SAP-C02 Continuous Improvement for Existing Solutions Practice Test 30 — 15 Questions

Question 1

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create one or more Read Replicas in the same region.. Read Replicas offload read traffic from the primary RDS instance by serving read-only queries, and they can be created in the same region with minimal architectural change. Since the application is read-heavy and can tolerate eventual consistency for some queries, routing those queries to replicas is the most effective and least disruptive improvement. This scales read capacity horizontally without modifying the application's write path.

Answer

Enable Multi-AZ deployment for failover.

Answer

Use Amazon ElastiCache to cache frequent queries.

Answer

Upgrade to a larger instance type.

Question 2

A company has a serverless application using AWS Lambda, API Gateway, and DynamoDB. During a traffic spike, some API requests fail with 5xx errors. The CloudWatch logs show 'ProvisionedThroughputExceededException' for DynamoDB. The team wants to handle this gracefully without losing requests. What should they do?

Accepted Answer

Enable auto scaling for DynamoDB and implement retry logic with exponential backoff in the Lambda function.. The ProvisionedThroughputExceededException indicates that DynamoDB is throttling requests because the table's provisioned capacity is insufficient for the traffic spike. Enabling DynamoDB auto scaling allows the table to automatically adjust its read/write capacity based on utilization, while implementing retry logic with exponential backoff in the Lambda function ensures that throttled requests are retried after progressively longer intervals, preventing request loss and handling temporary spikes gracefully. This combination directly addresses the root cause and provides resilience.

Answer

Increase the provisioned read/write capacity of the DynamoDB table to a high fixed value.

Answer

Use an SQS queue between API Gateway and Lambda to buffer requests.

Answer

Configure API Gateway to automatically retry failed requests.

Question 3

A company runs a containerized application on Amazon ECS with Fargate launch type. The application is deployed across multiple Availability Zones. Recently, deployments have been failing because new tasks cannot register with the Application Load Balancer (ALB) target group. The health checks are failing. What is the MOST likely cause?

Accepted Answer

The security group for the tasks does not allow inbound traffic from the ALB on the health check port.. If the security group for the tasks does not allow inbound traffic from the ALB on the health check port, health checks fail and tasks cannot register. Option B is incorrect because a desired count of zero would prevent new tasks from running, but the scenario describes deployments failing due to health check failures on new tasks. Option C is incorrect: an invalid container image would cause the task to fail to start, not cause health check failures after the task is running. Option D is incorrect because Fargate manages capacity; insufficient capacity would cause a different error (e.g., unable to provision tasks), not health check failures.

Answer

The ECS service is configured with a desired count of zero.

Answer

The task definition specifies an invalid container image.

Answer

The ECS cluster has insufficient capacity.

Question 4

A company is using AWS CloudFormation to manage infrastructure. They want to ensure that any changes to a production stack are reviewed and approved before being applied. What is the BEST way to achieve this?

Accepted Answer

Use Change Sets and require manual approval to execute them.. AWS CloudFormation Change Sets allow you to preview how proposed changes will affect your running resources before executing them. By using Change Sets in conjunction with a manual approval process (e.g., via AWS CodePipeline or a separate review step), you can ensure changes are reviewed and approved before being applied. Option A (termination protection) only prevents stack deletion, not updates. Option B (auto-deployment with CodePipeline) can include approval gates, but the question asks for the "BEST way" in the context of CloudFormation itself; Change Sets are the native mechanism for review. Option D (stack policies) control which resources can be updated, but do not enforce a review process.

Answer

Enable termination protection on the stack.

Answer

Use AWS CodePipeline to automatically deploy changes.

Answer

Use stack policies to prevent updates.

Question 5

A company has a multi-region architecture using DynamoDB global tables. They notice that write conflicts are occurring frequently between regions. What is the MOST likely cause and how should they resolve it?

Accepted Answer

The application is updating the same item in multiple regions concurrently, and the last-writer-wins conflict resolution is causing data loss.. DynamoDB global tables use multi-region replication with a last-writer-wins conflict resolution based on timestamps. When the same item is updated concurrently in multiple regions, one write silently overwrites the other, causing data loss. The most likely cause of frequent write conflicts is exactly this concurrent update pattern, and the fix is to redesign the application to avoid concurrent writes to the same item across regions — for example, by partitioning writes by region or using conditional writes.

Answer

The application is using strongly consistent reads.

Answer

The DynamoDB write capacity is insufficient.

Answer

The DynamoDB global tables are not properly configured with conflict resolution.

