SAP-C02 Continuous Improvement for Existing Solutions Practice Test 4 — 15 Questions

Question 1

Match each AWS database service to its characteristic.

Accepted Answer

Amazon RDS: Fully managed relational database service supporting multiple database engines. Each AWS database service targets specific use cases: RDS for relational workloads, DynamoDB for NoSQL, Redshift for analytics, and ElastiCache for caching. Common confusions include mixing up NoSQL with relational and caching with warehousing.

Answer

Amazon RDS: Fully managed NoSQL key-value database

Answer

Amazon Redshift: In-memory caching service

Question 2

A company uses AWS Lambda to process incoming messages from an SQS queue. The Lambda function is triggered by SQS and processes messages in batches of 10. Recently, the number of messages has increased significantly, and some messages are being processed multiple times. What should a solutions architect do to ensure exactly-once processing?

Accepted Answer

Change the SQS queue to a FIFO queue and enable content-based deduplication.. Exactly-once processing is achieved by using an SQS FIFO queue with content-based deduplication. FIFO queues guarantee that a message is delivered exactly once and consumers receive messages in order. Lambda supports SQS FIFO as an event source, though it has lower throughput limits. Option A (DynamoDB-based idempotency) also works but adds complexity and cost. Option B (increasing reserved concurrency) only helps with scaling but does not prevent duplicates if a message is processed but the function fails after processing. Option C (increasing visibility timeout) delays reprocessing but does not guarantee exactly-once if the function is throttled or fails.

Answer

Use a DynamoDB table to store unique message IDs and check for duplicates before processing.

Answer

Set the Lambda function's reserved concurrency to a higher value to prevent throttling.

Answer

Increase the visibility timeout of the SQS queue to 30 minutes.

Question 3

A company runs a web application on Amazon ECS with Fargate launch type behind an Application Load Balancer. The application stores session state in a local file system on the container. Users report that they are frequently logged out and lose session data. What is the most likely cause?

Accepted Answer

ECS tasks are being replaced by the service scheduler during deployments or health checks.. ECS tasks using Fargate are ephemeral; when the service scheduler replaces tasks during deployments or due to health check failures, any session data stored in the local file system is lost, causing users to be logged out. Option B is incorrect because security group misconfiguration would prevent traffic entirely, not cause intermittent session loss. Option C is incorrect because scaling out creates additional tasks but does not by itself cause existing tasks to lose their local data; the issue is replacement, not scaling. Option D is incorrect because sticky sessions only route a user to the same target, but if the target container is replaced, the local session data is still lost regardless of stickiness.

Answer

The security group for the ECS tasks is blocking inbound traffic from the ALB.

Answer

The ECS service is configured to scale out, causing new tasks to be created without existing session data.

Answer

The Application Load Balancer is not configured with sticky sessions.

Question 4

A company has a production AWS account with multiple VPCs connected via a transit gateway. The security team wants to centrally capture all VPC flow logs for analysis in Amazon Athena. What is the MOST cost-effective way to store the flow logs?

Accepted Answer

Publish VPC Flow Logs to an Amazon S3 bucket with S3 Intelligent-Tiering enabled.. VPC Flow Logs can be published directly to S3, and using S3 Intelligent-Tiering optimizes costs for logs that may be accessed infrequently. Option B is wrong because CloudWatch Logs is more expensive for long-term storage. Option C is wrong because Kinesis Data Firehose adds cost and complexity. Option D is wrong because it duplicates storage.

Answer

Publish VPC Flow Logs to both CloudWatch Logs and S3 for redundancy.

Answer

Use Amazon Kinesis Data Firehose to stream flow logs to an S3 bucket.

Answer

Publish VPC Flow Logs to Amazon CloudWatch Logs and export them to S3 after 30 days.

Question 5

A company uses AWS CloudFormation to deploy infrastructure. They have a stack that creates an Amazon RDS for MySQL database. The stack creation fails with the error 'The following resource(s) failed to create: [DBInstance]'. The solutions architect needs to troubleshoot the issue. Which approach should be taken first?

Accepted Answer

Review the CloudFormation stack events in the AWS Management Console.. When a CloudFormation stack creation fails, the stack events provide detailed status reasons for each resource, including the specific error message for the DBInstance. This is the first step to diagnose the failure. Option B is incorrect because while RDS events may show database-level issues, the failure occurred during stack creation and CloudFormation events are more direct. Option C is incorrect because deleting and redeploying without understanding the cause is inefficient. Option D is incorrect because CloudTrail logs API calls but does not provide the detailed resource failure reasons that CloudFormation events do.

Answer

Check the RDS console for any database events.

Answer

Delete the stack and deploy again with the same parameters.

Answer

Use AWS CloudTrail to view the CreateStack API call.

