SAP-C02 Continuous Improvement for Existing Solutions Practice Test 23 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made to S3, including requests to decrypt KMS keys. This enables auditing of all access requests to the bucket. AWS Config (C) records resource configuration changes, not access requests. VPC Flow Logs (A) capture network traffic, not API calls. CloudWatch Logs (B) can store and monitor logs but does not generate logs from S3 access by itself.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 2

A company uses Amazon RDS for MySQL with Multi-AZ deployment. They notice that during a failover, the application experiences a brief outage but then recovers. They want to minimize the failover time. Which action will most effectively reduce the failover time?

Accepted Answer

Enable Amazon RDS Proxy.. Enabling Amazon RDS Proxy provides connection pooling and reduces failover time by keeping connections alive during failover. Option A is wrong because disabling Multi-AZ removes high availability and increases downtime. Option B is wrong because read replicas are for read scaling and promoting a replica involves manual intervention and DNS changes, which does not minimize failover time as effectively as RDS Proxy. Option D is wrong because increasing the DB instance size improves performance but does not directly affect failover time.

Answer

Disable Multi-AZ to avoid failover altogether.

Answer

Create a read replica and promote it during failover.

Answer

Increase the DB instance size to improve performance.

Question 3

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

Accepted Answer

Configure the build project to use an S3 cache for dependencies.. Caching dependencies in an S3 bucket avoids re-downloading them from the public repository on every build, which is the most effective way to reduce build time as network downloads are typically the bottleneck. Increasing compute resources (Option C) may not help if the bottleneck is network bandwidth, and parallel builds (Option B) are for running multiple builds concurrently, not speeding up a single build. Reducing the build timeout (Option D) does not speed up execution; it just cancels a build that exceeds the limit.

Answer

Run the build in parallel across multiple build projects.

Answer

Increase the compute type of the build environment to use more vCPUs.

Answer

Reduce the build timeout setting to force faster execution.

Question 4

A company is using AWS CloudFormation to deploy a web application. The stack creation fails with the error: 'The following resource(s) failed to create: [MyEC2Instance].' The EC2 instance creation failed because of an insufficient IAM permissions error. Which TWO actions should the company take to resolve this issue? (Choose two.)

Accepted Answer

Update the IAM role associated with the CloudFormation stack to include ec2:RunInstances permission.. Options C and E are correct. The error indicates that the IAM role used by CloudFormation to create the EC2 instance lacks the ec2:RunInstances permission. Therefore, updating the IAM role to include this permission (C) and then executing a stack update (E) will resolve the issue. Option A is incorrect because the instance type is not related to the IAM permissions error. Option B is incorrect because creating a new role is unnecessary; updating the existing role suffices. Option D is incorrect because granting permissions to the user does not affect the CloudFormation service role's permissions.

Answer

Modify the CloudFormation template to use a different instance type.

Answer

Create a new IAM service role for CloudFormation and assign it to the stack.

Answer

Grant the user additional IAM permissions to create EC2 instances.

Question 5

A company is using Amazon CloudFront to distribute content globally. They want to improve the cache hit ratio. Which TWO actions are most effective? (Choose two.)

Accepted Answer

Configure the cache behavior to forward all query strings but cache based on a whitelist.. Forwarding all query strings but caching based on a whitelist prevents cache fragmentation from unnecessary query parameters, improving the cache hit ratio. Option B is correct because increasing the minimum TTL ensures objects remain in the cache for a longer duration, increasing the likelihood of cache hits. Option C is incorrect because custom error responses serve alternative content on errors but do not improve the cache hit ratio. Option D is incorrect because decreasing the default TTL reduces cache duration, leading to more misses. Option E is incorrect because compression improves transfer speed and reduces bandwidth, not the cache hit ratio.

Answer

Configure custom error responses to serve cached content on errors.

Answer

Decrease the default TTL for objects.

Answer

Enable automatic compression for compressible objects.

Question 6

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

Accepted Answer

Migrate the database to Amazon RDS with Multi-AZ deployment.. Amazon RDS with Multi-AZ deployment provides automatic failover and high availability for the database. Option D is correct because placing the EC2 instance in an Auto Scaling group that spans multiple Availability Zones ensures compute resources are available even if one AZ fails. Option E is correct because an Application Load Balancer distributes traffic across healthy instances and supports health checks, improving application availability. Option B is incorrect because higher IOPS improves performance but not availability. Option C is incorrect because instance store is ephemeral and data is lost on instance failure, reducing durability and availability.

Answer

Use an EBS volume with higher IOPS to improve performance.

Answer

Store data on the instance store instead of EBS to reduce latency.

