SAP-C02 Continuous Improvement for Existing Solutions Practice Test 5 — 15 Questions

Question 1

A company runs a critical web application on EC2 instances behind an Application Load Balancer. The instances are in an Auto Scaling group with a dynamic scaling policy based on average CPU utilization. After a recent deployment, users report intermittent timeouts. CloudWatch metrics show CPU utilization spikes to 90% before scaling out, but the new instances take 5 minutes to become healthy. What is the MOST effective solution to reduce timeouts during traffic spikes?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Decrease the cooldown period and set a lower CPU utilization threshold for scale-out. By decreasing the cooldown period and lowering the CPU utilization threshold for scale-out, the Auto Scaling group reacts faster to rising CPU usage. The lower threshold triggers a scale-out action before CPU reaches 90%, and the reduced cooldown allows new instances to start sooner after the previous scaling activity. This addresses the 5-minute startup lag by ensuring new instances are launched earlier in the spike, reducing the window of timeouts. Option A (scheduled scaling) only helps for predictable spikes, not intermittent ones. Option B (pre-warming the load balancer) is not a standard AWS feature and does not reduce instance startup time. Option D (predictive scaling) still has the same startup delay and requires historical data.

Answer

Use a scheduled scaling policy to add instances before expected peak times

Answer

Pre-warm the load balancer to reduce latency

Answer

Switch to predictive scaling

Question 2

A company uses AWS Lambda to process files uploaded to an S3 bucket. The Lambda function writes results to a DynamoDB table. Over time, the function's execution time has increased, and some operations fail with ProvisionedThroughputExceededException. The function is configured with 1024 MB memory and a 5-minute timeout. The DynamoDB table has 1000 RCUs and 500 WCUs. The Lambda function performs reads and writes on the same table. What is the MOST cost-effective way to resolve the throttling without sacrificing performance?

Accepted Answer

Use SQS to decouple the S3 trigger from the Lambda function and implement a batching strategy to DynamoDB. The most cost-effective solution because it uses SQS to decouple the S3 trigger from the Lambda function, allowing the Lambda to batch writes to DynamoDB. This reduces the frequency of writes, smooths out traffic spikes, and enables retries on throttling exceptions without scaling up capacity. Option A (DAX) only improves read performance, not writes. Option C (increasing WCUs) increases cost significantly without addressing the root cause of bursty traffic. Option D (increasing memory) improves compute but not write throughput, and may increase cost without resolving throttling.

Answer

Enable DynamoDB Accelerator (DAX) for the table

Answer

Increase DynamoDB write capacity units to 1000 WCUs

Answer

Increase the Lambda function memory to 2048 MB

Question 3

A DevOps engineer notices that a CloudFormation stack update fails with the error: 'UPDATE_ROLLBACK_FAILED'. The stack is in a state where some resources were updated, but others failed to update. The engineer needs to fix the stack and complete the update. What should the engineer do FIRST?

Accepted Answer

Manually correct the resources that are preventing rollback, then use 'ContinueUpdateRollback'. When a stack update fails and rollback fails, you must manually fix the resources that prevent rollback (e.g., delete a resource that is stuck) and then continue the rollback. Option A is wrong because you cannot update a stack in UPDATE_ROLLBACK_FAILED state without first completing the rollback. Option C is wrong because you cannot add resources while in failure state. Option D is wrong because you cannot delete the stack without first fixing the rollback.

Answer

Add a new resource to the stack to force a new update

Answer

Submit another stack update with the original template to overwrite the changes

Answer

Delete the stack and recreate it with the same template

Question 4

A company uses AWS CodePipeline to deploy a web application to an Elastic Beanstalk environment. The deployment pipeline includes a source stage, a build stage using CodeBuild, and a deploy stage. Recently, deployments have been failing in the deploy stage with the error: 'The environment is in an invalid state for this operation.' The developer confirms the build artifacts are correct. What is the MOST likely cause?

Accepted Answer

Another deployment or configuration update is already in progress on the environment. If another deployment or configuration update is already in progress, Elastic Beanstalk prevents concurrent operations, resulting in the 'environment is in an invalid state for this operation' error. Option A is incorrect because load balancer unavailability would cause health check or routing issues, not this error. Option B is incorrect because insufficient Auto Scaling capacity would lead to scaling failures, not an invalid state error. Option C is incorrect because CodePipeline does not impose instance type restrictions on Elastic Beanstalk environments.

Answer

The environment's load balancer is not available

Answer

The environment's Auto Scaling group has insufficient capacity

Answer

The Elastic Beanstalk environment uses a t2.micro instance type which is not supported by CodePipeline

Question 5

A financial services company has a multi-account AWS Organization with hundreds of accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest and that no public read access is allowed. They want a solution that automatically remediates non-compliant buckets in real time. What is the MOST scalable and operationally efficient approach?

