SAP-C02 Continuous Improvement for Existing Solutions Practice Test 6 — 15 Questions

Question 1

A security engineer runs the above command to list network interfaces attached to security group sg-12345678. The engineer notices that instance i-0a1b2c3d4e5f67890 has two network interfaces but only one is shown in the output. What is the MOST likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The second interface is associated with a different security group.. The AWS CLI command 'aws ec2 describe-network-interfaces --filters Name=group-id,Values=sg-12345678' returns only ENIs whose security group matches the filter. If the instance has two ENIs but only one appears, the second ENI is attached to a different security group and is therefore excluded by the filter.

Answer

The second interface is not attached to the instance.

Answer

The second interface has a device index of 0.

Answer

The command only returns interfaces that are attached.

Question 2

A company deploys the above CloudFormation template. After creation, they upload a file to the bucket and then delete it. What happens to the deleted object after 30 days?

Accepted Answer

The previous version is permanently deleted, but the delete marker remains.. The lifecycle rule expires noncurrent versions after 30 days. Deleting the object creates a delete marker (current version) and the previous version becomes noncurrent. After 30 days, the noncurrent version is permanently deleted, but the delete marker remains. Option A is wrong because the delete marker is not permanently deleted. Option B is wrong because the delete marker is not removed and the object does not become current again. Option C is wrong because only the noncurrent version is permanently deleted, not the delete marker.

Answer

All versions of the object are permanently deleted.

Answer

The delete marker is removed, and the object becomes current again.

Answer

The object is permanently deleted along with the delete marker.

Question 3

A company runs a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). They have configured an Auto Scaling group with a dynamic scaling policy based on CPU utilization. During a traffic spike, the Auto Scaling group launches new instances, but users report slow response times. What should the company do to improve the scaling responsiveness?

Accepted Answer

Implement scheduled scaling actions to add capacity before known peak times.. Scheduled scaling adds capacity at known peak times before the traffic spike hits, which directly improves responsiveness because instances are already running when demand arrives. Dynamic CPU-based scaling reacts only after utilization rises, and instance launch time (boot + app warm-up) causes the slow response users experienced. Scheduled scaling is the right fix for predictable peaks.

Answer

Decrease the CPU utilization threshold for scale-out.

Answer

Increase the cooldown period for the Auto Scaling group.

Answer

Change the scaling policy to step scaling with a higher step adjustment.

Question 4

A company is migrating a legacy monolithic application to AWS. They plan to use Amazon ECS with Fargate for containerized microservices. The application requires sticky sessions and SSL termination. What should the company use to meet these requirements?

Accepted Answer

Network Load Balancer (NLB) with target group stickiness.. Network Load Balancer (NLB) supports TLS termination at the listener level and provides sticky sessions through target group stickiness (source IP affinity). This meets the requirements for containerized microservices on Amazon ECS with Fargate. Application Load Balancer (ALB) also supports sticky sessions and SSL termination, but NLB is more cost-effective for high-throughput scenarios and works well with Fargate. Options C and D are incorrect because Classic Load Balancer is legacy and lacks advanced features, while AWS Lambda with API Gateway is not a load balancer and cannot directly provide sticky sessions.

Answer

Application Load Balancer (ALB) with stickiness and SSL termination.

Answer

Classic Load Balancer (CLB) with SSL termination at the instance.

Answer

AWS Lambda with API Gateway.

Question 5

A company has a stateful web application running on Amazon EC2 instances. They want to implement blue/green deployments to reduce downtime. Which TWO actions should the company take? (Choose TWO.)

Accepted Answer

Migrate session state to Amazon ElastiCache or DynamoDB.. Option A is correct because a stateful web application stores session data locally on each EC2 instance, which breaks blue/green deployments since users would lose their sessions when traffic shifts to the green environment; externalizing session state to Amazon ElastiCache (Redis/Memcached) or DynamoDB makes the instances stateless so either environment can serve any user. Option C is correct because Amazon Route 53 weighted routing policies let you gradually shift a percentage of DNS traffic from the blue environment to the green environment, enabling controlled cutover and easy rollback if issues arise. Option B is not required because while an ELB can front both environments, the question asks for actions specifically enabling blue/green traffic shifting, and DNS weighted routing is the mechanism that shifts traffic between environments. Option D is incorrect because a high TTL causes DNS resolvers to cache the old records longer, slowing the traffic shift and undermining gradual cutover; a low TTL is preferred. Option E is incorrect because immediately deregistering blue instances removes the ability to roll back and can abruptly terminate in-flight sessions, defeating the purpose of a safe blue/green deployment.

