SAP-C02 Continuous Improvement for Existing Solutions Practice Test 20 — 15 Questions

Question 1

A company has a multi-account AWS environment managed by AWS Organizations. The security team wants to ensure that all new Amazon S3 buckets created in any account have server-side encryption with AWS KMS keys (SSE-KMS) enabled by default. They also want to prevent the creation of buckets without encryption. Which solution should a solutions architect recommend to meet these requirements with the LEAST administrative effort?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies the s3:CreateBucket action unless the request includes the s3:x-amz-server-side-encryption header with a value of 'aws:kms', and attach it to the root of the organization.. SCPs are the central guardrail in AWS Organizations. A single SCP attached at the root can deny s3:CreateBucket unless the encryption header is present, preventing unencrypted bucket creation across all accounts. This is the least administrative effort because it is enforced organization-wide and requires no per-account configuration. Other options are either reactive or require per-account management.

Answer

Enable S3 Block Public Access at the organization level and require all buckets to use SSE-KMS via a bucket policy template.

Answer

Create an IAM policy in each account that allows s3:CreateBucket only if the request includes the encryption header, and attach it to all users and roles.

Answer

Use AWS Config to monitor for unencrypted S3 buckets and automatically remediate by enabling default encryption using an AWS Systems Manager Automation document.

Question 2

A solutions architect manages a multi-account AWS organization. A central networking account owns a transit gateway that all VPCs attach to. The security team must inspect all inter-VPC traffic in a single inspection VPC, but application teams must not be able to bypass inspection by modifying their own route tables. Which combination of controls achieves this with the least operational overhead?

Accepted Answer

Share the transit gateway through AWS Resource Access Manager, keep the transit gateway route tables in the central networking account, and deny application accounts the ability to create VPC peering connections or modify transit gateway attachments.. Centralizing the transit gateway and its route tables in the networking account, while sharing attachments through AWS Resource Access Manager, keeps segmentation policy out of reach of application teams. Service control policies that deny VPC peering creation and attachment modification close the remaining bypass routes. Flow logs and mesh peering are observation or connectivity tools, not enforcement controls.

Answer

Create a transit gateway route table in the inspection VPC, associate all application attachments with it, and use AWS Resource Access Manager to share the transit gateway.

Answer

Enable VPC flow logs on every VPC and deliver them to a central Amazon S3 bucket for analysis by the security team.

Answer

Create a VPC peering connection between each application VPC and the inspection VPC, and remove the transit gateway attachments.

Question 3

A company runs a three-tier web application on AWS. The application uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. During a recent load test, the team observed that response times increased significantly as the number of concurrent users grew. Amazon CloudWatch metrics show that the ALB's TargetResponseTime increased, and the EC2 instances' CPU utilization remained below 40%. The team wants to improve the application's performance and reduce latency without changing the application code. What should a solutions architect recommend?

Accepted Answer

Enable HTTP/2 support on the ALB and configure the target group to use HTTP/2 for backend connections.. The scenario describes increased latency with growing concurrent users while backend CPU remains low, pointing to inefficiencies in how connections are handled. HTTP/2 multiplexes multiple requests over a single connection, reducing overhead and improving response times. Enabling it on the ALB and for backend connections leverages this protocol without code changes, making it the most direct and effective solution.

Answer

Increase the instance size of the EC2 instances to provide more CPU and memory.

Answer

Enable sticky sessions on the ALB to ensure that each user is directed to the same EC2 instance.

Answer

Configure the Auto Scaling group to use a larger maximum size to allow more instances to handle the load.

Question 4

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application uses an Amazon RDS for PostgreSQL database. The company wants to improve the security of the existing solution by encrypting data at rest and in transit. The application connects to the database using the endpoint. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a new encrypted RDS instance from a snapshot of the existing database, and update the application to use SSL/TLS connections.. To encrypt an existing unencrypted RDS instance, you must create a snapshot, copy it with encryption enabled, and restore it to a new instance. This is the standard approach. For in-transit encryption, you configure the application to use SSL/TLS when connecting to the database. This solution uses native RDS capabilities and requires minimal changes to the application, only the connection string. Other options either misunderstand the services or do not achieve encryption at rest.

