SAP-C02 Continuous Improvement for Existing Solutions Practice Test 3 — 15 Questions

Question 1

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

Accepted Answer

ECS tasks are being replaced by the service scheduler during deployments or health checks.. Option B is correct because Fargate tasks are ephemeral; they can be replaced due to deployments or health checks, causing loss of local session data. Option A is wrong because ALB sticky sessions are irrelevant if the container itself is replaced. Option C is wrong because scaling out does not cause individual container replacement. Option D is wrong because the issue is about session persistence, not security groups.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS service is configured to scale out, causing new tasks to be created without existing session data.

Answer

The Application Load Balancer is not configured with sticky sessions.

Question 2

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally capture all VPC flow logs for analysis in Amazon Athena. What is the MOST cost-effective way to store the flow logs?

Accepted Answer

Publish VPC Flow Logs to an Amazon S3 bucket with S3 Intelligent-Tiering enabled.. Option A is correct because VPC Flow Logs can be published directly to S3, and using S3 Intelligent-Tiering optimizes costs for logs that may be accessed infrequently. Option B is wrong because CloudWatch Logs is more expensive for long-term storage. Option C is wrong because Kinesis Data Firehose adds cost and complexity. Option D is wrong because it duplicates storage.

Answer

Publish VPC Flow Logs to both CloudWatch Logs and S3 for redundancy.

Answer

Use Amazon Kinesis Data Firehose to stream flow logs to an S3 bucket.

Answer

Publish VPC Flow Logs to Amazon CloudWatch Logs and export them to S3 after 30 days.

Question 3

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS for MySQL database. The stack creation fails with the error 'The following resource(s) failed to create: [DBInstance]'. The solutions architect needs to troubleshoot the issue. Which approach should be taken first?

Accepted Answer

Review the CloudFormation stack events in the AWS Management Console.. Option B is correct because CloudFormation logs events that include detailed status reasons for resource failures. Option A is wrong because RDS events might not capture the specific CloudFormation-related failure. Option C is wrong because deleting the stack is premature without understanding the cause. Option D is wrong because CloudTrail logs API calls, but the failure reason is in CloudFormation events.

Answer

Check the RDS console for any database events.

Answer

Delete the stack and deploy again with the same parameters.

Answer

Use AWS CloudTrail to view the CreateStack API call.

Question 4

A company uses Amazon ElastiCache for Redis to cache frequently accessed data. The cache cluster is a single node (cache.r5.large). Over time, the cache hit ratio has decreased, and the CPU utilization is consistently above 80%. What should a solutions architect do to improve performance?

Accepted Answer

Enable cluster mode and distribute the cache across multiple shards.. Option D is correct because moving to a cluster mode enabled configuration distributes data across multiple shards, reducing CPU load and improving hit ratio. Option A is wrong because simply increasing instance size may help temporarily but doesn't address architectural issues. Option B is wrong because read replicas are for read scaling, not reducing CPU on the primary. Option C is wrong because TTL reduction may increase misses.

Answer

Reduce the Time-to-Live (TTL) of cached objects.

Answer

Add a read replica to offload read traffic.

Answer

Scale up to a larger node type, such as cache.r5.xlarge.

Question 5

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

Accepted Answer

Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.. Option A is correct because using S3 default encryption with an AWS KMS CMK and enabling automatic key rotation meets the requirement. Option B is wrong because SSE-S3 uses Amazon S3-managed keys, not KMS. Option C is wrong because SSE-C uses customer-provided keys, not KMS. Option D is wrong because client-side encryption does not use S3 server-side encryption.

Answer

Use SSE-S3 (Amazon S3-managed keys) and rely on S3's automatic key rotation.

Answer

Use SSE-C (customer-provided keys) and manage key rotation manually.

Answer

Use client-side encryption with a KMS CMK and upload the encrypted data.

Question 6

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application stores session data locally on the instances. The company wants to improve availability and scalability. What should a solutions architect recommend?

Accepted Answer

Move session state to Amazon ElastiCache and make the application stateless.. Option C is correct because moving session state to ElastiCache makes the application stateless, allowing instances to be added/removed without session loss. Option A is wrong because Auto Scaling without session management will cause session loss. Option B is wrong because sticky sessions alone don't prevent loss if an instance fails. Option D is wrong because increasing instance size doesn't improve scalability.

Answer

Use Auto Scaling to add more EC2 instances.

Answer

Enable sticky sessions on the ALB.

Answer

Use larger EC2 instances to handle more sessions.

Question 7

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. Option D is correct because DynamoDB Auto Scaling adjusts capacity based on actual usage, reducing throttling. Option A is wrong because changing to on-demand is a valid solution but may be more expensive; Auto Scaling is more cost-effective if usage is predictable. Option B is wrong because DAX is a cache for reads, not writes. Option C is wrong because increasing read capacity doesn't help write throttling.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 8

A company is using AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'CreateAccessKey' API call and sends an SNS notification.. Option A is correct because CloudWatch Events (now Amazon EventBridge) can match IAM CreateAccessKey events and trigger a notification. Option B is wrong because S3 events are for object-level operations, not API calls. Option C is wrong because CloudTrail logs events but doesn't natively send alerts. Option D is wrong because Config rules evaluate resource configurations, not API calls.

Answer

Configure an S3 event notification on the CloudTrail log bucket to trigger a Lambda function.

