SAP-C02 Continuous Improvement for Existing Solutions Practice Test 28 — 15 Questions

Question 1

A company uses AWS CloudFormation to deploy infrastructure. A Solutions Architect needs to update a stack that includes an RDS DB instance. The update requires modifying the DB instance's storage type from gp2 to io1. What change should be made to the CloudFormation template to minimize downtime?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Modify the StorageType property in the CloudFormation template and perform a stack update.. Modifying the StorageType property of an RDS DB instance (e.g., from gp2 to io1) can be done without replacing the resource. When the CloudFormation stack is updated with this change, AWS performs an in-place modification that typically causes only a brief downtime (a few minutes). This is the standard approach to minimize downtime. Option B is incorrect because UpdateReplacePolicy is not a valid CloudFormation attribute; the correct attribute is UpdatePolicy, but it does not apply to RDS storage type changes. Option C is incorrect because creating a new stack and migrating data would cause significantly more downtime and effort. Option D is incorrect because DeletionPolicy controls what happens when a resource is deleted from the stack, not during an update.

Answer

Add an UpdateReplacePolicy attribute to the RDS resource.

Answer

Create a new stack with the updated storage type and migrate data.

Answer

Set the DeletionPolicy to Retain for the RDS resource.

Question 2

A company is running a web application on Amazon EC2 instances behind an Application Load Balancer. The application is experiencing high latency. A Solutions Architect reviews the CloudWatch metrics and notices that the ALB's SurgeQueueLength is consistently high. What does this indicate, and how should the architect respond?

Accepted Answer

The ALB is buffering requests because the backend instances are overwhelmed; increase the number of instances or improve instance performance.. A high SurgeQueueLength means the ALB is receiving more requests than the healthy instances can handle, causing queuing. Option B is wrong because surge queue is for HTTP requests, not connections. Option C is wrong because it is not a client-side issue. Option D is wrong because the queue is at the ALB level, not instance level.

Answer

The backend instances are failing health checks; review the health check configuration.

Answer

Clients are sending too many requests; implement API rate limiting.

Answer

The ALB is experiencing a high number of new connections; increase the idle timeout setting.

Question 3

A company runs a multi-account AWS environment using AWS Organizations. The security team wants to ensure that all S3 buckets across all accounts are encrypted with AWS KMS. What is the MOST scalable and efficient way to enforce this policy?

Accepted Answer

Use an SCP that denies s3:PutBucketEncryption actions unless the encryption is set to aws:kms.. Using a service control policy (SCP) that denies s3:PutBucketEncryption unless the encryption is set to aws:kms is the most scalable and efficient way to enforce encryption across all accounts in an AWS Organization. SCPs are applied centrally and affect all accounts without requiring per-account configuration. Option A is less scalable because a periodic Lambda function may have delays and requires managing cross-account roles. Option C is per-account and requires Config rules and remediation in each account, which is less efficient. Option D only provides monitoring and alerting, not enforcement.

Answer

Use an AWS Lambda function that runs periodically across all accounts to check and remediate buckets.

Answer

Use AWS Config rules in each account to detect unencrypted buckets and trigger auto-remediation.

Answer

Use AWS CloudTrail to monitor PutBucketEncryption calls and alert the security team.

Question 4

A company is deploying a web application that uses an Application Load Balancer and an Auto Scaling group of EC2 instances. The application must be able to handle sudden spikes in traffic. Which TWO actions should the Solutions Architect take to improve scalability and reduce latency? (Choose two.)

Accepted Answer

Enable HTTP/2 on the Application Load Balancer.. Options A and D are correct. Option A: Enabling HTTP/2 on the ALB reduces latency through multiplexing and connection reuse. Option D: Using a predictive scaling policy helps prepare for traffic spikes by scaling based on forecasted demand. Option B is incorrect because increasing the cooldown period delays scaling response. Option C is incorrect because using larger instances is vertical scaling, which does not improve horizontal scalability and may increase cost. Option E is incorrect because increasing the health check interval delays detection of unhealthy instances.

Answer

Increase the default cooldown period for the Auto Scaling group.

Answer

Use larger EC2 instance types for the Auto Scaling group.

Answer

Increase the health check interval on the Application Load Balancer.

