SAP-C02 Continuous Improvement for Existing Solutions Practice Test 3 — 15 Questions

Question 1

A company is running a web application on EC2 instances in an Auto Scaling group behind an ALB. The application uses an Amazon RDS for MySQL database. Recently, the application has become slow, and the operations team identifies that the database is the bottleneck due to a high number of read queries. Which TWO actions should a solutions architect take to improve read performance? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add an Amazon RDS Read Replica in the same AWS Region.. Adding an Amazon RDS Read Replica offloads read traffic from the primary MySQL database, allowing read queries to be served by the replica and reducing load on the source instance. This directly addresses the high number of read queries causing the bottleneck, as read replicas are designed for read-heavy workloads and can be promoted to a standalone instance if needed.

Answer

Enable Multi-AZ for the RDS instance.

Answer

Implement DynamoDB Accelerator (DAX) in front of the database.

Answer

Scale up the RDS instance to a larger instance type.

Question 2

A company is deploying a new application on AWS and wants to implement a least-privilege IAM policy for an EC2 instance that needs to read from an S3 bucket (my-bucket) and write logs to CloudWatch Logs. Which TWO statements should be included in the IAM policy? (Choose two.)

Accepted Answer

{"Effect": "Allow", "Action": ["s3:GetObject"], "Resource": "arn:aws:s3:::my-bucket/*"}. The correct answers are A and C. Option A grants s3:GetObject on the S3 bucket objects, allowing the EC2 instance to read data from the bucket. Option C grants the necessary permissions to create log streams and put log events to a specific CloudWatch Logs log group, enabling logging. These two statements adhere to least-privilege by scoping to the exact actions and resources needed. Option E (s3:PutObject) is not required because the stem only specifies reading from S3; including it would violate the least-privilege principle. Options B and D are incorrect because B uses a wildcard action (s3:*) and D uses a wildcard resource, both of which are too broad and not scoped.

Answer

{"Effect": "Allow", "Action": ["s3:*"], "Resource": "arn:aws:s3:::my-bucket/*"}

Answer

{"Effect": "Allow", "Action": ["logs:PutLogEvents"], "Resource": "*"}

Answer

{"Effect": "Allow", "Action": ["s3:PutObject"], "Resource": "arn:aws:s3:::my-bucket/*"}

Question 3

An IAM policy is attached to a group. A user in the group tries to terminate an EC2 instance in us-east-1 using the AWS CLI. What will happen?

Accepted Answer

The user can describe instances but cannot terminate instances in any region.. The IAM policy attached to the group allows the user to describe instances (ec2:DescribeInstances) but explicitly denies the ability to terminate instances (ec2:TerminateInstances) in any region. Since the policy is attached to the group, the user inherits these permissions, so they can list instances but any attempt to terminate them will be denied by AWS IAM, regardless of the region specified.

Answer

The user cannot describe instances or terminate instances.

Answer

The user can terminate instances and describe instances.

Answer

The user can describe instances but cannot terminate any instances.

Question 4

A solutions architect runs the command shown in the exhibit. Which statement is true about the output?

Accepted Answer

The command displays the instance ID, instance type, and launch time of three running instances.. The command `aws ec2 describe-instances --query 'Reservations[].Instances[?State.Name==`running`].[InstanceId,InstanceType,LaunchTime]' --output table` filters for running instances and projects only the InstanceId, InstanceType, and LaunchTime fields. The output shows three rows, each representing a running instance with those three attributes. Therefore, option B is correct because it accurately describes the displayed data.

Answer

There are two instances with the Environment=production tag.

Answer

One of the instances is stopped.

Answer

The command lists all instances in the account regardless of tags.

Question 5

A company uses AWS CloudFormation to manage its infrastructure. The operations team reports that stack updates often fail because of resource conflicts. The team wants to improve the reliability of updates without manual intervention. Which solution provides the MOST automated recovery from update failures?

Accepted Answer

Use the default CloudFormation rollback behavior that automatically reverts changes on failure.. CloudFormation's built-in rollback behavior automatically reverts all changes made during a failed stack update, restoring the stack to its last known stable state without requiring any custom code or manual intervention. This provides the most automated recovery mechanism as it is natively integrated into the CloudFormation service and requires no additional infrastructure or scripting.

Answer

Use CloudFormation change sets to review and approve all changes before update.

Answer

Write a custom AWS Lambda function that reverts changes when a stack update fails.

Answer

Apply a stack policy to prevent updates to critical resources.

Question 6

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon RDS MySQL Multi-AZ DB instance. During a recent load test, the application became unresponsive for several minutes. The monitoring shows that the RDS instance CPU utilization spiked to 100% during the test. The application reads and writes to the same database. Which design change would provide the BEST improvement in database scalability and reduce CPU contention?

