SAP-C02 Continuous Improvement for Existing Solutions Practice Test 26 — 15 Questions

Question 1

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to implement a change management process where all stack updates must be reviewed and approved before execution. The team currently uses AWS CodePipeline for CI/CD. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a CodePipeline pipeline with an approval stage before the CloudFormation deployment action.. Option B is correct because using CloudFormation StackSets with approval gates in CodePipeline allows centralized management and approval workflow. Option A is wrong because Change Sets require manual review and execution, increasing operational overhead. Option C is wrong because direct CLI updates bypass approval. Option D is wrong because Service Catalog is for end-user provisioning, not for change management of existing stacks. Option E is wrong because it adds an extra service (Lambda) without need.

Answer

Use CloudFormation Change Sets and require a senior engineer to execute them.

Answer

Write an AWS Lambda function that triggers on stack update events and requires approval via Amazon SNS.

Answer

Use AWS Service Catalog to govern CloudFormation templates and require approval for provisioning.

Answer

Store CloudFormation templates in AWS CodeCommit and use AWS CLI to execute updates after peer review.

Question 2

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

Accepted Answer

Enable job bookmarking and configure incremental processing to reduce data volume per run.. Option B is correct because using Glue job bookmarking with incremental processing reduces the data processed per run, avoiding memory issues. Option A is wrong because increasing DPUs increases cost linearly. Option C is wrong because using a larger instance type for Redshift does not affect Glue memory. Option D is wrong because switching to EMR adds complexity and may not be more cost-effective. Option E is wrong because partitioning data in Amazon S3 with more files does not directly solve memory issues.

Answer

Use a larger node type for the Amazon Redshift cluster to offload processing.

Answer

Replace AWS Glue with Amazon EMR and use spot instances for cost savings.

Answer

Partition the input data in Amazon S3 into more files with smaller sizes.

Answer

Increase the number of DPUs (Data Processing Units) for the Glue job.

Question 3

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

Accepted Answer

Increase the memory (and CPU) allocation for the Lambda function.. Option C is correct because increasing the Lambda function's memory also increases CPU allocation, which can speed up processing. Option A is wrong because concurrency limit reduces parallelism, making timeouts worse. Option B is wrong because increasing the batch size may cause the function to process more messages per invocation, increasing the chance of timeout. Option D is wrong because reserving concurrency does not affect per-invocation performance. Option E is wrong because using a larger instance type is not applicable to Lambda.

Answer

Increase the reserved concurrency of the Lambda function.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Use a Lambda function URL instead of SQS invocation.

Answer

Migrate the Lambda function to run on Amazon ECS with Fargate using a larger task size.

Question 4

A company uses Amazon DynamoDB as its primary database. The operations team is seeing increased read latency during peak hours. The table has a provisioned read capacity of 1000 RCU, but CloudWatch metrics show that consumed read capacity frequently reaches 1000 RCU. The application uses eventually consistent reads. What is the MOST cost-effective way to reduce read latency?

Accepted Answer

Enable DynamoDB Accelerator (DAX) to cache frequently read items.. Option C is correct because enabling DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency without increasing provisioned RCU. Option A is wrong because increasing RCU increases cost. Option B is wrong because switching to strongly consistent reads would double RCU consumption. Option D is wrong because adding a global secondary index does not reduce read latency for the base table. Option E is wrong because using ElastiCache adds complexity and cost.

Answer

Switch to strongly consistent reads to improve consistency.

Answer

Create a global secondary index (GSI) on the table to offload reads.

Answer

Increase the provisioned read capacity to 2000 RCU.

Answer

Use Amazon ElastiCache for Memcached as a read cache.

Question 5

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instance and configure it to tail the log file.. Option D is correct because the CloudWatch agent can be installed on EC2 to send logs to CloudWatch Logs without code changes. Option A is wrong because copying logs to S3 requires custom scripting. Option B is wrong because Amazon Kinesis Agent is more complex and not necessary. Option C is wrong because it would require modification to the application. Option E is wrong because CloudTrail is for API activity, not application logs.

