SAP-C02 Continuous Improvement for Existing Solutions Practice Test 22 — 15 Questions

Question 1

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.. CodeDeploy with ECS blue/green deployment provides built-in traffic shifting and automated rollback. Option A is wrong because it lacks traffic shifting. Option B is wrong because it does not support blue/green. Option C is wrong because it lacks automated rollback.

Answer

Use CodePipeline with a Lambda function to swap target groups and monitor health.

Answer

Use CodeDeploy with an in-place deployment configuration and a manual approval step.

Answer

Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

Question 2

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AWS KMS and prohibit public access. Which TWO actions should the team take?

Accepted Answer

Use AWS Config rules to automatically remediate non-compliant buckets.. Uses AWS Config rules with automatic remediation to enforce compliance on both encryption and public access settings. Option C creates an SCP that denies s3:PutObject actions unless the x-amz-server-side-encryption header is set to aws:kms, ensuring new objects are encrypted with KMS. Option E is incorrect because it only denies put actions on bucket policies and public access blocks if encryption is not enabled, but does not itself prohibit public access; users could still enable public access if encryption is met. Option B is incorrect because CloudTrail is for auditing, not remediation. Option D is incorrect because per-account bucket policies can be overridden and are less effective than organizational policies.

Answer

Enable AWS CloudTrail to monitor and automatically remediate non-compliant buckets.

Answer

Create an S3 bucket policy in each account to enforce encryption and block public access.

Answer

Create an SCP to deny s3:PutBucketPublicAccessBlock and s3:PutBucketPolicy actions unless encryption is enabled.

Question 3

A company has a mission-critical application running on Amazon RDS for PostgreSQL. The database experiences high read traffic that causes performance degradation. The company wants to improve read scalability without modifying the application. Which THREE solutions should a solutions architect recommend?

Accepted Answer

Implement an Amazon ElastiCache cluster to cache frequently accessed data.. Options A, C, and E are correct. Amazon ElastiCache reduces database load by caching frequently accessed data. Read replicas offload read traffic from the primary database. RDS Proxy helps manage database connections and reduce load on the database. Option B (Multi-AZ) provides high availability and automatic failover but does not improve read scalability. Option D (database sharding) requires application modifications and is not the recommended approach for read scalability without modifying the application.

Answer

Deploy a Multi-AZ RDS instance for automatic failover.

Answer

Implement database sharding by splitting the data across multiple RDS instances.

Question 4

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to ensure that all future stack updates follow best practices for change management. Which THREE actions should the team implement?

Accepted Answer

Use IAM policies to restrict who can update stacks and require approval.. Options B, D, and E are correct. IAM policies enforce least privilege and require approval for updates (B), stack policies protect critical resources from accidental changes (D), and change sets allow review and approval before execution (E). Option A (drift detection) is a monitoring tool, not a change management control. Option C (nested stacks) promotes template reuse but does not enforce change management processes.

Answer

Enable drift detection to identify resources that have changed outside of CloudFormation.

Answer

Use nested stacks to reuse templates across multiple environments.

Question 5

A company uses AWS Systems Manager Patch Manager to patch Amazon EC2 instances. After a patching operation, some instances fail to report their compliance status. What is the MOST efficient way to identify the cause of the failure?

Accepted Answer

Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances.. Use Systems Manager Inventory to query patch compliance details and identify non-compliant instances. This is the most efficient approach because Systems Manager Inventory provides a centralized view of patch compliance across all managed instances, allowing you to quickly identify which instances are non-compliant and investigate the reasons for patch failures. Option A is inefficient because it requires running scripts manually on each instance. Option C is incorrect because the Patch Manager dashboard (if available) may not provide detailed failure reasons. Option D is inefficient and does not directly address compliance failure causes.

Answer

Run a script on each instance to list missing patches.

Answer

Use the Patch Manager dashboard in the AWS Management Console.

Answer

Check the EC2 console for each instance's patch status.

Question 6

A company uses AWS Elastic Beanstalk to deploy a web application. The application experiences increased traffic, and the environment's Auto Scaling group is not scaling out quickly enough. What should a solutions architect do to improve the scaling response?

