SAP-C02 Continuous Improvement for Existing Solutions Practice Test 27 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive data. The security team requires that all objects be encrypted at rest. The company currently uses server-side encryption with S3-managed keys (SSE-S3). The security team wants to ensure that only authorized users can access the decryption keys. What should the company do?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Change the default encryption to server-side encryption with AWS KMS (SSE-KMS) and apply IAM policies to control key usage.. SSE-KMS encrypts objects with keys managed in AWS KMS, and access to those keys is governed by IAM policies and KMS key policies. This satisfies the requirement that only authorized users can access decryption keys, because KMS enforces key-level permissions separately from S3 bucket access. SSE-S3 uses AWS-managed keys that customers cannot control or restrict per-user.

Answer

Configure an S3 bucket policy to allow only specific IAM roles to put objects.

Answer

Continue using SSE-S3 and enable S3 Block Public Access.

Answer

Use client-side encryption with an AWS KMS key.

Question 2

A company runs a web application on EC2 instances in an Auto Scaling group. The application receives a variable workload. The company wants to scale based on a custom metric that tracks the number of active users. What is the MOST efficient way to achieve this?

Accepted Answer

Create a target tracking scaling policy using the custom metric as the target.. Target tracking scaling is the most efficient because it automatically adjusts capacity to keep a chosen metric at a target value, using CloudWatch alarms under the hood. It supports custom metrics and eliminates the need to define step boundaries or thresholds manually, which is exactly what a variable workload with a custom metric requires.

Answer

Use a scheduled scaling policy to add or remove instances based on historical usage patterns.

Answer

Use AWS Lambda to periodically evaluate the custom metric and adjust the desired capacity via API calls.

Answer

Create a step scaling policy that uses CloudWatch alarms based on the custom metric.

Question 3

A company uses Amazon CloudWatch Logs to collect application logs. The operations team wants to be notified when a specific error message appears in the logs. What is the SIMPLEST way to achieve this?

Accepted Answer

Create a metric filter on the log group for the error message and set up a CloudWatch alarm on the metric.. A CloudWatch metric filter scans a log group for a specified pattern (such as an error string) and increments a custom metric each time the pattern matches; attaching a CloudWatch alarm to that metric then triggers notifications via SNS when the threshold is breached. This is the native, lowest-effort mechanism for alerting on log content and requires no custom code. It directly satisfies the 'simplest way' requirement.

Answer

Configure S3 event notifications on the log file destination to send an alert.

Answer

Subscribe a Lambda function to the log group and have it check for the error message.

Answer

Use CloudWatch Logs Insights to run a query periodically and send results via email.

Question 4

A company uses AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions query an Amazon RDS for PostgreSQL database. Recently, the company has noticed increased latency and occasional timeouts during peak hours. A solutions architect needs to improve the performance and scalability of the database layer. Which solution will meet these requirements with the LEAST operational overhead?

Accepted Answer

Implement Amazon RDS Proxy to manage connection pooling between Lambda and the RDS instance.. AWS Lambda functions can overwhelm an RDS database with too many concurrent connections, causing latency and timeouts. RDS Proxy pools and shares database connections, reducing the connection overhead and improving scalability without code changes. It requires minimal operational overhead because it is a managed service that integrates with IAM and Secrets Manager.

Answer

Enable Amazon DynamoDB Accelerator (DAX) on the RDS instance.

Answer

Add a Multi-AZ RDS Read Replica and modify Lambda to use the Read Replica for queries.

Answer

Increase the instance size of the RDS database to handle more concurrent connections.

Question 5

A company runs a production application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer (ALB) to distribute traffic to tasks. The company has configured an Auto Scaling target tracking policy based on average CPU utilization. During a marketing campaign, traffic spikes cause the ALB to return 503 errors. The ECS service dashboard shows that the number of tasks scaled out to the maximum allowed but the CPU utilization remained high. What is the MOST likely cause of the 503 errors?

