SAP-C02 Continuous Improvement for Existing Solutions Practice Test 15 — 15 Questions

Question 1

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which THREE actions can the company take?

Accepted Answer

Use CloudFront geo-restriction to allow or block countries.. Options B and D both describe CloudFront's built-in geo-restriction feature, which lets you allowlist or blocklist specific countries at the distribution level using the CloudFront console or API (the feature is officially called geographic restriction / geo restriction), so both are valid ways to restrict content by location. Option C is also correct because associating an AWS WAF web ACL with the CloudFront distribution and using a geo match condition lets you allow or block requests based on the country of origin, giving finer-grained control than the native feature. Option A is not correct because an S3 bucket policy denying specific IP ranges restricts by IP address, not by geographic location, and it does not address CloudFront edge behavior. Option E is not correct because, while Lambda@Edge can inspect the CloudFront-Viewer-Country header and return a 403, it is not one of the standard supported mechanisms for geographic restriction in this scenario and is not marked as correct.

Answer

Configure an S3 bucket policy to deny access from specific IP ranges.

Answer

Use Lambda@Edge to check the request's country and return a 403.

Question 2

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

Accepted Answer

The deny statement does not apply to the users attempting to access the bucket.. The bucket policy contains an explicit Deny statement that denies access to all principals, but if that Deny statement does not apply to the users attempting access (e.g., it has a condition that excludes them, or it targets different principals), then the Allow statement with the IP condition is not overridden. In AWS IAM policy evaluation, an explicit Deny always wins, but only if the Deny statement actually matches the request. If the Deny statement is scoped to specific principals or conditions that the users outside the IP range do not meet, then the Allow statement's IP condition is the only restriction, and if that condition is not properly enforced (e.g., due to a missing or incorrect condition), access is granted. Thus, the most likely reason is that the Deny statement does not apply to those users, leaving the Allow statement's IP restriction ineffective or bypassed.

Answer

The condition key 'aws:SourceIp' is misspelled.

Answer

The policy is an IAM policy, not a bucket policy, and the condition key is invalid.

Answer

The policy is attached to the IAM user instead of the bucket.

Question 3

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

Accepted Answer

Restrict the security group source to the API Gateway's VPC endpoint or the ALB security group.. The Lambda function should not be directly accessible from the internet. The security group sg-12345678 currently allows inbound traffic on port 443 from 0.0.0.0/0, which exposes the function to unnecessary risk. The function is intended to process API requests, typically invoked via API Gateway or an ALB. Therefore, the security group should restrict inbound traffic to only the source from the API Gateway's VPC endpoint or the ALB's security group. Option A is incorrect because the Lambda function might need to be in a VPC to access internal resources, and removing VPC attachment is not the best security measure. Option B is incorrect because Lambda functions do not have their own static IP; the ENI's IP is dynamic and cannot be used as a source restriction. More importantly, the source should be the API Gateway, not the Lambda function itself. Option C is incorrect because while using a VPC endpoint is beneficial, simply removing the VPC attachment does not solve the security group issue; the function may still need VPC access. The most direct fix is to modify the security group rule.

Answer

Modify the Lambda function to not use a VPC.

Answer

Add a deny rule for inbound 0.0.0.0/0 and allow only from the Lambda function's own IP.

Answer

Remove the VPC attachment from the Lambda function and use a VPC endpoint.

Question 4

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

Accepted Answer

The health check path is misconfigured and returns HTTP 404.. The target group's healthy host count dropping to zero is the key signal: ALB health checks are failing on all targets. If the health check path is misconfigured and returns HTTP 404, the ALB marks every instance unhealthy, removes them from rotation, and returns 503 Service Unavailable to clients. This matches the intermittent pattern because the failures align with health check intervals and peak-hour traffic amplification.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Answer

The EC2 instances are in an Auto Scaling group with insufficient capacity.

Question 5

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

Accepted Answer

The CloudFront behavior for older videos does not include the Lambda function association.. Lambda@Edge functions are associated with specific cache behaviors in a CloudFront distribution, not globally. If the older videos are served through a different cache behavior (e.g., a different path pattern like /legacy/*) that lacks the Lambda function association, the function never executes for those requests, so headers are missing. The fix is to attach the same Lambda@Edge function (or a versioned replica) to every cache behavior serving video content.