Accepted Answer

Reduce the cooldown period for the Auto Scaling group.. Reducing the cooldown period allows the Auto Scaling group to react faster to increased traffic, enabling quicker scale-out. Option A is incorrect because decreasing the CPU utilization threshold for scale-out alarms would cause the group to scale out at lower CPU levels, potentially scaling out sooner but not necessarily improving the speed of response. Option B is incorrect because increasing the minimum number of instances does not speed up scaling; it only ensures a higher baseline capacity. Option D is incorrect because using larger instance types handles more traffic per instance but does not improve the scaling response time.

Answer

Decrease the CPU utilization threshold for scale-out alarms.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Answer

Use a larger instance type to handle more traffic.

Question 7

A company runs a stateful application on Amazon EC2 instances in an Auto Scaling group. The application stores data on an Amazon EBS volume attached to each instance. The company wants to implement a patching strategy that minimizes downtime and preserves data. What should a solutions architect do?

Accepted Answer

Create a new launch template with a patched AMI, then perform a rolling update that detaches and reattaches the existing EBS volumes.. It minimizes downtime by using a rolling update and preserves data by detaching and reattaching existing EBS volumes. Option A is wrong because it does not preserve existing EBS volumes, leading to data loss. Option C is wrong because terminating all instances causes downtime and does not preserve data. Option D is wrong because patching running instances may cause application instability and does not ensure data preservation in case of rollback.

Answer

Use a rolling update with a new Auto Scaling group and delete old instances.

Answer

Terminate all instances and launch new ones with a patched AMI.

Answer

Use Systems Manager Patch Manager to apply patches to running instances.

Question 8

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses a custom header for authentication. The security team wants to ensure that requests are only accepted from authenticated users. Which TWO actions should the team take?

Accepted Answer

Configure the ALB to forward the custom header to the target group and validate it on the application.. Options B and C are correct. AWS WAF can inspect the custom header and block requests without it (Option C), and the ALB can forward the custom header to the target group where the application can validate it (Option B). Option A is incorrect because using CloudFront with signed URLs would add an extra layer but does not directly validate the custom header. Option D is incorrect because Amazon Cognito is used for authentication and user management, not for custom header validation. Option E is incorrect because security groups operate at the network layer and cannot inspect application headers.

Answer

Place an Amazon CloudFront distribution in front of the ALB and use signed URLs.

Answer

Use Amazon Cognito to authenticate users and pass the header.

Answer

Configure the ALB's security group to allow traffic only from known IP addresses.

Question 9

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.. The most efficient way to alert when an IAM user creates a new access key is to use CloudWatch Events (now Amazon EventBridge) to match the CreateAccessKey API call from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail Insights is for detecting unusual activity patterns, not for real-time event-driven alerts. Option C is less efficient because it requires additional steps of publishing logs to CloudWatch Logs and creating a metric filter, adding complexity. Option D is inefficient because querying CloudTrail logs with Athena is not real-time and requires custom scheduling.

Answer

Enable CloudTrail Insights to detect unusual key creation patterns.

Answer

Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.

Answer

Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.

Question 10

A company is using AWS CodePipeline with an S3 source action. After a successful deployment, the latest commit ID is stored as an environment variable in the CodeBuild project. The team notices that subsequent pipeline executions are not triggering when new commits are pushed to the S3 bucket. What is the most likely cause?

Accepted Answer

The S3 bucket does not have an event notification configured to trigger the pipeline.. With an S3 source action in CodePipeline, you must configure an S3 event notification to trigger the pipeline when a new commit (object) is pushed. Without this notification, CodePipeline will not automatically start a new execution on changes. Option A is incorrect because CodePipeline does not poll S3; it relies on event notifications. Option B is incorrect because CodePipeline reads objects using its service role, not via bucket policy. Option D is incorrect because webhooks are used for external sources like GitHub, not for S3.

Answer

The CodePipeline service role lacks permissions to poll the S3 bucket.

Answer

The S3 bucket policy does not allow CodePipeline to read objects.

Answer

The CodePipeline webhook is misconfigured.

Question 11

A company uses AWS CloudFormation to manage infrastructure. They want to update a stack that fails due to a resource limit exceeded error. Which approach minimizes downtime while fixing the issue?

