses to serve cached content on errors.

Answer

Decrease the default TTL for objects.

Answer

Enable automatic compression for compressible objects.

Question 2

A company is using AWS CloudFormation to manage infrastructure. The security team requires that all CloudFormation stacks include a specific tag (CostCenter). The company wants to enforce this tag automatically. Which method should be used to enforce the tag?

Accepted Answer

Use an AWS Config rule to check for the tag and a custom IAM policy to deny stack creation without the tag.. An AWS Config rule can detect stacks missing the required tag, and a custom IAM policy can deny the ability to create or update stacks that do not have the tag, providing preventive enforcement. Option A is incorrect because AWS Service Catalog can enforce tags on products it provisions, but the question is about all CloudFormation stacks, not just those from Service Catalog. Option C is incorrect because a Lambda function can alert or remediate after the fact, but it does not prevent creation of non-compliant stacks. Option D is incorrect because tagging after creation does not enforce the tag requirement at creation time, and AWS Resource Groups is not an enforcement mechanism.

Answer

Use AWS Service Catalog to enforce mandatory tags on all provisioned products.

Answer

Create an AWS Lambda function that checks for the tag and sends alerts.

Answer

Use AWS Resource Groups to tag resources after stack creation.

Question 3

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

Accepted Answer

Replace the EC2 instances with AWS Lambda functions that are triggered by SQS events.. Using Lambda functions triggered by SQS events provides automatic scaling to handle sudden spikes in message volume without requiring provisioning or managing EC2 instances. Lambda scales instantly based on the number of messages in the queue, and you pay only for compute time used, making it the most cost-effective solution for variable workloads. Option B is incorrect because increasing instance size is less cost-effective and still requires manual scaling. Option C is incorrect because a fixed desired capacity may lead to over-provisioning or under-provisioning during the spike. Option D is incorrect because step scaling based on queue depth introduces latency as it takes time to launch new instances, whereas Lambda reacts immediately per message.

Answer

Increase the EC2 instance size to handle more messages per instance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value during the expected spike.

Answer

Use Auto Scaling with a step scaling policy based on the SQS queue depth.

Question 4

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

Accepted Answer

Configure the JDBC connection string with a timeout and implement automatic retry logic.. Configuring the JDBC connection string with a timeout and implementing automatic retry logic allows the application to gracefully handle the brief connection interruption during a failover. The connection pool will attempt to reconnect, and retries will succeed once the new primary is available, minimizing errors.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Increase the TTL for the RDS DNS record to 60 seconds.

Question 5

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

Accepted Answer

Use an SCP to deny creation of buckets without SSE-KMS and use an AWS Config rule with remediation to enable SSE-KMS on existing buckets.. An SCP can deny creation of buckets without SSE-KMS, and AWS Config with automatic remediation can enable SSE-KMS on existing buckets. Option A is wrong because S3 default encryption only encrypts new objects, not existing ones. Option B is wrong because SSE-S3 does not meet the KMS requirement. Option D is wrong because a Lambda function is reactive and requires custom code, whereas the combination of SCP and Config provides a more scalable and policy-driven approach.

Answer

Use S3 default encryption to automatically encrypt new objects.

Answer

Use an AWS Config rule to check for encryption and automatically remediate by enabling SSE-S3.

Answer

Create an AWS Lambda function that scans all buckets and enables encryption.

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon ElastiCache Redis cluster. During a traffic spike, the Redis cluster's CPU utilization reaches 90%, causing increased latency. The company wants to reduce the load on Redis without changing the application code. Which solution should the company implement?

Accepted Answer

Upgrade to a larger Redis node type with more vCPUs.. Upgrading to a larger Redis node type with more vCPUs directly addresses the CPU bottleneck without requiring application code changes. ElastiCache Redis scaling vertically increases CPU capacity, reducing latency during traffic spikes. This is the simplest solution when the workload is CPU-bound and the application cannot be modified.

Answer

Enable cluster mode on the ElastiCache Redis cluster to distribute data across multiple shards.

Answer

Use Amazon ElastiCache Global Datastore to distribute traffic across regions.

Answer

Add read replicas to the Redis cluster to offload read traffic.

Question 7

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

Accepted Answer

Use a CloudWatch alarm to monitor test results and trigger a rollback.. CodeDeploy supports automatic rollback triggered by CloudWatch alarms. By associating a CloudWatch alarm (which can be based on a custom metric emitted by post-deployment tests) with the CodeDeploy deployment group, CodeDeploy will automatically roll back the deployment when the alarm enters ALARM state during the deployment. This integrates testing and rollback without manual intervention or cross-pipeline orchestration.

Answer

Create a separate CodePipeline for testing and use a cross-pipeline trigger to initiate rollback.

Answer

Add a manual approval step after deployment to run tests manually.

Answer

Add a test stage in CodePipeline after the deployment stage and configure CodeDeploy to automatically roll back on pipeline failure.

Question 8

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

Accepted Answer

Configure an Application Load Balancer in front of the Auto Scaling group.. Option B is correct because placing an Application Load Balancer in front of the Auto Scaling group distributes incoming traffic across all healthy instances, preventing any single instance from becoming a bottleneck and thereby reducing latency during peak hours. Option D is correct because launching the Auto Scaling group across multiple Availability Zones improves scalability and resilience by allowing the group to spread instances across isolated data centers, increasing aggregate capacity and fault tolerance. Option A is not ideal because simply raising the desired capacity to a fixed value does not provide dynamic scalability and can lead to over-provisioning or under-provisioning. Option C is not the best choice because changing the AMI does not directly address traffic distribution or horizontal scaling. Option E is not the best choice because vertical scaling with a larger instance type has limits and does not improve horizontal scalability as effectively as the correct options.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value.