Answer

The Lambda@Edge function is not triggered for viewer request events.

Answer

The S3 bucket policy denies access to the Lambda function.

Answer

The videos are cached in CloudFront and the function runs only on cache misses.

Question 6

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

Accepted Answer

Right-size the task definitions by adjusting CPU and memory reservations.. Right-sizing the task definitions by adjusting CPU and memory reservations ensures each service receives the appropriate resources, reducing wasted capacity and optimizing cluster utilization. This directly addresses the high cluster CPU utilization while individual services are underutilized. Option A (increasing tasks) would exacerbate the issue. Option B (Fargate Spot) does not solve the resource allocation problem. Option C (EC2 launch type) is not relevant to the utilization pattern described.

Answer

Increase the number of tasks for each service.

Answer

Use AWS Fargate Spot for interruptible workloads.

Answer

Switch from Fargate to EC2 launch type.

Question 7

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Accepted Answer

That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.. When a Lambda function is configured with a VPC, it loses direct internet access and must route traffic through a NAT gateway (for internet) or a VPC endpoint (for AWS services). If the Lambda function cannot reach the RDS database, it may be because the route table associated with the Lambda's subnets lacks a route to the NAT gateway or VPC endpoint. Since the security groups and NACLs are correct, the next check is the route.

Answer

That the database password has not been rotated.

Answer

That the Lambda function's reserved concurrency is not set to zero.

Answer

That the Lambda function's environment variables are correctly set.

Question 8

A company uses Amazon DynamoDB for a gaming application. During a new game launch, they experience higher than expected latency on write operations. The table has on-demand capacity. What is the best way to improve write performance?

Accepted Answer

Use auto scaling with provisioned capacity.. The table is on-demand, which automatically scales to accommodate workload, but during a new game launch, write latency increased. Switching to provisioned capacity with auto scaling allows the table to scale based on utilization, and provisioned capacity can provide better performance predictability and higher throughput limits than on-demand in some cases. Auto scaling adjusts WCU based on target utilization, improving write performance during spikes.

Answer

Enable DynamoDB Accelerator (DAX) for caching.

Answer

Increase the write capacity units (WCU).

Answer

Add a global secondary index (GSI) to the table.

Question 9

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

Accepted Answer

Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.. A service control policy (SCP) attached at the OU or account level in AWS Organizations is the most scalable preventive control because it applies uniformly to every account in scope without deploying per-account resources. By denying the ability to create or modify buckets without encryption (for example, denying s3:PutBucketEncryption when the request lacks the required encryption headers, or denying s3:CreateBucket unless encryption is specified), the guardrail blocks non-compliant actions before they happen. This is a single, centrally managed policy rather than a distributed remediation mechanism.

Answer

Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.

Answer

Create an AWS Config rule in each account to remediate non-compliant buckets.

Answer

Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Question 10

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

Accepted Answer

A build stage that packages the application using AWS CodeBuild.. Option A is correct because AWS CodeBuild is the build provider in CodePipeline that compiles source, runs unit tests, and packages the serverless application artifacts (e.g., producing the deployment bundle) needed before any staging deployment. Option D is correct because a test stage that deploys the application to a staging environment and runs integration tests validates the deployment end-to-end before production, which is exactly the pre-production verification the scenario requires. Option C is correct because after staging tests pass, a deploy stage that promotes the validated artifact to production completes the pipeline's promotion flow. Option B is not among the marked answers; while manual approval is a common CodePipeline pattern, it is not one of the three actions required to automatically test in staging and then promote. Option E is not marked because a canary environment is a production traffic-shifting strategy, not a staging test mechanism, and it is not needed to satisfy the stated requirement.

Answer

A manual approval step before deploying to production.

Answer

A deploy stage that deploys to a canary environment.

