SAP-C02 Continuous Improvement for Existing Solutions Practice Test 16 — 15 Questions

Question 1

A company runs a web application on AWS Elastic Beanstalk. The application experiences periodic traffic spikes that cause the environment to scale out. However, the scaling is slow, leading to increased latency during spikes. The operations team wants to improve the responsiveness of the Auto Scaling group. The application is stateless and runs on a single instance type. What should a solutions architect recommend?

Accepted Answer

Decrease the Auto Scaling group's cooldown period.. Option A is correct because increasing the cooldown period makes the Auto Scaling group more conservative, but that would slow scaling. Actually, decreasing the cooldown allows faster scaling. The question asks for improved responsiveness; Option A (decreasing cooldown) is the correct answer. Option B is wrong because a larger instance type may not help if the issue is scaling speed. Option C is wrong because multiple instance types add complexity and might not speed up scaling. Option D is wrong because scheduled scaling is proactive but does not respond to unexpected spikes.

Answer

Configure the Auto Scaling group to use multiple instance types.

Answer

Use scheduled scaling to add capacity before expected spikes.

Answer

Change the instance type to a larger size.

Question 2

A company runs a production AWS environment with Amazon EC2 instances managed by Auto Scaling groups. The operations team notices that after a recent deployment, the application is returning higher error rates. Which TWO steps should the team take to enable a quick rollback and improve future deployments?

Accepted Answer

Implement canary deployments using AWS CodeDeploy to shift traffic gradually and monitor error rates.. Option A (use Elastic Beanstalk for blue/green deployment) allows rollback by swapping environments. Option D (implement canary deployments in CodeDeploy) reduces blast radius and allows monitoring before full rollout. Option B (CloudFormation change sets) is for previewing changes, not rollback. Option C (CloudTrail) is for auditing, not deployment control. Option E (Lifecycle hooks) are for custom actions during instance launch/termination, not rollback.

Answer

Configure Auto Scaling lifecycle hooks to automatically terminate new instances if health checks fail.

Answer

Use AWS CloudFormation change sets to automatically roll back failed deployments.

Answer

Enable AWS CloudTrail to track deployment API calls and automatically revert if errors exceed a threshold.

Question 3

A company has a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application experiences occasional timeouts during peak hours. After reviewing AWS X-Ray traces, the team finds that DynamoDB queries are slow. Which THREE actions should the team take to improve performance and continuously optimize the solution?

Accepted Answer

Optimize DynamoDB queries by using global secondary indexes and reducing the number of separate queries.. Option A (DAX) reduces read latency. Option B (read capacity auto scaling) adapts to demand. Option E (connection pooling) reduces cold start overhead. Option C (ElastiCache) is for external caching, not DynamoDB. Option D (warm containers) is for Lambda optimization but not directly addressing DynamoDB performance.

Answer

Use Amazon ElastiCache for Redis to cache DynamoDB query results.

Answer

Implement Lambda function warmers to keep containers initialized and reduce cold starts.

Question 4

A financial services company runs a critical trading application on Amazon EC2 instances behind an Application Load Balancer (ALB) in three Availability Zones. The application uses a MySQL-compatible Amazon RDS for MariaDB database with Multi-AZ deployment. Recently, the operations team noticed that during periods of heavy trading, the database CPU utilization spikes to 100%, causing query timeouts and application errors. The team has already reviewed slow query logs and enabled Performance Insights, but the issue persists. The application is read-heavy with frequent writes. The team needs to reduce database load with minimal changes to the application code. Which solution is the MOST effective and scalable?

Accepted Answer

Create read replicas of the RDS for MariaDB instance and configure the application to send read queries to the read replicas.. Option D (RDS for MariaDB read replicas with read-only database connections) offloads read traffic without code changes, as read replicas can be used by modifying the connection string. Option A (Aurora) would require migration. Option B (ElastiCache) requires application code to cache data. Option C (DynamoDB Accelerator) is for DynamoDB, not MariaDB.

