SAP-C02 Continuous Improvement for Existing Solutions Practice Test 17 — 15 Questions

Question 1

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. What is the MOST scalable and efficient way to enforce this policy?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use an SCP that denies s3:PutBucketEncryption actions unless the encryption is set to aws:kms.. Using a service control policy (SCP) that denies s3:PutBucketEncryption unless the encryption is set to aws:kms is the most scalable and efficient way to enforce encryption across all accounts in an AWS Organization. SCPs are applied centrally and affect all accounts without requiring per-account configuration. Option A is less scalable because a periodic Lambda function may have delays and requires managing cross-account roles. Option C is per-account and requires Config rules and remediation in each account, which is less efficient. Option D only provides monitoring and alerting, not enforcement.

Answer

Use an AWS Lambda function that runs periodically across all accounts to check and remediate buckets.

Answer

Use AWS Config rules in each account to detect unencrypted buckets and trigger auto-remediation.

Answer

Use AWS CloudTrail to monitor PutBucketEncryption calls and alert the security team.

Question 2

A company runs a critical application on Amazon RDS for MySQL. The database size is 500 GB and growing. The application experiences high write latency during peak hours. A Solutions Architect needs to improve write performance with minimal downtime. Which THREE actions should the architect take? (Choose three.)

Accepted Answer

Migrate the database to Amazon Aurora with MySQL compatibility.. Option A is correct because migrating to Amazon Aurora with MySQL compatibility provides a distributed, log-structured storage system that reduces write amplification and delivers significantly higher write throughput than standard RDS for MySQL, and it can be done with minimal downtime using a snapshot restore or Aurora read replica promotion. Option D is correct because switching to Provisioned IOPS (io1/io2) storage guarantees dedicated IOPS independent of storage size, directly addressing high write latency during peak hours by ensuring consistent disk performance. Option E is correct because increasing allocated storage on RDS for MySQL also raises the baseline IOPS and throughput for gp2/gp3 storage (gp2 scales at 3 IOPS per GiB), which can improve write performance without downtime since RDS supports online storage scaling. Option B is not correct because a read replica only offloads read traffic and does not improve write performance on the primary. Option C is not correct because Multi-AZ provides high availability through synchronous standby replication, not write performance improvement; it can even add slight write latency.

Answer

Add a read replica to offload read traffic.

Answer

Enable Multi-AZ deployment for the DB instance.

Question 3

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

Accepted Answer

Modify the function to stream the file from S3 instead of downloading it entirely.. Option C is correct because streaming the object from S3 (for example, using the S3 GetObject response body as a stream) avoids first writing the whole file to /tmp, cutting the download-plus-write latency and reducing the risk of hitting the execution time limit. Option D is correct because the function is timing out, so raising the Lambda timeout (up to 15 minutes) gives the current processing logic enough time to finish instead of being terminated mid-execution. Option A is wrong because reserved concurrency only caps or guarantees the number of simultaneous invocations; it does not make a single slow invocation faster. Option B is wrong because more memory also scales CPU proportionally, but it does not address the dominant cost of downloading and writing the entire file, and it is not one of the intended fixes here. Option E is wrong because increasing /tmp (up to 10 GB) only provides more scratch space; it does not reduce the time spent downloading and writing the file.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Increase the /tmp storage limit for the Lambda function.

Question 4

A Solutions Architect runs the following command for an EC2 instance that is part of an Auto Scaling group. The instance is in a private subnet and should only receive traffic from an Application Load Balancer. However, the instance is accessible from the internet.

```
$ aws ec2 describe-instances --instance-id i-0abcd1234efgh5678
{
    "Reservations": [
        {
            "Instances": [
                {
                    "InstanceId": "i-0abcd1234efgh5678",
                    "SecurityGroups": [
                        {
                            "GroupName": "sg-web-app",
                            "GroupId": "sg-0123456789abcdef0"
                        }
                    ],
                    "PublicIpAddress": null,
                    "SubnetId": "subnet-12345678",
                    "VpcId": "vpc-23456789"
                }
            ]
        }
    ]
}
```

Based on the output, what is the most likely reason?

