SAP-C02 Continuous Improvement for Existing Solutions Practice Test 21 — 15 Questions

Question 1

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all new S3 buckets are encrypted using AES-256. What is the MOST effective way to enforce this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an SCP that denies s3:CreateBucket unless encryption is specified.. A service control policy (SCP) can deny creation of S3 buckets without encryption. Options B, C, and D are not effective at enforcing across all accounts.

Answer

Use CloudTrail to monitor bucket creation and alert security team.

Answer

Create an SCP that denies s3:PutBucketPublicAccessBlock without encryption.

Answer

Use AWS Config rules to detect non-compliant buckets and auto-remediate.

Question 2

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Accepted Answer

Create one or more Read Replicas in the same region.. Creating Read Replicas offloads read traffic from the primary instance. Option A increases cost unnecessarily, C requires application changes, and D does not directly improve read performance.

Answer

Enable Multi-AZ deployment for failover.

Answer

Use Amazon ElastiCache to cache frequent queries.

Answer

Upgrade to a larger instance type.

Question 3

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

Accepted Answer

Enable auto scaling for DynamoDB and implement retry logic with exponential backoff in the Lambda function.. It combines DynamoDB auto scaling to adjust capacity during traffic spikes with retry logic and exponential backoff in the Lambda function to handle transient ProvisionedThroughputExceededException errors gracefully without losing requests. Option B is wrong because fixing capacity to a high value is costly and inefficient; it doesn't adapt to variable traffic. Option C is wrong because using an SQS queue between API Gateway and Lambda would buffer requests but does not directly address the DynamoDB throughput exception; it would only shift the problem. Option D is wrong because API Gateway cannot automatically retry failed requests; retries must be implemented in the backend.

Answer

Increase the provisioned read/write capacity of the DynamoDB table to a high fixed value.

Answer

Use an SQS queue between API Gateway and Lambda to buffer requests.

Answer

Configure API Gateway to automatically retry failed requests.

Question 4

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

Accepted Answer

The security group for the tasks does not allow inbound traffic from the ALB on the health check port.. If the security group for the tasks does not allow inbound traffic from the ALB on the health check port, health checks fail and tasks cannot register. Option B is incorrect because a desired count of zero would prevent new tasks from running, but the scenario describes deployments failing due to health check failures on new tasks. Option C is incorrect: an invalid container image would cause the task to fail to start, not cause health check failures after the task is running. Option D is incorrect because Fargate manages capacity; insufficient capacity would cause a different error (e.g., unable to provision tasks), not health check failures.

Answer

The ECS service is configured with a desired count of zero.

Answer

The task definition specifies an invalid container image.

Answer

The ECS cluster has insufficient capacity.

Question 5

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

Accepted Answer

Use Change Sets and require manual approval to execute them.. AWS CloudFormation Change Sets allow you to preview how proposed changes will affect your running resources before executing them. By using Change Sets in conjunction with a manual approval process (e.g., via AWS CodePipeline or a separate review step), you can ensure changes are reviewed and approved before being applied. Option A (termination protection) only prevents stack deletion, not updates. Option B (auto-deployment with CodePipeline) can include approval gates, but the question asks for the "BEST way" in the context of CloudFormation itself; Change Sets are the native mechanism for review. Option D (stack policies) control which resources can be updated, but do not enforce a review process.

Answer

Enable termination protection on the stack.

Answer

Use AWS CodePipeline to automatically deploy changes.

Answer

Use stack policies to prevent updates.

Question 6

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared file system mounted on each instance. The company wants to minimize downtime during deployments. What should they use?

Accepted Answer

Use a rolling update with a lifecycle hook to gracefully handle connections and unmount the file system before instance termination.. A rolling update with a lifecycle hook (Option B) is the best approach for minimizing downtime in a stateful web application using a shared file system. The lifecycle hook allows the instance to gracefully handle existing connections and unmount the file system before termination, ensuring no data corruption or abrupt disconnection. This reduces downtime compared to other methods. Option A (in-place update without hooks) risks disrupting active connections. Option C (blue/green deployment) may not work seamlessly with stateful applications due to shared storage. Option D (terminate all instances) causes full downtime.

Answer

Use an in-place update without any hooks.

Answer

Perform a blue/green deployment.

Answer

Terminate all instances and launch new ones.

Question 7

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

Accepted Answer

The application is updating the same item in multiple regions concurrently, and the last-writer-wins conflict resolution is causing data loss.. DynamoDB global tables use last-writer-wins (LWW) conflict resolution, and if the same item is updated concurrently in multiple regions, conflicts occur. Using conditional writes and application-level conflict resolution can help. Option A is wrong because strongly consistent reads are not supported for global tables; they only support eventual consistency. Option B is wrong because write capacity insufficient would cause throttling, not write conflicts. Option D is wrong because DynamoDB global tables do have automatic conflict resolution via LWW; the issue is not misconfiguration but the concurrent updates.

Answer

The application is using strongly consistent reads.

Answer

The DynamoDB write capacity is insufficient.

Answer

The DynamoDB global tables are not properly configured with conflict resolution.

Question 8

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Options A and B are correct. A bucket policy that denies PutObject without the x-amz-server-side-encryption header enforces encryption at upload time, ensuring all objects are encrypted. Default encryption on the bucket automatically encrypts objects that are uploaded without encryption headers, covering cases where the policy may not apply. Option C (Cross-Region Replication) replicates objects but does not enforce encryption. Option D (Versioning) provides object version management and can help protect against overwrites, but does not enforce encryption. Option E (Server Access Logs) provides logging but does not enforce encryption.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning on the buckets.

