SAP-C02 Continuous Improvement for Existing Solutions Practice Test 31 — 15 Questions

Question 1

A company is migrating a legacy application to AWS. The application runs on a single EC2 instance and uses an attached EBS volume for data storage. The company wants to improve high availability. Which THREE actions should the company take? (Choose three.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Migrate the database to Amazon RDS with Multi-AZ deployment.. Option A is correct because migrating the database to Amazon RDS with a Multi-AZ deployment provides automatic failover to a standby replica in a different Availability Zone, eliminating the single point of failure for data storage and improving availability. Option D is correct because placing the EC2 instance in an Auto Scaling group spanning multiple Availability Zones allows the application to be launched in more than one AZ and automatically replaced if an instance or AZ fails. Option E is correct because placing the EC2 instances behind an Application Load Balancer distributes incoming traffic across healthy targets in multiple AZs and routes around failed instances, which is essential for high availability. Option B is incorrect because increasing EBS IOPS only improves performance, not availability, and does not address single-instance or single-AZ failure. Option C is incorrect because instance store is ephemeral and tied to a single host, so it reduces durability and availability rather than improving it.

Answer

Use an EBS volume with higher IOPS to improve performance.

Answer

Store data on the instance store instead of EBS to reduce latency.

Question 2

A company runs a critical web application on EC2 instances behind an Application Load Balancer (ALB). During a recent deployment, users experienced errors. The team wants to automatically roll back the deployment if the error rate exceeds 5% within 10 minutes after deployment. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Use CodeDeploy with a CloudWatch alarm on the ALB error rate that triggers a deployment rollback.. AWS CodeDeploy integrates natively with CloudWatch alarms to automatically roll back a deployment when the alarm enters the ALARM state. By creating a CloudWatch alarm on the ALB's HTTP 5xx error rate (or target group error metric) with a threshold of 5% over a 10-minute period, and associating it with the CodeDeploy deployment group, CodeDeploy will trigger an automatic rollback if the alarm fires. This requires minimal operational overhead because it uses built-in integration.

Answer

Configure the Auto Scaling group to use ELB health checks and replace instances if the error rate increases.

Answer

Use CodeDeploy with manual approval gates and a script that checks error rates.

Answer

Use a custom Lambda function that monitors ALB error rates and triggers a rollback via CodeDeploy API.

Question 3

A company runs a stateful application on EC2 instances in an Auto Scaling group behind a Network Load Balancer (NLB). The application requires that client sessions are maintained to the same instance. The operations team notices that after scaling events, some clients lose their sessions. Which configuration change should the team implement to ensure session persistence?

Accepted Answer

Enable source IP stickiness on the NLB target group.. Network Load Balancers operate at Layer 4 and support only source IP-based stickiness, configured on the target group via the 'stickiness.enabled' and 'stickiness.type=source_ip' attributes. Enabling source IP stickiness ensures that a given client IP is consistently routed to the same backend instance, preserving sessions across scaling events.

Answer

Disable cross-zone load balancing on the NLB.

Answer

Enable cookie-based stickiness on the NLB listener.

Answer

Switch to an Application Load Balancer and enable cookie-based stickiness.

Question 4

A company runs a monolithic application on a single EC2 instance. The application is critical and must be highly available. The company wants to migrate to a containerized architecture on Amazon ECS with minimal downtime. Which approach should the company take?

Accepted Answer

Use an Application Load Balancer with blue/green deployment using AWS CodeDeploy and ECS.. Using an Application Load Balancer (ALB) with blue/green deployment via AWS CodeDeploy and ECS allows you to shift traffic gradually from the old (blue) environment to the new (green) environment with minimal downtime. CodeDeploy orchestrates the deployment, and the ALB routes traffic to the appropriate target group. This approach provides high availability and rollback capability.

Answer

Launch a new ECS cluster with the containerized application and use Route 53 weighted routing to shift traffic.

Answer

Deploy the monolith as a single task in ECS and update the task definition with new container versions.

Answer

Use AWS CodeStar to automatically deploy the application to ECS with blue/green deployments.

Question 5

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of user_id and a sort key of timestamp. During a new game launch, the table experiences throttling on a few partitions. The company wants to improve the partition distribution. Which action should the company take?

Accepted Answer

Implement write sharding by using a composite partition key.. The root cause is a hot partition caused by low partition key cardinality: many writes land on the same user_id value. The correct fix is write sharding, which increases the number of distinct partition key values so writes spread across more physical partitions. Option D describes this correctly by using a composite partition key (e.g., user_id#shard). Option A is not correct: appending a random suffix to the existing partition key changes the key schema and destroys the ability to query by user_id, and it is the same sharding concept as D rather than a separate remediation. B is incorrect because DAX only accelerates reads and does not relieve write-side hot partitions. C is incorrect because increasing RCUs adds read throughput and cannot fix write throttling on a hot partition. E is incorrect because on-demand capacity mode changes billing/capacity management but does not change partition key distribution or eliminate hot partitions.

