SAP-C02 Continuous Improvement for Existing Solutions Practice Test 16 — 15 Questions

Question 1

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instance and configure it to tail the log file.. The Amazon CloudWatch agent can be installed on the EC2 instance without modifying the application code. It tails the local log file and sends the logs to Amazon CloudWatch Logs for centralized monitoring. Option A is incorrect because Amazon Kinesis Agent streaming to Kinesis Data Firehose adds unnecessary complexity for simple log ingestion. Option C is incorrect because it requires modifying the application code. Option D is incorrect because AWS CloudTrail captures API activity, not application logs. Option E is incorrect because it requires modifying the application code to write to Amazon S3.

Answer

Use Amazon Kinesis Agent to stream the log file to Amazon Kinesis Data Firehose.

Answer

Modify the application to use the AWS SDK for logging to Amazon CloudWatch Logs.

Answer

Turn on AWS CloudTrail for the EC2 instance to capture logs.

Answer

Configure the application to write logs to Amazon S3 using the AWS SDK.

Question 2

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. The company currently uses server-side encryption with S3 managed keys (SSE-S3). The team wants to enforce encryption using a customer-managed key (CMK) from AWS KMS. Which TWO actions should the team take?

Accepted Answer

Configure a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. Option A is correct because a bucket policy that denies PutObject unless the x-amz-server-side-encryption header equals 'aws:kms' enforces that clients explicitly request SSE-KMS with a KMS CMK, preventing uploads that would otherwise fall back to SSE-S3 or no encryption. Option C is correct because enabling default bucket encryption with SSE-KMS ensures that any PutObject request that does not specify an encryption header is automatically encrypted with a customer-managed AWS KMS key rather than S3-managed keys. Together, these two actions provide both a preventive policy guardrail and a default encryption baseline for all objects at rest. Option B is not correct because CloudTrail only records and audits API activity; it does not enforce encryption. Option D is not correct because a bucket policy cannot generically test whether an object 'is encrypted' after the fact; enforcement must be based on request headers or default encryption settings. Option E is not correct because SSE-S3 cannot be disabled on a bucket; S3 applies encryption by default, and the choice of SSE-S3 versus SSE-KMS is controlled through request headers, bucket policies, and default encryption configuration.

Answer

Enable AWS CloudTrail to audit all PutObject requests.

Answer

Configure a bucket policy that allows PutObject only if the object is encrypted.

Answer

Disable SSE-S3 on the bucket so that only SSE-KMS can be used.

Question 3

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

Accepted Answer

Create a conformance pack in the management account and deploy it to the organization.. Option C is correct because AWS Config conformance packs can be created in the management account and deployed across all accounts in an AWS Organization, packaging the required Config rule (e.g., s3-bucket-server-side-encryption-enabled) so it is automatically applied to new accounts as they join. Option E is correct because AWS Config must be enabled in each account for any Config rule or conformance pack to evaluate resources there; without enabling the configuration recorder and delivery channel in every account, the deployed rule cannot assess S3 bucket encryption. Option A is not appropriate because CloudFormation StackSets deploy stacks, not Config rules directly, and would require additional setup rather than the native organization-wide Config deployment mechanism. Option B is wrong because an SCP denying PutBucketEncryption would block encryption actions rather than enforce that buckets are encrypted, and SCPs do not evaluate resource compliance. Option D is wrong because AWS Config rules are regional and account-scoped; a rule created in the management account does not automatically apply to all accounts via Organizations.

Answer

Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.

Answer

Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.

Answer

Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.

Question 4

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

Accepted Answer

Use AWS CloudFormation resource import to bring the existing bucket into the stack.. The stack update failed because the S3 bucket already existed, likely due to it being removed from the template and then added back. By using AWS CloudFormation resource import, you can bring the existing bucket into the stack's management, preventing CloudFormation from attempting to create it again. This resolves the immediate error and allows future updates without conflict. DeletionPolicy Retain only prevents deletion, not creation conflicts.

Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Answer

Use a custom resource to check if the bucket exists before creation.

Answer

Manually delete the S3 bucket before each stack update.

Question 5

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

Accepted Answer

Modify the RDS instance to use a larger instance type with higher IOPS.. High write latency on RDS is typically caused by insufficient IOPS or CPU on the DB instance. Upgrading to a larger instance type with higher IOPS (e.g., moving to a provisioned IOPS SSD-backed instance or a larger class) directly improves write throughput without application changes.

Answer

Create a read replica and offload read traffic.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the DB parameter group to optimize for write operations.

Question 6

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the CloudWatch Logs agent and stream logs to CloudWatch Logs, then delete local logs.. Installing the CloudWatch Logs agent and streaming logs to CloudWatch Logs, then deleting local logs, automatically manages disk space without application changes. The agent can be configured to rotate and delete local logs after they are streamed, preventing the volume from filling up.

Answer

Configure an S3 Lifecycle policy to transition log files to Amazon S3 Glacier after 30 days.