Accepted Answer

The ECS service scaled out to the maximum number of tasks, but the new tasks are not yet registered as healthy with the ALB, or the existing tasks are overwhelmed.. The most likely cause is that the ECS service scaled out to the maximum number of tasks, but the new tasks are not yet registered as healthy with the ALB, or the existing tasks are overwhelmed. During a traffic spike, even if tasks scale out, there is a delay before they become healthy and can serve traffic. Meanwhile, the existing tasks may be overloaded, leading to 503 errors from the ALB.

Answer

The target tracking scaling policy takes too long to trigger, and the service cannot scale quickly enough.

Answer

The Fargate tasks have exhausted their elastic network interface (ENI) limits.

Answer

The ALB connection limit has been exceeded due to the traffic spike.

Question 6

A company is running a stateful web application on Amazon EC2 instances in an Auto Scaling group. The instances store session data in an Amazon ElastiCache for Redis cluster. The company wants to improve the application's fault tolerance and ensure that session data is not lost if an Availability Zone fails. What should the solutions architect do?

Accepted Answer

Enable Cluster Mode on the ElastiCache for Redis cluster and configure Multi-AZ.. Enabling Cluster Mode on the ElastiCache for Redis cluster and configuring Multi-AZ provides automatic sharding and replication across Availability Zones. This ensures that session data is not lost if an AZ fails, as replicas in other AZs can take over. Option B is incorrect because read replicas alone do not provide automatic failover or data durability across AZ failures unless Multi-AZ is enabled. Option C is incorrect because increasing instance size does not protect against AZ failure. Option D is incorrect because ElastiCache for Memcached does not support persistence or replication, so data would be lost on node failure.

Answer

Configure the ElastiCache for Redis cluster to have multiple read replicas in the same region.

Answer

Increase the instance size of the EC2 instances to handle more load.

Answer

Migrate from ElastiCache for Redis to ElastiCache for Memcached.

Question 7

A company has a monolithic application running on a single Amazon EC2 instance. The application consists of a web server and a backend worker process. The company wants to migrate to a microservices architecture using containers on Amazon ECS with Fargate. The solutions architect needs to design a solution that minimizes downtime during the migration. Which approach should the solutions architect recommend?

Accepted Answer

Use a strangler fig pattern: gradually replace parts of the monolith with microservices, routing traffic via an Application Load Balancer.. The strangler fig pattern incrementally replaces monolith functionality with microservices while keeping the monolith running, routing traffic between old and new components via a load balancer. This allows gradual cutover, rollback capability, and near-zero downtime — exactly what the question asks for. It is the industry-standard approach for low-risk monolith-to-microservices migration.

Answer

Create a Docker image of the entire monolithic application and run it on ECS with Fargate.

Answer

Run the monolithic application on the same EC2 instance as the new microservices, using different ports.

Answer

Refactor the entire application into microservices, then deploy all microservices at once on ECS.

Question 8

A company has an S3 bucket that stores sensitive data. The company wants to ensure that all objects uploaded to the bucket are encrypted at rest. Which solution should the solutions architect recommend?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the S3 bucket using SSE-S3 or SSE-KMS ensures that all objects are automatically encrypted at rest, regardless of whether the upload request specifies encryption. This is the simplest and most effective approach. Option A is technically viable but unnecessarily complex; a bucket policy that denies uploads without the x-amz-server-side-encryption header can enforce encryption, but it requires careful policy configuration and does not encrypt objects automatically if the header is missing—instead it rejects the upload. Option B is inefficient and costly; using a Lambda function to encrypt objects after upload introduces latency and extra expense, whereas default encryption achieves the same result seamlessly. Option C is incorrect because S3 Access Points are designed for managing access to shared datasets, not for enforcing encryption; adding a policy there would complicate access management without providing the automatic encryption that default encryption offers.

Answer

Use a bucket policy to deny uploads that do not include the x-amz-server-side-encryption header.

