SAP-C02 Continuous Improvement for Existing Solutions Practice Test 2 — 15 Questions

Question 1

A company uses Amazon ElastiCache for Redis to cache frequently accessed data. The cache cluster is a single node (cache.r5.large). Over time, the cache hit ratio has decreased, and the CPU utilization is consistently above 80%. What should a solutions architect do to improve performance?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable cluster mode and distribute the cache across multiple shards.. Enabling cluster mode distributes data across multiple shards, reducing CPU load on individual nodes and improving the cache hit ratio by allowing more efficient use of memory and processing. Option A is incorrect because reducing TTL would cause more cache misses, further degrading the hit ratio. Option B is incorrect because read replicas offload read traffic but do not reduce CPU utilization caused by high write activity or data management. Option C is incorrect because scaling up to a larger node type provides more resources but does not address the architectural limitation of a single node; the increased CPU utilization is due to the single node being overwhelmed, not just resource capacity.

Answer

Reduce the Time-to-Live (TTL) of cached objects.

Answer

Add a read replica to offload read traffic.

Answer

Scale up to a larger node type, such as cache.r5.xlarge.

Question 2

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. DynamoDB Auto Scaling adjusts write capacity based on actual usage, reducing throttling without manual intervention. Option A is wrong because increasing read capacity does not help with write throttling. Option B is wrong because DAX is a cache for read operations, not writes. Option C is wrong because while switching to On-Demand mode can eliminate throttling, it may be more expensive than Auto Scaling if the workload is predictable; Auto Scaling is the more cost-effective solution for this scenario.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 3

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store processed file IDs and check for duplicates before processing.. Option A is correct because storing processed file IDs in a DynamoDB table and checking for duplicates before processing creates an idempotency guard: the Lambda function can conditionally write the file ID (e.g., with a conditional PutItem on a unique key) and skip processing if it already exists, preventing the same file from being handled more than once. Option D is correct because configuring S3 event notifications with prefix and suffix filters ensures the Lambda function is only triggered for the intended object keys (e.g., only .csv files in a specific prefix), avoiding spurious or duplicate invocations caused by unrelated or unintended object events. Option B is not correct because switching to an SQS queue with Lambda polling improves decoupling and retry handling but does not by itself guarantee idempotent processing, since SQS can deliver messages at least once. Option C is not correct because increasing the Lambda timeout only allows longer execution and does not prevent duplicate processing. Option E is not correct because S3 Transfer Acceleration only speeds up uploads over long distances and has no effect on idempotency.

Answer

Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 4

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Accepted Answer

Create a read replica from the source DB instance.. Option B is correct because implementing an RDS read replica fundamentally requires creating the replica from the source DB instance, either via the console, CLI (create-db-instance-read-replica), or API, which establishes asynchronous replication from the primary. Option C is correct because the read replica only reduces load on the primary if the application is actually reconfigured to direct read-only queries to the replica's endpoint, leaving writes and read-write traffic on the primary endpoint. Option E is correct because placing the read replica in a different Availability Zone is a recommended practice that provides AZ-level fault tolerance for read traffic and avoids the replica competing for the same AZ resources as the primary. Option A is incorrect because co-locating the replica in the same AZ as the primary defeats the high-availability benefit and is not a requirement for read replicas. Option D is incorrect because Multi-AZ is a separate feature for the primary/standby failover model and is not enabled on read replicas; read replicas themselves are not Multi-AZ instances.

Answer

Ensure the read replica is in the same Availability Zone as the primary.

Answer

Enable Multi-AZ on the read replica.

Question 5

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

Accepted Answer

The upload request does not include the 'x-amz-acl' header with value 'bucket-owner-full-control'.. When an IAM user from Account A uploads an object to a bucket in Account B, the bucket owner does not automatically own the object unless the uploader grants ownership via the 'x-amz-acl' header with value 'bucket-owner-full-control'. Without this, the object is owned by Account A, and Account B may not have access, leading to failure if the bucket policy requires bucket owner ownership. Thus, the most likely reason is the missing ACL header.