Answer

Enable S3 Server Access Logs.

Question 9

A company is running a production web application on Amazon EKS. The application experiences intermittent latency spikes. The operations team suspects that the issue is related to pod networking. Which THREE tools should they use to diagnose the issue? (Choose 3)

Accepted Answer

VPC Flow Logs. The correct tools for diagnosing intermittent latency spikes in an Amazon EKS pod networking issue are VPC Flow Logs (B), Amazon CloudWatch Logs (C), and Amazon CloudWatch Container Insights (D). VPC Flow Logs capture network traffic metadata, helping identify packet loss or delays. CloudWatch Logs aggregate container logs for debugging application behavior. Container Insights provides metrics like network usage and pod performance. Option A (tcpdump) is a Linux command-line tool that can capture packets but is not an AWS managed service and may require elevated access; it is not optimal for production troubleshooting on EKS. Option E (AWS CodePipeline) is a CI/CD service unrelated to network diagnostics.

Answer

tcpdump on worker nodes

Answer

AWS CodePipeline

Question 10

A company has an AWS Lambda function that processes messages from an SQS queue. The function is experiencing timeouts. Which TWO changes could help resolve the timeout issue? (Choose 2)

Accepted Answer

Increase the Lambda function timeout.. Increasing the Lambda function timeout (option C) allows the function more time to complete processing of SQS messages, directly addressing timeout errors. Increasing memory allocation (option D) also increases CPU and network throughput, which can speed up execution and prevent timeouts. Option A (increasing batch size) would process more messages per invocation, potentially worsening timeouts. Option B (enabling SQS encryption) does not affect timeout. Option E (decreasing visibility timeout) would cause messages to reappear in the queue sooner, which does not resolve the Lambda timeout issue.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Enable SQS queue encryption.

Answer

Decrease the SQS visibility timeout.

Question 11

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

Accepted Answer

No, because the policy denies the request.. The IAM policy denies the s3:PutObject action when the encryption header is not present or does not match AES256. Since the user did not specify encryption, the condition is triggered, and the request is denied. Options A and B are incorrect because policy evaluation occurs before default encryption is applied and ACL permissions cannot override a deny. Option C is incorrect because the user does not need additional permissions; the policy explicitly denies the request.

Answer

Yes, because the user can override the policy with s3:PutObjectAcl.

Answer

Yes, because the bucket has default encryption enabled.

Answer

No, because the user needs additional permissions.

Question 12

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

Accepted Answer

The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.. The pattern of errors occurring exactly at 00:10, 00:30, and 00:50 (20-minute intervals) indicates that the Lambda function is timing out after processing for a long duration, and the SQS visibility timeout is set to 20 minutes. When the function times out, the message becomes visible again in the queue after the visibility timeout, leading to a retry. This results in errors at regular intervals. Option A is incorrect because memory exhaustion would cause out-of-memory errors, not timeouts. Option C is incorrect because hitting reserved concurrency would cause throttles (e.g., 429 errors), not function errors. Option D is incorrect because an incompatible runtime would cause all invocations to fail immediately, not in a pattern.

Answer

The Lambda function is running out of memory.

Answer

The Lambda function is hitting the reserved concurrency limit.

Answer

The Lambda function is using an incompatible runtime.

Question 13

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Accepted Answer

No security group or network ACL allows inbound traffic.. The template does not configure a security group or network ACL to allow inbound traffic. The route table and internet gateway are correctly set up for outbound traffic. Option A is wrong because the subnet has MapPublicIpOnLaunch: true. C is wrong because the route exists. D is wrong because the VPC is not missing an internet gateway.

Answer

The subnet does not have auto-assign public IP enabled.

Answer

The VPC does not have an internet gateway attached.

Answer

The route table does not have a route to the internet gateway.

Question 14

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

Accepted Answer

Use AWS CloudFormation change sets before updating the stack.. Change sets allow you to preview the changes before execution, helping to identify potential conflicts. Option A is wrong because termination protection prevents accidental deletion but does not address resource conflicts during updates. Option C is wrong because nested stacks are for organizing stacks, not for previewing changes. Option D is wrong because stack policies protect specific resources from updates, but they don't preview changes or prevent conflicts.

Answer

Enable termination protection on the stack.

Answer

Use AWS CloudFormation nested stacks.

Answer

Use stack policies to protect critical resources.

Question 15

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application experiences intermittent high latency due to CPU spikes on some instances. The company wants to automatically replace unhealthy instances and optimize costs. What should a solutions architect do?

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy dynamically adjusts the number of instances based on average CPU utilization, which addresses intermittent CPU spikes. The Auto Scaling group also automatically replaces instances that fail ALB health checks, ensuring unhealthy instances are replaced. This optimizes costs by scaling down during low usage. Option B is incorrect: lifecycle hooks are for custom actions during instance launch or termination, not for replacing unhealthy instances. Option C is incorrect: terminating instances with high CPU via Lambda does not integrate with Auto Scaling and could cause instability. Option D is incorrect: scheduled scaling is for predictable traffic patterns, not intermittent spikes.

Answer

Use a lifecycle hook to perform a health check and terminate unhealthy instances.

Answer

Use an AWS Lambda function to terminate instances with high CPU.

Answer

Implement a scheduled scaling policy to increase instances during peak hours.