SAP-C02 Continuous Improvement for Existing Solutions Practice Test 26 — 15 Questions

Question 1

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Config conformance packs deployed via AWS Organizations with automatic remediation using Systems Manager Automation.. AWS Config conformance packs can be deployed at the organization level using AWS Organizations, enabling centralized management of rules across hundreds of accounts. Automatic remediation is achieved by associating Systems Manager Automation documents with non-compliant resources. Option A is incorrect because CloudFormation StackSets require per-account deployment and management, which does not scale as efficiently as conformance packs. Option B is incorrect because Config rules in each account with Lambda functions lack centralized deployment and management. Option D is incorrect because an AWS Config aggregator only provides a cross-account compliance view, not enforcement or remediation.

Answer

Use AWS CloudFormation StackSets to deploy Config rules to all accounts.

Answer

Use AWS Config rules in each account with AWS Lambda functions for remediation.

Answer

Use an AWS Config aggregator in the management account to view compliance across accounts.

Question 2

A company is using Amazon ECS with Fargate launch type for a microservices application. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization but no obvious pattern. What should the company do to identify the cause?

Accepted Answer

Enable AWS X-Ray tracing on the ECS tasks to trace requests across microservices.. AWS X-Ray provides distributed tracing to pinpoint performance bottlenecks. Option A is wrong because increasing task size is a reactive fix that does not identify the cause. Option C is wrong because CloudWatch Synthetics monitors endpoint availability, not internal trace data. Option D is wrong because CloudWatch Logs Insights is for querying logs, not for tracing requests across microservices.

Answer

Increase the CPU and memory for all ECS tasks.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints.

Answer

Use CloudWatch Logs Insights to analyze application logs for errors.

Question 3

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

Accepted Answer

Create one or more RDS read replicas and direct read queries to the replica endpoint.. RDS read replicas offload read traffic from the primary instance by asynchronously replicating data, and the application only needs to change its read connection string to point at the replica endpoint — a minimal-change solution. This directly addresses read-heavy workloads with complex joins because the replica runs the same MySQL engine and can execute the same queries. It also preserves the existing Multi-AZ failover posture for the primary.

Answer

Migrate the database to Amazon DynamoDB Global Tables.

Answer

Implement Amazon ElastiCache in front of the database to cache query results.

Answer

Increase the DB instance class to a larger size with more vCPUs.

Question 4

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.. CloudFront Origin Access Control (OAC) is the current AWS-recommended mechanism to restrict S3 bucket access to a specific CloudFront distribution. By creating an OAC, associating it with the distribution's origin, and updating the S3 bucket policy to allow only that OAC's service principal, direct access to the S3 bucket is blocked while CloudFront can still fetch objects.

Answer

Set S3 Object Ownership to BucketOwnerPreferred.

Answer

Configure the S3 bucket policy to allow public read access.

Answer

Generate CloudFront key pairs and require signed URLs for all content.

Question 5

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

Accepted Answer

Create a dynamic scaling policy based on the average CPU utilization metric.. Option C is correct because target tracking or step scaling dynamic policies use the CloudWatch Average CPUUtilization metric of the Auto Scaling group to automatically add or remove instances as load changes, which is exactly the CPU-based automatic scaling the company requires. Option D is correct because an Auto Scaling group is the foundational resource that manages the EC2 fleet's desired/min/max capacity and health checks, and associating it with the ALB target group lets the load balancer register and route traffic to the instances it launches. Option A is not required because scheduled scaling is time-based rather than CPU-utilization-based, so it does not satisfy the stated requirement. Option B is wrong because an NLB operates at Layer 4 and is not needed here; the ALB already handles HTTP/HTTPS traffic appropriately. Option E is wrong because a CloudWatch alarm that only sends an email notification does not perform any scaling action.

Answer

Configure a scheduled scaling policy to add instances during business hours.

Answer

Replace the ALB with a Network Load Balancer for better performance.

Answer

Create a CloudWatch alarm that sends an email when CPU exceeds 80%.

Question 6

A company uses AWS Lambda functions to process events from Amazon S3. They notice that some Lambda invocations are failing with 'ResourceNotFoundException' errors when trying to write to an Amazon DynamoDB table. The Lambda execution role has a policy that grants dynamodb:PutItem on the table. What is the most likely cause of these errors?

