SAP-C02 Continuous Improvement for Existing Solutions Practice Test 5 — 15 Questions

Question 1

A DevOps team wants to automatically enforce tagging standards on all AWS resources created in an account. If a resource is created without the required tags, the team wants to prevent the creation or remediate it. Which AWS service should the team use?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS Config. AWS Config provides managed and custom rules that evaluate resource configurations, including required tags. Config rules can be configured with remediation actions (via SSM Automation) to auto-tag or delete non-compliant resources, and Config can also be used with AWS Organizations to enforce tag policies across accounts.

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Resource Groups & Tag Editor

Question 2

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent timeouts when calling an external API. The ECS tasks are in a private subnet with a NAT gateway. How can the company improve the reliability of outbound traffic?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update the route tables.. A NAT Gateway in each AZ provides high availability; without it, a single NAT Gateway failure causes timeouts. Option A is wrong because it reduces security. Option C is wrong because it does not address NAT redundancy. Option D is wrong because it adds complexity without directly fixing NAT issues.

Answer

Place the tasks in a public subnet with auto-assign public IP.

Answer

Increase the NAT gateway's bandwidth by using a larger instance type.

Answer

Use AWS Transit Gateway to route traffic through a central VPC.

Question 3

A company receives a Trusted Advisor recommendation to reduce costs by deleting unused Amazon EBS snapshots. The company has hundreds of snapshots. Which approach should the company use to identify and delete snapshots that are no longer needed?

Accepted Answer

Use AWS Backup to manage snapshots and set retention rules.. AWS Backup provides lifecycle policies and centralized snapshot management, making it easy to identify and automatically delete unused snapshots. Option A is incorrect because detailed billing reports show cost data but do not help identify which specific snapshots are unused. Option B is incorrect because manually checking each snapshot with the AWS CLI is not scalable for hundreds of snapshots. Option D is incorrect because Amazon S3 Lifecycle policies manage S3 objects, not EBS snapshots.

Answer

Enable detailed billing reports and analyze costs.

Answer

Use the AWS CLI to list all snapshots and manually check each one.

Answer

Use Amazon S3 Lifecycle policies to expire snapshots automatically.

Question 4

A company uses Amazon S3 to store critical data. The company wants to ensure that data is protected against accidental deletion and that deleted objects can be recovered within 30 days. Which S3 feature should the company enable?

Accepted Answer

S3 Versioning. S3 Versioning keeps multiple variants of an object in the same bucket, so if an object is accidentally deleted or overwritten, a previous version can be restored. With versioning enabled, a delete operation adds a delete marker rather than permanently removing the object, allowing recovery within the retention window.

Answer

S3 Server Access Logging

Answer

S3 Object Lock in governance mode

Answer

S3 Intelligent-Tiering

Question 5

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

Accepted Answer

Assign Elastic IP addresses to the Network Load Balancer.. You can assign Elastic IP addresses to the Network Load Balancer per Availability Zone, providing static IPs for external partners to whitelist. Option E is correct because AWS Global Accelerator provides two static IP addresses (or allows you to bring your own) and can be used with an NLB as an endpoint, offering static IPs that partners can whitelist. Option A is incorrect because attaching Elastic IPs to EC2 instances does not provide static IPs for the NLB frontend; the NLB uses its own IPs. Option C is incorrect because an Application Load Balancer (ALB) does not support static IP addresses by default and operates at layer 7, not suitable for this requirement. Option D is incorrect because AWS WAF is a web application firewall that filters traffic based on rules but does not provide static IP addresses for the load balancer.

Answer

Attach an Elastic IP to each EC2 instance.

Answer

Configure an Application Load Balancer instead of NLB.

Answer

Use AWS WAF to allow traffic from the partners' IP ranges.

Question 6

A company has a production AWS account with multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The firewall must be able to process traffic, and the solution must be highly available. Which THREE steps should the company take?

Accepted Answer

Attach Elastic Network Interfaces (ENIs) of the firewall instances to the inspection VPC subnets.. Options A, C, and E are correct. A: Attaching ENIs of firewall instances to the inspection VPC subnets allows traffic to be forwarded to the firewall for inspection. C: Deploying the firewall appliance as an EC2 instance in each AZ with auto scaling groups ensures high availability and scalability. E: Creating a dedicated inspection VPC with firewall instances in different Availability Zones centralizes inspection and provides fault tolerance. Option B is incorrect because propagating routes directly between VPCs would bypass the inspection firewall. Option D is incorrect because using a single route table in the Transit Gateway would not allow for selective routing to the inspection VPC and limits high availability.

