SAP-C02 Continuous Improvement for Existing Solutions Practice Test 18 — 15 Questions

Question 1

A company is using AWS Lambda functions to process data from an S3 bucket. Recently, the function has been timing out. The function has a 5-minute timeout configured. What is the most likely cause of the timeout?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda function is processing larger files than before.. The most likely cause of the timeout is that the Lambda function is processing larger files than before, which increases execution time beyond the 5-minute timeout. Option A is incorrect: moving to a different VPC might cause network latency but not necessarily a timeout due to file processing. Option B is incorrect: reserved concurrency controls the number of concurrent executions, not the execution duration of a single invocation. Option C is incorrect: while increasing memory can improve CPU performance and reduce execution time, the immediate cause of a timeout is typically an increase in processing workload, such as larger files. Therefore, option D is correct.

Answer

The Lambda function was moved to a different VPC.

Answer

The Lambda function's reserved concurrency is set too low.

Answer

The Lambda function's memory is too low.

Question 2

A DevOps engineer notices that an EC2 instance is running but is not reachable via SSH. The instance was launched with a security group that allows SSH from anywhere (0.0.0.0/0). What is the most likely cause?

Accepted Answer

The subnet's network ACL is blocking inbound SSH traffic.. The most likely cause is that the subnet's network ACL is blocking inbound SSH traffic. While the security group allows SSH from anywhere (0.0.0.0/0), network ACLs operate at the subnet level and can override security group rules. If the network ACL denies inbound traffic on port 22, SSH connections will be blocked. Option A is less likely because even without a public IP, the instance could be reached via private IP from within the VPC; the scenario implies external SSH access. Option B is incorrect because system status checks indicate underlying hardware issues, not connectivity problems. Option C is incorrect because the security group is attached by default when launching an instance, and the question confirms it allows SSH.

Answer

The instance does not have a public IP address.

Answer

The instance is failing system status checks.

Answer

The security group is not attached to the instance.

Question 3

A company is running a stateful web application on EC2 instances behind an ALB. Users report that when they refresh a page, they are logged out. What is the best solution to fix this issue?

Accepted Answer

Enable sticky sessions on the ALB.. Enabling sticky sessions (session affinity) on the ALB ensures that all requests from a user session are routed to the same EC2 instance, preventing logout on page refresh. Option A is incorrect because cross-zone load balancing distributes traffic across instances in multiple Availability Zones but does not affect session persistence. Option C is incorrect because replacing the ALB with a Classic Load Balancer does not provide a better solution; ALB also supports sticky sessions. Option D is incorrect because while ElastiCache can store session data externally, it does not address the routing issue; the root cause is that requests are going to different instances, so sticky sessions directly solve the problem.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Replace the ALB with a Classic Load Balancer.

Answer

Use ElastiCache to store session data.

Question 4

A company has an S3 bucket that stores critical data. They need to ensure that all objects are encrypted at rest. The bucket policy currently denies uploads if the x-amz-server-side-encryption header is not set to AES256. However, some objects are still stored with SSE-KMS. How can the company enforce SSE-S3 exclusively?

Accepted Answer

Update the bucket policy to deny uploads with SSE-KMS.. Updating the bucket policy to explicitly deny uploads with SSE-KMS ensures that only SSE-S3 encryption is allowed. The current policy denies uploads without the x-amz-server-side-encryption header set to AES256, but it does not prevent uploads that specify SSE-KMS (which uses a different header value). By adding a deny condition for SSE-KMS, the company can enforce SSE-S3 exclusively.

Option A is incorrect because S3 Lifecycle policies manage object transitions and expiration, not encryption enforcement. They cannot change encryption of existing objects or prevent new uploads with unauthorized encryption.

Option B is incorrect because enabling default encryption on the bucket applies only to objects uploaded without explicit encryption headers. It does not block uploads that specify SSE-KMS or other encryption methods, as the request headers override default encryption.

Option D is incorrect because S3 Object Lambda is designed to transform data when objects are retrieved, not to enforce encryption settings on new uploads. It cannot change the encryption of objects at rest.

Answer

Use S3 Lifecycle policies to transition objects to SSE-S3.

Answer

Enable default encryption on the bucket with SSE-S3.

Answer

Use S3 Object Lambda to change encryption.

Question 5

A company is using Amazon RDS for MySQL and notices that read replicas are falling behind the primary. The primary instance is experiencing high write traffic. What is the best solution to reduce replica lag?