Answer

Create an AWS Lambda function that encrypts objects after they are uploaded.

Answer

Configure an S3 Access Point with a policy that requires encryption.

Question 9

A company is using AWS CodePipeline to automate deployments of a web application. The pipeline includes a build stage using AWS CodeBuild and a deploy stage using AWS CodeDeploy to an Auto Scaling group. Recently, deployments have been failing during the deploy stage with an error indicating that the target instances are not in a healthy state. The CodeDeploy agent logs show that the agent is running but the application validation scripts are failing. Which THREE actions should the solutions architect take to troubleshoot and resolve the issue?

Accepted Answer

Test the validation script manually on a healthy instance to confirm it works as expected.. Option A is correct because running the validation script manually on a healthy instance isolates whether the script itself is broken or whether the failure is environmental (permissions, dependencies, or runtime context), which is the fastest way to reproduce and diagnose the error. Option C is correct because the CodeDeploy agent logs on a failing instance (typically /var/log/aws/codedeploy-agent/codedeploy-agent.log) contain the exact stderr/stdout and exit code from the failing lifecycle hook, pinpointing the specific validation error. Option D is correct because CodeDeploy only executes scripts mapped to lifecycle event hooks defined in the AppSpec file's hooks section (for EC2/on-premises, e.g., BeforeInstall, AfterInstall, ApplicationStart, ValidateService); if ValidateService is missing or misspelled, the validation script never runs as intended and the deployment fails validation. Option B is not appropriate because increasing the deployment timeout only masks a script that is failing outright rather than slow, and the logs already show the validation scripts are failing, not timing out. Option E is not appropriate because Auto Scaling lifecycle hooks govern instance launch/termination and do not address CodeDeploy application validation script failures during the deploy stage.

Answer

Increase the deployment timeout in the CodeDeploy deployment group to allow more time for validation.

Answer

Configure an Auto Scaling lifecycle hook to perform health checks before the instance is placed in service.

Question 10

A company runs a containerized application on Amazon ECS with Fargate. The application uses an Application Load Balancer (ALB) to distribute traffic. The company has configured a target tracking scaling policy based on average memory utilization. During a traffic spike, the ECS service scales out, but the new tasks are immediately deregistered and replaced. The CloudWatch logs show that the new tasks are failing the ALB health check. The health check is configured to ping the '/health' endpoint on the container. The solutions architect verifies that the application container correctly responds to the '/health' endpoint with a 200 status code. What is the MOST likely cause of the health check failures?

Accepted Answer

The security group attached to the ECS tasks does not allow inbound traffic from the ALB on the health check port.. Since the application container correctly responds to the '/health' endpoint with a 200 status code, the health check failures are likely due to network connectivity. For Fargate tasks, each task gets an ENI, and the security group attached to the tasks must allow inbound traffic from the ALB on the health check port. If this rule is missing, the ALB cannot reach the health check endpoint, causing tasks to be deregistered. Option A is incorrect because the ALB listener rule is for routing traffic, not health checks. Option C is incorrect because a high deregistration delay would cause slow draining, not immediate health check failures. Option D is incorrect because the health check path is confirmed correct by the architect.

Answer

The ALB is not configured with a proper listener rule to forward traffic to the target group.

Answer

The deregistration delay (connection draining) is set too high, causing the ALB to think the tasks are unhealthy.

Answer

The health check path is incorrect; it should be '/index.html' instead of '/health'.

Question 11

A financial services company runs a critical application on Amazon EC2 instances in an Auto Scaling group across multiple Availability Zones. The application uses an Amazon RDS for MySQL database with Multi-AZ deployment. The company has a recovery time objective (RTO) of 15 minutes and a recovery point objective (RPO) of 1 hour for the database. During a recent disaster recovery drill, the solutions architect simulated an Availability Zone failure by terminating all EC2 instances and the primary RDS instance in one AZ. The Auto Scaling group launched new instances in the other AZ, and the RDS Multi-AZ failover completed in about 2 minutes. However, the application remained unavailable for 30 minutes because the new EC2 instances could not connect to the RDS secondary instance. The security groups are configured correctly. The RDS instance is not publicly accessible. What is the MOST likely cause of the connectivity issue?

