SAP-C02 Continuous Improvement for Existing Solutions Practice Test 7 — 15 Questions

Question 1

A company uses Amazon S3 to store sensitive data. The security team requires that all S3 buckets have server-side encryption enabled. How can the company enforce this across all existing and future buckets?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable default encryption on each S3 bucket.. Enabling default encryption on each S3 bucket ensures that all objects uploaded to that bucket are automatically encrypted, enforcing the policy across existing and future buckets. Option B is wrong because an IAM policy that denies s3:PutObject without encryption headers only applies when the request includes encryption headers; it does not enforce encryption for all objects, and it depends on the caller including the headers. Option C is wrong because while an S3 bucket policy can deny PutObject without encryption, it requires a policy per bucket and does not automatically remediate existing buckets. Option D is wrong because AWS Config can detect noncompliant buckets but requires a custom remediation action to enable encryption; it does not automatically enforce encryption without additional setup.

Answer

Create an IAM policy that denies s3:PutObject unless encryption headers are present.

Answer

Use an S3 bucket policy to deny PutObject without encryption.

Answer

Use AWS Config to automatically remediate noncompliant buckets.

Question 2

A company uses Amazon CloudFront to serve static content from an S3 bucket. Users in Europe report slow load times. The CloudFront distribution uses the default cache behavior. What is the MOST cost-effective improvement?

Accepted Answer

Enable CloudFront Lambda@Edge to optimize content delivery.. Using Lambda@Edge to route users based on their geographic location can direct European users to a closer CloudFront distribution or origin, reducing latency. This approach is cost-effective as it avoids the need for additional infrastructure. Option B is incorrect because S3 Transfer Acceleration is designed for uploads, not for accelerating content delivery to end users. Option C is incorrect because geographic restrictions are for access control, not routing; they cannot route users to the nearest origin. Option D is incorrect because additional cache behaviors control caching policies, not which origin serves content; they do not inherently reduce latency.

Answer

Use an S3 Transfer Acceleration to speed up content delivery.

Answer

Configure CloudFront with multiple origins and use geographic restrictions to route users to the nearest origin.

Answer

Add additional cache behaviors to serve different content from different origins.

Question 3

A company runs a stateful web application on EC2 instances behind an Application Load Balancer (ALB). The application uses WebSockets for real-time communication. During scale-in events, users experience disconnections. How can the company maintain WebSocket connections during scaling?

Accepted Answer

Enable connection draining on the ALB target group.. Connection draining (also called deregistration delay) on the ALB target group allows existing WebSocket connections to remain open for a specified period when an instance is being deregistered during scale-in. This ensures that ongoing WebSocket sessions are not abruptly terminated. Sticky sessions (B) only ensure that a client sticks to the same instance for subsequent requests, but do not prevent disconnection when that instance is terminated. NLB (A) does not support WebSocket natively at layer 7 and would not solve the issue. Lifecycle hooks (D) delay termination but do not gracefully drain connections.

Answer

Replace the ALB with a Network Load Balancer (NLB).

Answer

Use sticky sessions (session affinity) on the ALB.

Answer

Use an Auto Scaling lifecycle hook to delay instance termination.

Question 4

A company uses Amazon DynamoDB for a gaming application. The table has a partition key of 'user_id' and a sort key of 'game_id'. The application experiences high latency during peak hours. Which TWO actions would improve read performance?

Accepted Answer

Increase the read capacity units for the table.. Option B is correct because increasing the read capacity units (RCUs) raises the table's provisioned read throughput, so under peak-hour load the table is less likely to throttle reads and latency drops. Option C is correct because enabling DynamoDB Accelerator (DAX) places an in-memory write-through cache in front of the table, serving eventually consistent reads in microseconds and offloading repeated read traffic from DynamoDB. Option A is not correct here because global tables address multi-Region replication and disaster recovery, not single-Region read latency. Option D is not correct because the sort key only orders items within a partition and does not distribute read load across partitions. Option E is not correct because a GSI with a different partition key helps query flexibility and can spread load, but it is not one of the two direct fixes for peak read latency compared with RCU scaling and DAX caching.