Accepted Answer

Use AWS Config conformance packs with remediation actions through AWS Systems Manager Automation. AWS Config conformance packs with remediation via Systems Manager Automation can be deployed across all accounts in an AWS Organization. This allows automatic detection and remediation of non-compliant S3 buckets (e.g., lacking encryption or having public read access) in near real-time, providing a scalable and operationally efficient solution without custom code. Option A (SCPs) can prevent public access policies but cannot enforce encryption on existing buckets. Option C (CloudWatch Events) requires per-account setup and custom Lambda functions, and does not cover bucket modifications. Option D (daily Lambda scans) is not real-time and does not provide automatic remediation.

Answer

Use Service Control Policies to deny PutBucketPolicy that allows public access and require encryption

Answer

Use Amazon CloudWatch Events to detect bucket creation and trigger a Lambda function to apply encryption

Answer

Use AWS Config rules and AWS Lambda functions to scan buckets daily and send alerts

Question 6

A company is using AWS CloudFormation to manage infrastructure. The operations team wants to be notified when a stack operation fails. Which approach is the MOST efficient?

Accepted Answer

Configure an SNS topic as a notification option in the CloudFormation stack. CloudFormation can directly publish to SNS topics on stack events, including failures. Option A is inefficient because it requires polling. Option C is not native. Option D is expensive and complex.

Answer

Create a scheduled CloudWatch Events rule that calls the DescribeStacks API and sends an alert if status is FAILED

Answer

Use a Lambda function that is invoked by CloudFormation via custom resource

Answer

Use Amazon EventBridge to monitor CloudFormation API calls and trigger a Lambda function

Question 7

A company runs a stateful web application on EC2 instances in an Auto Scaling group. The application uses a shared EFS file system for persistent data. The operations team notices that during scale-in events, some requests fail because the instance is terminated while still processing. What is the BEST way to prevent request failures during scale-in?

Accepted Answer

Use lifecycle hooks to put the instance in a 'terminating:wait' state and complete request processing. Lifecycle hooks allow the Auto Scaling group to put the instance in a 'terminating:wait' state, giving it time to complete processing existing requests before termination. Option A (Network Load Balancer with connection draining) can help drain new connections but does not ensure that in-flight requests are completed, especially for a stateful application using EFS. Option B (increase cooldown) only delays scaling decisions and does not prevent termination of an instance that is already processing. Option C (decrease scale-in threshold) reduces the frequency of scale-in events but does not prevent request failures when termination occurs.

Answer

Use a Network Load Balancer with connection draining enabled

Answer

Increase the cooldown period for the Auto Scaling group

Answer

Decrease the scale-in threshold to reduce the frequency of termination

Question 8

A company runs a critical application on Amazon ECS Fargate. The application uses an Application Load Balancer as the front end. Recently, the application experienced a spike in traffic, and many tasks were marked as unhealthy and replaced. The team wants to improve resilience to traffic spikes without over-provisioning. What should the team do?

Accepted Answer

Use a step scaling policy with a lower scale-out threshold and a larger adjustment. Step scaling policies can respond more aggressively to larger traffic spikes by using a lower scale-out threshold and a larger adjustment, adding capacity faster when needed. Option B (increase task memory) does not directly affect scaling behavior. Option C (increase health check interval) would actually delay detection of unhealthy tasks, potentially reducing resilience. Option D (target tracking) is reactive and may not handle sudden spikes as effectively as step scaling.

Answer

Increase the task memory allocation to improve performance

Answer

Increase the health check interval to reduce the number of tasks marked unhealthy

Answer

Use a target tracking scaling policy with a higher target value

Question 9

A company is using Amazon S3 to store sensitive data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. The company also needs to ensure that any attempt to upload an unencrypted object is blocked. How can the company enforce this requirement?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with value aws:kms. A bucket policy that denies s3:PutObject if the request does not include the x-amz-server-side-encryption header with the value aws:kms will enforce encryption at upload time, blocking any unencrypted upload. Option B (default encryption) does not enforce on all uploads if the request header is omitted. Option C (CloudTrail) is detective, not preventive. Option D (Object Lock) is for write-once-read-many (WORM) compliance, not encryption.

Answer

Enable default encryption on the bucket with AWS KMS

Answer

Use AWS CloudTrail to monitor PutObject calls and alert on unencrypted uploads

Answer

Enable S3 Object Lock on the bucket

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group. The application writes logs to local instance storage. The operations team wants to centralize log analysis using Amazon CloudWatch Logs. The team needs a solution that is resilient to instance failures and does not lose logs. Which TWO options should the team implement? (Choose TWO.)