Answer

Migrate the database to Amazon Aurora MySQL-Compatible Edition with Auto Scaling and enable performance insights.

Answer

Implement an in-memory caching layer using Amazon ElastiCache for Memcached and modify the application to check the cache first.

Answer

Replace the RDS database with Amazon DynamoDB and use DynamoDB Accelerator (DAX) for caching.

Question 5

A media company delivers video content to a global audience using Amazon CloudFront, AWS Lambda@Edge, and Amazon S3. The origin is an S3 bucket that stores video files. Recently, users in Asia-Pacific report slow load times. The operations team checks CloudFront metrics and sees a high cache miss rate for content popular in that region. The team wants to improve performance for all users without significantly increasing costs. The application uses a single CloudFront distribution with a default cache behavior. The S3 bucket is in us-east-1. Which solution should the team implement?

Accepted Answer

Set up multiple origin groups in the existing CloudFront distribution with one S3 bucket per region, and configure cache behaviors based on geographic headers.. Option B (multiple origin groups with region-specific behaviors) is ideal for global distribution because CloudFront can route based on geographic headers. Option A (multiple distributions) increases complexity. Option C (Lambda@Edge for origin selection) can work but requires code changes. Option D (S3 Transfer Acceleration) speeds up uploads, not downloads.

Answer

Enable S3 Transfer Acceleration on the S3 bucket and update CloudFront to use the accelerated endpoint.

Answer

Create separate CloudFront distributions for each geographic region and use Route 53 latency-based routing.

Answer

Use Lambda@Edge to redirect requests to the nearest S3 bucket based on the viewer's location.

Question 6

A healthcare company runs a HIPAA-compliant web application on AWS. The application consists of an Application Load Balancer (ALB), a fleet of Amazon EC2 instances in an Auto Scaling group, and an Amazon RDS for PostgreSQL database with Multi-AZ. The security team requires that all data in transit be encrypted using TLS 1.2 or higher. The current setup uses an SSL certificate on the ALB to terminate HTTPS, but traffic between the ALB and EC2 instances is over HTTP. The company wants to enforce end-to-end encryption without changing the application code. Which solution meets these requirements?

Accepted Answer

Replace the ALB with a Network Load Balancer, configure a TLS listener, and use target group health checks over HTTPS.. Option D (network load balancer with target group health checks over HTTPS) is not correct because it requires code change on instances. Actually, the correct solution is to terminate TLS at the ALB and re-encrypt using a self-signed certificate on the EC2 instances, but that requires application support. However, the best option is to use a Network Load Balancer with TLS termination and forward to instances with a self-signed certificate (which doesn't require code change if the app listens on HTTPS). However, among the options, Option D is most plausible but still flawed. Let me reconsider: The correct answer should be to use a Network Load Balancer with TLS passthrough to instances that have certificates installed. Since the application cannot be changed, use a self-signed certificate on the instances for the internal traffic. Option B (self-signed certificate on EC2 and ALB re-encrypt) often requires code changes to trust the self-signed cert. Option D is the closest: NLB with TLS listener and target group with HTTPS health check. But the correct answer is actually to use an NLB with TLS listener and target group health checks over HTTPS, but the application must support HTTPS. Since the problem says no code change, the application likely already listens on HTTPS? Actually, the problem says traffic between ALB and EC2 is HTTP, so the application listens on HTTP. So we need to enable HTTPS on the instances without code change. That's not possible. The only way is to use a reverse proxy on the instance or use a self-signed certificate that the ALB can trust. But ALB can terminate TLS and re-encrypt to target group with a self-signed certificate if the target group protocol is HTTPS and the ALB trusts the self-signed certificate (by uploading it to ACM as a private certificate?). ACM does not accept self-signed certificates. So the correct solution is to use a Network Load Balancer with TLS passthrough and install a certificate on the instances. The application must support HTTPS. Since the application currently uses HTTP, the only way is to modify the application to listen on HTTPS. However, the problem says 'without changing the application code'. So the only feasible solution is to use a reverse proxy like NGINX on the instance in front of the application. That is not listed. Among the options, Option B is the least bad because you can upload a private CA-signed certificate to ACM and use it on ALB to re-encrypt to instances. But the instances need to have the corresponding certificate. That might require manual installation but not code change. Option A (NLB with TLS listener and target group protocol TCP) does not encrypt traffic to instances. Option C (CloudFront in front of ALB) adds complexity. Option D is similar to B but uses NLB. So the best answer is B. Actually, the correct answer is D: use a Network Load Balancer with TLS listener and target group health checks over HTTPS. Wait, NLB does not terminate TLS; it passes through. So the instances must handle TLS. That requires code change. So B is better because ALB can re-encrypt. But ALB re-encryption requires the target group protocol to be HTTPS and the ALB to trust the target's certificate. If the target uses a self-signed certificate, ALB will reject it. So you need a certificate signed by a CA that ALB trusts. That can be a private CA from ACM Private CA. So you can install a certificate from ACM Private CA on the instances. That is a configuration change, not code change. So B is feasible.

