SAP-C02 Continuous Improvement for Existing Solutions Practice Test 22 — 15 Questions

Question 1

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

Accepted Answer

Create a new launch template with a patched AMI, then perform a rolling update that detaches and reattaches the existing EBS volumes.. Option D is correct because replacing instances with a new launch template and attaching the existing EBS volumes preserves data. Option A is wrong because it causes downtime. Option B is wrong because it does not preserve state. Option C is wrong because it does not preserve data.

Answer

Use a rolling update with a new Auto Scaling group and delete old instances.

Answer

Terminate all instances and launch new ones with a patched AMI.

Answer

Use Systems Manager Patch Manager to apply patches to running instances.

Question 2

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

Accepted Answer

Configure the ALB to forward the custom header to the target group and validate it on the application.. Options B and D are correct. WAF can inspect custom headers, and ALB can forward headers to the target. Option A is wrong because Security Groups do not inspect headers. Option C is wrong because Cognito is for user pools, not custom headers. Option E is wrong because CloudFront is a CDN, not a security service.

Answer

Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.

Answer

Use Amazon Cognito to authenticate users and pass the header.

Answer

Configure the ALB's security group to allow traffic only from known IP addresses.

Question 3

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.. Option A is correct because CloudWatch Events can filter CloudTrail events and trigger a notification via SNS. Option B is wrong because it requires creating a custom metric. Option C is wrong because it is passive. Option D is wrong because it requires custom analytics.

Answer

Enable CloudTrail Insights to detect unusual key creation patterns.

Answer

Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.

Answer

Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.

Question 4

A company is using AWS CodePipeline with an S3 source action. After a successful deployment, the latest commit ID is stored as an environment variable in the CodeBuild project. The team notices that subsequent pipeline executions are not triggering when new commits are pushed to the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to trigger the pipeline.. Option B is correct because S3 event notifications for PUT and POST operations require the bucket to be configured to send events to CodePipeline. Option A is wrong because the bucket policy is not relevant for event notifications. Option C is wrong because CodePipeline can use S3 as a source without a webhook. Option D is wrong because the pipeline execution role is not the cause.

Answer

The CodePipeline service role lacks permissions to poll the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to read objects.

Answer

The CodePipeline webhook is misconfigured.

Question 5

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

Accepted Answer

Create a change set that replaces the resource causing the limit error with a smaller instance type.. Option D is correct because updating the stack with a change set that replaces the resource causing the limit error is the safest way to handle it. Option A is wrong because deleting and recreating causes downtime. Option B is wrong because manual modifications lead to drift. Option C is wrong because rolling back doesn't fix the underlying issue.

Answer

Manually modify the resource to reduce its capacity and then continue the update.

Answer

Roll back the stack update and ignore the error.

Answer

Delete the stack and recreate it with the corrected template.

Question 6

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

Accepted Answer

Increase both memory and vCPU to 4 GB and 2 vCPUs.. Option C is correct because increasing memory and vCPU together can improve performance for CPU-bound tasks. Option A is wrong because increasing only memory doesn't address CPU. Option B is wrong because increasing only vCPU might not be enough if memory is also a bottleneck. Option D is wrong because scaling horizontally may not reduce latency for a single request if the task itself is underpowered.

Answer

Increase the number of tasks (desired count) to distribute the load.

Answer

Increase the vCPU to 2 while keeping 2 GB memory.

Answer

Increase the memory to 4 GB while keeping 1 vCPU.

Question 7

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Option A is correct because increasing reserved concurrency allows more concurrent invocations. Option B is wrong because adding more Lambda functions is not how concurrency works. Option C is wrong because increasing batch size may cause timeouts. Option D is wrong because decreasing concurrency worsens the problem.

Answer

Create multiple Lambda functions each processing a subset of the queue.

Answer

Decrease the reserved concurrency to force the function to process messages more efficiently.

Answer

Increase the batch size of the SQS event source mapping.

Question 8

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application has a health check endpoint at /health. Recently, the ALB is marking instances as unhealthy even though the application is running. The health check settings are: interval 30 seconds, timeout 5 seconds, unhealthy threshold 2. What is the most likely cause?

