SAP-C02 Continuous Improvement for Existing Solutions Practice Test 4 — 15 Questions

Question 1

A solutions architect applies the IAM policy shown in the exhibit to an IAM user. The user attempts to upload an object to the S3 bucket 'my-bucket' without specifying the 'x-amz-server-side-encryption' header. What will happen?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The upload fails because the Deny statement blocks any PutObject request that does not specify AES256 encryption.. The IAM policy contains a Deny statement with a condition that blocks s3:PutObject unless the request includes the x-amz-server-side-encryption header set to AES256. Because the user did not specify the header, the condition evaluates such that the Deny applies, and explicit Deny always overrides Allow. Therefore the upload fails.

Answer

The upload succeeds because the Allow statement grants the s3:PutObject permission.

Answer

The upload succeeds because the Deny statement only applies when the header is present but set to a value other than AES256.

Answer

The upload fails because the condition is malformed and causes an error.

Question 2

A solutions architect runs the AWS CLI command shown in the exhibit to troubleshoot a failed CloudFormation stack creation. What is the most likely cause of the failure?

Accepted Answer

The LaunchConfigurationName property in the Auto Scaling group resource was not provided or was an incorrect type.. The most likely cause is that the LaunchConfigurationName property in the Auto Scaling group resource was missing or had an incorrect type, which CloudFormation would report as a validation error during stack creation. CloudFormation validates resource properties against the template schema, and a missing or mistyped required property causes an immediate failure with a specific error message pointing to that property.

Answer

The VPC configuration is incorrect, causing the Auto Scaling group to fail.

Answer

The Auto Scaling group resource type is not supported in the region.

Answer

The IAM role for the stack does not have permission to create Auto Scaling groups.

Question 3

A company is using AWS Lambda functions to process data from an SQS queue. The Lambda function sometimes fails due to transient errors, but the messages are not being retried. Which configuration should the company check to ensure proper retry behavior?

Accepted Answer

Adjust the Maximum retries setting in the Lambda event source mapping. The correct setting is the 'Maximum retries' in the Lambda event source mapping for SQS. This parameter controls how many times Lambda will retry a failed message batch (default is 3). Option A is incorrect because the dead-letter queue (DLQ) is used to store messages that have failed after all retries are exhausted, not to control the number of retries. Option C is incorrect because the SQS queue's redrive policy 'maxReceiveCount' is used for SQS redrive to a DLQ, not for Lambda retries. Option D is incorrect because the SQS queue's Default visibility timeout determines how long a message is hidden after being received, but does not affect the retry count for Lambda processing.

Answer

Configure the Lambda function's dead-letter queue (DLQ)

Answer

Set the SQS queue's redrive policy maxReceiveCount to a higher value

Answer

Increase the SQS queue's Default visibility timeout

Question 4

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a 5-minute downtime. The application uses a connection pool with a 30-second connection timeout. The RDS DNS name is used as the endpoint. What is the MOST likely cause of the downtime?

Accepted Answer

The DNS TTL for the RDS endpoint is set too high. RDS Multi-AZ failover typically completes in 60-120 seconds, but the application's DNS resolver may cache the old endpoint IP for the duration of the DNS TTL. If the TTL is set high (e.g., 300 seconds or more), clients continue connecting to the failed primary until the cache expires, producing downtime far longer than the actual failover. This matches the observed 5-minute outage.

Answer

The connection pool timeout is too short to allow failover

Answer

The Multi-AZ failover took longer than expected

Answer

The application is using the wrong endpoint after failover

Question 5

A company has deployed a web application behind an Application Load Balancer (ALB) with an Auto Scaling group. Users report that the application is slow during peak hours. The CPU utilization of the EC2 instances is consistently below 40%, but the ALB's request count per target is high. Which action would MOST improve performance?

Accepted Answer

Increase the desired capacity of the Auto Scaling group. The ALB's high request count per target with low CPU utilization indicates the bottleneck is not CPU but the number of concurrent requests each instance handles. Increasing the desired capacity of the Auto Scaling group adds more targets behind the ALB, distributing the request load and improving response times. This directly addresses the high request-per-target metric, which is a better scaling signal than CPU in this scenario.

