SAP-C02 Continuous Improvement for Existing Solutions Practice Test 21 — 15 Questions

Question 1

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

Accepted Answer

The application is updating the same item in multiple regions concurrently, and the last-writer-wins conflict resolution is causing data loss.. Option B is correct because DynamoDB global tables use last-writer-wins (LWW) conflict resolution, and if the same item is updated in multiple regions concurrently, conflicts occur. Using conditional writes and application-level conflict resolution can help. Option A is wrong because strong consistency is not supported for global tables. C is wrong because auto scaling does not affect conflicts. D is wrong because conflict resolution is automatic with LWW.

Answer

The application is using strongly consistent reads.

Answer

The DynamoDB write capacity is insufficient.

Answer

The DynamoDB global tables are not properly configured with conflict resolution.

Question 2

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Options B and D are correct. B enforces encryption at upload time, and D provides server-side encryption. A does not enforce encryption, C is about access logging, and E is about replication.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning on the buckets.

Answer

Enable S3 Server Access Logs.

Question 3

A company is running a production web application on Amazon EKS. The application experiences intermittent latency spikes. The operations team suspects that the issue is related to pod networking. Which THREE tools should they use to diagnose the issue? (Choose 3)

Accepted Answer

VPC Flow Logs. Options A, C, and D are correct. VPC Flow Logs capture network traffic, Container Insights provides metrics, and CloudWatch Logs capture container logs. B is for Linux commands, not AWS services. E is for CI/CD, not troubleshooting.

Answer

tcpdump on worker nodes

Answer

AWS CodePipeline

Question 4

A company has an AWS Lambda function that processes messages from an SQS queue. The function is experiencing timeouts. Which TWO changes could help resolve the timeout issue? (Choose 2)

Accepted Answer

Increase the Lambda function timeout.. Options A and B are correct. Increasing timeout gives more time, increasing memory provides more CPU. C does not affect timeout, D reduces visibility timeout (opposite), E is for SQS, not Lambda.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Enable SQS queue encryption.

Answer

Decrease the SQS visibility timeout.

Question 5

A company applies the above IAM policy to an S3 bucket. An IAM user attempts to upload an object without specifying encryption. Will the upload succeed?

Accepted Answer

No, because the policy denies the request.. Option B is correct because the policy denies PutObject if encryption is not AES256. Since no encryption header is specified, the condition matches (StringNotEquals is true because the header is absent), so the request is denied. Option A is wrong because even though bucket default encryption might apply, the policy evaluation happens before the default encryption is applied. Options C and D are incorrect.

Answer

Yes, because the user can override the policy with s3:PutObjectAcl.

Answer

Yes, because the bucket has default encryption enabled.

Answer

No, because the user needs additional permissions.

Question 6

A solutions architect sees the above CloudWatch metric data for a Lambda function. The function is triggered by an SQS queue. The errors occur in a pattern: exactly 5 errors at 00:10, 00:30, and 00:50. What is the MOST likely cause?

Accepted Answer

The Lambda function is timing out due to long-running processing, and the SQS visibility timeout is set to 20 minutes, causing the same messages to be retried.. Option A is correct because the pattern suggests the function times out after 30 seconds of processing, and the SQS messages become visible again after the visibility timeout. The errors at regular intervals (20 minutes) indicate that the function retries the same messages. Option B is wrong because insufficient concurrency would cause throttles, not errors. C is wrong because memory would cause out-of-memory errors, not timeouts. D is wrong because runtime updates would cause all invocations to fail.

Answer

The Lambda function is running out of memory.

Answer

The Lambda function is hitting the reserved concurrency limit.

Answer

The Lambda function is using an incompatible runtime.

Question 7

A company deploys the above CloudFormation template. After deployment, an EC2 instance launched in mySubnet can access the internet. However, the instance cannot receive inbound traffic from the internet. What is the MOST likely reason?

Accepted Answer

No security group or network ACL allows inbound traffic.. Option B is correct because the template does not configure a security group or network ACL to allow inbound traffic. The route table and internet gateway are correctly set up for outbound traffic. Option A is wrong because the subnet has MapPublicIpOnLaunch: true. C is wrong because the route exists. D is wrong because the VPC is not missing an internet gateway.

Answer

The subnet does not have auto-assign public IP enabled.

Answer

The VPC does not have an internet gateway attached.

