SAP-C02 Continuous Improvement for Existing Solutions Practice Test 9 — 15 Questions

Question 1

A company has a production AWS account with multiple VPCs connected via a Transit Gateway. The security team wants to centrally inspect all traffic between VPCs using a third-party firewall appliance. The firewall must be able to process traffic, and the solution must be highly available. Which THREE steps should the company take?

Accepted Answer

Attach Elastic Network Interfaces (ENIs) of the firewall instances to the inspection VPC subnets.. Options A, B, and D are correct: A creates an inspection VPC, B places instances across AZs for HA, and D uses ENIs in each subnet. Option C is wrong because a single route table limits HA. Option E is wrong because it bypasses inspection.

Answer

Configure the Transit Gateway to propagate routes directly between VPCs.

Answer

Use a single route table in the Transit Gateway for all VPC attachments.

Question 2

A company is using AWS Organizations to manage multiple accounts. The security team wants to enforce that no S3 buckets in any account are publicly accessible. Which TWO services can the team use to achieve this?

Accepted Answer

AWS Config. Options A and D are correct: SCPs can deny public access at the OU level, and AWS Config can detect and remediate. Option B is wrong because it's for resource restrictions, not access control. Option C is wrong because it's a firewall, not for bucket policies. Option E is wrong because it's for identity federation.

Answer

AWS Resource Access Manager

Answer

AWS WAF

Answer

AWS IAM Identity Center (SSO)

Question 3

Refer to the exhibit. An IAM policy is attached to an IAM group. When a user in the group tries to start a stopped EC2 instance with the tag 'Environment: production', the action fails. What is the MOST likely reason?

Accepted Answer

The 'ec2:StartInstances' action does not support resource-level conditions.. Option B is correct because the Condition block requires the resource tag to be 'Environment: production', but the action 'StartInstances' does not support resource-level authorization; it requires 'ec2:StartInstances' to be allowed without conditions, or the condition must be on the request. AWS evaluates conditions on the resource only for actions that support it. Option A is wrong because the policy allows all actions. Option C is wrong because the policy does not enforce MFA. Option D is wrong because the policy is attached to a group, not a user, but that should still work.

Answer

The policy is attached to a group, not directly to the user.

Answer

The user does not have MFA enabled.

Answer

The policy does not allow 'ec2:StartInstances' on all resources.

Question 4

Refer to the exhibit. A CloudFormation stack was successfully created. The stack's template includes an S3 bucket and a Lambda function. A developer runs the CLI command shown but receives an error that the stack does not exist. What is the MOST likely cause?

Accepted Answer

The AWS CLI is configured to use a different region than where the stack was deployed.. Option A is correct because the CLI command is querying the wrong region. The stack was created in us-east-1 but the CLI default region might be different. Option B is wrong because the stack was created successfully. Option C is wrong because outputs are returned correctly. Option D is wrong because the stack name is exactly as used.

Answer

The stack was deleted after creation.

Answer

The stack name is case-sensitive and should be 'MyApp'.

Answer

The '--query' parameter is incorrectly formatted.

Question 5

Refer to the exhibit. A company has an Amazon ECS task definition with two containers. The 'web' container is essential, and the 'sidecar' container is not. The 'sidecar' container exits unexpectedly. What will happen to the task?

Accepted Answer

The task continues running as normal.. Option C is correct because non-essential containers can fail without affecting the task. Option A is wrong because only essential container failure stops the task. Option B is wrong because ECS will not restart a non-essential container by default; it depends on the task definition restart policy. Option D is wrong because the sidecar's CPU=0 means it can use up to the available CPU, but it still runs.

Answer

The sidecar container will be marked as essential.

Answer

ECS will automatically restart the sidecar container.

Answer

The ECS task will be stopped.

Question 6

A company runs a production web application on EC2 instances in an Auto Scaling group behind an ALB. The application logs are stored on an EBS volume attached to each instance. The operations team notices that the logs are not being sent to a central location. What is the MOST efficient way to centralize log collection with minimal code changes?

