SAP-C02 Continuous Improvement for Existing Solutions Practice Test 3 — 15 Questions

Question 1

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The health check target path or port is misconfigured.. The most likely cause of instances becoming unhealthy and being replaced, while users experience errors, is a misconfigured health check target path or port. If the ALB health check is pointing to the wrong path or port, instances may be marked unhealthy even if the application is running, leading to unnecessary replacements and errors during the transition.

Answer

The EC2 instances are of a burstable performance type.

Answer

The Auto Scaling group's minimum size is too small.

Answer

The health check interval is too long.

Question 2

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

Accepted Answer

Add a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. An S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not present enforces encryption for all new objects. Option A is wrong because Amazon CloudFront enforces HTTPS for data in transit, not server-side encryption at rest. Option B is wrong because enabling S3 default encryption encrypts objects that do not specify encryption, but it does not deny uploads without encryption headers; objects can still be uploaded without explicitly setting encryption. Option C is wrong because pre-signed URLs provide temporary access but do not enforce encryption requirements.

Answer

Use Amazon CloudFront to enforce HTTPS.

Answer

Enable S3 default encryption on the bucket.

Answer

Require pre-signed URLs for all uploads.

Question 3

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They want to improve performance and reduce costs. Which THREE actions should they take? (Choose THREE.)

Accepted Answer

Enable Lambda Provisioned Concurrency for the function.. Option A is correct because Lambda Provisioned Concurrency pre-initializes execution environments so invocations avoid cold-start latency, which improves performance for latency-sensitive serverless APIs. Option C is correct because DynamoDB Accelerator (DAX) is an in-memory cache for DynamoDB that serves eventually consistent reads in microseconds and reduces read load on the table, improving performance and lowering read capacity costs for read-heavy workloads. Option D is correct because API Gateway caching stores endpoint responses in a stage cache with a configurable TTL, reducing the number of Lambda invocations and DynamoDB calls, which both lowers cost and improves response latency. Option B is not marked correct because on-demand capacity mode is primarily a capacity-management choice that removes provisioning, but it does not by itself improve performance or reduce cost compared with a well-sized provisioned table. Option E is not marked correct because increasing the Lambda timeout to 5 minutes does not improve performance and can increase cost by allowing functions to run longer before failing.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Increase the Lambda function timeout to 5 minutes.

Question 4

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create one or more read replicas in the same Region.. Option B is correct because Amazon RDS for PostgreSQL read replicas use PostgreSQL's asynchronous streaming replication to create read-only copies of the primary instance, allowing read-heavy query traffic to be offloaded from the primary and thereby reducing its CPU utilization. Option E is correct because RDS Proxy pools and shares database connections to the primary instance, which reduces the CPU and memory overhead associated with connection establishment and management, improving performance under high connection churn. Option A is not correct because Multi-AZ is a high-availability feature that maintains a synchronous standby for failover, not a mechanism to serve read traffic. Option C is not correct because vertically scaling the primary instance increases capacity but does not offload read traffic, and it may not address the root cause cost-effectively. Option D is not correct because ElastiCache caches application-level query results and requires code changes, and it is not an RDS-native read-offloading feature for PostgreSQL.

Answer

Enable Multi-AZ deployment for the database.

Answer

Increase the instance size of the primary database.

Answer

Use Amazon ElastiCache to cache query results.

Question 5

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. The operations team notices that the ALB is returning a high number of 504 errors during peak hours. Which configuration change is MOST likely to reduce the 504 errors?

Accepted Answer

Increase the idle timeout setting on the ALB.. ALB 504 errors occur when the load balancer's connection to the target times out — the target did not respond within the ALB's idle timeout. Increasing the idle timeout gives backend instances more time to process long-running requests and return a response, reducing 504s during peak hours when processing is slower. This is the most direct configuration change to address 504s caused by slow backends.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the health check interval for the target group.

Answer

Increase the deregistration delay on the target group.

Question 6

A company uses AWS Lambda to process events from an Amazon SQS queue. The Lambda function is invoked with a batch size of 10. Recently, the function started failing with timeout errors when processing large batches. Which solution would improve the reliability of event processing without losing messages?