Accepted Answer

The security group attached to the instance allows inbound traffic from 0.0.0.0/0.. The output shows the instance has a security group 'sg-web-app' attached to its network interface. If that security group allows inbound traffic from 0.0.0.0/0, the instance would be accessible from the internet regardless of the subnet being private. The subnet's route table (Option A) having a route to an internet gateway would not matter for inbound traffic because the instance is in a private subnet and lacks a public IP; the ALB would handle inbound traffic via its public IP and forward to the private instance. Option B is incorrect because an Elastic IP would make the instance directly reachable from the internet, but the output does not show an Elastic IP. Option C is incorrect because the instance is in a private subnet and would not have a public IP assigned automatically.

Answer

The subnet's route table has a route to an internet gateway.

Answer

The instance has an Elastic IP address attached.

Answer

The instance has a public IP address assigned.

Question 5

A company runs a critical e-commerce platform on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances running a web server. The web servers store session data locally on the instance's ephemeral storage. The Auto Scaling group is configured with a min of 2, max of 10, and desired of 2. Recently, during a flash sale, traffic surged and the Auto Scaling group scaled out to 10 instances. However, many users reported that their shopping carts were lost and they were logged out during the event. The Cognito user pool was used for authentication, and the application uses cookies to maintain session state. The ALB's stickiness is enabled. The team observed that the ALB's RequestCountPerTarget metric was well below the instance's capacity, but the error rate increased. The CloudWatch logs show that the web server returned 503 errors for a subset of requests. After the flash sale ended, the Auto Scaling group scaled back to 2 instances, and the issue disappeared. The team wants to prevent this from happening in future events. Which solution should the Solutions Architect recommend?

Accepted Answer

Modify the application to store session data in an Amazon ElastiCache for Redis cluster instead of local ephemeral storage.. The root cause is that session state is stored on each instance's ephemeral storage, so when the Auto Scaling group scales out, new instances have no knowledge of existing sessions, and when it scales in, sessions on terminated instances are lost. ALB stickiness only helps while the same instance remains in service; it cannot preserve sessions across scale-in events or instance replacement. Moving session data to ElastiCache for Redis externalizes state so any instance can serve any request, eliminating lost carts and logouts during scaling. This directly addresses the 503 errors caused by session-dependent requests failing on instances that lack the session.

Answer

Increase the minimum size of the Auto Scaling group to 10 to handle the surge without scaling down.

Answer

Disable stickiness on the ALB so that any instance can handle any request.

Answer

Increase the health check interval on the ALB to prevent instances from being marked unhealthy too quickly.

Question 6

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

Accepted Answer

Increase the Lambda function reserved concurrency.. Lambda polls SQS using an event source mapping, and each concurrent Lambda invocation processes one batch. Increasing reserved concurrency allows more simultaneous pollers/invocations, directly raising throughput and draining the backlog without code changes. Reserved concurrency also guarantees those slots are not throttled by other functions sharing the account pool.

Answer

Increase the SQS visibility timeout to allow more time per message.

Answer

Increase the Lambda function memory and timeout settings.

Answer

Increase the SQS batch size to the maximum of 100.

Question 7

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

Accepted Answer

Enable API Gateway caching with a TTL of 60 seconds.. Option C is correct because enabling API Gateway caching with a TTL of 60 seconds stores responses at the API Gateway stage level, reducing the number of invocations that reach the Lambda functions and DynamoDB, which directly lowers latency for repeated requests and reduces the load that can cause 5xx errors. Option E is correct because DynamoDB auto scaling adjusts the table's read/write capacity based on utilization via Application Auto Scaling, preventing throttling (ProvisionedThroughputExceededException) that would otherwise surface as Lambda errors and API Gateway 5xx responses. Option A is not appropriate because setting reserved concurrency to 5 caps the function's concurrency at a very low value, which would throttle invocations and worsen 5xx errors rather than improve reliability. Option B is not the best fit because provisioned concurrency reduces cold-start latency but does not address DynamoDB throttling or backend load, and it adds cost without fixing the root cause. Option D is not appropriate because increasing the Lambda timeout to 30 seconds only allows slow executions to run longer; it does not reduce latency and can increase cost and tie up concurrency.

Answer

Set Lambda reserved concurrency to 5 for each function.

Answer

Configure provisioned concurrency for all Lambda functions.

