SAP-C02 Continuous Improvement for Existing Solutions Practice Test 28 — 15 Questions

Question 1

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

Accepted Answer

The ALB is buffering requests because the backend instances are overwhelmed; increase the number of instances or improve instance performance.. Option A is correct because a high SurgeQueueLength means the ALB is receiving more requests than the healthy instances can handle, causing queuing. Option B is wrong because surge queue is for HTTP requests, not connections. Option C is wrong because it is not a client-side issue. Option D is wrong because the queue is at the ALB level, not instance level.

Answer

The backend instances are failing health checks; review the health check configuration.

Answer

Clients are sending too many requests; implement API rate limiting.

Answer

The ALB is experiencing a high number of new connections; increase the idle timeout setting.

Question 2

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. What is the MOST scalable and efficient way to enforce this policy?

Accepted Answer

Use an SCP that denies s3:PutBucketEncryption actions unless the encryption is set to aws:kms.. Option D is correct because using a service control policy (SCP) that denies the creation of unencrypted S3 buckets if encryption is not set to aws:kms is the most scalable way to enforce this across all accounts. Option A is wrong because it requires manual auditing. Option B is wrong because Config rules are per-account. Option C is wrong because CloudTrail does not enforce policies.

Answer

Use an AWS Lambda function that runs periodically across all accounts to check and remediate buckets.

Answer

Use AWS Config rules in each account to detect unencrypted buckets and trigger auto-remediation.

Answer

Use AWS CloudTrail to monitor PutBucketEncryption calls and alert the security team.

Question 3

A company is deploying a web application that uses an Application Load Balancer and an Auto Scaling group of EC2 instances. The application must be able to handle sudden spikes in traffic. Which TWO actions should the Solutions Architect take to improve scalability and reduce latency? (Choose two.)

Accepted Answer

Enable HTTP/2 on the Application Load Balancer.. Options B and C are correct. Option B: Using a predictive scaling policy helps prepare for traffic spikes. Option C: Enabling HTTP/2 on the ALB reduces latency through multiplexing. Option A is wrong because increasing cooldown delays scaling. Option D is wrong because larger instances are a vertical scaling approach, not horizontal. Option E is wrong because increasing health check interval delays detection of unhealthy instances.

Answer

Increase the default cooldown period for the Auto Scaling group.

Answer

Use larger EC2 instance types for the Auto Scaling group.

Answer

Increase the health check interval on the Application Load Balancer.

Question 4

A company runs a critical application on Amazon RDS for MySQL. The database size is 500 GB and growing. The application experiences high write latency during peak hours. A Solutions Architect needs to improve write performance with minimal downtime. Which THREE actions should the architect take? (Choose three.)

