SAP-C02 Continuous Improvement for Existing Solutions Practice Test 25 — 15 Questions

Question 1

A company migrated a monolithic application to a microservices architecture on Amazon ECS. They notice that the CPU utilization of the cluster is high, but individual services are underutilized. What is the best optimization?

Accepted Answer

Right-size the task definitions by adjusting CPU and memory reservations.. Right-sizing the task definitions ensures each service gets the appropriate resources, reducing wasted capacity. Option C is correct. Option A (EC2 launch type) might not help with utilization. Option B increases capacity unnecessarily. Option D (Fargate) can help but is not specific to the utilization issue.

Answer

Increase the number of tasks for each service.

Answer

Use AWS Fargate Spot for interruptible workloads.

Answer

Switch from Fargate to EC2 launch type.

Question 2

A company uses AWS Lambda with a VPC configuration to access an RDS database. After a recent change, the Lambda function times out when connecting to the database. The security group and network ACLs appear correct. What should the company check first?

Accepted Answer

That the Lambda function has a route to the database via a NAT gateway or VPC endpoint.. When a Lambda function is VPC-enabled, it requires a VPC endpoint for services like S3, DynamoDB, or a NAT gateway for internet access. If the function needs to access the database via a public endpoint, a NAT gateway is needed. Option D is correct. Option A is about Lambda's environment variables. Option B is about database credentials. Option C is about Lambda's concurrency, not connectivity.

Answer

That the database password has not been rotated.

Answer

That the Lambda function's reserved concurrency is not set to zero.

Answer

That the Lambda function's environment variables are correctly set.

Question 3

A company uses AWS CloudFormation to manage infrastructure. They want to detect drift from the intended template configuration. Which service should they use?

Accepted Answer

CloudFormation Drift Detection. AWS CloudFormation Drift Detection is a native feature that compares the actual resource configuration with the template. Option A is correct. Options B, C, and D are other services but not specifically for CloudFormation drift detection.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 4

A company uses Amazon DynamoDB for a gaming application. During a new game launch, they experience higher than expected latency on write operations. The table has on-demand capacity. What is the best way to improve write performance?

Accepted Answer

Enable DynamoDB Accelerator (DAX) for caching.. For write-heavy workloads, using DynamoDB Accelerator (DAX) can reduce latency by caching writes. Option B is correct. Option A (increase WCU) is unnecessary with on-demand. Option C (GSI) adds overhead. Option D (Auto Scaling) is for provisioned capacity.

Answer

Use auto scaling with provisioned capacity.

Answer

Increase the write capacity units (WCU).

Answer

Add a global secondary index (GSI) to the table.

Question 5

A company has a multi-account strategy using AWS Organizations. They want to enforce that all newly created S3 buckets in any account have server-side encryption enabled. What is the most scalable solution?

Accepted Answer

Apply a service control policy (SCP) that denies PutBucketEncryption with no encryption.. Using an SCP in AWS Organizations to deny creation of buckets without encryption is the most scalable solution, as it applies to all accounts in the organization. Option B is correct. Option A is per-account. Option C is reactive. Option D is not scalable across accounts.

Answer

Configure AWS CloudFormation StackSets to deploy a bucket creation template with encryption.

Answer

Create an AWS Config rule in each account to remediate non-compliant buckets.

Answer

Use AWS CloudTrail to detect bucket creation and trigger a Lambda function to enable encryption.

Question 6

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to be notified immediately if any instance fails a status check. What is the simplest solution?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric with an SNS action.. CloudWatch alarms can monitor EC2 status check metrics and trigger an SNS notification. Option B is correct. Option A uses CloudTrail for API calls, not status checks. Option C is for load balancer target health. Option D uses SSM, which is not real-time for status checks.

Answer

Configure an ELB health check and monitor the unhealthy host count.

Answer

Use AWS Systems Manager Automation to check instance status periodically.

Answer

Enable AWS CloudTrail and create a metric filter for EC2 instance failures.