Answer

Enable encryption at rest on the RDS instance by modifying the instance to use an AWS KMS key. Configure the application to use SSL/TLS for connections.

Answer

Use AWS Certificate Manager (ACM) to provision a certificate for the RDS instance and enable encryption at rest using the certificate.

Answer

Enable encryption at rest on the RDS instance using the default AWS managed key, and use IAM database authentication for in-transit encryption.

Question 5

A company runs a microservices application on Amazon ECS with the Fargate launch type. The services communicate over a service mesh and write logs to stdout. The operations team wants to implement distributed tracing to identify latency bottlenecks across services. They need a solution that requires minimal code changes and integrates with AWS X-Ray. Which approach should a solutions architect recommend?

Accepted Answer

Deploy the AWS X-Ray daemon as a sidecar container in each ECS task definition and configure the application to send trace data to it.. The AWS X-Ray daemon as a sidecar container is the standard way to enable tracing for ECS Fargate tasks. The application uses the X-Ray SDK to send trace data to the daemon, which runs in the same task and forwards data to X-Ray. This requires minimal code changes and integrates natively with X-Ray. The other options either do not provide distributed tracing or require more extensive changes.

Answer

Enable AWS X-Ray integration in the Application Load Balancer and use the ALB to generate trace data.

Answer

Configure AWS Distro for OpenTelemetry (ADOT) as a sidecar to collect traces and send them to AWS X-Ray.

Answer

Use AWS CloudTrail to log all API calls and analyze the logs with Amazon CloudWatch Logs Insights to identify latency.

Question 6

A company runs a stateful web application on a fleet of Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS for PostgreSQL database. The company wants to improve the resilience of the application so that it can survive an Availability Zone (AZ) failure with minimal downtime and data loss. The application must continue to accept writes during the failover. Which two actions should a solutions architect take to meet these requirements? (Choose two.)

Accepted Answer

Configure the RDS DB instance to be a Multi-AZ deployment with a standby in a different AZ.. To survive an AZ failure with minimal downtime and data loss for a stateful application, the database tier should use RDS Multi-AZ for automatic failover with synchronous replication, and the web tier should use an Auto Scaling group spanning multiple AZs behind an ALB. This combination ensures that both the application and database remain available if an AZ fails, and writes can continue after failover.

Answer

Enable automated backups and point-in-time recovery for the RDS database, and restore the database to the latest point in time in a different AZ during a failover.

Answer

Use Amazon Route 53 latency-based routing to distribute traffic across multiple ALBs in different AZs.

Answer

Create an RDS read replica in a different AZ and modify the application to direct write traffic to the read replica during a failover.

Question 7

A company is migrating a legacy monolithic application to AWS. The application currently runs on a physical server with 64 vCPUs and 256 GB of RAM, and uses a local SSD for temporary data processing. The company wants to reduce costs and improve scalability by moving to Amazon EC2. The application is not licensed for more than 32 vCPUs. The company needs to choose an instance type that meets the CPU and memory requirements while optimizing for cost. (Choose two.)

Accepted Answer

Attach an instance store volume to the chosen instance for temporary data processing.. The R5 family offers a memory-optimized instance with 32 vCPUs and 256 GB of RAM (r5.8xlarge), meeting both the CPU licensing limit and memory requirement. Instance store volumes provide the necessary local SSD for temporary data processing, matching the legacy server's setup. Together, these choices satisfy performance, licensing, and cost goals.

Answer

Use an instance from the R5 family with 16 vCPUs and 256 GB of RAM.

Answer

Use an instance from the M5 family with 32 vCPUs and 128 GB of RAM.

Answer

Use an instance from the X1 family with 32 vCPUs and 256 GB of RAM.

Question 8

A solutions architect is optimizing a legacy three-tier web application running on Amazon EC2 instances behind an Application Load Balancer. The application stores session state in a self-managed Redis cluster on EC2, which has become a operational burden and scaling bottleneck. The architect wants to reduce operational overhead, improve availability, and enable automatic scaling of the session store without changing the application code. The application connects to Redis via a single endpoint and uses standard Redis commands. Which solution meets these requirements MOST cost-effectively?