Answer

Configure the ALB to use a TLS listener and forward traffic to the target group using the TCP protocol on port 443.

Answer

Install a self-signed certificate on each EC2 instance, configure the ALB target group to use HTTPS, and upload the self-signed certificate to AWS Certificate Manager (ACM) for the ALB to trust.

Answer

Place AWS CloudFront in front of the ALB and configure CloudFront to use TLS 1.2, with the ALB still using HTTP.

Question 7

A social media startup uses AWS Lambda functions to process user-uploaded images. The Lambda function resizes images and stores them in Amazon S3. The function uses the S3 SDK to put objects. Recently, the team noticed that the function sometimes fails with 'Timeout' errors for large images. The Lambda function has a timeout of 5 seconds and 256 MB of memory. The team wants to improve the solution to handle larger images reliably and cost-effectively. Which solution should the team implement?

Accepted Answer

Increase the Lambda function's timeout to 15 minutes and allocate more memory (e.g., 1024 MB).. Option C (increase memory and timeout) directly addresses the issue of processing large images. Option A (Elastic Transcoder) is for video. Option B (EC2 with EBS) is overkill and not serverless. Option D (API Gateway with larger payload) does not solve the Lambda processing limit.

Answer

Migrate the image processing to a dedicated Amazon EC2 instance with an EBS volume.

Answer

Use Amazon API Gateway with a larger payload limit to offload the image processing.

Answer

Use AWS Elastic Transcoder to resize images instead of Lambda.

Question 8

A startup runs its application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to distribute traffic. During a recent marketing campaign, the application experienced high latency and some requests returned 503 errors. The team suspects that the tasks are hitting resource limits. The team wants to automatically scale the tasks based on CPU utilization. Which solution should the team implement?

Accepted Answer

Configure Application Auto Scaling for the ECS service with a target tracking scaling policy based on average CPU utilization.. Option A (Application Auto Scaling with target tracking) is the correct approach for ECS services. Option B (Auto Scaling group) is for EC2. Option C (CloudWatch alarm to stop tasks) is not scaling. Option D (Lambda to add tasks) is less efficient.

Answer

Create a CloudWatch alarm that triggers a Lambda function to stop idle tasks.

Answer

Create an Auto Scaling group for the ECS cluster and configure it to scale based on CPU utilization.

Answer

Use AWS Lambda to periodically check CPU utilization and update the desired count of the ECS service.

Question 9

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

Accepted Answer

Implement an ElastiCache for Redis cluster to cache frequently accessed data.. Option A is correct because ElastiCache for Redis provides an in-memory cache that reduces database read load without code changes. Option B is wrong because it would not reduce database load. Option C is wrong because RDS Proxy is for connection pooling, not caching. Option D is wrong because increasing instance size is a vertical scaling approach that may not be as cost-effective as caching.