Question 7

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Right-size the cluster by analyzing resource utilization metrics.. Using Spot instances reduces cost significantly for fault-tolerant workloads. Right-sizing the cluster ensures efficient resource use. Option A is correct (Spot) and Option D is correct (right-sizing). Option B (On-Demand) increases cost. Option C (Reserved Instances) is for steady-state. Option E (dedicated) is more expensive.

Answer

Use On-Demand Instances for all nodes.

Answer

Purchase Reserved Instances for the cluster.

Answer

Use Dedicated Instances to improve performance.

Question 8

A company uses AWS CodePipeline to deploy a serverless application. They want to automatically test the deployment in a staging environment before promoting to production. Which THREE actions should they include in their pipeline? (Choose THREE.)

Accepted Answer

A build stage that packages the application using AWS CodeBuild.. A typical deployment pipeline includes: build the application, run automated tests in a staging environment, and then deploy to production after approval. Option A (build) is needed. Option C (test in staging) is needed. Option D (deploy to production after staging tests pass) is needed. Option B (manual approval to production) is common but not required for automated testing. Option E (deploy to staging) is redundant if already included in test stage.

Answer

A manual approval step before deploying to production.

Answer

A deploy stage that deploys to a canary environment.

Question 9

A company runs a web application on EC2 instances behind an ALB. They want to improve the security posture by implementing defense in depth. Which TWO measures should they implement? (Choose TWO.)

Accepted Answer

Configure security groups to restrict traffic to only necessary ports.. Defense in depth includes multiple layers. AWS WAF protects against web exploits. Security groups act as a virtual firewall. Option A (WAF) and Option D (security groups) are correct. Option B (public subnets) is less secure. Option C (direct internet access) bypasses security. Option E (public S3) is not relevant.

Answer

Store static assets in a public S3 bucket.

Answer

Place EC2 instances in public subnets for easier management.

Answer

Allow direct internet access to the EC2 instances.

Question 10

A CloudFormation stack deployment failed with the status ROLLBACK_COMPLETE. What is the most likely cause?

Accepted Answer

The IAM role used by CloudFormation does not have permission to create EC2 instances.. The StackStatusReason indicates resource creation failure (MyEC2Instance). This could be due to insufficient IAM permissions to create the EC2 instance. Option A is correct. Option B (template syntax) would cause a validation error before stack creation. Option C (out of quota) would also cause failure but is less specific. Option D (wrong region) would not cause a rollback after creation starts.

Answer

The stack was created in the wrong AWS region.

Answer

The EC2 instance type is not available in the region.

Answer

The CloudFormation template has a syntax error.

Question 11

An IAM policy attached to a user allows s3:GetObject and s3:PutObject on my-bucket, but denies all actions on the confidential/ prefix. The user reports that they can still upload objects to the confidential/ folder. Why?

Accepted Answer

The Deny statement is in a separate policy that is not attached to the user.. IAM policy evaluation logic: an explicit Deny overrides any Allow. However, the Deny statement uses a specific resource ARN for the confidential folder, but the Allow statement uses my-bucket/* which includes the confidential folder. Since the Deny is explicit, it should block. But the user can still upload, likely because the policy is not applied correctly or there is another policy allowing the action. Wait: Actually, an explicit Deny always overrides Allow. The most likely reason is that the user has another policy that allows s3:PutObject on the bucket, and the Deny is not effective because the resource pattern in the Deny might not match the specific object ARN? In IAM, resource ARNs must match. The Deny uses arn:aws:s3:::my-bucket/confidential/* which should match any object under that prefix. So the Deny should work. The correct answer is that the policy order is irrelevant, but perhaps the Deny is not being evaluated because of missing condition? Actually, the most common issue is that the user has a separate policy that explicitly allows the action, and the Deny is not applied? No, explicit Deny always wins. The issue could be that the policy is not attached to the user. Option D is correct: the Deny statement might be in a different policy that is not attached. Option A is incorrect because order does not matter. Option B is incorrect because explicit Deny overrides Allow. Option C is incorrect because the resource matches.

Answer

The Allow statement appears before the Deny statement in the policy.

Answer

The Deny statement is not explicit enough to override the Allow.