Accepted Answer

Replace the self-managed Redis cluster with Amazon ElastiCache for Redis (cluster mode disabled), using a single shard with one primary and two replicas across multiple Availability Zones.. ElastiCache for Redis with cluster mode disabled offers a single primary endpoint and automatic failover with replicas across AZs, aligning with the application's existing connection pattern and standard Redis commands. It eliminates the operational burden of self-managed Redis and provides cost-effective scaling. Cluster mode enabled would require a cluster-aware client, DAX requires application changes and is not Redis-compatible, and MemoryDB is overkill for non-durable session state.

Answer

Replace the self-managed Redis cluster with Amazon MemoryDB for Redis, using a single shard with one primary and one replica.

Answer

Replace the self-managed Redis cluster with Amazon ElastiCache for Redis (cluster mode enabled), using three shards with one primary and one replica each.

Answer

Replace the self-managed Redis cluster with Amazon DynamoDB Accelerator (DAX) in front of a new DynamoDB table, and modify the application to use the DAX client.

Question 9

A media company stores millions of small thumbnail images in an Amazon S3 bucket using the S3 Standard storage class. Analytics show that objects older than 30 days are almost never accessed, but they must remain retrievable within milliseconds if a legal hold request arrives. The company wants to lower storage cost while preserving immediate retrieval. Which action should a solutions architect take?

Accepted Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Instant Retrieval 30 days after creation.. The requirement pairs lower cost with millisecond retrieval, which is exactly the design point of S3 Glacier Instant Retrieval. An age-based lifecycle transition automates the move after 30 days without touching application code. Deep Archive and Intelligent-Tiering archive tiers delay retrieval, and version expiration targets a different cost component entirely.

Answer

Enable S3 Intelligent-Tiering on the bucket and let it move objects automatically between access tiers.

Answer

Configure an S3 Lifecycle rule to transition objects to S3 Glacier Deep Archive 30 days after creation.

Answer

Enable S3 Versioning on the bucket and add a lifecycle rule to expire noncurrent versions after 30 days.

Question 10

A company has a critical application that writes millions of small objects to an Amazon S3 bucket. The application uses the AWS SDK for Java and uploads each object individually. The company has noticed that upload latency is high and wants to improve performance. The objects are typically less than 1 MB in size. The solutions architect needs to recommend a change that minimizes latency and maximizes throughput without modifying the application's logic significantly. Which approach should the solutions architect recommend?

Accepted Answer

Use the S3 PUT Object API with the TransferManager class to upload objects in parallel.. The application uploads many small objects individually, leading to high latency due to sequential request overhead. Using the TransferManager class in the AWS SDK for Java enables parallel uploads, which can dramatically increase throughput by utilizing multiple connections and threads. This approach requires minimal code changes and directly addresses the bottleneck of per-object latency, making it the most effective solution.

Answer

Enable S3 multipart upload in the SDK and set the part size to 5 MB.

Answer

Increase the S3 bucket's request rate limit by contacting AWS Support to raise the default limit.

Answer

Use S3 Transfer Acceleration on the bucket and configure the SDK to use the accelerated endpoint.

Question 11

A company runs a microservices application on Amazon ECS using the EC2 launch type. The application consists of multiple services that communicate over HTTP. The company wants to improve the security and observability of service-to-service communication without modifying application code. The company also wants to minimize operational overhead. Which two solutions should a solutions architect recommend? (Choose two.)

Accepted Answer

Enable AWS Cloud Map for service discovery and use it with App Mesh.. To improve security and observability of service-to-service communication without code changes, a service mesh like AWS App Mesh is ideal. App Mesh uses Envoy proxies to intercept traffic and provide mutual TLS for security and metrics/tracing for observability. AWS Cloud Map complements App Mesh by providing service discovery, enabling dynamic registration and discovery of services. Together, they offer a managed solution that reduces operational overhead. Other options either require code changes or do not provide application-level features.

Answer

Deploy AWS PrivateLink endpoints for each service.

Answer

Implement security groups and network ACLs to control traffic between services.

Answer

Use AWS X-Ray SDK to instrument each microservice.

Question 12

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences occasional failures due to unhandled exceptions. The operations team wants to automatically recover from these failures without manual intervention. The application logs are stored in Amazon CloudWatch Logs. The team wants to minimize downtime and ensure that the failed instance is replaced only when necessary. Which solution should a solutions architect recommend?