Question 6

A company is using Amazon S3 to store sensitive data. The security team wants to ensure that all objects uploaded to specific S3 buckets are encrypted at rest. Which TWO actions should they take? (Choose 2)

Accepted Answer

Use a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Option A is correct because a bucket policy with a Deny effect on s3:PutObject conditioned on the absence of the s3:x-amz-server-side-encryption header (or Null condition on that key) forces every uploader to explicitly request server-side encryption, preventing unencrypted PUT requests. Option B is correct because configuring default bucket encryption with SSE-S3 (AES-256) or SSE-KMS automatically encrypts objects at rest even when the request does not include an encryption header, providing a baseline guarantee for all uploaded data. Option C is not relevant because Cross-Region Replication only copies objects to another bucket and does not enforce encryption at rest on the source bucket. Option D is not relevant because Versioning preserves multiple object versions but does not itself encrypt data. Option E is not relevant because Server Access Logs record request activity for auditing, not encryption enforcement.

Answer

Enable S3 Cross-Region Replication.

Answer

Enable S3 Versioning on the buckets.

Answer

Enable S3 Server Access Logs.

Question 7

A company has an AWS Lambda function that processes messages from an SQS queue. The function is experiencing timeouts. Which TWO changes could help resolve the timeout issue? (Choose 2)

Accepted Answer

Increase the Lambda function timeout.. Option C is correct because the Lambda function timeout setting defines the maximum execution time before Lambda terminates the invocation; if the function legitimately needs more time to process messages, raising the timeout (up to 15 minutes) directly prevents timeout errors. Option D is correct because Lambda allocates CPU and network bandwidth proportionally to memory, so increasing the memory allocation gives the function more compute power and can significantly reduce processing time, resolving timeouts caused by slow execution. Option A is not appropriate because increasing the SQS batch size means each invocation processes more messages, which typically increases execution duration and worsens timeouts. Option B is not relevant because SQS queue encryption (SSE) protects data at rest and does not affect Lambda execution time. Option E is not appropriate because decreasing the visibility timeout makes messages reappear sooner for reprocessing, which can cause duplicate processing and does not fix the underlying Lambda timeout.

Answer

Increase the batch size in the SQS event source mapping.

Answer

Enable SQS queue encryption.

Answer

Decrease the SQS visibility timeout.

Question 8

A company uses AWS CloudFormation to deploy resources. The operations team notices that some stack updates fail due to resource conflicts. What is the BEST practice to minimize such failures?

Accepted Answer

Use AWS CloudFormation change sets before updating the stack.. Change sets let you preview exactly what CloudFormation will add, modify, or delete before executing the update, so you can catch resource conflicts, replacement issues, or unintended changes before they cause a failed stack update. This is the AWS-recommended best practice for minimizing update failures and understanding impact.

Answer

Enable termination protection on the stack.

Answer

Use AWS CloudFormation nested stacks.

Answer

Use stack policies to protect critical resources.

Question 9

A company runs a critical application on Amazon RDS for PostgreSQL. The database experiences high read traffic. The application is read-heavy and can tolerate eventual consistency for some queries. What is the MOST effective way to improve read performance without significant architectural changes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a target tracking scaling policy based on average CPU utilization.. A target tracking scaling policy dynamically adjusts the number of instances based on average CPU utilization, which addresses intermittent CPU spikes. The Auto Scaling group also automatically replaces instances that fail ALB health checks, ensuring unhealthy instances are replaced. This optimizes costs by scaling down during low usage. Option B is incorrect: lifecycle hooks are for custom actions during instance launch or termination, not for replacing unhealthy instances. Option C is incorrect: terminating instances with high CPU via Lambda does not integrate with Auto Scaling and could cause instability. Option D is incorrect: scheduled scaling is for predictable traffic patterns, not intermittent spikes.

Answer

Use a lifecycle hook to perform a health check and terminate unhealthy instances.

Answer

Use an AWS Lambda function to terminate instances with high CPU.

Answer

Implement a scheduled scaling policy to increase instances during peak hours.

Question 10

A company uses AWS CodePipeline to deploy a web application to Amazon ECS. The deployment often fails because the ECS service's desired count is not met during the update. The company wants to implement a blue/green deployment with automated rollback on failure. What is the MOST effective approach?

Accepted Answer

Use CodePipeline with CodeDeploy to perform a blue/green deployment on ECS and configure automatic rollback.. CodePipeline integrated with CodeDeploy for ECS blue/green deployments provides automated traffic shifting, health monitoring, and automatic rollback on failure. CodeDeploy manages the replacement task set, shifts traffic via the load balancer, and rolls back if alarms fire or health checks fail, which directly addresses the desired count issue.

Answer

Use CodePipeline with a Lambda function to swap target groups and monitor health.

Answer

Use CodeDeploy with an in-place deployment configuration and a manual approval step.

Answer

Use CodePipeline with ECS rolling update and CloudWatch alarms to trigger rollback.