Question 6

A company is using Amazon S3 to store critical data. The security team requires that all data at rest be encrypted using AWS KMS with automatic rotation of the customer master key (CMK) every year. What should a solutions architect do to meet this requirement?

Accepted Answer

Enable S3 default encryption with AWS KMS and enable automatic rotation of the KMS key.. It enables S3 default encryption with AWS KMS and enables automatic rotation of the KMS key, meeting the requirement for encryption at rest with automatic key rotation. Option A is wrong because SSE-S3 uses Amazon S3-managed keys, not KMS, and does not allow automatic rotation of a customer-managed key. Option C is wrong because SSE-C uses customer-provided keys, not KMS, and requires manual key rotation. Option D is wrong because client-side encryption does not use S3 server-side encryption and does not leverage S3's default encryption settings.

Answer

Use SSE-S3 (Amazon S3-managed keys) and rely on S3's automatic key rotation.

Answer

Use SSE-C (customer-provided keys) and manage key rotation manually.

Answer

Use client-side encryption with a KMS CMK and upload the encrypted data.

Question 7

A company runs a stateful web application on EC2 instances behind an Application Load Balancer. The application stores session data locally on the instances. The company wants to improve availability and scalability. What should a solutions architect recommend?

Accepted Answer

Move session state to Amazon ElastiCache and make the application stateless.. Moving session state to Amazon ElastiCache makes the application stateless, allowing EC2 instances to be added or removed without session loss, which improves both availability and scalability. Option B (Auto Scaling alone) is wrong because without external session storage, scaling out will cause new instances to lack existing session data, and terminating instances will lose sessions. Option C (sticky sessions) is wrong because it only routes a user to the same instance, but if that instance fails, the session is lost. Option D (larger instances) is wrong because it does not address scalability; it only increases capacity of individual instances, but does not allow for horizontal scaling or improve availability beyond a single instance.

Answer

Use Auto Scaling to add more EC2 instances.

Answer

Enable sticky sessions on the ALB.

Answer

Use larger EC2 instances to handle more sessions.

Question 8

A company uses Amazon DynamoDB with provisioned capacity for a critical workload. They notice that write requests are being throttled during peak hours. The table has a partition key of 'user_id' and a sort key of 'timestamp'. The access pattern is evenly distributed. What should a solutions architect do to reduce throttling?

Accepted Answer

Enable DynamoDB Auto Scaling for write capacity.. DynamoDB Auto Scaling adjusts write capacity based on actual usage, reducing throttling without manual intervention. Option A is wrong because increasing read capacity does not help with write throttling. Option B is wrong because DAX is a cache for read operations, not writes. Option C is wrong because while switching to On-Demand mode can eliminate throttling, it may be more expensive than Auto Scaling if the workload is predictable; Auto Scaling is the more cost-effective solution for this scenario.

Answer

Increase the read capacity units for the table.

Answer

Add a DynamoDB Accelerator (DAX) cluster in front of the table.

Answer

Switch the table to DynamoDB On-Demand capacity mode.

Question 9

A company is using AWS CloudTrail to log all API activity. The security team wants to be alerted when an IAM user creates a new access key. What is the simplest way to achieve this?

Accepted Answer

Create an Amazon EventBridge rule that matches the 'CreateAccessKey' API call and sends an SNS notification.. Amazon EventBridge can be configured with a rule that matches the 'CreateAccessKey' API call from CloudTrail and sends an SNS notification to alert the security team. Option A is incorrect because S3 event notifications are triggered by object-level operations (e.g., object created/deleted) in the S3 bucket, not by API calls logged by CloudTrail. Option B is incorrect because enabling log file validation on a CloudTrail trail only ensures the integrity of log files, it does not generate alerts. Option C is incorrect because AWS Config rules evaluate the configuration state of AWS resources (e.g., whether an IAM user has a key older than 90 days), not real-time API calls.

Answer

Configure an S3 event notification on the CloudTrail log bucket to trigger a Lambda function.

Answer

Set up a CloudTrail trail with log file validation enabled.

Answer

Use AWS Config to create a rule that checks for access keys.

Question 10

A company runs a web application on Amazon ECS with Fargate launch type. The application uses an Application Load Balancer. The operations team notices that the ALB returns 503 errors during peak traffic. Which TWO actions should the solutions architect take to resolve this issue?

Accepted Answer

Enable ECS service Auto Scaling to automatically adjust the number of tasks.. Options B and D are correct. 503 errors from ALB indicate the target group has no healthy targets. Enabling ECS service Auto Scaling (B) will increase the number of tasks to handle traffic. Reviewing ECS service events (D) can reveal why tasks are unhealthy. Option A is wrong because increasing ALB idle timeout does not affect health. Option C is wrong because increasing deregistration delay might help but is not a primary fix. Option E is wrong because increasing task memory might not solve the health issue if it's due to capacity.