Accepted Answer

Reduce the batch size to a smaller value, such as 5.. Reducing the batch size decreases the number of messages processed per invocation, which reduces the total processing time and helps avoid timeouts. Option A is incorrect because increasing the visibility timeout does not reduce the processing time within the function; it only prevents messages from becoming visible again before the function finishes. Option B is incorrect because increasing reserved concurrency increases the number of concurrent invocations but does not affect the processing time of a single invocation. Option C is incorrect because increasing the function timeout to 15 minutes may allow the function to complete, but it does not address the root cause of long processing times and could lead to higher costs and delayed processing; reducing the batch size is a more targeted solution.

Answer

Increase the SQS queue visibility timeout to match the function timeout.

Answer

Increase the Lambda function reserved concurrency to handle more invocations.

Answer

Increase the Lambda function timeout to the maximum 15 minutes.

Question 7

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

Accepted Answer

Create an Aurora read replica and direct read queries to it.. Creating an Aurora read replica offloads read queries from the primary DB instance, reducing CPU load on it. Option C is correct because implementing an ElastiCache for Redis caching layer reduces the number of repeated read queries hitting the database, further lowering CPU utilization. Option B is wrong: while increasing the DB instance class could provide more CPU resources, it does not reduce load—it only scales up, which is not a best practice for immediate load reduction without code changes. Option D is wrong because Performance Insights is a monitoring tool for identifying performance bottlenecks, not a direct mechanism to reduce database load. Option E is wrong because increasing the Auto Scaling group size only scales the application tier, which would increase traffic to the database, worsening the CPU issue.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Amazon RDS Performance Insights to identify slow queries.

Answer

Increase the Auto Scaling group maximum size to handle more traffic.

Question 8

A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)

Accepted Answer

Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.. A service control policy (SCP) can deny PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled, preventing disabling of encryption at the bucket level. Option D is correct because AWS Config managed rule s3-bucket-server-side-encryption-enabled can detect S3 buckets that lack server-side encryption. Option E is correct because enabling default encryption on all S3 buckets ensures that new objects are automatically encrypted. Option A is incorrect because while an S3 bucket policy can enforce encryption on uploads, it does not enforce encryption on existing objects and must be applied per bucket; moreover, it is not an organization-wide enforcement mechanism. Option C is incorrect because AWS CloudTrail only logs API calls and does not enforce encryption; it can alert but does not remediate.

Answer

Apply an S3 bucket policy on each bucket that denies PutObject without encryption.

Answer

Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.

Question 9

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use a launch template with a pre-provisioned AMI that includes the application and dependencies.. Option D is correct because using a launch template with a pre-provisioned AMI that already contains the application and its dependencies eliminates the time-consuming bootstrap/installation steps that currently make new instances take several minutes to become healthy, so instances can pass health checks and serve traffic much faster. Option E is correct because a scheduled scaling policy proactively adds instances before predictable traffic spikes, so capacity is already in place when the load arrives rather than reacting after degradation begins. Option A is incorrect because increasing the cooldown period only delays subsequent scaling actions and makes the group less responsive, not more. Option B is incorrect because shortening the target group health check interval only speeds up health status detection; it does not address the several-minute application startup time that is the actual bottleneck. Option C is incorrect because decreasing the health check grace period to 30 seconds would likely cause instances to be marked unhealthy and terminated before the application finishes starting, worsening the problem.

Answer

Increase the Auto Scaling group cooldown period.

Answer

Reduce the target group health check interval to 5 seconds.

Answer

Decrease the health check grace period to 30 seconds.

Question 10

A solutions architect notices that an Auto Scaling group's instances are continuously being terminated and replaced. CloudWatch logs show that health checks are failing due to high memory usage. The instances run a memory-intensive application. What should the architect do to improve stability?

Accepted Answer

Create a CloudWatch alarm for memory utilization and attach it to a scaling policy.. The Auto Scaling group is terminating instances because the application is exhausting memory, and the ASG's default EC2 health check only validates instance/host status — not application-level memory pressure. The correct fix is to surface memory utilization as a CloudWatch metric (via the CloudWatch agent) and attach a scaling policy so the group scales out before instances become unhealthy. This addresses the root cause (capacity vs. demand) rather than just masking the symptom.

Answer

Change the instance type to a memory-optimized family like R5.

Answer

Use a scheduled scaling policy to add instances during peak hours.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Question 11

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically deleted after 30 days. The current lifecycle policy is configured to expire objects after 30 days, but objects are not being deleted. What is the most likely cause?