Question 5

A company runs a critical application on Amazon RDS for MySQL. The database size is 500 GB and growing. The application experiences high write latency during peak hours. A Solutions Architect needs to improve write performance with minimal downtime. Which THREE actions should the architect take? (Choose three.)

Accepted Answer

Migrate the database to Amazon Aurora with MySQL compatibility.. Migrating to Amazon Aurora (A) improves write performance because Aurora uses a distributed storage subsystem with better throughput and lower latency than standard RDS for MySQL. Changing the storage type to Provisioned IOPS (D) guarantees consistent low-latency I/O, directly improving write performance. Increasing allocated storage (E) increases the baseline IOPS for gp2 volumes, which can reduce write latency under high load. Option B (read replica) offloads read traffic but does not help write performance. Option C (Multi-AZ) provides high availability but does not improve write performance.

Answer

Add a read replica to offload read traffic.

Answer

Enable Multi-AZ deployment for the DB instance.

Question 6

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function takes too long to execute and frequently times out. The function downloads the entire file to /tmp before processing. Which TWO changes would improve performance? (Choose two.)

Accepted Answer

Modify the function to stream the file from S3 instead of downloading it entirely.. The correct answers are C and D. Option C (streaming the file from S3) reduces download time and eliminates the need to store the entire file in /tmp, directly improving performance by lowering I/O latency. Option D (increasing the Lambda timeout) provides more time for the function to complete processing, preventing timeouts. Option B (increasing memory) does not directly address the root cause of the timeout (slow file download), and its CPU benefit is secondary. Option A (reserved concurrency) affects scaling, not individual execution time. Option E (/tmp storage) is ephemeral and does not impact performance.

Answer

Increase the Lambda function's reserved concurrency.

Answer

Increase the memory allocation for the Lambda function.

Answer

Increase the /tmp storage limit for the Lambda function.

Question 7

A Solutions Architect runs the following command for an EC2 instance that is part of an Auto Scaling group. The instance is in a private subnet and should only receive traffic from an Application Load Balancer. However, the instance is accessible from the internet.

```
$ aws ec2 describe-instances --instance-id i-0abcd1234efgh5678
{
    "Reservations": [
        {
            "Instances": [
                {
                    "InstanceId": "i-0abcd1234efgh5678",
                    "SecurityGroups": [
                        {
                            "GroupName": "sg-web-app",
                            "GroupId": "sg-0123456789abcdef0"
                        }
                    ],
                    "PublicIpAddress": null,
                    "SubnetId": "subnet-12345678",
                    "VpcId": "vpc-23456789"
                }
            ]
        }
    ]
}
```

Based on the output, what is the most likely reason?

Accepted Answer

The security group attached to the instance allows inbound traffic from 0.0.0.0/0.. The output shows the instance has a security group 'sg-web-app' attached to its network interface. If that security group allows inbound traffic from 0.0.0.0/0, the instance would be accessible from the internet regardless of the subnet being private. The subnet's route table (Option A) having a route to an internet gateway would not matter for inbound traffic because the instance is in a private subnet and lacks a public IP; the ALB would handle inbound traffic via its public IP and forward to the private instance. Option B is incorrect because an Elastic IP would make the instance directly reachable from the internet, but the output does not show an Elastic IP. Option C is incorrect because the instance is in a private subnet and would not have a public IP assigned automatically.

Answer

The subnet's route table has a route to an internet gateway.

Answer

The instance has an Elastic IP address attached.

Answer

The instance has a public IP address assigned.

Question 8

A company runs a critical e-commerce platform on AWS. The application consists of an Application Load Balancer (ALB) that distributes traffic to an Auto Scaling group of EC2 instances running a web server. The web servers store session data locally on the instance's ephemeral storage. The Auto Scaling group is configured with a min of 2, max of 10, and desired of 2. Recently, during a flash sale, traffic surged and the Auto Scaling group scaled out to 10 instances. However, many users reported that their shopping carts were lost and they were logged out during the event. The Cognito user pool was used for authentication, and the application uses cookies to maintain session state. The ALB's stickiness is enabled. The team observed that the ALB's RequestCountPerTarget metric was well below the instance's capacity, but the error rate increased. The CloudWatch logs show that the web server returned 503 errors for a subset of requests. After the flash sale ended, the Auto Scaling group scaled back to 2 instances, and the issue disappeared. The team wants to prevent this from happening in future events. Which solution should the Solutions Architect recommend?