Answer

Add a random suffix to the partition key to distribute writes more evenly.

Answer

Use DAX (DynamoDB Accelerator) to cache read-heavy workloads.

Answer

Increase the read capacity units for the table.

Answer

Switch the table to on-demand capacity mode.

Question 6

A company has a monolithic application running on a single EC2 instance. The application experiences performance issues during peak hours. The company decides to migrate to a microservices architecture using AWS Lambda and Amazon API Gateway. The migration must be done incrementally without downtime. What strategy should the company use?

Accepted Answer

Use the strangler fig pattern: implement API Gateway to route traffic to new Lambda functions for specific endpoints while keeping the monolith for others.. The strangler fig pattern allows incremental migration by routing specific API requests to new Lambda functions via API Gateway while keeping the monolithic application for the rest. This approach avoids downtime. Option A is incorrect because deploying all microservices in a new VPC and cutting over DNS risks downtime and is not incremental. Option B is incorrect because creating a new version of the monolith that calls Lambda functions still leaves the monolith in place and does not fully utilize API Gateway for routing. Option C is incorrect because CodeDeploy blue/green deployment is for deploying to EC2 or Lambda, but it does not provide a pattern for incremental migration of a monolith to microservices; the strangler fig pattern is more appropriate.

Answer

Deploy all microservices in a new VPC and cut over DNS after testing.

Answer

Create a new version of the monolith that calls Lambda functions as backend.

Answer

Use AWS CodeDeploy to perform a blue/green deployment of the monolith to Lambda.

Question 7

A company uses AWS CloudFormation to manage infrastructure. The stack fails to update with the error: 'Resource handler returned message: The subnet 'subnet-xxx' is in use by a network interface.' The subnet is associated with a Lambda function in a VPC. The CloudFormation template is trying to delete the subnet. What should the company do to resolve this?

Accepted Answer

Update the Lambda function configuration to remove the VPC settings, then delete the subnet.. The error indicates that the subnet cannot be deleted because it is in use by a network interface, which is likely the Lambda function's elastic network interface (ENI). To resolve this, the Lambda function's VPC configuration must be removed so that the ENI is released, allowing the subnet to be deleted. This is the correct approach because CloudFormation cannot delete a subnet that still has dependencies.

Answer

Modify the CloudFormation template to ignore the deletion failure using a DeletionPolicy attribute.

Answer

Use the AWS CLI to force delete the subnet.

Answer

Manually delete the Elastic Network Interface (ENI) from the AWS Management Console.

Question 8

A company uses Amazon S3 to store backups. The backup process uploads objects with a prefix 'backups/' and sets the storage class to STANDARD_IA. The company wants to automatically move objects older than 30 days to GLACIER. What is the most efficient way to achieve this?

Accepted Answer

Create an S3 Lifecycle rule that transitions objects with prefix 'backups/' to GLACIER after 30 days.. S3 Lifecycle rules are designed to automatically transition objects between storage classes based on age and prefix. Creating a rule that targets the 'backups/' prefix and transitions objects to GLACIER after 30 days is the most efficient, server-side, and cost-effective method. It requires no custom code or manual intervention.

Answer

Use an AWS Lambda function triggered by S3 events to change the storage class.

Answer

Use S3 Batch Operations to copy objects to a new bucket with GLACIER storage class.

Answer

Enable S3 Intelligent-Tiering on the bucket.

Question 9

A company has deployed a web application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database. The security team mandates that the database must not be publicly accessible. What is the best way to securely connect the ECS tasks to the RDS database?

Accepted Answer

Place the ECS tasks and RDS instance in the same VPC, and configure security groups to allow traffic on the database port.. Placing ECS tasks and RDS in the same VPC allows private communication via security groups. This ensures the database is not publicly accessible. Option A is incorrect because a NAT gateway is for outbound internet access, not for inbound traffic to RDS. Option B is incorrect because an internet gateway would expose the RDS instance to the internet. Option C is incorrect because enabling public accessibility would violate the security mandate even with IP restrictions.

Answer

Use a NAT gateway to route traffic from ECS tasks to RDS.

Answer

Attach an internet gateway to the VPC and route through it.

Answer

Enable public accessibility on the RDS instance and restrict access to the ECS task public IP.

Question 10

A company is using AWS CloudTrail to log API activity. The security team wants to ensure that log files are tamper-proof and can be used for forensic analysis. Which TWO actions should the company take?

Accepted Answer

Enable S3 Object Lock on the CloudTrail S3 bucket.. Option A is correct because enabling S3 Object Lock on the CloudTrail S3 bucket (in compliance or governance mode with a retention period) uses WORM (write-once-read-many) semantics to prevent log files from being deleted or overwritten, which is essential for tamper-proof forensic evidence. Option B is correct because CloudTrail log file validation generates a digitally signed digest file for each log, allowing you to verify via the AWS CLI (aws cloudtrail validate-logs) that logs have not been altered or deleted after delivery. Option C is not correct here because SSE-KMS provides encryption at rest and access control but does not by itself prevent tampering or deletion of log files. Option D is not correct because S3 Transfer Acceleration only speeds up uploads over long distances and has no bearing on log integrity. Option E is not correct because a Lifecycle policy transitioning logs to S3 Glacier changes storage class and could affect availability, but it does not make logs tamper-proof.

