SAP-C02 Continuous Improvement for Existing Solutions Practice Test 18 — 15 Questions

Question 1

A company is using Amazon CloudFront with an S3 origin. They notice that users are receiving outdated content. What configuration change should be made to ensure users always get the latest content?

Accepted Answer

Create an invalidation for the objects.. Option D is correct because creating an invalidation removes cached objects. Option A is incorrect because TTL to 0 would increase origin load. Option B is incorrect because signed URLs control access, not cache. Option C is incorrect because compression doesn't affect freshness.

Answer

Use signed URLs to serve content.

Answer

Enable compression on the S3 bucket.

Answer

Reduce the TTL to 0 in the CloudFront distribution.

Question 2

Which TWO actions would improve the security of an S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable default encryption (SSE-S3).. Options A and D are correct. A: Blocking public access prevents unintended exposure. D: Enabling encryption protects data at rest. B is incorrect because versioning is for data protection, not security. C is incorrect because logging is for auditing. E is incorrect because lifecycle policies manage storage, not security.

Answer

Enable S3 Server Access Logging.

Answer

Enable S3 Versioning.

Answer

Configure S3 Lifecycle to expire objects.

Question 3

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO).. Options A, B, and D are correct. A: RTO and RPO define recovery objectives. B: Replication of data ensures consistency. D: DNS failover routes traffic to DR site. C is incorrect because using larger instances may not be needed. E is incorrect because multiple AZs solve high availability within a region, not DR across regions.

Answer

Deploying the application across multiple Availability Zones.

Answer

Using larger instance sizes for better performance.

Question 4

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

Accepted Answer

VPC Reachability Analyzer.. Options A and D are correct. A: VPC Flow Logs capture IP traffic information. D: Reachability Analyzer checks network paths. B is incorrect because CloudTrail records API calls, not network traffic. C is incorrect because Config records resource configuration, not real-time connectivity. E is incorrect because Inspector is for security assessments.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Answer

AWS Config.

Question 5

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

Accepted Answer

The upload is denied because the Deny statement applies to all uploads.. Option B is correct because the Deny statement without a condition applies to all uploads, overriding the Allow. Option A is incorrect because the Allow only applies to SSE-S3. Option C is incorrect because the Deny statement applies to all principals. Option D is incorrect because the Deny statement is explicit.

Answer

The upload succeeds because the Deny statement has no Principal specified.

Answer

The upload is denied only if the object is larger than 5 GB.

Answer

The upload succeeds because the user has an Allow for s3:PutObject.

Question 6

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

Accepted Answer

Two log files are larger than 1 KB.. Option B is correct because the query filters objects larger than 1000 bytes and returns only those keys. Option A is incorrect because the output shows two keys. Option C is incorrect because the command queries objects, not versions. Option D is incorrect because size > 1000 bytes, not 1000 KB.

Answer

The log files are larger than 1000 KB.

Answer

The bucket contains only two objects with the prefix 'logs/'.

Answer

The bucket has versioning enabled.

Question 7

An IAM policy condition allows launching EC2 instances only if the instance type is t2.micro or t2.small. A developer tries to launch a t2.medium instance. What happens?

Accepted Answer

The launch is denied because t2.medium is not in the allowed list.. Option C is correct because the condition restricts allowed instance types, so t2.medium is not allowed. Option A is incorrect because the condition is explicit. Option B is incorrect because the condition applies. Option D is incorrect because the policy is evaluated at launch time.

Answer

The launch is denied only if the user does not have a separate policy allowing t2.medium.

Answer

The launch succeeds because the condition only allows, not denies.

Answer

The launch succeeds if the user has an additional Allow for t2.medium.

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

Accepted Answer

Enable detailed monitoring on the EC2 instances.. Option D is correct because detailed CloudWatch metrics (at 1-minute granularity) can provide more granular data to pinpoint when CPU spikes occur. Option A is wrong because increasing instance size only masks the symptom. Option B is wrong because scaling policies respond to sustained high CPU, not intermittent spikes. Option C is wrong because CloudTrail records API calls, not instance-level metrics.

Answer

Increase the instance size to handle the load.

Answer

Add a scaling policy based on CPU utilization.

