SAP-C02 Continuous Improvement for Existing Solutions Practice Test 24 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy a multi-tier application. The deployment includes an Application Load Balancer, Auto Scaling group, and Amazon RDS database. The company wants to ensure that updates to the database do not cause downtime. Which TWO strategies should the company use? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS CloudFormation with a blue/green deployment strategy for the database.. CloudFormation can use a blue/green deployment strategy, which creates a new database environment (green) alongside the existing one (blue). Traffic is switched after the new environment is ready, minimizing downtime. Option E is correct because taking a database snapshot before updates provides a rollback mechanism in case the update fails. Option A is wrong: Multi-AZ provides high availability and automatic failover but does not eliminate downtime during updates—it simply recovers quickly after an outage. Option B is wrong: Directly updating the CloudFormation stack without creating a new database may cause downtime if the database must be replaced or modified in place. Option D is wrong: A read replica serves only read traffic; it cannot handle write traffic during database updates, so it does not prevent downtime for write operations.

Answer

Enable Multi-AZ on the RDS instance to allow failover during updates.

Answer

Update the CloudFormation stack directly without creating a new database.

Answer

Use a read replica to serve traffic during the update.

Question 2

A company runs a production application on EC2 instances behind an Application Load Balancer. After a recent deployment, users report intermittent 503 errors. The CloudWatch metrics show that the ALB's 'TargetResponseTime' is within normal range, but 'RequestCount' has increased by 50%. There are no changes to the security groups. What is the MOST likely cause of the 503 errors?

Accepted Answer

The deployment removed the health check path from the application.. If the deployment removed the health check path from the application, the health checks would fail for any instance that was updated. Since the application runs behind an ALB, the target group health check would mark those instances as unhealthy, causing intermittent 503 errors as traffic is routed only to remaining healthy instances. Even if not all instances are updated simultaneously, the gradual roll-out could lead to periods where all instances become unhealthy temporarily. Option A is incorrect because a low idle timeout would cause timeout errors, not 503s. Option B is incorrect because security groups were not changed. Option C is incorrect because misconfigured health check settings would cause consistent failures, not intermittent.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the ALB does not allow inbound traffic on the listener port.

Answer

The ALB's target group health check settings are misconfigured.

Question 3

A company uses AWS CodePipeline to deploy a microservices application to Amazon ECS Fargate. The pipeline includes stages for source, build, and deploy. The deploy stage uses an ECS service with a blue/green deployment configuration. After a recent update, the deployment fails with the error: 'The service cannot be deployed because the target group is not in a healthy state.' The target group health checks are configured with path '/health', interval 30 seconds, unhealthy threshold 2. The application health endpoint returns 200 OK. What should the company do to resolve this issue?

Accepted Answer

Modify the target group health check to use path '/' instead of '/health'.. The CodePipeline deploy action uses CodeDeploy for blue/green deployments. The error indicates that the original target group (blue) is not healthy, possibly because the health check path is not valid for the original application version. Adjusting the health check to a common path like '/' allows both versions to pass. Option A is incorrect because Fargate does not allow SSH. Option C is incorrect because redeploying the same version won't fix the underlying health check issue. Option D is incorrect because a new target group does not address the root cause.

Answer

Redeploy the previous version of the application that passed health checks.

Answer

Create a new target group with the correct health check path and update the ECS service.

Answer

SSH into the Fargate container and restart the application.

Question 4

A company is using Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest. Currently, the S3 bucket uses server-side encryption with S3 managed keys (SSE-S3). The company wants to use a key stored in AWS KMS for additional control. What is the simplest way to achieve this?

Accepted Answer

Change the bucket's default encryption configuration to SSE-KMS.. Changing the default encryption configuration to SSE-KMS automatically encrypts new objects with the specified KMS key without re-uploading existing objects. Option A is incorrect because a lifecycle policy does not change encryption. Option B is incorrect because bucket policies do not control encryption keys. Option D is incorrect because existing objects are not re-encrypted by default encryption changes.

Answer

Add a lifecycle policy to transition objects to SSE-KMS.

Answer

Use S3 Batch Operations to copy objects and re-encrypt with SSE-KMS.

Answer

Use a bucket policy to deny uploads without SSE-KMS.

Question 5

A company runs a web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application writes logs to local instance storage. The company wants to centralize log collection and ensure logs are retained even if instances are terminated. The current solution uses Amazon CloudWatch Logs agent, but log streams are frequently missing when instances are replaced. What should the company do to ensure complete log collection?