Accepted Answer

The application is using a hardcoded IP address or an endpoint that points to the old primary RDS instance instead of the RDS DNS name.. The RDS Multi-AZ failover promotes the standby to primary, changing the underlying IP address. If the application uses a hardcoded IP address or an endpoint that points to the old primary, it will fail to connect after failover. The correct approach is to use the RDS DNS name (CNAME) which automatically resolves to the current primary. Option A is incorrect because the stem states the security groups are correctly configured. Option B is incorrect because the failover completed in about 2 minutes, which is within normal Multi-AZ failover time (1-2 minutes). Option C is incorrect because the RDS endpoint DNS record updates quickly (within seconds) after a failover.

Answer

The security group for the EC2 instances does not allow outbound traffic to the RDS instance.

Answer

The RDS Multi-AZ failover took longer than expected, exceeding the RTO.

Answer

The RDS endpoint DNS record did not update to point to the new primary.

Question 12

A company is migrating a monolithic application to microservices on Amazon ECS. The application uses a legacy database that does not support distributed transactions. The team wants to ensure data consistency across services. Which solution is BEST for achieving eventual consistency with minimal code changes?

Accepted Answer

Implement the Saga pattern using AWS Step Functions.. The Saga pattern coordinates a sequence of local transactions across microservices, with compensating transactions to roll back on failure, achieving eventual consistency without distributed transactions. AWS Step Functions is the managed orchestration service that implements Saga with minimal custom code — you define the state machine in Amazon States Language and Step Functions handles retries, compensation, and state tracking. This is the AWS-recommended approach for eventual consistency in microservices.

Answer

Use Amazon DynamoDB transactions across all services.

Answer

Modify the legacy database to support two-phase commit.

Answer

Use Amazon SQS to queue all database writes and process them sequentially.

Question 13

A company uses AWS CloudFormation to deploy infrastructure. The operations team notices that stack updates frequently fail because of updates to resources that are not supported for updates. What is the BEST way to handle this?

Accepted Answer

Use a change set to review the proposed changes before executing the update.. The best practice is to use a change set to preview changes and identify unsupported updates before executing the update.

Answer

Use AWS Config rules to prevent updates.

Answer

Delete the stack and create a new one for each update.

Answer

Use AWS Service Catalog to enforce version control.

Question 14

A company wants to monitor CPU utilization of their EC2 instances and receive an alert when utilization exceeds 80% for 10 minutes. Which AWS service should be used?

Accepted Answer

Amazon CloudWatch Alarms. CloudWatch Alarms can monitor metrics and trigger actions when a threshold is breached.

Answer

Amazon Inspector

Answer

AWS Config

Answer

AWS CloudTrail

Question 15

A company has a CI/CD pipeline that builds and deploys a containerized application to Amazon ECS Fargate. The pipeline uses AWS CodeBuild to run tests and build Docker images. Recently, the pipeline has been failing intermittently with the error 'CannotPullContainerError: Error response from daemon: manifest for <image> not found'. The image is stored in Amazon ECR. The team suspects the issue is related to image tag inconsistency. The pipeline tags images with the commit hash. Which change will prevent this error?

Accepted Answer

Ensure the pipeline builds and pushes the image with a unique tag, such as the commit hash, and uses that tag in the ECS task definition.. Ensuring that the image tag is unique and not reused prevents stale image references. Using the commit hash ensures uniqueness.

Answer

Store the Docker image in Amazon S3 instead of ECR.

Answer

Use the 'latest' tag for all images.

Answer

Retry the failed pipeline step after a delay.