Answer

Configure the Transit Gateway to propagate routes directly between VPCs.

Answer

Use a single route table in the Transit Gateway for all VPC attachments.

Question 7

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

Accepted Answer

AWS Config. AWS Config (option D) is correct because it can continuously evaluate S3 bucket policies and ACLs against managed or custom rules (for example, s3-bucket-public-read-prohibited and s3-bucket-public-write-prohibited), detect any bucket that becomes publicly accessible, and trigger remediation via SSM Automation — giving the security team organization-wide detection and enforcement. AWS Organizations Service Control Policies (option E) are correct because SCPs applied at the root or OU level set the maximum permissions for all member accounts, so a deny statement on s3:PutBucketPolicy, s3:PutBucketAcl, or s3:PutAccountPublicAccessBlock prevents principals in those accounts from making buckets public in the first place. AWS Resource Access Manager (A) only shares resources such as subnets or Transit Gateways across accounts and has no role in blocking public S3 access. AWS WAF (B) filters HTTP/HTTPS traffic at CloudFront, ALB, or API Gateway and cannot control S3 bucket policies or ACLs. AWS IAM Identity Center (C) handles workforce SSO and permission sets for human users, not organization-wide preventive guardrails on S3.

Answer

AWS Resource Access Manager

Answer

AWS WAF

Answer

AWS IAM Identity Center (SSO)

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

Accepted Answer

The 'ec2:StartInstances' action does not support resource-level conditions.. The policy includes a condition requiring the resource tag 'Environment: production', but the ec2:StartInstances action does not support resource-level condition keys (like ec2:ResourceTag). Therefore, the condition is never evaluated, and the action is denied by default. Option A is incorrect because attaching the policy to a group effectively applies it to all group members. Option B is incorrect because the policy does not require MFA. Option C is incorrect because the policy does allow ec2:StartInstances on specific resources, but the condition is the issue.

Answer

The policy is attached to a group, not directly to the user.

Answer

The user does not have MFA enabled.

Answer

The policy does not allow 'ec2:StartInstances' on all resources.

Question 9

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CodePipeline to send notifications to an Amazon SNS topic when the pipeline fails.. AWS CodePipeline natively supports sending notifications to Amazon SNS topics when pipeline state changes occur, such as failure. This is the most direct and efficient method without requiring additional services. Option B is incorrect because while the build script could use the AWS CLI to send a notification, this would require modifying the build script and does not leverage CodePipeline's built-in notification capability. Option C is incorrect because although a CloudWatch Events (EventBridge) rule can trigger a Lambda function to send email via SES, this approach is more complex and less efficient than using SNS directly from CodePipeline. Option D is incorrect because CloudWatch alarms are designed for metric-based thresholds, not for pipeline state changes; CodePipeline events are better handled via SNS or EventBridge.

Answer

Have the build script send a notification on failure using the AWS CLI.

Answer

Set up a CloudWatch Events rule to trigger an AWS Lambda function that sends an email via Amazon SES.

Answer

Create a CloudWatch alarm on the CodePipeline failure metric.

Question 10

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

Accepted Answer

Use an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is not present.. An S3 bucket policy that denies PutObject unless the request includes the SSE-KMS key header enforces encryption at the API layer, so any upload lacking the required KMS key is rejected outright. This is preventive, applies to all principals including root and IAM users, and directly enforces the use of a customer-managed key. It is the most secure and deterministic way to guarantee the requirement across all buckets.

Answer

Use AWS Config rules to detect unencrypted objects and remediate with Lambda.

Answer

Enable default encryption on each bucket with SSE-KMS.

Answer

Create an IAM policy that requires kms:Encrypt permission for all S3 operations.

Question 11

A company is running a batch processing job on an EC2 instance that processes data from an S3 bucket and writes results to another S3 bucket. The job runs once per hour and takes about 20 minutes. The company wants to optimize costs by only paying for compute time when the job is running. Which solution is MOST cost-effective?