Answer

Use DynamoDB global tables to replicate data to another region.

Answer

Change the table's sort key to a more evenly distributed attribute.

Answer

Add a Global Secondary Index with a different partition key.

Question 5

A company uses AWS Lambda to process messages from an Amazon SQS queue. The Lambda function is idempotent and processes each message in about 30 seconds. The SQS queue has a visibility timeout of 60 seconds. Recently, the team notices that the same messages are being processed multiple times. Which TWO actions should the team take to prevent duplicate processing?

Accepted Answer

Increase the SQS queue's visibility timeout to 6 minutes.. Option A is correct because the visibility timeout (60 seconds) is too short relative to the Lambda processing time (~30 seconds plus potential retries or slow invocations), so messages can become visible again and be picked up by another Lambda invocation before the first finishes; increasing it to 6 minutes gives ample headroom to complete processing and delete the message. Option C is correct because switching to a FIFO queue with content-based deduplication ensures SQS itself suppresses duplicate messages with the same deduplication ID within the 5-minute deduplication interval, directly preventing the same message from being delivered and processed more than once. Option B does not help because reserved concurrency of 1 only limits parallel invocations; it does not stop a message from reappearing after the visibility timeout expires. Option D does not help because batch size 1 still allows the same message to be redelivered if it is not deleted before the visibility timeout. Option E does not help because a dead-letter queue only captures messages after they exceed the maxReceiveCount; it does not prevent duplicate processing.

Answer

Set the Lambda function's reserved concurrency to 1.

Answer

Reduce the SQS batch size to 1.

Answer

Configure a dead-letter queue for the SQS queue.

Question 6

A company is designing a new microservices architecture on Amazon ECS with Fargate. The company wants to ensure that services can discover each other using DNS names. Which TWO components are required?

Accepted Answer

AWS Cloud Map. AWS Cloud Map (A) is required because it is the service discovery service that maintains a registry of the microservices and their instance locations, allowing ECS tasks to register themselves and be looked up by name. Amazon Route 53 (D) is required because Cloud Map uses Route 53 to create and manage the DNS records (such as A or SRV records) that resolve the service names to the underlying task IP addresses or endpoints. Together, Cloud Map and Route 53 provide the DNS-based service discovery mechanism the company needs for its Fargate services. A Network Load Balancer (B) and an Application Load Balancer (E) are load-balancing options that can distribute traffic but are not required for DNS-based service discovery, and Amazon ECS Service Connect (C) is an alternative service-connectivity feature that is not needed when using Cloud Map with Route 53 for DNS discovery.

Answer

Network Load Balancer (NLB)

Answer

Amazon ECS Service Connect

Answer

Application Load Balancer (ALB)

Question 7

Refer to the exhibit. An S3 bucket policy is shown. A user from IP 10.0.0.5 makes a GET request over HTTPS. Will the request succeed?

Accepted Answer

Yes, because the request matches the Allow condition and the Deny condition does not apply.. The request will succeed because it matches the Allow condition and the Deny condition does not apply. In S3 bucket policies, an explicit Deny always overrides an Allow, but here the Deny statement likely has a condition that does not match the request (e.g., denying requests not over HTTPS or from a different IP). Since the request is over HTTPS from 10.0.0.5, it meets the Allow condition and the Deny condition is not triggered, so access is granted.

Answer

No, because the Deny statement explicitly denies all actions.

Answer

Yes, because the IP address is within the allowed range.

Answer

No, because the Deny statement overrides the Allow statement.

Question 8

Refer to the exhibit. An EC2 instance in subnet-11111 (10.0.1.0/24) cannot access the internet. The route table for the subnet is shown. What is the MOST likely cause?

Accepted Answer

The NAT gateway is not in a public subnet with an internet gateway.. For an EC2 instance in a private subnet to access the internet via a NAT gateway, the NAT gateway must be deployed in a public subnet (with a route to an internet gateway). Option D correctly identifies that the NAT gateway is not in a public subnet with an internet gateway. Option A is incorrect because the route table does have a default route (0.0.0.0/0) pointing to the NAT gateway. Option B is incorrect because the VPC has a local route for internal traffic. Option C is incorrect because the route table is associated with the subnet (the exhibit shows the subnet ID). Therefore, the most likely cause is that the NAT gateway itself is in a private subnet, preventing it from reaching the internet.

