SAP-C02 Continuous Improvement for Existing Solutions Practice Test 26 — 15 Questions

Question 1

A company is using AWS CodePipeline to automate deployments of a web application. The deployment to an Amazon ECS cluster often fails during the 'Deploy' stage due to insufficient capacity in the target group. The operations team wants to improve the pipeline to automatically handle such failures without manual intervention. Which solution is MOST operationally efficient?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a retry action in the CodePipeline stage for the ECS deployment.. The most operationally efficient because it uses CodePipeline's built-in retry mechanism to automatically retry the failed 'Deploy' stage when the ECS deployment fails due to insufficient capacity. This eliminates the need for manual intervention or additional services like Lambda, reducing operational overhead. Option A adds unnecessary complexity with CloudWatch Alarms and Lambda. Option B does not address capacity issues. Option C requires manual approval, which is not automated. Option D would reduce capacity, exacerbating the failure.

Answer

Use Amazon CloudWatch Alarms to trigger an AWS Lambda function that restarts the pipeline.

Answer

Modify the CodeBuild project to run integration tests after deployment.

Answer

Add a manual approval step before the deploy stage to verify capacity.

Answer

Configure the ECS service to automatically scale down the desired count on deployment failure.

Question 2

A company runs a critical application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and logs, but cannot identify the root cause. What is the MOST effective way to troubleshoot the latency issue?

Accepted Answer

Use AWS X-Ray to trace requests from the ALB to the application and downstream services.. AWS X-Ray provides end-to-end tracing of requests from the ALB to the EC2 instances and downstream services, allowing the team to identify the specific component causing latency spikes. Option A is wrong because detailed ALB metrics only provide aggregate data, not per-request traces. Option B is wrong because migrating to Lambda would not necessarily resolve latency and adds significant architectural change. Option C is wrong because a Network Load Balancer operates at Layer 4 and does not provide application-level tracing or visibility. Option E is wrong because while adding instances might reduce load, it does not help identify the root cause of intermittent latency spikes.

Answer

Enable detailed ALB metrics and create a CloudWatch dashboard.

Answer

Migrate the application to AWS Lambda to eliminate EC2 overhead.

Answer

Replace the ALB with a Network Load Balancer (NLB) for lower latency.

Answer

Add more EC2 instances behind the ALB to distribute the load.

Question 3

A company has a monolithic application running on a single Amazon EC2 instance. The application stores data on an instance store volume. The company wants to improve availability and disaster recovery with minimal architectural changes. What is the MOST cost-effective solution?

Accepted Answer

Replace the instance store volume with an Amazon EBS volume, create an AMI, and use Auto Scaling with an Application Load Balancer.. The most cost-effective solution with minimal architectural changes. By replacing the ephemeral instance store with an EBS volume, the data becomes persistent. Then creating an AMI and using Auto Scaling with an Application Load Balancer provides high availability and disaster recovery automatically. Option B only adds backups but does not provide high availability, and restoring from snapshots is slower. Option C, AWS Backup, cannot back up instance store data directly, so it is ineffective. Option D provides high availability but still uses instance store, so data is lost on instance failure; it also does not address data persistence. Therefore, Option A is correct.

Answer

Attach an Amazon EBS volume and configure the application to write to it, then take periodic EBS snapshots.

Answer

Use AWS Backup to schedule backups of the instance and restore to a new instance if needed.

Answer

Create an AMI from the instance and launch a second instance in a different Availability Zone behind an Application Load Balancer.

Question 4

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to implement a change management process where all stack updates must be reviewed and approved before execution. The team currently uses AWS CodePipeline for CI/CD. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Create a CodePipeline pipeline with an approval stage before the CloudFormation deployment action.. It leverages the existing CodePipeline CI/CD system with a built-in approval gate, allowing the operations team to review and approve CloudFormation stack updates before deployment with minimal additional overhead. Option A (Change Sets) requires manual execution and lacks integration with the CI/CD pipeline. Option B (Lambda + SNS) introduces custom code and additional management overhead. Option C (Service Catalog) is designed for provisioning new resources, not for change management of existing stacks. Option D (manual CLI + peer review) does not automate the process and increases operational overhead.

