SAP-C02 Continuous Improvement for Existing Solutions Practice Test 24 — 15 Questions

Question 1

A company runs a web application on Amazon EC2 instances in an Auto Scaling group across three Availability Zones. The application writes logs to local instance storage. The company wants to centralize log collection and ensure logs are retained even if instances are terminated. The current solution uses Amazon CloudWatch Logs agent, but log streams are frequently missing when instances are replaced. What should the company do to ensure complete log collection?

Accepted Answer

Configure the CloudWatch agent to use a persistent buffer on an EBS volume.. Option D is correct because the CloudWatch agent can be configured to buffer logs to disk, preventing data loss during instance termination. Option A is incorrect because EBS volumes do not persist when an instance is terminated unless termination protection is enabled, but logs are on instance store. Option B is incorrect because S3 Lifecycle does not affect CloudWatch log retention. Option C is incorrect because CloudWatch agent does not export to S3 directly without additional configuration.

Answer

Configure an S3 Lifecycle policy to transition logs to S3 Glacier.

Answer

Use the CloudWatch agent to send logs directly to Amazon S3.

Answer

Attach an EBS volume to each instance and store logs there.

Question 2

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

Accepted Answer

Use the strangler fig pattern: implement API Gateway to route traffic to new Lambda functions for specific endpoints while keeping the monolith for others.. Option B is correct because the strangler fig pattern allows incremental replacement of functionality by routing specific requests to new microservices via API Gateway while keeping the monolithic application for the rest. Option A is incorrect because full migration at once risks downtime. Option C is incorrect because pattern does not require database changes initially. Option D is incorrect because deployment pipeline is not a migration strategy.

Answer

Deploy all microservices in a new VPC and cut over DNS after testing.

Answer

Create a new version of the monolith that calls Lambda functions as backend.

Answer

Use AWS CodeDeploy to perform a blue/green deployment of the monolith to Lambda.

Question 3

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences a failover event. After the failover, the application team notices that the new primary DB instance has higher latency than expected. What is the most likely cause?

Accepted Answer

A pending modification to the DB instance was applied during failover.. Option A is correct because the new primary may have a pending modification (e.g., scaling) applied during failover, causing a brief performance impact. Option B is incorrect because failover is automatic. Option C is incorrect because parameter group changes require a reboot, not failover. Option D is incorrect because Multi-AZ does not provide read replicas.

Answer

The read replica in a different region is now serving traffic.

Answer

The Multi-AZ configuration was disabled during the failover.

Answer

The DB parameter group was changed to a less efficient configuration.

Question 4

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

Accepted Answer

Update the Lambda function configuration to remove the VPC settings, then delete the subnet.. Option C is correct because the Lambda function's ENI must be deleted first by deleting the Lambda function or updating its configuration to not use the subnet. Option A is incorrect because the ENI is managed by Lambda and cannot be manually deleted. Option B is incorrect because the subnet is in use, so the stack cannot continue. Option D is incorrect because force delete is not a valid operation for subnets.

Answer

Modify the CloudFormation template to ignore the deletion failure using a DeletionPolicy attribute.

Answer

Use the AWS CLI to force delete the subnet.

Answer

Manually delete the Elastic Network Interface (ENI) from the AWS Management Console.

Question 5

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

Accepted Answer

Create an S3 Lifecycle rule that transitions objects with prefix 'backups/' to GLACIER after 30 days.. Option D is correct because an S3 Lifecycle rule can be configured to transition objects with the specified prefix to GLACIER after 30 days. Option A is incorrect because S3 Batch Operations are for one-time bulk operations. Option B is incorrect because S3 Intelligent-Tiering may not move to GLACIER automatically. Option C is incorrect because Lambda would be less efficient.

Answer

Use an AWS Lambda function triggered by S3 events to change the storage class.

Answer

Use S3 Batch Operations to copy objects to a new bucket with GLACIER storage class.

Answer

Enable S3 Intelligent-Tiering on the bucket.

Question 6

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

Accepted Answer

Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.. Option A is correct because placing ECS tasks and RDS in the same VPC allows private communication via security groups. Option B is incorrect because NAT gateway is for outbound internet access. Option C is incorrect because a public endpoint would violate the security requirement. Option D is incorrect because an internet gateway is not needed for private communication.

Answer

Use a NAT gateway to route traffic from ECS tasks to RDS.

Answer

Attach an internet gateway to the VPC and route through it.

Answer

Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.

Question 7

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket.. Option A is correct because enabling log file validation creates a digest file that can be used to verify integrity. Option D is correct because S3 Object Lock prevents objects from being deleted or overwritten. Option B is incorrect because SSE-KMS does not prevent tampering. Option C is incorrect because S3 Lifecycle does not prevent deletion. Option E is incorrect because S3 Transfer Acceleration does not provide security.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS).

Answer

Enable S3 Transfer Acceleration on the CloudTrail S3 bucket.

Answer

Set an S3 Lifecycle policy to transition logs to Amazon S3 Glacier.

Question 8

A company is designing a disaster recovery strategy for a critical application that runs on Amazon EC2. The application data is stored on Amazon EBS volumes and Amazon RDS for MySQL. The recovery time objective (RTO) is 2 hours, and the recovery point objective (RPO) is 1 hour. Which THREE steps should the company take to meet these objectives?

