SAP-C02 Continuous Improvement for Existing Solutions Practice Test 6 — 15 Questions

Question 1

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon S3 bucket that contains sensitive data. The security team requires that all traffic between the ECS tasks and S3 remain within the AWS network and not traverse the internet. What is the MOST secure way to meet this requirement?

Accepted Answer

Create a VPC endpoint for S3 and attach it to the VPC.. Option C is correct because using a VPC endpoint for S3 (Gateway or Interface) ensures traffic stays within the AWS network. Option A is wrong because internet traffic goes over the public internet. Option B is wrong because a NAT gateway is for outbound internet, not private access to S3. Option D is wrong because S3 Transfer Acceleration uses the internet.

Answer

Use an internet gateway and route traffic through a NAT gateway.

Answer

Enable S3 Transfer Acceleration on the bucket.

Answer

Use a NAT gateway and update the route table to direct S3 traffic to the NAT.

Question 2

A company uses AWS CloudFormation to manage infrastructure. A recent stack update failed because a resource exceeded a service quota. The team wants to be notified proactively when service limits are approaching. Which solution meets this requirement?

Accepted Answer

Use Amazon CloudWatch to monitor service quota usage metrics and set CloudWatch alarms.. Option A is correct because CloudWatch can monitor service quotas via metrics published by AWS and trigger alarms. Option B is wrong because AWS Config evaluates resource configurations, not quotas. Option C is wrong because Trusted Advisor provides a dashboard but not proactive alarms. Option D is wrong because CloudTrail logs API calls, not quota utilization.

Answer

Use AWS CloudTrail to monitor API calls that indicate quota exhaustion.

Answer

Use AWS Config rules to check if resources are within limits.

Answer

Use AWS Trusted Advisor to check service limits regularly.

Question 3

A company runs a web application on EC2 instances behind an ALB. The application uses an Amazon Aurora MySQL database. The operations team notices that the database CPU utilization is consistently above 80% during business hours. The team needs to reduce database load without changing the application code. Which TWO actions should the team take? (Select TWO.)

Accepted Answer

Create an Aurora read replica and direct read queries to it.. Option A is correct because implementing an ElastiCache caching layer can reduce repeat database queries. Option D is correct because creating an Aurora read replica and directing read traffic to it offloads the primary instance. Option B is wrong because increasing the DB instance class may help but is not a best practice for immediate load reduction. Option C is wrong because increasing Auto Scaling group size does not affect database load. Option E is wrong because enabling Performance Insights is for monitoring, not load reduction.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Amazon RDS Performance Insights to identify slow queries.

Answer

Increase the Auto Scaling group maximum size to handle more traffic.

Question 4

A company uses AWS Organizations to manage multiple accounts. The security team needs to ensure that all S3 buckets across the organization are encrypted at rest. Currently, some buckets are not encrypted. Which THREE steps should the team take to enforce encryption? (Select THREE.)

Accepted Answer

Create an SCP that denies PutBucketAcl or PutBucketPolicy actions if the bucket does not have encryption enabled.. Option A is correct because a service control policy can prevent creating unencrypted buckets. Option C is correct because AWS Config rules can detect non-compliant buckets. Option D is correct because S3 default encryption ensures new objects are encrypted. Option B is wrong because S3 bucket policies enforce encryption at upload time, not after creation. Option E is wrong because CloudTrail logs events but does not enforce encryption.

Answer

Apply an S3 bucket policy on each bucket that denies PutObject without encryption.

Answer

Use AWS CloudTrail to monitor S3 API calls and alert on unencrypted bucket creation.

Question 5

A company runs a stateless web application on EC2 instances in an Auto Scaling group. The application occasionally receives traffic spikes that cause the Auto Scaling group to launch new instances. However, the new instances take several minutes to become healthy, causing a temporary performance degradation. Which TWO actions would improve the scaling responsiveness? (Select TWO.)

Accepted Answer

Use a launch template with a pre-provisioned AMI that includes the application and dependencies.. Option B is correct because using a launch template with a pre-warmed Amazon Machine Image (AMI) reduces instance startup time. Option D is correct because scheduled scaling can add capacity before expected spikes. Option A is wrong because decreasing the health check grace period may cause instances to be terminated prematurely. Option C is wrong because increasing cooldown period delays scaling. Option E is wrong because reducing the health check interval does not speed up instance initialization.

Answer

Increase the Auto Scaling group cooldown period.