Accepted Answer

Modify the application to store session data in an Amazon ElastiCache for Redis cluster instead of local ephemeral storage.. The root cause is that session data stored on ephemeral storage is lost when instances are terminated or replaced. Even with ALB stickiness, if an instance is terminated (e.g., due to scaling in or health check failure), the session data is gone. Option C solves this by storing sessions externally in ElastiCache, which persists independently of EC2 instances, ensuring sessions survive scaling events. Option A would prevent scaling in but does not address data loss if instances become unhealthy or replaced. Option B would make the problem worse because without stickiness, requests could go to different instances, causing session loss even without termination. Option D only delays health checks and does not solve data loss.

Answer

Increase the minimum size of the Auto Scaling group to 10 to handle the surge without scaling down.

Answer

Disable stickiness on the ALB so that any instance can handle any request.

Answer

Increase the health check interval on the ALB to prevent instances from being marked unhealthy too quickly.

Question 9

A company has a multi-tier application running on AWS. The web tier uses an Application Load Balancer (ALB) with an Auto Scaling group of EC2 instances. The application tier runs on a separate Auto Scaling group of EC2 instances. The database tier uses Amazon RDS for MySQL. During a recent load test, the application became unresponsive. Monitoring showed that the database's CPU utilization was at 100% and the number of database connections was at the maximum limit. The application tier instances were healthy, but the web tier instances were returning 503 errors. The Solutions Architect determined that the application tier was making too many database connections because each request opened a new connection and did not close it properly. The team wants to fix the issue with minimal changes to the application code. Which solution should the Solutions Architect recommend?

Accepted Answer

Configure Amazon RDS Proxy to pool database connections from the application tier.. Amazon RDS Proxy provides connection pooling, allowing the application to reuse existing connections rather than opening new ones. This reduces the number of simultaneous connections to the database, alleviating CPU and connection limit pressure. It requires minimal code changes. Option A is incorrect because migrating to Aurora does not address the connection management problem; it may still require RDS Proxy. Option B is incorrect because increasing max_connections does not fix the root cause of unclosed connections and can lead to resource contention. Option C is incorrect because scaling the application tier horizontally would increase the number of connections, worsening the issue.

Answer

Migrate the database from RDS MySQL to Amazon Aurora MySQL with read replicas.

Answer

Increase the max_connections parameter in the RDS parameter group to allow more connections.

Answer

Scale the application tier horizontally by increasing the desired capacity of the Auto Scaling group.

Question 10

A company runs a batch processing job on a schedule using AWS Lambda. The job processes files from an S3 bucket and writes results to another S3 bucket. Recently, the job has been failing with the error 'Access Denied' when trying to write to the destination bucket. The Lambda function's execution role has the following IAM policy attached:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject",
                "s3:ListBucket"
            ],
            "Resource": [
                "arn:aws:s3:::source-bucket/*",
                "arn:aws:s3:::source-bucket"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::destination-bucket/*"
        }
    ]
}

The Lambda function also has a VPC configuration to access an RDS instance. The S3 buckets are in the same region. The Solutions Architect verified that the destination bucket policy does not deny access. What is the MOST likely cause of the 'Access Denied' error?

Accepted Answer

The Lambda function is in a VPC without an S3 VPC endpoint, so it cannot reach S3.. The Lambda function is attached to a VPC and does not have an S3 VPC endpoint. When a Lambda function is configured to access a VPC, it loses public internet connectivity unless a NAT gateway or VPC endpoints are provided. Without an S3 VPC endpoint (gateway type) in the VPC, the function cannot reach the S3 API, causing PutObject calls to fail with 'Access Denied' (even though the IAM policy allows it). Option B is incorrect because the IAM policy allows s3:GetObject and s3:ListBucket on the source bucket, and the error is on write to the destination bucket. Option C is incorrect because the IAM policy explicitly allows s3:PutObject on the destination bucket. Option D is incorrect because the destination bucket policy does not deny access, as stated in the question.

Answer

The Lambda function does not have permissions to read from the source bucket.

Answer

The IAM policy does not allow s3:PutObject on the destination bucket.

Answer

The destination bucket policy denies the Lambda function's access.