Accepted Answer

Use an Auto Scaling group with ELB health checks enabled, and configure the application to report health status to the ALB target group health check endpoint.. The correct solution uses the native integration between Auto Scaling groups and ELB health checks. By enabling ELB health checks, the Auto Scaling group relies on the ALB's health checks to determine if an instance is healthy. If the application fails, the health check fails, and Auto Scaling terminates and replaces the instance. This provides automatic recovery and minimizes downtime. Other options either do not replace the instance, require custom logic, or do not continuously monitor health.

Answer

Configure an EC2 Auto Scaling group with a lifecycle hook that checks the application health endpoint and terminates the instance if it fails.

Answer

Create a CloudWatch alarm based on a custom metric for application errors, and configure the alarm to trigger an Auto Scaling policy that replaces the instance.

Answer

Configure a CloudWatch Logs subscription filter that triggers an AWS Lambda function to reboot the instance when an error is detected in the logs.

Question 13

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application experiences sudden traffic spikes, and the operations team wants to ensure that the Auto Scaling group scales out quickly in response to increased load. The team has configured a target tracking scaling policy based on average CPU utilization. However, they notice that scaling takes several minutes to react. Which action should a solutions architect take to improve the responsiveness of the scaling policy?

Accepted Answer

Enable detailed monitoring for the EC2 instances and adjust the target tracking policy to use a shorter metric evaluation period.. Detailed monitoring enables 1-minute CloudWatch metrics, and a shorter metric evaluation period in the target tracking policy allows the Auto Scaling group to detect and react to load changes more quickly. These adjustments reduce the lag between a traffic spike and the scaling action, improving responsiveness without over-provisioning.

Answer

Decrease the target value for average CPU utilization in the target tracking policy.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Replace the target tracking policy with a simple scaling policy based on CPU utilization.

Question 14

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application uses a PostgreSQL database on Amazon RDS for PostgreSQL with a single Availability Zone deployment. The database is experiencing performance degradation during peak hours, and the company wants to improve read scalability and fault tolerance without modifying the application's connection string. The application uses a single DNS endpoint to connect to the database. Which solution meets these requirements with the LEAST operational effort?

Accepted Answer

Migrate the database to Amazon Aurora PostgreSQL with a writer instance and two reader instances. Use the Aurora cluster endpoint, which automatically load-balances read queries across reader instances.. Migrating to Aurora PostgreSQL with a writer and two readers provides read scaling and fault tolerance. Using the cluster endpoint for writes and the reader endpoint for reads requires minimal application changes to use separate endpoints, which the company is willing to make. This offloads read traffic and provides automatic failover. The other options either do not provide read scaling, require more changes, or are based on incorrect assumptions about endpoint behavior.

Answer

Migrate the database to Amazon Aurora PostgreSQL with a writer instance and two reader instances in different Availability Zones. Use the cluster endpoint for writes and the reader endpoint for reads, updating the application to use both endpoints.

Answer

Convert the RDS instance to a Multi-AZ deployment and enable RDS Proxy. Configure the application to connect to the RDS Proxy endpoint.

Answer

Convert the RDS instance to a Multi-AZ deployment and add a read replica in a different Availability Zone. Update the application to use the read replica endpoint for read queries.

Question 15

A company runs a serverless application using AWS Lambda functions that process messages from an Amazon SQS queue. The Lambda functions write results to an Amazon DynamoDB table. During peak periods, the SQS queue depth grows rapidly, and Lambda concurrency reaches the account limit, causing throttling. The company wants to improve the solution's ability to handle peak loads without increasing the account concurrency limit. Which approach is MOST effective?

Accepted Answer

Implement a Lambda function that polls the SQS queue and invokes other Lambda functions asynchronously.. Decoupling the SQS processing with a poller Lambda that invokes other functions asynchronously allows the workload to be distributed across multiple functions, each with its own concurrency. This pattern can better utilize available account concurrency and handle bursts. Other options either do not increase concurrency or limit it further.

Answer

Increase the Lambda function's memory allocation to allow more concurrent executions.

Answer

Use AWS Lambda reserved concurrency to dedicate capacity to the function and avoid throttling.

Answer

Configure the SQS queue as an event source for the Lambda function with a larger batch size and longer batch window.