SAP-C02 Continuous Improvement for Existing Solutions Practice Test 25 — 15 Questions

Question 1

A security engineer runs the command above and finds an ENI attached to a Lambda function. The security group sg-12345678 allows inbound traffic on port 443 from 0.0.0.0/0. The Lambda function is used to process API requests. The engineer is concerned about security. What should the engineer do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Restrict the security group source to the API Gateway's VPC endpoint or the ALB security group.. The Lambda function should not be directly accessible from the internet. The security group sg-12345678 currently allows inbound traffic on port 443 from 0.0.0.0/0, which exposes the function to unnecessary risk. The function is intended to process API requests, typically invoked via API Gateway or an ALB. Therefore, the security group should restrict inbound traffic to only the source from the API Gateway's VPC endpoint or the ALB's security group. Option A is incorrect because the Lambda function might need to be in a VPC to access internal resources, and removing VPC attachment is not the best security measure. Option B is incorrect because Lambda functions do not have their own static IP; the ENI's IP is dynamic and cannot be used as a source restriction. More importantly, the source should be the API Gateway, not the Lambda function itself. Option C is incorrect because while using a VPC endpoint is beneficial, simply removing the VPC attachment does not solve the security group issue; the function may still need VPC access. The most direct fix is to modify the security group rule.

Answer

Modify the Lambda function to not use a VPC.

Answer

Add a deny rule for inbound 0.0.0.0/0 and allow only from the Lambda function's own IP.

Answer

Remove the VPC attachment from the Lambda function and use a VPC endpoint.

Question 2

A company runs a web application on EC2 instances behind an ALB. Users report intermittent 503 errors during peak hours. The metrics show the target group's healthy host count drops to zero periodically. What is the most likely cause?

Accepted Answer

The health check path is misconfigured and returns HTTP 404.. The ALB performs health checks on targets by sending requests to the configured health check path. If the health check path returns an HTTP 404 (or any non-200 status), the ALB marks the target as unhealthy. When all instances have a misconfigured health check path that returns 404, the healthy host count drops to zero, resulting in 503 errors. Option D is correct because a misconfigured health check path directly causes all instances to be marked unhealthy. Option A (idle timeout) would cause connection timeouts but not affect healthy host count. Option B (security group) would prevent traffic from ALB, but the health check would still succeed if the security group allows ALB traffic, and it would not cause healthy host count to drop to zero periodically if misconfigured. Option C (insufficient capacity) would cause scaling issues but not zero healthy hosts if the health check is correct. Therefore, D is the most likely cause.

Answer

The ALB's idle timeout is set too low.

Answer

The security group for the EC2 instances does not allow inbound traffic from the ALB.

Answer

The EC2 instances are in an Auto Scaling group with insufficient capacity.

Question 3

A media company uses S3 for storing video files and CloudFront for distribution. They implemented a Lambda@Edge function to add copyright headers. After deployment, some users report that older videos still lack the headers. What is the most likely reason?

Accepted Answer

The CloudFront behavior for older videos does not include the Lambda function association.. Lambda@Edge functions are associated with specific CloudFront behaviors. If the function is only associated with certain behaviors (e.g., based on path pattern or cache behavior), older videos served under a different behavior that does not include the Lambda function association will not have the copyright headers added. Option B correctly identifies this as the most likely reason. Option A is incorrect because the function could be triggered for viewer request events but still not apply to all videos if not associated with all behaviors. Option C is irrelevant because S3 bucket policies do not affect Lambda@Edge execution. Option D is incorrect because the function runs on every request regardless of cache hit/miss; caching does not prevent the function from executing.

Answer

The Lambda@Edge function is not triggered for viewer request events.

Answer

The S3 bucket policy denies access to the Lambda function.

Answer

The videos are cached in CloudFront and the function runs only on cache misses.

Question 4

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

Accepted Answer

CodeDeploy automatic rollback configuration with CloudWatch alarm.. AWS CodeDeploy natively supports automatic rollback triggered by CloudWatch alarms. When a deployment causes a CloudWatch alarm to enter an ALARM state, CodeDeploy can automatically revert to the previous working version. This is the most straightforward and integrated solution for the requirement. Option A (Lambda + CloudWatch Events) is possible but not the primary recommended feature. Option B (Route 53 health checks) is for DNS-level failover, not deployment rollback. Option C (CodeBuild post-build actions) is for build phase, not post-deployment monitoring.

Answer

AWS Lambda function invoked by CloudWatch Events.

Answer

Amazon Route 53 health checks with failover routing.

Answer

AWS CodeBuild with post-build actions.

Question 5

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

Accepted Answer

Right-size the task definitions by adjusting CPU and memory reservations.. Right-sizing the task definitions by adjusting CPU and memory reservations ensures each service receives the appropriate resources, reducing wasted capacity and optimizing cluster utilization. This directly addresses the high cluster CPU utilization while individual services are underutilized. Option A (increasing tasks) would exacerbate the issue. Option B (Fargate Spot) does not solve the resource allocation problem. Option C (EC2 launch type) is not relevant to the utilization pattern described.

Answer

Increase the number of tasks for each service.

Answer

Use AWS Fargate Spot for interruptible workloads.

Answer

Switch from Fargate to EC2 launch type.

Question 6

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Accepted Answer

That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.. When a Lambda function is configured with VPC access, it can communicate with RDS instances within the same VPC (or peered VPCs) using private IP addresses, assuming proper security group and network ACL rules. The most likely cause of a timeout after a change is a missing route in the Lambda function's subnet's route table to the RDS subnet. NAT gateways are only required for internet access, and VPC endpoints are for AWS services (not RDS). Therefore, the administrator should first verify that the Lambda function's subnet has a route to the database's subnet. No password rotation, concurrency, or environment variable issue would cause a network timeout.