Answer

Reduce the target group health check interval to 5 seconds.

Answer

Decrease the health check grace period to 30 seconds.

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer. Users report intermittent slowdowns. CloudWatch metrics show high CPU utilization on the instances. The company wants to improve performance with minimal architectural changes. What should a solutions architect do?

Accepted Answer

Configure an Auto Scaling group with a dynamic scaling policy based on CPU utilization.. Option C is correct because Auto Scaling with a dynamic scaling policy based on CPU utilization automatically adjusts capacity to handle load spikes. Option A is wrong because vertical scaling (larger instances) has an upper limit and may cause downtime during resizing. Option B is wrong because CloudFront caches content but doesn't reduce CPU load from dynamic requests. Option D is wrong because ElastiCache adds a caching layer but may not address CPU bottlenecks from compute-intensive operations.

Answer

Use Amazon ElastiCache to offload database queries.

Answer

Replace the EC2 instances with a larger instance type.

Answer

Enable Amazon CloudFront in front of the ALB to cache content.

Question 7

A company has a legacy monolithic application running on a single EC2 instance. The application stores customer data in an attached EBS volume. The company wants to modernize the application to improve scalability and availability. Which approach should a solutions architect recommend?

Accepted Answer

Refactor the application into microservices running on Amazon ECS with data stored in Amazon S3.. Option D is correct because migrating to a containerized, stateless application decouples storage and allows scaling. Option A is wrong because a larger instance still has a single point of failure. Option B is wrong because RDS is for databases, not for application data stored in files. Option C is wrong because a Multi-Attach EBS volume has limited support and multiple instances writing to the same volume can cause data corruption.

Answer

Use a larger EC2 instance with enhanced networking.

Answer

Configure multiple EC2 instances to share the same EBS volume using Multi-Attach.

Answer

Replace the EBS volume with an Aurora RDS database.

Question 8

A solutions architect notices that an Auto Scaling group's instances are continuously being terminated and replaced. CloudWatch logs show that health checks are failing due to high memory usage. The instances run a memory-intensive application. What should the architect do to improve stability?

Accepted Answer

Create a CloudWatch alarm for memory utilization and attach it to a scaling policy.. Option A is correct because adding a memory alarm allows the Auto Scaling group to scale out before memory exhaustion causes failures. Option B is wrong because increasing instance count per AZ doesn't address the root cause of memory pressure. Option C is wrong because memory-optimized instances provide more memory per instance, reducing the likelihood of failure. Option D is wrong because a scheduled scaling policy is for predictable traffic, not for memory-driven scaling.

Answer

Change the instance type to a memory-optimized family like R5.

Answer

Use a scheduled scaling policy to add instances during peak hours.

Answer

Increase the minimum number of instances in the Auto Scaling group.

Question 9

A company is using Amazon S3 to store critical data and needs to ensure that objects are automatically deleted after 30 days. The current lifecycle policy is configured to expire objects after 30 days, but objects are not being deleted. What is the most likely cause?

Accepted Answer

The bucket has S3 Object Lock enabled with a retention period exceeding 30 days.. Option C is correct because S3 Lifecycle policies require proper permissions to execute actions. Option A is wrong because S3 Object Lock can prevent deletion if retention period is set. Option B is wrong because versioning does not prevent lifecycle expiration; expired delete markers are removed. Option D is wrong because storage class transitions do not affect expiration.

Answer

The bucket has versioning enabled, and lifecycle rules apply only to current versions.

Answer

The objects are stored in the S3 Glacier Deep Archive storage class.

Answer

The IAM role used by S3 Lifecycle lacks the s3:DeleteObject permission.

Question 10

A company runs a production database on Amazon RDS for PostgreSQL. The database experiences high write latency during peak hours. The company wants to improve write performance with minimal cost. Which action should a solutions architect take?

Accepted Answer

Use RDS for PostgreSQL with multiple write replicas and configure application-level sharding.. Option D is correct because using multiple write replicas with sharding distributes the write load. Option A is wrong because adding more read replicas does not help write performance. Option B is wrong because Multi-AZ does not improve write performance; it provides failover. Option C is wrong while increasing IOPS helps, it may not be cost-effective compared to sharding.

Answer

Enable Multi-AZ deployment for automatic failover.

Answer

Add multiple read replicas in different Availability Zones.

Answer

Increase the allocated storage and provisioned IOPS.

