SAP-C02 Continuous Improvement for Existing Solutions Practice Test 5 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

Accepted Answer

Use the RDS Multi-AZ DNS name (CNAME) that automatically updates after failover.. Option B is correct because using the RDS cluster endpoint (for Aurora) or the Multi-AZ DNS name (which automatically points to the current primary) ensures the application reconnects with minimal disruption. Option A is wrong because read replicas are for read scaling, not automatic failover. Option C is wrong because using an Elastic IP with RDS is not supported. Option D is wrong because a Network Load Balancer adds complexity and latency.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Create a read replica in another Region and promote it during failover manually.

Answer

Configure a Network Load Balancer in front of the RDS instance.

Question 2

A company stores sensitive data in Amazon S3. They need to ensure that data is encrypted at rest using a key managed by the company's on-premises hardware security module (HSM). Which S3 encryption option should they use?

Accepted Answer

Client-Side Encryption using the company's own encryption library.. Option D is correct because S3 client-side encryption allows the company to encrypt data before uploading using their own key from the on-premises HSM. Option A is wrong because SSE-S3 uses AWS-managed keys. Option B is wrong because SSE-KMS uses AWS KMS, not the company's own HSM. Option C is wrong because SSE-C uses a customer-provided key, but the key must be provided with each request and is not stored in an on-premises HSM.

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Answer

Server-Side Encryption with AWS KMS (SSE-KMS).

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Question 3

A company has a production AWS Lambda function that processes orders. The function's execution time has increased, causing timeouts. The team wants to troubleshoot without affecting production traffic. What should they do?

Accepted Answer

Create a new Lambda function with a different name to test the code changes.. Option B is correct because creating a separate Lambda function with the same code but a different name allows testing and debugging without impacting the production function. Option A is wrong because version aliases can route traffic but still affect production. Option C is wrong because CloudWatch Logs will show the production function's logs. Option D is wrong because changing the timeout directly on the production function could break the SLA.

Answer

Enable detailed CloudWatch Logs for the production function and analyze them.

Answer

Use a Lambda alias to route a percentage of traffic to a new version with increased timeout.

Answer

Increase the timeout of the production Lambda function temporarily.

Question 4

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

Accepted Answer

The health check target path or port is misconfigured.. Option C is correct because if the health check target is misconfigured (e.g., wrong path or port), healthy instances may be marked as unhealthy, causing unnecessary replacements and errors. Option A is wrong because a longer health check interval would reduce unnecessary replacements. Option B is wrong because instance type does not directly affect health checks. Option D is wrong because a smaller Auto Scaling group might cause capacity issues but not necessarily errors due to unhealthy instances.

Answer

The EC2 instances are of a burstable performance type.

Answer

The Auto Scaling group's minimum size is too small.

Answer

The health check interval is too long.

Question 5

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

Accepted Answer

Add a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. Option D is correct because an S3 bucket policy with a condition that denies PutObject if encryption headers are not present enforces encryption for all new objects. Option A is wrong because default encryption only encrypts objects that don't specify encryption, but doesn't enforce it. Option B is wrong because pre-signed URLs do not enforce encryption. Option C is wrong because CloudFront does not enforce encryption at the S3 level.

Answer

Use Amazon CloudFront to enforce HTTPS.

Answer

Enable S3 default encryption on the bucket.

Answer

Require pre-signed URLs for all uploads.

Question 6

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to ensure that during a patching cycle, the application remains available and no requests are dropped. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Perform a rolling update using a batch size of 50% with a pause time.. Options B and D are correct. B: Using a lifecycle hook with a custom action can pause the instance before termination, allowing graceful draining. D: Using a rolling update with a batch size ensures that only a portion of instances are patched at a time. Option A is wrong because stopping instances all at once causes downtime. Option C is wrong because increasing desired capacity without draining connections may cause issues. Option E is wrong because Amazon Inspector identifies vulnerabilities but does not implement patching.

Answer

Increase the desired capacity of the Auto Scaling group before patching.

Answer

Stop all instances at the same time to apply patches consistently.

Answer

Use Amazon Inspector to automatically patch instances.

Question 7

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They want to improve performance and reduce costs. Which THREE actions should they take? (Choose THREE.)

Accepted Answer

Enable Lambda Provisioned Concurrency for the function.. Options A, C, and D are correct. A: Lambda Provisioned Concurrency reduces cold starts for predictable traffic. C: Using DAX reduces read latency and DynamoDB costs. D: API Gateway caching reduces the number of requests to Lambda and DynamoDB. Option B is wrong because increasing timeout may increase costs without improving performance. Option E is wrong because DynamoDB on-demand can be more expensive for predictable workloads.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Increase the Lambda function timeout to 5 minutes.

Question 8

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create one or more read replicas in the same Region.. Options A and D are correct. A: Creating a read replica offloads read queries from the primary database. D: Using an RDS Proxy allows connection pooling, reducing overhead. Option B is wrong because Multi-AZ is for high availability, not read scaling. Option C is wrong because increasing instance size can help but is often more expensive than read replicas. Option E is wrong because ElastiCache is for caching data, not for offloading database queries directly.

Answer

Enable Multi-AZ deployment for the database.

Answer

Increase the instance size of the primary database.

Answer

Use Amazon ElastiCache to cache query results.

