SAP-C02 Continuous Improvement for Existing Solutions Practice Test 23 — 15 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). During a recent deployment, users experienced errors. The team wants to automatically roll back the deployment if the error rate exceeds 5% within 10 minutes after deployment. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use CodeDeploy with a CloudWatch alarm on the ALB error rate that triggers a deployment rollback.. Option D is correct because AWS CodeDeploy supports automatic rollback based on CloudWatch alarm metrics, such as error rate, with minimal overhead. Option A is wrong because manual approval does not trigger automatic rollback. Option B is wrong because Lambda functions add complexity and are not the best practice for automatic rollback. Option C is wrong because modifying ASG health checks does not directly monitor error rate for rollback.

Answer

Configure the Auto Scaling group to use ELB health checks and replace instances if the error rate increases.

Answer

Use CodeDeploy with manual approval gates and a script that checks error rates.

Answer

Use a custom Lambda function that monitors ALB error rates and triggers a rollback via CodeDeploy API.

Question 2

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

Accepted Answer

Enable source IP stickiness on the NLB target group.. Option B is correct because NLB supports target group stickiness based on the source IP address, which is the appropriate method for stateful applications. Option A is wrong because ALB is not used with NLB. Option C is wrong because the NLB itself does not support cookie-based stickiness; that is an ALB feature. Option D is wrong because disabling cross-zone load balancing does not ensure stickiness.

Answer

Disable cross-zone load balancing on the NLB.

Answer

Enable cookie-based stickiness on the NLB listener.

Answer

Switch to an Application Load Balancer and enable cookie-based stickiness.

Question 3

A company is using AWS CloudFormation to manage infrastructure. The security team requires that all CloudFormation stacks include a specific tag (CostCenter). The company wants to enforce this tag automatically. Which method should be used to enforce the tag?

Accepted Answer

Use an AWS Config rule to check for the tag and a custom IAM policy to deny stack creation without the tag.. Option C is correct because an AWS Config rule with an iam policy to deny non-compliant stacks is the most automated enforcement method. Option A is wrong because AWS Service Catalog does not enforce tags on existing stacks. Option B is wrong because Lambda can remediate but not prevent non-compliant stacks. Option D is wrong because tagging at the resource level is not automated enforcement.

Answer

Use AWS Service Catalog to enforce mandatory tags on all provisioned products.

Answer

Create an AWS Lambda function that checks for the tag and sends alerts.

Answer

Use AWS Resource Groups to tag resources after stack creation.

Question 4

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

Accepted Answer

Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.. Option D is correct because a blue/green deployment with ECS minimizes downtime by switching traffic gradually. Option A is wrong because migrating all at once risks downtime. Option B is wrong because launching a separate ECS cluster adds complexity. Option C is wrong because CodeStar is not a deployment strategy.

Answer

Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.

Answer

Deploy the monolith as a single task in ECS and update the task definition with new container versions.

Answer

Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.

Question 5

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

Accepted Answer

Replace the EC2 instances with AWS Lambda functions that are triggered by SQS events.. Option B is correct because using a Lambda function with SQS triggers scales automatically and cost-effectively for variable workloads. Option A is wrong because Auto Scaling with a fixed schedule may not react quickly to a sudden spike. Option C is wrong because Auto Scaling based on queue length may be slower to scale. Option D is wrong because increasing instance size is less cost-effective than serverless.

Answer

Increase the EC2 instance size to handle more messages per instance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value during the expected spike.

Answer

Use Auto Scaling with a step scaling policy based on the SQS queue depth.

Question 6

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

Accepted Answer

Configure the JDBC connection string with a timeout and implement automatic retry logic.. Option C is correct because using a custom JDBC URL with a timeout and retry logic allows the application to reconnect after failover. Option A is wrong because RDS proxy does not eliminate the need for application retry logic. Option B is wrong because increasing the TTL does not affect the connection timeout. Option D is wrong because a Lambda function does not directly improve failover recovery.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Increase the TTL for the RDS DNS record to 60 seconds.

Question 7

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

Accepted Answer

Use an SCP to deny creation of buckets without SSE-KMS and use an AWS Config rule with remediation to enable SSE-KMS on existing buckets.. Option D is correct because an SCP can deny creation of unencrypted buckets and AWS Config can remediate existing buckets. Option A is wrong because a Lambda function is reactive, not proactive. Option B is wrong because S3 default encryption is not applied retroactively. Option C is wrong because SSE-S3 does not meet the KMS requirement.

Answer

Use S3 default encryption to automatically encrypt new objects.

Answer

Use an AWS Config rule to check for encryption and automatically remediate by enabling SSE-S3.

Answer

Create an AWS Lambda function that scans all buckets and enables encryption.

Question 8

A company runs a web application on EC2 instances behind an Application Load Balancer. The application stores session state in an Amazon ElastiCache Redis cluster. During a traffic spike, the Redis cluster's CPU utilization reaches 90%, causing increased latency. The company wants to reduce the load on Redis without changing the application code. Which solution should the company implement?

