SAP-C02 Continuous Improvement for Existing Solutions Practice Test 6 — 15 Questions

Question 1

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, they experienced a few minutes of downtime because the application's connection string pointed to the primary instance DNS name. What is the MOST effective solution to minimize downtime during failover?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the RDS Multi-AZ DNS name (CNAME) that automatically updates after failover.. The RDS Multi-AZ deployment automatically provides a CNAME (DNS name) that always points to the current primary instance. After a failover, this CNAME is updated to point to the new primary, so the application using this DNS name will experience minimal downtime. Option B is incorrect because Elastic IP addresses are not supported for RDS instances; they are used for EC2 instances. Option C is incorrect because a read replica in another Region is designed for disaster recovery and read scaling, not for automatic failover within the same region; manual promotion would cause significant downtime. Option D is incorrect because a Network Load Balancer adds unnecessary complexity and latency; RDS Multi-AZ already provides automatic failover with DNS update.

Answer

Assign an Elastic IP address to the RDS instance.

Answer

Create a read replica in another Region and promote it during failover manually.

Answer

Configure a Network Load Balancer in front of the RDS instance.

Question 2

A company stores sensitive data in Amazon S3. They need to ensure that data is encrypted at rest using a key managed by the company's on-premises hardware security module (HSM). Which S3 encryption option should they use?

Accepted Answer

Client-Side Encryption using the company's own encryption library.. Client-Side Encryption (B) allows the company to encrypt the data locally using their own encryption keys from the on-premises HSM before uploading to S3. This ensures the HSM manages the key and the company retains full control. Option A (SSE-C) requires the customer to provide a key with each request, but the key is not managed by the on-premises HSM; it is provided per-request and S3 uses it for encryption/decryption. Option C (SSE-KMS) uses AWS KMS, not the company's HSM. Option D (SSE-S3) uses S3-managed keys, which also do not involve the on-premises HSM.

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Answer

Server-Side Encryption with AWS KMS (SSE-KMS).

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Question 3

A company has a production AWS Lambda function that processes orders. The function's execution time has increased, causing timeouts. The team wants to troubleshoot without affecting production traffic. What should they do?

Accepted Answer

Create a new Lambda function with a different name to test the code changes.. Creating a separate Lambda function with the same code but a different name allows testing and debugging without impacting the production function. Option A is wrong because version aliases can route traffic but still affect production. Option C is wrong because CloudWatch Logs will show the production function's logs. Option D is wrong because changing the timeout directly on the production function could break the SLA.

Answer

Enable detailed CloudWatch Logs for the production function and analyze them.

Answer

Use a Lambda alias to route a percentage of traffic to a new version with increased timeout.

Answer

Increase the timeout of the production Lambda function temporarily.

Question 4

A company runs a stateless web application on EC2 instances behind an Application Load Balancer (ALB). During peak traffic, some instances become unhealthy and are replaced by Auto Scaling, but users experience errors. What is the MOST likely cause?

Accepted Answer

The health check target path or port is misconfigured.. If the health check target path or port is misconfigured, healthy instances may fail health checks and be replaced, causing errors during peak traffic. Option A is incorrect because burstable performance instances are not directly related to health check failures; health checks depend on the configured endpoint. Option B is incorrect because a small minimum size affects capacity, not the accuracy of health checks. Option D is incorrect because a longer health check interval delays detection of unhealthy instances but does not cause healthy instances to be mistakenly replaced.

Answer

The EC2 instances are of a burstable performance type.

Answer

The Auto Scaling group's minimum size is too small.

Answer

The health check interval is too long.

Question 5

A company wants to automatically enforce encryption on all new objects uploaded to an S3 bucket. What should they do?

Accepted Answer

Add a bucket policy that denies PutObject without the x-amz-server-side-encryption header.. An S3 bucket policy with a condition that denies PutObject if the x-amz-server-side-encryption header is not present enforces encryption for all new objects. Option A is wrong because Amazon CloudFront enforces HTTPS for data in transit, not server-side encryption at rest. Option B is wrong because enabling S3 default encryption encrypts objects that do not specify encryption, but it does not deny uploads without encryption headers; objects can still be uploaded without explicitly setting encryption. Option C is wrong because pre-signed URLs provide temporary access but do not enforce encryption requirements.

Answer

Use Amazon CloudFront to enforce HTTPS.

Answer

Enable S3 default encryption on the bucket.

Answer

Require pre-signed URLs for all uploads.

Question 6

A company runs a critical application on EC2 instances in an Auto Scaling group. They want to ensure that during a patching cycle, the application remains available and no requests are dropped. Which TWO strategies should they implement? (Choose TWO.)

