SAP-C02 Continuous Improvement for Existing Solutions Practice Test 19 — 15 Questions

Question 1

A company uses AWS Lambda functions to process files uploaded to an S3 bucket. The processing time varies, but some files fail with a timeout error. The function has the default timeout setting. What is the MOST cost-effective way to resolve this issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Increase the Lambda function timeout.. The default Lambda timeout is 3 seconds, which is insufficient for processing that can take longer. Increasing the timeout allows the function to complete without incurring additional costs. Option A is wrong because increasing memory also increases cost and does not directly address timeouts; it may improve performance but at higher cost. Option B is wrong because SQS buffering does not resolve timeout issues; it only decouples event sources. Option C is wrong because Step Functions add complexity and cost; a simpler solution is to adjust the timeout.

Answer

Increase the memory allocation for the Lambda function.

Answer

Use an SQS queue to buffer the S3 events.

Answer

Use AWS Step Functions to orchestrate the processing.

Question 2

A company has a multi-account AWS environment using AWS Organizations. The security team needs to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. The team wants to automatically remediate any non-compliant buckets created in the future. Which solution is MOST effective and requires the least ongoing maintenance?

Accepted Answer

Apply a service control policy (SCP) that denies s3:PutBucketEncryption actions unless encryption is set.. A service control policy (SCP) can proactively deny the creation of S3 buckets without encryption, enforcing compliance across all accounts before any non-compliant bucket is created. Option A is incorrect because AWS Config rules with SSM Automation remediate after the fact, introducing a delay and relying on detection, not prevention. Option B is incorrect because an AWS Lambda function triggered by S3 bucket creation events reacts to the creation event but does not prevent the bucket from being created unencrypted; it only attempts to enable encryption after creation, which may not always work seamlessly. Option C is incorrect because CloudTrail and metric filters only provide alerts after the non-compliant bucket is created, offering no automated remediation or prevention.

Answer

Use AWS Config rules with auto-remediation using SSM Automation.

Answer

Use an AWS Lambda function triggered by S3 bucket creation events to enable encryption.

Answer

Enable AWS CloudTrail and create a metric filter to alert on non-encrypted bucket creation.

Question 3

A company runs a critical application on an Amazon RDS for PostgreSQL DB instance. The database experiences periodic slowdowns. The team notices that the DB instance has a large number of connections in an idle state. What is the BEST way to address this issue?

Accepted Answer

Use an RDS Proxy to pool database connections.. Using an RDS Proxy reduces the number of idle connections by pooling and reusing them. Option A is wrong because switching to Aurora may not directly address idle connections. Option B is wrong because Lambda is not a database connection management tool. Option D is wrong because increasing max_connections might worsen the problem.

Answer

Migrate the database to Amazon Aurora.

Answer

Configure AWS Lambda to manage database connections.

Answer

Increase the max_connections parameter in the DB parameter group.

Question 4

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS. Recently, a deployment failed because the new task definition referenced an ECR image that did not exist. The team wants to prevent this type of failure in the future. Which action should be taken?

Accepted Answer

Add a validation step in CodePipeline to run a task definition dry-run.. Adding a validation step in CodePipeline that runs a task definition dry-run can verify the referenced ECR image exists before deployment, preventing failures. Option A is wrong because ECR scan on push only checks for vulnerabilities, not image existence. Option B is wrong because ECR lifecycle policies manage image retention, not validation. Option D is wrong because CloudTrail logs API calls but does not prevent deployment failures.

Answer

Configure ECR scan on push to verify image integrity.

Answer

Add an ECR lifecycle policy to expire old images.

Answer

Enable AWS CloudTrail to log ECR API calls.

Question 5

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). An audit reveals that some objects were uploaded without encryption. What is the MOST efficient way to enforce encryption for all future uploads?

Accepted Answer

Add a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set.. An S3 bucket policy that denies PutObject without the correct encryption header enforces encryption at upload time. Option A is wrong because default encryption applies only if no encryption header is provided; it can be overridden. Option B is wrong because it only encrypts existing objects, not future ones. Option D is wrong because CloudTrail does not enforce encryption.

Answer

Enable default encryption on the bucket.

Answer

Use S3 Batch Operations to encrypt existing objects.

Answer

Enable AWS CloudTrail to monitor uploads without encryption.

Question 6

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application is deployed across multiple Availability Zones. The team notices that during a recent traffic spike, some instances were terminated and replaced, causing a temporary drop in performance. How can the team improve the resilience of the application?

Accepted Answer

Configure a warm pool for the Auto Scaling group.. A warm pool pre-initializes instances, reducing the time needed for new instances to become ready during scale-out events. Option A is wrong because Reserved Instances guarantee capacity but do not reduce the initialization delay. Option B is wrong because lifecycle hooks can delay termination but do not accelerate instance readiness. Option C is wrong because larger instance size does not prevent the temporary drop in performance caused by instance replacement delays.