Accepted Answer

The bucket has S3 Object Lock enabled with a retention period exceeding 30 days.. S3 Object Lock in compliance or governance mode prevents object deletion (including by lifecycle policies) until the retention period expires. If the bucket has Object Lock with a retention period longer than 30 days, the lifecycle expiration rule cannot delete the objects, which explains why they remain after 30 days. This is the most likely cause given the symptom.

Answer

The bucket has versioning enabled, and lifecycle rules apply only to current versions.

Answer

The objects are stored in the S3 Glacier Deep Archive storage class.

Answer

The IAM role used by S3 Lifecycle lacks the s3:DeleteObject permission.

Question 12

A company is using Amazon CloudFront to deliver content to users worldwide. The origin is an S3 bucket. Users in some regions experience high latency. What is the most effective way to reduce latency?

Accepted Answer

Use an origin shield to reduce the number of requests to the S3 bucket.. Using an origin shield reduces the number of requests directly to the S3 bucket by serving cached content from a central location, which reduces latency for users. Option A is wrong because CloudFront automatically uses a global network of edge locations; you cannot manually add more. Option B is wrong because SSL/TLS certificates do not affect latency. Option D is wrong because S3 Transfer Acceleration improves upload speeds, not download speeds to end users.

Answer

Add more CloudFront edge locations in the affected regions.

Answer

Enable CloudFront's SSL/TLS certificate using SNI only.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 13

A company has a web application running on EC2 instances in an Auto Scaling group. The application experiences unpredictable traffic spikes. The company wants to ensure that the application can scale out quickly and scale in to reduce costs. Which TWO actions should the solutions architect recommend?

Accepted Answer

Create a target tracking scaling policy based on Average CPU Utilization.. Options C and D are correct. A target tracking scaling policy (C) automatically adjusts capacity based on a specified metric like CPU utilization, providing dynamic scaling for unpredictable spikes. A simple scaling policy with a step adjustment (D) allows you to define specific thresholds (e.g., CPU > 80%) to add instances quickly. Option A is wrong because a lifecycle hook delays termination during scale-in, which would increase costs by keeping instances running longer. Option B is wrong because manually adjusting capacity is not automated and does not respond quickly to spikes. Option E is wrong because scheduled scaling is for predictable patterns, not unpredictable traffic spikes.

Answer

Configure a lifecycle hook to delay instance termination during scale-in.

Answer

Manually increase the desired capacity during peak times.

Answer

Use a scheduled scaling policy to add instances during expected peak hours.

Question 14

A company runs a critical application on Amazon ECS with Fargate launch type. The application needs to be highly available across multiple Availability Zones. The company wants to implement blue/green deployments to minimize downtime. Which THREE steps should the solutions architect take?

Accepted Answer

Create two separate ECS task definitions for the blue and green environments.. Options C, D, and E are correct because blue/green deployments for ECS require separate task definitions for each environment (C), CodeDeploy to manage traffic shifting (D), and an Application Load Balancer with separate target groups for each task set to route traffic (E). Option A is incorrect because storing artifacts in ECR is about container images, not a deployment step. Option B is incorrect because using a load balancer is a prerequisite for any ECS service, but it is not one of the specific steps required to implement blue/green deployments. The blue/green-specific steps are C, D, and E.

Answer

Store the application artifacts in Amazon ECR and use an ECS service with a single task definition.

Answer

Use a Network Load Balancer to route traffic to the ECS service.

Question 15

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest and that the encryption keys be rotated automatically every year. The company also needs to audit who accessed the key and when. Which THREE services should the solutions architect use to meet these requirements?

Accepted Answer

S3 server-side encryption with AWS KMS (SSE-KMS).. Option A (SSE-KMS) is correct because it enforces server-side encryption at rest for S3 objects using AWS KMS customer master keys, satisfying the encryption-at-rest requirement. Option D (KMS with automatic key rotation enabled) is correct because KMS supports automatic annual rotation of customer managed keys, directly meeting the yearly key rotation requirement. Option B (CloudTrail logging KMS Decrypt and GenerateDataKey events) is correct because CloudTrail records KMS API calls, enabling auditing of who accessed the key and when. Option C (IAM to control access to keys) is not one of the required three services for encryption, rotation, and auditing, since IAM governs permissions rather than providing the encryption, rotation, or audit logging itself. Option E (SSE-S3) is incorrect because S3-managed keys do not support customer-controlled automatic annual rotation or KMS-based audit trails of key usage.

Answer

AWS Identity and Access Management (IAM) to control access to the keys.

Answer

S3 server-side encryption with S3-managed keys (SSE-S3).