SAP-C02 Continuous Improvement for Existing Solutions Practice Test 20 — 15 Questions

Question 1

A company has an Amazon S3 bucket that stores sensitive data. The company wants to ensure that all data in the bucket is encrypted at rest. Which action should the Solutions Architect take?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3, SSE-KMS, or SSE-C.. Option A is correct because enabling default encryption on the bucket ensures all objects are encrypted. Option B is wrong because bucket policies do not encrypt data. Option C is wrong because CloudHSM is not required. Option D is wrong because pre-signed URLs do not enforce encryption.

Answer

Use AWS CloudHSM to manage encryption keys.

Answer

Configure a bucket policy that denies unencrypted uploads.

Answer

Require the use of pre-signed URLs for uploads.

Question 2

A company is running a critical application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume. To improve recovery time in the event of an AZ failure, which TWO actions should the company take? (Choose two.)

Accepted Answer

Create an Amazon Machine Image (AMI) from the instance.. Options A and C are correct. Option A: Using an AMI from the instance ensures a quick launch in another AZ. Option C: EBS snapshots can be used to create volumes in another AZ. Option B is wrong because EBS volumes are AZ-specific. Option D is wrong because EC2 instances are AZ-specific. Option E is wrong because EBS multi-attach is for specific use cases, not AZ recovery.

Answer

Use EBS multi-attach to attach the volume to instances in another AZ.

Answer

Copy the EBS volume to another AZ using the AWS Management Console.

Answer

Configure the Auto Scaling group to launch instances in multiple AZs.

Question 3

A company is using AWS CodePipeline to deploy a web application. The pipeline includes a build stage and a deploy stage. The company wants to add a test stage that runs automated integration tests after the build stage and before the deploy stage. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Configure AWS CodeBuild to run the integration tests as part of the test stage.. Options B, C, and D are correct. Option B: Adding a test stage in CodePipeline. Option C: Using CodeBuild for test execution. Option D: Adding a manual approval step for safety. Option A is wrong because Lambda is not suitable for running tests directly. Option E is wrong because CloudFormation is for infrastructure, not testing.

Answer

Use AWS CloudFormation to create a test environment.

Answer

Use an AWS Lambda function to run the integration tests.

Question 4

A company is migrating a legacy application to AWS. The application requires a relational database with high availability and automated backups. Which TWO AWS services should the company consider? (Choose two.)

Accepted Answer

Amazon RDS with Multi-AZ deployment. Options A and C are correct. Option A: Amazon RDS Multi-AZ provides high availability and automated backups. Option C: Amazon Aurora is a MySQL/PostgreSQL-compatible relational database with high availability and automated backups. Option B is wrong because DynamoDB is NoSQL. Option D is wrong because ElastiCache is an in-memory cache. Option E is wrong because Redshift is a data warehouse.

Answer

Amazon Redshift

Answer

Amazon ElastiCache

Answer

Amazon DynamoDB

Question 5

An IAM policy is attached to an IAM user. The user reports being unable to download objects from the bucket 'example-bucket' when connecting from their office IP address 203.0.113.5. What is the most likely reason?

Accepted Answer

The user's IP address is not in the allowed range.. Option B is correct because the policy only allows access from the IP range 192.0.2.0/24, and the user's IP 203.0.113.5 is not in that range. Option A is wrong because the resource is correct. Option C is wrong because the action is correct. Option D is wrong because the condition is valid.

Answer

The condition key 'aws:SourceIp' is invalid.

Answer

The resource ARN is incorrect.

Answer

The s3:GetObject action is misspelled.

Question 6

A Solutions Architect runs the above AWS CLI command and gets the output shown. The instance is 'running' but the application is not accessible. What should the Solutions Architect check next?

Accepted Answer

Check the security group rules for the instance.. Option C is correct because security group rules control inbound traffic. Option A is wrong because the instance is running. Option B is wrong because the status checks show health, not network access. Option D is wrong because the instance ID is correct.

Answer

Check if the instance is terminated.

Answer

Check if the instance ID is correct.

Answer

Check the instance status checks.

Question 7

A CloudFormation stack update failed with the above error. What is the likely cause?

Accepted Answer

The runtime is no longer supported by AWS Lambda.. Option D is correct because the error message explicitly states that the runtime 'nodejs14.x' is not supported. Option A is wrong because the S3 bucket is not the issue. Option B is wrong because the role ARN is correct. Option C is wrong because the timeout is within limits.