Answer

Purchase Reserved Instances to ensure capacity.

Answer

Use lifecycle hooks to wait for instance termination.

Answer

Increase the instance size to handle more traffic.

Question 7

A company uses AWS CloudFormation to deploy infrastructure. The team wants to ensure that all resources are tagged with a CostCenter tag. They want to automatically remediate any stack that creates resources without the required tag. Which approach is MOST effective?

Accepted Answer

Use an AWS Config rule with auto-remediation via SSM Automation.. Using an AWS Config rule with auto-remediation via SSM Automation can detect untagged resources in near real-time and automatically apply the required CostCenter tag, ensuring compliance without manual intervention. Option A is incorrect because tagging after creation is reactive and does not prevent untagged resources from existing temporarily. Option B is incorrect because IAM policies cannot enforce tagging across all services consistently, and many services allow resource creation without tags even with IAM restrictions. Option C is incorrect because CloudFormation stack policies only control updates and deletions, not creation; they cannot prevent the creation of untagged resources.

Answer

Create a Lambda function that tags resources after creation.

Answer

Use IAM policies to require tagging on all resource creation.

Answer

Use a CloudFormation stack policy with a deny effect for resource creation without tags.

Question 8

A company is using Amazon API Gateway to expose a REST API. The API backend is a Lambda function that queries an Amazon DynamoDB table. During peak hours, the API returns HTTP 429 (Too Many Requests) errors. What is the MOST cost-effective way to reduce these errors?

Accepted Answer

Increase the throttling limits in API Gateway.. HTTP 429 errors from API Gateway indicate that the request rate is exceeding the configured throttling limits. Increasing the throttling limits allows more requests to pass through directly, and this is a cost-effective configuration change. Option A (API caching) can reduce backend load but does not address the throttling limit itself. Option B (DynamoDB auto-scaling) addresses DynamoDB capacity, not API Gateway throttling. Option D (Lambda reserved concurrency) addresses Lambda throttling, but the 429 is from API Gateway, not Lambda.

Answer

Enable API caching in API Gateway.

Answer

Enable DynamoDB auto-scaling.

Answer

Increase the reserved concurrency of the Lambda function.

Question 9

A company uses an Amazon RDS for MySQL DB instance. The database is experiencing high read latency. The team wants to improve read performance with minimal application changes. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Create one or more read replicas and direct read queries to them.. A: Read replicas offload read queries from the primary instance, reducing read latency with minimal application changes (only need to modify connection strings for read queries). E: Increasing the DB instance size provides more CPU and memory, which can improve query processing and reduce read latency, and does not require application changes beyond a potential brief downtime. C is incorrect because migrating to Aurora is a significant change that requires database migration and possible application modifications, not a minimal change. B is incorrect because Multi-AZ only provides failover, not read performance improvement. D is incorrect because max_connections does not directly affect read latency.

Answer

Enable Multi-AZ deployment for failover support.

Answer

Migrate the database to Amazon Aurora.

Answer

Increase the max_connections parameter.

Question 10

A company has a fleet of EC2 instances that process data from an SQS queue. The instances are part of an Auto Scaling group. The team notices that the queue depth is growing, but the Auto Scaling group is not scaling out quickly enough. Which THREE actions should the team take to improve the scaling responsiveness? (Choose three.)

Accepted Answer

Use a custom CloudWatch metric for the SQS queue depth to drive scaling.. Using a custom CloudWatch metric for SQS queue depth enables scaling based on actual workload, providing more responsive scaling than the default CPU or network metrics. Option C: Reducing the cooldown period allows the Auto Scaling group to launch instances more quickly after a scaling activity, improving responsiveness. Option D: Step scaling policies adjust capacity incrementally based on the size of the alarm breach, allowing more aggressive scaling when queue depth is high. Options B and E are incorrect: Decreasing warm-up time is not a supported CloudWatch feature, and increasing instance size does not improve scaling speed but rather increases capacity per instance.

Answer

Decrease the AWS CloudWatch metric warm-up time.

Answer

Increase the instance size in the launch template.

Question 11

A company uses AWS CloudFormation to manage infrastructure. A recent update to a stack failed, and the stack is now in a ROLLBACK_COMPLETE state. The team needs to investigate the cause and then redeploy the update. Which TWO actions should the team take? (Choose two.)

Accepted Answer

View the stack events in the CloudFormation console.. After a stack update fails and reaches ROLLBACK_COMPLETE, the team should view stack events (Option A) to see detailed error messages for each resource, which helps identify the cause. Then, before redeploying, they should create a ChangeSet (Option C) to review the proposed changes and ensure they are correct. Option B is not directly helpful because the previous template version is already known. Option D, StackSets, is for managing stacks across multiple accounts, not for debugging a single stack. Option E is incorrect because executing a rollback is unnecessary when the stack has already completed rollback.

