SAP-C02 Continuous Improvement for Existing Solutions Practice Test 8 — 15 Questions

Question 1

A company runs a critical application on Amazon ECS with Fargate launch type. The application needs to be highly available across multiple Availability Zones. The company wants to implement blue/green deployments to minimize downtime. Which THREE steps should the solutions architect take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create two separate ECS task definitions for the blue and green environments.. Options C, D, and E are correct because blue/green deployments for ECS require separate task definitions for each environment (C), CodeDeploy to manage traffic shifting (D), and an Application Load Balancer with separate target groups for each task set to route traffic (E). Option A is incorrect because storing artifacts in ECR is about container images, not a deployment step. Option B is incorrect because using a load balancer is a prerequisite for any ECS service, but it is not one of the specific steps required to implement blue/green deployments. The blue/green-specific steps are C, D, and E.

Answer

Store the application artifacts in Amazon ECR and use an ECS service with a single task definition.

Answer

Use a Network Load Balancer to route traffic to the ECS service.

Question 2

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest and that the encryption keys be rotated automatically every year. The company also needs to audit who accessed the key and when. Which THREE services should the solutions architect use to meet these requirements?

Accepted Answer

S3 server-side encryption with AWS KMS (SSE-KMS).. Options A, B, and D are correct. AWS KMS (SSE-KMS) provides encryption with customer-managed keys that can be automatically rotated annually (option A and D). AWS CloudTrail logs KMS API calls such as Decrypt and GenerateDataKey, enabling auditing of key usage (option B). Option C is incorrect because IAM controls access to resources, not encryption keys directly; key access is managed via KMS key policies. Option E is incorrect because SSE-S3 uses S3-managed keys that do not allow customer-controlled rotation or auditing.

Answer

AWS Identity and Access Management (IAM) to control access to the keys.

Answer

S3 server-side encryption with S3-managed keys (SSE-S3).

Question 3

A solutions architect applies the IAM policy shown in the exhibit to an IAM user. The user attempts to upload an object to the S3 bucket 'my-bucket' without specifying the 'x-amz-server-side-encryption' header. What will happen?

Accepted Answer

The upload fails because the Deny statement blocks any PutObject request that does not specify AES256 encryption.. The Deny statement with a StringNotEquals condition on the 's3:x-amz-server-side-encryption' header will block any PutObject request where the header is not present or is set to a value other than 'AES256'. Since the user does not specify the header, the condition evaluates to true, and the Deny applies, causing the upload to fail. Option B is incorrect because the Deny statement applies even when the header is missing, not only when it is present with a different value. Option A is incorrect because the Allow statement's condition is not met, so it does not grant permission. Option D is incorrect because the condition is valid and correctly evaluated.

Answer

The upload succeeds because the Allow statement grants the s3:PutObject permission.

Answer

The upload succeeds because the Deny statement only applies when the header is present but set to a value other than AES256.

Answer

The upload fails because the condition is malformed and causes an error.

Question 4

A solutions architect runs the AWS CLI command shown in the exhibit to troubleshoot a failed CloudFormation stack creation. What is the most likely cause of the failure?

Accepted Answer

The LaunchConfigurationName property in the Auto Scaling group resource was not provided or was an incorrect type.. The error message indicates that the 'LaunchConfigurationName' property must be a string, meaning it was likely not provided or was of the wrong type. Option A is wrong because the error message does not mention any VPC configuration issues. Option C is wrong because the error specifically references the 'LaunchConfigurationName' property, not the resource type being unsupported in the region. Option D is wrong because the error indicates a property validation issue, not a permissions problem.

Answer

The VPC configuration is incorrect, causing the Auto Scaling group to fail.

Answer

The Auto Scaling group resource type is not supported in the region.

Answer

The IAM role for the stack does not have permission to create Auto Scaling groups.

Question 5

A solutions architect deployed an AWS Lambda function using a deployment package. The function logs the error shown in the exhibit. What is the most likely cause?

Accepted Answer

The deployment package does not include the 'express' npm dependency.. The error indicates that the 'express' module is not found, which means it was not included in the deployment package. Option B is wrong because the function ran, so the handler is correct. Option C is wrong because the Lambda execution role does not affect module availability. Option D is wrong because the error is a missing module, not a memory issue.

Answer

The Lambda function has exceeded the maximum memory limit.

Answer

The Lambda function handler is incorrectly configured.

