SAP-C02 Continuous Improvement for Existing Solutions Practice Test 4 — 15 Questions

Question 1

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function writes results to a DynamoDB table. Over time, the function's execution time has increased, and some operations fail with ProvisionedThroughputExceededException. The function is configured with 1024 MB memory and a 5-minute timeout. The DynamoDB table has 1000 RCUs and 500 WCUs. The Lambda function performs reads and writes on the same table. What is the MOST cost-effective way to resolve the throttling without sacrificing performance?

Accepted Answer

Use SQS to decouple the S3 trigger from the Lambda function and implement a batching strategy to DynamoDB. Option C is correct because increasing WCUs alone would cost more and might not be efficient if the issue is read-heavy. Option D (DAX) reduces read latency but doesn't increase write capacity. Option A (increase memory) increases CPU but not write capacity. Option B (SQS) decouples the writes, allowing retries and smoothing out spikes, which is cost-effective because SQS is cheap and prevents throttling by buffering requests.

Answer

Enable DynamoDB Accelerator (DAX) for the table

Answer

Increase DynamoDB write capacity units to 1000 WCUs

Answer

Increase the Lambda function memory to 2048 MB

Question 2

A DevOps engineer notices that a CloudFormation stack update fails with the error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, but others failed to update. The engineer needs to fix the stack and complete the update. What should the engineer do FIRST?

Accepted Answer

Manually correct the resources that are preventing rollback, then use 'ContinueUpdateRollback'. Option B is correct because when a stack update fails and rollback fails, you must manually fix the resources that prevent rollback (e.g., delete a resource that is stuck) and then continue the rollback. Option A is wrong because you cannot update a stack in UPDATE_ROLLBACK_FAILED state without first completing the rollback. Option C is wrong because you cannot add resources while in failure state. Option D is wrong because you cannot delete the stack without first fixing the rollback.

Answer

Add a new resource to the stack to force a new update

Answer

Submit another stack update with the original template to overwrite the changes

Answer

Delete the stack and recreate it with the same template

Question 3

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The deployment pipeline includes a source stage, a build stage using CodeBuild, and a deploy stage. Recently, deployments have been failing in the deploy stage with the error: 'The environment is in an invalid state for this operation.' The developer confirms the build artifacts are correct. What is the MOST likely cause?

Accepted Answer

Another deployment or configuration update is already in progress on the environment. Option C is correct because if there is an ongoing update or configuration change, Elastic Beanstalk prevents concurrent operations. Option A is wrong because CodePipeline does not require a specific instance type. Option B is wrong because insufficient capacity would cause a different error. Option D is wrong because the environment URL being unavailable is a symptom, not cause.

Answer

The environment's load balancer is not available

Answer

The environment's Auto Scaling group has insufficient capacity

Answer

The Elastic Beanstalk environment uses a t2.micro instance type which is not supported by CodePipeline

Question 4

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

Accepted Answer

Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation. Option D is correct because AWS Config rules with automatic remediation via Systems Manager Automation documents can enforce encryption and public access settings across accounts using an organization-wide conformance pack. Option A is too manual. Option B (Service Control Policies) can prevent public access but not enforce encryption on existing buckets. Option C (CloudWatch Events) requires per-account setup and custom Lambda functions.

Answer

Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption

Answer

Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption

Answer

Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts

Question 5

A company is using AWS CloudFormation to manage infrastructure. The operations team wants to be notified when a stack operation fails. Which approach is the MOST efficient?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack. Option B is correct because CloudFormation can directly publish to SNS topics on stack events, including failures. Option A is inefficient because it requires polling. Option C is not native. Option D is expensive and complex.

Answer

Create a scheduled CloudWatch Events rule that calls the DescribeStacks API and sends an alert if status is FAILED

Answer

Use a Lambda function that is invoked by CloudFormation via custom resource

Answer

Use Amazon EventBridge to monitor CloudFormation API calls and trigger a Lambda function

Question 6

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared EFS file system for persistent data. The operations team notices that during scale-in events, some requests fail because the instance is terminated while still processing. What is the BEST way to prevent request failures during scale-in?

Accepted Answer

Use lifecycle hooks to put the instance in a 'terminating:wait' state and complete request processing. Option C is correct because lifecycle hooks allow the Auto Scaling group to wait for a custom action (e.g., drain connections) before terminating an instance. Option A (increase cooldown) delays scaling but does not prevent interruption. Option B (decrease scale-in threshold) reduces the chance but not the issue. Option D (use a Network Load Balancer) does not help with instance termination.

Answer

Use a Network Load Balancer with connection draining enabled

Answer

Increase the cooldown period for the Auto Scaling group

Answer

Decrease the scale-in threshold to reduce the frequency of termination

Question 7

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

Accepted Answer

Use a step scaling policy with a lower scale-out threshold and a larger adjustment. Option B is correct because step scaling policies respond more aggressively to larger deviations, helping to add capacity faster. Option A (increase memory) does not directly affect scaling. Option C (increase health check interval) would slow detection of unhealthy tasks. Option D (use target tracking) is reactive and may not handle spikes well.