Answer

Use an Elastic Load Balancer (ELB) to manage the blue and green environments.

Answer

Set a high TTL on the DNS record to prevent caching issues.

Answer

Immediately deregister the blue instances from the load balancer after deployment.

Question 6

A company runs a critical application on Amazon RDS for MySQL. They want to implement a disaster recovery (DR) strategy across AWS Regions with a Recovery Point Objective (RPO) of 1 second and Recovery Time Objective (RTO) of 1 minute. Which TWO strategies meet these requirements? (Choose TWO.)

Accepted Answer

Use Amazon Aurora Global Database with a primary in one Region and a secondary in another Region.. Amazon RDS Multi-AZ does not support cross-Region standby; it only provides high availability within a single region. Option C is correct: Amazon Aurora Global Database offers synchronous cross-Region replication with automatic failover, typically achieving an RPO of less than 1 second and RTO of 1 minute, although it requires migrating from RDS MySQL to Aurora. Option D is incorrect: AWS DMS with continuous change data capture (CDC) uses asynchronous replication, which cannot guarantee a 1-second RPO. Option B is incorrect because manual snapshots every hour cannot achieve an RPO of 1 second. Option E is incorrect because cross-Region read replicas use asynchronous replication, so RPO is not guaranteed to be 1 second, and manual promotion takes longer than 1 minute.

Answer

Use Amazon RDS Multi-AZ deployment in the primary Region with a standby in another Region.

Answer

Take manual snapshots of the RDS instance every hour and copy them to another Region.

Answer

Use AWS Database Migration Service (DMS) for continuous replication to another Region.

Answer

Configure cross-Region read replicas for RDS MySQL.

Question 7

A company has an IAM policy attached to a user. When the user tries to stop an EC2 instance using the AWS CLI, they receive an 'AccessDenied' error. The instance is tagged with 'Environment=Production'. What is the most likely cause?

Accepted Answer

A service control policy (SCP) or a resource-based policy is denying the action.. The 'AccessDenied' error despite having the StopInstances permission indicates that something else is denying the action. The most likely cause is a service control policy (SCP) attached at the account or organizational level, or a resource-based policy on the EC2 instance itself that explicitly denies the action. Option A is wrong because incorrect CLI syntax would cause a different error. Option B is wrong because the policy may not have a tag-based condition; the issue is not about missing tag permissions. Option C is wrong because the policy can use a wildcard for the Resource field, so not specifying an instance ID does not cause AccessDenied. Option D correctly identifies that an SCP or resource-based policy is denying the action.

Answer

The user is using an incorrect CLI command syntax.

Answer

The policy does not allow the ec2:StopInstances action for instances with the 'Environment=Production' tag.

Answer

The policy does not specify the instance ID in the Resource field.

Question 8

A company uses this CloudFormation template to manage an S3 bucket. They notice that old object versions are not being deleted after 30 days. What is the most likely reason?

Accepted Answer

The bucket contains delete markers that are not being expired.. When S3 versioning is enabled and objects are deleted, S3 adds delete markers instead of permanently removing the object. A lifecycle rule that expires noncurrent versions will not remove the delete markers themselves unless a separate rule explicitly expires them. Therefore, old object versions may remain because the delete markers prevent the noncurrent versions from being expired, or the rule is not configured to expire delete markers.

Answer

The bucket has a bucket policy that prevents deletion.

Answer

Versioning is not enabled on the bucket.

Answer

The lifecycle rule is disabled.

Question 9

A company runs a production database on Amazon RDS for PostgreSQL. They need to perform a major version upgrade with minimal downtime. Which strategy should they use?

Accepted Answer

Create a read replica of the current database using the new version, promote it, and update the connection string.. Creating a read replica with the new PostgreSQL version, promoting it, and updating the connection string minimizes downtime by allowing the replica to catch up before promotion. Option A (DMS) adds complexity and potential lag. Option C (pg_dump) involves export/import time and potential data loss. Option D (in-place upgrade) causes downtime during the upgrade and risk of failure.

Answer

Use AWS Database Migration Service (DMS) to replicate data to a new instance.

Answer

Create a new RDS instance with the new version and migrate data using pg_dump.

Answer

Take a snapshot of the database, perform an in-place upgrade, and restore if needed.

Question 10

A company has an Amazon S3 bucket that stores sensitive data. They want to ensure that all objects in the bucket are encrypted at rest. What should they do?

Accepted Answer

Enable default encryption on the S3 bucket using SSE-S3 or SSE-KMS.. Enabling default encryption on the bucket ensures all new objects are encrypted. Option A is wrong because CloudTrail only logs and does not enforce encryption. Option C is wrong because versioning does not enforce encryption. Option D is wrong because a bucket policy that denies PutObject if not encrypted can be circumvented or does not cover existing objects, but default encryption is more straightforward.