Accepted Answer

Create a change set that replaces the resource causing the limit error with a smaller instance type.. Creating a change set that replaces the resource causing the limit error with a smaller instance type allows the update to proceed without manual intervention, minimizing downtime. Option A is wrong because manually modifying the resource can cause stack drift and may not be safe. Option C is wrong because rolling back does not resolve the underlying resource limit issue. Option D is wrong because deleting and recreating the stack would cause significant downtime.

Answer

Manually modify the resource to reduce its capacity and then continue the update.

Answer

Roll back the stack update and ignore the error.

Answer

Delete the stack and recreate it with the corrected template.

Question 12

A company runs a critical application on Amazon ECS with Fargate launch type. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization on tasks during these spikes. The current task definition has 1 vCPU and 2 GB memory. Which improvement will most effectively reduce latency without over-provisioning?

Accepted Answer

Increase both memory and vCPU to 4 GB and 2 vCPUs.. Increasing both vCPU and memory improves performance for CPU-bound tasks and prevents memory contention. Option A is wrong because increasing the number of tasks (horizontal scaling) does not reduce latency for a single request if the task itself is underpowered; it distributes load but does not address high CPU on each task. Option B is wrong because increasing only vCPU might alleviate CPU pressure but could still be limited by memory if the application is also memory-intensive; however, increasing both ensures no bottleneck. Option D is wrong because increasing memory alone does not address the high CPU utilization.

Answer

Increase the number of tasks (desired count) to distribute the load.

Answer

Increase the vCPU to 2 while keeping 2 GB memory.

Answer

Increase the memory to 4 GB while keeping 1 vCPU.

Question 13

A company uses AWS Lambda functions to process events from an SQS queue. The Lambda function is configured with a reserved concurrency of 5. The SQS queue has a high volume of messages, and the Lambda function is experiencing throttling errors. What is the most cost-effective solution to reduce throttling?

Accepted Answer

Increase the reserved concurrency for the Lambda function.. Increasing the reserved concurrency from 5 to a higher value allows the Lambda function to handle more concurrent invocations, directly reducing throttling errors. Option A is incorrect because each Lambda function has its own concurrency limit; adding more functions does not increase the concurrency of a single function. Option B is incorrect because decreasing reserved concurrency would worsen throttling. Option D is incorrect because increasing the batch size increases the number of messages processed per invocation but does not increase the number of concurrent invocations, so it does not address throttling caused by concurrency limits.

Answer

Create multiple Lambda functions each processing a subset of the queue.

Answer

Decrease the reserved concurrency to force the function to process messages more efficiently.

Answer

Increase the batch size of the SQS event source mapping.

Question 14

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application has a health check endpoint at /health. Recently, the ALB is marking instances as unhealthy even though the application is running. The health check settings are: interval 30 seconds, timeout 5 seconds, unhealthy threshold 2. What is the most likely cause?

Accepted Answer

The health check timeout of 5 seconds is too short for the application to respond.. A timeout of 5 seconds may be insufficient if the application's /health endpoint takes longer to respond due to high load or backend processing. The ALB expects a response within the timeout; if not received, it marks the instance unhealthy. Option A is wrong because a 30-second interval is standard and not too long; reducing it would increase load but not fix the timeout issue. Option B is wrong because an unhealthy threshold of 2 is reasonable; lowering it would mark instances unhealthy more quickly but does not address the root cause of slow responses. Option D is wrong because the path /health is accessible (the application is running), so the ALB can reach it; the problem is the response time.

Answer

The health check interval of 30 seconds is too long.

Answer

The unhealthy threshold of 2 is too high.

Answer

The health check path /health is not accessible from the ALB.

Question 15

A company runs a stateful application on EC2 instances in an Auto Scaling group behind an ALB. They want to perform a rolling update without losing session state. Which solution is most appropriate?

Accepted Answer

Enable sticky sessions (session affinity) on the ALB and perform a rolling update.. Enabling sticky sessions (session affinity) on the ALB ensures that requests from a user are consistently routed to the same instance during the rolling update, preserving session state. Option B (blue/green deployment) would require external session state management or state replication. Option C (scale out then scale in) may route new requests to instances lacking state, and Option D (terminate instances one by one) loses the state when the instance is terminated.

Answer

Use a blue/green deployment with a new Auto Scaling group.

Answer

Scale out the Auto Scaling group, then scale in the old instances.

Answer

Terminate instances one by one and let Auto Scaling replace them.