Answer

Add a second RDS read replica to distribute read traffic.

Answer

Upgrade the RDS instance to a larger instance type with more vCPUs.

Answer

Enable RDS Proxy to manage database connections.

Question 10

A company runs a critical workload on EC2 instances in an Auto Scaling group across three Availability Zones. The application needs to maintain a consistent IP address for outbound traffic to external partners. The current design uses a NAT gateway in each AZ, but partners whitelist a single IP. How can the company provide a fixed outbound IP while maintaining high availability?

Accepted Answer

Deploy a Network Load Balancer with Elastic IPs in front of NAT instances in each AZ.. Option C is correct because a NAT gateway with an Elastic IP can be placed in a single AZ, but if that AZ fails, the workload fails. A Network Load Balancer with EIPs and NAT instances provides a fixed IP and HA. Option A is wrong because multiple NAT gateways have different IPs. Option B is wrong because it's not HA. Option D is wrong because a proxy fleet still uses multiple IPs.

Answer

Use a proxy fleet of EC2 instances behind an Application Load Balancer.

Answer

Use a single NAT gateway across all three AZs and assign an Elastic IP.

Answer

Use a NAT instance with an Elastic IP in one AZ.

Question 11

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

Accepted Answer

The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.. Option A is correct because the pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission. Option D is wrong because versioning is not required for writes.

Answer

The S3 bucket policy denies access from the pipeline's AWS account.

Answer

The CodeBuild project does not have the necessary environment variables.

Answer

The S3 bucket does not have versioning enabled.

Question 12

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

Accepted Answer

Increase the Lambda function's reserved concurrency and timeout.. Option B is correct because increasing the reserved concurrency ensures Lambda can scale to handle the burst. Option A is wrong because it does not address the timeout. Option C is wrong because DLQ is for failed messages after retries, not for avoiding reprocessing. Option D is wrong because batch size reduction may increase timeouts.

Answer

Reduce the batch size in the Lambda event source mapping.

Answer

Increase the SQS visibility timeout to 6 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 13

A company is using Amazon CloudFront to serve content from an S3 origin. The content is updated infrequently. Users in some regions report seeing stale content. The company wants to ensure that users always see the latest version without waiting for TTL expiration. What is the MOST cost-effective solution?

Accepted Answer

Use file versioning in the URL (e.g., appending a query string or using a unique object key).. Option D is correct because file versioning (changing the URL) guarantees fresh content without cache invalidation costs. Option A is wrong because it is costly and not automatic. Option B is wrong because reducing TTL increases origin load. Option C is wrong because it does not invalidate existing cache.

Answer

Set a very short TTL (e.g., 0 seconds) for the CloudFront distribution.

Answer

Use an origin shield to reduce the number of requests to S3.

Answer

Create a CloudFront invalidation request for the changed files after each update.

Question 14

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

Accepted Answer

Increase the number of EC2 instances running the consumer application.. Option B is correct because KCL distributes shard processing across workers; adding more workers allows parallel processing. Option A is wrong because it does not reduce per-shard load. Option C is wrong because it does not help shard distribution. Option D is wrong because it may increase shard count but still requires more workers.

Answer

Decrease the batch size in the KCL configuration.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the Kinesis stream's retention period to 7 days.

Question 15

A company is using AWS CloudFormation to manage infrastructure. The stack creation fails with the error 'Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/Admin/MySession is not authorized to perform: ec2:RunInstances'. What is the MOST likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have ec2:RunInstances permission.. Option C is correct because the IAM role assumed by CloudFormation lacks the necessary permissions. Option A is wrong because the error is about the user/role, not AWS. Option B is wrong because the error does not mention S3. Option D is wrong because the region is specified in the template.

Answer

The region specified in the template is disabled.

Answer

The CloudFormation template has a syntax error.

Answer

The AWS account is not subscribed to EC2 service.