Answer

Increase the task memory allocation to improve performance

Answer

Increase the health check interval to reduce the number of tasks marked unhealthy

Answer

Use a target tracking scaling policy with a higher target value

Question 8

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. The company also needs to ensure that any attempt to upload an unencrypted object is blocked. How can the company enforce this requirement?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with value aws:kms. Option B is correct because a bucket policy that denies PutObject without x-amz-server-side-encryption header set to aws:kms will enforce encryption at upload time. Option A is not possible at the bucket level. Option C (default encryption) does not enforce on existing uploads if the header is omitted. Option D (CloudTrail) is detective, not preventive.

Answer

Enable default encryption on the bucket with AWS KMS

Answer

Use AWS CloudTrail to monitor PutObject calls and alert on unencrypted uploads

Answer

Enable S3 Object Lock on the bucket

Question 9

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

Accepted Answer

Mount an EFS volume to the instances for log storage. Option A ensures logs are sent to CloudWatch in near real-time. Option B ensures that if the instance fails, logs are not lost by writing to a persistent volume. Option C (S3) is not necessary if using CloudWatch Logs. Option D (SQS) adds complexity. Option E (CloudWatch agent with auto-scaling) is not a separate feature.

Answer

Use the CloudWatch agent with the auto-scaling group lifecycle hooks

Answer

Configure the Auto Scaling group to send logs to Amazon S3 on instance termination

Answer

Use Amazon SQS to buffer log events before sending to CloudWatch Logs

Question 10

A company uses AWS CodeBuild to compile and test code. The build process takes a long time because dependencies are downloaded from the internet each time. The company wants to speed up the build process. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use a custom Docker image in CodeBuild that includes the dependencies. Option A avoids downloading dependencies on every build by using a custom Docker image with pre-installed dependencies. Option B caches dependency files in a persistent S3 bucket. Option C (increase compute) may help but does not address the root cause. Option D (parallel builds) may increase complexity. Option E (CodeArtifact) is for storing artifacts but does not speed up initial download as much as caching.

Answer

Use AWS CodeArtifact to store and retrieve dependencies

Answer

Use local build agents to run builds in parallel

Answer

Increase the compute type of the build environment

Question 11

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team observes that some services are experiencing high latency during peak hours. The team wants to identify the root cause. Which THREE approaches should the team use? (Choose THREE.)

Accepted Answer

Use AWS X-Ray to trace requests through the microservices. Option A provides detailed metrics for each service. Option C helps trace requests across services. Option E shows latency distribution. Option B (CloudTrail) is for API calls. Option D (VPC Flow Logs) is for network traffic analysis, not application latency.

Answer

Enable AWS CloudTrail to log API calls

Answer

Enable VPC Flow Logs to analyze network traffic

Question 12

A company uses Amazon S3 to store critical data. They need to ensure that data is automatically replicated to another AWS Region for disaster recovery. Which configuration meets this requirement with minimal operational overhead?

Accepted Answer

Enable S3 Cross-Region Replication (CRR) on the source bucket.. Option D is correct because S3 Cross-Region Replication (CRR) automatically replicates objects to a destination bucket in a different AWS Region, providing disaster recovery with minimal operational overhead. Option A is wrong because S3 Versioning alone does not replicate data. Option B is wrong because S3 Lifecycle policies manage storage tiers, not replication. Option C is wrong because S3 Transfer Acceleration speeds up uploads but does not replicate data.

Answer

Enable S3 Versioning on the source bucket.

Answer

Use S3 Transfer Acceleration to upload objects to both Regions.

Answer

Configure an S3 Lifecycle policy to transition objects to S3 Glacier.

Question 13

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

Accepted Answer

Use a cell-based architecture where each microservice runs in isolated cells with independent data stores.. Option B is correct because adopting a cell-based architecture isolates failures to individual cells, reducing blast radius. Option A is wrong because a single shared database creates a single point of failure. Option C is wrong while Auto Scaling helps with capacity, it does not isolate failures. Option D is wrong because a single Application Load Balancer can still be a bottleneck.

Answer

Implement Auto Scaling groups for each microservice without separating data stores.

Answer

Route all traffic through a single Application Load Balancer to simplify management.

Answer

Deploy all microservices in a single Availability Zone with a shared database.

Question 14

A DevOps engineer notices that an EC2 instance's CPU utilization is consistently above 90%. They need to optimize costs without affecting performance. What should they do?

Accepted Answer

Rightsize the instance to a larger instance type.. Option C is correct because rightsizing the instance to a larger type can provide more CPU capacity, potentially reducing contention and allowing the same workload to run efficiently. Option A is wrong because buying Reserved Instances locks in cost but does not solve performance. Option B is wrong because terminating and recreating does not change instance type. Option D is wrong because adding more instances may increase cost unnecessarily.

Answer

Add more EC2 instances behind a load balancer.

Answer

Purchase a Reserved Instance for the current instance type.

Answer

Terminate the instance and launch a new one of the same type.

Question 15

A company runs a web application on a single EC2 instance. They want to improve availability and fault tolerance with minimal architectural changes. What should they do?

Accepted Answer

Use an Auto Scaling group with a minimum of two instances across two Availability Zones.. Option D is correct because placing instances in an Auto Scaling group across multiple Availability Zones ensures that if one AZ fails, traffic is routed to the other. Option A is wrong because a larger instance does not add fault tolerance. Option B is wrong because multiple subnets in one AZ still share that AZ's risk. Option C is wrong because multiple EBS volumes do not provide instance-level redundancy.

Answer

Attach multiple EBS volumes to the instance.

Answer

Create multiple subnets in the same Availability Zone.

Answer

Upgrade to a larger instance type.