Accepted Answer

Use AWS Batch with spot instances to run the job only when needed.. AWS Batch automatically provisions and terminates EC2 instances based on job queue requirements, and it can use Spot Instances for significant cost savings. Option A (AWS Lambda) is wrong because the batch job takes 20 minutes, exceeding the 15-minute maximum execution time for Lambda functions. Option B (Reserved Instance) is wrong because it requires a 1-year commitment and still incurs costs for idle hours when the job is not running. Option C (t3.micro running 24/7) is wrong because while it is low-cost, it still charges for idle time, making it less cost-effective than only paying for compute during job execution.

Answer

Convert the batch job into an AWS Lambda function.

Answer

Purchase a Reserved Instance for the EC2 instance to reduce hourly cost.

Answer

Use a t3.micro instance and keep it running 24/7 since it's low cost.

Question 12

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

Accepted Answer

Use Amazon S3 for temporary data storage.. Moving temporary data to Amazon S3 provides durable, highly available object storage at low cost, and S3 is designed for 11 nines of durability. Since the data is temporary, S3's cost-effective standard or infrequent access tiers can store it without the expense of mirrored EBS volumes. This improves durability without significantly increasing cost.

Answer

Increase the IOPS of the current EBS volume to improve performance.

Answer

Add additional EBS volumes and set up RAID 1 for mirroring.

Answer

Move the temporary data to an instance store volume if the instance type supports it.

Question 13

A company runs a containerized microservices application on Amazon EKS. The operations team notices that some pods are frequently being evicted due to resource constraints. The team wants to improve resource utilization and reduce evictions. Which TWO actions should the team take? (Choose two.)

Accepted Answer

Configure Horizontal Pod Autoscaler based on CPU and memory utilization.. Option A is correct because configuring the Horizontal Pod Autoscaler (HPA) to scale pods based on CPU and memory utilization allows the application to dynamically add replicas when demand rises, spreading the workload and reducing the chance that individual pods hit resource limits and get evicted. Option C is correct because setting ResourceQuotas per namespace caps aggregate CPU/memory consumption, preventing a single namespace or team from monopolizing node resources and causing other pods to be evicted due to node pressure. Option B is not ideal because blindly increasing resource requests for all pods reduces schedulable capacity and can worsen utilization rather than improve it. Option D is not the best fit because Cluster Autoscaler only adds nodes when pods are unschedulable, not when pods are being evicted for exceeding their own limits. Option E is not selected because Vertical Pod Autoscaler adjusts requests over time but does not directly address utilization or eviction pressure as effectively as HPA plus quotas in this scenario.

Answer

Increase the resource requests for all pods to ensure they have enough resources.

Answer

Enable Cluster Autoscaler to add more worker nodes.

Answer

Use Vertical Pod Autoscaler to automatically adjust pod resource requests.

Question 14

A company uses AWS CodeCommit to store source code and CodePipeline for CI/CD. The pipeline includes a build stage using CodeBuild and a deploy stage to Elastic Beanstalk. The team wants to add a manual approval step before deployment to production. Which THREE resources are needed? (Choose three.)

Accepted Answer

An approval action in the CodePipeline stage.. To add a manual approval step before deployment to production, you need: an approval action in the CodePipeline stage (A), an Amazon SNS topic to send approval notifications (E), and an IAM role for CodePipeline to publish to the SNS topic (C). The approval action pauses the pipeline and sends a notification via SNS. A CloudWatch Events rule (B) is not required because the approval action itself triggers the notification, not an event. An AWS Lambda function (D) is not needed because the approval process is handled natively by CodePipeline with SNS.

Answer

A CloudWatch Events rule to trigger the approval action.

Answer

An AWS Lambda function to process approval requests.

Question 15

A company applies the above IAM policy to an IAM user. The user attempts to upload an object to my-bucket using the AWS CLI with the command: aws s3 cp file.txt s3://my-bucket/. What is the outcome?

Accepted Answer

The upload fails with an access denied error because the Deny statement with StringNotEquals blocks the request.. The Deny statement with StringNotEquals on s3:x-amz-server-side-encryption denies any PutObject that does not specify SSE-S3 (AES256). Since the CLI command does not include any encryption header, the Deny condition matches and the request is denied. Option A is incorrect because evaluation order does not matter; an explicit Deny always overrides an Allow. Option C is incorrect because the Allow statement requires encryption, which is not provided. Option D is incorrect because the Deny statement applies precisely when no encryption header is present.

Answer

The upload fails with an access denied error because the Deny statement is evaluated first.

Answer

The upload succeeds because the Allow statement matches.

Answer

The upload succeeds because the Deny statement does not apply when no encryption header is present.