Answer

Review the previous stack template version.

Answer

Use AWS CloudFormation StackSets to redeploy across accounts.

Answer

Execute a rollback to continue the rollback process.

Question 12

A company runs a web application on Amazon ECS with Fargate launch type. The application is behind an Application Load Balancer. During traffic spikes, the application becomes slow. The team suspects that the ECS service is not scaling fast enough. Which TWO actions should the team take to improve the scalability? (Choose two.)

Accepted Answer

Decrease the scale-in and scale-out cooldown periods.. Options B and D are correct. Decreasing cooldown periods (option B) allows scaling to happen more frequently, reducing lag during traffic spikes. Increasing the maximum number of tasks (option D) ensures the service can scale out to a higher capacity to handle increased load. Option A is incorrect because decreasing subnets does not improve scalability and reduces fault tolerance. Option C is incorrect because decreasing the ALB idle timeout does not directly affect scaling behavior; it only affects connection persistence. Option E is incorrect because increasing the target value for the scaling metric (e.g., CPU utilization) makes the scaling threshold harder to reach, reducing scaling aggressiveness. The correct action would be to decrease the target value.

Answer

Decrease the number of subnets in the VPC.

Answer

Decrease the ALB idle timeout.

Answer

Increase the target value for the scaling metric (e.g., CPU utilization).

Question 13

Refer to the exhibit. An IAM policy is attached to a group. A user in the group tries to stop an EC2 instance with the tag 'Environment=production'. The action fails. What is the MOST likely reason?

Accepted Answer

The ec2:ResourceTag condition key is not supported for ec2:StopInstances.. The ec2:ResourceTag condition key is not supported for the ec2:StopInstances action; it is only supported for read actions such as ec2:DescribeInstances. Therefore, even though the instance has the tag 'Environment=production', the condition is not evaluated and the action fails. Option B is incorrect because the Resource element '*' includes all instances. Option C is incorrect because the policy does include ec2:StopInstances. Option D is incorrect because a resource ARN is not required for the condition to work; the issue is the unsupported condition key.

Answer

The Resource element is set to '*', which does not include the specific instance.

Answer

The ec2:StopInstances action is not listed in the policy.

Answer

The policy requires a resource ARN for the condition to work.

Question 14

Refer to the exhibit. A company configured an Amazon Route 53 alias record for a domain name pointing to an Application Load Balancer (ALB). Users report that occasionally they are directed to an unhealthy ALB node. Which change should the company make to improve availability?

Accepted Answer

Configure the ALB health check to mark unhealthy nodes.. The issue is that the ALB health check is not properly configured to mark unhealthy nodes. Although the Route 53 alias record has EvaluateTargetHealth set to true, Route 53 relies on the ALB's health check status to determine which targets are healthy. If the ALB health check is misconfigured (e.g., incorrect path, interval, or thresholds), it may not correctly report unhealthy nodes, causing Route 53 to occasionally route traffic to unhealthy nodes. Therefore, configuring the ALB health check to accurately mark unhealthy nodes (option B) is the direct solution. Option A (CNAME) is unsuitable for apex domains and doesn't provide health checking. Option C (weighted routing) distributes traffic proportionally but doesn't address health. Option D (multi-value answer routing) is for non-alias records and doesn't improve health checking beyond what alias records with EvaluateTargetHealth already offer.

Answer

Change the record type to CNAME.

Answer

Use weighted routing policy.

Answer

Use multi-value answer routing.

Question 15

A company is using AWS CloudFormation to manage its infrastructure. They have a production stack that creates an Amazon RDS DB instance. The company wants to update the DB instance class to a larger size with minimal downtime. Which approach should they use?

Accepted Answer

Edit the CloudFormation template to change the DBInstanceClass and update the stack directly.. Updating the CloudFormation stack directly with a new DBInstanceClass property will cause a reboot of the RDS DB instance, which typically has minimal downtime compared to creating a new instance. This is the standard approach for modifying RDS instance classes. Option A is incorrect because AutoScalingReplacingUpdate is an update policy for Auto Scaling groups, not applicable to RDS DB instances. Option B is incorrect because creating a new stack and deleting the old one would cause significant downtime and is not efficient. Option D is incorrect because AWS OpsWorks is not used for managing RDS instances.

Answer

Modify the DBInstanceClass property in the CloudFormation template and use an UpdatePolicy of AutoScalingReplacingUpdate.

Answer

Create a new CloudFormation stack with the new DB instance class and delete the old stack.

Answer

Use AWS OpsWorks to manage the DB instance and apply the change.