Accepted Answer

Enable cluster mode on the ElastiCache Redis cluster to distribute data across multiple shards.. Option A is correct because enabling ElastiCache for Redis cluster mode allows data to be distributed across multiple shards, reducing CPU load per node. Option B is wrong because read replicas are for read-heavy workloads, not for reducing CPU load on the primary. Option C is wrong because a larger node type may help but is less cost-effective than sharding. Option D is wrong because ElastiCache does not support Lambda extensions.

Answer

Use Amazon ElastiCache Global Datastore to distribute traffic across regions.

Answer

Add read replicas to the Redis cluster to offload read traffic.

Answer

Upgrade to a larger Redis node type with more vCPUs.

Question 9

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

Accepted Answer

Add a test stage in CodePipeline after the deployment stage and configure CodeDeploy to automatically roll back on pipeline failure.. Option C is correct because CodePipeline can have a test stage after deployment, and CodeDeploy can trigger a rollback if the test stage fails. Option A is wrong because manual testing is not automatic. Option B is wrong because CloudWatch alarms are not for test results. Option D is wrong because a separate pipeline adds complexity.

Answer

Create a separate CodePipeline for testing and use a cross-pipeline trigger to initiate rollback.

Answer

Add a manual approval step after deployment to run tests manually.

Answer

Use a CloudWatch alarm to monitor test results and trigger a rollback.

Question 10

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

Accepted Answer

Configure an Application Load Balancer in front of the Auto Scaling group.. Option B is correct because adding an ALB distributes traffic across instances. Option D is correct because launching instances across multiple AZs improves availability and scalability. Option A is wrong because larger instances may not help if the issue is concurrency. Option C is wrong because increasing desired capacity without a load balancer may cause uneven distribution. Option E is wrong because changing the AMI does not directly improve performance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value.

Answer

Switch to a different Amazon Machine Image (AMI) with optimized performance.

Answer

Increase the instance size to a larger type.

Question 11

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of user_id and a sort key of timestamp. During a new game launch, the table experiences throttling on a few partitions. The company wants to improve the partition distribution. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Add a random suffix to the partition key to distribute writes more evenly.. Option A is correct because adding a suffix to partition key can spread writes across partitions. Option C is correct because using DynamoDB Accelerator (DAX) reduces read load, indirectly helping write capacity. Option D is correct because using write sharding distributes writes across multiple partitions. Option B is wrong because increasing read capacity does not help write throttling. Option E is wrong because changing to on-demand may help but does not improve partition distribution.

Answer

Increase the read capacity units for the table.

Answer

Switch the table to on-demand capacity mode.

Question 12

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Accepted Answer

Use AWS CloudFormation with a blue/green deployment strategy for the database.. Option A is correct because a blue/green deployment minimizes downtime by creating a new database environment. Option C is correct because taking a snapshot before updates provides a rollback option. Option B is wrong because Multi-AZ is for high availability, not for zero-downtime updates. Option D is wrong because a read replica is for read scaling, not for updates. Option E is wrong because modifying the stack directly may cause downtime.

Answer

Enable Multi-AZ on the RDS instance to allow failover during updates.

Answer

Update the CloudFormation stack directly without creating a new database.

Answer

Use a read replica to serve traffic during the update.

Question 13

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

Accepted Answer

The deployment removed the health check path from the application.. Option A is correct because an increase in request count without a corresponding increase in target capacity can cause the ALB to return 503 errors when all targets are unhealthy or overloaded. Option B is incorrect because security groups were not changed. Option C is incorrect because if the health check path was removed, health checks would fail consistently, not intermittently. Option D is incorrect because a missing security group rule would block traffic entirely, not cause intermittent errors.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the ALB does not allow inbound traffic on the listener port.

Answer

The ALB's target group health check settings are misconfigured.

Question 14

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

Accepted Answer

Modify the target group health check to use path '/' instead of '/health'.. Option B is correct because the CodePipeline deploy action uses CodeDeploy for blue/green deployments. The error indicates that the original target group (blue) is not healthy, possibly because the health check path is not valid for the original application version. Adjusting the health check to a common path like '/' allows both versions to pass. Option A is incorrect because Fargate does not allow SSH. Option C is incorrect because redeploying the same version won't fix the underlying health check issue. Option D is incorrect because a new target group does not address the root cause.

Answer

Redeploy the previous version of the application that passed health checks.

Answer

Create a new target group with the correct health check path and update the ECS service.

Answer

SSH into the Fargate container and restart the application.

Question 15

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

Accepted Answer

Change the bucket's default encryption configuration to SSE-KMS.. Option C is correct because changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys. Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Answer

Add a lifecycle policy to transition objects to SSE-KMS.

Answer

Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.

Answer

Use a bucket policy to deny uploads without SSE-KMS.