Question 7

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). During a recent deployment, users experienced errors. The team wants to automatically roll back the deployment if the error rate exceeds 5% within 10 minutes after deployment. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use CodeDeploy with a CloudWatch alarm on the ALB error rate that triggers a deployment rollback.. AWS CodeDeploy supports automatic rollback based on CloudWatch alarm metrics, such as the ALB error rate exceeding 5% for 10 minutes, with minimal operational overhead. Option A is incorrect because modifying Auto Scaling group health checks does not directly monitor application-level error rates for rollback. Option B is incorrect because manual approval gates require human intervention and do not provide automatic rollback. Option D is incorrect because using a custom Lambda function adds complexity and is not the best practice; CodeDeploy with CloudWatch alarms provides a simpler, fully managed solution.

Answer

Configure the Auto Scaling group to use ELB health checks and replace instances if the error rate increases.

Answer

Use CodeDeploy with manual approval gates and a script that checks error rates.

Answer

Use a custom Lambda function that monitors ALB error rates and triggers a rollback via CodeDeploy API.

Question 8

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

Accepted Answer

Enable source IP stickiness on the NLB target group.. Network Load Balancer (NLB) supports target group stickiness based on source IP address, which ensures that client requests are routed to the same EC2 instance, maintaining session persistence. This is the appropriate method for stateful applications. Option A is incorrect because disabling cross-zone load balancing does not provide stickiness; it only restricts traffic to instances in the same Availability Zone. Option B is incorrect because NLB does not support cookie-based stickiness; that is a feature of Application Load Balancer. Option C is incorrect because while ALB does support cookie-based stickiness, switching to ALB is unnecessary; NLB already supports source IP stickiness.

Answer

Disable cross-zone load balancing on the NLB.

Answer

Enable cookie-based stickiness on the NLB listener.

Answer

Switch to an Application Load Balancer and enable cookie-based stickiness.

Question 9

A company is using AWS CloudFormation to manage infrastructure. The security team requires that all CloudFormation stacks include a specific tag (CostCenter). The company wants to enforce this tag automatically. Which method should be used to enforce the tag?

Accepted Answer

Use an AWS Config rule to check for the tag and a custom IAM policy to deny stack creation without the tag.. An AWS Config rule can detect stacks missing the required tag, and a custom IAM policy can deny the ability to create or update stacks that do not have the tag, providing preventive enforcement. Option A is incorrect because AWS Service Catalog can enforce tags on products it provisions, but the question is about all CloudFormation stacks, not just those from Service Catalog. Option C is incorrect because a Lambda function can alert or remediate after the fact, but it does not prevent creation of non-compliant stacks. Option D is incorrect because tagging after creation does not enforce the tag requirement at creation time, and AWS Resource Groups is not an enforcement mechanism.

Answer

Use AWS Service Catalog to enforce mandatory tags on all provisioned products.

Answer

Create an AWS Lambda function that checks for the tag and sends alerts.

Answer

Use AWS Resource Groups to tag resources after stack creation.

Question 10

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

Accepted Answer

Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.. A blue/green deployment with ECS minimizes downtime by switching traffic gradually. Option A is wrong because migrating all at once risks downtime. Option B is wrong because launching a separate ECS cluster adds complexity. Option C is wrong because CodeStar is not a deployment strategy.

Answer

Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.

Answer

Deploy the monolith as a single task in ECS and update the task definition with new container versions.

Answer

Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.

Question 11

A company runs a data processing application on EC2 instances that read from an Amazon SQS queue. The application processes each message in about 2 seconds. The company expects a sudden spike in messages and wants to minimize processing latency. Which configuration will handle the spike most cost-effectively?

Accepted Answer

Replace the EC2 instances with AWS Lambda functions that are triggered by SQS events.. Using Lambda functions triggered by SQS events provides automatic scaling to handle sudden spikes in message volume without requiring provisioning or managing EC2 instances. Lambda scales instantly based on the number of messages in the queue, and you pay only for compute time used, making it the most cost-effective solution for variable workloads. Option B is incorrect because increasing instance size is less cost-effective and still requires manual scaling. Option C is incorrect because a fixed desired capacity may lead to over-provisioning or under-provisioning during the spike. Option D is incorrect because step scaling based on queue depth introduces latency as it takes time to launch new instances, whereas Lambda reacts immediately per message.

Answer

Increase the EC2 instance size to handle more messages per instance.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value during the expected spike.

Answer

Use Auto Scaling with a step scaling policy based on the SQS queue depth.