Accepted Answer

Install the CloudWatch Logs agent on each EC2 instance and configure it to stream the log files to CloudWatch Logs.. Option C is correct because the CloudWatch Logs agent can be installed on EC2 instances to stream logs to CloudWatch Logs without modifying application code. Option A is wrong because modifying the application to send logs via API requires code changes. Option B is wrong because S3 lifecycle policies do not collect logs. Option D is wrong because Amazon Kinesis Agent is more complex and not typically used for EC2 log collection.

Answer

Modify the application to use the AWS SDK to send logs to CloudWatch Logs via PutLogEvents API.

Answer

Use Amazon Kinesis Agent to send logs to Kinesis Data Firehose and then to S3.

Answer

Set up an S3 bucket with a lifecycle policy to transition logs to Glacier.

Question 7

A company has a multi-account AWS organization with hundreds of accounts. The security team wants to ensure that all accounts have AWS Config enabled with a specific set of rules. They also want to automatically remediate non-compliant resources. Which solution is MOST scalable and operationally efficient?

Accepted Answer

Use AWS Config conformance packs deployed via AWS Organizations with automatic remediation using Systems Manager Automation.. Option D is correct because AWS Config conformance packs can be deployed at the organization level using AWS Organizations, allowing centralized management of rules and automatic remediation with SSM Automation. Option A is wrong because manual deployment doesn't scale. Option B is wrong because CloudFormation StackSets require per-account management. Option C is wrong because AWS Config aggregator only aggregates data, doesn't enforce rules.

Answer

Use AWS CloudFormation StackSets to deploy Config rules to all accounts.

Answer

Use AWS Config rules in each account with AWS Lambda functions for remediation.

Answer

Use an AWS Config aggregator in the management account to view compliance across accounts.

Question 8

A company is using Amazon ECS with Fargate launch type for a microservices application. The application experiences intermittent latency spikes. CloudWatch metrics show high CPU utilization but no obvious pattern. What should the company do to identify the cause?

Accepted Answer

Enable AWS X-Ray tracing on the ECS tasks to trace requests across microservices.. Option A is correct because AWS X-Ray provides distributed tracing to pinpoint performance bottlenecks. Option B is wrong because CloudWatch Logs Insights is for querying logs, not tracing. Option C is wrong because increasing task size is a reactive fix. Option D is wrong because CloudWatch Synthetics monitors endpoints, not internal traces.

Answer

Increase the CPU and memory for all ECS tasks.

Answer

Set up CloudWatch Synthetics canaries to monitor the endpoints.

Answer

Use CloudWatch Logs Insights to analyze application logs for errors.

Question 9

A company is using AWS CodePipeline to build and deploy a Java application to Elastic Beanstalk. Recently, deployments have been failing due to unit test failures in the build stage. The team wants to receive immediate notifications when a pipeline fails. What is the MOST efficient way to achieve this?

Accepted Answer

Configure CodePipeline to send notifications to an Amazon SNS topic when the pipeline fails.. Option B is correct because CodePipeline can publish events to Amazon SNS when the pipeline state changes, enabling notifications. Option A is wrong because CloudWatch alarms are for metrics, not pipeline state. Option C is wrong because CloudWatch Events (now Amazon EventBridge) can trigger notifications, but using SNS directly from CodePipeline is simpler. Option D is wrong because SES is for email sending, but SNS is more appropriate.

Answer

Have the build script send a notification on failure using the AWS CLI.

Answer

Set up a CloudWatch Events rule to trigger an AWS Lambda function that sends an email via Amazon SES.

Answer

Create a CloudWatch alarm on the CodePipeline failure metric.

Question 10

A company runs a critical database on an RDS for MySQL Multi-AZ DB instance. The database is experiencing high read latency. The application is read-heavy and uses many complex joins. The company needs to improve read performance with minimal application changes. Which solution is MOST appropriate?

Accepted Answer

Create one or more RDS read replicas and direct read queries to the replica endpoint.. Option C is correct because setting up RDS read replicas offloads read traffic from the primary instance, and can be done with zero application changes if the application uses a separate endpoint. Option A is wrong because increasing instance size is a vertical scaling approach but may not help with complex joins. Option B is wrong because ElastiCache requires application code changes. Option D is wrong because DynamoDB is a different database and would require significant application rework.

Answer

Migrate the database to Amazon DynamoDB Global Tables.

Answer

Implement Amazon ElastiCache in front of the database to cache query results.

Answer

Increase the DB instance class to a larger size with more vCPUs.