Answer

Use server-side encryption with AWS KMS managed keys (SSE-KMS).

Answer

Enable S3 Transfer Acceleration on the CloudTrail S3 bucket.

Answer

Set an S3 Lifecycle policy to transition logs to Amazon S3 Glacier.

Question 11

A CloudFormation stack is created using the template above. The stack creation fails with the error: 'The following resource(s) failed to create: [EC2Instance]'. Logs show: 'AMI 'ami-0abcdef1234567890' does not exist.' What is the most likely cause?

Accepted Answer

The AMI ID is not available in the region where the stack is being deployed.. The error 'AMI ami-0abcdef1234567890 does not exist' indicates that the specified AMI ID is not available in the AWS region where the CloudFormation stack is being deployed. AMI IDs are region-specific; an AMI that exists in us-east-1 will not exist in eu-west-1 unless it was explicitly copied or is a public AMI available in that region. The most likely cause is a region mismatch between the AMI ID and the stack's deployment region.

Answer

The SQS queue name 'my-queue' is already in use.

Answer

The AMI ID is invalid because it contains letters.

Answer

The instance type t2.micro is not supported in the region.

Question 12

A company uses AWS CodePipeline to deploy a web application. They want to automatically roll back the deployment if the new version fails CloudWatch alarm-based health checks. Which feature should they use?

Accepted Answer

CodeDeploy automatic rollback configuration with CloudWatch alarm.. AWS CodeDeploy natively supports automatic rollback triggered by CloudWatch alarms. When a deployment causes a CloudWatch alarm to enter an ALARM state, CodeDeploy can automatically revert to the previous working version. This is the most straightforward and integrated solution for the requirement. Option A (Lambda + CloudWatch Events) is possible but not the primary recommended feature. Option B (Route 53 health checks) is for DNS-level failover, not deployment rollback. Option C (CodeBuild post-build actions) is for build phase, not post-deployment monitoring.

Answer

AWS Lambda function invoked by CloudWatch Events.

Answer

Amazon Route 53 health checks with failover routing.

Answer

AWS CodeBuild with post-build actions.

Question 13

A company uses AWS CloudFormation to manage infrastructure. They want to detect drift from the intended template configuration. Which service should they use?

Accepted Answer

CloudFormation Drift Detection. CloudFormation Drift Detection compares the actual configuration of stack resources against the expected template configuration and reports resources that have been modified outside of CloudFormation. It is the native feature designed specifically to detect drift for CloudFormation-managed resources. AWS Config can detect configuration changes but is not tied to the template's intended state in the same way.

Answer

AWS Config

Answer

AWS Service Catalog

Answer

AWS CloudTrail

Question 14

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to be notified immediately if any instance fails a status check. What is the simplest solution?

Accepted Answer

Create a CloudWatch alarm on the StatusCheckFailed metric with an SNS action.. CloudWatch can monitor the EC2 StatusCheckFailed metric and trigger an SNS notification when an instance fails a status check. This is the simplest solution because it uses built-in metrics and requires no custom scripting. Option A uses ELB health checks which monitor load balancer target health, not instance status checks. Option B uses Systems Manager Automation which is not real-time. Option D uses CloudTrail which logs API calls, not status checks.

Answer

Configure an ELB health check and monitor the unhealthy host count.

Answer

Use AWS Systems Manager Automation to check instance status periodically.

Answer

Enable AWS CloudTrail and create a metric filter for EC2 instance failures.

Question 15

A company wants to reduce costs for a batch processing workload that runs nightly on Amazon EMR. The workload is fault-tolerant and can handle interruptions. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Right-size the cluster by analyzing resource utilization metrics.. Option B is correct because right-sizing the cluster based on CloudWatch resource utilization metrics (such as CPU, memory, and disk I/O) eliminates over-provisioned nodes, directly lowering EMR costs for a nightly batch workload. Option E is correct because Spot Instances can be used for task nodes in EMR, and since the workload is fault-tolerant and interruption-tolerant, the steep Spot discounts (up to ~90% off On-Demand) reduce costs substantially without risking data loss on core/HDFS nodes. Option A is wrong because On-Demand Instances for all nodes is the most expensive purchasing model and ignores the workload's tolerance for interruption. Option C is wrong because Reserved Instances require a 1- or 3-year commitment and are better suited to steady-state, predictable usage rather than a nightly batch job that may not run continuously. Option D is wrong because Dedicated Instances address tenancy/compliance requirements and typically cost more; they do not improve performance or reduce cost for this scenario.

Answer

Use On-Demand Instances for all nodes.

Answer

Purchase Reserved Instances for the cluster.

Answer

Use Dedicated Instances to improve performance.