Question 11

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have permission to create EC2 instances.. A stack status of ROLLBACK_COMPLETE indicates that CloudFormation successfully initiated resource creation but one or more resources failed, triggering a rollback. The most common cause is that the IAM role associated with the stack lacks permissions to create the required resources (e.g., EC2 instances). A template syntax error would cause a validation error before any resource creation begins, resulting in a status like CREATE_FAILED without a rollback. Wrong region selection would not cause a rollback after resources start being created; the stack would either succeed or fail due to availability issues. Option C is correct because insufficient IAM permissions are a frequent cause of resource creation failures leading to rollback.

Answer

The stack was created in the wrong AWS region.

Answer

The EC2 instance type is not available in the region.

Answer

The CloudFormation template has a syntax error.

Question 12

A company is using AWS CodePipeline to automate deployments of a web application. The deployment to an Amazon ECS cluster often fails during the 'Deploy' stage due to insufficient capacity in the target group. The operations team wants to improve the pipeline to automatically handle such failures without manual intervention. Which solution is MOST operationally efficient?

Accepted Answer

Add a retry action in the CodePipeline stage for the ECS deployment.. The most operationally efficient because it uses CodePipeline's built-in retry mechanism to automatically retry the failed 'Deploy' stage when the ECS deployment fails due to insufficient capacity. This eliminates the need for manual intervention or additional services like Lambda, reducing operational overhead. Option A adds unnecessary complexity with CloudWatch Alarms and Lambda. Option B does not address capacity issues. Option C requires manual approval, which is not automated. Option D would reduce capacity, exacerbating the failure.

Answer

Use Amazon CloudWatch Alarms to trigger an AWS Lambda function that restarts the pipeline.

Answer

Modify the CodeBuild project to run integration tests after deployment.

Answer

Add a manual approval step before the deploy stage to verify capacity.

Answer

Configure the ECS service to automatically scale down the desired count on deployment failure.

Question 13

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

Accepted Answer

Replace the instance store volume with an Amazon EBS volume, create an AMI, and use Auto Scaling with an Application Load Balancer.. The most cost-effective solution with minimal architectural changes. By replacing the ephemeral instance store with an EBS volume, the data becomes persistent. Then creating an AMI and using Auto Scaling with an Application Load Balancer provides high availability and disaster recovery automatically. Option B only adds backups but does not provide high availability, and restoring from snapshots is slower. Option C, AWS Backup, cannot back up instance store data directly, so it is ineffective. Option D provides high availability but still uses instance store, so data is lost on instance failure; it also does not address data persistence. Therefore, Option A is correct.

Answer

Attach an Amazon EBS volume and configure the application to write to it, then take periodic EBS snapshots.

Answer

Use AWS Backup to schedule backups of the instance and restore to a new instance if needed.

Answer

Create an AMI from the instance and launch a second instance in a different Availability Zone behind an Application Load Balancer.

Question 14

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

Accepted Answer

Enable job bookmarking and configure incremental processing to reduce data volume per run.. The most cost-effective solution is to enable job bookmarking and configure incremental processing. This reduces the data volume processed per run, thereby preventing memory issues without increasing costs. Increasing DPUs (Option E) would linearly increase cost. Changing Redshift node type (Option B) does not address Glue memory. Replacing Glue with EMR (Option C) adds complexity and may not be more cost-effective. Partitioning input data into more files (Option D) does not directly solve memory issues and can actually increase overhead.

Answer

Use a larger node type for the Amazon Redshift cluster to offload processing.

Answer

Replace AWS Glue with Amazon EMR and use spot instances for cost savings.

Answer

Partition the input data in Amazon S3 into more files with smaller sizes.

Answer

Increase the number of DPUs (Data Processing Units) for the Glue job.

Question 15

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

Accepted Answer

Increase the memory (and CPU) allocation for the Lambda function.. The Lambda function is CPU-bound and takes close to the 15-minute timeout. In AWS Lambda, CPU allocation is directly proportional to the memory allocated. Increasing the memory setting also increases the allocated CPU, which can significantly speed up CPU-bound workloads. This is the simplest change because it requires only a configuration update and does not involve architectural changes.

Answer

Increase the reserved concurrency of the Lambda function.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Use a Lambda function URL instead of SQS invocation.

Answer

Migrate the Lambda function to run on Amazon ECS with Fargate using a larger task size.