Question 11

A company runs a production application on Amazon EC2 instances behind an Application Load Balancer. Recently, error rates increased due to a misconfiguration. The operations team wants to automatically roll back to the previous working configuration if errors exceed a threshold. Which solution provides the fastest rollback?

Accepted Answer

Implement AWS CodeDeploy with automatic rollback triggered by CloudWatch alarms.. AWS CodeDeploy supports automatic rollback based on CloudWatch alarm thresholds, providing the fastest rollback by reverting to the previous working deployment revision automatically. Option A is incorrect because manually restoring AMI snapshots is slow and error-prone. Option B is incorrect because AWS Elastic Beanstalk with rolling updates and health checks can perform rollbacks, but it is slower and less granular than CodeDeploy’s immediate alarm-based rollback. Option C is incorrect because AWS CloudFormation stack policies prevent updates and do not facilitate automatic rollback of the application deployment.

Answer

Manually restore AMI snapshots of the previous deployment.

Answer

Use AWS Elastic Beanstalk with rolling updates and health checks.

Answer

Use AWS CloudFormation with a stack policy to prevent updates.

Question 12

A company uses AWS Lambda functions to process events from Amazon SQS. The function's duration has increased, causing a backlog. The team wants to improve throughput without changing the function code. Which action should the team take?

Accepted Answer

Increase the Lambda function reserved concurrency.. Increasing the number of Lambda function instances will increase concurrency and process more messages in parallel. Option A is wrong because increasing batch size may cause timeouts. Option C is wrong because increasing function memory/timeout does not directly improve throughput. Option D is wrong because SQS visibility timeout does not affect Lambda concurrency.

Answer

Increase the SQS visibility timeout to allow more time per message.

Answer

Increase the Lambda function memory and timeout settings.

Answer

Increase the SQS batch size to the maximum of 100.

Question 13

A company is migrating a monolithic application to microservices on AWS. They want to implement a continuous improvement process for existing services. Which AWS service should they use to collect and analyze operational metrics and logs from all microservices in a centralized location?

Accepted Answer

Amazon CloudWatch. Amazon CloudWatch provides centralized monitoring of metrics and logs from all microservices. Option A is wrong because AWS Config tracks configuration changes and compliance, not operational metrics. Option B is wrong because Amazon Inspector performs automated security assessments, not log/metrics collection. Option D is wrong because AWS X-Ray is used for tracing requests across services, not for centralized log and metric analysis.

Answer

AWS Config

Answer

Amazon Inspector

Answer

AWS X-Ray

Question 14

A company uses Amazon RDS for MySQL with Multi-AZ deployment. The database experiences occasional read replica lag of up to 5 seconds. The application requires read-after-write consistency. Which action should the company take to improve the solution?

Accepted Answer

Modify the application to always read from the primary instance.. Reading from the primary instance ensures read-after-write consistency. Since the application requires strong consistency, all reads must be directed to the primary, as read replicas may have lag. Option B is incorrect because increasing the number of read replicas does not reduce replication lag. Option C is incorrect because Amazon ElastiCache is a caching layer, not a solution for consistency. Option D is incorrect because Amazon RDS Proxy helps manage connections but does not eliminate read replica lag.

Answer

Increase the number of read replicas to distribute the load.

Answer

Implement Amazon ElastiCache to cache read results.

Answer

Use Amazon RDS Proxy to route read queries to the read replica.

Question 15

A company is using AWS Lambda functions behind an Amazon API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. Recently, the company has observed increased latency and occasional 5xx errors from the API. The operations team wants to implement continuous improvements. Which TWO actions should be taken to improve performance and reliability? (Choose 2)

Accepted Answer

Enable API Gateway caching with a TTL of 60 seconds.. Enabling API Gateway caching reduces load on Lambda and DynamoDB for repeated requests, improving latency and reducing errors. Option E: Enabling DynamoDB auto scaling adjusts capacity based on traffic patterns, reducing throttling-related 5xx errors. Option A (Lambda reserved concurrency) limits concurrency and could worsen throttling. Option B (provisioned concurrency) helps with cold starts but does not address DynamoDB throttling. Option D (increasing Lambda timeout) may mask underlying issues without resolving root causes.

Answer

Set Lambda reserved concurrency to 5 for each function.

Answer

Configure provisioned concurrency for all Lambda functions.

Answer

Increase the Lambda function timeout to 30 seconds.