Answer

Enable AWS CloudTrail to log EC2 API calls.

Question 9

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. Option C is correct because increasing the timeout allows longer-running functions to complete without failing. Option A is wrong because increasing memory also increases cost and may not be needed. Option B is wrong because SQS is for decoupling, not for fixing timeouts. Option D is wrong because Step Functions add complexity and cost; simpler is to adjust the timeout.

Answer

Increase the memory allocation for the Lambda function.

Answer

Use an SQS queue to buffer the S3 events.

Answer

Use AWS Step Functions to orchestrate the processing.

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

Accepted Answer

Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.. Option D is correct because a service control policy (SCP) can deny the creation of S3 buckets without encryption, enforcing compliance across all accounts. Option A is wrong because it relies on Lambda execution after bucket creation, which may have a delay. Option B is wrong because AWS Config rules can detect but not automatically remediate without additional automation. Option C is wrong because CloudTrail logs events but does not prevent non-compliant actions.

Answer

Use AWS Config rules with auto-remediation using SSM Automation.

Answer

Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.

Answer

Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.

Question 11

A company runs a critical application on an Amazon RDS for PostgreSQL DB instance. The database experiences periodic slowdowns. The team notices that the DB instance has a large number of connections in an idle state. What is the BEST way to address this issue?

Accepted Answer

Use an RDS Proxy to pool database connections.. Option B is correct because using an RDS Proxy reduces the number of idle connections by pooling and reusing them. Option A is wrong because switching to Aurora may not directly address idle connections. Option C is wrong because increasing max_connections might worsen the problem. Option D is wrong because Lambda is not a database connection management tool.

Answer

Migrate the database to Amazon Aurora.

Answer

Configure AWS Lambda to manage database connections.

Answer

Increase the max_connections parameter in the DB parameter group.

Question 12

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. Recently, a deployment failed because the new task definition referenced an ECR image that did not exist. The team wants to prevent this type of failure in the future. Which action should be taken?

Accepted Answer

Add a validation step in CodePipeline to run a task definition dry-run.. Option D is correct because running a task definition dry-run in CodePipeline can validate the image existence before deployment. Option A is wrong because ECR lifecycle policies manage images, not validate deployment. Option B is wrong because CloudTrail logs events but does not prevent failures. Option C is wrong because ECR scan on push only scans for vulnerabilities, not image existence.

Answer

Configure ECR scan on push to verify image integrity.

Answer

Add an ECR lifecycle policy to expire old images.

Answer

Enable AWS CloudTrail to log ECR API calls.

Question 13

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

Accepted Answer

Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set.. Option C is correct because an S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones. Option D is wrong because CloudTrail does not enforce encryption.

Answer

Enable default encryption on the bucket.

Answer

Use S3 Batch Operations to encrypt existing objects.

Answer

Enable AWS CloudTrail to monitor uploads without encryption.

Question 14

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The team notices that during a recent traffic spike, some instances were terminated and replaced, causing a temporary drop in performance. How can the team improve the resilience of the application?

Accepted Answer

Configure a warm pool for the Auto Scaling group.. Option B is correct because using a warm pool allows instances to be pre-initialized and ready to serve traffic quickly when scaling out. Option A is wrong because increasing instance size does not address the replacement delay. Option C is wrong because purchasing Reserved Instances does not affect scaling speed. Option D is wrong because lifecycle hooks can delay termination but do not speed up new instance readiness.

Answer

Purchase Reserved Instances to ensure capacity.

Answer

Use lifecycle hooks to wait for instance termination.

Answer

Increase the instance size to handle more traffic.

Question 15

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

Accepted Answer

Use a CloudFormation stack policy with a deny effect for resource creation without tags.. Option C is correct because CloudFormation stack policies can enforce tagging at the stack level by denying creation of resources without tags. Option A is wrong because AWS Config rules can detect but may not automatically remediate without additional setup. Option B is wrong because resource-level permissions would require modifying each service's policy. Option D is wrong because a Lambda function would be reactive and may have a delay.

Answer

Create a Lambda function that tags resources after creation.

Answer

Use IAM policies to require tagging on all resource creation.

Answer

Use an AWS Config rule with auto-remediation via SSM Automation.