Accepted Answer

Migrate the database to Amazon Aurora with MySQL compatibility.. Options A, C, and D are correct. Option A: Increasing storage IOPS directly improves write performance. Option C: Enabling Multi-AZ provides a standby that can be used for failover, but it does not improve write performance; however, the question asks for improving write performance, so this is incorrect. Wait, Multi-AZ does not improve write performance; it adds availability. Option D: Adding read replicas does not help writes. Actually, let's re-evaluate. The correct answer should be: A (increase IOPS), B (use provisioned IOPS), and E (switch to Aurora) or similar. But the instruction says exactly 3 correct. Let me correct: Option A (increase allocated storage) can improve IOPS because larger volumes have higher baseline IOPS. Option B (enable Performance Insights) is for monitoring, not performance. Option C (Multi-AZ) does not improve write performance. Option D (read replica) does not help writes. Option E (migrate to Aurora) improves write performance. But that's only two. Actually, increasing storage size (A) and migrating to Aurora (E) are two. Another could be using provisioned IOPS. But the options don't have that. Let me adjust the options to make three correct. I'll revise the options. Since the question is generated, I can choose the correct ones. Let's set: Options A, C, and E are correct. A: Increase allocated storage (increases IOPS). C: Enable Multi-AZ (does not improve write performance, so not correct). Hmm. Let me think: For write performance, you can: 1) Increase storage (more IOPS), 2) Use provisioned IOPS, 3) Use Aurora. So the options should include those. I'll modify the options to include provisioned IOPS. For the sake of this response, I'll set the correct options as: A (increase storage), B (use provisioned IOPS), and E (migrate to Aurora). But I need to ensure the distractors are wrong. Let me rewrite the options properly. Given the constraints, I'll produce a consistent answer. Actually, I have to follow the original options I wrote. Let me correct the explanation accordingly: For multi-select, I'll define options that make sense. I'll set: Correct: A (increase storage), C (enable Multi-AZ - though it doesn't improve write performance, but it's a common misconception; wait, it does not. So I'll not include it. Better to set: A (increase storage), D (add read replica - no), that's not correct. I'll restart: The correct three actions to improve write performance are: 1) Increase storage size (increases baseline IOPS), 2) Switch to provisioned IOPS (if not already), 3) Migrate to Amazon Aurora (better write performance). So in options, include those. Let me define options: A: Increase allocated storage, B: Enable Multi-AZ, C: Enable Performance Insights, D: Add a read replica, E: Migrate to Amazon Aurora. Then correct: A, E, and maybe B? No, Multi-AZ does not improve write performance. So only A and E are two, need a third. Could be: Change instance class to a memory optimized instance? Not listed. Alternatively, use Amazon RDS Proxy? Not listed. I'll add an option for provisioned IOPS. Let me redo the options: A: Increase allocated storage, B: Enable Multi-AZ, C: Change storage type to Provisioned IOPS, D: Add a read replica, E: Migrate to Amazon Aurora. Then correct: A, C, E. That works. So I'll use that. Explanation: Increasing storage (A) improves baseline IOPS, Provisioned IOPS (C) provides consistent performance, and Aurora (E) has better write throughput. Multi-AZ (B) does not improve writes, and read replicas (D) are for reads.

Answer

Add a read replica to offload read traffic.

Answer

Enable Multi-AZ deployment for the DB instance.

Question 5

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

Accepted Answer

Modify the function to stream the file from S3 instead of downloading it entirely.. Options B and D are correct. Option B: Increasing the Lambda timeout gives more time for processing. Option D: Streaming the file instead of downloading it reduces I/O time. Option A is wrong because more memory also increases CPU, but it's not the best approach; streaming is better. Option C is wrong because /tmp is ephemeral and its size limit does not affect performance significantly. Option E is wrong because concurrency limits affect throughput, not individual execution time.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Increase the /tmp storage limit for the Lambda function.

Question 6

A Solutions Architect runs the above command for an EC2 instance that is part of an Auto Scaling group. The instance is in a private subnet and should only receive traffic from an Application Load Balancer. However, the instance is accessible from the internet. Based on the output, what is the most likely reason?

Accepted Answer

The security group attached to the instance allows inbound traffic from 0.0.0.0/0.. Option B is correct. The output shows the instance has a security group 'sg-web-app' attached to its network interface. If that security group allows inbound traffic from 0.0.0.0/0, the instance would be accessible from the internet. The subnet being private does not matter if a security group allows public access. Option A is wrong because the instance is in a private subnet, so it should not have a public IP. Option C is wrong because the output does not show a route table. Option D is wrong because the instance does not have a public IP attached; it's in a private subnet.

Answer

The subnet's route table has a route to an internet gateway.

Answer

The instance has an Elastic IP address attached.

Answer

The instance has a public IP address assigned.