Answer

The resource ARN in the policy is incorrect; it should include the bucket name only.

Answer

The bucket policy in Account B denies the upload.

Answer

The IAM user does not have permission to call s3:PutObject.

Question 6

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

Accepted Answer

Decrease the cooldown period and set a lower CPU utilization threshold for scale-out. The root cause is that the scaling policy reacts too slowly: CPU must hit 90% before scaling triggers, and new instances take 5 minutes to become healthy. Lowering the CPU threshold triggers scale-out earlier (before saturation), and decreasing the cooldown allows subsequent scaling actions to fire sooner, adding capacity faster during spikes. Together these reduce the window of overload that causes timeouts.

Answer

Use a scheduled scaling policy to add instances before expected peak times

Answer

Pre-warm the load balancer to reduce latency

Answer

Switch to predictive scaling

Question 7

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function writes results to a DynamoDB table. Over time, the function's execution time has increased, and some operations fail with ProvisionedThroughputExceededException. The function is configured with 1024 MB memory and a 5-minute timeout. The DynamoDB table has 1000 RCUs and 500 WCUs. The Lambda function performs reads and writes on the same table. What is the MOST cost-effective way to resolve the throttling without sacrificing performance?

Accepted Answer

Use SQS to decouple the S3 trigger from the Lambda function and implement a batching strategy to DynamoDB. The most cost-effective solution because it uses SQS to decouple the S3 trigger from the Lambda function, allowing the Lambda to batch writes to DynamoDB. This reduces the frequency of writes, smooths out traffic spikes, and enables retries on throttling exceptions without scaling up capacity. Option A (DAX) only improves read performance, not writes. Option C (increasing WCUs) increases cost significantly without addressing the root cause of bursty traffic. Option D (increasing memory) improves compute but not write throughput, and may increase cost without resolving throttling.

Answer

Enable DynamoDB Accelerator (DAX) for the table

Answer

Increase DynamoDB write capacity units to 1000 WCUs

Answer

Increase the Lambda function memory to 2048 MB

Question 8

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

Accepted Answer

Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation. AWS Config conformance packs bundle multiple managed rules (e.g., s3-bucket-server-side-encryption-enabled, s3-bucket-public-read-prohibited) and can be deployed organization-wide via a single CloudFormation StackSet. Remediation actions tied to Systems Manager Automation documents automatically fix non-compliant buckets in near real time, satisfying both the detection and auto-remediation requirements at scale. This is the AWS-recommended pattern for multi-account compliance enforcement.

Answer

Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption

Answer

Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption

Answer

Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts

Question 9

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

Accepted Answer

Use a step scaling policy with a lower scale-out threshold and a larger adjustment. A step scaling policy allows the team to define multiple scaling adjustments based on the magnitude of the alarm breach. By lowering the scale-out threshold, ECS will add tasks sooner when traffic begins to rise, and a larger adjustment adds more tasks per step, quickly absorbing the spike. This directly addresses the issue of tasks becoming unhealthy due to insufficient capacity during sudden load increases.

Answer

Increase the task memory allocation to improve performance

Answer

Increase the health check interval to reduce the number of tasks marked unhealthy

Answer

Use a target tracking scaling policy with a higher target value

Question 10

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. The company also needs to ensure that any attempt to upload an unencrypted object is blocked. How can the company enforce this requirement?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with value aws:kms. A bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with the value aws:kms will enforce encryption at upload time, blocking any unencrypted upload. Option B (default encryption) does not enforce on all uploads if the request header is omitted. Option C (CloudTrail) is detective, not preventive. Option D (Object Lock) is for write-once-read-many (WORM) compliance, not encryption.