Answer

Increase the Lambda function timeout to 30 seconds.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache Redis cluster. The operations team has noticed that during peak hours, application response times increase significantly. They need to improve performance without downtime. Which THREE actions should they take? (Choose 3)

Accepted Answer

Enable connection draining on the ALB.. Option A is correct because enabling connection draining (deregistration delay) on the ALB allows in-flight requests to complete before an instance is removed from service, which supports safe, zero-downtime scaling and deployment operations during peak load. Option D is correct because adding read replicas to the ElastiCache Redis cluster offloads read traffic from the primary node, reducing latency and improving throughput for session-state reads during peak hours. Option E is correct because adding more EC2 instances to the Auto Scaling group horizontally scales the web tier, distributing the increased request volume across more instances and improving response times without downtime. Option B is not appropriate because decreasing the ALB idle timeout would prematurely close idle connections, potentially causing errors rather than improving performance. Option C is not the best choice because vertical scaling requires stopping and resizing instances, which introduces downtime and does not address the distributed session-store bottleneck as effectively as horizontal scaling and read replicas.

Answer

Decrease the idle timeout of the ALB.

Answer

Increase the EC2 instance size to a larger instance type.

Question 9

A media company runs a video processing pipeline on AWS. Videos are uploaded to an S3 bucket (input-bucket), which triggers an AWS Lambda function that starts an AWS Glue job. The Glue job processes the video metadata and stores results in a DynamoDB table. Then, a second Lambda function triggers an Amazon ECS Fargate task to transcode the video into multiple formats. The transcoded videos are stored in another S3 bucket (output-bucket). Recently, the company started receiving complaints about delays in video availability. The operations team notices that CloudWatch Logs show no errors, but the ECS tasks often take longer than expected. They also see that the DynamoDB table has a high number of throttled write events. The video upload rate has increased by 50% in the last month. The team needs to improve the pipeline's performance and reduce delays. What should they do?

Accepted Answer

Enable DynamoDB auto scaling on the table with a target utilization of 70%.. The pipeline's bottleneck is DynamoDB write throttling, which is causing the Glue job's metadata writes to back off and delaying downstream ECS transcoding. Enabling DynamoDB auto scaling on the table (and its GSIs) with a target utilization around 70% lets the table scale write capacity up and down with the 50% increased upload rate, eliminating throttling without over-provisioning. This directly addresses the observed symptom.

Answer

Increase the Lambda function timeout for both functions to 15 minutes.

Answer

Introduce an Amazon SQS queue between the second Lambda and ECS to buffer requests.

Answer

Set reserved concurrency on the first Lambda function to 10 to control throttling.

Question 10

A financial services company uses Amazon RDS for MySQL as the backend for a trading application. The application runs on EC2 instances in an Auto Scaling group behind an ALB. The database is a Multi-AZ DB instance with 500 GB provisioned storage. During peak trading hours, the application becomes slow. The RDS metrics show high CPU utilization and high read IOPS. The application performs many read-heavy queries. The team needs to improve performance without application changes. What should they do?

Accepted Answer

Create one or more read replicas and direct read traffic to them.. Read replicas offload read-heavy query traffic from the primary DB instance, directly addressing the high read IOPS and CPU utilization caused by the application's many read queries. Because RDS read replicas use MySQL's native asynchronous replication, the application can be pointed at the replica endpoint without code changes — only the connection string changes. This is the standard AWS pattern for scaling read-intensive RDS workloads.

Answer

Modify the DB instance to a larger instance type with more vCPUs.

Answer

Enable Performance Insights and create a CloudWatch dashboard.

Answer

Convert the DB instance to a Multi-AZ cluster with two readable standbys.

Question 11

A company uses AWS CloudFormation to manage infrastructure as code. They have a production stack that includes an EC2 instance, an RDS database, and an S3 bucket. Recently, an engineer manually terminated the EC2 instance from the console. The CloudFormation stack status shows UPDATE_ROLLBACK_FAILED. The company wants to recover the stack to a consistent state. What should they do?

Accepted Answer

Manually recreate the EC2 instance with the same configuration, then tell CloudFormation to continue the update rollback.. When a CloudFormation stack is in UPDATE_ROLLBACK_FAILED, it means the rollback itself could not complete — typically because a resource was manually modified or deleted outside CloudFormation. The documented recovery path is to manually restore the resource to its expected state (recreate the EC2 instance with the same logical ID and configuration), then run ContinueUpdateRollback so CloudFormation can finish the rollback and return the stack to a stable state.