Answer

Use Amazon Kinesis Agent to stream the log file to Amazon Kinesis Data Firehose.

Answer

Modify the application to use the AWS SDK for logging to Amazon CloudWatch Logs.

Answer

Turn on AWS CloudTrail for the EC2 instance to capture logs.

Answer

Configure the application to write logs to Amazon S3 using the AWS SDK.

Question 6

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. The company currently uses server-side encryption with S3 managed keys (SSE-S3). The team wants to enforce encryption using a customer-managed key (CMK) from AWS KMS. Which TWO actions should the team take?

Accepted Answer

Configure a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. Option A and Option C are correct. Option A (S3 Bucket Policy denying PutObject without the correct encryption header) enforces encryption at upload time. Option C (Default encryption with SSE-KMS) ensures that objects uploaded without encryption headers are encrypted with KMS. Option B (Bucket policy allowing any encryption) does not enforce KMS. Option D (Disable SSE-S3) is not possible; you cannot disable SSE-S3, you can only set default encryption. Option E (CloudTrail logging) does not enforce encryption.

Answer

Enable AWS CloudTrail to audit all PutObject requests.

Answer

Configure a bucket policy that allows PutObject only if the object is encrypted.

Answer

Disable SSE-S3 on the bucket so that only SSE-KMS can be used.

Question 7

A company is running a critical microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the team noticed that the ALB's 5xx error rate has increased. The error is HTTP 503. The team suspects the target group is unhealthy. Which THREE steps should the team take to diagnose and resolve the issue?

Accepted Answer

Verify the ECS service's desired count and compare with the number of healthy tasks in the target group.. Option A, Option C, and Option E are correct. Option A checks health check settings and logs. Option C checks if the service is running and tasks are healthy. Option E checks if the service's desired count matches running tasks. Option B (Check target group stickiness) is not directly related to 503 errors. Option D (Switch to Network Load Balancer) is a major change and not diagnostic.

Answer

Replace the ALB with a Network Load Balancer (NLB) to bypass health checks.

Answer

Verify that sticky sessions (session affinity) are enabled on the target group.

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

Accepted Answer

Create a conformance pack in the management account and deploy it to the organization.. Option A and Option D are correct. Option A (Enable AWS Config in all accounts) is necessary for rules to work. Option D (Use a conformance pack deployed to the organization) automatically applies rules to all accounts. Option B (Service Control Policy) can deny non-encrypted buckets but does not enable the Config rule. Option C (AWS CloudFormation StackSets) can deploy Config rules but requires manual setup per account. Option E (Organization Config rule) is not a feature; Config rules are per account.

Answer

Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.

Answer

Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.

Answer

Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.

Question 9

A company is running a production web application on AWS Auto Scaling EC2 instances behind an Application Load Balancer. Recent deployments have caused intermittent errors. The team wants to implement a deployment strategy that minimizes downtime and allows for quick rollback. Which strategy should they use?

Accepted Answer

Use blue/green deployment with a second Auto Scaling group and switch the ALB target group.. Option B is correct because blue/green deployment with a second Auto Scaling group and ALB switch allows instant rollback by switching back to the original environment. Option A is wrong because rolling updates with a single ASG can still cause partial downtime and slower rollback. Option C is wrong because it does not minimize downtime and requires manual intervention. Option D is wrong because immutable deployments replace instances, but rollback requires redeployment.

Answer

Deploy a new version to a single instance, test, then scale out.

Answer

Perform rolling updates with a single Auto Scaling group, updating a few instances at a time.

Answer

Use an immutable deployment by launching a new Auto Scaling group and terminating the old one.

Question 10

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

Accepted Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.. Option B is correct because setting the bucket's DeletionPolicy to Retain allows the stack to update even if the bucket already exists, and manual deletion is avoided. Option A is wrong because it does not prevent the update failure if the bucket exists. Option C is wrong because importing requires manual steps and does not prevent update failures. Option D is wrong because it does not address the root cause.

Answer

Use AWS CloudFormation resource import to bring the existing bucket into the stack.