Question 9

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. The operations team notices that the ALB is returning a high number of 504 errors during peak hours. Which configuration change is MOST likely to reduce the 504 errors?

Accepted Answer

Increase the idle timeout setting on the ALB.. Option B is correct because increasing the idle timeout setting on the ALB can help prevent premature connection closures that cause 504 errors. Option A is wrong because increasing the deregistration delay only affects instance draining, not idle timeouts. Option C is wrong because enabling cross-zone load balancing does not address timeout issues. Option D is wrong because increasing the health check interval does not affect idle timeouts.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the health check interval for the target group.

Answer

Increase the deregistration delay on the target group.

Question 10

A company runs a critical web application on EC2 instances behind an ALB. The application stores session data in an ElastiCache Redis cluster. During a recent outage, the Redis cluster failed and all active sessions were lost, causing users to be logged out. Which solution would provide the HIGHEST availability for session data?

Accepted Answer

Enable Cluster Mode and deploy Redis in Multi-AZ with replicas.. Option D is correct because ElastiCache for Redis with Cluster Mode enabled and Multi-AZ provides automatic failover and data replication across Availability Zones. Option A is wrong because a single-node cluster has no redundancy. Option B is wrong because increasing instance size does not provide failover. Option C is wrong because disabling persistence reduces durability.

Answer

Deploy a single-node Redis cluster with automatic backups.

Answer

Disable Redis persistence to improve performance.

Answer

Use a larger Redis instance type to handle more connections.

Question 11

A company has a microservices architecture running on Amazon ECS with Fargate. Each service writes logs to CloudWatch Logs. The operations team needs to search across all logs for a specific error pattern. Currently, they manually query each log group, which is time-consuming. What is the MOST efficient way to enable centralized log search?

Accepted Answer

Use CloudWatch Logs Insights to query all log groups from a single query.. Option A is correct because CloudWatch Logs Insights allows querying multiple log groups in a single query, enabling centralized search. Option B is wrong because subscription filters send logs to a destination, but Kinesis Data Firehose is not designed for ad-hoc search. Option C is wrong because S3 is for long-term storage, not real-time search. Option D is wrong because CloudWatch Contributor Insights analyzes top contributors, not arbitrary patterns.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use CloudWatch Contributor Insights to identify the top error sources.

Answer

Create a subscription filter for each log group that sends logs to a Kinesis Data Firehose delivery stream.

Question 12

A company uses AWS Lambda to process events from an Amazon SQS queue. The Lambda function is invoked with a batch size of 10. Recently, the function started failing with timeout errors when processing large batches. Which solution would improve the reliability of event processing without losing messages?

Accepted Answer

Reduce the batch size to a smaller value, such as 5.. Option C is correct because reducing the batch size decreases the processing time per invocation, reducing the chance of timeout. Option A is wrong because increasing the timeout may not help if the issue is total processing time. Option B is wrong because increasing reserved concurrency does not help with timeout. Option D is wrong because SQS queues do not send batches to Lambda as SQS batch size; the Lambda batch size is the relevant parameter.

Answer

Increase the SQS queue visibility timeout to match the function timeout.

Answer

Increase the Lambda function reserved concurrency to handle more invocations.

Answer

Increase the Lambda function timeout to the maximum 15 minutes.

Question 13

A company runs a static website on Amazon S3 behind Amazon CloudFront. The website uses a custom domain and SSL certificate from AWS Certificate Manager (ACM). Users report that they sometimes see an older version of the website after updates. What should the company do to ensure users always see the latest content?

Accepted Answer

Create a CloudFront invalidation for the updated files.. Option B is correct because creating a CloudFront invalidation removes cached objects, forcing CloudFront to fetch the latest content from the origin. Option A is wrong because S3 bucket versioning controls object versions but does not invalidate CloudFront cache. Option C is wrong because decreasing TTL affects future caching but does not clear existing cache. Option D is wrong because disabling the distribution is disruptive and unnecessary.

Answer

Disable and re-enable the CloudFront distribution after each update.

Answer

Enable S3 bucket versioning and use version IDs in URLs.

Answer

Reduce the CloudFront TTL to 0 seconds for all objects.

Question 14

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Option D is correct because increasing the number of DPUs (data processing units) allocated to the Glue job can parallelize processing and reduce runtime. Option A is wrong because converting to Parquet is a good practice but does not reduce processing time if the job is CPU-bound. Option B is wrong because increasing the timeout does not speed up processing. Option C is wrong because S3 Transfer Acceleration speeds up uploads, not Glue processing.

Answer

Increase the Glue job timeout setting to 24 hours.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Answer

Convert the input data from CSV to Parquet format.

Question 15

A company uses Amazon RDS for MySQL for its database. The operations team notices that read queries are slow during peak hours. The application is read-heavy and can tolerate eventual consistency. Which solution would improve read performance with minimal application changes?

Accepted Answer

Create an RDS read replica and direct read traffic to it.. Option B is correct because creating a read replica offloads read traffic from the primary instance, improving read performance. Option A is wrong because increasing the DB instance size may help but is more expensive and not as targeted. Option C is wrong because RDS Proxy is for connection pooling, not read scaling. Option D is wrong because Multi-AZ provides high availability, not read scaling.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Multi-AZ deployment for failover support.

Answer

Enable RDS Proxy to pool database connections.