Accepted Answer

Create RDS read replicas for the DB instance and route read queries from the application to the replicas.. Creating RDS read replicas offloads read queries from the primary DB instance, reducing CPU contention from read-heavy workloads. Since the application reads and writes to the same database, directing read traffic to replicas decreases the primary instance's CPU utilization, directly addressing the 100% CPU spike observed during the load test. This improves database scalability by distributing read operations horizontally without altering write capacity.

Answer

Configure an in-memory cache like Amazon ElastiCache to cache frequent queries.

Answer

Increase the instance size of the RDS DB instance to a larger instance type.

Answer

Enable Multi-AZ for the RDS instance to distribute the load across two instances.

Question 7

A company uses AWS CodePipeline to automate deployments of a microservices application to Amazon ECS. The pipeline builds a Docker image, pushes it to Amazon ECR, and updates the ECS service. Recently, deployments have failed because insufficient IAM permissions cause the pipeline to fail when updating the ECS service. The development team wants to implement least privilege permissions. Which IAM policy statement should be added to the CodePipeline service role to allow it to update the ECS service?

Accepted Answer

{"Effect":"Allow","Action":["ecs:UpdateService"],"Resource":"*"}. The CodePipeline service role needs the ecs:UpdateService permission to trigger an ECS service update after a new Docker image is pushed to Amazon ECR. This action allows the pipeline to instruct ECS to redeploy the service using the updated task definition, which is the specific step that was failing due to insufficient permissions. The resource wildcard is acceptable here because the pipeline role is scoped by the pipeline's own trust policy and resource-based policies on the ECS service.

Answer

{"Effect":"Allow","Action":["ecr:PutImage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RunTask"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["ecs:RegisterTaskDefinition"],"Resource":"*"}

Question 8

A company is using an AWS Lambda function to process records from an Amazon Kinesis stream. The function stores results in an Amazon DynamoDB table. The team notices that the Lambda function sometimes fails due to throttling from DynamoDB. Which TWO actions should the team take to improve the continuous processing of records? (Choose TWO.)

Accepted Answer

Switch the DynamoDB table to on-demand capacity mode.. Switching the DynamoDB table to on-demand capacity mode eliminates the need to provision read/write capacity, allowing the table to automatically scale to handle any throttling caused by sudden spikes in Lambda writes. This directly addresses the throttling issue without requiring manual capacity management.

Answer

Increase the number of shards in the Kinesis stream to reduce data per Lambda invocation.

Answer

Configure reserved concurrency for the Lambda function to limit its maximum concurrency.

Answer

Increase the concurrency limit for the Lambda function to allow more parallel executions.

Question 9

An e-commerce company runs its application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application uses an Amazon Aurora MySQL DB cluster with one writer and two reader instances. During a sales event, the database CPU utilization is high, and read replicas show high replica lag. The company needs to improve the read scalability and reduce replica lag. Which THREE actions should the company take? (Choose THREE.)

Accepted Answer

Add more reader instances to the cluster to distribute the read traffic.. Adding more reader instances (Option A) distributes the read workload across additional nodes, reducing the load on each reader and helping to lower replica lag. Aurora Auto Scaling (Option E) automatically adjusts the number of reader instances based on metrics like CPU utilization or replica lag, providing dynamic scaling during traffic spikes. Increasing the instance size of reader instances (Option D) provides more CPU and memory resources to each reader, enabling them to process more read queries and apply changes from the writer faster, which directly reduces replica lag.

Answer

Enable Multi-AZ for the cluster to improve read availability.

Answer

Increase the instance size of the writer instance to improve write throughput.

Question 10

A company runs a critical web application on Amazon EC2 instances in an Auto Scaling group behind an Application Load Balancer (ALB). The application stores session state in an Amazon ElastiCache for Redis cluster. Recently, the operations team noticed that during traffic spikes, the ALB returns 5xx errors and the application becomes slow. CloudWatch metrics show that the Redis cluster's CPU utilization reaches 100% and memory usage is high. The Auto Scaling group scales out, but the new instances take several minutes to warm up and become healthy. The company needs to improve the application's ability to handle traffic spikes with minimal impact on performance. Which solution should the company implement?

Accepted Answer

Enable cluster mode for the Redis cluster and add more shards.. Enabling cluster mode for the Redis cluster and adding more shards horizontally partitions the data across multiple nodes, distributing both CPU and memory load. This directly addresses the 100% CPU and high memory utilization during traffic spikes, allowing the cluster to handle more concurrent requests without performance degradation. Cluster mode also provides linear scalability, which is essential for a critical web application experiencing variable traffic.

Answer

Configure ElastiCache Auto Scaling to automatically add nodes when CPU utilization exceeds 75%.

Answer

Enable Multi-AZ replication for the Redis cluster.

Answer

Increase the instance size of the Redis cluster to a larger node type.