Answer

The route table does not have a default route (0.0.0.0/0).

Answer

The VPC does not have a local route.

Answer

The route table is not associated with the subnet.

Question 9

A company uses AWS Lambda functions to process orders. Recently, some orders have been lost due to Lambda throttling. The operations team wants to implement a solution to capture failed invocations and retry them. What is the MOST reliable approach?

Accepted Answer

Configure an SQS queue as the Lambda event source with a dead-letter queue for failed messages.. Configuring an SQS queue as the Lambda event source with a dead-letter queue is the most reliable approach because SQS durably stores messages, Lambda polls the queue, and failed messages after the configured retries are moved to a DLQ for later reprocessing. This decouples order processing from invocation and prevents message loss during throttling.

Answer

Enable CloudWatch Logs for Lambda and create a metric filter to trigger an alarm.

Answer

Use Amazon EventBridge to capture Lambda errors and route them to a recovery function.

Answer

Publish failed invocation details to an SNS topic and subscribe a Lambda function to process them.

Question 10

A media company runs a video transcoding pipeline on AWS using Amazon EC2 Spot Instances. The pipeline uses a custom AMI with pre-installed software. The operations team notices that the latest AMI is not always used when new instances launch, causing inconsistent transcoding results. What should the team do to ensure that all new Spot Instances use the latest AMI?

Accepted Answer

Use an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store.. Using an EC2 Auto Scaling group with a launch template that dynamically references the latest AMI ID from AWS Systems Manager Parameter Store ensures that new instances automatically use the most recent AMI without manual intervention. Option A is incorrect because launch configurations are immutable and cannot reference dynamic parameters like SSM Parameter Store; they require creating a new launch configuration each time the AMI changes. Option B is incorrect because CloudFormation updates require manual initiation and do not automatically track the latest AMI. Option C is incorrect because manually updating the AMI ID in the Auto Scaling group configuration is error-prone and not automated.

Answer

Create a new launch configuration each time a new AMI is released and associate it with the Auto Scaling group.

Answer

Use AWS CloudFormation to update the stack with the new AMI ID and then manually trigger a rolling update.

Answer

Manually update the AMI ID in the EC2 Auto Scaling group configuration every time a new AMI is released.

Question 11

A company is using Amazon RDS for MySQL and needs to capture slow query logs for performance tuning. The logs must be stored for 30 days for analysis. What is the MOST cost-effective way to achieve this?

Accepted Answer

Enable slow query logging and stream logs to Amazon CloudWatch Logs with a retention policy of 30 days.. The most cost-effective because Amazon RDS for MySQL can natively publish slow query logs to Amazon CloudWatch Logs with minimal setup. By setting a retention policy of 30 days in CloudWatch Logs, you avoid additional storage costs and complex configurations. Option B is not directly supported; exporting logs to S3 requires extra steps (e.g., via CloudWatch Logs export) and incurs added cost. Option A adds unnecessary complexity and cost with SQS. Option C is not feasible as RDS does not write slow query logs to EBS by default and snapshotting is not a log management solution.

Answer

Enable slow query logging and use an RDS event subscription to send logs to an SQS queue for processing.

Answer

Enable slow query logging and store logs in an S3 bucket with lifecycle policy to delete after 30 days.

Answer

Enable slow query logging and store logs on the RDS instance's EBS volume, then take daily snapshots.

Question 12

A company runs a containerized application on Amazon ECS using Fargate. The application experiences intermittent high latency during peak hours. The operations team suspects that the task placement strategy is causing resource contention. The cluster uses the default binpack strategy. What should the team do to improve performance?

Accepted Answer

Change the task placement strategy to spread across Availability Zones.. The default binpack placement strategy packs tasks onto the fewest instances to minimize resource usage, which can concentrate tasks on the same underlying host and cause CPU/memory contention during peak hours. Changing to the spread strategy distributes tasks evenly across Availability Zones (and instances), reducing contention and improving latency. This directly addresses the suspected placement issue without over-provisioning resources.