Answer

The Lambda execution role does not have permissions to access the module.

Question 6

A company is using AWS Lambda functions to process data from an SQS queue. The Lambda function sometimes fails due to transient errors, but the messages are not being retried. Which configuration should the company check to ensure proper retry behavior?

Accepted Answer

Adjust the Maximum retries setting in the Lambda event source mapping. The correct setting is the 'Maximum retries' in the Lambda event source mapping for SQS. This parameter controls how many times Lambda will retry a failed message batch (default is 3). Option A is incorrect because the dead-letter queue (DLQ) is used to store messages that have failed after all retries are exhausted, not to control the number of retries. Option C is incorrect because the SQS queue's redrive policy 'maxReceiveCount' is used for SQS redrive to a DLQ, not for Lambda retries. Option D is incorrect because the SQS queue's Default visibility timeout determines how long a message is hidden after being received, but does not affect the retry count for Lambda processing.

Answer

Configure the Lambda function's dead-letter queue (DLQ)

Answer

Set the SQS queue's redrive policy maxReceiveCount to a higher value

Answer

Increase the SQS queue's Default visibility timeout

Question 7

A company uses Amazon RDS for MySQL with Multi-AZ deployment. During a recent failover, the application experienced a 5-minute downtime. The application uses a connection pool with a 30-second connection timeout. The RDS DNS name is used as the endpoint. What is the MOST likely cause of the downtime?

Accepted Answer

The DNS TTL for the RDS endpoint is set too high. During an RDS Multi-AZ failover, the DNS name remains the same but the underlying IP address changes. If the DNS TTL is set too high (default is 60 seconds but can be configured higher), clients may continue to use the old cached IP address for the duration of the TTL, leading to connection failures until the cache expires. This explains the 5-minute downtime, as the application's connection pool with a 30-second timeout cannot recover until the DNS record is refreshed. Option B is incorrect because the 30-second timeout is sufficient to wait for failover, but the issue is DNS propagation, not timeout duration. Option C is incorrect because Multi-AZ failover typically completes within 1-2 minutes, not 5 minutes. Option D is incorrect because the endpoint (DNS name) does not change after failover; only the IP changes.

Answer

The connection pool timeout is too short to allow failover

Answer

The Multi-AZ failover took longer than expected

Answer

The application is using the wrong endpoint after failover

Question 8

A company has deployed a web application behind an Application Load Balancer (ALB) with an Auto Scaling group. Users report that the application is slow during peak hours. The CPU utilization of the EC2 instances is consistently below 40%, but the ALB's request count per target is high. Which action would MOST improve performance?

Accepted Answer

Increase the desired capacity of the Auto Scaling group. High request count per target with low CPU utilization suggests the application is I/O bound or waiting on external calls. Adding more instances by increasing the desired capacity distributes the load across more targets, reducing queueing and improving performance. Option A is wrong because the bottleneck is not CPU, so increasing instance size is unlikely to help. Option C is wrong because scaling based on CPU utilization would not trigger since CPU is low. Option D is wrong because changing the ALB routing algorithm to least outstanding requests might help distribute load more evenly but does not add capacity; increasing desired capacity directly addresses the high request count per target.

Answer

Increase the instance size (e.g., from t3.medium to t3.large)

Answer

Configure the Auto Scaling group to scale based on CPU utilization

Answer

Change the ALB routing algorithm to least outstanding requests

Question 9

A company uses Amazon CloudFront with an S3 origin to serve static content. They recently updated the content in S3, but users still see the old files. What is the MOST likely reason?

Accepted Answer

The CloudFront distribution's cache TTL is too long. CloudFront caches objects at edge locations based on TTL; if the TTL has not expired, users will get cached old content. Option B is wrong because S3 versioning does not affect cache invalidation. Option C is wrong because CloudFront does not have a 'Cache-Control' header by default; it's set by the origin. Option D is wrong because S3 Transfer Acceleration is irrelevant to caching.

Answer

S3 versioning is enabled and the objects are not updated

Answer

CloudFront is not configured to forward the Cache-Control header

Answer

S3 Transfer Acceleration is disabled

Question 10

A company uses AWS CloudFormation to deploy infrastructure. They want to update a stack but need to ensure that a specific resource is not accidentally replaced. Which CloudFormation attribute should they use?