Answer

The S3 bucket does not contain the zip file.

Answer

The IAM role ARN is incorrect.

Answer

The timeout value is too high.

Question 8

A company is using AWS Lambda functions to process files uploaded to an S3 bucket. Recently, the processing time has increased significantly. A solutions architect notices that the Lambda functions are using the default VPC configuration. What is the MOST likely cause of the performance degradation?

Accepted Answer

Lambda function is attached to a VPC, causing network latency for S3 API calls.. Option B is correct because Lambda functions in a VPC use an Elastic Network Interface (ENI) in a private subnet, which can add latency for internet-bound requests. Options A, C, and D do not directly cause increased processing time.

Answer

Lambda function is using too much memory.

Answer

S3 bucket has versioning enabled, causing extra overhead.

Answer

S3 bucket is in a different region.

Question 9

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). The application experiences periodic spikes in traffic. The operations team wants to ensure that the application can handle the spikes without manual intervention. What is the MOST cost-effective solution?

Accepted Answer

Create a target tracking scaling policy using the ALB RequestCountPerTarget metric.. Option C is correct because a target tracking scaling policy automatically adjusts capacity based on a metric, and using the ALB RequestCountPerTarget metric is appropriate for web traffic spikes. Option A uses the wrong metric, B requires manual intervention, and D is not cost-effective.

Answer

Use a scheduled scaling policy to add instances during predicted peak hours.

Answer

Manually add instances when traffic spikes are expected.

Answer

Use a simple scaling policy based on CPU utilization.

Question 10

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

Accepted Answer

Create an SCP that denies s3:CreateBucket unless encryption is specified.. Option A is correct because a service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.

Answer

Use CloudTrail to monitor bucket creation and alert security team.

Answer

Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.

Answer

Use AWS Config rules to detect non-compliant buckets and auto-remediate.

Question 11

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Accepted Answer

Create one or more Read Replicas in the same region.. Option B is correct because creating Read Replicas offloads read traffic from the primary instance. Option A increases cost unnecessarily, C requires application changes, and D does not directly improve read performance.

Answer

Enable Multi-AZ deployment for failover.

Answer

Use Amazon ElastiCache to cache frequent queries.

Answer

Upgrade to a larger instance type.

Question 12

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

Accepted Answer

Enable auto scaling for DynamoDB and implement retry logic with exponential backoff in the Lambda function.. Option A is correct because enabling DynamoDB auto scaling adjusts capacity dynamically, and adding retry logic with exponential backoff in Lambda handles transient errors. Option B is wrong because SQS with Lambda can buffer requests. C is wrong because increasing capacity might be costly and does not handle spikes. D is wrong because Lambda retries on its own but without backoff.

Answer

Increase the provisioned read/write capacity of the DynamoDB table to a high fixed value.

Answer

Use an SQS queue between API Gateway and Lambda to buffer requests.

Answer

Configure API Gateway to automatically retry failed requests.

Question 13

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

Accepted Answer

The security group for the tasks does not allow inbound traffic from the ALB on the health check port.. Option C is correct because if the security group for the tasks does not allow inbound traffic from the ALB on the health check port, health checks fail. Options A, B, and D do not directly cause health check failures.

Answer

The ECS service is configured with a desired count of zero.

Answer

The task definition specifies an invalid container image.

Answer

The ECS cluster has insufficient capacity.

Question 14

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

Accepted Answer

Use Change Sets and require manual approval to execute them.. Option B is correct because Change Sets allow you to review changes before executing them. Option A is automatic, C is for changesets but does not require approval, D is not related.

Answer

Enable termination protection on the stack.

Answer

Use AWS CodePipeline to automatically deploy changes.

Answer

Use stack policies to prevent updates.

Question 15

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

Accepted Answer

Use a rolling update with a lifecycle hook to gracefully handle connections and unmount the file system before instance termination.. Option D is correct because a rolling update with a lifecycle hook allows draining connections and unmounting the file system gracefully. Option A is for immutable deployments but stateful apps may not support it. B and C do not minimize downtime.

Answer

Use an in-place update without any hooks.

Answer

Perform a blue/green deployment.

Answer

Terminate all instances and launch new ones.