Answer

Increase the EBS volume size and enable auto-scaling.

Answer

Use a script with Amazon Data Lifecycle Manager to snapshot the volume and delete old snapshots.

Question 7

A company is using AWS Elastic Beanstalk to deploy a web application. The application's performance degrades over time due to increasing database connections. The company wants to implement a solution that automatically scales the database tier based on connection count. Which action should be taken?

Accepted Answer

Use Amazon RDS Proxy to manage database connections and enable connection pooling.. Amazon RDS Proxy manages connection pooling and can scale with application, reducing load on database. Option A is wrong because DynamoDB is a different database. Option C is wrong because scaling EC2 instances does not address database connections. Option D is wrong because modifying RDS instance type is manual and not automatic.

Answer

Migrate the database to Amazon DynamoDB with auto scaling.

Answer

Enable Multi-AZ on the RDS instance and modify the DB instance class.

Answer

Configure the Auto Scaling group to scale based on CPU utilization.

Question 8

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. The team wants to capture network traffic between containers for troubleshooting. Which solution should they implement?

Accepted Answer

Enable VPC Flow Logs on the ENIs attached to the ECS tasks.. VPC Flow Logs capture IP traffic metadata (source/destination IP, port, protocol, bytes, accept/reject) for the elastic network interfaces attached to ECS tasks, which is the correct way to observe network traffic between containers on Fargate. Because Fargate tasks have ENIs, enabling flow logs on those ENIs provides the network-level visibility needed to troubleshoot latency spikes.

Answer

Enable AWS X-Ray tracing on the ECS tasks.

Answer

Configure the awslogs driver to send container logs to CloudWatch Logs.

Answer

Use Amazon ECS Exec to access containers and run tcpdump.

Question 9

A company is migrating a legacy application to AWS. The application requires a relational database with high I/O and low latency. The database size is 2 TB and growing. The Solutions Architect must choose a storage solution that provides the best price-performance. Which TWO solutions meet these requirements?

Accepted Answer

Use Amazon Aurora with I/O-Optimized cluster configuration.. Option A is correct because Amazon Aurora with the I/O-Optimized cluster configuration is purpose-built for I/O-intensive relational workloads, charging a predictable price based on database capacity rather than per-I/O, which delivers better price-performance when I/O usage is high and latency must stay low. Option B is correct because Amazon RDS with Provisioned IOPS io2 volumes lets you provision a specific IOPS level (up to 256,000 IOPS and sub-millisecond latency) for a 2 TB relational database, giving the sustained high I/O and low latency the legacy application needs while remaining a managed relational service. Option C is wrong because DynamoDB is a NoSQL key-value/document store, not a relational database, so it does not satisfy the relational requirement. Option D is wrong because Redshift is a columnar data warehouse for analytics, not a low-latency transactional relational database. Option E is wrong because gp3 is a general-purpose SSD baseline (3,000 IOPS, up to 16,000 IOPS) that does not provide the high, dedicated I/O performance the workload demands.

Answer

Use Amazon DynamoDB with provisioned capacity.

Answer

Use Amazon Redshift with dense compute nodes.

Answer

Use Amazon RDS with gp3 storage.

Question 10

A company is using AWS CodePipeline to automate deployments. The pipeline includes a build stage that compiles code and runs tests. The build stage fails intermittently due to network timeouts when downloading dependencies. Which THREE actions could improve the reliability of the build stage?

Accepted Answer

Use CodeBuild local cache to store dependencies across builds.. Option B is correct because CodeBuild local cache (or S3 cache) persists dependency directories such as Maven .m2 or npm node_modules between builds, so the build stage avoids re-downloading dependencies and eliminates the network calls that are timing out. Option C is correct because running the CodeBuild project inside a VPC with a NAT gateway provides stable, predictable outbound internet connectivity for dependency downloads, avoiding the intermittent timeouts that can occur with default networking. Option D is correct because storing dependencies in an S3 bucket and configuring the build to pull cached dependencies from S3 replaces fragile external downloads with reliable, low-latency AWS-internal retrieval. Option A is not ideal because increasing the build timeout only gives the failing downloads more time; it does not fix the underlying network reliability problem. Option E is incorrect because a larger compute type increases CPU and memory, not network bandwidth or reliability, so it will not resolve intermittent download timeouts.

Answer

Increase the build timeout to allow more time for downloads.

Answer

Use a larger compute type for CodeBuild to improve network speed.