Answer

Create a change set to update the stack to ignore the EC2 instance.

Answer

Update the stack with a new template that removes the EC2 instance.

Answer

Delete the stack and recreate it using a new template.

Question 12

A company runs a stateless web application on AWS Elastic Beanstalk. The application experiences periodic spikes in traffic that cause CPU utilization to reach 90% on the EC2 instances. The company wants to automatically scale the environment based on CPU usage. They also want to ensure that the scaling is proactive and can handle sudden traffic surges. What should they do?

Accepted Answer

Configure a predictive scaling policy using AWS Auto Scaling.. Predictive scaling policies in AWS Auto Scaling use historical data to forecast future traffic and proactively adjust capacity, handling sudden surges. Option A: Simple scaling policies react after alarms trigger, causing delays. Option C: Manual scaling is not automated. Option D: Scheduled scaling works for known peak times but not for unpredictable surges.

Answer

Configure a simple scaling policy based on CPU utilization with a cooldown period.

Answer

Manually increase the instance count when traffic spikes are expected.

Answer

Use scheduled scaling to add instances during known peak times.

Question 13

A gaming company uses Amazon DynamoDB as the database for a leaderboard feature. The table has a partition key of 'game_id' and a sort key of 'score'. The table uses on-demand capacity mode. During a new game launch, write traffic to a few popular game_id partitions becomes very hot, causing throttling. The company wants to improve performance for these hot partitions without changing the application code. What should they do?

Accepted Answer

Implement an Amazon SQS queue to buffer write requests.. The problem is hot partitions caused by a non-uniform workload, not insufficient capacity. DynamoDB on-demand mode automatically scales to accommodate traffic, but it cannot split a single partition key beyond the 1,000 WCU per second limit. Since the application code cannot be changed, the only viable solution is to decouple writes using an SQS queue, which buffers and smooths the write requests, allowing DynamoDB to process them at a manageable rate without throttling. This approach maintains the existing table schema and application logic while absorbing sudden spikes.

Answer

Add a global secondary index with a different partition key.

Answer

Enable DynamoDB Accelerator (DAX) for the table to cache frequently accessed data.

Answer

Switch to provisioned capacity and increase read/write capacity units for the table.

Question 14

A company hosts a static website on Amazon S3 with public read access. The website uses a custom domain name (www.example.com). The company wants to improve performance for global users and also add HTTPS support. They have already set up a CloudFront distribution with the S3 bucket as the origin. However, users still cannot access the website via HTTPS. What should they do?

Accepted Answer

Configure the CloudFront distribution to use a custom SSL certificate and set the alternate domain name (CNAME) to www.example.com.. To serve HTTPS on a custom domain via CloudFront, you must attach a valid SSL/TLS certificate to the distribution and configure the alternate domain name (CNAME) to match the custom domain. The certificate must be issued in ACM in the us-east-1 region for CloudFront. Setting the alternate domain name ensures CloudFront accepts requests for www.example.com and presents the correct certificate.

Answer

Request an SSL certificate from AWS Certificate Manager (ACM) and import it into CloudFront.

Answer

Enable static website hosting on the S3 bucket and configure the bucket policy to allow HTTPS.

Answer

Place an Application Load Balancer in front of the S3 bucket and attach an SSL certificate.

Question 15

A company runs a batch processing job on Amazon EMR every night. The job processes data from an S3 bucket and writes results to another S3 bucket. The job currently takes 6 hours to complete. The company wants to reduce the runtime to under 2 hours to meet a new SLA. The data volume is expected to grow by 20% each month. The EMR cluster uses a single master node and 10 core nodes of type m5.xlarge. The job is CPU-bound. What should they do?

Accepted Answer

Increase the number of core nodes in the EMR cluster.. The job is CPU-bound and currently takes 6 hours with 10 core nodes; to reduce runtime to under 2 hours, the cluster needs more compute capacity. Increasing the number of core nodes adds both HDFS storage and CPU, directly scaling the processing power for the CPU-bound job, making it the correct choice.

Answer

Change the core node instance type to m5.4xlarge.

Answer

Use spot instances for the core nodes to reduce costs.

Answer

Add task nodes with spot instances to the cluster.