Answer

Increase the memory and CPU for each task definition to reduce contention.

Answer

Increase the number of tasks to distribute the load evenly.

Answer

Use a launch type of EC2 with GPU instances to handle the load.

Question 13

A company has a legacy application that runs on a single EC2 instance. The application stores data on an attached EBS volume. The company wants to improve availability and reduce the recovery time objective (RTO) in case of instance failure. What should the company do?

Accepted Answer

Create an Auto Scaling group with a minimum of 2 instances across multiple Availability Zones and use a load balancer.. An Auto Scaling group with a minimum of two instances across multiple Availability Zones combined with a load balancer provides high availability and automatic failover, reducing RTO significantly. Option B is wrong: while EBS snapshots are useful for backups, restoring from a snapshot to create a new instance involves manual steps and can take minutes, not improving RTO adequately. Option C is wrong: Multi-Attach EBS volumes are for specific clustered applications (e.g., Windows Server Failover Clustering) and not all applications support it; also, it does not provide automatic failover. Option D is wrong: converting to an AMI and launching in another AZ requires manual intervention and does not ensure rapid recovery; it's a migration step, not an availability solution.

Answer

Take frequent EBS snapshots and automate the creation of a new instance from the latest snapshot.

Answer

Configure the EBS volume as a Multi-Attach volume and attach it to a standby instance.

Answer

Convert the instance to an AMI and launch a new instance from that AMI in a different Availability Zone.

Question 14

A company runs a web application on EC2 instances behind an Application Load Balancer. The application experiences a sudden spike in traffic. The operations team notices that the Auto Scaling group is not scaling out quickly enough. Which TWO actions should the team take to improve the scaling responsiveness?

Accepted Answer

Switch from a step scaling policy to a target tracking scaling policy based on CPU utilization.. Option B is correct because target tracking scaling policies continuously adjust capacity to keep a metric (e.g., average CPU utilization) at a target value, reacting faster and more smoothly to sudden traffic spikes than step scaling policies, which only trigger on discrete alarm thresholds. Option D is correct because the cooldown period is the time Auto Scaling waits after a scaling activity before starting another; decreasing it allows subsequent scale-out actions to occur sooner, improving responsiveness during rapid traffic increases. Option A is incorrect because increasing instance size (vertical scaling) does not make the Auto Scaling group scale out faster and may not address the responsiveness issue. Option C is incorrect because increasing the health check grace period only delays when new instances are considered unhealthy, which does not speed up scaling. Option E is incorrect because decreasing the minimum number of instances reduces baseline capacity and does not improve the speed of scale-out events.

Answer

Increase the instance size to handle more traffic per instance.

Answer

Increase the health check grace period for the Auto Scaling group.

Answer

Decrease the minimum number of instances in the Auto Scaling group.

Question 15

A company runs a critical database on Amazon RDS for PostgreSQL. The database is experiencing performance degradation due to high CPU utilization. The operations team wants to analyze the root cause. Which THREE steps should the team take to diagnose the issue?

Accepted Answer

Enable Enhanced Monitoring to view OS-level metrics such as CPU and memory usage.. Option A is correct because RDS Enhanced Monitoring publishes OS-level metrics (via the CloudWatch Logs agent on the DB instance) at granularities down to 1 second, letting the team see real CPU, memory, and load breakdowns by process to confirm whether PostgreSQL itself or another process is driving high CPU. Option C is correct because Performance Insights captures database load (DBLoad) sliced by SQL statement, wait event, user, and host, so the team can directly identify the specific queries consuming the most CPU. Option D is correct because reviewing RDS events reveals recent maintenance windows, reboots, failovers, or parameter changes that could explain a sudden CPU spike. Option B is not a diagnostic step — resizing to provisioned IOPS addresses storage performance, not CPU root cause, and would mask rather than diagnose the issue. Option E is not diagnostic either; Multi-AZ provides synchronous standby and automatic failover for availability, not CPU troubleshooting.

Answer

Increase the instance size to provisioned IOPS to handle the load.

Answer

Enable Multi-AZ deployment for automatic failover.