Accepted Answer

UpdateReplacePolicy. UpdateReplacePolicy. This attribute allows you to specify how CloudFormation handles resource updates that require replacement. You can set it to 'Retain' to keep the old resource and prevent replacement during a stack update. DeletionPolicy (option A) only controls what happens when a resource is deleted, not during updates that require replacement. CreationPolicy and UpdatePolicy do not address replacement prevention.

Answer

DeletionPolicy

Answer

CreationPolicy

Answer

UpdatePolicy

Question 11

A company uses Amazon DynamoDB with on-demand capacity. They notice that a specific table frequently exceeds the write throughput limit and experiences throttling. The table has a partition key with high cardinality. What is the MOST likely cause of throttling?

Accepted Answer

A sudden spike in write traffic exceeds the table's burst capacity. On-demand DynamoDB tables can handle traffic spikes up to double the previous peak. If write traffic exceeds that threshold, throttling occurs. The table's burst capacity is limited to the previous peak for on-demand, so a sudden spike exceeding that will cause throttling. Option B is incorrect because DAX is a caching layer for reads, not writes, and does not affect write throughput. Option C is incorrect because the table is using on-demand capacity, not provisioned; on-demand does not have provisioned write capacity. Option D is incorrect because auto scaling is not applicable for on-demand tables; on-demand automatically scales, but still has a limit based on previous peak.

Answer

The table is using DynamoDB Accelerator (DAX) for writes

Answer

The write workload exceeds the table's provisioned write capacity

Answer

The table has auto scaling disabled

Question 12

A company uses AWS Elastic Beanstalk to deploy a web application. They want to update the environment's configuration to use a larger instance type without any downtime. Which update policy supports this?

Accepted Answer

Rolling. (Rolling) is correct because Rolling update with batch size updates instances in batches, keeping the environment running and avoiding downtime. Option A is wrong because All at once replaces all instances simultaneously, causing downtime. Option B is wrong because Blue/Green is not a built-in Elastic Beanstalk update policy; it's a manual approach. Option C is wrong because Immutable update launches new instances in a separate ASG and then swaps, which causes a brief downtime during the swap.

Answer

All at once

Answer

Blue/Green

Answer

Immutable

Question 13

A company uses Amazon RDS for PostgreSQL and needs to apply a minor version upgrade. They want to minimize downtime. Which approach should they use?

Accepted Answer

Use a Multi-AZ deployment and apply the upgrade. To minimize downtime for a PostgreSQL minor version upgrade on Amazon RDS, the best approach is to use a Multi-AZ deployment and then apply the upgrade. With Multi-AZ, RDS upgrades the standby instance first, then performs a failover, resulting in very minimal downtime (typically under a minute). Option A (maintenance window) can cause longer downtime depending on the window. Option B (read replica) is more complex and can have a longer cutover time, and is not the most efficient for minor upgrades. Option D (modify parameter group) does not upgrade the engine version.

Answer

Apply the upgrade during the maintenance window

Answer

Create a read replica, upgrade it, and promote it

Answer

Modify the DB parameter group to set the version

Question 14

A company is using AWS CodePipeline to automate deployments. They want to add a manual approval step before deploying to production. Which TWO actions are required?

Accepted Answer

Add a manual approval action to the pipeline. To add a manual approval step, you must add a manual approval action to the pipeline (option B) and create an IAM role that allows the approver to approve or reject (option E). The approval action itself provides an SNS topic for notification, but configuring it is optional. Options A, C, and D are incorrect: A (Lambda function) is not required; C (CloudWatch Events) is not required; D (SNS topic) is automatically created by the approval action, but explicit configuration is not required.

Answer

Create a Lambda function to trigger the approval

Answer

Set up a CloudWatch Events rule to invoke the approval

Answer

Configure an SNS topic to notify the approver

Question 15

A company is migrating a monolithic application to microservices on Amazon ECS. They want to implement a service mesh for observability and traffic management. Which THREE AWS services should they consider?

Accepted Answer

AWS X-Ray. Options B, C, and D are correct. AWS App Mesh is a service mesh that provides observability and traffic management. AWS X-Ray provides tracing for microservices. Amazon CloudWatch provides monitoring and logs. Option A is wrong because Amazon Route 53 is DNS, not a service mesh. Option E is wrong because AWS Step Functions is for orchestrating workflows, not service mesh.

Answer

Amazon Route 53

Answer

AWS Step Functions