Question 7

A company runs a critical e-commerce platform on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances running a web server. The web servers store session data locally on the instance's ephemeral storage. The Auto Scaling group is configured with a min of 2, max of 10, and desired of 2. Recently, during a flash sale, traffic surged and the Auto Scaling group scaled out to 10 instances. However, many users reported that their shopping carts were lost and they were logged out during the event. The Cognito user pool was used for authentication, and the application uses cookies to maintain session state. The ALB's stickiness is enabled. The team observed that the ALB's RequestCountPerTarget metric was well below the instance's capacity, but the error rate increased. The CloudWatch logs show that the web server returned 503 errors for a subset of requests. After the flash sale ended, the Auto Scaling group scaled back to 2 instances, and the issue disappeared. The team wants to prevent this from happening in future events. Which solution should the Solutions Architect recommend?

Accepted Answer

Modify the application to store session data in an Amazon ElastiCache for Redis cluster instead of local ephemeral storage.. Option A is correct. The root cause is that session data stored on ephemeral storage is lost when instances are terminated or replaced. Even with ALB stickiness, if an instance is scaled in (terminated) or replaced, the session data is gone. Using ElastiCache for session storage decouples sessions from instances, ensuring persistence across scaling events. Option B is wrong because increasing the min size does not solve the data loss; sessions are still lost on instance termination. Option C is wrong because disabling stickiness would make it worse, as requests would go to different instances, potentially losing sessions even without scaling. Option D is wrong because increasing health check interval does not solve the data loss; it only delays detection of unhealthy instances.

Answer

Increase the minimum size of the Auto Scaling group to 10 to handle the surge without scaling down.

Answer

Disable stickiness on the ALB so that any instance can handle any request.

Answer

Increase the health check interval on the ALB to prevent instances from being marked unhealthy too quickly.

Question 8

A company has a multi-tier application running on AWS. The web tier uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The application tier runs on a separate Auto Scaling group of EC2 instances. The database tier uses Amazon RDS for MySQL. During a recent load test, the application became unresponsive. Monitoring showed that the database's CPU utilization was at 100% and the number of database connections was at the maximum limit. The application tier instances were healthy, but the web tier instances were returning 503 errors. The Solutions Architect determined that the application tier was making too many database connections because each request opened a new connection and did not close it properly. The team wants to fix the issue with minimal changes to the application code. Which solution should the Solutions Architect recommend?

Accepted Answer

Configure Amazon RDS Proxy to pool database connections from the application tier.. Option C is correct. Using Amazon RDS Proxy allows connection pooling, reducing the number of database connections and reusing connections, which reduces CPU load on the database. It requires minimal code changes. Option A is wrong because increasing the max connections limit does not address the root cause; it may lead to more resource contention. Option B is wrong because scaling the application tier horizontally will increase the number of connections further, making the problem worse. Option D is wrong because switching to Aurora does not inherently solve connection management; RDS Proxy is still needed.

Answer

Migrate the database from RDS MySQL to Amazon Aurora MySQL with read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more connections.

Answer

Scale the application tier horizontally by increasing the desired capacity of the Auto Scaling group.

Question 9

A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::source-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::destination-bucket/*"
        }
    ]
}

The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

Accepted Answer

The Lambda function is in a VPC without an S3 VPC endpoint, so it cannot reach S3.. Option D is correct. When a Lambda function is configured to access a VPC, it loses internet access unless a NAT gateway or VPC endpoints are provided. To access S3, the function needs an S3 VPC endpoint (gateway type) in the same VPC and subnet. Without it, the PutObject call fails with 'Access Denied' because the function cannot reach the S3 API endpoint. Option A is wrong because the IAM policy allows s3:PutObject. Option B is wrong because the bucket policy does not deny access. Option C is wrong because the source bucket permissions are for read, not write; the error is on write.

Answer

The Lambda function does not have permissions to read from the source bucket.

Answer

The IAM policy does not allow s3:PutObject on the destination bucket.

Answer

The destination bucket policy denies the Lambda function's access.

Question 10

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer. Recently, error rates increased due to a misconfiguration. The operations team wants to automatically roll back to the previous working configuration if errors exceed a threshold. Which solution provides the fastest rollback?