Accepted Answer

Increase the instance class of the read replica.. Increasing the instance class of the read replica provides it with more CPU and memory resources to apply write-ahead logs from the primary, directly addressing the replica lag caused by high write traffic. Enabling Multi-AZ on the primary (Option B) only ensures high availability and does not reduce replica lag. Disabling binary logging (Option C) would prevent replication entirely. Read replicas can be in the same region (Option D) and that does not solve lag due to resource constraints.

Answer

Enable Multi-AZ on the primary instance.

Answer

Disable binary logging on the primary.

Answer

Move the read replica to the same AWS Region as the primary.

Question 6

A company has a VPC with a public subnet and a private subnet. An EC2 instance in the private subnet needs to download patches from the internet. The instance does not have a public IP. What is the most secure way to provide internet access?

Accepted Answer

Add a NAT Gateway in the public subnet and update the private subnet's route table.. A NAT Gateway in a public subnet enables instances in a private subnet to initiate outbound internet traffic for tasks like downloading patches, while preventing inbound connections from the internet. Option A is incorrect because a VPC endpoint is used for private connectivity to AWS services, not for general internet access. Option B is incorrect because a NAT instance is less managed and secure than a NAT Gateway, and it must be placed in a public subnet. Option C is incorrect because an Internet Gateway is attached to the VPC, not directly to a subnet, and attaching it to a private subnet would not function correctly and could expose the instance to inbound traffic.

Answer

Create a VPC endpoint for the internet.

Answer

Launch a NAT instance in the private subnet.

Answer

Attach an Internet Gateway directly to the private subnet.

Question 7

A developer is deploying a serverless application using AWS SAM. The deployment fails with a 'ResourceNotReady' error. What is the most likely cause?

Accepted Answer

A resource that the application depends on is not yet created.. 'ResourceNotReady' in AWS SAM indicates that a resource the application depends on is not yet created or still in progress. This often happens when a nested stack or a resource with dependencies (e.g., a DynamoDB table) is not fully provisioned before the dependent resource tries to use it. Option A is incorrect: invalid YAML syntax would cause a template validation error, not a 'ResourceNotReady' error. Option B is incorrect: too many tags would not cause this error; tags are metadata and do not affect resource readiness. Option D is incorrect: a Lambda runtime error would occur during function invocation, not during deployment.

Answer

The SAM template has invalid YAML syntax.

Answer

The application has too many tags.

Answer

The Lambda function code has a runtime error.

Question 8

A company is using Amazon CloudFront with an S3 origin. They notice that users are receiving outdated content. What configuration change should be made to ensure users always get the latest content?

Accepted Answer

Create an invalidation for the objects.. Creating an invalidation removes cached objects from CloudFront edge locations, forcing them to be refreshed from the origin. Option A is incorrect because signed URLs control access, not cache freshness. Option C is incorrect because compression does not affect whether cached or fresh content is served. Option D is incorrect because reducing TTL to 0 would cause every request to go to the origin, increasing load and latency; invalidations are more efficient.

Answer

Use signed URLs to serve content.

Answer

Enable compression on the S3 bucket.

Answer

Reduce the TTL to 0 in the CloudFront distribution.

Question 9

Which TWO actions would improve the security of an S3 bucket that contains sensitive data? (Choose two.)

Accepted Answer

Enable default encryption (SSE-S3).. Options B and C are correct. B: Enabling default encryption (SSE-S3) ensures data is encrypted at rest, protecting it from unauthorized access. C: Enabling S3 Block Public Access prevents any public access to the bucket and its objects, reducing the risk of data exposure. Option A is incorrect because server access logging provides audit trails, not a direct security improvement. Option D is incorrect because versioning helps with data recovery, not security. Option E is incorrect because lifecycle policies manage storage costs, not security.

Answer

Enable S3 Server Access Logging.

Answer

Enable S3 Versioning.

Answer

Configure S3 Lifecycle to expire objects.

Question 10

Which THREE factors should be considered when designing a disaster recovery plan for a multi-tier application using AWS? (Choose three.)

Accepted Answer

Recovery Time Objective (RTO) and Recovery Point Objective (RPO).. Options A, B, and C are correct. A: RTO and RPO define recovery objectives. B: Data replication strategy (synchronous vs. asynchronous) impacts consistency and latency. C: DNS failover using Route 53 directs traffic to the DR site during a disaster. D is incorrect because deploying across multiple Availability Zones addresses high availability, not disaster recovery across regions. E is incorrect because larger instance sizes improve performance, not disaster recovery readiness.