Answer

Increase the idle timeout on the ALB.

Answer

Increase the deregistration delay on the target group.

Answer

Increase the task memory allocation in the task definition.

Question 11

A company is using an AWS Lambda function to process files uploaded to an S3 bucket. The function is written in Python and uses the boto3 library to read the files. Recently, some files have been processed multiple times. Which TWO measures should a solutions architect implement to ensure idempotent processing?

Accepted Answer

Use a DynamoDB table to store processed file IDs and check for duplicates before processing.. Options A and D are correct. Using a DynamoDB table to store processed file IDs (A) ensures idempotency by checking for duplicates before processing. Configuring S3 event notifications with prefix and suffix filters (D) reduces the chance of triggering multiple invocations for the same file. Option B is incorrect because simply using an SQS queue does not guarantee idempotent processing; additional deduplication logic is needed. Option C is incorrect because increasing the Lambda timeout does not prevent multiple invocations. Option E is incorrect because S3 Transfer Acceleration improves upload speed, not idempotency.

Answer

Configure the S3 bucket to send events to an SQS queue and use the Lambda function to poll the queue.

Answer

Increase the Lambda function timeout to 15 minutes.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 12

A company is using Amazon RDS for PostgreSQL with Multi-AZ deployment. The database experiences high write latency during peak hours. The solutions architect suggests using an RDS read replica to offload read traffic. Which THREE steps are necessary to implement this solution?

Accepted Answer

Create a read replica from the source DB instance.. To implement the solution of offloading read traffic using an RDS read replica, three steps are necessary. First, create a read replica from the source DB instance (option B), which provides a separate read-only copy of the database. Second, modify the application to send read-only queries to the read replica endpoint (option C); otherwise, the replica won't be utilized. Third, configure the read replica to be in a different Availability Zone for high availability (option E). While not strictly required for basic read offloading, this step enhances fault tolerance and is considered a necessary part of the solution to ensure high availability of the read replica. Option A is incorrect because placing the read replica in the same AZ does not provide high availability and is not a necessary step. Option D is incorrect because Multi-AZ is a feature for the primary instance, not for read replicas, and enabling it on a read replica is not supported.

Answer

Ensure the read replica is in the same Availability Zone as the primary.

Answer

Enable Multi-AZ on the read replica.

Question 13

A company uses cross-account S3 access. The above IAM policy is attached to an IAM user in Account A. The user tries to upload an object to a bucket in Account B, but the upload fails. What is the MOST likely reason?

Accepted Answer

The upload request does not include the 'x-amz-acl' header with value 'bucket-owner-full-control'.. The policy explicitly requires the 'x-amz-acl: bucket-owner-full-control' condition. If the upload request does not include this header, the request fails. Options B, C, and D are incorrect: the resource ARN is correct (includes bucket and object), the bucket policy is not shown but the IAM policy is the issue, and the IAM user does have s3:PutObject permission as stated in the policy.

Answer

The resource ARN in the policy is incorrect; it should include the bucket name only.

Answer

The bucket policy in Account B denies the upload.

Answer

The IAM user does not have permission to call s3:PutObject.

Question 14

A solutions architect runs the above commands for an EC2 instance. The instance state is 'running' but the system status is 'impaired'. What should the solutions architect do to restore the instance?

Accepted Answer

Stop and start the instance.. When the system status check fails, it indicates a hardware issue. AWS recommends stopping and starting the instance to move it to new underlying hardware. Option A is incorrect because the instance is already running, so starting it does nothing. Option C is incorrect because modifying the instance type does not resolve underlying hardware issues. Option D is incorrect because rebooting the instance does not change the underlying hardware and may not resolve the impairment.

Answer

Start the instance.

Answer

Modify the instance type.

Answer

Reboot the instance.

Question 15

A solutions architect deployed the above CloudFormation template. However, the Lambda function is not triggered when objects are uploaded to the S3 bucket. What is the most likely cause?

Accepted Answer

The Lambda function lacks a resource-based policy that allows S3 to invoke it.. The Lambda function requires a resource-based policy (also known as a function policy) that grants the S3 service permission to invoke the function. The CloudFormation template does not include such a policy, so S3 cannot trigger the Lambda function. Option A is incorrect because the BucketNotification resource is correctly configured to send events to the Lambda function, but the function itself lacks the invoke permission. Option C is incorrect because the Lambda execution role manages permissions for the function to access other services (like CloudWatch Logs), not for other services to invoke it. Option D is irrelevant because the trigger itself is the issue, not the function code.

Answer

The BucketNotification resource depends on MyLambdaFunction, but the notification configuration is incorrect.

Answer

The Lambda execution role does not have permission to access S3.

Answer

The Lambda function code does not read the S3 object content.