Question 11

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application experiences intermittent latency spikes. The operations team has enabled detailed CloudWatch metrics and EC2 instance status checks. The team needs to identify the root cause of the latency. Which TWO actions should the team take to diagnose the issue? (Choose two.)

Accepted Answer

Set up an Amazon CloudWatch Synthetics canary that follows a step-by-step guide through the application and monitor the step durations.. CloudWatch Synthetics canaries simulate user workflows step by step, and monitoring step durations helps pinpoint which specific part of the application is causing latency spikes. This provides granular, end-to-end visibility into the user experience beyond what aggregate metrics offer. Option D is correct because ALB access logs contain detailed information about each request, including timestamps, processing times, and response times. Analyzing these logs can help identify specific requests that contribute to high latency, such as those with long target response times or backend errors.

Answer

Enable detailed monitoring (1-minute metrics) on the ALB and create a CloudWatch dashboard to view the RequestCount and TargetResponseTime metrics.

Answer

Integrate the application with AWS X-Ray and enable tracing on the EC2 instances to capture trace data for all requests.

Answer

Enable VPC Flow Logs on the subnets where the EC2 instances reside and analyze the logs for packet loss.

Question 12

Refer to the exhibit. A company uses this IAM policy to allow an automation script to manage Amazon EBS snapshots. The script runs on an EC2 instance with this attached IAM role. The script is failing when trying to create a snapshot from a volume and tag it. The error message indicates an authorization failure. What is the root cause?

Accepted Answer

The policy does not grant permission to call ec2:CreateSnapshot on the volume resource.. The error occurs because the IAM policy grants `ec2:CreateSnapshot` only on the `arn:aws:ec2:*::snapshot/*` resource, but the API call to create a snapshot also requires permission on the source volume resource (`arn:aws:ec2:*:*:volume/*`). Without that volume-level permission, the request fails with an authorization error, even though the snapshot-level permission is present.

Answer

The policy does not grant permission to call ec2:DescribeSnapshots, which is required before creating a snapshot.

Answer

The policy lacks a condition key to restrict the snapshot creation to specific volumes.

Answer

The policy does not include ec2:CreateTags for the volume, only for snapshots.

Question 13

A company runs a containerized microservices application on Amazon ECS with Fargate launch type. The application consists of a frontend service and a backend service. The backend service is CPU-intensive and experiences high load during business hours. The operations team observes that the frontend service sometimes returns 503 errors during peak load. The team has already configured an ECS service auto scaling policy for the backend service based on average CPU utilization with a target value of 70%. The backend service is currently running 4 tasks, and the frontend is running 2 tasks. The errors seem to correlate with the backend scaling up. Which solution should the team implement to improve the application's performance and reduce errors?

Accepted Answer

Update the backend service auto scaling policy to use a combination of CPU and memory utilization metrics with a step scaling policy, and increase the cooldown period to allow tasks to stabilize before additional scaling actions.. The 503 errors during backend scale-up are likely caused by the backend tasks not being fully ready to handle traffic immediately after launch. By using a combination of CPU and memory utilization metrics with a step scaling policy, the team can make scaling decisions more responsive to actual load patterns. Increasing the cooldown period prevents additional scaling actions from being triggered prematurely, giving new tasks time to stabilize and reducing the window where the backend is overwhelmed, which in turn reduces frontend timeouts.

Answer

Reduce the target CPU utilization for the backend auto scaling policy from 70% to 50% to trigger scaling earlier and keep CPU lower.

Answer

Change the backend service from Fargate to EC2 launch type and use larger instance types to provide more CPU capacity.

Answer

Increase the desired count of the frontend service to 4 tasks to handle more requests and reduce the load on the backend service.

Question 14

Drag and drop the steps to troubleshoot an EC2 instance that is unreachable via SSH in the correct order.

Accepted Answer

Check security groups, then network ACLs, then public IP, then system status, then console output.. Start with security groups, then network ACLs, then public IP, then system status, and finally console output.

Answer

Check network ACLs, then security groups, then public IP, then system status, then console output.

Answer

Check public IP, then security groups, then network ACLs, then console output, then system status.

Answer

Check system status, then console output, then security groups, then network ACLs, then public IP.

Question 15

Drag and drop the steps to deploy a serverless application using AWS SAM in the correct order.

Accepted Answer

Write the AWS SAM template, then build, then package, then deploy, then test.. The correct order for deploying a serverless application with AWS SAM is to first write the SAM template (defining resources and configuration), then build the application (compiling code and dependencies), then package the built artifacts (uploading to S3), then deploy the stack (using CloudFormation), and finally test the deployed application to ensure it works as expected. Common mistakes include swapping build and package, writing the template after building, or deploying before packaging, which lead to errors or incomplete deployments.

Answer

Write the AWS SAM template, then package, then build, then deploy, then test.

Answer

Build, then write the AWS SAM template, then package, then deploy, then test.

Answer

Write the AWS SAM template, then build, then deploy, then package, then test.