Accepted Answer

The DynamoDB table name is misspelled in the Lambda code.. A 'ResourceNotFoundException' from DynamoDB means the API call reached DynamoDB successfully but the table name in the request did not resolve to an existing table in the caller's account/region. Because the execution role already grants dynamodb:PutItem, the failure is not authorization-related — it is a resource-resolution problem, and a misspelled table name in the Lambda code is the classic cause. The error is returned by the DynamoDB service itself, which confirms the request was authenticated and authorized.

Answer

The Lambda function is using the wrong AWS credentials.

Answer

The Lambda function is in a VPC without a DynamoDB VPC endpoint.

Answer

The DynamoDB table is in a different AWS account and the Lambda role does not have cross-account access.

Question 7

A company is using AWS CloudFormation to deploy infrastructure. They want to ensure that updates to a stack do not cause downtime for a critical web application. Which THREE strategies should they consider? (Choose THREE.)

Accepted Answer

Apply a stack policy to protect critical resources.. Option B is correct because a CloudFormation stack policy lets you explicitly deny Update:Replace or Update:Delete actions on critical resources (for example, the production load balancer or database), preventing an update from accidentally replacing or removing them and thereby avoiding downtime. Option C is correct because rolling updates with an appropriate batch size (such as MaxBatchSize/MinInstancesInService settings in an UpdatePolicy for Auto Scaling groups or ECS services) replace instances or tasks incrementally while keeping a minimum number in service, so the web application stays available throughout the deployment. Option D is correct because Change Sets let you preview exactly which resources will be added, modified, or replaced before executing the update, allowing you to detect disruptive replacements (for example, a resource that would be recreated) and adjust the template before any downtime-causing change is applied. Option A is not appropriate here because DeletionPolicy only controls what happens to a resource when it is removed from the stack or the stack is deleted; it does not prevent or mitigate downtime during an update. Option E is not appropriate because nested stacks are a code-organization and reuse mechanism, not a strategy that by itself prevents update-related downtime.

Answer

Use the DeletionPolicy attribute to retain resources.

Answer

Use nested stacks to isolate components.

Question 8

A developer notices that CloudWatch Logs for a Lambda function show no logs after a recent deployment. The function is invoked successfully. What is the most likely cause?

Accepted Answer

The Lambda execution role does not have permissions to write to CloudWatch Logs.. Lambda writes logs to CloudWatch Logs using the function's execution role. If that role lacks logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions, invocations succeed but no log events appear. This is the most common cause of silent logging after a deployment that changed IAM roles.

Answer

The Lambda function is exceeding the CloudWatch Logs API rate limits.

Answer

The log group retention policy is set to 7 days, which expired old logs.

Answer

The log group was deleted and not recreated.

Question 9

A company uses Amazon CloudFront to deliver static content from an S3 bucket. They want to restrict access so that only CloudFront can access the S3 bucket. What configuration should they use?

Accepted Answer

Create an origin access identity (OAI) and grant it read access to the S3 bucket.. Create an origin access identity (OAI) and grant it read access to the S3 bucket. An OAI is a special CloudFront user that allows CloudFront to access private S3 bucket content securely. Option A is incorrect because CloudFront does not have static public IP ranges; it uses a large dynamic range. Option C is incorrect because IAM roles are not used directly for CloudFront to S3 access; OAI is the standard method. Option D is incorrect because signed URLs control end-user access, not origin access.

Answer

Set the S3 bucket policy to allow access only from CloudFront's public IP ranges.

Answer

Attach an IAM role to CloudFront distribution.

Answer

Configure CloudFront signed URLs.

Question 10

A company is using t3.large instances in an Auto Scaling group. They want to launch instances that support both x86_64 and arm64 architectures. Based on the exhibit, can they meet this requirement with t3.large?

Accepted Answer

No, because t3.large instances only support x86_64 architecture.. T3.large instances only support the x86_64 architecture. They do not support arm64. Therefore, the company cannot meet the requirement of supporting both x86_64 and arm64 architectures with t3.large instances. Options B and D are incorrect because t3.large does not support arm64, and a custom AMI cannot add architecture support beyond what the instance type offers. Option C is incorrect because t3.large is a current generation instance type, but that is not relevant to the architecture support limitation.