Answer

Use a custom resource to check if the bucket exists before creation.

Answer

Manually delete the S3 bucket before each stack update.

Question 11

A company is using AWS Config to evaluate resource compliance. They want to receive notifications when a noncompliant resource is detected. Which AWS service should be used to send these notifications to an email endpoint?

Accepted Answer

Amazon Simple Notification Service (SNS). Option A is correct because Amazon SNS can send email notifications when triggered by AWS Config rules. Option B is wrong because SQS is a queue, not for direct email. Option C is wrong because Lambda can process notifications but not directly send email to multiple recipients without SNS. Option D is wrong because CloudWatch Events can trigger actions but not directly send email.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon CloudWatch Events

Answer

AWS Lambda

Question 12

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

Accepted Answer

Modify the RDS instance to use a larger instance type with higher IOPS.. Option C is correct because provisioning GP3 volumes with higher IOPS can improve write performance without code changes. Option A is wrong because Multi-AZ improves availability, not write latency. Option B is wrong because read replicas improve read performance, not write. Option D is wrong because modifying parameter groups does not directly increase IOPS.

Answer

Create a read replica and offload read traffic.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the DB parameter group to optimize for write operations.

Question 13

A company has a legacy application that runs on an EC2 instance with a large attached EBS volume. The application writes log files to the volume, and the volume is frequently full, causing application errors. The Solutions Architect needs to implement a solution to automatically manage disk space without application changes. Which solution meets these requirements?

Accepted Answer

Use a script with Amazon Data Lifecycle Manager to snapshot the volume and delete old snapshots.. Option D is correct because using a lifecycle policy to move old logs to S3 Glacier and delete from volume automates space management. Option A is wrong because S3 Lifecycle policies apply to S3 objects, not EBS volumes. Option B is wrong because CloudWatch Logs agent requires application changes to send logs. Option C is wrong because increasing volume size does not automatically manage space.

Answer

Configure an S3 Lifecycle policy to transition log files to Amazon S3 Glacier after 30 days.

Answer

Increase the EBS volume size and enable auto-scaling.

Answer

Install the CloudWatch Logs agent and stream logs to CloudWatch Logs, then delete local logs.

Question 14

A company is using AWS Elastic Beanstalk to deploy a web application. The application's performance degrades over time due to increasing database connections. The company wants to implement a solution that automatically scales the database tier based on connection count. Which action should be taken?

Accepted Answer

Use Amazon RDS Proxy to manage database connections and enable connection pooling.. Option B is correct because Amazon RDS Proxy manages connection pooling and can scale with application, reducing load on database. Option A is wrong because DynamoDB is a different database. Option C is wrong because scaling EC2 instances does not address database connections. Option D is wrong because modifying RDS instance type is manual and not automatic.

Answer

Migrate the database to Amazon DynamoDB with auto scaling.

Answer

Enable Multi-AZ on the RDS instance and modify the DB instance class.

Answer

Configure the Auto Scaling group to scale based on CPU utilization.

Question 15

A company uses AWS CloudTrail to log API activity. The compliance team requires that logs be stored for 7 years and be immediately accessible for the first 90 days, after which access can take up to 12 hours. Which storage solution meets these requirements cost-effectively?

Accepted Answer

Store logs in Amazon S3 Standard for 90 days, then transition to Amazon S3 Glacier Deep Archive.. Option C is correct because S3 Standard for 90 days then transition to S3 Glacier Deep Archive meets access needs and cost. Option A is wrong because S3 Glacier is more expensive than Deep Archive for long-term. Option B is wrong because S3 Standard-IA is not cost-effective for 7 years. Option D is wrong because S3 One Zone-IA has lower durability and not suitable for compliance.

Answer

Store logs in Amazon S3 Standard for 90 days, then transition to Amazon S3 Glacier for the remainder.

Answer

Store logs in Amazon S3 One Zone-Infrequent Access for 90 days, then delete.

Answer

Store logs in Amazon S3 Standard-Infrequent Access for 90 days, then transition to Amazon S3 Standard.