Answer

Deploying the application across multiple Availability Zones.

Answer

Using larger instance sizes for better performance.

Question 11

Which TWO AWS services can be used to monitor and troubleshoot network connectivity issues between EC2 instances? (Choose two.)

Accepted Answer

VPC Reachability Analyzer.. Options D and E are correct. D: VPC Reachability Analyzer helps diagnose network connectivity issues by checking network paths between resources. E: VPC Flow Logs capture IP traffic information for analysis. A is incorrect because Amazon Inspector is a vulnerability assessment tool, not for network connectivity monitoring. B is incorrect because AWS CloudTrail records API activity, not network traffic. C is incorrect because AWS Config tracks resource configuration changes, not real-time connectivity.

Answer

Amazon Inspector.

Answer

AWS CloudTrail.

Answer

AWS Config.

Question 12

An IAM policy is attached to a user. What is the result when the user tries to upload an object with SSE-KMS encryption?

Accepted Answer

The upload is denied because the Deny statement applies to all uploads.. The explicit Deny statement without any condition applies to all uploads, overriding any Allow statements. Option A is incorrect because the Deny statement still applies even without a Principal (since it's attached to the user). Option B is incorrect because there is no size condition; the Deny applies to all uploads regardless of size. Option C is incorrect because the explicit Deny overrides the Allow for s3:PutObject.

Answer

The upload succeeds because the Deny statement has no Principal specified.

Answer

The upload is denied only if the object is larger than 5 GB.

Answer

The upload succeeds because the user has an Allow for s3:PutObject.

Question 13

An S3 bucket contains log files. An administrator runs the above AWS CLI command. What does the output indicate?

Accepted Answer

Two log files are larger than 1 KB.. The command uses the --query parameter to filter objects where size > 1000 bytes (1 KB) and returns only the keys of those objects. The output displays two keys, meaning exactly two log files are larger than 1 KB. Therefore, option A is correct. Option B is incorrect because the filter is 1000 bytes, not 1000 KB. Option C is incorrect because the bucket may contain more than two objects with the prefix 'logs/', but only two are larger than 1 KB. Option D is incorrect because the command does not query versioning.

Answer

The log files are larger than 1000 KB.

Answer

The bucket contains only two objects with the prefix 'logs/'.

Answer

The bucket has versioning enabled.

Question 14

An IAM policy condition allows launching EC2 instances only if the instance type is t2.micro or t2.small. A developer tries to launch a t2.medium instance. What happens?

Accepted Answer

The launch is denied because t2.medium is not in the allowed list.. The IAM policy condition explicitly allows only t2.micro and t2.small. When the developer tries to launch a t2.medium instance, the condition restricts the allowed types, so the launch is denied. Option D is correct because t2.medium is not in the allowed list. Option A is incorrect because the condition is explicit and no additional policy can override a deny from the condition. Option B is incorrect because the condition applies to both allow and deny. Option C is incorrect because even with an additional Allow for t2.medium, the condition would still deny it unless the condition is modified.

Answer

The launch is denied only if the user does not have a separate policy allowing t2.medium.

Answer

The launch succeeds because the condition only allows, not denies.

Answer

The launch succeeds if the user has an additional Allow for t2.medium.

Question 15

A company runs a web application on EC2 instances behind an Application Load Balancer. Recently, the application has been experiencing intermittent latency spikes. CloudWatch metrics show high CPU utilization on the instances during these spikes, but no corresponding increase in request count. Which action is MOST likely to identify the root cause?

Accepted Answer

Enable detailed monitoring on the EC2 instances.. Enabling detailed monitoring on EC2 instances provides CloudWatch metrics at a 1-minute granularity, which is crucial for identifying the exact timing and duration of CPU spikes. The intermittent nature of the latency spikes and the lack of correlation with request count suggest that the root cause may be a specific process or internal instance activity. Detailed monitoring allows for more precise analysis of CPU usage patterns, helping to isolate the cause. Option A is incorrect because increasing instance size only masks the symptom without addressing the underlying issue. Option C is incorrect because scaling policies respond to sustained high CPU utilization, not intermittent spikes, and would not help identify the root cause. Option D is incorrect because CloudTrail logs API calls and does not provide instance-level metric data needed to diagnose CPU spikes.

Answer

Increase the instance size to handle the load.

Answer

Add a scaling policy based on CPU utilization.

Answer

Enable AWS CloudTrail to log EC2 API calls.