Answer

That the database password has not been rotated.

Answer

That the Lambda function's reserved concurrency is not set to zero.

Answer

That the Lambda function's environment variables are correctly set.

Question 7

A company uses AWS CloudFormation to manage infrastructure. They want to detect drift from the intended template configuration. Which service should they use?

Accepted Answer

CloudFormation Drift Detection. AWS CloudFormation Drift Detection is a native feature that compares the actual resource configuration with the template, identifying any drift. This is the correct service for the stated requirement. AWS Config is used for compliance and resource inventory, not specifically for CloudFormation drift detection. AWS Service Catalog helps manage approved IT services, and AWS CloudTrail logs API calls for auditing. Therefore, Option D is correct.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 8

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

Accepted Answer

Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.. Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.

Answer

Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.

Answer

Create an AWS Config rule in each account to remediate non-compliant buckets.

Answer

Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Question 9

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to be notified immediately if any instance fails a status check. What is the simplest solution?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric with an SNS action.. CloudWatch can monitor the EC2 StatusCheckFailed metric and trigger an SNS notification when an instance fails a status check. This is the simplest solution because it uses built-in metrics and requires no custom scripting. Option A uses ELB health checks which monitor load balancer target health, not instance status checks. Option B uses Systems Manager Automation which is not real-time. Option D uses CloudTrail which logs API calls, not status checks.

Answer

Configure an ELB health check and monitor the unhealthy host count.

Answer

Use AWS Systems Manager Automation to check instance status periodically.

Answer

Enable AWS CloudTrail and create a metric filter for EC2 instance failures.

Question 10

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Right-size the cluster by analyzing resource utilization metrics.. Spot Instances are ideal for fault-tolerant, interruptible workloads like batch processing, significantly reducing costs (Option E). Right-sizing the cluster by analyzing resource utilization ensures that you are not over-provisioning, which directly lowers costs (Option B). On-Demand Instances (A) are more expensive and unnecessary given fault tolerance. Reserved Instances (C) are for steady-state workloads, not nightly batch jobs. Dedicated Instances (D) add cost and do not improve performance for this use case.

Answer

Use On-Demand Instances for all nodes.

Answer

Purchase Reserved Instances for the cluster.

Answer

Use Dedicated Instances to improve performance.

Question 11

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

Accepted Answer

A build stage that packages the application using AWS CodeBuild.. The correct actions are: a build stage (Option A) to package the application using AWS CodeBuild, a test stage (Option D) that deploys to a staging environment and runs integration tests, and a deploy stage (Option C) that deploys to production after staging tests pass. Option B (manual approval) is not required because the goal is automatic testing before promotion, and Option E (canary deploy) is not specified as part of the requirement.

Answer

A manual approval step before deploying to production.

Answer

A deploy stage that deploys to a canary environment.

Question 12

A company runs a web application on EC2 instances behind an ALB. They want to improve the security posture by implementing defense in depth. Which TWO measures should they implement? (Choose TWO.)

Accepted Answer

Configure security groups to restrict traffic to only necessary ports.. Defense in depth involves multiple layers of security. Option D (security groups) acts as a virtual firewall at the instance level, restricting traffic to only necessary ports. Option E (AWS WAF) helps filter common web exploits at the application layer. Option A (public S3) does not improve security. Option B (public subnets) increases exposure. Option C (direct internet access) bypasses the ALB and security layers.

Answer

Store static assets in a public S3 bucket.

Answer

Place EC2 instances in public subnets for easier management.

Answer

Allow direct internet access to the EC2 instances.

Question 13

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have permission to create EC2 instances.. A stack status of ROLLBACK_COMPLETE indicates that CloudFormation successfully initiated resource creation but one or more resources failed, triggering a rollback. The most common cause is that the IAM role associated with the stack lacks permissions to create the required resources (e.g., EC2 instances). A template syntax error would cause a validation error before any resource creation begins, resulting in a status like CREATE_FAILED without a rollback. Wrong region selection would not cause a rollback after resources start being created; the stack would either succeed or fail due to availability issues. Option C is correct because insufficient IAM permissions are a frequent cause of resource creation failures leading to rollback.

Answer

The stack was created in the wrong AWS region.

Answer

The EC2 instance type is not available in the region.

Answer

The CloudFormation template has a syntax error.

Question 14

An IAM policy attached to a user allows s3:GetObject and s3:PutObject on my-bucket, but denies all actions on the confidential/ prefix. The user reports that they can still upload objects to the confidential/ folder. Why?

Accepted Answer

The Deny statement is in a separate policy that is not attached to the user.. IAM policy evaluation follows the rule that an explicit Deny always overrides any Allow. If both the Allow and Deny statements were in an attached policy, the Deny would block uploads to the confidential/ prefix. Therefore, the fact that the user can still upload indicates that the Deny statement is in a policy that is not attached to the user (or not effective). Option C correctly identifies this: the Deny statement is in a separate policy that is not attached to the user.

Answer

The Allow statement appears before the Deny statement in the policy.

Answer

The Deny statement is not explicit enough to override the Allow.

Answer

The Deny statement's resource ARN does not match the confidential folder objects.

Question 15

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

Accepted Answer

Use the put-retention-policy command to set retentionInDays to 7.. The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct. Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Answer

Export the logs to S3 and delete the log group.

Answer

Configure an S3 Lifecycle policy on the log group's underlying storage.

Answer

Create a CloudTrail trail to capture log events and expire them after 7 days.