Answer

Use CloudFormation Change Sets and require a senior engineer to execute them.

Answer

Write an AWS Lambda function that triggers on stack update events and requires approval via Amazon SNS.

Answer

Use AWS Service Catalog to govern CloudFormation templates and require approval for provisioning.

Answer

Store CloudFormation templates in AWS CodeCommit and use AWS CLI to execute updates after peer review.

Question 5

A company runs a data processing pipeline on AWS using AWS Glue and Amazon Redshift. Recently, the pipeline has been failing due to insufficient memory in the Glue job. The team wants to improve the pipeline to handle larger datasets without manual intervention. Which solution is MOST cost-effective?

Accepted Answer

Enable job bookmarking and configure incremental processing to reduce data volume per run.. The most cost-effective solution is to enable job bookmarking and configure incremental processing. This reduces the data volume processed per run, thereby preventing memory issues without increasing costs. Increasing DPUs (Option E) would linearly increase cost. Changing Redshift node type (Option B) does not address Glue memory. Replacing Glue with EMR (Option C) adds complexity and may not be more cost-effective. Partitioning input data into more files (Option D) does not directly solve memory issues and can actually increase overhead.

Answer

Use a larger node type for the Amazon Redshift cluster to offload processing.

Answer

Replace AWS Glue with Amazon EMR and use spot instances for cost savings.

Answer

Partition the input data in Amazon S3 into more files with smaller sizes.

Answer

Increase the number of DPUs (Data Processing Units) for the Glue job.

Question 6

A company uses AWS Lambda functions to process messages from an Amazon SQS queue. The Lambda function is CPU-bound and takes close to the 15-minute timeout. The operations team notices that the function sometimes times out during peak hours. What is the SIMPLEST way to improve the function's performance?

Accepted Answer

Increase the memory (and CPU) allocation for the Lambda function.. Increasing the Lambda function's memory also increases CPU allocation proportionally, which directly speeds up CPU-bound processing and reduces the chance of timeout during peak hours. Option A is wrong because increasing reserved concurrency only allows more parallel invocations, but does not improve per-invocation performance; it could actually increase load on the same slow function. Option B is wrong because increasing the batch size makes each invocation process more messages, which would further increase processing time and worsen timeouts. Option C is wrong because using a Lambda function URL changes the invocation source but does not affect CPU allocation or timeout behavior. Option E is wrong because migrating to ECS with Fargate is more complex and not the simplest solution; increasing Lambda memory is a simpler and effective change.

Answer

Increase the reserved concurrency of the Lambda function.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Use a Lambda function URL instead of SQS invocation.

Answer

Migrate the Lambda function to run on Amazon ECS with Fargate using a larger task size.

Question 7

A company uses Amazon DynamoDB as its primary database. The operations team is seeing increased read latency during peak hours. The table has a provisioned read capacity of 1000 RCU, but CloudWatch metrics show that consumed read capacity frequently reaches 1000 RCU. The application uses eventually consistent reads. What is the MOST cost-effective way to reduce read latency?

Accepted Answer

Enable DynamoDB Accelerator (DAX) to cache frequently read items.. DynamoDB Accelerator (DAX) provides an in-memory cache that reduces read latency by serving frequently accessed items from cache, without increasing provisioned RCU. This is cost-effective as it adds minimal cost compared to increasing capacity. Option A is wrong because switching to strongly consistent reads consumes double the RCU (since they require a read of the primary replica), increasing cost and potentially worsening latency. Option C is wrong because a Global Secondary Index (GSI) offloads reads from the base table but does not reduce latency for reads on the base table itself; it also incurs additional write costs. Option D is wrong because increasing RCU to 2000 would double the cost, though it might reduce throttling, it's not the most cost-effective. Option E is wrong because using ElastiCache adds operational complexity and cost, and DAX is a more seamless, DynamoDB-native caching solution.