Question 11

A company uses AWS CloudFormation to manage infrastructure. The operations team wants to ensure that all future stack updates follow best practices for change management. Which THREE actions should the team implement?

Accepted Answer

Use IAM policies to restrict who can update stacks and require approval.. Option B is correct because IAM policies are the mechanism to enforce least privilege and change control on CloudFormation operations: you can deny cloudformation:UpdateStack/ExecuteChangeSet to most principals and allow it only to an approved role, and combine that with manual approval gates so no unauthorized or unreviewed update can run. Option D is correct because a CloudFormation stack policy is a JSON document that explicitly denies Update:Modify/Update:Replace/Update:Delete actions on specified logical resources, protecting critical resources such as databases from accidental replacement or deletion during a stack update. Option E is correct because change sets let you preview exactly which resources will be added, modified, or deleted (and whether replacement occurs) before committing, so creating and reviewing a change set prior to ExecuteChangeSet is the standard best practice for controlled stack updates. Option A is not part of the answer because drift detection only reports resources whose actual configuration diverges from the template; it detects and informs but does not enforce change management on future updates. Option C is not part of the answer because nested stacks address template reuse, modularity, and per-environment composition, not approval or protection of update operations.

Answer

Enable drift detection to identify resources that have changed outside of CloudFormation.

Answer

Use nested stacks to reuse templates across multiple environments.

Question 12

A company uses AWS CloudTrail to log all API calls. The security team wants to be alerted when an IAM user creates a new access key. What is the MOST efficient way to achieve this?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and sends an SNS notification.. The most efficient way to alert when an IAM user creates a new access key is to use CloudWatch Events (now Amazon EventBridge) to match the CreateAccessKey API call from CloudTrail and trigger an SNS notification. Option A is incorrect because CloudTrail Insights is for detecting unusual activity patterns, not for real-time event-driven alerts. Option C is less efficient because it requires additional steps of publishing logs to CloudWatch Logs and creating a metric filter, adding complexity. Option D is inefficient because querying CloudTrail logs with Athena is not real-time and requires custom scheduling.

Answer

Enable CloudTrail Insights to detect unusual key creation patterns.

Answer

Use CloudTrail to publish logs to CloudWatch Logs and create a metric filter to trigger an alarm.

Answer

Configure Amazon Athena to query CloudTrail logs and set up a scheduled query to notify.

Question 13

A company is using an Application Load Balancer (ALB) in front of an Auto Scaling group of EC2 instances. The application has a health check endpoint at /health. Recently, the ALB is marking instances as unhealthy even though the application is running. The health check settings are: interval 30 seconds, timeout 5 seconds, unhealthy threshold 2. What is the most likely cause?

Accepted Answer

The health check timeout of 5 seconds is too short for the application to respond.. The most likely cause is that the health check timeout of 5 seconds is too short for the application to respond to /health within the allotted time (C). If the application takes longer than 5 seconds to respond — due to slow database calls, cold starts, or heavy load — the ALB marks the check as failed. After two consecutive failures (unhealthy threshold 2), the instance is marked unhealthy even though the process is running.

Answer

The health check interval of 30 seconds is too long.

Answer

The unhealthy threshold of 2 is too high.

Answer

The health check path /health is not accessible from the ALB.

Question 14

A company stores sensitive data in an S3 bucket encrypted with SSE-KMS. They need to audit all access requests to the bucket. Which AWS service should they use?

Accepted Answer

AWS CloudTrail. AWS CloudTrail logs all API calls made to S3, including requests to decrypt KMS keys. This enables auditing of all access requests to the bucket. AWS Config (C) records resource configuration changes, not access requests. VPC Flow Logs (A) capture network traffic, not API calls. CloudWatch Logs (B) can store and monitor logs but does not generate logs from S3 access by itself.

Answer

VPC Flow Logs

Answer

Amazon CloudWatch Logs

Answer

AWS Config

Question 15

A company uses AWS CodeBuild to run unit tests. The build process is taking longer than expected. The buildspec.yml file includes a pre-build phase that downloads dependencies from a public repository. What is the most effective way to reduce build time?

Accepted Answer

Configure the build project to use an S3 cache for dependencies.. The pre-build phase downloads dependencies from a public repository, which is the slowest part of the build. Configuring an S3 cache in CodeBuild lets the project persist and reuse files (like downloaded dependencies) between builds, so subsequent builds skip the network download entirely. This directly targets the identified bottleneck and is the most effective, cost-efficient optimization for repeated dependency fetching.

Answer

Run the build in parallel across multiple build projects.

Answer

Increase the compute type of the build environment to use more vCPUs.

Answer

Reduce the build timeout setting to force faster execution.