Answer

Switch to a different Amazon Machine Image (AMI) with optimized performance.

Answer

Increase the instance size to a larger type.

Question 9

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Use AWS CloudFormation with a blue/green deployment strategy for the database.. Option C is correct because a blue/green deployment strategy in CloudFormation (often implemented via AWS CodeDeploy or CloudFormation change sets with a new stack) creates a separate green environment with the updated database, validates it, and then shifts traffic over, so the original database remains available and downtime is avoided. Option E is correct because taking a database snapshot before the update provides a reliable rollback point; if the update fails, the database can be restored from the snapshot, minimizing the impact and supporting a no-downtime recovery plan. Option A is not correct because Multi-AZ failover addresses availability during an AZ failure or maintenance, but it does not by itself prevent downtime during a schema or engine update. Option B is not correct because updating the stack directly on the existing database can cause an in-place modification and potential downtime. Option D is not correct because a read replica is read-only and cannot serve write traffic during the update, so it does not provide a complete no-downtime strategy.

Answer

Enable Multi-AZ on the RDS instance to allow failover during updates.

Answer

Update the CloudFormation stack directly without creating a new database.

Answer

Use a read replica to serve traffic during the update.

Question 10

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

Accepted Answer

The deployment removed the health check path from the application.. If the deployment removed the health check path from the application, the health checks would fail for any instance that was updated. Since the application runs behind an ALB, the target group health check would mark those instances as unhealthy, causing intermittent 503 errors as traffic is routed only to remaining healthy instances. Even if not all instances are updated simultaneously, the gradual roll-out could lead to periods where all instances become unhealthy temporarily. Option A is incorrect because a low idle timeout would cause timeout errors, not 503s. Option B is incorrect because security groups were not changed. Option C is incorrect because misconfigured health check settings would cause consistent failures, not intermittent.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the ALB does not allow inbound traffic on the listener port.

Answer

The ALB's target group health check settings are misconfigured.

Question 11

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

Accepted Answer

Modify the target group health check to use path '/' instead of '/health'.. The CodePipeline deploy action uses CodeDeploy for blue/green deployments. The error indicates that the original target group (blue) is not healthy, possibly because the health check path is not valid for the original application version. Adjusting the health check to a common path like '/' allows both versions to pass. Option A is incorrect because Fargate does not allow SSH. Option C is incorrect because redeploying the same version won't fix the underlying health check issue. Option D is incorrect because a new target group does not address the root cause.

Answer

Redeploy the previous version of the application that passed health checks.

Answer

Create a new target group with the correct health check path and update the ECS service.

Answer

SSH into the Fargate container and restart the application.

Question 12

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

Accepted Answer

Change the bucket's default encryption configuration to SSE-KMS.. The simplest way to encrypt all objects in an S3 bucket with SSE-KMS is to change the bucket's default encryption configuration to use SSE-KMS. This ensures that all new objects uploaded to the bucket are automatically encrypted with the specified KMS key, without requiring any changes to applications or bucket policies. Existing objects are not re-encrypted, but the question asks for the simplest way to achieve encryption at rest with a KMS key, which this satisfies for new data.

Answer

Add a lifecycle policy to transition objects to SSE-KMS.

Answer

Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.

Answer

Use a bucket policy to deny uploads without SSE-KMS.

Question 13

A company runs a web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application writes logs to local instance storage. The company wants to centralize log collection and ensure logs are retained even if instances are terminated. The current solution uses Amazon CloudWatch Logs agent, but log streams are frequently missing when instances are replaced. What should the company do to ensure complete log collection?

Accepted Answer

Configure the CloudWatch agent to use a persistent buffer on an EBS volume.. The CloudWatch agent supports a persistent buffer that stores unsent log data on disk (e.g., an EBS volume) when the agent cannot reach CloudWatch Logs. This prevents log loss during instance termination or network interruptions, ensuring complete log collection across instance replacements.

Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier.

Answer

Use the CloudWatch agent to send logs directly to Amazon S3.

Answer

Attach an EBS volume to each instance and store logs there.

Question 14

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

Accepted Answer

A pending modification to the DB instance was applied during failover.. The most likely cause because during a failover, any pending modifications (e.g., scaling, instance type changes) that were scheduled are applied to the new primary, which can cause a brief performance impact. This is a known behavior in AWS RDS. Option A is incorrect because read replicas in a different region do not affect latency of the primary after failover; Multi-AZ does not use read replicas. Option B is incorrect because Multi-AZ configuration is not disabled during failover; it remains enabled. Option D is incorrect because DB parameter group changes require a manual reboot, not a failover event.

Answer

The read replica in a different region is now serving traffic.

Answer

The Multi-AZ configuration was disabled during the failover.

Answer

The DB parameter group was changed to a less efficient configuration.

Question 15

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

Accepted Answer

Configure cross-region replication for the RDS instance using a read replica.. Option A is correct because an RDS cross-region read replica continuously replicates data to another region, giving a low RPO (well within 1 hour) and enabling fast promotion to a primary in the DR region to meet the 2-hour RTO. Option D is correct because enabling automated backups with a retention period of at least 1 hour ensures point-in-time recovery within the 1-hour RPO window, allowing the RDS database to be restored to a recent state during failover. Option E is correct because hourly EBS snapshots meet the 1-hour RPO for the EC2 instance data, and replicating those snapshots to another region ensures the volumes can be restored in the DR region within the 2-hour RTO. Option B is not appropriate because AWS DMS is a migration and replication tool, not the native DR mechanism for RDS, and it adds unnecessary complexity versus a cross-region read replica. Option C is not sufficient because creating AMIs only captures the instance's boot/root state and does not provide the hourly data-level recovery needed for the EBS volumes or RDS database, so it alone cannot satisfy the RPO.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Answer

Create AMIs of the EC2 instances every hour.