SAP-C02 Continuous Improvement for Existing Solutions Practice Test 8 — 15 Questions

Question 1

A company is migrating a monolithic application to microservices on Amazon ECS. They want to implement a service mesh for observability and traffic management. Which THREE AWS services should they consider?

Accepted Answer

AWS X-Ray. Options B, C, and D are correct. AWS App Mesh is a service mesh that provides observability and traffic management. AWS X-Ray provides tracing for microservices. Amazon CloudWatch provides monitoring and logs. Option A is wrong because AWS Step Functions is for orchestrating workflows, not service mesh. Option E is wrong because Amazon Route 53 is DNS, not a service mesh.

Answer

Amazon Route 53

Answer

AWS Step Functions

Question 2

A company uses Amazon S3 to store critical data. They need to ensure that data is encrypted at rest. Which TWO methods can achieve this?

Accepted Answer

Use AWS KMS (SSE-KMS). Options A and D are correct. A: S3-Managed Keys (SSE-S3) is a server-side encryption option. D: AWS KMS (SSE-KMS) is another server-side encryption option. Option B is wrong because client-side encryption is not managed by AWS. Option C is wrong because SSL/TLS encrypts data in transit, not at rest. Option E is wrong because S3 bucket policies do not encrypt data; they control access.

Answer

Enable SSL/TLS for the S3 bucket

Answer

Configure a bucket policy to enforce encryption

Answer

Use client-side encryption

Question 3

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to upload an object to example-bucket with SSE-S3 (AES256) encryption. What will happen?

Accepted Answer

The upload fails because the Deny statement explicitly denies it. Option D is correct. The Deny statement explicitly denies PutObject if the encryption is NOT aws:kms. Since the user uses SSE-S3 (AES256), the condition 'StringNotEquals' evaluates to true (AES256 != aws:kms), so the Deny applies and the request is denied. Option A is wrong because the Allow statement is for GetObject, not PutObject. Option B is wrong because the Deny overrides any allow. Option C is wrong because the Deny explicitly denies.

Answer

The upload fails because there is no explicit Allow for PutObject

Answer

The upload succeeds because the Allow statement permits it

Answer

The upload succeeds because SSE-S3 is allowed by the first statement

Question 4

Refer to the exhibit. A solutions architect runs the AWS CLI command to check the state of an EC2 instance. The output shows the instance is running. However, the application team reports that the instance is unreachable over SSH. What is the MOST likely cause?

Accepted Answer

A security group rule blocks inbound SSH traffic. Option C is correct. The instance state is 'running', so it's not stopped or terminated. The issue is likely a security group or network ACL blocking SSH. Option A is wrong because the instance is running. Option B is wrong because the instance ID is not shown but the query is correct. Option D is wrong because EBS optimization does not affect network connectivity.

Answer

The CLI command is querying the wrong instance

Answer

The instance is in a 'stopped' state

Answer

The instance does not have EBS optimization enabled

Question 5

Refer to the exhibit. A CloudFormation template is used to create an S3 bucket with versioning enabled and a DeletionPolicy of Retain. The stack is deleted. What happens to the bucket and its objects?

Accepted Answer

The bucket and its objects are retained. Option D is correct. With DeletionPolicy set to Retain, the bucket is preserved along with all its objects when the stack is deleted. Option A is wrong because the bucket is not deleted. Option B is wrong because versioning status remains as set. Option C is wrong because buckets with versioning enabled can be deleted via console with force delete option, but CloudFormation respects DeletionPolicy.

Answer

The bucket and all its objects are deleted

Answer

The bucket is deleted only if it is empty

Answer

The bucket is deleted, but versioning information is retained

Question 6

A company runs a web application on EC2 instances behind an Application Load Balancer (ALB). Users report intermittent 503 errors. The ALB target group health checks are failing. Which step is MOST likely to resolve the issue?

Accepted Answer

Increase the health check timeout and decrease the unhealthy threshold.. Option C is correct because increasing the timeout for health checks can prevent false negatives due to transient delays. Option A is wrong because it does not address health check failures. Option B is wrong because it reduces the chance of healthy instances being marked unhealthy. Option D is wrong because it does not change health check behavior.

Answer

Change the health check protocol from HTTP to HTTPS.

Answer

Use a Network Load Balancer instead of ALB.

Answer

Increase the number of instances in the target group.

Question 7

A company uses AWS CloudFormation to deploy a multi-tier application. The stack fails to update due to a resource conflict. The operations team needs to identify the resource causing the failure and modify the template to allow the update. Which approach is MOST effective?

Accepted Answer

Create a Change Set for the stack to preview the changes and identify the conflict.. Option B is correct because Change Sets show the changes and potential errors before execution. Option A is wrong because it only shows the last event, not the planned changes. Option C is wrong because StackSets manage multiple accounts/regions, not single stack updates. Option D is wrong because Drift detection shows differences from the template, not update conflicts.

Answer

Review the stack's 'Events' tab in the AWS Management Console to find the error message.

Answer

Use AWS CloudFormation StackSets to deploy the update across multiple accounts.

Answer

Run a drift detection operation on the stack to identify manual changes.

Question 8

A company wants to reduce costs for its Amazon RDS for MySQL database without affecting performance. The database is used by a read-intensive application. Which action should the company take?

Accepted Answer

Implement a Read Replica and direct read traffic to it.. Option A is correct because using Read Replicas offloads read traffic from the primary instance, allowing the primary to be smaller. Option B is wrong because Reserved Instances reduce cost but do not change the instance size. Option C is wrong because it reduces availability. Option D is wrong because it increases cost.