Question 11

A company is using Amazon CloudFront to deliver content to users worldwide. The origin is an S3 bucket. Users in some regions experience high latency. What is the most effective way to reduce latency?

Accepted Answer

Use an origin shield to reduce the number of requests to the S3 bucket.. Option B is correct because using an origin shield reduces load on the origin and improves cache hit ratio, reducing latency. Option A is wrong because enabling additional SSL methods does not affect latency. Option C is wrong while adding more edge locations is not directly configurable; CloudFront automatically uses a global network. Option D is wrong because S3 Transfer Acceleration speeds up uploads, not downloads.

Answer

Add more CloudFront edge locations in the affected regions.

Answer

Enable CloudFront's SSL/TLS certificate using SNI only.

Answer

Enable S3 Transfer Acceleration on the bucket.

Question 12

A company is running a stateful web application on EC2 instances in an Auto Scaling group. Users report that their sessions are lost when instances are terminated during scale-in. What should a solutions architect do to preserve session state?

Accepted Answer

Store session state in Amazon ElastiCache.. Option D is correct because ElastiCache provides a centralized, fast session store that persists across instance terminations. Option A is wrong because sticky sessions (session affinity) can cause uneven load and still lose sessions if all instances in a target group are replaced. Option B is wrong because increasing cooldown delays scaling but does not prevent session loss. Option C is wrong because lifecycle hooks allow custom actions before termination, but moving session data during termination is complex and may not be reliable.

Answer

Use lifecycle hooks to save session data to Amazon S3 before instance termination.

Answer

Enable sticky sessions (session affinity) on the Application Load Balancer.

Answer

Increase the Auto Scaling group's cooldown period to prevent rapid scaling.

Question 13

A company is migrating a legacy application to AWS. The application requires a fixed IP address for whitelisting by a third-party service. The application will run on EC2 instances behind an Application Load Balancer. The company needs a solution that provides a static IP address for outbound traffic. What should a solutions architect do?

Accepted Answer

Place the EC2 instances in a private subnet and route outbound traffic through a NAT Gateway with an Elastic IP.. Option D is correct because a NAT Gateway in a public subnet with an Elastic IP provides a static IP for outbound traffic from private instances. Option A is wrong because ALBs do not have Elastic IPs; they use dynamic IPs. Option B is wrong while an NLB can have static IPs, it is for inbound traffic, not outbound. Option C is wrong because an Internet Gateway does not provide a static IP; it is a routing target.

Answer

Replace the ALB with a Network Load Balancer and assign Elastic IPs.

Answer

Assign an Elastic IP address to the Application Load Balancer.

Answer

Attach an Internet Gateway to the VPC and assign an Elastic IP to it.

Question 14

A company uses AWS CloudFormation to deploy infrastructure. A recent change to a stack failed because an IAM role name already exists. The company wants to avoid this issue in the future. What should a solutions architect do?

Accepted Answer

Use the Fn::Sub function with a reference to the AWS::StackName in the IAM role name.. Option B is correct because using the Fn::Sub function with !Ref AWS::StackName makes the role name unique per stack. Option A is wrong because the AWS::IAM::Role resource does not have a DeletionPolicy attribute that recreates roles. Option C is wrong while EnableTerminationProtection prevents accidental deletion but does not help with naming conflicts. Option D is wrong because a custom resource with a Lambda function is overkill and adds complexity.

Answer

Enable termination protection on the stack.

Answer

Use a DeletionPolicy of Retain on the IAM role resource.

Answer

Create a custom resource with an AWS Lambda function to generate a random role name.

Question 15

A company has a web application running on EC2 instances in an Auto Scaling group. The application experiences unpredictable traffic spikes. The company wants to ensure that the application can scale out quickly and scale in to reduce costs. Which TWO actions should the solutions architect recommend?

Accepted Answer

Create a target tracking scaling policy based on Average CPU Utilization.. Options B and C are correct. A target tracking scaling policy based on a metric like CPU utilization automatically adjusts capacity. A simple scaling policy with a step adjustment allows rapid scaling out. Option A is wrong because scheduled scaling is for predictable patterns. Option D is wrong because manual scaling is not automated. Option E is wrong because a lifecycle hook delays scale-in, increasing costs.

Answer

Configure a lifecycle hook to delay instance termination during scale-in.

Answer

Manually increase the desired capacity during peak times.

Answer

Use a scheduled scaling policy to add instances during expected peak hours.