Accepted Answer

Configure the CloudWatch agent to use a persistent buffer on an EBS volume.. The CloudWatch agent can be configured with a persistent buffer on an EBS volume. This buffer stores log data temporarily until it is successfully sent to CloudWatch Logs. Even if an EC2 instance is terminated, the buffered logs on the EBS volume are retained and will be sent when the agent is configured to use that volume. This ensures no log data is lost during instance replacement. Option B is incorrect because S3 Lifecycle policies manage object transitions in Amazon S3, not CloudWatch logs. Option C is incorrect because the CloudWatch agent does not send logs directly to S3; it sends to CloudWatch Logs. Option D is incorrect because simply storing logs on an EBS volume without the agent's persistent buffer does not ensure automatic log collection and forwarding; the logs would only reside on the volume and not be centrally collected.

Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier.

Answer

Use the CloudWatch agent to send logs directly to Amazon S3.

Answer

Attach an EBS volume to each instance and store logs there.

Question 6

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

Accepted Answer

Use the strangler fig pattern: implement API Gateway to route traffic to new Lambda functions for specific endpoints while keeping the monolith for others.. The strangler fig pattern allows incremental migration by routing specific API requests to new Lambda functions via API Gateway while keeping the monolithic application for the rest. This approach avoids downtime. Option A is incorrect because deploying all microservices in a new VPC and cutting over DNS risks downtime and is not incremental. Option B is incorrect because creating a new version of the monolith that calls Lambda functions still leaves the monolith in place and does not fully utilize API Gateway for routing. Option C is incorrect because CodeDeploy blue/green deployment is for deploying to EC2 or Lambda, but it does not provide a pattern for incremental migration of a monolith to microservices; the strangler fig pattern is more appropriate.

Answer

Deploy all microservices in a new VPC and cut over DNS after testing.

Answer

Create a new version of the monolith that calls Lambda functions as backend.

Answer

Use AWS CodeDeploy to perform a blue/green deployment of the monolith to Lambda.

Question 7

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

Accepted Answer

A pending modification to the DB instance was applied during failover.. The most likely cause because during a failover, any pending modifications (e.g., scaling, instance type changes) that were scheduled are applied to the new primary, which can cause a brief performance impact. This is a known behavior in AWS RDS. Option A is incorrect because read replicas in a different region do not affect latency of the primary after failover; Multi-AZ does not use read replicas. Option B is incorrect because Multi-AZ configuration is not disabled during failover; it remains enabled. Option D is incorrect because DB parameter group changes require a manual reboot, not a failover event.

Answer

The read replica in a different region is now serving traffic.

Answer

The Multi-AZ configuration was disabled during the failover.

Answer

The DB parameter group was changed to a less efficient configuration.

Question 8

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

Accepted Answer

Update the Lambda function configuration to remove the VPC settings, then delete the subnet.. To delete a subnet that is in use by a Lambda function's ENI, you must first disassociate the ENI. This can be done by updating the Lambda function configuration to remove the VPC settings, which causes Lambda to delete the ENI. After the ENI is deleted, you can delete the subnet. Option B is incorrect because the DeletionPolicy attribute only handles deletion, not update failures, and the subnet is still in use. Option C is incorrect because there is no force delete option for subnets; dependencies must be resolved first. Option D is incorrect because ENIs managed by Lambda cannot be manually deleted; you must update or delete the Lambda function.

Answer

Modify the CloudFormation template to ignore the deletion failure using a DeletionPolicy attribute.

Answer

Use the AWS CLI to force delete the subnet.

Answer

Manually delete the Elastic Network Interface (ENI) from the AWS Management Console.

Question 9

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

Accepted Answer

Create an S3 Lifecycle rule that transitions objects with prefix 'backups/' to GLACIER after 30 days.. An S3 Lifecycle rule can be configured to transition objects with the prefix 'backups/' to the GLACIER storage class after 30 days. This is the most efficient and automated approach. Option A is incorrect because using AWS Lambda triggered by S3 events to change the storage class would be less efficient and more complex than a lifecycle rule. Option B is incorrect because S3 Batch Operations are designed for one-time bulk operations, not for ongoing, time-based transitions. Option D is incorrect because S3 Intelligent-Tiering automatically moves objects between access tiers based on changing access patterns, but it does not automatically move objects to GLACIER after a fixed period; lifecycle rules are more appropriate for this requirement.

Answer

Use an AWS Lambda function triggered by S3 events to change the storage class.

Answer

Use S3 Batch Operations to copy objects to a new bucket with GLACIER storage class.

Answer

Enable S3 Intelligent-Tiering on the bucket.