Accepted Answer

Mount an EFS volume to the instances for log storage. (EFS volume) ensures log persistence even if an instance fails, because EFS is a shared, durable file system. Option C (CloudWatch agent) streams logs to CloudWatch Logs in near real-time, enabling centralized analysis. Option A (lifecycle hooks) is not sufficient for streaming logs to CloudWatch; it only helps with final log delivery on instance termination but doesn't provide real-time streaming. Option D (SQS) adds unnecessary complexity; CloudWatch agent can directly stream logs. Option E (S3) is not needed when using CloudWatch Logs.

Answer

Use the CloudWatch agent with the auto-scaling group lifecycle hooks

Answer

Configure the Auto Scaling group to send logs to Amazon S3 on instance termination

Answer

Use Amazon SQS to buffer log events before sending to CloudWatch Logs

Question 11

A company uses AWS CodeBuild to compile and test code. The build process takes a long time because dependencies are downloaded from the internet each time. The company wants to speed up the build process. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Use a custom Docker image in CodeBuild that includes the dependencies. Reduces build time by using a custom Docker image that pre-installs dependencies, avoiding repeated downloads. Option E caches dependency files in Amazon S3 so subsequent builds reuse them instead of downloading again. Option A (CodeArtifact) manages package storage but does not inherently speed up the initial build; it still requires downloading from CodeArtifact. Option D (increasing compute) may help but does not address the root cause of repeated downloads. Option C (parallel builds) adds complexity without solving the dependency download issue.

Answer

Use AWS CodeArtifact to store and retrieve dependencies

Answer

Use local build agents to run builds in parallel

Answer

Increase the compute type of the build environment

Question 12

A company runs a microservices architecture on Amazon ECS with Fargate. The operations team observes that some services are experiencing high latency during peak hours. The team wants to identify the root cause. Which THREE approaches should the team use? (Choose THREE.)

Accepted Answer

Use AWS X-Ray to trace requests through the microservices. (AWS X-Ray) traces requests through microservices to pinpoint latency sources. Option D (Amazon CloudWatch ServiceLens) correlates metrics, logs, and traces for comprehensive analysis. Option E (Container Insights for Amazon ECS) provides resource metrics (e.g., CPU, memory, network) to identify bottlenecks. Option B (AWS CloudTrail) logs API calls, not application performance. Option C (VPC Flow Logs) analyzes network traffic, not application-level latency.

Answer

Enable AWS CloudTrail to log API calls

Answer

Enable VPC Flow Logs to analyze network traffic

Question 13

A company is migrating from a monolithic application to microservices on AWS. They need to reduce the blast radius of failures. Which architecture pattern should they implement?

Accepted Answer

Use a cell-based architecture where each microservice runs in isolated cells with independent data stores.. Cell-based architecture isolates failures to individual cells, reducing blast radius. Option A is wrong because sharing a data store creates a single point of failure. Option C is wrong because a single Application Load Balancer creates a single point of failure and bottleneck. Option D is wrong because a single Availability Zone and shared database are single points of failure.

Answer

Implement Auto Scaling groups for each microservice without separating data stores.

Answer

Route all traffic through a single Application Load Balancer to simplify management.

Answer

Deploy all microservices in a single Availability Zone with a shared database.

Question 14

A DevOps engineer notices that an EC2 instance's CPU utilization is consistently above 90%. They need to optimize costs without affecting performance. What should they do?

Accepted Answer

Add more EC2 instances behind a load balancer.. Adding more EC2 instances behind a load balancer allows you to distribute the workload across multiple smaller instances, which can be more cost-effective than a single large instance. This approach (scaling out) can improve performance and availability without necessarily increasing costs, as you can use smaller, cheaper instance types. Option B is wrong because rightsizing to a larger instance typically increases cost, contrary to the goal of cost optimization. Option C is wrong because purchasing a Reserved Instance reduces cost but does not address the high CPU utilization performance issue. Option D is wrong because launching a new instance of the same type does not solve the performance problem.

Answer

Rightsize the instance to a larger instance type.

Answer

Purchase a Reserved Instance for the current instance type.

Answer

Terminate the instance and launch a new one of the same type.

Question 15

A company runs a web application on a single EC2 instance. They want to improve availability and fault tolerance with minimal architectural changes. What should they do?

Accepted Answer

Use an Auto Scaling group with a minimum of two instances across two Availability Zones.. Using an Auto Scaling group with a minimum of two instances across two Availability Zones provides high availability and fault tolerance. If one Availability Zone fails, the other zone continues to serve traffic. Option A is wrong because multiple EBS volumes do not protect against instance or AZ failure. Option C is wrong because multiple subnets in the same Availability Zone still share the same failure domain. Option D is wrong because a larger instance type does not add redundancy.

Answer

Attach multiple EBS volumes to the instance.

Answer

Create multiple subnets in the same Availability Zone.

Answer

Upgrade to a larger instance type.