SAP-C02 Continuous Improvement for Existing Solutions Practice Test 17 — 15 Questions

Question 1

A social media startup uses AWS Lambda functions to process user-uploaded images. The Lambda function resizes images and stores them in Amazon S3. The function uses the S3 SDK to put objects. Recently, the team noticed that the function sometimes fails with 'Timeout' errors for large images. The Lambda function has a timeout of 5 seconds and 256 MB of memory. The team wants to improve the solution to handle larger images reliably and cost-effectively. Which solution should the team implement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the Lambda function's timeout to 15 minutes and allocate more memory (e.g., 1024 MB).. (increase memory and timeout) directly addresses the issue: increasing memory also increases CPU and network throughput, which helps process large images faster; increasing timeout gives more time. Option A (EC2 with EBS) is overkill and not serverless, losing the benefits of Lambda. Option C (API Gateway with larger payload) does not help with Lambda's internal processing limits. Option D (Elastic Transcoder) is for video transcoding, not image resizing.

Answer

Migrate the image processing to a dedicated Amazon EC2 instance with an EBS volume.

Answer

Use Amazon API Gateway with a larger payload limit to offload the image processing.

Answer

Use AWS Elastic Transcoder to resize images instead of Lambda.

Question 2

A startup runs its application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer to distribute traffic. During a recent marketing campaign, the application experienced high latency and some requests returned 503 errors. The team suspects that the tasks are hitting resource limits. The team wants to automatically scale the tasks based on CPU utilization. Which solution should the team implement?

Accepted Answer

Configure Application Auto Scaling for the ECS service with a target tracking scaling policy based on average CPU utilization.. Uses Application Auto Scaling with a target tracking scaling policy based on average CPU utilization, which automatically adjusts the desired count of ECS tasks to maintain CPU utilization. Option B stops idle tasks via Lambda, but does not scale based on CPU utilization. Option C creates an Auto Scaling group for the ECS cluster, which is designed for EC2 instances, not Fargate tasks. Option D uses Lambda to periodically check CPU and update desired count, which is inefficient compared to native Application Auto Scaling. Therefore, Option A is correct.

Answer

Create a CloudWatch alarm that triggers a Lambda function to stop idle tasks.

Answer

Create an Auto Scaling group for the ECS cluster and configure it to scale based on CPU utilization.

Answer

Use AWS Lambda to periodically check CPU utilization and update the desired count of the ECS service.

Question 3

A company is experiencing increased latency in their web application running on EC2 instances behind an Application Load Balancer. The application uses an RDS MySQL database. The CloudWatch metrics show elevated CPU utilization on the database instance during peak hours. Which design change would be MOST effective to reduce database load without application code changes?

Accepted Answer

Enable RDS Proxy to manage database connections.. RDS Proxy is a database proxy that manages connection pooling, reducing the CPU overhead associated with opening and closing many database connections. It requires only a change in the database endpoint configuration, not application code changes, making it the most effective solution that satisfies the requirement of no code changes. Option A (read replica) would require application changes to direct read traffic to the replica. Option B (upgrading instance type) vertically scales the database but does not reduce the load; it only provides more capacity to handle the same load. Option C (ElastiCache for Redis) reduces database read load by caching frequent queries, but implementing it typically requires application code modifications to integrate the caching logic, which conflicts with the stem's requirement.

Answer

Add a second RDS read replica to distribute read traffic.

Answer

Upgrade the RDS instance to a larger instance type with more vCPUs.

Answer

Implement an ElastiCache for Redis cluster to cache frequently accessed data.

Question 4

A company runs a critical workload on EC2 instances in an Auto Scaling group across three Availability Zones. The application needs to maintain a consistent IP address for outbound traffic to external partners. The current design uses a NAT gateway in each AZ, but partners whitelist a single IP. How can the company provide a fixed outbound IP while maintaining high availability?