Answer

The route table does not have a route to the internet gateway.

Question 8

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

Accepted Answer

Use AWS CloudFormation change sets before updating the stack.. Option C is correct because change sets allow you to preview the changes before execution, helping to identify conflicts. Option A is wrong because it does not directly address conflicts. Option B is wrong because resource deletion is not the primary goal. Option D is wrong because it targets templates, not update execution.

Answer

Enable termination protection on the stack.

Answer

Use AWS CloudFormation nested stacks.

Answer

Use stack policies to protect critical resources.

Question 9

A company runs a critical application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application experiences intermittent high latency due to CPU spikes on some instances. The company wants to automatically replace unhealthy instances and optimize costs. What should a solutions architect do?

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. Option B is correct because a dynamic scaling policy adjusts the number of instances based on CPU utilization. Option A is wrong because it does not replace unhealthy instances. Option C is wrong because it replaces all instances at fixed times. Option D is wrong because it only replaces instances on a schedule.

Answer

Use a lifecycle hook to perform a health check and terminate unhealthy instances.

Answer

Use an AWS Lambda function to terminate instances with high CPU.

Answer

Implement a scheduled scaling policy to increase instances during peak hours.

Question 10

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

Accepted Answer

Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.. Option D is correct because CodeDeploy with ECS blue/green deployment provides built-in traffic shifting and automated rollback. Option A is wrong because it lacks traffic shifting. Option B is wrong because it does not support blue/green. Option C is wrong because it lacks automated rollback.

Answer

Use CodePipeline with a Lambda function to swap target groups and monitor health.

Answer

Use CodeDeploy with an in-place deployment configuration and a manual approval step.

Answer

Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

Question 11

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Accepted Answer

Create an SCP to deny s3:PutObject actions without the x-amz-server-side-encryption header set to aws:kms.. Options B and D are correct. Service control policies (SCPs) can deny actions that do not meet encryption and public access conditions. Option A is wrong because resource-level policies are per bucket. Option C is wrong because CloudTrail cannot enforce. Option E is wrong because Config rules only detect, not enforce.

Answer

Use AWS Config rules to automatically remediate non-compliant buckets.

Answer

Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

Answer

Create an S3 bucket policy in each account to enforce encryption and block public access.

Question 12

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster to cache frequently accessed data.. Options A, C, and E are correct. Read replicas offload read traffic, ElastiCache reduces database load, and Multi-AZ provides high availability but not read scaling. Option B is wrong because it does not support sharding. Option D is wrong because it only provides failover, not read scaling.

Answer

Deploy a Multi-AZ RDS instance for automatic failover.

Answer

Implement database sharding by splitting the data across multiple RDS instances.

Question 13

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to ensure that all future stack updates follow best practices for change management. Which THREE actions should the team implement?

Accepted Answer

Use IAM policies to restrict who can update stacks and require approval.. Options A, C, and D are correct. Change sets allow review, stack policies protect resources, and IAM policies enforce least privilege. Option B is wrong because nested stacks do not enforce change management. Option E is wrong because Drift detection identifies differences but does not manage changes.

Answer

Enable drift detection to identify resources that have changed outside of CloudFormation.

Answer

Use nested stacks to reuse templates across multiple environments.

Question 14

A company uses AWS Systems Manager Patch Manager to patch Amazon EC2 instances. After a patching operation, some instances fail to report their compliance status. What is the MOST efficient way to identify the cause of the failure?

Accepted Answer

Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances.. Option A is correct because Systems Manager Inventory collects and queries patch compliance data. Option B is wrong because it only shows state, not failures. Option C is wrong because Patch Manager does not have a dashboard. Option D is wrong because it's not about missing patches.

Answer

Run a script on each instance to list missing patches.

Answer

Use the Patch Manager dashboard in the AWS Management Console.

Answer

Check the EC2 console for each instance's patch status.

Question 15

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

Accepted Answer

Reduce the cooldown period for the Auto Scaling group.. Option C is correct because reducing the cooldown period allows the Auto Scaling group to respond faster to changes. Option A is wrong because increasing min size does not speed up scaling. Option B is wrong because it changes the threshold. Option D is wrong because it's not about instance type.

Answer

Decrease the CPU utilization threshold for scale-out alarms.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Answer

Use a larger instance type to handle more traffic.