Question 11

A company uses Amazon S3 to store sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with a customer-managed key (SSE-KMS). What is the MOST secure way to enforce this requirement across all S3 buckets?

Accepted Answer

Use an S3 bucket policy that denies PutObject if the x-amz-server-side-encryption-aws-kms-key-id header is not present.. Option A is correct because S3 bucket policies can deny PutObject requests that do not specify the required encryption, ensuring SSE-KMS is used. Option B is wrong because S3 default encryption only applies if no encryption header is set, but can be overridden. Option C is wrong because IAM policies can restrict API calls but not enforce encryption on objects. Option D is wrong because AWS Config can detect non-compliant objects but not prevent them.

Answer

Use AWS Config rules to detect unencrypted objects and remediate with Lambda.

Answer

Enable default encryption on each bucket with SSE-KMS.

Answer

Create an IAM policy that requires kms:Encrypt permission for all S3 operations.

Question 12

A company is running a batch processing job on an EC2 instance that processes data from an S3 bucket and writes results to another S3 bucket. The job runs once per hour and takes about 20 minutes. The company wants to optimize costs by only paying for compute time when the job is running. Which solution is MOST cost-effective?

Accepted Answer

Use AWS Batch with spot instances to run the job only when needed.. Option D is correct because AWS Batch automatically provisions and terminates EC2 instances based on job queue, and can use spot instances for cost savings. Option A is wrong because Reserved Instances require 1-year commitment. Option B is wrong because keeping the instance running incurs costs even when idle. Option C is wrong because Lambda has a 15-minute timeout limit.

Answer

Convert the batch job into an AWS Lambda function.

Answer

Purchase a Reserved Instance for the EC2 instance to reduce hourly cost.

Answer

Use a t3.micro instance and keep it running 24/7 since it's low cost.

Question 13

A company has a legacy application that runs on an EC2 instance with a single EBS volume. The application stores temporary data on a second EBS volume that is attached to the instance. The company wants to improve durability of the temporary data without increasing costs significantly. What should the company do?

Accepted Answer

Move the temporary data to an instance store volume if the instance type supports it.. Option B is correct because instance store volumes are ephemeral but provide low-cost storage; however, they are not durable. For temporary data, using an EBS volume with snapshots is not cost-effective. Option A is wrong because RAID with additional EBS volumes increases cost. Option C is wrong because increasing IOPS adds cost. Option D is wrong because S3 is not block-level storage.

Answer

Increase the IOPS of the current EBS volume to improve performance.

Answer

Use Amazon S3 for temporary data storage.

Answer

Add additional EBS volumes and set up RAID 1 for mirroring.

Question 14

A company is using Amazon CloudFront to deliver static content from an S3 bucket. The company wants to ensure that users can only access content through CloudFront and not directly from the S3 bucket. What should the company do?

Accepted Answer

Use CloudFront Origin Access Control (OAC) and update the bucket policy to only allow access from the CloudFront distribution.. Option C is correct by using Origin Access Control (OAC) to restrict S3 bucket access to only CloudFront. Option A is wrong because it does not restrict direct access. Option B is wrong because Object Ownership is not a security feature. Option D is wrong because CloudFront key pairs are for signed URLs, not bucket access.

Answer

Set S3 Object Ownership to BucketOwnerPreferred.

Answer

Configure the S3 bucket policy to allow public read access.

Answer

Generate CloudFront key pairs and require signed URLs for all content.

Question 15

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application experiences high traffic during business hours and low traffic at night. The company wants to automatically scale the instances based on CPU utilization. Which TWO steps are required to achieve this?

Accepted Answer

Create a dynamic scaling policy based on the average CPU utilization metric.. Options A and C are correct. An Auto Scaling group is needed to manage the instances, and a scaling policy based on CPU utilization is needed. Option B is wrong because a scheduled scaling policy is based on time, not CPU. Option D is wrong because a Network Load Balancer is not required. Option E is wrong because CloudWatch alarm is part of the scaling policy but not the primary requirement; the policy itself is needed.

Answer

Configure a scheduled scaling policy to add instances during business hours.

Answer

Replace the ALB with a Network Load Balancer for better performance.

Answer

Create a CloudWatch alarm that sends an email when CPU exceeds 80%.