Accepted Answer

Implement AWS CodeDeploy with automatic rollback triggered by CloudWatch alarms.. Option C is correct because AWS CodeDeploy allows automatic rollback based on CloudWatch alarms. Option A is wrong because manual rollback is slower. Option B is wrong because CloudFormation stack rollback requires stack update, not real-time. Option D is wrong because Elastic Beanstalk uses CodeDeploy internally but with less control.

Answer

Manually restore AMI snapshots of the previous deployment.

Answer

Use AWS Elastic Beanstalk with rolling updates and health checks.

Answer

Use AWS CloudFormation with a stack policy to prevent updates.

Question 11

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

Accepted Answer

Increase the Lambda function reserved concurrency.. Option B is correct because increasing the number of Lambda function instances will increase concurrency and process more messages in parallel. Option A is wrong because increasing batch size may cause timeouts. Option C is wrong because increasing function memory/timeout does not directly improve throughput. Option D is wrong because SQS visibility timeout does not affect Lambda concurrency.

Answer

Increase the SQS visibility timeout to allow more time per message.

Answer

Increase the Lambda function memory and timeout settings.

Answer

Increase the SQS batch size to the maximum of 100.

Question 12

A company is migrating a monolithic application to microservices on AWS. They want to implement a continuous improvement process for existing services. Which AWS service should they use to collect and analyze operational metrics and logs from all microservices in a centralized location?

Accepted Answer

Amazon CloudWatch. Option B is correct because Amazon CloudWatch Logs and Metrics provide centralized monitoring. Option A is wrong because AWS X-Ray is for tracing, not metrics. Option C is wrong because AWS Config is for configuration compliance. Option D is wrong because Amazon Inspector is for security assessment.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS X-Ray

Question 13

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences occasional read replica lag of up to 5 seconds. The application requires read-after-write consistency. Which action should the company take to improve the solution?

Accepted Answer

Modify the application to always read from the primary instance.. Option C is correct because reading from the primary instance ensures strong consistency. Option A is wrong because RDS Proxy does not eliminate read replica lag. Option B is wrong because adding more read replicas does not solve consistency. Option D is wrong because ElastiCache is for caching, not consistency.

Answer

Increase the number of read replicas to distribute the load.

Answer

Implement Amazon ElastiCache to cache read results.

Answer

Use Amazon RDS Proxy to route read queries to the read replica.

Question 14

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

Accepted Answer

Enable API Gateway caching with a TTL of 60 seconds.. Option B: Enabling DynamoDB auto scaling adjusts capacity based on traffic patterns, reducing throttling-related errors. Option C: Configuring API Gateway caching reduces the load on Lambda and DynamoDB for repeated requests. Option A: Increasing Lambda timeout may not address root cause and could mask issues. Option D: Provisioned concurrency helps with cold starts but not with DynamoDB throttling. Option E: Lambda reserved concurrency limits concurrency, which could worsen throttling.

Answer

Set Lambda reserved concurrency to 5 for each function.

Answer

Configure provisioned concurrency for all Lambda functions.

Answer

Increase the Lambda function timeout to 30 seconds.

Question 15

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache Redis cluster. The operations team has noticed that during peak hours, application response times increase significantly. They need to improve performance without downtime. Which THREE actions should they take? (Choose 3)

Accepted Answer

Enable connection draining on the ALB.. Option A: Adding more EC2 instances scales horizontally, distributing load. Option B: Increasing instance size vertical scaling may cause downtime if done without rolling replacement. Option C: Adding read replicas to ElastiCache offloads read traffic. Option D: Enabling ELB connection draining ensures in-flight requests complete during instance replacement, improving availability. Option B is not chosen because it can cause downtime.

Answer

Decrease the idle timeout of the ALB.

Answer

Increase the EC2 instance size to a larger instance type.