Answer

Switch to strongly consistent reads to improve consistency.

Answer

Create a global secondary index (GSI) on the table to offload reads.

Answer

Increase the provisioned read capacity to 2000 RCU.

Answer

Use Amazon ElastiCache for Memcached as a read cache.

Question 8

A company has a legacy application that runs on an Amazon EC2 instance. The application writes logs to a local file. The company wants to centralize log monitoring without modifying the application code. Which solution should the company use?

Accepted Answer

Install the Amazon CloudWatch agent on the EC2 instance and configure it to tail the log file.. The Amazon CloudWatch agent can be installed on the EC2 instance without modifying the application code. It tails the local log file and sends the logs to Amazon CloudWatch Logs for centralized monitoring. Option A is incorrect because Amazon Kinesis Agent streaming to Kinesis Data Firehose adds unnecessary complexity for simple log ingestion. Option C is incorrect because it requires modifying the application code. Option D is incorrect because AWS CloudTrail captures API activity, not application logs. Option E is incorrect because it requires modifying the application code to write to Amazon S3.

Answer

Use Amazon Kinesis Agent to stream the log file to Amazon Kinesis Data Firehose.

Answer

Modify the application to use the AWS SDK for logging to Amazon CloudWatch Logs.

Answer

Turn on AWS CloudTrail for the EC2 instance to capture logs.

Answer

Configure the application to write logs to Amazon S3 using the AWS SDK.

Question 9

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects are encrypted at rest. The company currently uses server-side encryption with S3 managed keys (SSE-S3). The team wants to enforce encryption using a customer-managed key (CMK) from AWS KMS. Which TWO actions should the team take?

Accepted Answer

Configure a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not set to 'aws:kms'.. (bucket policy denying PutObject without x-amz-server-side-encryption header set to 'aws:kms') enforces that all uploads must specify SSE-KMS at the request level. Option C (default encryption with SSE-KMS) ensures that objects uploaded without encryption headers are automatically encrypted with a KMS key. Together, they enforce encryption with customer-managed KMS keys. Option B (CloudTrail auditing) logs requests but does not enforce encryption. Option D (bucket policy allowing PutObject only if encrypted) allows any encryption type, not specifically KMS, so it does not enforce customer-managed keys. Option E (disabling SSE-S3) is not possible; you cannot disable SSE-S3, only set default encryption, and it would not enforce KMS alone.

Answer

Enable AWS CloudTrail to audit all PutObject requests.

Answer

Configure a bucket policy that allows PutObject only if the object is encrypted.

Answer

Disable SSE-S3 on the bucket so that only SSE-KMS can be used.

Question 10

A company is running a critical microservices application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic. Recently, the team noticed that the ALB's 5xx error rate has increased. The error is HTTP 503. The team suspects the target group is unhealthy. Which THREE steps should the team take to diagnose and resolve the issue?

Accepted Answer

Verify the ECS service's desired count and compare with the number of healthy tasks in the target group.. And Option E are correct. Option A checks the ECS service's desired count and compares it with the number of healthy tasks in the target group, ensuring sufficient capacity. Option C checks ECS service events and task status to confirm tasks are running and passing health checks. Option E checks ALB access logs and health check settings for the target group to identify health check failures or misconfigurations. Option B (replacing ALB with NLB) is a major architectural change and not a diagnostic step. Option D (enabling sticky sessions) is unrelated to 503 errors.

Answer

Replace the ALB with a Network Load Balancer (NLB) to bypass health checks.

Answer

Verify that sticky sessions (session affinity) are enabled on the target group.

Question 11

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all new accounts created through the organization automatically have a specific AWS Config rule enabled that requires S3 buckets to be encrypted. Which TWO actions should the team take?