Answer

Use AWS CloudTrail to monitor for unencrypted objects.

Answer

Enable S3 Versioning to protect objects.

Answer

Create a bucket policy that denies PutObject if the object is not encrypted.

Question 11

A company runs a containerized application on Amazon ECS with Fargate. The application needs to access an Amazon RDS database that is in a private subnet. The ECS tasks are launched in a public subnet. How should they configure network access?

Accepted Answer

Launch the ECS tasks in the same private subnet as the RDS instance.. For an ECS Fargate task to reach an RDS instance in a private subnet, the simplest and most secure configuration is to launch the task in the same private subnet (or a private subnet with a route to the RDS subnet). Fargate tasks in a public subnet with a public IP cannot initiate connections to a private RDS endpoint without a NAT or peering path, and placing them in the private subnet keeps traffic on the private network. This also avoids exposing the task to the internet.

Answer

Place the ECS tasks in a public subnet and use a NAT gateway to route traffic to the database.

Answer

Set up a VPN connection between the ECS tasks and the database.

Answer

Use an Application Load Balancer to route traffic to the database.

Question 12

A company uses AWS Config to record resource changes. The security team wants to be notified when an S3 bucket policy changes to allow public access. What is the most efficient way to achieve this?

Accepted Answer

Create an AWS Config rule that triggers a custom Lambda function to check bucket policies and publish to SNS.. AWS Config rules can evaluate resource configurations and trigger remediation or notifications. To notify when an S3 bucket policy allows public access, you can create a custom AWS Config rule that uses a Lambda function to check the bucket policy and publish to SNS if noncompliant. This is efficient because AWS Config continuously monitors changes.

Answer

Configure S3 event notifications on the bucket to send events to SNS.

Answer

Set up an AWS Config rule to directly publish to an SNS topic when noncompliant.

Answer

Enable AWS CloudTrail and create a metric filter for PutBucketPolicy events.

Question 13

A company uses Amazon RDS for PostgreSQL with Multi-AZ and automated backups set to 35 days. The database experiences a sudden spike in write IOPS, causing performance degradation. The team needs to investigate the cause without affecting production. What should they do?

Accepted Answer

Create a read replica from the latest automated snapshot and enable Performance Insights on the replica.. Creating a read replica from the latest automated snapshot and enabling Performance Insights on the replica lets the team analyze query-level performance without touching the production instance. Performance Insights on the replica provides the same wait-event and SQL-level visibility, and the snapshot ensures the replica reflects the production data state at the time of the incident. This satisfies the requirement to investigate without affecting production.

Answer

Use the enhanced monitoring feature to collect OS-level metrics on the production instance.

Answer

Review Amazon CloudWatch metrics for the production DB instance to identify the cause.

Answer

Enable Performance Insights on the production instance to analyze queries.

Question 14

A company uses Amazon ECS with Fargate launch type for a web application. During deployments, the new tasks fail health checks and the deployment rolls back. What should the team do to identify why the new tasks are failing?

Accepted Answer

View the stopped task logs in Amazon CloudWatch Logs.. When ECS tasks fail health checks and the deployment rolls back, the task's application-level output is the most direct evidence of why the container is unhealthy. With Fargate, there is no host to SSH into, so CloudWatch Logs (configured via the awslogs log driver in the task definition) is the primary diagnostic surface. Viewing the stopped task's log stream reveals startup errors, missing dependencies, or failed health check responses that caused the task to be killed.

Answer

Review the task definition for misconfigured environment variables.

Answer

Check the ECS service event stream for error messages.

Answer

Use ECS Exec to connect to the failing tasks and debug.

Question 15

A company uses Amazon API Gateway with a Lambda authorizer to control access to its APIs. Recently, some requests are returning 401 Unauthorized errors even though the tokens are valid. The Lambda authorizer logs show that the function is invoked and returns an IAM policy. What is the MOST likely cause?

Accepted Answer

The authorizer result is cached, and a previous invalid token caused a deny policy to be cached.. The most likely cause is that the Lambda authorizer's result is cached, and a previous invalid token caused a deny policy to be cached, which is now being applied to valid tokens. API Gateway caches authorizer responses by default for up to 3600 seconds, keyed on the token value, so if a token was previously denied, subsequent requests with the same token may still be denied until the cache expires.

Answer

The Lambda function is returning a malformed IAM policy.

Answer

The token has expired.

Answer

The Lambda authorizer is not being invoked due to throttling.