Accepted Answer

The health check timeout of 5 seconds is too short for the application to respond.. Option A is correct because if the health check timeout is too short, the ALB may not receive a response in time. Option B is wrong because the interval is standard. Option C is wrong because the unhealthy threshold is not too high. Option D is wrong because the path is correct.

Answer

The health check interval of 30 seconds is too long.

Answer

The unhealthy threshold of 2 is too high.

Answer

The health check path /health is not accessible from the ALB.

Question 9

A company runs a stateful application on EC2 instances in an Auto Scaling group behind an ALB. They want to perform a rolling update without losing session state. Which solution is most appropriate?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB and perform a rolling update.. Option D is correct because using a sticky session (session affinity) ensures that requests from a user are routed to the same instance during the update. Option A is wrong because a blue/green deployment would lose state if not designed for stateful apps. Option B is wrong because terminating instances immediately loses state. Option C is wrong because scaling out first without sticky sessions may route requests to new instances that don't have the state.

Answer

Use a blue/green deployment with a new Auto Scaling group.

Answer

Scale out the Auto Scaling group, then scale in the old instances.

Answer

Terminate instances one by one and let Auto Scaling replace them.

Question 10

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. Option C is correct because AWS CloudTrail logs all API calls to S3, including KMS decrypt calls. Option A is wrong because AWS Config records resource configuration, not access. Option B is wrong because VPC Flow Logs track network traffic, not API calls. Option D is wrong because CloudWatch Logs can store logs but not generate them from S3 access.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 11

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

Accepted Answer

Enable Amazon RDS Proxy.. Option A is correct because enabling Amazon RDS Proxy provides connection pooling and reduces failover time by keeping connections alive. Option B is wrong because read replicas are for read scaling, not for reducing failover time. Option C is wrong because increasing instance size doesn't directly affect failover time. Option D is wrong because disabling Multi-AZ increases downtime.

Answer

Disable Multi-AZ to avoid failover altogether.

Answer

Create a read replica and promote it during failover.

Answer

Increase the DB instance size to improve performance.

Question 12

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

Accepted Answer

Configure the build project to use an S3 cache for dependencies.. Option B is correct because caching dependencies in S3 avoids re-downloading them each build. Option A is wrong because increasing compute resources may not help if the bottleneck is network bandwidth. Option C is wrong because parallel builds are for multiple builds, not a single build. Option D is wrong because CodeBuild doesn't have a build timeout setting that reduces build time; it's a limit.

Answer

Run the build in parallel across multiple build projects.

Answer

Increase the compute type of the build environment to use more vCPUs.

Answer

Reduce the build timeout setting to force faster execution.

Question 13

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Accepted Answer

Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.. Option A is correct because the IAM role used by CloudFormation needs permissions to create EC2 instances. Option C is correct because updating the stack with the corrected IAM role allows the resource creation to proceed. Option B is wrong because the template doesn't need to be changed. Option D is wrong because the service role is not the issue. Option E is wrong because user does not need more permissions.

Answer

Modify the CloudFormation template to use a different instance type.

Answer

Create a new IAM service role for CloudFormation and assign it to the stack.

Answer

Grant the user additional IAM permissions to create EC2 instances.

Question 14

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

Accepted Answer

Configure the cache behavior to forward all query strings but cache based on a whitelist.. Option B is correct because increasing the TTL allows objects to stay in cache longer. Option C is correct because normalizing query strings ensures that different query string orders don't create multiple cache entries. Option A is wrong because shorter TTL reduces cache hits. Option D is wrong because custom error responses don't affect cache hit ratio. Option E is wrong because enabling compression improves speed, not cache hit ratio.

Answer

Configure custom error responses to serve cached content on errors.

Answer

Decrease the default TTL for objects.

Answer

Enable automatic compression for compressible objects.

Question 15

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Migrate the database to Amazon RDS with Multi-AZ deployment.. Option A is correct because Multi-AZ RDS provides database high availability. Option B is correct because Auto Scaling across multiple AZs provides compute high availability. Option C is correct because an ALB distributes traffic across healthy instances. Option D is wrong because a single EBS volume is not highly available. Option E is wrong because storing data only on the instance store is not durable.

Answer

Use an EBS volume with higher IOPS to improve performance.

Answer

Store data on the instance store instead of EBS to reduce latency.