Answer

Change the DB instance to a Multi-AZ deployment.

Answer

Upgrade to the latest generation instance type.

Answer

Purchase Reserved Instances for the database.

Question 9

A company has a serverless application using AWS Lambda and Amazon API Gateway. The application experiences cold starts that cause latency spikes. Which solution would reduce the impact of cold starts?

Accepted Answer

Configure Provisioned Concurrency for the Lambda function.. Option D is correct because Provisioned Concurrency keeps a number of execution environments warm. Option A is wrong because increasing memory reduces cold start duration but does not eliminate it. Option B is wrong because it increases cost and complexity. Option C is wrong because it reduces performance.

Answer

Increase the Lambda function memory allocation.

Answer

Decrease the Lambda function timeout.

Answer

Use a VPC and enable Lambda to access resources in the VPC.

Question 10

A company has a hybrid architecture with an AWS Direct Connect connection to its on-premises data center. The company wants to improve network availability and ensure that if the Direct Connect fails, traffic automatically uses a VPN backup. Which configuration should the company implement?

Accepted Answer

Configure a Direct Connect gateway and attach a VPN to it, then advertise the same prefixes via BGP with lower priority on the VPN.. Option B is correct because AWS VPN CloudHub provides a hub-and-spoke model for multiple VPN connections, but for failover, using BGP with Direct Connect and VPN as backup is standard. However, the best answer is to use a Direct Connect gateway with a VPN attachment for failover. Option A is wrong because it adds latency. Option C is wrong because it bypasses Direct Connect. Option D is wrong because it does not provide automatic failover.

Answer

Use a NAT gateway to route traffic through the internet as a backup.

Answer

Create a Site-to-Site VPN connection and update route tables to point all traffic to the VPN.

Answer

Set up a second Direct Connect connection from a different provider.

Question 11

A DevOps team wants to automatically enforce tagging standards on all AWS resources created in an account. If a resource is created without the required tags, the team wants to prevent the creation or remediate it. Which AWS service should the team use?

Accepted Answer

AWS Config. Option C is correct because AWS Config with managed rules (e.g., required-tags) can detect non-compliant resources and trigger auto-remediation. Option A is wrong because it is a governance tool but does not auto-remediate. Option B is wrong because it manages permissions, not tagging. Option D is wrong because it visualizes resources but does not enforce policies.

Answer

AWS Organizations

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Resource Groups & Tag Editor

Question 12

A company runs a containerized application on Amazon ECS with Fargate launch type. The application experiences intermittent timeouts when calling an external API. The ECS tasks are in a private subnet with a NAT gateway. How can the company improve the reliability of outbound traffic?

Accepted Answer

Deploy a NAT gateway in each Availability Zone and update the route tables.. Option B is correct because a NAT Gateway in each AZ provides high availability; without it, a single NAT Gateway failure causes timeouts. Option A is wrong because it reduces security. Option C is wrong because it does not address NAT redundancy. Option D is wrong because it adds complexity without directly fixing NAT issues.

Answer

Place the tasks in a public subnet with auto-assign public IP.

Answer

Increase the NAT gateway's bandwidth by using a larger instance type.

Answer

Use AWS Transit Gateway to route traffic through a central VPC.

Question 13

A company receives a Trusted Advisor recommendation to reduce costs by deleting unused Amazon EBS snapshots. The company has hundreds of snapshots. Which approach should the company use to identify and delete snapshots that are no longer needed?

Accepted Answer

Use AWS Backup to manage snapshots and set retention rules.. Option C is correct because AWS Backup provides lifecycle policies and centralized snapshot management, making it easy to identify orphaned snapshots. Option A is wrong because it doesn't help identify unused snapshots. Option B is wrong because it's for storage class, not snapshot deletion. Option D is wrong because it's for billing, not operations.

Answer

Enable detailed billing reports and analyze costs.

Answer

Use the AWS CLI to list all snapshots and manually check each one.

Answer

Use Amazon S3 Lifecycle policies to expire snapshots automatically.

Question 14

A company uses Amazon S3 to store critical data. The company wants to ensure that data is protected against accidental deletion and that deleted objects can be recovered within 30 days. Which S3 feature should the company enable?

Accepted Answer

S3 Versioning. Option D is correct because S3 Versioning keeps all versions, and when combined with a lifecycle policy to expire after 30 days, it allows recovery. Option A is wrong because it is for access logs. Option B is wrong because it prevents overwrites but not deletions. Option C is wrong because it is for archive, not immediate recovery.

Answer

S3 Server Access Logging

Answer

S3 Object Lock in governance mode

Answer

S3 Intelligent-Tiering

Question 15

A company is migrating a legacy application to AWS. The application requires static IP addresses for whitelisting by external partners. The company will use a Network Load Balancer (NLB) to distribute traffic to EC2 instances. Which TWO actions should the company take to provide static IP addresses for the partners to whitelist?

Accepted Answer

Assign Elastic IP addresses to the Network Load Balancer.. Options B and D are correct because assigning an Elastic IP to the NLB provides static IPs, and using a Global Accelerator provides two static IPs. Option A is wrong because it doesn't provide static IPs. Option C is wrong because it's for ALB, not NLB. Option E is wrong because EIPs cannot be attached to instances behind NLB directly.

Answer

Attach an Elastic IP to each EC2 instance.

Answer

Configure an Application Load Balancer instead of NLB.

Answer

Use AWS WAF to allow traffic from the partners' IP ranges.