Answer

The Deny statement's resource ARN does not match the confidential folder objects.

Question 12

A Lambda function logs are being retained for 30 days. The company wants to reduce costs by deleting logs older than 7 days. What should they do?

Accepted Answer

Use the put-retention-policy command to set retentionInDays to 7.. The exhibit shows the log group has a retention policy of 30 days. To change it to 7 days, use the put-retention-policy CLI command. Option B is correct. Option A (CloudTrail) is for API logs. Option C (S3 lifecycle) is for objects, not CloudWatch Logs. Option D (export to S3) is for archival, not deletion.

Answer

Export the logs to S3 and delete the log group.

Answer

Configure an S3 Lifecycle policy on the log group's underlying storage.

Answer

Create a CloudTrail trail to capture log events and expire them after 7 days.

Question 13

A company is using AWS CodePipeline to automate deployments of a web application. The deployment to an Amazon ECS cluster often fails during the 'Deploy' stage due to insufficient capacity in the target group. The operations team wants to improve the pipeline to automatically handle such failures without manual intervention. Which solution is MOST operationally efficient?

Accepted Answer

Add a retry action in the CodePipeline stage for the ECS deployment.. Option C is correct because configuring CodePipeline with a manual approval action that retries on failure would require manual intervention, which is not operationally efficient. Option A is correct because adding a retry action in the pipeline stage automatically retries the deployment on failure. Option B is wrong because scaling down the ECS service would reduce capacity, making the problem worse. Option D is wrong because modifying the CodeBuild project to run smoke tests does not address capacity failures. Option E is wrong because using CloudWatch Alarms to trigger a Lambda function adds complexity and latency compared to a built-in retry mechanism.

Answer

Use Amazon CloudWatch Alarms to trigger an AWS Lambda function that restarts the pipeline.

Answer

Modify the CodeBuild project to run integration tests after deployment.

Answer

Add a manual approval step before the deploy stage to verify capacity.

Answer

Configure the ECS service to automatically scale down the desired count on deployment failure.

Question 14

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

Accepted Answer

Use AWS X-Ray to trace requests from the ALB to the application and downstream services.. Option B is correct because leveraging AWS X-Ray to trace requests end-to-end helps identify which component is causing latency. Option A is wrong because adding more EC2 instances may not address the root cause and could increase costs. Option C is wrong because switching to a Network Load Balancer (NLB) does not provide visibility into application-level latency. Option D is wrong because enabling detailed monitoring on the ALB only provides metrics, not traces. Option E is wrong because migrating to Lambda adds complexity and may not solve latency issues caused by other factors.

Answer

Enable detailed ALB metrics and create a CloudWatch dashboard.

Answer

Migrate the application to AWS Lambda to eliminate EC2 overhead.

Answer

Replace the ALB with a Network Load Balancer (NLB) for lower latency.

Answer

Add more EC2 instances behind the ALB to distribute the load.

Question 15

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

Accepted Answer

Replace the instance store volume with an Amazon EBS volume, create an AMI, and use Auto Scaling with an Application Load Balancer.. Option C is correct because using EBS snapshots provides backup and recovery for instance store data? Actually instance store is ephemeral; EBS snapshots cannot back up instance store. So Option A is correct: Create an AMI from the instance and use Auto Scaling with an Application Load Balancer. This provides high availability without changing the storage to EBS? Wait, instance store data is lost on stop/terminate. So the best solution is to migrate data to EBS and then use AMI/Auto Scaling. But the question says minimal architectural changes. Option D is correct: Replace instance store with EBS and use AMI/Auto Scaling. Option A uses instance store which is not persistent. Option B adds cost without solving availability. Option C is wrong because EBS snapshots cannot back up instance store. So the correct answer is D.

Answer

Attach an Amazon EBS volume and configure the application to write to it, then take periodic EBS snapshots.

Answer

Use AWS Backup to schedule backups of the instance and restore to a new instance if needed.

Answer

Create an AMI from the instance and launch a second instance in a different Availability Zone behind an Application Load Balancer.