Question 11

An e-commerce company runs a customer-facing application on AWS. The application architecture includes an Application Load Balancer (ALB), EC2 instances in an Auto Scaling group, and an Amazon RDS for MySQL Multi-AZ DB instance. The application uses a custom web server that stores session data in a local file system. During peak traffic, users experience session timeouts and errors. The operations team observes that the Auto Scaling group launches new instances and terminates old ones frequently. The team wants to improve the user experience and ensure session persistence. The Solutions Architect proposes to modify the application to store session data in an external store. However, due to a legacy code dependency, the application cannot be modified in the short term. Which solution should the Solutions Architect implement to resolve the session persistence issue without modifying the application?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB and configure the Auto Scaling group to use a lifecycle hook to drain connections before instance termination.. Enabling sticky sessions on the ALB ensures that a user's requests are always routed to the same instance, preserving the local session files. Additionally, configuring a lifecycle hook to drain connections before instance termination prevents session loss during scale-in events. Option A is incorrect because ElastiCache requires application code changes to use it. Option C is incorrect because DynamoDB also requires code changes. Option D is incorrect because scaling down based on memory does not prevent session loss; it may cause more terminations.

Answer

Replace the local file system storage with an Amazon ElastiCache for Redis cluster that is external to the instances.

Answer

Store session data in Amazon DynamoDB and configure the application to use the DynamoDB session handler.

Answer

Configure the Auto Scaling group to scale down based on memory utilization rather than CPU, to reduce termination frequency.

Question 12

A company uses AWS Lambda functions within a VPC to process data from an Amazon SQS queue. The Lambda functions frequently timeout with the error 'Task timed out after 3.00 seconds'. The functions perform database operations on an RDS instance in the same VPC. The average database query takes 2 seconds. What is the MOST likely cause of the timeouts?

Accepted Answer

The VPC does not have a NAT gateway, so the Lambda function cannot poll the SQS queue.. Lambda functions in a VPC require a NAT gateway or VPC endpoints to access the SQS API, which is outside the VPC. Without a NAT gateway, the function cannot poll the SQS queue, causing timeouts. Option A is wrong because Lambda can access RDS within the same VPC without special permissions. Option C is wrong because the timeout is due to SQS polling failure, not the database query time. Option D is wrong because the RDS instance is under-provisioned would cause slow queries, but the error is a timeout after exactly 3 seconds, indicating the function is waiting on something else (SQS polling).

Answer

The Lambda function does not have the required VPC permissions to access the RDS instance.

Answer

The Lambda function timeout should be increased to accommodate database query time.

Answer

The RDS instance is under-provisioned and causing slow queries.

Question 13

A company is running a stateless web application on Amazon EC2 instances in an Auto Scaling group. The application stores session data in an Amazon ElastiCache Redis cluster. After a recent deployment, users are being logged out frequently. What is the most likely cause?

Accepted Answer

The application is not using the ElastiCache cluster for session storage.. The most likely cause is that the application is not using the ElastiCache cluster for session storage. If the application fails to properly store session data in Redis, sessions will not persist across instances. This becomes evident after a deployment if the configuration or code change inadvertently disables Redis session handling. Option A is incorrect because a small Auto Scaling group min size does not cause logouts; it affects capacity. Option B is incorrect because an aggressive health check might cause instance replacement, but if sessions are stored in Redis, users should not be logged out. Option D is incorrect because the ALB does not directly interact with ElastiCache; security group issues would cause connection failures, not intermittent logouts.

Answer

The Auto Scaling group's min size is too small.

Answer

The Elastic Load Balancer's health check is too aggressive.

Answer

The ElastiCache cluster's security group is blocking traffic from the ALB.

Question 14

A company runs a containerized microservices application on Amazon ECS using Fargate. The application includes a service that processes messages from an Amazon SQS queue. The service is CPU-bound and takes longer to process messages as the queue depth increases. The team wants to automatically scale the number of tasks based on the queue depth. Which solution is MOST effective?

Accepted Answer

Configure ECS Service Auto Scaling with a target tracking scaling policy based on the SQS queue's ApproximateNumberOfMessagesVisible metric.. ECS Service Auto Scaling with a target tracking policy on the SQS ApproximateNumberOfMessagesVisible metric directly ties task count to queue depth, which is the actual workload signal for a queue-driven, CPU-bound service. As the queue grows, more tasks are added; as it drains, tasks scale in. This is the most responsive and workload-aligned approach.

Answer

Use an AWS Lambda function to poll the SQS queue and invoke a new task for each message.

Answer

Increase the CPU allocation for the task definition to process messages faster.

Answer

Use a CloudWatch alarm based on CPU utilization to trigger an Auto Scaling action.

Question 15

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

Accepted Answer

The ALB is buffering requests because the backend instances are overwhelmed; increase the number of instances or improve instance performance.. SurgeQueueLength is an ALB metric that tracks the number of requests waiting in the ALB's surge queue because the load balancer cannot immediately forward them to a healthy backend target. A consistently high value means the backend targets (EC2 instances) are not accepting connections fast enough — they are overwhelmed or under-provisioned. The correct remediation is to scale out (add instances) or scale up (improve instance performance) so the backend can drain the queue.

Answer

The backend instances are failing health checks; review the health check configuration.

Answer

Clients are sending too many requests; implement API rate limiting.

Answer

The ALB is experiencing a high number of new connections; increase the idle timeout setting.