Question 12

A company uses Amazon RDS for MySQL with Multi-AZ. The operations team notices that during a failover, the application experiences errors for about 2 minutes. The application uses a JDBC connection pool. Which solution should the team implement to reduce the failover impact?

Accepted Answer

Configure the JDBC connection string with a timeout and implement automatic retry logic.. Implementing a timeout and automatic retry logic in the JDBC connection pool ensures that after a failover, the application can quickly detect the failed connection and reconnect to the new primary. Option A is incorrect because restarting the application via CloudWatch Events and Lambda does not directly address connection failures and may cause additional downtime. Option B is incorrect: while Amazon RDS Proxy can help manage connections and reduce latency, it does not eliminate the need for application-level retry logic; during failover, connections are dropped and need to be re-established. Option D is incorrect because increasing the TTL of the RDS DNS record would actually cause the application to cache the old DNS record longer, delaying failover detection.

Answer

Use Amazon CloudWatch Events to trigger a Lambda function that restarts the application.

Answer

Use Amazon RDS Proxy to manage database connections.

Answer

Increase the TTL for the RDS DNS record to 60 seconds.

Question 13

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets be encrypted at rest using SSE-KMS. The company has thousands of existing buckets, some of which are not encrypted. Which approach will enforce encryption on all buckets with minimal effort?

Accepted Answer

Use an SCP to deny creation of buckets without SSE-KMS and use an AWS Config rule with remediation to enable SSE-KMS on existing buckets.. An SCP can deny creation of buckets without SSE-KMS, and AWS Config with automatic remediation can enable SSE-KMS on existing buckets. Option A is wrong because S3 default encryption only encrypts new objects, not existing ones. Option B is wrong because SSE-S3 does not meet the KMS requirement. Option D is wrong because a Lambda function is reactive and requires custom code, whereas the combination of SCP and Config provides a more scalable and policy-driven approach.

Answer

Use S3 default encryption to automatically encrypt new objects.

Answer

Use an AWS Config rule to check for encryption and automatically remediate by enabling SSE-S3.

Answer

Create an AWS Lambda function that scans all buckets and enables encryption.

Question 14

A company uses AWS CodePipeline for CI/CD. The deployment stage uses AWS CodeDeploy to deploy to EC2 instances. The team wants to automatically test the application after deployment and roll back if tests fail. Which approach should the team use?

Accepted Answer

Use a CloudWatch alarm to monitor test results and trigger a rollback.. It allows automatic testing and rollback by integrating CloudWatch alarms. After deployment, a test stage can run tests and publish a custom metric to CloudWatch. If the metric breaches a threshold (indicating test failure), a CloudWatch alarm triggers a rollback action, such as an AWS Lambda function that calls the CodeDeploy API to roll back the deployment. This approach automates the entire process without manual intervention. Option A is incorrect because creating a separate pipeline introduces unnecessary complexity and cross-pipeline triggers are not straightforward for rollback. Option B is incorrect because manual approval steps require human interaction, which is not automatic. Option D is incorrect because CodeDeploy cannot automatically roll back based on a pipeline failure; CodeDeploy only rolls back on its own deployment failures, not failures in subsequent pipeline stages. The test stage is part of the pipeline, and if it fails, the pipeline fails, but CodeDeploy's rollback is not triggered by pipeline stage failures.

Answer

Create a separate CodePipeline for testing and use a cross-pipeline trigger to initiate rollback.

Answer

Add a manual approval step after deployment to run tests manually.

Answer

Add a test stage in CodePipeline after the deployment stage and configure CodeDeploy to automatically roll back on pipeline failure.

Question 15

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application experiences high latency during peak hours. The operations team suspects that the instances are overloaded. Which TWO actions should the team take to improve performance and scalability? (Choose two.)

Accepted Answer

Configure an Application Load Balancer in front of the Auto Scaling group.. An Application Load Balancer distributes incoming traffic across multiple EC2 instances, reducing load on individual instances and improving scalability. Option D is correct because launching instances in multiple Availability Zones increases fault tolerance and allows the Auto Scaling group to scale across zones, improving availability and performance during peak hours. Option A is incorrect because increasing desired capacity to a fixed value does not adapt to variable demand and may lead to overprovisioning. Option C is incorrect because changing the AMI does not address the root cause of overload; performance improvements from AMI changes are negligible compared to scaling. Option E is incorrect because increasing instance size (vertical scaling) has limits and does not provide the elasticity and cost-efficiency of horizontal scaling.

Answer

Increase the Auto Scaling group's desired capacity to a higher fixed value.

Answer

Switch to a different Amazon Machine Image (AMI) with optimized performance.

Answer

Increase the instance size to a larger type.