Answer

Increase the instance size (e.g., from t3.medium to t3.large)

Answer

Configure the Auto Scaling group to scale based on CPU utilization

Answer

Change the ALB routing algorithm to least outstanding requests

Question 6

A company runs a containerized application on Amazon ECS with Fargate launch type. The application needs to access an S3 bucket. The ECS task role has the necessary S3 permissions. However, the application is unable to upload files to S3. What is the MOST likely cause?

Accepted Answer

The task definition does not specify the correct task role ARN. For an ECS Fargate task to access S3, the task role with the necessary permissions must be specified in the task definition. If the task role ARN is incorrect or missing, the container will not be able to assume the role, causing S3 access failures. Option A is wrong because the task execution role is used only by the ECS agent to pull container images and send logs, not for application-level S3 access. Option B is wrong because the question states that the task role already has the required S3 permissions, so the bucket policy is likely not the issue. Option C is wrong because an S3 VPC endpoint is not required if the task can reach S3 through the internet or a NAT gateway; its absence would not prevent uploads if proper routing exists.

Answer

The Task execution role is missing S3 permissions

Answer

The S3 bucket policy denies access to the task role

Answer

The VPC does not have an S3 VPC endpoint

Question 7

A company uses AWS CloudFormation to deploy infrastructure. They want to update a stack but need to ensure that a specific resource is not accidentally replaced. Which CloudFormation attribute should they use?

Accepted Answer

UpdateReplacePolicy. UpdateReplacePolicy. This attribute allows you to specify how CloudFormation handles resource updates that require replacement. You can set it to 'Retain' to keep the old resource and prevent replacement during a stack update. DeletionPolicy (option A) only controls what happens when a resource is deleted, not during updates that require replacement. CreationPolicy and UpdatePolicy do not address replacement prevention.

Answer

DeletionPolicy

Answer

CreationPolicy

Answer

UpdatePolicy

Question 8

A company uses Amazon DynamoDB with on-demand capacity. They notice that a specific table frequently exceeds the write throughput limit and experiences throttling. The table has a partition key with high cardinality. What is the MOST likely cause of throttling?

Accepted Answer

A sudden spike in write traffic exceeds the table's burst capacity. On-demand DynamoDB tables can handle traffic spikes up to double the previous peak. If write traffic exceeds that threshold, throttling occurs. The table's burst capacity is limited to the previous peak for on-demand, so a sudden spike exceeding that will cause throttling. Option B is incorrect because DAX is a caching layer for reads, not writes, and does not affect write throughput. Option C is incorrect because the table is using on-demand capacity, not provisioned; on-demand does not have provisioned write capacity. Option D is incorrect because auto scaling is not applicable for on-demand tables; on-demand automatically scales, but still has a limit based on previous peak.

Answer

The table is using DynamoDB Accelerator (DAX) for writes

Answer

The write workload exceeds the table's provisioned write capacity

Answer

The table has auto scaling disabled

Question 9

A company uses AWS Elastic Beanstalk to deploy a web application. They want to update the environment's configuration to use a larger instance type without any downtime. Which update policy supports this?

Accepted Answer

Rolling. (Rolling) is correct because Rolling update with batch size updates instances in batches, keeping the environment running and avoiding downtime. Option A is wrong because All at once replaces all instances simultaneously, causing downtime. Option B is wrong because Blue/Green is not a built-in Elastic Beanstalk update policy; it's a manual approach. Option C is wrong because Immutable update launches new instances in a separate ASG and then swaps, which causes a brief downtime during the swap.

Answer

All at once

Answer

Blue/Green

Answer

Immutable

Question 10

A company uses Amazon RDS for PostgreSQL and needs to apply a minor version upgrade. They want to minimize downtime. Which approach should they use?

Accepted Answer

Use a Multi-AZ deployment and apply the upgrade. With a Multi-AZ deployment, RDS performs the minor version upgrade on the standby first, then fails over so the standby becomes the new primary, and finally upgrades the old primary (now standby). This failover-based rolling upgrade reduces downtime to only the brief failover window (typically 60-120 seconds), which is far less than an in-place upgrade. This is the AWS-recommended approach for minimizing downtime during minor version upgrades on RDS.