Accepted Answer

Perform a rolling update using a batch size of 50% with a pause time.. (rolling update with a batch size of 50% and pause time) is correct because it gradually replaces instances, allowing the application to remain available during patching. Option D (lifecycle hook for custom action before termination) is correct because it can drain connections gracefully before an instance is terminated. Option A is wrong because increasing desired capacity does not guarantee no dropped requests during patching and may cause additional cost. Option B is wrong because stopping all instances simultaneously causes downtime. Option E is wrong because Amazon Inspector only identifies vulnerabilities but does not apply patches.

Answer

Increase the desired capacity of the Auto Scaling group before patching.

Answer

Stop all instances at the same time to apply patches consistently.

Answer

Use Amazon Inspector to automatically patch instances.

Question 7

A company is building a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. They want to improve performance and reduce costs. Which THREE actions should they take? (Choose THREE.)

Accepted Answer

Enable Lambda Provisioned Concurrency for the function.. Options A, C, and D are correct. A: Lambda Provisioned Concurrency reduces cold starts for predictable traffic, improving performance. C: Using DAX reduces read latency and can lower DynamoDB read costs by offloading reads from the table. D: API Gateway caching reduces the number of requests to Lambda and DynamoDB, improving response times and reducing costs. Option B is incorrect because DynamoDB on-demand capacity mode is typically more expensive for predictable workloads compared to provisioned capacity. Option E is incorrect because increasing the Lambda function timeout does not improve performance and may increase costs due to longer execution time.

Answer

Use DynamoDB on-demand capacity mode.

Answer

Increase the Lambda function timeout to 5 minutes.

Question 8

A company has an Amazon RDS for PostgreSQL database that is experiencing high CPU utilization due to a large number of read queries. They need to offload read traffic and improve performance. Which TWO actions should they take? (Choose TWO.)

Accepted Answer

Create one or more read replicas in the same Region.. Read replicas offload read queries from the primary database, reducing CPU utilization. Option E is correct because RDS Proxy manages connections, reducing overhead from a large number of read queries. Option A is wrong: Multi-AZ provides high availability, not read scaling. Option C is wrong: increasing instance size may help but does not specifically offload read traffic and is often more expensive than read replicas. Option D is wrong: ElastiCache caches query results but does not offload read queries from the database directly.

Answer

Enable Multi-AZ deployment for the database.

Answer

Increase the instance size of the primary database.

Answer

Use Amazon ElastiCache to cache query results.

Question 9

A company uses an Application Load Balancer (ALB) to distribute traffic to an Auto Scaling group of EC2 instances. The operations team notices that the ALB is returning a high number of 504 errors during peak hours. Which configuration change is MOST likely to reduce the 504 errors?

Accepted Answer

Increase the idle timeout setting on the ALB.. Increasing the idle timeout setting on the ALB can help prevent premature connection closures that cause 504 errors. Option A is wrong because increasing the deregistration delay only affects instance draining, not idle timeouts. Option C is wrong because enabling cross-zone load balancing does not address timeout issues. Option D is wrong because increasing the health check interval does not affect idle timeouts.

Answer

Enable cross-zone load balancing on the ALB.

Answer

Increase the health check interval for the target group.

Answer

Increase the deregistration delay on the target group.

Question 10

A company runs a critical web application on EC2 instances behind an ALB. The application stores session data in an ElastiCache Redis cluster. During a recent outage, the Redis cluster failed and all active sessions were lost, causing users to be logged out. Which solution would provide the HIGHEST availability for session data?

Accepted Answer

Enable Cluster Mode and deploy Redis in Multi-AZ with replicas.. Enabling Cluster Mode and deploying Redis in Multi-AZ with replicas provides automatic failover and data replication across Availability Zones, ensuring high availability for session data. Option B is wrong because a single-node cluster with backups does not provide automatic failover; backups only help with recovery, not availability. Option C is wrong because disabling persistence reduces durability and does not improve availability. Option D is wrong because increasing instance size does not provide failover or redundancy.

Answer

Deploy a single-node Redis cluster with automatic backups.

Answer

Disable Redis persistence to improve performance.

Answer

Use a larger Redis instance type to handle more connections.

Question 11

A company has a microservices architecture running on Amazon ECS with Fargate. Each service writes logs to CloudWatch Logs. The operations team needs to search across all logs for a specific error pattern. Currently, they manually query each log group, which is time-consuming. What is the MOST efficient way to enable centralized log search?