Accepted Answer

Configure cross-region replication for the RDS instance using a read replica.. Option A is correct because automated backups of RDS allow point-in-time recovery with RPO of 5 minutes. Option C is correct because EBS snapshots can be created frequently and replicated. Option E is correct because cross-region replication provides a secondary site. Option B is incorrect because AMIs do not include data. Option D is incorrect because application-level replication is less reliable.

Answer

Use AWS Database Migration Service (DMS) for continuous replication.

Answer

Create AMIs of the EC2 instances every hour.

Question 9

A company uses Amazon CloudFront to distribute content globally. The company wants to restrict access to content based on geographic location. Which TWO actions can the company take?

Accepted Answer

Use CloudFront geo-restriction to allow or block countries.. Option A is correct because CloudFront geo-restriction allows whitelisting or blacklisting countries. Option D is correct because the geographic restriction feature is built-in. Option B is incorrect because S3 bucket policies do not support geographic restrictions. Option C is incorrect because Lambda@Edge can be used but is more complex. Option E is incorrect because WAF can block based on country using geo match conditions.

Answer

Configure an S3 bucket policy to deny access from specific IP ranges.

Answer

Use Lambda@Edge to check the request's country and return a 403.

Question 10

An IAM policy is attached to an S3 bucket to allow access only from a specific IP range. Users report that they can access the bucket from IP addresses outside the range. The bucket policy also includes another statement that denies access to all principals. What is the most likely reason users outside the IP range can still access the bucket?

Accepted Answer

The deny statement does not apply to the users attempting to access the bucket.. Option A is correct because an explicit deny in another statement would override the allow, but the question says users can access from outside the range, meaning the deny is not effective. The most likely reason is that the deny statement does not apply to the users (e.g., it applies to a different principal). Option B is incorrect because the policy is a bucket policy, not an IAM policy. Option C is incorrect because the condition is correct syntax. Option D is incorrect because the bucket policy is applied to the bucket, not IAM users.

Answer

The condition key 'aws:SourceIp' is misspelled.

Answer

The policy is an IAM policy, not a bucket policy, and the condition key is invalid.

Answer

The policy is attached to the IAM user instead of the bucket.

Question 11

A CloudFormation stack is created using the template above. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]'. Logs show: 'AMI 'ami-0abcdef1234567890' does not exist.' What is the most likely cause?

Accepted Answer

The AMI ID is not available in the region where the stack is being deployed.. Option B is correct because the AMI ID is region-specific. The template uses a hardcoded AMI ID that likely does not exist in the region where the stack is being created. Option A is incorrect because the AMI ID is syntactically correct. Option C is incorrect because the instance type is valid. Option D is incorrect because SQS queue creation succeeds.

Answer

The SQS queue name 'my-queue' is already in use.

Answer

The AMI ID is invalid because it contains letters.

Answer

The instance type t2.micro is not supported in the region.

Question 12

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

Accepted Answer

Restrict the security group source to the API Gateway's VPC endpoint or the ALB security group.. Option B is correct because the Lambda function should only be invoked via the API Gateway, not directly from the internet. The security group should restrict inbound traffic from the API Gateway's source, not from all IPs. Option A is incorrect because outbound traffic is needed for the function to send responses. Option C is incorrect because VPC attachment is necessary for accessing internal resources. Option D is incorrect because the Lambda function is already in a VPC.

Answer

Modify the Lambda function to not use a VPC.

Answer

Add a deny rule for inbound 0.0.0.0/0 and allow only from the Lambda function's own IP.

Answer

Remove the VPC attachment from the Lambda function and use a VPC endpoint.

Question 13

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

Accepted Answer

The health check path is misconfigured and returns HTTP 404.. The ALB sends requests to targets based on health checks. If the health check path returns a non-200 status, the target is marked unhealthy. A misconfigured health check path (e.g., pointing to a non-existent endpoint) can cause all instances to be marked unhealthy, leading to 503 errors. Option B is correct because it directly affects health check status. Options A, C, and D would not cause the healthy host count to drop to zero.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Answer

The EC2 instances are in an Auto Scaling group with insufficient capacity.

Question 14

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

Accepted Answer

The CloudFront behavior for older videos does not include the Lambda function association.. Lambda@Edge functions can be associated with CloudFront behaviors. If the function is only triggered for specific behaviors (e.g., only for certain file extensions or cache behaviors), older videos served under other behaviors may not get the headers. Option C is correct. Options A and B are less likely because the function is invoked on every request, and S3 permissions do not affect Lambda@Edge execution. Option D is incorrect because the issue is about missing headers, not caching of old content.

Answer

The Lambda@Edge function is not triggered for viewer request events.

Answer

The S3 bucket policy denies access to the Lambda function.

Answer

The videos are cached in CloudFront and the function runs only on cache misses.

Question 15

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

Accepted Answer

CodeDeploy automatic rollback configuration with CloudWatch alarm.. CodeDeploy can be configured to automatically roll back a deployment when a CloudWatch alarm is triggered. This is a native feature. Option B is correct. Options A, C, and D are not directly applicable: Lambda can be used but is not the primary feature; R53 health checks are not integrated with CodeDeploy; CodeBuild is for building, not deploying.

Answer

AWS Lambda function invoked by CloudWatch Events.

Answer

Amazon Route 53 health checks with failover routing.

Answer

AWS CodeBuild with post-build actions.