Answer

Yes, because t3.large supports both architectures.

Answer

No, because t3.large is not a current generation instance type.

Answer

Yes, but only if they use a custom AMI that supports both architectures.

Question 11

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. How should they configure this?

Accepted Answer

Add a manual approval action in the pipeline stage with an SNS topic for notification.. AWS CodePipeline provides a built-in manual approval action that can be added to a pipeline stage, which sends an SNS notification to approvers. Option B is incorrect because CloudWatch Events is used for event-driven automation, not for manual approvals. Option C is incorrect because AWS CodeDeploy is a deployment service, not for approval steps. Option D is incorrect because while a Lambda function could be used, CodePipeline has a native approval action that is simpler and more appropriate.

Answer

Use Amazon CloudWatch Events to trigger an SNS topic for approval.

Answer

Create a custom action using AWS CodeDeploy.

Answer

Add a Lambda function that sends an email and pauses the pipeline until a token is provided.

Question 12

A company runs a production AWS Lambda function that processes orders. Recently, the function has been timing out occasionally. The function uses a VPC with a single private subnet and has a timeout of 30 seconds. What is the MOST likely cause of the timeout?

Accepted Answer

The function does not have a NAT gateway or VPC endpoints to access external resources.. A Lambda function attached to a VPC with only a private subnet has no route to the internet unless a NAT gateway (for outbound internet) or VPC endpoints (for AWS services) are configured. If the function calls external resources or AWS APIs without these, the calls hang until the 30-second timeout. This is the most likely cause of intermittent timeouts in this scenario.

Answer

The function is experiencing cold starts due to high concurrency.

Answer

The function is hitting the maximum concurrent execution limit.

Answer

The function needs to be attached to a public subnet.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. A stack update fails with a resource update failure. The team wants to investigate the specific error without rolling back the stack. What is the BEST approach?

Accepted Answer

Rerun the stack update with the --disable-rollback flag and then describe the stack events.. Using the --disable-rollback flag on the update-stack command prevents CloudFormation from rolling back when a resource update fails, leaving the stack in UPDATE_FAILED state so you can inspect the exact error via describe-stack-events. This is the standard way to debug a failed update without losing the partially applied changes.

Answer

Delete the stack and review the CloudFormation logs.

Answer

Create a change set to preview the updates.

Answer

Use the AWS CLI describe-stack-resources command to see the status of each resource.

Question 14

Refer to the exhibit. An AWS Lambda function logs the error above. The function uses the AWS SDK to call an Amazon DynamoDB table. What is the MOST likely cause?

Accepted Answer

The DynamoDB table specified in the function does not exist.. The error shown in the exhibit is a ResourceNotFoundException from DynamoDB, which indicates that the table specified in the function's request does not exist. This is the most likely cause when the SDK call fails with that specific exception, as opposed to permission or throttling errors.

Answer

The Lambda function timed out while waiting for a response.

Answer

The Lambda function does not have permission to access DynamoDB.

Answer

The DynamoDB table is throttling requests.

Question 15

A company runs a critical application on EC2 instances behind an Application Load Balancer. The security team requires that all traffic to the application be encrypted in transit and that the load balancer use a certificate from AWS Certificate Manager (ACM). The application currently uses HTTP. What should the company do to meet the security requirement?

Accepted Answer

Add an HTTPS listener to the ALB using an ACM certificate, and configure the HTTP listener to redirect to HTTPS.. Adding an HTTPS listener to the ALB with an ACM certificate and configuring the HTTP listener to redirect to HTTPS ensures all traffic is encrypted in transit. This meets the security requirement directly without additional components. Option A is incorrect because Network Load Balancers do not support ACM certificates for TLS termination; they require TLS termination on the backend instances. Option B is incorrect because TCP listeners cannot terminate TLS, and self-signed certificates on EC2 instances would not provide trusted encryption for clients. Option C is incorrect because while CloudFront can provide HTTPS, it adds unnecessary complexity and cost; the requirement can be met natively with the ALB.

Answer

Replace the ALB with a Network Load Balancer and associate an ACM certificate with it.

Answer

Change the ALB listener to TCP and use a self-signed certificate on the EC2 instances.

Answer

Place a CloudFront distribution in front of the ALB and configure HTTPS between viewers and CloudFront.