Accepted Answer

Use CloudWatch Logs Insights to query all log groups from a single query.. CloudWatch Logs Insights enables querying multiple log groups in a single query using a query language, allowing centralized search across all services. Option A is wrong because exporting to S3 and using Athena is for analyzing historical data, not real-time search. Option B is wrong because CloudWatch Contributor Insights identifies top contributors and is not for arbitrary pattern search. Option C is wrong because subscription filters to Kinesis Data Firehose can centralize logs but require additional infrastructure and do not provide a built-in query interface like Logs Insights.

Answer

Export logs to Amazon S3 and use Amazon Athena to query them.

Answer

Use CloudWatch Contributor Insights to identify the top error sources.

Answer

Create a subscription filter for each log group that sends logs to a Kinesis Data Firehose delivery stream.

Question 12

A company uses AWS Lambda to process events from an Amazon SQS queue. The Lambda function is invoked with a batch size of 10. Recently, the function started failing with timeout errors when processing large batches. Which solution would improve the reliability of event processing without losing messages?

Accepted Answer

Reduce the batch size to a smaller value, such as 5.. Reducing the batch size decreases the number of messages processed per invocation, which reduces the total processing time and helps avoid timeouts. Option A is incorrect because increasing the visibility timeout does not reduce the processing time within the function; it only prevents messages from becoming visible again before the function finishes. Option B is incorrect because increasing reserved concurrency increases the number of concurrent invocations but does not affect the processing time of a single invocation. Option C is incorrect because increasing the function timeout to 15 minutes may allow the function to complete, but it does not address the root cause of long processing times and could lead to higher costs and delayed processing; reducing the batch size is a more targeted solution.

Answer

Increase the SQS queue visibility timeout to match the function timeout.

Answer

Increase the Lambda function reserved concurrency to handle more invocations.

Answer

Increase the Lambda function timeout to the maximum 15 minutes.

Question 13

A company runs a static website on Amazon S3 behind Amazon CloudFront. The website uses a custom domain and SSL certificate from AWS Certificate Manager (ACM). Users report that they sometimes see an older version of the website after updates. What should the company do to ensure users always see the latest content?

Accepted Answer

Create a CloudFront invalidation for the updated files.. Creating a CloudFront invalidation removes cached objects, forcing CloudFront to fetch the latest content from the origin. Option A is wrong because disabling and re-enabling the distribution is disruptive and unnecessary. Option B is wrong because bucket versioning controls object versions but does not invalidate CloudFront cache. Option C is wrong because reducing TTL to 0 affects future caching but does not clear existing cache.

Answer

Disable and re-enable the CloudFront distribution after each update.

Answer

Enable S3 bucket versioning and use version IDs in URLs.

Answer

Reduce the CloudFront TTL to 0 seconds for all objects.

Question 14

A company has a data pipeline that uses AWS Glue to process large datasets in Amazon S3. The pipeline runs daily and takes over 12 hours to complete. The company wants to reduce the processing time. Which approach would be MOST effective?

Accepted Answer

Increase the number of DPUs allocated to the Glue job.. Increasing the number of DPUs (data processing units) allocated to the Glue job allows for greater parallelism, which directly reduces processing time for CPU-bound or memory-bound workloads. Option A is incorrect because increasing the timeout does not improve performance; it only prevents the job from failing due to time limits. Option B is incorrect because S3 Transfer Acceleration speeds up data transfer to S3, not the processing within Glue. Option D is incorrect because while converting to Parquet can improve read performance and reduce data volume, it does not address the core processing bottleneck if the job is compute-intensive; the most effective immediate step is to increase DPUs.

Answer

Increase the Glue job timeout setting to 24 hours.

Answer

Enable S3 Transfer Acceleration on the source bucket.

Answer

Convert the input data from CSV to Parquet format.

Question 15

A company uses Amazon RDS for MySQL for its database. The operations team notices that read queries are slow during peak hours. The application is read-heavy and can tolerate eventual consistency. Which solution would improve read performance with minimal application changes?

Accepted Answer

Create an RDS read replica and direct read traffic to it.. Creating an RDS read replica allows read traffic to be offloaded from the primary DB instance, significantly improving read performance with minimal application changes, and the application can tolerate eventual consistency. Option A is incorrect because increasing the DB instance class may help but is more costly and does not scale reads independently. Option B is incorrect because Multi-AZ provides high availability and failover, not read scaling. Option C is incorrect because RDS Proxy is for connection pooling and managing database connections, not for scaling reads.

Answer

Increase the DB instance class to a larger size.

Answer

Enable Multi-AZ deployment for failover support.

Answer

Enable RDS Proxy to pool database connections.