Answer

Set up a CloudTrail trail with log file validation enabled.

Answer

Use AWS Config to create a rule that checks for access keys.

Question 9

A company runs a web application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer. The operations team notices that the ALB returns 503 errors during peak traffic. Which TWO actions should the solutions architect take to resolve this issue?

Accepted Answer

Enable ECS service Auto Scaling to automatically adjust the number of tasks.. Options B and D are correct. 503 errors from ALB indicate the target group has no healthy targets. Checking ECS service events (B) can reveal why tasks are unhealthy. Enabling ECS service Auto Scaling (D) will increase the number of tasks to handle traffic. Option A is wrong because increasing ALB idle timeout does not affect health. Option C is wrong because increasing deregistration delay might help but is not a primary fix. Option E is wrong because increasing task memory might not solve the health issue if it's due to capacity.

Answer

Increase the idle timeout on the ALB.

Answer

Increase the deregistration delay on the target group.

Answer

Increase the task memory allocation in the task definition.

Question 10

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store processed file IDs and check for duplicates before processing.. Options B and D are correct. Using a DynamoDB table to track processed file IDs (B) allows the function to skip duplicates. Enabling S3 event notifications with a prefix and suffix filter (D) reduces the chance of multiple events for the same object. Option A is wrong because increasing Lambda timeout doesn't prevent multiple invocations. Option C is wrong because SQS can help but needs deduplication logic as well. Option E is wrong because S3 Transfer Acceleration is for faster uploads, not idempotency.

Answer

Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 11

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Accepted Answer

Create a read replica from the source DB instance.. Options A, B, and D are correct. Create a read replica (A) from the source DB instance. Modify the application to use the read replica endpoint for read queries (B). Ensure the read replica is in a different AZ for high availability (D). Option C is wrong because read replicas do not need to be in the same AZ. Option E is wrong because Multi-AZ is for the source instance, not the read replica.

Answer

Ensure the read replica is in the same Availability Zone as the primary.

Answer

Enable Multi-AZ on the read replica.

Question 12

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

Accepted Answer

The upload request does not include the 'x-amz-acl' header with value 'bucket-owner-full-control'.. Option B is correct. The policy requires the x-amz-acl header to be set to 'bucket-owner-full-control', but the user likely did not include that header. Option A is wrong because the policy allows s3:PutObject. Option C is wrong because the resource is the bucket ARN. Option D is wrong because the bucket policy is not shown, but the IAM policy is correct.

Answer

The resource ARN in the policy is incorrect; it should include the bucket name only.

Answer

The bucket policy in Account B denies the upload.

Answer

The IAM user does not have permission to call s3:PutObject.

Question 13

A solutions architect runs the above commands for an EC2 instance. The instance state is 'running' but the system status is 'impaired'. What should the solutions architect do to restore the instance?

Accepted Answer

Stop and start the instance.. Option C is correct. AWS recommends stopping and starting the instance to move it to new underlying hardware when system status checks fail. Option A is wrong because the instance is already running. Option B is wrong because reboot may not resolve hardware issues. Option D is wrong because changing instance type does not fix underlying hardware impairment.

Answer

Start the instance.

Answer

Modify the instance type.

Answer

Reboot the instance.

Question 14

A solutions architect deployed the above CloudFormation template. However, the Lambda function is not triggered when objects are uploaded to the S3 bucket. What is the most likely cause?

Accepted Answer

The Lambda function lacks a resource-based policy that allows S3 to invoke it.. Option D is correct. The Lambda function's resource-based policy must allow S3 to invoke it. The template does not add any resource-based policy. Option A is wrong because the bucket notification is configured. Option B is wrong because the role allows CloudWatch Logs. Option C is wrong because the Lambda function code does not need to read S3 for the trigger to work.

Answer

The BucketNotification resource depends on MyLambdaFunction, but the notification configuration is incorrect.

Answer

The Lambda execution role does not have permission to access S3.

Answer

The Lambda function code does not read the S3 object content.

Question 15

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

Accepted Answer

Decrease the cooldown period and set a lower CPU utilization threshold for scale-out. Option B is correct because increasing the target CPU utilization threshold and decreasing the cooldown period may cause more aggressive scaling but does not address the 5-minute startup lag. Predictive scaling (C) is proactive but still has the same startup delay. Option D (pre-warming) is not a standard AWS feature. Option A is correct because using a scheduled scaling policy to add instances before known peak hours can pre-empt the startup delay for predictable traffic patterns. However, the question asks for MOST effective; if traffic spikes are unpredictable, using a larger instance type (E) would reduce per-instance CPU but increase cost. The best answer is to reduce the cooldown period and set a lower CPU threshold (B) but that still has lag. Actually, the best is to use a weighted target group with EC2 instances in a warm pool that are already registered with the ALB but not serving traffic until needed. Since warm pools are not an option, the correct answer is to use a step scaling policy with a lower scale-out threshold and reduce the health check grace period to speed up instance registration. But among given options, B is best because it triggers scale-out earlier and reduces the time to reach desired capacity. Reviewing: A is scheduled, not reactive; B reduces cooldown and threshold; C is predictive; D is not a thing; E changes instance type. Correct: B.

Answer

Use a scheduled scaling policy to add instances before expected peak times

Answer

Pre-warm the load balancer to reduce latency

Answer

Switch to predictive scaling