Accepted Answer

Deploy a Network Load Balancer with Elastic IPs in front of NAT instances in each AZ.. A Network Load Balancer (NLB) with Elastic IPs can distribute traffic to NAT instances across multiple Availability Zones, providing a fixed outbound IP and high availability. If one AZ fails, the NLB redirects traffic to healthy NAT instances in other AZs, ensuring the workload remains operational. Option A is incorrect because a proxy fleet behind an ALB would still result in multiple outbound IPs, as ALB instances have different IPs. Option B is incorrect because using a single NAT gateway across all AZs is not possible – NAT gateways are AZ-specific and cannot span zones; also, a single NAT gateway is a single point of failure. Option C is incorrect because a single NAT instance in one AZ lacks high availability – if that AZ fails, outbound connectivity is lost.

Answer

Use a proxy fleet of EC2 instances behind an Application Load Balancer.

Answer

Use a single NAT gateway across all three AZs and assign an Elastic IP.

Answer

Use a NAT instance with an Elastic IP in one AZ.

Question 5

A DevOps engineer is troubleshooting an AWS CodePipeline that fails during the Deploy stage. The pipeline deploys a static website to an S3 bucket. The error message indicates 'Access Denied' when putting objects into the bucket. What is the MOST likely cause?

Accepted Answer

The IAM role used by CodePipeline lacks s3:PutObject permission on the bucket.. The pipeline role needs s3:PutObject permission on the bucket. Option B is wrong because S3 bucket policy is not the issue if the pipeline uses a role. Option C is wrong unless the role already has the permission. Option D is wrong because versioning is not required for writes.

Answer

The S3 bucket policy denies access from the pipeline's AWS account.

Answer

The CodeBuild project does not have the necessary environment variables.

Answer

The S3 bucket does not have versioning enabled.

Question 6

A company has a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The queue receives a burst of messages daily. The Lambda function sometimes times out, causing messages to return to the queue and be reprocessed. How can the company improve the application to handle the burst without reprocessing failures?

Accepted Answer

Increase the Lambda function's reserved concurrency and timeout.. Increasing the reserved concurrency ensures Lambda can scale to handle the burst, and increasing the timeout allows the function to complete processing without timing out. Option A is wrong because reducing the batch size may reduce the number of messages processed per invocation but does not address the timeout issue. Option C is wrong because increasing the SQS visibility timeout would cause messages to be delayed before becoming visible again after a timeout, but it does not solve the root cause of the Lambda function timing out; it just delays reprocessing. Option D is wrong because a dead-letter queue is used to capture messages that repeatedly fail processing after maximum retries, not to prevent reprocessing of timeout failures.

Answer

Reduce the batch size in the Lambda event source mapping.

Answer

Increase the SQS visibility timeout to 6 minutes.

Answer

Configure a dead-letter queue for the SQS queue.

Question 7

A company is using Amazon CloudFront to serve content from an S3 origin. The content is updated infrequently. Users in some regions report seeing stale content. The company wants to ensure that users always see the latest version without waiting for TTL expiration. What is the MOST cost-effective solution?

Accepted Answer

Use file versioning in the URL (e.g., appending a query string or using a unique object key).. File versioning (changing the URL or appending a query string) is the most cost-effective solution because it guarantees that users always fetch the latest version from the origin without waiting for TTL expiration. This approach avoids the costs associated with CloudFront invalidations (Option D) and does not increase load on the origin as a very short TTL would (Option B). Option C (origin shield) helps reduce requests to the origin but does not force existing cached content to be refreshed. Therefore, file versioning is the best practice for infrequently updated content.

Answer

Set a very short TTL (e.g., 0 seconds) for the CloudFront distribution.

Answer

Use an origin shield to reduce the number of requests to S3.

Answer

Create a CloudFront invalidation request for the changed files after each update.

Question 8

A company runs a real-time analytics platform on Amazon Kinesis Data Streams with multiple consumers. The stream is provisioned with 10 shards. One consumer is falling behind, causing data latency. The consumer reads data using the Kinesis Client Library (KCL). Which action will improve the consumer's processing throughput?

Accepted Answer

Increase the number of EC2 instances running the consumer application.. The Kinesis Client Library (KCL) distributes shard processing across workers. Increasing the number of EC2 instances running the consumer application adds more workers, allowing parallel processing of shards and thus improving throughput for the lagging consumer. Option A is incorrect because decreasing the batch size reduces the number of records processed per call, which typically lowers throughput. Option B is incorrect because increasing the number of shards increases the stream's total capacity but does not directly help a consumer that is already falling behind; it may actually require more workers to handle the additional shards. Option C is incorrect because extending the retention period affects how long data is stored, not how quickly it is processed.