Answer

Enable default encryption on the bucket with AWS KMS

Answer

Use AWS CloudTrail to monitor PutObject calls and alert on unencrypted uploads

Answer

Enable S3 Object Lock on the bucket

Question 11

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

Accepted Answer

Mount an EFS volume to the instances for log storage. Option B is correct because mounting an Amazon EFS volume gives the instances a shared, durable storage location for logs that survives instance termination, so logs written before a failure are not lost when an instance is replaced. Option C is correct because installing the CloudWatch Logs agent on each EC2 instance streams the log files to CloudWatch Logs, centralizing log analysis as required. Together, EFS preserves the log data across instance failures while the CloudWatch Logs agent ships it to CloudWatch Logs for analysis. Option A is not correct because ASG lifecycle hooks only pause instance transitions and do not themselves centralize or persist logs. Option D is not correct because Auto Scaling groups have no built-in feature to send logs to Amazon S3 on instance termination. Option E is not correct because Amazon SQS is a message queue, not a log-shipping mechanism to CloudWatch Logs, and it would not prevent log loss from local instance storage.

Answer

Use the CloudWatch agent with the auto-scaling group lifecycle hooks

Answer

Configure the Auto Scaling group to send logs to Amazon S3 on instance termination

Answer

Use Amazon SQS to buffer log events before sending to CloudWatch Logs

Question 12

A DevOps engineer notices that an EC2 instance's CPU utilization is consistently above 90%. They need to optimize costs without affecting performance. What should they do?

Accepted Answer

Add more EC2 instances behind a load balancer.. Adding more EC2 instances behind a load balancer horizontally scales the application, distributing the CPU load across multiple instances. This reduces the CPU utilization on each instance, allowing the existing instance to operate within its performance envelope without over-provisioning a single instance. It also enables cost optimization through elasticity—instances can be scaled in when demand drops, and you only pay for what you use. This approach directly addresses the high CPU utilization while maintaining performance and potentially lowering costs compared to vertical scaling.

Answer

Rightsize the instance to a larger instance type.

Answer

Purchase a Reserved Instance for the current instance type.

Answer

Terminate the instance and launch a new one of the same type.

Question 13

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

Accepted Answer

Use the RDS Multi-AZ DNS name (CNAME) that automatically updates after failover.. The RDS Multi-AZ endpoint is a CNAME record that RDS automatically repoints to the standby instance's IP during a failover, so applications using this DNS name reconnect without manual intervention. This is the standard AWS-recommended approach for minimizing failover downtime, since the DNS TTL is short (typically 5 seconds) and the update happens automatically.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Create a read replica in another Region and promote it during failover manually.

Answer

Configure a Network Load Balancer in front of the RDS instance.

Question 14

A company stores sensitive data in Amazon S3. They need to ensure that data is encrypted at rest using a key managed by the company's on-premises hardware security module (HSM). Which S3 encryption option should they use?

Accepted Answer

Client-Side Encryption using the company's own encryption library.. Client-side encryption means the company encrypts data before uploading it to S3, using keys that never leave their on-premises HSM. AWS never sees the plaintext or the key material, satisfying the requirement that the key be managed by the company's own HSM. This is the only option where the HSM fully controls the key lifecycle.

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Answer

Server-Side Encryption with AWS KMS (SSE-KMS).

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Question 15

A company has a production AWS Lambda function that processes orders. The function's execution time has increased, causing timeouts. The team wants to troubleshoot without affecting production traffic. What should they do?

Accepted Answer

Create a new Lambda function with a different name to test the code changes.. Creating a new Lambda function with a different name allows the team to test code changes and configuration adjustments (like increased timeout) in isolation without impacting the production function. This approach provides a safe environment to troubleshoot and validate fixes before deploying to production.

Answer

Enable detailed CloudWatch Logs for the production function and analyze them.

Answer

Use a Lambda alias to route a percentage of traffic to a new version with increased timeout.

Answer

Increase the timeout of the production Lambda function temporarily.