Answer

Apply the upgrade during the maintenance window

Answer

Create a read replica, upgrade it, and promote it

Answer

Modify the DB parameter group to set the version

Question 11

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. Which TWO actions are required?

Accepted Answer

Add a manual approval action to the pipeline. Option B is correct because AWS CodePipeline natively supports a manual approval action type that can be inserted into any stage (typically before the production deploy stage) to pause the pipeline until an approver acts. Option E is correct because the IAM user performing the approval must have permissions for the codepipeline:PutApprovalResult action on the relevant pipeline/stage/action resource; without this IAM policy the approval cannot be submitted. Option A is incorrect because manual approvals are a built-in CodePipeline action type and do not require a custom Lambda function. Option C is incorrect because CloudWatch Events (EventBridge) rules are used for reacting to pipeline state changes, not for invoking or performing manual approvals. Option D is incorrect because an SNS topic is optional — it can notify approvers, but it is not required to add or complete a manual approval step.

Answer

Create a Lambda function to trigger the approval

Answer

Set up a CloudWatch Events rule to invoke the approval

Answer

Configure an SNS topic to notify the approver

Question 12

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

Accepted Answer

Use AWS KMS (SSE-KMS). Options D and E are correct. Both SSE-KMS (AWS KMS) and SSE-S3 (S3-Managed Keys) are server-side encryption options that encrypt data at rest in Amazon S3. Option A (SSL/TLS) encrypts data in transit, not at rest. Option B (bucket policy) controls access permissions but does not provide encryption. Option C (client-side encryption) would encrypt data before sending to S3, but it is not an AWS-managed service and requires client-side implementation; the question focuses on encryption at rest provided by AWS.

Answer

Enable SSL/TLS for the S3 bucket

Answer

Configure a bucket policy to enforce encryption

Answer

Use client-side encryption

Question 13

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to example-bucket with SSE-S3 (AES256) encryption. What will happen?

Accepted Answer

The upload fails because the Deny statement explicitly denies it. In IAM policy evaluation, an explicit Deny always overrides any Allow. Even though the policy contains an Allow for the action, the Deny statement explicitly blocks the upload under the specified condition (SSE-S3/AES256), so the request is denied and the upload fails.

Answer

The upload fails because there is no explicit Allow for PutObject

Answer

The upload succeeds because the Allow statement permits it

Answer

The upload succeeds because SSE-S3 is allowed by the first statement

Question 14

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

Accepted Answer

Create a Change Set for the stack to preview the changes and identify the conflict.. A Change Set is the correct approach because it performs a dry-run of the stack update, showing exactly which resources will be added, modified, or deleted, and it surfaces resource conflicts before execution. When a stack update fails due to a resource conflict (e.g., a resource already exists or a property cannot be updated in place), the Change Set preview will indicate the problematic resource and the nature of the conflict. This allows the operations team to modify the template accordingly without repeatedly attempting and failing the update.

Answer

Review the stack's 'Events' tab in the AWS Management Console to find the error message.

Answer

Use AWS CloudFormation StackSets to deploy the update across multiple accounts.

Answer

Run a drift detection operation on the stack to identify manual changes.

Question 15

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

Accepted Answer

Configure a Direct Connect gateway and attach a VPN to it, then advertise the same prefixes via BGP with lower priority on the VPN.. To provide automatic failover from Direct Connect to a VPN backup, the company should configure a Direct Connect gateway, attach a Site-to-Site VPN to it (via a transit gateway or virtual private gateway), and advertise the same on-premises prefixes over both paths using BGP, with the VPN path set to a lower priority (longer AS path or higher MED). BGP then automatically prefers the Direct Connect path and fails over to the VPN when the Direct Connect becomes unavailable. This is the AWS-recommended hybrid high-availability design.

Answer

Use a NAT gateway to route traffic through the internet as a backup.

Answer

Create a Site-to-Site VPN connection and update route tables to point all traffic to the VPN.

Answer

Set up a second Direct Connect connection from a different provider.