Answer

Decrease the batch size in the KCL configuration.

Answer

Increase the number of shards in the Kinesis stream.

Answer

Increase the Kinesis stream's retention period to 7 days.

Question 9

A company is using AWS CloudFormation to manage infrastructure. The stack creation fails with the error 'Resource handler returned message: 'User: arn:aws:sts::123456789012:assumed-role/Admin/MySession is not authorized to perform: ec2:RunInstances'. What is the MOST likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have ec2:RunInstances permission.. The error message indicates that the IAM role assumed by CloudFormation does not have permission to perform ec2:RunInstances. Therefore, the IAM role used by CloudFormation lacks the necessary permissions (Option A). Option B is incorrect because a disabled region would cause a different error, not an authorization issue. Option C is incorrect because a syntax error would produce a validation error, not an IAM authorization error. Option D is incorrect because AWS accounts are automatically subscribed to EC2; there is no subscription requirement.

Answer

The region specified in the template is disabled.

Answer

The CloudFormation template has a syntax error.

Answer

The AWS account is not subscribed to EC2 service.

Question 10

A company is migrating an on-premises application to AWS. The application requires persistent shared storage that can be accessed by multiple EC2 instances simultaneously with strong consistency. Which AWS storage solution should the company use?

Accepted Answer

Amazon EFS. Amazon EFS is a fully managed NFS file system that can be mounted by multiple EC2 instances and provides strong consistency. Option A is incorrect because Amazon S3 with S3 File Gateway provides file access to S3 but S3 is eventually consistent for overwrites, not strongly consistent. Option B is incorrect because Amazon S3 Glacier Deep Archive is designed for long-term archival storage with retrieval times of hours, not for active shared storage. Option C is incorrect because Amazon EBS with Multi-Attach enabled allows a single EBS volume to be attached to multiple instances, but it is block storage and requires a cluster-aware file system; it is not a fully managed shared file system.

Answer

Amazon S3 with S3 File Gateway.

Answer

Amazon S3 Glacier Deep Archive.

Answer

Amazon EBS with Multi-Attach enabled.

Question 11

A company has a web application behind an Application Load Balancer that uses sticky sessions. The application is deployed on EC2 instances in an Auto Scaling group. During a deployment, the team notices that users are experiencing errors after new instances are launched. What is the MOST likely cause?

Accepted Answer

The Auto Scaling group's scale-in policy is terminating instances with active sessions.. The correct answer. The issue occurs during deployment when new instances are launched. With sticky sessions enabled, user sessions are tied to specific instances. If the Auto Scaling group's scale-in policy terminates instances that have active sessions (e.g., during a rolling update or instance replacement), users lose their session data and experience errors. Option A is incorrect because the deregistration delay is about waiting for in-flight requests to complete, not about session stickiness. Option B is incorrect because if stickiness duration were too long, requests would still be routed to terminated instances, but the issue here is after new instances are launched (scale-out), not scale-in. Option D is incorrect because health checks are configured and would pass for new healthy instances; the errors stem from missing session data on the new instances.

Answer

The target group's deregistration delay is too short.

Answer

The stickiness duration is set too long, causing requests to be routed to terminated instances.

Answer

The ALB health check is not configured for the new instances.

Question 12

A company is using Amazon API Gateway with a Lambda authorizer to authenticate requests. The Lambda authorizer function times out frequently during peak traffic. The company wants to improve authorization performance without changing the authentication logic. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Enable caching of authorization responses in API Gateway.. (enabling caching of authorization responses) is correct because it caches the authorizer's response for a specified time, reducing the number of Lambda invocations during peak traffic and improving performance without changing authentication logic. Option C (increasing the Lambda function timeout) is correct because if the authorizer times out during peak traffic, increasing the timeout gives it more time to complete. Option B (using AWS WAF) is incorrect because WAF blocks suspicious requests at the web application layer, but does not improve the performance of the Lambda authorizer. Option D (increasing Lambda reserved concurrency) is incorrect because the issue is timeouts, not concurrency limits; reserved concurrency ensures capacity but does not prevent timeouts. Option E (enabling request validation in API Gateway) is incorrect because request validation checks request structure before reaching the authorizer, but does not affect authorizer performance.