Question 10

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

Accepted Answer

Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.. Placing ECS tasks and RDS in the same VPC allows private communication via security groups. This ensures the database is not publicly accessible. Option A is incorrect because a NAT gateway is for outbound internet access, not for inbound traffic to RDS. Option B is incorrect because an internet gateway would expose the RDS instance to the internet. Option C is incorrect because enabling public accessibility would violate the security mandate even with IP restrictions.

Answer

Use a NAT gateway to route traffic from ECS tasks to RDS.

Answer

Attach an internet gateway to the VPC and route through it.

Answer

Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.

Question 11

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket.. S3 Object Lock prevents objects from being deleted or overwritten, ensuring tamper-proof logs. Option B is correct because CloudTrail log file validation creates digest files that allow integrity verification. Option C is incorrect because server-side encryption with KMS protects data at rest but does not prevent tampering or deletion. Option D is incorrect because S3 Transfer Acceleration speeds up uploads but does not provide security. Option E is incorrect because lifecycle policies transition objects to cheaper storage classes but do not prevent modification or deletion.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS).

Answer

Enable S3 Transfer Acceleration on the CloudTrail S3 bucket.

Answer

Set an S3 Lifecycle policy to transition logs to Amazon S3 Glacier.

Question 12

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

Accepted Answer

Configure cross-region replication for the RDS instance using a read replica.. To achieve RTO of 2 hours and RPO of 1 hour, the company should combine RDS cross-region read replicas (option A) for near-real-time replication, RDS automated backups (option D) for point-in-time recovery, and EBS snapshots every hour with cross-region replication (option E) for EC2 instances. Option A provides asynchronous replication to another region. Option D allows restoring to any point within the retention period. Option E ensures EBS volumes can be recovered in another region. Option B (AWS DMS) is typically used for database migrations, not as a primary DR replication method. Option C is incorrect because creating AMIs every hour is inefficient and does not provide the required RPO for data; EBS snapshots are more appropriate.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Answer

Create AMIs of the EC2 instances every hour.

Question 13

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which THREE actions can the company take?

Accepted Answer

Use CloudFront geo-restriction to allow or block countries.. CloudFront's built-in geo-restriction feature allows whitelisting or blacklisting countries. Option C is correct because AWS WAF geo match conditions can be used with a CloudFront distribution to block or allow requests based on country codes. Option D is correct because CloudFront geographic restriction is another name for the same feature as geo-restriction, and it is a valid action. Option A is incorrect because S3 bucket policies do not support geographic location conditions; they only support IP-based conditions. Option E is incorrect: although Lambda@Edge can be used to check the country and return a 403, it is not one of the simplest recommended actions; the question asks for actions the company can take, and geo-restriction and WAF are the primary methods.

Answer

Configure an S3 bucket policy to deny access from specific IP ranges.

Answer

Use Lambda@Edge to check the request's country and return a 403.

Question 14

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

Accepted Answer

The deny statement does not apply to the users attempting to access the bucket.. An explicit deny in a bucket policy overrides any allow, but only if the deny statement applies to the principal making the request. If the deny statement specifies a different principal (e.g., an AWS account or role not matching the users), or includes a condition that does not evaluate to true for these users, the deny does not take effect. Therefore, the allow statement granting access based on IP range would still apply, allowing users outside the range to access the bucket. Option A is incorrect because the condition key syntax is not the issue; the deny is not applying to the correct principals. Option C is incorrect because the question states an IAM policy is attached to an S3 bucket, which is possible (resource-based policy), and the condition key 'aws:SourceIp' is valid. Option D is incorrect because the policy is attached to the bucket, not to individual users.

Answer

The condition key 'aws:SourceIp' is misspelled.

Answer

The policy is an IAM policy, not a bucket policy, and the condition key is invalid.

Answer

The policy is attached to the IAM user instead of the bucket.

Question 15

A CloudFormation stack is created using the template above. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]'. Logs show: 'AMI 'ami-0abcdef1234567890' does not exist.' What is the most likely cause?

Accepted Answer

The AMI ID is not available in the region where the stack is being deployed.. The error 'AMI does not exist' indicates that the hardcoded AMI ID in the CloudFormation template is not available in the region where the stack is being deployed. AMI IDs are region-specific, so using a hardcoded ID from another region causes the failure. Option B is incorrect because the SQS queue name collision would result in a different error. Option C is incorrect because AMI IDs are alphanumeric by design. Option D is incorrect because the error specifically mentions the AMI, not the instance type.

Answer

The SQS queue name 'my-queue' is already in use.

Answer

The AMI ID is invalid because it contains letters.

Answer

The instance type t2.micro is not supported in the region.