Accepted Answer

Create a conformance pack in the management account and deploy it to the organization.. To automatically enable an AWS Config rule for all new accounts in AWS Organizations, the team should enable AWS Config in every account (Option E) and create a conformance pack in the management account deployed to the organization (Option C). AWS Config conformance packs allow deploying a set of AWS Config rules and remediation actions across accounts via Organizations. Enabling Config in all accounts is a prerequisite for rules to evaluate resources. Option A (CloudFormation StackSets) can deploy rules but does not automatically enable Config per account. Option B (SCP) denies actions but does not enforce the Config rule itself. Option D (management account rule) would not automatically apply to other accounts unless using conformance packs.

Answer

Use AWS CloudFormation StackSets to deploy the Config rule to all accounts.

Answer

Create a Service Control Policy (SCP) that denies PutBucketEncryption actions.

Answer

Create an AWS Config rule in the management account that applies to all accounts via AWS Organizations.

Question 12

A company is running a production web application on AWS Auto Scaling EC2 instances behind an Application Load Balancer. Recent deployments have caused intermittent errors. The team wants to implement a deployment strategy that minimizes downtime and allows for quick rollback. Which strategy should they use?

Accepted Answer

Use blue/green deployment with a second Auto Scaling group and switch the ALB target group.. Blue/green deployment with a second Auto Scaling group and ALB switch allows instant rollback by switching back to the original environment. Option A is wrong because rolling updates with a single ASG can still cause partial downtime and slower rollback. Option C is wrong because it does not minimize downtime and requires manual intervention. Option D is wrong because immutable deployments replace instances, but rollback requires redeployment.

Answer

Deploy a new version to a single instance, test, then scale out.

Answer

Perform rolling updates with a single Auto Scaling group, updating a few instances at a time.

Answer

Use an immutable deployment by launching a new Auto Scaling group and terminating the old one.

Question 13

A company uses AWS CloudFormation to manage infrastructure. They have a stack that creates an S3 bucket and a Lambda function that processes objects uploaded to the bucket. Recently, updates to the Lambda code caused the stack update to fail because the S3 bucket already existed in the account. What is the most efficient way to allow future updates without error?

Accepted Answer

Use AWS CloudFormation resource import to bring the existing bucket into the stack.. The stack update failed because the S3 bucket already existed, likely due to it being removed from the template and then added back. By using AWS CloudFormation resource import, you can bring the existing bucket into the stack's management, preventing CloudFormation from attempting to create it again. This resolves the immediate error and allows future updates without conflict. DeletionPolicy Retain only prevents deletion, not creation conflicts.

Answer

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Answer

Use a custom resource to check if the bucket exists before creation.

Answer

Manually delete the S3 bucket before each stack update.

Question 14

A company is using AWS Config to evaluate resource compliance. They want to receive notifications when a noncompliant resource is detected. Which AWS service should be used to send these notifications to an email endpoint?

Accepted Answer

Amazon Simple Notification Service (SNS). (Amazon SNS) is correct because Amazon SNS can send email notifications when triggered by AWS Config rules to notify about noncompliant resources. Option A (SQS) is incorrect because SQS is a message queue service that does not directly send email. Option C (CloudWatch Events) can trigger other actions but cannot directly send email to endpoints. Option D (AWS Lambda) can process notifications but requires additional services like SNS to send email.

Answer

Amazon Simple Queue Service (SQS)

Answer

Amazon CloudWatch Events

Answer

AWS Lambda

Question 15

A company runs a critical database on an Amazon RDS for PostgreSQL instance. The database experiences high write latency during peak hours. The company wants to improve write performance without changing the application code. Which action should the Solutions Architect take?

Accepted Answer

Modify the RDS instance to use a larger instance type with higher IOPS.. Upgrading to a larger instance type with higher IOPS directly increases the I/O capacity of the RDS instance, improving write performance without requiring application changes. Option A is incorrect because read replicas are used to offload read traffic, not to improve write latency. Option C is incorrect because Multi-AZ deployment provides high availability and automatic failover, but does not directly improve write performance. Option D is incorrect because modifying DB parameter groups can tune certain database settings but does not increase the underlying IOPS provided by the instance type.

Answer

Create a read replica and offload read traffic.

Answer

Enable Multi-AZ deployment for the RDS instance.

Answer

Change the DB parameter group to optimize for write operations.