Answer

Use AWS WAF to block suspicious requests.

Answer

Increase the Lambda reserved concurrency.

Answer

Enable request validation in API Gateway.

Question 13

A company uses AWS Control Tower to manage a multi-account environment. The security team wants to ensure that all accounts conform to a set of baseline rules, including encryption at rest for S3 buckets. Which THREE steps should the team take to implement this control? (Choose THREE.)

Accepted Answer

Set up an automatic remediation action using AWS Config to enable encryption on non-compliant buckets.. AWS Config can be configured with automatic remediation actions (e.g., using AWS Systems Manager Automation) to enable encryption on S3 buckets that are found non-compliant. Option C is correct because a Service Control Policy (SCP) can be applied to organizational units (OUs) in AWS Control Tower to deny the creation of S3 buckets without encryption, providing preventive governance. Option D is correct because an AWS Config rule can be defined to evaluate whether S3 buckets have encryption enabled, alerting on non-compliance. Option B is incorrect because IAM policies attached to the root user are not effective for enforcing baseline rules across multiple accounts; SCPs are designed for that purpose. Option E is incorrect because AWS CloudTrail only logs API calls for auditing and does not enforce or remediate compliance; it is not a control mechanism for ensuring encryption at rest.

Answer

Attach an IAM policy to each account's root user.

Answer

Enable AWS CloudTrail to log all S3 API calls.

Question 14

A company is designing a disaster recovery strategy for a critical application running on Amazon RDS for PostgreSQL. The primary database is in us-east-1. The company needs a Recovery Point Objective (RPO) of less than 5 seconds and a Recovery Time Objective (RTO) of less than 1 minute. Which TWO solutions meet these requirements? (Choose TWO.)

Accepted Answer

Use AWS Database Migration Service (DMS) for continuous replication.. AWS DMS with ongoing replication (change data capture) can achieve sub-5-second RPO by continuously replicating changes to a target database in another Region. The RTO can be under 1 minute if the target is pre-provisioned and promotion is automated. Option C: A cross-Region read replica uses asynchronous replication, but when configured for maximum throughput, the typical lag is under 5 seconds, and promoting the replica takes less than a minute, meeting the RPO and RTO requirements. Options B is incorrect because Multi-AZ deployments are limited to a single Region and do not support cross-Region synchronous replication. Option D: Daily snapshots have an RPO of up to 24 hours. Option E: Automated backups have an RPO of up to 5 minutes and an RTO longer than 1 minute. Therefore, only A and C satisfy the required RPO and RTO.

Answer

Configure a Multi-AZ deployment with a standby in a different AWS Region.

Answer

Take daily snapshots and copy them to another Region.

Answer

Enable automated backups with a retention period of 35 days.

Question 15

Refer to the exhibit.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/Admin"
      },
      "Action": [
        "kms:Decrypt",
        "kms:GenerateDataKey"
      ],
      "Resource": "*",
      "Condition": {
        "StringEquals": {
          "kms:CallerAccount": "123456789012"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/Admin"
      },
      "Action": [
        "kms:Decrypt"
      ],
      "Resource": "*"
    }
  ]
}

A solutions architect is reviewing the above KMS key policy. The Admin role cannot decrypt data using the key. What is the MOST likely reason?

Accepted Answer

There is an explicit deny statement elsewhere in the policy.. The key policy shown does not contain any explicit deny statements, so the inability to decrypt must be due to an explicit deny elsewhere in the key policy (possibly not shown) or in an IAM policy attached to the role. Option B is incorrect because the kms:CallerAccount condition checks the AWS account ID of the principal making the request; when a role from account 123456789012 is assumed, the caller account is 123456789012, regardless of the user's origin. Therefore, the condition would pass, and the first statement would apply. Since both statements allow decryption, the only remaining explanation is an explicit deny somewhere.

Answer

The second statement does not include kms:GenerateDataKey, which is required for decryption.

Answer

The condition in the first statement restricts decryption to requests coming from account 123456789012, but the role might be used by a user from a different account.

Answer

The condition key kms:CallerAccount is not a valid condition key for KMS key policies.